Xemectrum

Code: Select all

//--------------------------------------------------------------------------
#define jmp(frm, to) (int)(((int)to - (int)frm) - 5)
#define call(frm, to) (int)(((int)to - (int)frm) - 5)
#define CountOf(array) (sizeof(array)/sizeof(array[0]))

#include <vcl.h>


#include "Unit1.h"
#include <tchar.h>
#pragma hdrstop
//---------------------------------------------------------------------------
#pragma package(smart_init)
#pragma resource "*.dfm"
TForm1 *Form1;

bool bUpdated = false;
bool bDoHP, bDoMP = false;
int iHPMethod = 0, iMPMethod = 0;
int iOptedHP = 100, iOptedMP = 50;
int iHPKey, iMPKey;

DWORD dwStatAddy, dwStatJump;
int iHP, iMP, iMaxHP, iMaxMP;
char StatAOB[19] = "\xE8\x00\x00\x00\x00\x8B\x4D\x00\xE8\x00\x00\x00\x00\x85\xC0\x75\x00\x8B\x4D";
//E8 ? ? ? ? 8B 4D ? E8 ? ? ? ? 85 C0 75 ? 8B 4D
char StatMem[4];

DWORD dwStatPtr;
int iHPOffset, iMPOffset;
char StatPtrAOB[15] = "\xA1\x00\x00\x00\x00\xC3\x8B\x01\x85\xC0\x74\x06\x8B\x08\x50";
//A1 ? ? ? ? C3 8B 01 85 C0 74 06 8B 08 50
char HPAOB[15] = "\x8B\x86\x00\x00\x00\x00\x3B\x45\x00\x8D\xBE\x00\x00\x00\x00";
//8B 86 ? ? ? ? 3B 45 ? 8D BE ? ? 00 00

int iAlertPtr, iHPAlertOffset, iMPAlertOffset;
char AlertPtrAOB[16] = "\xA1\x00\x00\x00\x00\x8B\x00\x00\x00\x00\x00\x53\x56\x8B\xF1\x8D";
//A1 ? ? ? ? 8B ? ? ? ? ? 53 56 8B F1 8D
char HPAlertAOB[15] = "\x8B\x00\x00\x00\x00\x00\x53\x56\x8B\xF1\x8D\x00\x00\x33\xDB";
//8B ? ? ? ? ? 53 56 8B F1 8D ? ? 33 DB

bool Check(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
	for(; *szMask; ++szMask, ++pData, ++bMask)
	{
		if(*szMask == 'x' && *pData != *bMask )
		{
			return false;
		}
	}

	return (*szMask) == NULL;
}

DWORD FindPattern(BYTE *bMask, char* szMask, DWORD dwOffset)
{
	DWORD dwAddress = 0x00400000;
	DWORD dwLen = 0x00D00000;

	for(DWORD i=0; i < dwLen; i++)
	{
		if(Check((BYTE*)(dwAddress + i), bMask, szMask))
		{
			return (DWORD)(dwAddress + i + dwOffset);
		}
	}

	MessageBox(NULL, "Update Failed. :(", "epic fail", MB_OK);
	return TerminateProcess(GetCurrentProcess(), 0);
}

__inline ULONG_PTR ReadPointer(ULONG_PTR* ulBase, INT nOffset)
{
   if (!IsBadReadPtr((VOID*)ulBase, sizeof(ULONG_PTR)))
	{
		if (!IsBadReadPtr((VOID*)((*(ULONG_PTR*)ulBase)+nOffset), sizeof(ULONG_PTR)))
		{
			return *(ULONG_PTR*)((*(ULONG_PTR*)ulBase)+nOffset);
        }
	}
	return 0;
}

__inline void WritePointer(ULONG_PTR* ulBase, INT nOffset, DWORD dwValue)
{
   if (!IsBadReadPtr((VOID*)ulBase, sizeof(ULONG_PTR)))
   {
		if (!IsBadWritePtr((VOID*)((*(ULONG_PTR*)ulBase)+nOffset), sizeof(ULONG_PTR)))
		{
			*(DWORD*)(*(DWORD*)ulBase + nOffset) = dwValue;
		}
   }
}

//---------------------------------------------------------------------------
__fastcall TForm1::TForm1(TComponent* Owner)
	: TForm(Owner)
{
}
//---------------------------------------------------------------------------
void UpdateAddresses()
{
	dwStatAddy = (int)FindPattern((BYTE*)StatAOB, "x????xx?x????xxx?xx", 0);
	dwStatJump = *(int*)(dwStatAddy + 1) + dwStatAddy + 5;
	memcpy((void*)StatMem, (void*)(dwStatAddy + 1), 4);

	dwStatPtr = *(int*)FindPattern((BYTE*)StatPtrAOB, "x????xxxxxxxxxx", 1);
	iHPOffset = *(int*)FindPattern((BYTE*)HPAOB, "xx????xx?xx??xx", 2);
	iMPOffset = iHPOffset + 4;

	iAlertPtr = *(int*)FindPattern((BYTE*)AlertPtrAOB, "x????x?????xxxxx", 1);
	iHPAlertOffset = *(int*)FindPattern((BYTE*)HPAlertAOB, "x?????xxxxx??xx", 2);
	iMPAlertOffset = iHPAlertOffset + 4;

	bUpdated = true;
}

void UpdateStats()
{
	for(;;)
	{
		WritePointer((ULONG_PTR*)iAlertPtr, iHPAlertOffset, 20);
		WritePointer((ULONG_PTR*)iAlertPtr, iMPAlertOffset, 20);

		iHP = (int)ReadPointer((ULONG_PTR*)dwStatPtr, iHPOffset);
		iMP = (int)ReadPointer((ULONG_PTR*)dwStatPtr, iMPOffset);

		Sleep(50);
	}
}

DWORD check = 0;

__declspec(naked) void __stdcall StatHook()
{
	__asm
	{
		push eax
		mov eax,[esp+0x08]
		mov [iHP],eax
		mov eax,[esp+0x0C]
		mov [iMaxHP],eax
		mov eax,[esp+0x10]
		mov [iMP],eax
		mov eax,[esp+0x14]
		mov [iMaxMP],eax
		mov [check],0x00000001
		pop eax
		jmp dword ptr [dwStatJump]
   }
}

void GetMaxValues()
{
	check = 0;
	while (bUpdated)
	{
		if (check == 0)
		{
			*(DWORD*)(dwStatAddy + 1) = call(dwStatAddy, StatHook);
		}
		else if (check != 0)
		{
			memcpy((void*)(dwStatAddy + 1), (void*)StatMem, 4);
			return; //exit the loop
		}
		Sleep(10);
	}
}

void __fastcall TForm1::FormCreate(TObject *Sender)
{
	UpdateAddresses();
	CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&UpdateStats, 0, 0, 0);
}
//---------------------------------------------------------------------------

void __fastcall TForm1::Timer2Timer(TObject *Sender) //I got lazy with the coding... :P
{
	if(bUpdated)
	{
		if (iMaxHP != 0 && iMaxMP != 0)
		{
			Image1->Width = (200 * iHP) / iMaxHP;
			StaticText1->Caption = IntToStr(iHP) + " / " + IntToStr(iMaxHP);
			Image2->Width = (200 * iMP) / iMaxMP;
			StaticText2->Caption = IntToStr(iMP) + " / " + IntToStr(iMaxMP);
		}
		else
		{
			Image1->Width = 200;
			StaticText1->Caption = IntToStr(iHP) + " / NULL";
			Image2->Width = 200;
			StaticText2->Caption = IntToStr(iMP) + " / NULL";
		}
	}
}
//---------------------------------------------------------------------------
DWORD dwOpenProcess, dwOPReturn;

void __declspec(naked) __stdcall HsCrcAsm() //credits to nimo1993 for this
{
	__asm
	{
		mov eax,fs:[0x00000020]
		cmp eax,[esp+0x0C]
		jne Return
		mov fs:[0x00000034],0x00000057
		xor eax,eax
		ret 0x000C

		Return:
		push ebp
		mov ebp,esp
		jmp dword ptr [dwOPReturn]
	}
}

void __fastcall TForm1::Button1Click(TObject *Sender)
{
	dwOpenProcess = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"), "OpenProcess"); //obtain an address for OpenProcess
	dwOPReturn = dwOpenProcess + 5;

	if (*(BYTE*)dwOpenProcess != 0xE9) //if the function is not hooked, then hook it
	{
		DWORD randomdw;
		VirtualProtect((void*)dwOpenProcess, 5, PAGE_EXECUTE_READWRITE, &randomdw);
	
		*(BYTE*)dwOpenProcess = 0xE9;
		*(DWORD*)(dwOpenProcess + 1) = jmp(dwOpenProcess, HsCrcAsm);
	}

	Button1->Enabled = false;
}
//---------------------------------------------------------------------------

void __fastcall TForm1::ComboBox1Change(TObject *Sender)
{
	iHPMethod = ComboBox1->ItemIndex;
}
//---------------------------------------------------------------------------

void __fastcall TForm1::ComboBox2Change(TObject *Sender)
{
	iMPMethod = ComboBox2->ItemIndex;
}
//---------------------------------------------------------------------------

void __fastcall TForm1::Edit1Change(TObject *Sender)
{
	if (atoi(Edit1->Text.t_str()) > 0) //allow nonzero values for the HP
	{
		iOptedHP = atoi(Edit1->Text.t_str());
	}
}
//---------------------------------------------------------------------------

void __fastcall TForm1::Edit2Change(TObject *Sender)
{
	iOptedMP = atoi(Edit2->Text.t_str()); //allow all values for the MP
}
//---------------------------------------------------------------------------
HWND MShWnd;

HWND FindProcessWindow(__in DWORD dwProcessId, __in LPCTSTR lpcszClass) //all hail Irwin
{
  TCHAR szBuffer[200];
  DWORD dwTemp;

  for (HWND hWnd = GetTopWindow(NULL); hWnd != NULL; hWnd = GetNextWindow(hWnd, GW_HWNDNEXT))
  {
	if (GetClassName(hWnd, szBuffer, CountOf(szBuffer)) == 0)
	  continue;

	if (_tcsicmp(szBuffer, lpcszClass) != 0)
	  continue;

	GetWindowThreadProcessId(hWnd, &dwTemp);

	if (dwTemp == dwProcessId)
	  return hWnd;
  }

  return NULL;
}

void PotHP()
{
	MShWnd = FindProcessWindow(GetCurrentProcessId(), "MapleStoryClass");
	while(bDoHP)
	{
		if (iHPMethod == 1) //percent potter
		{
			if (iMaxHP != 0 && iOptedHP >= (int)((100 * iHP) / iMaxHP) && iHP > 0) //don't bother potting if the character is dead
			{
				PostMessage(MShWnd, WM_KEYDOWN, iHPKey, MapVirtualKey(iHPKey, 0) << 16);
			}
		}
		else
		{
			if (iOptedHP >= iHP && iHP > 0) //don't bother potting if the character is dead
			{
				PostMessage(MShWnd, WM_KEYDOWN, iHPKey, MapVirtualKey(iHPKey, 0) << 16);
			}
		}

		Sleep(150);
	}
}

void PotMP()
{
	MShWnd = FindProcessWindow(GetCurrentProcessId(), "MapleStoryClass");
	while(bDoMP)
	{
		if (iMPMethod == 1) //percent potter
		{
			if (iMaxMP != 0 && iOptedMP >= (int)((100 * iMP) / iMaxMP))
			{
				PostMessage(MShWnd, WM_KEYDOWN, iMPKey, MapVirtualKey(iMPKey, 0) << 16);
			}
		}
		else
		{
			if (iOptedMP >= iMP)
			{
				PostMessage(MShWnd, WM_KEYDOWN, iMPKey, MapVirtualKey(iMPKey, 0) << 16);
			}
		}

		Sleep(150);
	}
}

void __fastcall TForm1::ComboBox3Change(TObject *Sender)
{
	if (ComboBox3->Text.Length() == 1) //this is an easy way to get character codes, which are just VKs
	{
		iHPKey = ComboBox3->Text.t_str()[0];
	}
	else
	{
		switch (ComboBox3->ItemIndex)
		{
			case 0: iHPKey = VK_SHIFT; break;
			case 1: iHPKey = VK_CONTROL; break;
			case 2: iHPKey = VK_MENU; break;
			case 3: iHPKey = VK_SPACE; break;
			case 4: iHPKey = VK_END; break;
			case 5: iHPKey = VK_HOME; break;
			case 6: iHPKey = VK_INSERT; break;
			case 7: iHPKey = VK_DELETE; break;				
		}
	}
}
//---------------------------------------------------------------------------

void __fastcall TForm1::ComboBox4Change(TObject *Sender)
{
	if (ComboBox3->Text.Length() == 1)
	{
		iMPKey = ComboBox4->Text.t_str()[0];
	}
	else
	{
		switch (ComboBox4->ItemIndex)
		{
			case 0: iMPKey = VK_SHIFT; break;
			case 1: iMPKey = VK_CONTROL; break;
			case 2: iMPKey = VK_MENU; break;
			case 3: iMPKey = VK_SPACE; break;
			case 4: iMPKey = VK_END; break;
			case 5: iMPKey = VK_HOME; break;
			case 6: iMPKey = VK_INSERT; break;
			case 7: iMPKey = VK_DELETE; break;				
		}
	}
}
//---------------------------------------------------------------------------

void __fastcall TForm1::Button2Click(TObject *Sender)
{
	CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&GetMaxValues, 0, 0, 0);
}
//---------------------------------------------------------------------------

void __fastcall TForm1::CheckBox1Click(TObject *Sender)
{
	bDoHP ^= true;
	CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&PotHP, 0, 0, 0);
}
//---------------------------------------------------------------------------

void __fastcall TForm1::CheckBox2Click(TObject *Sender)
{
	bDoMP ^= true;
	CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&PotMP, 0, 0, 0);
}
//---------------------------------------------------------------------------