Требуется подсказка

Discussion in 'С/С++, C#, Rust, Swift, Go, Java, Perl, Ruby' started by Sersh, 11 Feb 2018.

  1. Sersh

    Sersh New Member

    Joined:
    11 Feb 2018
    Messages:
    1
    Likes Received:
    0
    Reputations:
    0
    Подскажите способ защиты/отлова инжекта через mono для Unity.Заранее Спасибо

    Есть такой код,но на C++ я не работал еще


    #include <TlHelp32.h>
    #include <psapi.h>
    #pragma comment( lib, "psapi.lib")

    char* GetModulePatchByName(HANDLE hProcess, char* module_name)
    {
    HMODULE hMods[1024];
    DWORD cbNeeded;
    CHAR szModName[MAX_PATH];

    if (K32EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded))
    {
    for (int i = 0; i < (cbNeeded / sizeof(HMODULE)); i++)
    {
    if (K32GetModuleFileNameExA(hProcess, hMods, szModName, sizeof(szModName) / sizeof(TCHAR)))
    {
    if (strstr(szModName, module_name))
    {
    break;
    }
    }
    }
    }
    return szModName;
    }

    bool BlockAPI_mono(HANDLE hProcess, char* api_name)
    {
    CHAR _asm_ret[] = { 0xC3 };

    char* mono_patch = GetModulePatchByName(hProcess, "mono.dll");

    if (mono_patch == NULL)
    return false;

    HMODULE mono_lib = LoadLibraryA(mono_patch);

    if (mono_lib == NULL)
    return false;

    FARPROC func = GetProcAddress(mono_lib, api_name);

    if (func == NULL)
    return false;

    DWORD dwOldProtect = 0;
    VirtualProtectEx(hProcess, reinterpret_cast<LPVOID>(func), sizeof(_asm_ret), PAGE_EXECUTE_READWRITE, &dwOldProtect);
    bool write = WriteProcessMemory(hProcess, reinterpret_cast<LPVOID>(func), reinterpret_cast<LPCVOID>(_asm_ret), sizeof(_asm_ret), 0);
    VirtualProtectEx(hProcess, reinterpret_cast<LPVOID>(func), sizeof(_asm_ret), dwOldProtect, &dwOldProtect);

    return write;
    }
    int main()
    {
    HANDLE hProcess = GetCurrentProcess();

    if (BlockAPI_mono(hProcess, "mono_get_root_domain")
    && BlockAPI_mono(hProcess, "mono_thread_attach")
    && BlockAPI_mono(hProcess, "mono_assembly_open")
    && BlockAPI_mono(hProcess, "mono_assembly_get_image")
    && BlockAPI_mono(hProcess, "mono_class_from_name")
    && BlockAPI_mono(hProcess, "mono_class_get_method_from_name")
    && BlockAPI_mono(hProcess, "mono_runtime_invoke"))
    {
    printf("mono inject fixed!\n");
    }
    else
    {
    printf("no!\n");
    }

    system("pause");
    return 0;
    }