From 6647ce280001a2f482bfae69cefdb9c47628b251 Mon Sep 17 00:00:00 2001 From: Failzuma Date: Thu, 22 Jan 2026 10:48:34 +0700 Subject: [PATCH] init --- .gitignore | 368 +++++++++++++++++++++++++ EndfieldMetadataDumper.sln | 31 +++ EndfieldMetadataDumper.vcxproj | 134 +++++++++ EndfieldMetadataDumper.vcxproj.filters | 22 ++ main.cpp | 166 +++++++++++ 5 files changed, 721 insertions(+) create mode 100644 .gitignore create mode 100644 EndfieldMetadataDumper.sln create mode 100644 EndfieldMetadataDumper.vcxproj create mode 100644 EndfieldMetadataDumper.vcxproj.filters create mode 100644 main.cpp diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ff15edd --- /dev/null +++ b/.gitignore @@ -0,0 +1,368 @@ +## Ignore Visual Studio temporary files, build results, and +## files generated by popular Visual Studio add-ons. +## +## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore + +# User-specific files +*.rsuser +*.suo +*.user +*.userosscache +*.sln.docstates + +# User-specific files (MonoDevelop/Xamarin Studio) +*.userprefs + +# Mono auto generated files +mono_crash.* + +# Build results +[Dd]ebug/ +[Dd]ebugPublic/ +[Rr]elease/ +[Rr]eleases/ +x64/ +x86/ +[Ww][Ii][Nn]32/ +[Aa][Rr][Mm]/ +[Aa][Rr][Mm]64/ +bld/ +[Bb]in/ +[Oo]bj/ +[Oo]ut/ +[Ll]og/ +[Ll]ogs/ + +# Visual Studio 2015/2017 cache/options directory +.vs/ +# Uncomment if you have tasks that create the project's static files in wwwroot +#wwwroot/ + +# Visual Studio 2017 auto generated files +Generated\ Files/ + +# MSTest test Results +[Tt]est[Rr]esult*/ +[Bb]uild[Ll]og.* + +# NUnit +*.VisualState.xml +TestResult.xml +nunit-*.xml + +# Build Results of an ATL Project +[Dd]ebugPS/ +[Rr]eleasePS/ +dlldata.c + +# Benchmark Results +BenchmarkDotNet.Artifacts/ + +# .NET Core +project.lock.json +project.fragment.lock.json +artifacts/ + +# ASP.NET Scaffolding +ScaffoldingReadMe.txt + +# StyleCop +StyleCopReport.xml + +# Files built by Visual Studio +*_i.c +*_p.c +*_h.h +*.ilk +*.meta +*.obj +*.iobj +*.pch +*.pdb +*.ipdb +*.pgc +*.pgd +*.rsp +*.sbr +*.tlb +*.tli +*.tlh +*.tmp +*.tmp_proj +*_wpftmp.csproj +*.log +*.vspscc +*.vssscc +.builds +*.pidb +*.svclog +*.scc + +# Chutzpah Test files +_Chutzpah* + +# Visual C++ cache files +ipch/ +*.aps +*.ncb +*.opendb +*.opensdf +*.sdf +*.cachefile +*.VC.db +*.VC.VC.opendb + +# Visual Studio profiler +*.psess +*.vsp +*.vspx +*.sap + +# Visual Studio Trace Files +*.e2e + +# TFS 2012 Local Workspace +$tf/ + +# Guidance Automation Toolkit +*.gpState + +# ReSharper is a .NET coding add-in +_ReSharper*/ +*.[Rr]e[Ss]harper +*.DotSettings.user + +# TeamCity is a build add-in +_TeamCity* + +# DotCover is a Code Coverage Tool +*.dotCover + +# AxoCover is a Code Coverage Tool +.axoCover/* +!.axoCover/settings.json + +# Coverlet is a free, cross platform Code Coverage Tool +coverage*.json +coverage*.xml +coverage*.info + +# Visual Studio code coverage results +*.coverage +*.coveragexml + +# NCrunch +_NCrunch_* +.*crunch*.local.xml +nCrunchTemp_* + +# MightyMoose +*.mm.* +AutoTest.Net/ + +# Web workbench (sass) +.sass-cache/ + +# Installshield output folder +[Ee]xpress/ + +# DocProject is a documentation generator add-in +DocProject/buildhelp/ +DocProject/Help/*.HxT +DocProject/Help/*.HxC +DocProject/Help/*.hhc +DocProject/Help/*.hhk +DocProject/Help/*.hhp +DocProject/Help/Html2 +DocProject/Help/html + +# Click-Once directory +publish/ + +# Publish Web Output +*.[Pp]ublish.xml +*.azurePubxml +# Note: Comment the next line if you want to checkin your web deploy settings, +# but database connection strings (with potential passwords) will be unencrypted +*.pubxml +*.publishproj + +# Microsoft Azure Web App publish settings. Comment the next line if you want to +# checkin your Azure Web App publish settings, but sensitive information contained +# in these scripts will be unencrypted +PublishScripts/ + +# NuGet Packages +*.nupkg +# NuGet Symbol Packages +*.snupkg +# The packages folder can be ignored because of Package Restore +**/[Pp]ackages/* +# except build/, which is used as an MSBuild target. +!**/[Pp]ackages/build/ +# Uncomment if necessary however generally it will be regenerated when needed +#!**/[Pp]ackages/repositories.config +# NuGet v3's project.json files produces more ignorable files +*.nuget.props +*.nuget.targets + +# Microsoft Azure Build Output +csx/ +*.build.csdef + +# Microsoft Azure Emulator +ecf/ +rcf/ + +# Windows Store app package directories and files +AppPackages/ +BundleArtifacts/ +Package.StoreAssociation.xml +_pkginfo.txt +*.appx +*.appxbundle +*.appxupload + +# Visual Studio cache files +# files ending in .cache can be ignored +*.[Cc]ache +# but keep track of directories ending in .cache +!?*.[Cc]ache/ + +# Others +ClientBin/ +~$* +*~ +*.dbmdl +*.dbproj.schemaview +*.jfm +*.pfx +*.publishsettings +orleans.codegen.cs + +# Including strong name files can present a security risk +# (https://github.com/github/gitignore/pull/2483#issue-259490424) +#*.snk + +# Since there are multiple workflows, uncomment next line to ignore bower_components +# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) +#bower_components/ + +# RIA/Silverlight projects +Generated_Code/ + +# Backup & report files from converting an old project file +# to a newer Visual Studio version. Backup files are not needed, +# because we have git ;-) +_UpgradeReport_Files/ +Backup*/ +UpgradeLog*.XML +UpgradeLog*.htm +ServiceFabricBackup/ +*.rptproj.bak + +# SQL Server files +*.mdf +*.ldf +*.ndf + +# Business Intelligence projects +*.rdl.data +*.bim.layout +*.bim_*.settings +*.rptproj.rsuser +*- [Bb]ackup.rdl +*- [Bb]ackup ([0-9]).rdl +*- [Bb]ackup ([0-9][0-9]).rdl + +# Microsoft Fakes +FakesAssemblies/ + +# GhostDoc plugin setting file +*.GhostDoc.xml + +# Node.js Tools for Visual Studio +.ntvs_analysis.dat +node_modules/ + +# Visual Studio 6 build log +*.plg + +# Visual Studio 6 workspace options file +*.opt + +# Visual Studio 6 auto-generated workspace file (contains which files were open etc.) +*.vbw + +# Visual Studio LightSwitch build output +**/*.HTMLClient/GeneratedArtifacts +**/*.DesktopClient/GeneratedArtifacts +**/*.DesktopClient/ModelManifest.xml +**/*.Server/GeneratedArtifacts +**/*.Server/ModelManifest.xml +_Pvt_Extensions + +# Paket dependency manager +.paket/paket.exe +paket-files/ + +# FAKE - F# Make +.fake/ + +# CodeRush personal settings +.cr/personal + +# Python Tools for Visual Studio (PTVS) +__pycache__/ +*.pyc + +# Cake - Uncomment if you are using it +# tools/** +# !tools/packages.config + +# Tabs Studio +*.tss + +# Telerik's JustMock configuration file +*.jmconfig + +# BizTalk build output +*.btp.cs +*.btm.cs +*.odx.cs +*.xsd.cs + +# OpenCover UI analysis results +OpenCover/ + +# Azure Stream Analytics local run output +ASALocalRun/ + +# MSBuild Binary and Structured Log +*.binlog + +# NVidia Nsight GPU debugger configuration file +*.nvuser + +# MFractors (Xamarin productivity tool) working folder +.mfractor/ + +# Local History for Visual Studio +.localhistory/ + +# BeatPulse healthcheck temp database +healthchecksdb + +# Backup folder for Package Reference Convert tool in Visual Studio 2017 +MigrationBackup/ + +# Ionide (cross platform F# VS Code tools) working folder +.ionide/ + +# Fody - auto-generated XML schema +FodyWeavers.xsd + +# Specific ignored files +Launcher/sbypass_bytes.h +Launcher/scheat_bytes.h +Launcher/slancaubypass_bytes.h \ No newline at end of file diff --git a/EndfieldMetadataDumper.sln b/EndfieldMetadataDumper.sln new file mode 100644 index 0000000..6d87bc3 --- /dev/null +++ b/EndfieldMetadataDumper.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.14.36908.2 d17.14 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "EndfieldMetadataDumper", "EndfieldMetadataDumper.vcxproj", "{F448DFA6-5655-43B7-962E-0D7ABBFD3C11}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {F448DFA6-5655-43B7-962E-0D7ABBFD3C11}.Debug|x64.ActiveCfg = Debug|x64 + {F448DFA6-5655-43B7-962E-0D7ABBFD3C11}.Debug|x64.Build.0 = Debug|x64 + {F448DFA6-5655-43B7-962E-0D7ABBFD3C11}.Debug|x86.ActiveCfg = Debug|Win32 + {F448DFA6-5655-43B7-962E-0D7ABBFD3C11}.Debug|x86.Build.0 = Debug|Win32 + {F448DFA6-5655-43B7-962E-0D7ABBFD3C11}.Release|x64.ActiveCfg = Release|x64 + {F448DFA6-5655-43B7-962E-0D7ABBFD3C11}.Release|x64.Build.0 = Release|x64 + {F448DFA6-5655-43B7-962E-0D7ABBFD3C11}.Release|x86.ActiveCfg = Release|Win32 + {F448DFA6-5655-43B7-962E-0D7ABBFD3C11}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {D9915762-45CE-4567-9799-BCF97E38AD58} + EndGlobalSection +EndGlobal diff --git a/EndfieldMetadataDumper.vcxproj b/EndfieldMetadataDumper.vcxproj new file mode 100644 index 0000000..0eb7d32 --- /dev/null +++ b/EndfieldMetadataDumper.vcxproj @@ -0,0 +1,134 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 17.0 + Win32Proj + {f448dfa6-5655-43b7-962e-0d7abbfd3c11} + EndfieldMetadataDumper + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + + + Console + true + RequireAdministrator + + + + + + + + + \ No newline at end of file diff --git a/EndfieldMetadataDumper.vcxproj.filters b/EndfieldMetadataDumper.vcxproj.filters new file mode 100644 index 0000000..ce0c35c --- /dev/null +++ b/EndfieldMetadataDumper.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file diff --git a/main.cpp b/main.cpp new file mode 100644 index 0000000..ad24883 --- /dev/null +++ b/main.cpp @@ -0,0 +1,166 @@ +#include +#include +#include +#include +#include +#include +#include +#include + +#pragma comment(lib, "shell32.lib") + +void CreateConsole() { + AllocConsole(); + FILE* f; + freopen_s(&f, "CONOUT$", "w", stdout); + freopen_s(&f, "CONOUT$", "w", stderr); + SetConsoleTitleW(L"Endfield Runtime Metadata Dumper"); +} + +std::vector ParsePattern(std::string_view combo) { + std::vector pattern; + for (size_t i = 0; i < combo.size(); ++i) { + if (combo[i] == ' ') continue; + if (combo[i] == '?') { + pattern.push_back(-1); + if (i + 1 < combo.size() && combo[i + 1] == '?') i++; + } + else { + char buffer[3] = { combo[i], combo[i + 1], 0 }; + pattern.push_back(std::strtoul(buffer, nullptr, 16)); + i++; + } + } + return pattern; +} + +uintptr_t ScanPattern(uintptr_t base, size_t size, std::string_view signature) { + auto pattern = ParsePattern(signature); + uint8_t* pData = reinterpret_cast(base); + for (size_t i = 0; i < size - pattern.size(); ++i) { + bool found = true; + for (size_t j = 0; j < pattern.size(); ++j) { + if (pattern[j] != -1 && pData[i + j] != pattern[j]) { + found = false; + break; + } + } + if (found) return base + i; + } + return 0; +} + +uintptr_t ResolveRip(uintptr_t instructionAddr, int instructionLen, int offsetToRead) { + int32_t relativeOffset = *reinterpret_cast(instructionAddr + offsetToRead); + return instructionAddr + instructionLen + relativeOffset; +} + +void DumpThread(HMODULE hModule) { + CreateConsole(); + + std::cout << "\n[+] Initializing Dumper..." << std::endl; + + uintptr_t modBase = 0; + while (!modBase) { + modBase = reinterpret_cast(GetModuleHandleW(L"GameAssembly.dll")); + if (!modBase) std::this_thread::sleep_for(std::chrono::milliseconds(100)); + } + std::cout << "[+] GameAssembly: 0x" << std::hex << modBase << std::endl; + + constexpr std::string_view sig = "48 89 05 ? ? ? ? 48 85 C0 0F 84 ? ? ? ? 4C 89 05 ? ? ? ? 48 63 88"; + uintptr_t sigAddr = ScanPattern(modBase, 0x8000000, sig); + + if (!sigAddr) { + std::cout << "[-] Pattern not found." << std::endl; + std::this_thread::sleep_for(std::chrono::seconds(5)); + FreeConsole(); FreeLibraryAndExitThread(hModule, 0); + return; + } + std::cout << "[+] Signature: 0x" << std::hex << sigAddr << std::endl; + + uintptr_t globalMetadataVar = ResolveRip(sigAddr, 7, 3); + std::cout << "[+] Global Var: 0x" << std::hex << globalMetadataVar << std::endl; + + uintptr_t metadataPtr = 0; + std::cout << "[*] Waiting for pointer..." << std::endl; + for (int i = 0; i < 200; i++) { + metadataPtr = *reinterpret_cast(globalMetadataVar); + if (metadataPtr != 0) break; + std::this_thread::sleep_for(std::chrono::milliseconds(100)); + } + + if (!metadataPtr) { + std::cout << "[-] Timed out waiting for pointer." << std::endl; + } + else { + std::cout << "[+] Pointer: 0x" << std::hex << metadataPtr << std::endl; + + uint32_t magic = *reinterpret_cast(metadataPtr); + std::cout << "[*] Header Magic: 0x" << std::hex << magic << std::endl; + + if (magic != 0xFAB11BAF) { + std::cout << "[-] Magic Bytes mismatch! Expected 0xFAB11BAF." << std::endl; + std::cout << "[-] Aborting dump." << std::endl; + std::this_thread::sleep_for(std::chrono::seconds(3)); + FreeConsole(); + FreeLibraryAndExitThread(hModule, 0); + return; + } + + std::cout << "[+] Magic Bytes verified!" << std::endl; + + MEMORY_BASIC_INFORMATION mbi{}; + if (VirtualQuery(reinterpret_cast(metadataPtr), &mbi, sizeof(mbi))) { + std::cout << "[+] Region Size: " << std::dec << mbi.RegionSize << " bytes" << std::endl; + DWORD oldProtect; + if (VirtualProtect(reinterpret_cast(metadataPtr), mbi.RegionSize, PAGE_EXECUTE_READWRITE, &oldProtect)) { + std::cout << "[+] Permissions set to RWX." << std::endl; + } + else { + std::cout << "[!] VirtualProtect failed. Dumping might fail." << std::endl; + } + + std::wstring fullPath = L"global-metadata-dump.dat"; + FILE* f = nullptr; + _wfopen_s(&f, fullPath.c_str(), L"wb"); + if (f) { + size_t totalWritten = 0; + size_t chunkSize = 4096; + uint8_t* pData = reinterpret_cast(metadataPtr); + + for (size_t i = 0; i < mbi.RegionSize; i += chunkSize) { + size_t toWrite = (mbi.RegionSize - i < chunkSize) ? (mbi.RegionSize - i) : chunkSize; + size_t w = fwrite(pData + i, 1, toWrite, f); + totalWritten += w; + if (w != toWrite) break; + } + + fclose(f); + + if (totalWritten > 0) { + std::wcout << L"[SUCCESS] Dumped " << totalWritten << L" bytes to: " << fullPath << std::endl; + } + else { + std::cout << "[-] Write failed completely. Zero bytes written." << std::endl; + } + } + else { + std::cout << "[-] Failed to open file. Error: " << errno << std::endl; + } + VirtualProtect(reinterpret_cast(metadataPtr), mbi.RegionSize, oldProtect, &oldProtect); + } + } + + std::cout << "Unloading in 5s..." << std::endl; + std::this_thread::sleep_for(std::chrono::seconds(5)); + FreeConsole(); + FreeLibraryAndExitThread(hModule, 0); +} + +BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { + if (ul_reason_for_call == DLL_PROCESS_ATTACH) { + DisableThreadLibraryCalls(hModule); + CloseHandle(CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)DumpThread, hModule, 0, nullptr)); + } + return TRUE; +} \ No newline at end of file