Block query_security_file

Fixed 'the client is damaged' error popup, which appeared due to remote anticheat config update from hoyo

Cargo.toml

@@ -4,7 +4,7 @@ version = "0.1.0"
 edition = "2021"
 
 [lib]
-name = "version"
+name = "ext"
 crate-type = ["cdylib"]
 
 [dependencies]

src/lib.rs

@@ -3,10 +3,11 @@
 use std::{sync::RwLock, time::Duration};
 
 use lazy_static::lazy_static;
-use util::try_get_base_address;
-use windows::Win32::Foundation::HINSTANCE;
+use modules::{CcpBlocker, Misc};
+use windows::core::PCSTR;
 use windows::Win32::System::Console;
 use windows::Win32::System::SystemServices::DLL_PROCESS_ATTACH;
+use windows::Win32::{Foundation::HINSTANCE, System::LibraryLoader::GetModuleHandleA};
 
 mod interceptor;
 mod marshal;
@@ -16,19 +17,23 @@ mod util;
 use crate::modules::{Http, MhyContext, ModuleManager, Security};
 
 unsafe fn thread_func() {
-    let base = try_get_base_address("GenshinImpact.exe").unwrap();
+    let base = GetModuleHandleA(PCSTR::null()).unwrap().0 as usize;
+    let mut module_manager = MODULE_MANAGER.write().unwrap();
 
-    std::thread::sleep(Duration::from_secs(12));
+    // Block query_security_file ASAP
+    module_manager.enable(MhyContext::<CcpBlocker>::new(base));
+
+    std::thread::sleep(Duration::from_secs(14));
 
     util::disable_memprotect_guard();
     Console::AllocConsole().unwrap();
 
-    println!("Genshin Impact encryption patch\nMade by xeondev\nTo work with MualaniImpact: git.xeondev.com/reversedrooms/MualaniImpact");
+    println!("Genshin Impact encryption patch\nMade by xeondev\nTo work with XilonenImpact: git.xeondev.com/reversedrooms/XilonenImpact");
     println!("Base: {:X}", base);
 
-    let mut module_manager = MODULE_MANAGER.write().unwrap();
     module_manager.enable(MhyContext::<Http>::new(base));
     module_manager.enable(MhyContext::<Security>::new(base));
+    module_manager.enable(MhyContext::<Misc>::new(base));
 
     println!("Successfully initialized!");
 }

src/marshal.rs

@@ -1,8 +1,8 @@
 use std::ffi::CStr;
 
-use crate::util;
+use windows::{core::PCSTR, Win32::System::LibraryLoader::GetModuleHandleA};
 
-const PTR_TO_STRING_ANSI: usize = 0x103CBB00;
+const PTR_TO_STRING_ANSI: usize = 0xF33F640;
 type MarshalPtrToStringAnsi = unsafe extern "fastcall" fn(*const u8) -> *const u8;
 
 pub unsafe fn ptr_to_string_ansi(content: &CStr) -> *const u8 {
@@ -11,5 +11,5 @@ pub unsafe fn ptr_to_string_ansi(content: &CStr) -> *const u8 {
 }
 
 unsafe fn base() -> usize {
-    util::try_get_base_address("GenshinImpact.exe").unwrap()
+    GetModuleHandleA(PCSTR::null()).unwrap().0 as usize
 }

src/modules/ccp_blocker.rs

@@ -0,0 +1,38 @@
+use std::ffi::CStr;
+
+use super::{MhyContext, MhyModule, ModuleType};
+use anyhow::Result;
+use ilhook::x64::Registers;
+use windows::{
+    core::s,
+    Win32::System::LibraryLoader::{GetModuleHandleA, GetProcAddress},
+};
+
+pub struct CcpBlocker;
+
+impl MhyModule for MhyContext<CcpBlocker> {
+    unsafe fn init(&mut self) -> Result<()> {
+        let winsock2 = GetModuleHandleA(s!("Ws2_32.dll")).unwrap();
+        let getaddrinfo = GetProcAddress(winsock2, s!("getaddrinfo")).unwrap();
+
+        self.interceptor
+            .attach(getaddrinfo as usize, on_getaddrinfo)
+    }
+
+    unsafe fn de_init(&mut self) -> Result<()> {
+        Ok(())
+    }
+
+    fn get_module_type(&self) -> super::ModuleType {
+        ModuleType::CcpBlocker
+    }
+}
+
+unsafe extern "win64" fn on_getaddrinfo(reg: *mut Registers, _: usize) {
+    let host_ptr = (*reg).rcx as *const i8;
+    let host = CStr::from_ptr(host_ptr);
+
+    if host.to_string_lossy() == "dispatchcnglobal.yuanshen.com" {
+        std::ptr::copy_nonoverlapping(c"0.0.0.0".as_ptr(), (*reg).rcx as *mut i8, 9);
+    }
+}

src/modules/http.rs

@@ -5,8 +5,8 @@ use crate::marshal;
 use anyhow::Result;
 use ilhook::x64::Registers;
 
-const WEB_REQUEST_UTILS_MAKE_INITIAL_URL: usize = 0x110107A0;
-const BROWSER_LOAD_URL: usize = 0x10E55670;
+const WEB_REQUEST_UTILS_MAKE_INITIAL_URL: usize = 0xFFDA8B0;
+const BROWSER_LOAD_URL: usize = 0xFE06E40;
 
 pub struct Http;
 
@@ -48,9 +48,11 @@ unsafe extern "win64" fn on_make_initial_url(reg: *mut Registers, _: usize) {
         new_url.push_str(s);
     });
 
-    println!("Redirect: {url} -> {new_url}");
-    (*reg).rcx =
-        marshal::ptr_to_string_ansi(CString::new(new_url.as_str()).unwrap().as_c_str()) as u64;
+    if !url.contains("/query_cur_region") {
+        println!("Redirect: {url} -> {new_url}");
+        (*reg).rcx =
+            marshal::ptr_to_string_ansi(CString::new(new_url.as_str()).unwrap().as_c_str()) as u64;
+    }
 }
 
 unsafe extern "win64" fn on_browser_load_url(reg: *mut Registers, _: usize) {

src/modules/misc.rs

@@ -0,0 +1,52 @@
+use std::ffi::CStr;
+
+use super::{MhyContext, MhyModule, ModuleType};
+use anyhow::Result;
+use ilhook::x64::Registers;
+use windows::{core::PCSTR, Win32::System::LibraryLoader::GetModuleHandleA};
+
+pub struct Misc;
+
+const DYNAMIC_IMPORT: usize = 0x3F5240;
+const SET_CUSTOM_PROPERTY_FLOAT: usize = 0x11E1880;
+
+impl MhyModule for MhyContext<Misc> {
+    unsafe fn init(&mut self) -> Result<()> {
+        // CNCBWin5.0.50 sound fix
+        self.interceptor
+            .attach(self.assembly_base + DYNAMIC_IMPORT, on_dynamic_import)?;
+
+        // Dither
+        self.interceptor.replace(
+            self.assembly_base + SET_CUSTOM_PROPERTY_FLOAT,
+            set_custom_property_float_replacement,
+        )
+    }
+
+    unsafe fn de_init(&mut self) -> Result<()> {
+        Ok(())
+    }
+
+    fn get_module_type(&self) -> super::ModuleType {
+        ModuleType::Misc
+    }
+}
+
+unsafe extern "win64" fn on_dynamic_import(reg: *mut Registers, _: usize) {
+    let symbol_name_ptr = *((*reg).rcx.wrapping_add(16) as *const usize);
+    let symbol_name = CStr::from_ptr(symbol_name_ptr as *const i8);
+
+    // Hoyo forgot to package updated sound library and that's the missing export
+    if symbol_name.to_string_lossy() == "GetMusicSyncCallbackInfoPlayingSeq" {
+        let base = GetModuleHandleA(PCSTR::null()).unwrap().0 as usize;
+        *((*reg).rcx.wrapping_add(16) as *mut usize) = base + 0x2F6CD04;
+    }
+}
+
+unsafe extern "win64" fn set_custom_property_float_replacement(
+    _: *mut Registers,
+    _: usize,
+    _: usize,
+) -> usize {
+    0
+}

src/modules/mod.rs

@@ -4,10 +4,14 @@ use anyhow::Result;
 
 use crate::interceptor::Interceptor;
 
+mod ccp_blocker;
 mod http;
+mod misc;
 mod security;
 
+pub use ccp_blocker::CcpBlocker;
 pub use http::Http;
+pub use misc::Misc;
 pub use security::Security;
 
 #[derive(Default)]
@@ -38,6 +42,8 @@ impl ModuleManager {
 pub enum ModuleType {
     Http,
     Security,
+    Misc,
+    CcpBlocker,
 }
 
 pub trait MhyModule {

src/modules/security.rs

@@ -6,9 +6,9 @@ use super::{MhyContext, MhyModule, ModuleType};
 use anyhow::Result;
 use ilhook::x64::Registers;
 
-const MHYRSA_PERFORM_CRYPTO_ACTION: usize = 0xC37F9B;
-const KEY_SIGN_CHECK: usize = 0xC3C42D;
-const SDK_UTIL_RSA_ENCRYPT: usize = 0x1088E510;
+const MHYRSA_PERFORM_CRYPTO_ACTION: usize = 0x9DD5C8;
+const KEY_SIGN_CHECK: usize = 0x9DF4BC;
+const SDK_UTIL_RSA_ENCRYPT: usize = 0xF7A73C0;
 
 const KEY_SIZE: usize = 268;
 static SERVER_PUBLIC_KEY: &[u8] = include_bytes!("../../server_public_key.bin");

src/util.rs

@@ -10,15 +10,6 @@ pub fn wide_str(value: &str) -> Vec<u16> {
     OsStr::new(value).encode_wide().chain(once(0)).collect()
 }
 
-pub unsafe fn try_get_base_address(module_name: &str) -> Option<usize> {
-    let w_module_name = wide_str(module_name);
-
-    match GetModuleHandleW(PCWSTR::from_raw(w_module_name.as_ptr())) {
-        Ok(module) => Some(module.0 as usize),
-        Err(_) => None
-    }
-}
-
 // VMProtect hooks NtProtectVirtualMemory to prevent changing protection of executable segments
 // We use this trick to remove hook
 pub unsafe fn disable_memprotect_guard() {