Initial commit

.gitattributes

@@ -0,0 +1,2 @@
+# Auto detect text files and perform LF normalization
+* text=auto

.gitignore

@@ -0,0 +1 @@
+build

CMakeLists.txt

@@ -0,0 +1,70 @@
+cmake_minimum_required(VERSION 3.28)
+
+cmake_policy(SET CMP0091 NEW)
+set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")
+set(BUILD_SHARED_LIBS OFF)
+set(CMAKE_GENERATOR_PLATFORM Win32)
+
+project(vacmon
+    LANGUAGES
+        C
+        CXX
+        ASM_MASM
+)
+
+include(FetchContent)
+
+message(STATUS "Fetching minhook (951d13cfe48ecb3a511a9783572df6cd37274f0b)...")
+FetchContent_Declare(minhook
+	GIT_REPOSITORY
+		"https://github.com/TsudaKageyu/minhook.git"
+	GIT_TAG
+        951d13cfe48ecb3a511a9783572df6cd37274f0b
+)
+FetchContent_MakeAvailable(minhook)
+
+message(STATUS "Fetching xscan (9daf95748277d56430ffaf5c3eccc1a4052a8339)...")
+FetchContent_Declare(xscan
+	GIT_REPOSITORY
+		"https://github.com/eliasmoflag/xscan.git"
+	GIT_TAG
+        9daf95748277d56430ffaf5c3eccc1a4052a8339
+)
+FetchContent_MakeAvailable(xscan)
+
+file(GLOB_RECURSE SOURCES
+    ./src/*.hpp
+    ./src/*.cpp
+    ./src/*.inc
+    ./src/*.asm
+    ./src/*.lua
+)
+
+add_library(vacmon SHARED ${SOURCES})
+
+target_sources(vacmon PRIVATE ${SOURCES})
+
+source_group(TREE ${CMAKE_CURRENT_SOURCE_DIR} FILES ${SOURCES})
+
+target_link_libraries(vacmon PRIVATE
+    minhook
+    xscan::xscan
+)
+
+target_compile_definitions(vacmon PRIVATE
+    NOMINMAX
+)
+
+target_compile_features(vacmon PUBLIC
+	cxx_std_23
+)
+
+target_compile_options(vacmon
+    PRIVATE
+        /bigobj
+)
+
+target_compile_options(vacmon
+    PRIVATE
+        /GR-
+)

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 eliasmoflag
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,2 @@
+# vacmon
+

src/hooks.cpp

@@ -0,0 +1,169 @@
+#include <Windows.h>
+#include <ShlObj.h>
+#include <MinHook.h>
+#include <xscan.hpp>
+#include <fstream>
+#include <iostream>
+#include <filesystem>
+#include "hooks.hpp"
+
+static std::filesystem::path get_known_folder_path(const KNOWNFOLDERID& folder, KNOWN_FOLDER_FLAG flag = KF_FLAG_DEFAULT);
+
+static FILE* g_output{ nullptr };
+
+bool vacmon::hooks::install() {
+
+    AllocConsole();
+    SetConsoleOutputCP(CP_UTF8);
+    freopen_s(&g_output, "CONOUT$", "w", stdout);
+
+    const auto console_output{ GetStdHandle(STD_OUTPUT_HANDLE) };
+    if (DWORD console_mode{ 0 }; GetConsoleMode(console_output, &console_mode)) {
+        SetConsoleMode(console_output, console_mode | ENABLE_VIRTUAL_TERMINAL_PROCESSING);
+    }
+
+    std::cout << "\x1b[93m";
+    std::cout << "initializing..." << std::endl;
+
+    const auto steamservice_dll{ reinterpret_cast<std::uint8_t*>(GetModuleHandleA("steamservice.dll")) };
+    const auto p_load_image{ xscan::pattern{ "E8 ? ? ? ? 84 C0 75 16 8B 43 10" }
+        .scan(xscan::pe_sections(steamservice_dll)).add(1).rip() };
+
+    if (!p_load_image) {
+        std::cout << "failed to find load_image." << std::endl;
+        return false;
+    }
+
+    const auto p_protect_image{ xscan::pattern{ "E8 ? ? ? ? 8B 46 08 83 C4 04 8B 40 28" }
+        .scan(xscan::pe_sections(steamservice_dll)).add(1).rip() };
+
+    if (!p_protect_image) {
+        std::cout << "failed to find protect_image." << std::endl;
+        return false;
+    }
+
+    std::cout << "  load_image    : steamservice.dll+0x" << std::hex << (p_load_image - steamservice_dll) << std::endl;
+    std::cout << "  protect_image : steamservice.dll+0x" << std::hex << (p_protect_image - steamservice_dll) << std::endl;
+
+    if (MH_Initialize() != MH_OK) {
+        std::cout << "failed to initialize minhook." << std::endl;
+        return false;
+    }
+
+    if (MH_CreateHook(p_load_image, &load_image, reinterpret_cast<LPVOID*>(&m_load_image)) != MH_OK) {
+        std::cout << "failed to create load_image hook." << std::endl;
+        return false;
+    }
+
+    if (MH_CreateHook(p_protect_image, &protect_image, reinterpret_cast<LPVOID*>(&m_protect_image)) != MH_OK) {
+        std::cout << "failed to create protect_image hook." << std::endl;
+        return false;
+    }
+
+    if (MH_EnableHook(MH_ALL_HOOKS) != MH_OK) {
+        std::cout << "failed to enable hooks." << std::endl;
+        return false;
+    }
+
+    std::cout << "\nready\n" << std::endl;
+    return true;
+}
+
+bool vacmon::hooks::uninstall() {
+
+    MH_DisableHook(MH_ALL_HOOKS);
+    MH_Uninitialize();
+    free(g_output);
+    FreeConsole();
+    return true;
+}
+
+bool __stdcall vacmon::hooks::load_image(module_info* info, std::uint8_t flags) {
+
+    const auto manually_mapped{ (flags & 2) != 0 };
+
+    const auto result{ m_load_image(info, flags) };
+
+    if (info && info->mapped_module && manually_mapped) {
+
+        std::cout << "ran module (0x"
+            << std::hex << info->crc32 << ") at 0x"
+            << std::hex << reinterpret_cast<std::uintptr_t>(info->mapped_module->image_base)
+            << std::endl;
+
+        const auto folder{ get_known_folder_path(FOLDERID_Desktop) / "vacmon" / "modules" };
+        if (!std::filesystem::exists(folder) && !std::filesystem::create_directories(folder)) {
+
+            std::cout << "failed to create folder: " << folder << std::endl;
+            return result;
+        }
+
+        const auto file_name{ std::format("vac.0x{:X}.dll", info->crc32) };
+        if (std::filesystem::exists(folder / file_name)) {
+            return result;
+        }
+
+        const auto image_base{ info->mapped_module->image_base };
+        const auto image_size{ info->mapped_module->nt_headers->OptionalHeader.SizeOfImage };
+
+        std::vector<std::uint8_t> image_data(image_size);
+        std::copy_n(reinterpret_cast<const std::uint8_t*>(image_base), image_data.size(), image_data.data());
+
+        const auto dos_header{ reinterpret_cast<IMAGE_DOS_HEADER*>(image_data.data()) };
+        const auto nt_headers{ reinterpret_cast<IMAGE_NT_HEADERS*>(image_data.data() + dos_header->e_lfanew) };
+
+        nt_headers->OptionalHeader.ImageBase = reinterpret_cast<std::uintptr_t>(image_base);
+
+        for (std::uint16_t i{ 0 }; i < nt_headers->FileHeader.NumberOfSections; i++) {
+
+            auto& section{ IMAGE_FIRST_SECTION(nt_headers)[i] };
+
+            section.PointerToRawData = section.VirtualAddress;
+            section.SizeOfRawData = section.Misc.VirtualSize;
+        }
+
+        std::ofstream file(folder / file_name, std::ios::out | std::ios::binary);
+        if (file) {
+            file.write(
+                reinterpret_cast<const char*>(image_data.data()),
+                image_size
+            );
+            std::cout << "dumped " << file_name << std::endl;
+        }
+        else {
+            std::cout << "failed to open file: " << folder / file_name << std::endl;
+        }
+    }
+
+    return result;
+}
+
+int __cdecl vacmon::hooks::protect_image(mapped_module_info* info) {
+
+    for (std::int16_t i{ 0 }; i < info->nt_headers->FileHeader.NumberOfSections; i++) {
+        auto& section{ IMAGE_FIRST_SECTION(info->nt_headers)[i] };
+
+        DWORD protection{ PAGE_READWRITE };
+        if (section.Characteristics & IMAGE_SCN_MEM_EXECUTE) {
+            protection = PAGE_EXECUTE_READWRITE;
+        }
+
+        VirtualProtect(reinterpret_cast<std::uint8_t*>(info->image_base) + section.VirtualAddress, section.Misc.VirtualSize, protection, &protection);
+    }
+
+    return info->nt_headers->FileHeader.NumberOfSections;
+}
+
+std::filesystem::path get_known_folder_path(const KNOWNFOLDERID& folder, KNOWN_FOLDER_FLAG flag) {
+
+    std::filesystem::path result;
+    {
+        wchar_t* path_buf{ nullptr };
+        if (SUCCEEDED(::SHGetKnownFolderPath(folder, 0, 0, &path_buf))) {
+            result = std::filesystem::path(path_buf);
+        }
+
+        ::CoTaskMemFree(path_buf);
+    }
+    return result;
+}

src/hooks.hpp

@@ -0,0 +1,47 @@
+#pragma once
+#include <cstdint>
+#include <cstddef>
+#include <unordered_map>
+
+namespace vacmon {
+
+    class mapped_module_info;
+    class module_info;
+
+    using crc32_t = std::uint32_t;
+    using run_func_t = int __stdcall(int, int, int, void *, module_info*);
+
+    class hooks {
+    public:
+        static bool install();
+        static bool uninstall();
+
+    protected:
+        static bool __stdcall load_image(module_info* info, std::uint8_t flags);
+        static int __cdecl protect_image(mapped_module_info* info);
+
+    protected:
+        static inline decltype(&load_image) m_load_image;
+        static inline decltype(&protect_image) m_protect_image;
+    };
+
+    class mapped_module_info {
+    public:
+        std::uint32_t dword0;
+        void* image_base;
+        IMAGE_NT_HEADERS* nt_headers;
+        std::uint32_t dwordC;
+        void* pvoid10;
+    };
+
+    class module_info {
+    public:
+        crc32_t crc32;
+        std::uint32_t dword4;
+        mapped_module_info* mapped_module;
+        run_func_t* runfunc;
+        std::int32_t status;
+        std::uint32_t image_size;
+        std::uint8_t* image_data;
+    };
+}

src/main.cpp

@@ -0,0 +1,17 @@
+#include <Windows.h>
+#include <cstdint>
+#include <cstddef>
+#include "hooks.hpp"
+
+std::int32_t WINAPI DllMain(
+    std::uintptr_t image_base,
+    std::uint32_t reason_for_call,
+    std::size_t) {
+
+    if (reason_for_call == DLL_PROCESS_ATTACH) {
+
+        vacmon::hooks::install();
+    }
+
+	return TRUE;
+}