LordGando
|
  |
| Joined: 05 Jul 2011 |
| Total Posts: 6723 |
|
|
| 16 Jun 2013 03:09 PM |
Exploits = [] Successes = [] Config = [ Restore = false, Bar = true [ function AddExploit(name, hex, offset, func) table.insert(Exploits, [ name, hex, offset, func ]) end function GetExploit(index) local tab = Exploits[index] local scan = createMemScan(true) memscan_returnOnlyOneResult(scan, true) memscan_firstScan(scan, soExactValue, vtByteArray, rtTruncated, table.concat(tab[2], " "), nil, 0, 0x00FFFFFF, "", fsmNotAligned, nil, false, false, false, false) memscan_waitTillDone(scan) local result = memscan_getOnlyResult(scan) if (result == nil) then return nil end result = result + tab[3] result = string.format("%x", result) result = string.rep("0", 8-#result) .. result return result end -- Exploit functions here function HashChecker(addr) _, instruction = splitDisassembledString(disassemble(addr)) local hcbyte = "" for i = 1, #instruction do if string.sub(instruction, i, i) == "[" then hcbyte = string.sub(instruction, i+1, i+8) break end end writeBytes(hcbyte, 0x00) print("Disabled - " .. hcbyte) end function ContextChanger(addr, arg) print("ContextChanger invoked.") local calladdr = string.format("%x", tonumber(addr, 16) + 2) _, callInstruction = splitDisassembledString(disassemble(calladdr)) autoAssemble(string.format([[ alloc(newmem,20) label(returnhere) newmem: mov [esi], %s %s jmp returnhere %s: jmp newmem db 90 90 returnhere: ]], control_getCaption(Interface.ContextEdit), callInstruction, addr)) print("Modified context") end function Hook(addr) local script if (Config.Restore) then Config.Restore = false writeBytes(addr, 0x83, 0xEC, 0x14, 0x56, 0x57) return end if Config.Bar then script = control_getCaption(Interface.ScriptEdit) else script = strings_getText(memo_getLines(Interface.Scripts)) end print(script) local mem = string.format("%x", allocateSharedMemory("scropt", #script)) mem = string.rep("0", 8-#mem) .. mem writeString(mem, script) local len = string.format("%x", #script) local assemble = string.format([[ alloc(newmem,2048) label(returnhere) newmem: mov [esp+18], %s mov [esp+1C], %s sub esp,14 push esi push edi jmp returnhere %s: jmp newmem returnhere: ]], mem, len, addr) -- >:3 autoAssemble(assemble) print(addr) end function Noclip(addr) print(addr) if readBytes(addr, 1) == 0xFF then print("We're enabling it.") Config.LegitBytes = readBytes(addr, 7, true) writeBytes(addr, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90) else writeBytes(addr, Config.LegitBytes) end end function DisableOtherChecks(addr) print("Disabling other checks...") writeBytes(addr, 0xEB) end -- Exploit definitions here AddExploit("noclip", [ 0x56, 0x8B, 0xf1, 0x83, 0xf8, 0x18], 12, Noclip) AddExploit("level", [ 0x89, 0x74, 0x24, 0x0C, 0x89, 0x06, 0xe8], 4, ContextChanger) AddExploit("script", [ 0x83, 0xEC, 0x14, 0x56, 0x57, 0x8B, 0x7C, 0x24, 0x2C, 0x85, 0xFF], 0, Hook) AddExploit("hash", [ 0x00, 0x51, 0x53, 0x56, 0x83, 0xCB, 0xFF], 7, HashChecker) AddExploit("checks", [ 0xe4, 0xC7, 0x45, 0xfc, 00, 00, 00, 00, 0x85, 0xC0, 0x74], 10, DisableOtherChecks) -- print("Autoscanning for " .. tostring(#Exploits) .. " exploits...") for i,v in pairs(Exploits) do local exploit = GetExploit(i) if (exploit == nil) then print("Failed to scan exploit " .. v[1]) else print("Successful - " .. v[1] .. " is at " .. exploit) table.insert(Successes, [v[1], exploit, v[4]]) end end showMessage(tostring(#Successes) .. " out of " .. tostring(#Exploits) .. " exploits could be found.") -- function DoExploit(name) split = 0 for i = 1, #name do if string.sub(name, i, i) == " " then split = i break end end if split ~= 0 then arg = string.sub(name, split+1) name = string.sub(name, 1, split-1) else arg = "" end print("name: " .. name .. "; arg: " .. arg) for i,v in pairs(Successes) do if v[1] == name then v[3](v[2], arg) end end end -- Interface = [] Interface.Frame = createForm(true) control_setSize(Interface.Frame, 800, 500) Interface.Script = createLabel(Interface.Frame) control_setSize(Interface.Script, 400, 22) control_setCaption(Interface.Script, "Command line - doesn't change context!") control_setPosition(Interface.Script, 0, 7) Interface.ScriptEdit = createEdit(Interface.Frame) control_setPosition(Interface.ScriptEdit, 0, 22) control_setSize(Interface.ScriptEdit, 360, 300) Interface.ScriptBtn = createButton(Interface.Frame) control_setPosition(Interface.ScriptBtn, 360, 22) control_setCaption(Interface.ScriptBtn, ">") control_setSize(Interface.ScriptBtn, 40, 22) control_onClick(Interface.ScriptBtn, function() Config.Bar = true DoExploit("script") end) Interface.Context = createLabel(Interface.Frame) control_setSize(Interface.Context, 400, 22) control_setPosition(Interface.Context, 0, 46) control_setCaption(Interface.Context, "Context changer - doesn't have max; may crash if too high") Interface.ContextEdit = createEdit(Interface.Frame) control_setSize(Interface.ContextEdit, 360, 22) control_setPosition(Interface.ContextEdit, 0, 60) Interface.ContextBtn = createButton(Interface.Frame) control_setSize(Interface.ContextBtn, 40, 22) control_setPosition(Interface.ContextBtn, 360, 60) control_setCaption(Interface.ContextBtn, ">") control_onClick(Interface.ContextBtn, function() DoExploit("level") end) Interface.Checkers = createButton(Interface.Frame) control_setSize(Interface.Checkers, 400, 25) control_setPosition(Interface.Checkers, 0, 85) control_setCaption(Interface.Checkers, "Disable hash checker") control_onClick(Interface.Checkers, function() DoExploit("hash") end) Interface.Restore = createButton(Interface.Frame) control_setSize(Interface.Restore, 400, 25) control_setPosition(Interface.Restore, 0, 110) control_setCaption(Interface.Restore, "Repair script execution") control_onClick(Interface.Restore, function() Config.Restore = true DoExploit("script") end) Interface.Exit = createButton(Interface.Frame) control_setSize(Interface.Exit, 800, 25) control_setPosition(Interface.Exit, 0, 475) control_setCaption(Interface.Exit, "Exit current trainer") Interface.Scripts = createMemo(Interface.Frame) control_setSize(Interface.Scripts, 400, 450) control_setPosition(Interface.Scripts, 400, 0) memo_setScrollbars(Interface.Scripts, ssVertical) Interface.Scripte = createButton(Interface.Frame) control_setSize(Interface.Scripte, 400, 25) control_setPosition(Interface.Scripte, 400, 450) control_setCaption(Interface.Scripte, "Execute script") control_onClick(Interface.Scripte, function() Config.Bar = false DoExploit("script") end)
-LᴏʀᴅGᴀɴᴅᴏ |
|
|
| Report Abuse |
|