|
1 | 1 | use crate::config::Config; |
2 | | -use crate::patch_engine::{apply_patch, PatchDef}; |
3 | 2 | use crate::util::api::Api; |
| 3 | +use crate::util::iat_hook::hook_iat; |
| 4 | +use crate::util::pattern; |
| 5 | +use std::ffi::c_void; |
| 6 | +use std::sync::atomic::{AtomicUsize, Ordering}; |
| 7 | + |
| 8 | +const WINHTTP_DLL: &str = "winhttp.dll"; |
| 9 | +const WINHTTP_OPEN_REQUEST: &str = "WinHttpOpenRequest"; |
| 10 | +// WINHTTP_FLAG_SECURE = 0x00800000 |
| 11 | +const WINHTTP_FLAG_SECURE: u32 = 0x0080_0000; |
| 12 | + |
| 13 | +type WinHttpOpenRequestFn = unsafe extern "system" fn( |
| 14 | + *mut c_void, *const u16, *const u16, *const u16, |
| 15 | + *const u16, *const *const u16, u32, |
| 16 | +) -> *mut c_void; |
| 17 | + |
| 18 | +static ORIG_OPEN_REQUEST: AtomicUsize = AtomicUsize::new(0); |
4 | 19 |
|
5 | 20 | pub fn apply(api: &Api, config: &Config) { |
6 | | - apply_patch( |
7 | | - api, |
8 | | - config, |
9 | | - &PatchDef { |
10 | | - name: "关闭网络加密 1", |
11 | | - section: "DisableEncryption", |
12 | | - pattern: None, |
13 | | - pattern_offset: 0, |
14 | | - known_offsets: &[0x17D200C], |
15 | | - expected: &[0xF5], |
16 | | - patch: &[0x00], |
17 | | - }, |
18 | | - ); |
19 | | - apply_patch( |
20 | | - api, |
21 | | - config, |
22 | | - &PatchDef { |
23 | | - name: "关闭网络加密 2", |
24 | | - section: "DisableEncryption", |
25 | | - pattern: None, |
26 | | - pattern_offset: 0, |
27 | | - known_offsets: &[0x17D2010], |
28 | | - expected: &[0xF5], |
29 | | - patch: &[0x00], |
30 | | - }, |
31 | | - ); |
32 | | - apply_patch( |
33 | | - api, |
34 | | - config, |
35 | | - &PatchDef { |
36 | | - name: "关闭 TLS", |
37 | | - section: "DisableTLS", |
38 | | - pattern: None, |
39 | | - pattern_offset: 0, |
40 | | - known_offsets: &[0xE0D3FB], |
41 | | - expected: &[0x80], |
42 | | - patch: &[0x00], |
43 | | - }, |
44 | | - ); |
| 21 | + apply_disable_encryption(api, config); |
| 22 | + apply_disable_tls(api, config); |
| 23 | +} |
| 24 | + |
| 25 | +fn apply_disable_encryption(api: &Api, config: &Config) { |
| 26 | + if !config.is_enabled("DisableEncryption") { |
| 27 | + return; |
| 28 | + } |
| 29 | + |
| 30 | + let found = pattern::scan_bytes(api, b"cannot encrypt.\0"); |
| 31 | + if found == 0 { |
| 32 | + api.log_warn("关闭网络加密: 未找到加密标识字符串"); |
| 33 | + return; |
| 34 | + } |
| 35 | + |
| 36 | + let addr_bytes = (found as u32).to_le_bytes(); |
| 37 | + // 68 [addr] = PUSH <string_addr> |
| 38 | + let mut push_sig = [0u8; 5]; |
| 39 | + push_sig[0] = 0x68; |
| 40 | + push_sig[1..5].copy_from_slice(&addr_bytes); |
| 41 | + |
| 42 | + let text_base = api.text_base(); |
| 43 | + let text_size = api.text_size(); |
| 44 | + let mut search_start = text_base; |
| 45 | + let mut patched = 0u32; |
| 46 | + |
| 47 | + loop { |
| 48 | + let remaining = text_size.saturating_sub((search_start - text_base) as u32); |
| 49 | + if remaining < 5 { |
| 50 | + break; |
| 51 | + } |
| 52 | + |
| 53 | + let push_site = api.aob_scan(search_start, remaining, &push_sig, "xxxxx"); |
| 54 | + if push_site == 0 { |
| 55 | + break; |
| 56 | + } |
| 57 | + |
| 58 | + if let Some(func_start) = find_function_start(api, push_site, text_base) { |
| 59 | + if patch_encrypt_flag_in_function(api, func_start, push_site) { |
| 60 | + patched += 1; |
| 61 | + } |
| 62 | + } |
| 63 | + |
| 64 | + search_start = push_site + 5; |
| 65 | + } |
| 66 | + |
| 67 | + if patched > 0 { |
| 68 | + api.log_info(&format!("补丁已应用: 关闭网络加密 ({patched} 处)")); |
| 69 | + } else { |
| 70 | + api.log_warn("关闭网络加密: 未找到加密标志"); |
| 71 | + } |
| 72 | +} |
| 73 | + |
| 74 | +fn find_function_start(api: &Api, addr: usize, text_base: usize) -> Option<usize> { |
| 75 | + // 55 8B EC 6A FF = PUSH EBP / MOV EBP,ESP / PUSH -1 |
| 76 | + let prologue = [0x55, 0x8B, 0xEC, 0x6A, 0xFF]; |
| 77 | + for back in 1..0x800usize { |
| 78 | + let candidate = addr.checked_sub(back)?; |
| 79 | + if candidate < text_base { |
| 80 | + return None; |
| 81 | + } |
| 82 | + let mut buf = [0u8; 5]; |
| 83 | + if api.mem_read(candidate, &mut buf) && buf == prologue { |
| 84 | + return Some(candidate); |
| 85 | + } |
| 86 | + } |
| 87 | + None |
| 88 | +} |
| 89 | + |
| 90 | +fn patch_encrypt_flag_in_function(api: &Api, func_start: usize, ref_site: usize) -> bool { |
| 91 | + let func_end = ref_site + 0x200; |
| 92 | + // MOV dword ptr [param_1+4], imm32 → C7 41 04 xx xx xx xx |
| 93 | + let mut scan_addr = func_start; |
| 94 | + while scan_addr < func_end { |
| 95 | + let remaining = (func_end - scan_addr) as u32; |
| 96 | + if remaining < 7 { |
| 97 | + break; |
| 98 | + } |
| 99 | + let site = api.aob_scan(scan_addr, remaining, &[0xC7, 0x41, 0x04], "xxx"); |
| 100 | + if site == 0 { |
| 101 | + break; |
| 102 | + } |
| 103 | + let mut val_buf = [0u8; 4]; |
| 104 | + if api.mem_read(site + 3, &mut val_buf) { |
| 105 | + let val = u32::from_le_bytes(val_buf); |
| 106 | + if val != 0 && val < 0x1000 { |
| 107 | + let zero = [0u8; 4]; |
| 108 | + if api.mem_write(site + 3, &zero) { |
| 109 | + return true; |
| 110 | + } |
| 111 | + } |
| 112 | + } |
| 113 | + scan_addr = site + 7; |
| 114 | + } |
| 115 | + false |
| 116 | +} |
| 117 | + |
| 118 | +fn apply_disable_tls(api: &Api, config: &Config) { |
| 119 | + if !config.is_enabled("DisableTLS") { |
| 120 | + return; |
| 121 | + } |
| 122 | + |
| 123 | + let original = unsafe { |
| 124 | + hook_iat( |
| 125 | + api.game_base(), |
| 126 | + WINHTTP_DLL, |
| 127 | + WINHTTP_OPEN_REQUEST, |
| 128 | + hooked_open_request as *const (), |
| 129 | + ) |
| 130 | + }; |
| 131 | + |
| 132 | + if let Some(orig) = original { |
| 133 | + ORIG_OPEN_REQUEST.store(orig as usize, Ordering::SeqCst); |
| 134 | + api.log_info("补丁已应用: 关闭 TLS (WinHttpOpenRequest IAT hook)"); |
| 135 | + } else { |
| 136 | + api.log_warn("关闭 TLS: 未找到 WinHttpOpenRequest 导入"); |
| 137 | + } |
| 138 | +} |
| 139 | + |
| 140 | +unsafe extern "system" fn hooked_open_request( |
| 141 | + h_connect: *mut c_void, |
| 142 | + verb: *const u16, |
| 143 | + object_name: *const u16, |
| 144 | + version: *const u16, |
| 145 | + referrer: *const u16, |
| 146 | + accept_types: *const *const u16, |
| 147 | + flags: u32, |
| 148 | +) -> *mut c_void { |
| 149 | + let orig_addr = ORIG_OPEN_REQUEST.load(Ordering::SeqCst); |
| 150 | + if orig_addr == 0 { |
| 151 | + return std::ptr::null_mut(); |
| 152 | + } |
| 153 | + |
| 154 | + let orig: WinHttpOpenRequestFn = std::mem::transmute(orig_addr); |
| 155 | + orig(h_connect, verb, object_name, version, referrer, accept_types, flags & !WINHTTP_FLAG_SECURE) |
45 | 156 | } |
0 commit comments