#pragma once #include #include #include #include #define AUTO_ASSEMBLE_TRAMPOLINE(ADDRESS, TRAMPOLINE_LENGTH, INSTRUCTIONS) \ do { \ auto allocMemory = Memory::AllocateNearbyMemory(ADDRESS, sizeof INSTRUCTIONS + 14); \ Memory::CreateTrampoline(ADDRESS, allocMemory, TRAMPOLINE_LENGTH); \ Memory::WriteInstructions(allocMemory, INSTRUCTIONS, sizeof INSTRUCTIONS, ADDRESS + TRAMPOLINE_LENGTH); \ } while (false) namespace UT { // Typedef used by Unreal Engine typedef int8_t int8; typedef int16_t int16; typedef int32_t int32; typedef int64_t int64; typedef uint8_t uint8; typedef uint16_t uint16; typedef uint32_t uint32; typedef uint64_t uint64; } struct AOBScanEntry { uint8_t** address; std::function getSignature; const char* featureName; std::string moduleName = ""; // "" = main exe DWORD protection = PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_READWRITE | PAGE_EXECUTE_WRITECOPY; intptr_t offset = 0; }; namespace AOBScan { // Helper template to create entry with ObfuscatedString template static AOBScanEntry Make(uint8_t** addr, ObfStr& obf, const char* name, std::string module = "", DWORD prot = PAGE_EXECUTE_READ) { return AOBScanEntry{ addr, [&, obf]() { return obf.decrypt(); }, name, module, prot, 0 }; } } enum class OffsetCalcType { None, GetOffsetFromOpcode, UE_CalculateOffset }; struct OffsetScanEntry { uint8_t** outAddress; // Address where the pointer will be stored std::function getSignature; // decrypted AOB std::string name; // Name for the log (GWorlds ...) OffsetCalcType calcType; // Method to calculate offset UT::int32* outOffset = nullptr; // Offset pointer to update size_t opcodeOffset = 0; // Relative offset for GetOffsetFromOpcode method DWORD protection = PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_READWRITE | PAGE_EXECUTE_WRITECOPY; }; namespace OffsetScan { // Helper template to create an entry template static OffsetScanEntry Make(uint8_t** addr, ObfStr& obf, const char* featureName, OffsetCalcType type, UT::int32* outOffsetPtr, size_t opOffset = 0, DWORD prot = PAGE_EXECUTE_READ) { return OffsetScanEntry{ addr, [&obf]() { return obf.decrypt(); }, // signature lambda featureName, type, outOffsetPtr, opOffset, prot }; } } class Memory { public: /** * Get offset from opcode. * * @param opcode : The address where the offset begins. */ static uint8_t* GetOffsetFromOpcode(uint8_t* opcode, int extraOffset = 0); /** * Converts flkoat 32 bits into a char*. * * @param value : The value to encode. */ static const char* Float32ToHexBytes(float value); /** * Read x bytes in memory. * * @param address : The address to read. * @param size : The size in bytes to read * @std::vector : The bytes read. */ static std::vector ReadBytes(const void* addr, std::size_t size); /** * Patch x bytes in memory. * * @param address : The address to patch. * @param bytes : The bytes to patch * @param len : The number of bytes to be patched */ static void PatchBytes(void* address, const char* bytes, size_t len); /** * Restore x bytes in memory. * * @param address : The address to patch. */ static void RestoreBytes(void* address); /** * Achieve an AOB scan in memory. * * @param module_name : The executable to scan. * @param signature : The signature to search for (eg : 7F ?? F3 0F ?? ?? ?? F2) * @param protect_flags : Page protection (PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_READWRITE | PAGE_EXECUTE_WRITECOPY) * @param log : If any log is to be used * @return uint_8* : Pointer to address where AOB is found. */ static uint8_t* AOBScan(const std::string& module_name, const std::string& signature, DWORD protect_flags, std::shared_ptr log = nullptr); /** * Achieve an AOB scan in memory by batch. * * @param const std::vector& entries : AOB signatures of AOBScanEntry type. * @param logger : If any log is to be used */ static void AOBScanBatch(const std::vector& entries, std::shared_ptr logger); /** * Achieve an unreal offsets scan by batch. * * @param const std::vector& entries : AOB signatures of OffsetScanEntry type. * @param baseModule : The starting address of module scanned. * @param logger : If any log is to be used * @param moduleName : The module targeted (.exe, .dll ...) */ static void OffsetScanBatch(const std::vector& entries, uint8_t* baseModule, std::shared_ptr logger, const std::string& moduleName = ""); static std::string ByteToHexEscaped(const BYTE byte); /** * Set or clear VEH hardware breakpoint. * * @param targetAddress : The memory target to set a VEH breakpoint. * @param vehHandle : The VEH handle (nullptr when to set breakpoint or a handle when to unset * @param enable : Set or unset the VEH debugger * @param pVEH : The function where to detour (set to nullptr to unset) * @param hwIndex : The hawdware breakpoint to set (0 - 4) * @return hwIndex : The VEH breakpoint handle */ static PVOID SetupOrClearHardwareBreakPointForAllThreads(uintptr_t targetAddress, PVOID vehHandle, bool enable, PVECTORED_EXCEPTION_HANDLER pVEH = nullptr, int hwIndex = 0); private: static MODULEINFO WaitForModule(const std::string& module_name, int timeoutMs = 15000, int intervalMs = 500); struct PatchInfo { void* address; std::vector originalBytes; bool hasTrampoline = false; void* trampolineDestination = nullptr; }; static std::unordered_map patches; };