Stealthy way to hijack the existing game process handle within the game launcher (currently supports Steam and Battle.net). Achieve external game process read/write with minimum footprint.

Launcher Abuser

Stealthy way to hijack the existing game process handle within the game launcher (currently supports Steam and Battle.net). Achieve external game process read/write with minimum footprint.

Core Concepts:

  • No new handles: The LA (Launcher Abuser/cheat) process communicates with the game launcher using Named Shared Memory, but the LA->game launcher handle is destroyed before the game is loaded (and the communication still works without it).
  • No new modules: A 154 bytes shellcode is injected into the game launcher to handle read and write requests using a spinlock and the shared memory.
  • No new threads: An existing game launcher thread is hijacked so there's less footprint.
  • No new executable memory pages: Since it's a 154 bytes shellcode, an existing executable page memory is used as a codecave for the spinlock (and the following read/write operations).

How It Works

It abuses the existing game process handle that the launchers keep (usually with full permissions). The LA process controls the game launcher process using it to send read and write commands to the game process. The thing that allows us to have an inter-process communication without a handle between the LA process and the game launcher is the fact that you can destroy the handle after setting up the named shared memory (before the game gets loaded). A thread is hijacked from the game launcher process, and the execution redirected to an an eternal loop shellcode. This shellcode keeps checking if the operation byte is set. When the LA process wants to read or write to the game process, it writes the shared memory on his own process the arguments for NtReadVirtualMemory/NtWriteVirtualMemory and sets the operation byte. That memory is reflected on the game launcher process, and the spinlock gets to execute the operation and stores the result on an offset of the same shared memory.

How It Actually Works

Considering game launchers that are x86, here's what it does step by step:

  1. Spawns a x86 process to get the addresses of the functions OpenFileMappingW, MapViewOfFile and CloseHandle. Those addresses are the same across all Windows processes, so they are used in the shellcode.
  2. Searches for a codecave in the game launcher, and injects a shellcode that will establish the IPC using the named shared memory and close the handle right after.
  3. Hijacks the game launcher main thread and makes it execute the IPC setup shellcode. The LA process waits for the first bytes of the shared memory to be updated with the address of the shared memory in the game launcher process.
  4. The spinlock shellcode is deployed in the shared memory and the game launcher's thread is redirected to it.
  5. From now on, the LA process has control of the operations thru the shared memory. If the control byte is 0, it will keep looping. If it's 1, it'll perform a read operation and 2 a write operation. It uses a few instructions to transict to x64 mode so we don't have to worry about WoW64's Heaven's Gate and we can simply use syscall opcodes to perform NtReadVirtualMemory/NtWriteVirtualMemory. The parameters for the functions are passed in the following struct:
        struct SpinLockControlStruct {
            DWORD64 operation = 0; //0=do nothing, 1=read, 2=write
            HANDLE hProcess = NULL;
            DWORD64 lpBaseAddress = NULL;
            DWORD64 lpBuffer = 0;
            SIZE_T nSize = 0;
        };
  1. After the operation, the result (if it's a read) comes in a specific offset of the shared memory.

How to Use It

The example on Launcher Abuser.cpp's main function is pretty self explanatory. Just call the functions below after the setup and do whatever you want:

//this function reads from the game memory
uintptr_t *dataPtr = gameLauncherCtl.readGameMemory(lpBaseAddress, lengthToRead);

//this function writes on the game memory
gameLauncherCtl.writeGameMemory(lpBaseAddress, (void*)bufferToWritePtr,  size);

More info

I wrote a tutorial on Guided Hacking. Check it out!

Disclaimer

The project was developed for education purposes only. Nothing here is new and it was somewhat based on this great project by harakirinox. It should not be used to cheat in online games. It ain't cool kids. Also, as always, big shout-out to Guided Hacking. Best game hacking learning resources on the internet. You should check them out if you haven't yet.

Similar Resources

Plugin to generate landscapes and oceans from the Unreal editor shader graph. Supports collisions, assets spawning, landscape layers. UE 4.26 / 4.27 / 5.0

Plugin to generate landscapes and oceans from the Unreal editor shader graph. Supports collisions, assets spawning, landscape layers. UE 4.26 / 4.27 / 5.0

Procedural Landscapes and Oceans as a plugin for unreal engine 4.26/4.27/5.0 using Editor Shader Graph Using the Editor Shader Graph, creating landsca

Oct 11, 2021

A CTRPF plugin for the Nintendo 3DS Pokémon games in which, supports both the 6th and 7th generations.

Multi-Pokémon Framework Multi-Pokémon Framework is a Pokémon plugin developed by Jared0714 that is based off of Nanquitas' CTRPluginFramework. This pl

Jul 31, 2022

Unreal Engine 4 vulnerability, that allows you to run shellcode directly into the target game process.

Unreal Engine 4 vulnerability, that allows you to run shellcode directly into the target game process, to load any DLL undetected from most game anti cheats, such as Easy Anti Cheat, BattleEye, Ricochet, Vanguard, ATG, and more.

Jul 22, 2022

Game Boy, Game Boy Color, and Game Boy Advanced Emulator

Game Boy, Game Boy Color, and Game Boy Advanced Emulator

SkyEmu SkyEmu is low level cycle accurate GameBoy, GameBoy Color and Game Boy Advance emulator that I have been developing in my spare time. Its prima

Aug 13, 2022

Improved version of the X-Ray Engine, the game engine used in the world-famous S.T.A.L.K.E.R. game series by GSC Game World.

Improved version of the X-Ray Engine, the game engine used in the world-famous S.T.A.L.K.E.R. game series by GSC Game World.

OpenXRay OpenXRay is an improved version of the X-Ray Engine, the game engine used in the world-famous S.T.A.L.K.E.R. game series by GSC Game World. S

Aug 10, 2022

GB Studio is a quick and easy to use retro adventure game creator for Game Boy available for Mac, Linux and Windows

GB Studio is a quick and easy to use retro adventure game creator for Game Boy available for Mac, Linux and Windows

GB Studio is a quick and easy to use retro adventure game creator for Game Boy available for Mac, Linux and Windows

Aug 6, 2022

A cycle-accurate Game Boy and Game Boy Color Emulator, with rewind feature.

A cycle-accurate Game Boy and Game Boy Color Emulator, with rewind feature.

Azayaka is a free and open-source Game Boy and Game Boy Color emulator written in C++. Features Cycle-Accurate emulation. Console based Debugg

Dec 16, 2021

CLUSEK-RT is a complex game engine written in C++ and the successor of the CLUSEK game engine

CLUSEK-RT is a complex game engine written in C++ and the successor of the CLUSEK game engine

CLUSEK-RT is a complex game engine written in C++ and the successor of the CLUSEK game engine. This engine has been designed with a cross-platform design in mind. Thanks to Vulkan API it delivers a next-gen experience with ray tracing to both Linux and Windows platforms

Jul 28, 2022

Minetest is an open source voxel game engine with easy modding and game creation

Minetest is an open source voxel game engine with easy modding and game creation

Aug 14, 2022
Comments
  • Q: How did you get the ingame address?

    Q: How did you get the ingame address?

    This project is a very clever idea to get access to the game memory. However I wonder how you got the ingame address for the player health in Overwatch. Like one can see in the gif. I can not read the process memory with CheatEngine to find the address. (That is what this project bypasses) Can one tell CheatEngine to use custom RPM and WPM functions (the functions of the GameLauncherController class)?

Related tags
📦 A familiar Minecraft Launcher with native support for macOS arm64 (M1)

ManyMC A familiar Minecraft Launcher with native support for macOS arm64 (M1) ⚠️ This is an UNOFFICIAL project. DO NOT report any issues to the MultiM

Aug 15, 2022
A custom launcher for Minecraft that allows you to easily manage multiple installations of Minecraft at once (Fork of MultiMC)

PolyMC is a custom launcher for Minecraft that focuses on predictability, long term stability and simplicity. This is a fork of the MultiMC Launcher a

Aug 13, 2022
Guess a random number between your selected range within the chances you select to win the game!

Number-Guessing-Game Guess a random number between your selected range within the chances you select to win the game! This project was developed by Sa

May 13, 2022
Steam API for the Godot game engine

Steam API for the Godot game engine

Aug 10, 2022
Legit DLC Unlocker for Steam, Epic, Origin, EA Desktop & Uplay (R1)

?? Koalageddon ?? Legit DLC Unlocker for Steam, Epic, Origin, EA Desktop & Uplay (R1) Welcome to the Koalageddon repository. For user-friendly introdu

Aug 14, 2022
Captain Claw external hack
Captain Claw external hack

Captain Captain is cheat for the the game known as Captain claw, it has 2 cheating modes and each has its features : god mod the player doesn't get an

Jul 7, 2022
So_Long project is a 2D game that can read/parse any given map.

SO_LONG So_Long project is a 2D game builded with <MLX> that can read/parse any given map. COMPILE cd path/to/SO_LONG && make or for bonus part cd pat

May 17, 2022
OpenMW is an open-source open-world RPG game engine that supports playing Morrowind.

OpenMW is an open-source open-world RPG game engine that supports playing Morrowind.

Aug 15, 2022
A Game Boy Printer emulator that supports the Phomemo T02 printer
A Game Boy Printer emulator that supports the Phomemo T02 printer

ESP32 + Phomemo T02 Game Boy Printer This project lets you print Game Boy Printer images via Bluetooth using a Phomemo T02 thermal printer and an ESP3

May 21, 2022
An OpenGL Engine Written In C Using A Very OOP-Like Way Of Programming

A Simple Engine in its very first stages of becoming a, Game Engine or just a framework for making games using OpenGL. Here are the features of the Op

Jul 9, 2022