I've seen few requests for the range patch so i wanted to do it. I guess the only way to patch it without bypassing gameguard is with injected dll, which need to be injected before gameguard loads. Gameguard detected the patch at startup (protection error), but if we wait the sro to be loaded we can modify the value of pointers with the injected dll. I tried patching static address, but game guard detected it few minutes later. That means zoomhack, etc are not possible.
Binarys: attached
scan: http://www.virustotal.com/file…6ffb15276ff86e-1307849807
source:
Esro Loader.dll.cpp
[cs]#include "windows.h"
[cs]#include "windows.h"
void WriteMemory(DWORD address, LPVOID patch, DWORD size)
{
DWORD oldProtect;
VirtualProtect((LPVOID)address, 4, PAGE_EXECUTE_READWRITE, &oldProtect);
memcpy((LPVOID)address, patch, size);
}
DWORD WINAPI PatchRangeThread(LPVOID lpParam) //need to wait for sro window or we get protection error
{
while(1)
{
HWND hWnd = FindWindowA("CLIENT", 0);
DWORD pid = 0;
GetWindowThreadProcessId(hWnd, &pid);
if(pid == GetCurrentProcessId())
break;
Sleep(10);
}
float range = 5000;
WriteMemory(0xD10678, &range, sizeof(float));
return 0;
}
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
if(ul_reason_for_call == DLL_PROCESS_ATTACH)
{
CreateMutexA(0, 0, "Silkroad Online Launcher");
CreateMutexA(0, 0, "Ready");
CreateThread(0, 0, &PatchRangeThread, 0, 0, 0);
}
return true;
}
[/cs]
Esro Loader.cpp
[cs]#include
#include
#include
using namespace std;
string OpenFile(char *filter = "sro_client.exe (*.exe*)")
{
OPENFILENAMEA ofn;
char fileName[MAX_PATH] = "";
ZeroMemory(&ofn, sizeof(ofn));
ofn.lStructSize = sizeof(OPENFILENAME);
ofn.hwndOwner = NULL;
ofn.lpstrFilter = filter;
ofn.lpstrFile = fileName;
ofn.nMaxFile = MAX_PATH;
ofn.Flags = OFN_EXPLORER | OFN_FILEMUSTEXIST | OFN_HIDEREADONLY;
ofn.lpstrDefExt = "";
string fileNameStr;
if(GetOpenFileNameA(&ofn))
fileNameStr = fileName;
return fileNameStr;
}
void InjectDLL(HANDLE hProcess, LPCSTR lpszDLLPath)
{
DWORD dwMemSize = lstrlenA(lpszDLLPath) + 1;
LPVOID lpBaseAddr = VirtualAllocEx(hProcess, NULL, dwMemSize, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProcess, lpBaseAddr, lpszDLLPath, dwMemSize, NULL);
HMODULE hUserDLL = LoadLibraryA("kernel32.dll");
LPVOID lpFuncAddr = GetProcAddress(hUserDLL, "LoadLibraryA");
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpFuncAddr, lpBaseAddr, 0, NULL);
WaitForSingleObject(hThread, INFINITE);
FreeLibrary(hUserDLL);
CloseHandle(hThread);
VirtualFreeEx(hProcess, lpBaseAddr, 0, MEM_RELEASE);
}
HANDLE CreateSusProc(LPCSTR appName, LPSTR commandLine, LPCSTR dllPath)
{
STARTUPINFOA si;
PROCESS_INFORMATION pi;
memset(&si, 0, sizeof(si));
CreateProcessA(appName, commandLine, 0, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
InjectDLL(pi.hProcess, dllPath);
return pi.hThread;
}
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{
char dllpath[MAX_PATH];
GetCurrentDirectoryA(sizeof(dllpath), dllpath);
strcat_s(dllpath, "\\esroLoaderdll.dll");
string args = " 0 /38 0 0";
string path = OpenFile();
path += args;
HANDLE hThread = CreateSusProc("sro_client.exe", (LPSTR)path.c_str(), dllpath);
ResumeThread(hThread);
return 0;
}
[/cs]
quelle und dl link
http://www.elitepvpers.com/for…o-loader-range-patch.html
Meint ihr das funzt?
edit: grade selber ausprobiert, funzt
</iostream>