Add base for skipping amauthd, not functional yet

dist/config.toml

@@ -2,6 +2,8 @@
 drumMax = 20000
 drumMin = 10000
 
+server = "vsapi.taiko-p.jp"
+
 accessCode1 = 1
 chipId1 = 1
 

patches/8.18/dllmain.c

@@ -8,11 +8,10 @@ HOOK_DYNAMIC (u8, __fastcall, qrReadFromCOM1, u64 a1) {
 	return 1;
 }
 
-i32 __stdcall DllMain (HMODULE mod, DWORD cause, void *ctx) {
+void
-	if (cause != DLL_PROCESS_ATTACH) return 1;
+PreInit () {
-
 	toml_table_t *config = openConfig (configPath ("plugins/patches.toml"));
-	if (!config) return 1;
+	if (!config) return;
 	void *handle = GetModuleHandle (0);
 	WRITE_MEMORY (ASLR (0x1400239C0, handle), u8, 0xC3);                                                          // Stop error
 	if (readConfigBool (config, "unlock_songs", true)) WRITE_MEMORY (ASLR (0x140314E8D, handle), u8, 0xB0, 0x01); // Unlock songs
@@ -39,6 +38,4 @@ i32 __stdcall DllMain (HMODULE mod, DWORD cause, void *ctx) {
 
 	INSTALL_HOOK_DYNAMIC (qrVtable1, amHandle + 0x1BA00);
 	INSTALL_HOOK_DYNAMIC (qrReadFromCOM1, amHandle + 0x1BC20);
-
-	return 1;
 }

patches/what_the_fuck/Makefile

@@ -0,0 +1,31 @@
+OUT = what_the_fuck
+CXX := x86_64-w64-mingw32-g++
+TARGET := x86_64-pc-windows-gnu
+SRC = dllmain.cpp
+OBJ = ${addprefix ../../${TARGET}/patches/what_the_fuck/,${SRC:.cpp=.o}}
+EXTERN_SRC = src/helpers.c tomlc99/toml.c minhook/src/buffer.c minhook/src/hook.c minhook/src/trampoline.c minhook/src/hde/hde32.c minhook/src/hde/hde64.c
+EXTERN_OBJ = ${addprefix ../../${TARGET}/,${EXTERN_SRC:.c=.o}}
+CXXFLAGS = -std=c++11 -I../../src -I../../minhook/include -I../../tomlc99 -Wall -Ofast -DWIN32_LEAN_AND_MEAN -D_WIN32_WINNT=_WIN32_WINNT_WIN7
+LDFLAGS := -shared -static -static-libgcc -s
+LIBS := -lmingw32 -luuid -lgdi32 -lwinmm -limm32 -lole32 -loleaut32 -lsetupapi -lversion -pthread
+
+all: options ${OUT}
+
+.PHONY: dirs
+dirs:
+	@mkdir -p ../../${TARGET}/patches/what_the_fuck
+
+.PHONY: options
+options:
+	@echo "CFLAGS	= ${CFLAGS}"
+	@echo "LDFLAGS	= ${LDFLAGS}"
+	@echo "CXX	= ${CXX}"
+
+../../${TARGET}/patches/what_the_fuck/%.o: %.cpp
+	@echo BUILD $@
+	@${CXX} -c ${CXXFLAGS} $< -o $@
+
+.PHONY: ${OUT}
+${OUT}: dirs ${OBJ}
+	@echo LINK $@
+	@${CXX} ${CXXFLAGS} -o ../../${TARGET}/$@.dll ${OBJ} ${EXTERN_OBJ} ${LDFLAGS} ${LIBS}

patches/what_the_fuck/dllmain.cpp

@@ -0,0 +1,280 @@
+// Here be lions
+#include <chrono>
+#include <combaseapi.h>
+#include <thread>
+#include <unknwn.h>
+#include <winerror.h>
+#include <winnt.h>
+// Needs to be after for DEFINE_GUID
+#include "helpers.h"
+
+extern "C" {
+
+DWORD reg = 0;
+
+DEFINE_GUID (IID_CAuthFactory, 0x4603BB03, 0x058D, 0x43D9, 0xB9, 0x6F, 0x63, 0x9B, 0xE9, 0x08, 0xC1, 0xED);
+DEFINE_GUID (IID_CAuth, 0x045A5150, 0xD2B3, 0x4590, 0xA3, 0x8B, 0xC1, 0x15, 0x86, 0x78, 0xE1, 0xAC);
+
+class CAuth : public IUnknown {
+  public:
+	STDMETHODIMP
+	QueryInterface (REFIID riid, LPVOID *ppvObj) {
+		wchar_t *iid_str;
+		StringFromCLSID (riid, &iid_str);
+		printf ("QueryInterface %ls\n", iid_str);
+
+		if (riid == IID_IUnknown || riid == IID_CAuth) {
+			*ppvObj = this;
+			this->AddRef ();
+			return 0;
+		} else {
+			*ppvObj = 0;
+			return E_NOINTERFACE;
+		}
+	}
+	STDMETHODIMP_ (ULONG) AddRef () { return this->refCount++; }
+	STDMETHODIMP_ (ULONG) Release () {
+		this->refCount--;
+		if (this->refCount <= 0) {
+			delete this;
+			return 0;
+		}
+		return this->refCount;
+	}
+
+	// Seems to verify that local network is valid?
+	virtual i64
+	Unk3 (u32 a1) {
+		return 1;
+	}
+	virtual i64
+	Unk4 () {
+		return 1;
+	}
+	// Seems to check a config field, something to do with server/client
+	virtual i32
+	Unk5 () {
+		return 0;
+	}
+	// Seems to check that some config field is valid
+	virtual i64
+	Unk6 () {
+		return 1;
+	}
+	// Sets a random global to 1
+	virtual i32
+	Unk7 () {
+		return 0;
+	}
+	// Set some global vars
+	virtual i32
+	Unk8 () {
+		return 0;
+	}
+	// Puts some globals into a1
+	virtual i32
+	Unk9 (i32 *a1) {
+		printf ("Unk9\n");
+		a1[0x28] = 0;
+		a1[1]    = 1;
+		a1[7]    = 1;
+		a1[0x2C] = 1;
+		a1[0x2A] = 1;
+		a1[0x2E] = 1;
+		a1[0x31] = 0x11;
+		a1[0x30] = 1;
+		a1[0x2F] = 1;
+		return 0;
+	}
+	// Copies from a global to a1
+	virtual i32
+	Unk10 (void *a1) {
+		printf ("Unk10\n");
+		memset (a1, 0, 0xA8);
+		return 0;
+	}
+	// Lotsa fancy stuff here
+	virtual i32
+	Unk11 (char *a1) {
+		printf ("Unk11\n");
+		memset (a1, 0, 0x13C);
+		strncpy_s (a1, 4, "1", 3);
+		strncpy_s (a1 + 4, 0x10, "ALLNET", 0xF);
+		strncpy_s (a1 + 20, 8, "SWBY", 7);
+		strncpy_s (a1 + 28, 8, "12.00", 7);
+		strncpy_s (a1 + 36, 8, "S121", 7);
+		strncpy_s (a1 + 44, 8, "08.18", 7);
+		strncpy_s (a1 + 52, 4, "0", 3);
+		strncpy_s (a1 + 56, 4, "PCB", 3);
+		strncpy_s (a1 + 60, 0x100, "https://v402-front.mucha-prd.nbgi-amnet.jp:10122/mucha_front/", 0xFF);
+		return 0;
+	}
+	// Some config stuff, unsure if true or false wanted
+	virtual i32
+	Unk12 () {
+		return 1;
+	}
+	virtual i32
+	Unk13 () {
+		return 1;
+	}
+	// Seems to be some kind of copy? Can return E_FAIL and E_ACCESSDENIED
+	virtual i32
+	Unk14 (void *a1) {
+		printf ("Unk14\n");
+		memset (a1, 0, 0x8A2);
+		return 0;
+	}
+	// Can return E_FAIL E_ABORT E_UNEXPECTED
+	virtual i32
+	Unk15 () {
+		return 0;
+	}
+	// Config stuff
+	virtual i32
+	Unk16 () {
+		return 0;
+	}
+	virtual i32
+	Unk17 () {
+		return 0;
+	}
+	// Seems to be some kind of copy? Can return E_FAIL and E_ACCESSDENIED
+	virtual i32
+	Unk18 (void *a1) {
+		printf ("Unk18\n");
+		return 0;
+	}
+	// Fancy stuff happening here
+	virtual i32
+	Unk19 (void *a1) {
+		printf ("Unk19\n");
+		return 0;
+	}
+	// Can return E_FAIL E_ABORT E_UNEXPECTED E_NOTIMPL
+	// Something to do with MH
+	virtual i32
+	Unk20 () {
+		printf ("Unk20\n");
+		return 0;
+	}
+	// Can return E_FAIL E_ABORT E_UNEXPECTED E_NOTIMPL
+	// Something to do with a list<T>
+	// Maybe an init function
+	virtual i32
+	Unk21 () {
+		return 1;
+	}
+	virtual i32
+	Unk22 () {
+		return 0;
+	}
+	virtual i32
+	Unk23 () {
+		return 0;
+	}
+	// E_FAIL E_NOTIMPL
+	virtual i32
+	Unk24 () {
+		return 0;
+	}
+	// E_FAIL E_UNEXPECTED E_NOTIMPL
+	virtual i32
+	Unk25 () {
+		return 1;
+	}
+	// E_FAIL E_NOTIMPL
+	virtual i32
+	Unk26 () {
+		return 0;
+	}
+	// E_FAIL E_UNEXPECTED E_NOTIMPL
+	virtual i32
+	Unk27 () {
+		return 1;
+	}
+	// E_FAIL E_NOTIMPL
+	virtual i32
+	Unk28 () {
+		return 0;
+	}
+	// E_FAIL E_ACCESSDENIED
+	virtual i32
+	Unk29 () {
+		return 0;
+	}
+	virtual i32
+	Unk30 () {
+		return 0;
+	}
+	// nothing special
+	virtual i32
+	PrintDebugInfo () {
+		return 0;
+	}
+	virtual i32
+	Unk32 (void *a1) {
+		return 0;
+	}
+	virtual void
+	Unk33 () {}
+
+  public:
+	CAuth () { printf ("CAuth\n"); }
+	virtual ~CAuth () {}
+
+  private:
+	i32 refCount = 0;
+};
+
+class CAuthFactory : public IClassFactory {
+  public:
+	STDMETHODIMP
+	QueryInterface (REFIID riid, LPVOID *ppvObj) {
+		wchar_t *iid_str;
+		StringFromCLSID (riid, &iid_str);
+		printf ("QueryInterface %ls\n", iid_str);
+
+		if (riid == IID_IUnknown || riid == IID_IClassFactory || riid == IID_CAuthFactory) {
+			*ppvObj = this;
+			this->AddRef ();
+			return 0;
+		} else {
+			*ppvObj = 0;
+			return E_NOINTERFACE;
+		}
+	}
+	STDMETHODIMP_ (ULONG) AddRef () { return 2; }
+	STDMETHODIMP_ (ULONG) Release () { return 1; }
+	virtual HRESULT
+	CreateInstance (IUnknown *outer, REFIID riid, void **object) {
+		if (outer != 0) return CLASS_E_NOAGGREGATION;
+		wchar_t *iid_str;
+		StringFromCLSID (riid, &iid_str);
+		printf ("CreateInstance %ls\n", iid_str);
+		if (riid == IID_CAuth) {
+			CAuth *auth = new CAuth ();
+			return auth->QueryInterface (riid, object);
+		} else {
+			*object = 0;
+			return E_NOINTERFACE;
+		}
+	}
+	virtual HRESULT
+	LockServer (i32 lock) {
+		return 0;
+	}
+};
+
+void
+Init () {
+	CoInitializeEx (0, 0);
+	CoRegisterClassObject (IID_CAuthFactory, (IUnknown *)new CAuthFactory (), 4, 1, &reg);
+}
+
+void
+Exit () {
+	CoRevokeClassObject (reg);
+	CoUninitialize ();
+}
+}

src/boilerplate.c

@@ -14,7 +14,6 @@ HOOK_DYNAMIC (u32, __stdcall, XinputGetCapabilites, u32 index, u32 flags, void *
 
 // bnusio stuff
 RETURN_FALSE (i64, __stdcall, bnusio_ClearSram);
-RETURN_FALSE (i64, __stdcall, bnusio_Close);
 RETURN_FALSE (i64, __fastcall, bnusio_Communication, i32 a1);
 RETURN_FALSE (i64, __fastcall, bnusio_DecService, i32 a1, u16 a2);
 RETURN_FALSE (void *, __fastcall, bnusio_GetBuffer, u16 a1, i64 a2, i16 a3);
@@ -67,7 +66,6 @@ HOOK_DYNAMIC (void, __stdcall, bngrw_fin) { return; }
 HOOK_DYNAMIC (u64, __stdcall, bngrw_GetFwVersion) { return 0; }
 HOOK_DYNAMIC (u64, __stdcall, bngrw_GetStationID) { return 0; }
 HOOK_DYNAMIC (u64, __stdcall, bngrw_GetRetryCount) { return 0; }
-HOOK_DYNAMIC (u64, __stdcall, bngrw_Init) { return 0; }
 HOOK_DYNAMIC (u64, __stdcall, bngrw_IsCmdExec) { return 0xFFFFFFFF; }
 HOOK_DYNAMIC (u64, __stdcall, bngrw_ReqAction) { return 1; }
 HOOK_DYNAMIC (u64, __stdcall, bngrw_ReqAiccAuth) { return 1; }
@@ -100,7 +98,6 @@ init_boilerplate () {
 	INSTALL_HOOK_DYNAMIC (bngrw_GetFwVersion, PROC_ADDRESS ("bngrw.dll", "BngRwGetFwVersion"));
 	INSTALL_HOOK_DYNAMIC (bngrw_GetStationID, PROC_ADDRESS ("bngrw.dll", "BngRwGetStationID"));
 	INSTALL_HOOK_DYNAMIC (bngrw_GetRetryCount, PROC_ADDRESS ("bngrw.dll", "BngRwGetTotalRetryCount"));
-	INSTALL_HOOK_DYNAMIC (bngrw_Init, PROC_ADDRESS ("bngrw.dll", "BngRwInit"));
 	INSTALL_HOOK_DYNAMIC (bngrw_IsCmdExec, PROC_ADDRESS ("bngrw.dll", "BngRwIsCmdExec"));
 	INSTALL_HOOK_DYNAMIC (bngrw_ReqAction, PROC_ADDRESS ("bngrw.dll", "BngRwReqAction"));
 	INSTALL_HOOK_DYNAMIC (bngrw_ReqAiccAuth, PROC_ADDRESS ("bngrw.dll", "BngRwReqAiccAuth"));

src/dllmain.c

@@ -12,6 +12,8 @@ char accessCode2[21] = "00000000000000000002";
 char chipId1[33]     = "00000000000000000000000000000001";
 char chipId2[33]     = "00000000000000000000000000000002";
 
+char *server = "vsapi.taiko-p.jp";
+
 typedef i32 (*callbackAttach) (i32, i32, i32 *);
 typedef void (*callbackTouch) (i32, i32, u8[168], u64);
 bool waitingForTouch = false;
@@ -133,6 +135,66 @@ u32 __stdcall bnusio_GetSwIn () {
 	return sw;
 }
 
+i64 __stdcall bnusio_Close () {
+	wchar_t path[MAX_PATH];
+	GetModuleFileNameW (NULL, path, MAX_PATH);
+	*wcsrchr (path, '\\') = '\0';
+	SetCurrentDirectoryW (path);
+
+	WIN32_FIND_DATAW fd;
+	HANDLE hFind = FindFirstFileW (L"plugins/*.dll", &fd);
+	if (hFind != INVALID_HANDLE_VALUE) {
+		do {
+			if (fd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) continue;
+			wchar_t filePath[MAX_PATH];
+			wcscpy (filePath, path);
+			wcscat (filePath, L"/plugins/");
+			wcscat (filePath, fd.cFileName);
+			HMODULE hModule = LoadLibraryW (filePath);
+			if (!hModule) {
+				wchar_t buf[128];
+				swprintf (buf, 128, L"Failed to load plugin %d", GetLastError ());
+				MessageBoxW (NULL, buf, fd.cFileName, MB_ICONERROR);
+			} else {
+				FARPROC initEvent = GetProcAddress (hModule, "Exit");
+				if (initEvent) ((event *)initEvent) ();
+			}
+		} while (FindNextFileW (hFind, &fd));
+		FindClose (hFind);
+	}
+	return 0;
+}
+
+HOOK_DYNAMIC (u64, __stdcall, bngrw_Init) {
+	wchar_t path[MAX_PATH];
+	GetModuleFileNameW (NULL, path, MAX_PATH);
+	*wcsrchr (path, '\\') = '\0';
+	SetCurrentDirectoryW (path);
+
+	WIN32_FIND_DATAW fd;
+	HANDLE hFind = FindFirstFileW (L"plugins/*.dll", &fd);
+	if (hFind != INVALID_HANDLE_VALUE) {
+		do {
+			if (fd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) continue;
+			wchar_t filePath[MAX_PATH];
+			wcscpy (filePath, path);
+			wcscat (filePath, L"/plugins/");
+			wcscat (filePath, fd.cFileName);
+			HMODULE hModule = LoadLibraryW (filePath);
+			if (!hModule) {
+				wchar_t buf[128];
+				swprintf (buf, 128, L"Failed to load plugin %d", GetLastError ());
+				MessageBoxW (NULL, buf, fd.cFileName, MB_ICONERROR);
+			} else {
+				FARPROC initEvent = GetProcAddress (hModule, "Init");
+				if (initEvent) ((event *)initEvent) ();
+			}
+		} while (FindNextFileW (hFind, &fd));
+		FindClose (hFind);
+	}
+	return 0;
+}
+
 HOOK_DYNAMIC (u64, __stdcall, bngrw_attach, i32 a1, char *a2, i32 a3, i32 a4, callbackAttach callback, i32 *a6) {
 	// This is way too fucking jank
 	attachCallback = callback;
@@ -147,6 +209,10 @@ HOOK_DYNAMIC (i32, __stdcall, bngrw_reqWaitTouch, u32 a1, i32 a2, u32 a3, callba
 	return 1;
 }
 
+HOOK_DYNAMIC (i32, __stdcall, ws2_getaddrinfo, char *node, char *service, void *hints, void *out) {
+	return originalws2_getaddrinfo (server, service, hints, out);
+}
+
 i32 __stdcall DllMain (HMODULE mod, DWORD cause, void *ctx) {
 	if (cause == DLL_PROCESS_DETACH) DisposePoll ();
 	if (cause != DLL_PROCESS_ATTACH) return true;
@@ -155,6 +221,9 @@ i32 __stdcall DllMain (HMODULE mod, DWORD cause, void *ctx) {
 
 	INSTALL_HOOK_DYNAMIC (bngrw_attach, PROC_ADDRESS ("bngrw.dll", "BngRwAttach"));
 	INSTALL_HOOK_DYNAMIC (bngrw_reqWaitTouch, PROC_ADDRESS ("bngrw.dll", "BngRwReqWaitTouch"));
+	INSTALL_HOOK_DYNAMIC (bngrw_Init, PROC_ADDRESS ("bngrw.dll", "BngRwInit"));
+
+	INSTALL_HOOK_DYNAMIC (ws2_getaddrinfo, PROC_ADDRESS ("ws2_32.dll", "getaddrinfo"));
 
 	// Set current directory to the directory of the executable
 	// Find all files in the plugins directory that end with .dll
@@ -179,6 +248,9 @@ i32 __stdcall DllMain (HMODULE mod, DWORD cause, void *ctx) {
 				wchar_t buf[128];
 				swprintf (buf, 128, L"Failed to load plugin %d", GetLastError ());
 				MessageBoxW (NULL, buf, fd.cFileName, MB_ICONERROR);
+			} else {
+				FARPROC preInitEvent = GetProcAddress (hModule, "PreInit");
+				if (preInitEvent) ((event *)preInitEvent) ();
 			}
 		} while (FindNextFileW (hFind, &fd));
 		FindClose (hFind);
@@ -188,6 +260,7 @@ i32 __stdcall DllMain (HMODULE mod, DWORD cause, void *ctx) {
 	if (config) {
 		drumMax            = readConfigInt (config, "drumMax", drumMax);
 		drumMin            = readConfigInt (config, "drumMin", drumMin);
+		server             = readConfigString (config, "server", server);
 		i64 accessCode1Int = readConfigInt (config, "accessCode1", 1);
 		i64 accessCode2Int = readConfigInt (config, "accessCode2", 2);
 		i64 chipId1Int     = readConfigInt (config, "chipId1", 1);

src/helpers.h

@@ -14,6 +14,13 @@ typedef uint8_t u8;
 typedef uint16_t u16;
 typedef uint32_t u32;
 typedef uint64_t u64;
+typedef void event ();
+
+#ifdef DEFINE_GUID
+#undef DEFINE_GUID
+#endif
+
+#define DEFINE_GUID(name, l, w1, w2, b1, b2, b3, b4, b5, b6, b7, b8) const GUID name = { l, w1, w2, { b1, b2, b3, b4, b5, b6, b7, b8 } }
 
 #ifdef BASE_ADDRESS
 #define ASLR(address, handle) ((u64)handle + (u64)address - (u64)BASE_ADDRESS)