[ESRO] Loader with range patch

Quote:

Originally Posted by jremy

I've seen few requests for the range patch so i wanted to do it. I guess the only way to patch it without bypassing gameguard is with injected dll, which need to be injected before gameguard loads. Gameguard detected the patch at startup (protection error), but if we wait the sro to be loaded we can modify the value of pointers with the injected dll. I tried patching static address, but game guard detected it few minutes later. That means zoomhack, etc are not possible.

Binarys: attached

Scan: [Only registered and activated users can see links. Click Here To Register...]

Sources:

Spoiler

esroLoaderdll.cpp:

Code:

#include "windows.h"

void WriteMemory(DWORD address, LPVOID patch, DWORD size)
{
	DWORD oldProtect;
	VirtualProtect((LPVOID)address, 4, PAGE_EXECUTE_READWRITE, &oldProtect);
	memcpy((LPVOID)address, patch, size);
}

DWORD WINAPI PatchRangeThread(LPVOID lpParam) //need to wait for sro window or we get protection error
{
	while(1)
	{
		HWND hWnd = FindWindowA("CLIENT", 0);
		DWORD pid = 0;
		GetWindowThreadProcessId(hWnd, &pid);
		if(pid == GetCurrentProcessId())
			break;

		Sleep(10);
	}

	float range = 5000;
	WriteMemory(0xD10678, &range, sizeof(float));

	return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
	if(ul_reason_for_call == DLL_PROCESS_ATTACH)
	{
		CreateMutexA(0, 0, "Silkroad Online Launcher");
		CreateMutexA(0, 0, "Ready");

		CreateThread(0, 0, &PatchRangeThread, 0, 0, 0);
	}
	return true;
}

esroLoader.cpp:

Code:

#include <windows.h>
#include <string.h>
#include <iostream>
using namespace std;

string OpenFile(char *filter = "sro_client.exe (*.exe*)")
{
	OPENFILENAMEA ofn;
	char fileName[MAX_PATH] = "";
	ZeroMemory(&ofn, sizeof(ofn));

	ofn.lStructSize = sizeof(OPENFILENAME);
	ofn.hwndOwner = NULL;
	ofn.lpstrFilter = filter;
	ofn.lpstrFile = fileName;
	ofn.nMaxFile = MAX_PATH;
	ofn.Flags = OFN_EXPLORER | OFN_FILEMUSTEXIST | OFN_HIDEREADONLY;
	ofn.lpstrDefExt = "";

	string fileNameStr;

	if(GetOpenFileNameA(&ofn))
		fileNameStr = fileName;

	return fileNameStr;
}

void InjectDLL(HANDLE hProcess, LPCSTR lpszDLLPath)
{
	DWORD dwMemSize = lstrlenA(lpszDLLPath) + 1;
	LPVOID lpBaseAddr = VirtualAllocEx(hProcess, NULL, dwMemSize, MEM_COMMIT, PAGE_READWRITE);
	WriteProcessMemory(hProcess, lpBaseAddr, lpszDLLPath, dwMemSize, NULL);
	HMODULE hUserDLL = LoadLibraryA("kernel32.dll");
	LPVOID lpFuncAddr = GetProcAddress(hUserDLL, "LoadLibraryA");
	HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpFuncAddr, lpBaseAddr, 0, NULL);
	WaitForSingleObject(hThread, INFINITE);
	FreeLibrary(hUserDLL);
	CloseHandle(hThread);
	VirtualFreeEx(hProcess, lpBaseAddr, 0, MEM_RELEASE);
}

HANDLE CreateSusProc(LPCSTR appName, LPSTR commandLine, LPCSTR dllPath)
{
	STARTUPINFOA si;
	PROCESS_INFORMATION pi;

	memset(&si, 0, sizeof(si));

	CreateProcessA(appName, commandLine, 0, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);

	InjectDLL(pi.hProcess, dllPath);

	return pi.hThread;
}

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{
	char dllpath[MAX_PATH];
	GetCurrentDirectoryA(sizeof(dllpath), dllpath);
	strcat_s(dllpath, "\\esroLoaderdll.dll");

	string args = " 0 /38 0 0";
	string path = OpenFile();
	path += args;
	
	HANDLE hThread = CreateSusProc("sro_client.exe", (LPSTR)path.c_str(), dllpath);
	ResumeThread(hThread);
	return 0;
}

TY FOR THE SOURCE! this well help Alot of people with there projects im sure.