Error while build
(*
(void
(__fastcall **
)(_QWORD, _QWORD
))(*
(_QWORD *
)(*
(_QWORD *
)(a1 + 88
) + 8LL
) + 688LL
)))((unsigned
int)v18, *v15
); #include <list>
#include <vector>
#include <string.h>
#include <pthread.h>
#include <thread>
#include <cstring>
#include <jni.h>
#include <unistd.h>
#include <fstream>
#include <iostream>
#include <dlfcn.h>
#include <fcntl.h>
#include <sys/stat.h>
#include "Includes/Logger.h"
#include "Includes/obfuscate.h"
#include "Includes/Utils.h"
#include "KittyMemory/MemoryPatch.h"
#include "Includes/Macros.h"
// ❗ Only one valid target lib name should be defined
#undef targetLibName
#define targetLibName OBFUSCATE
("libanogs.so"
)
#define _BYTE u
int8_t
#define _WORD u
int16_t
#define _DWORD u
int32_t
#define _QWORD u
int64_t
#define j_j__free
#define __OFSUB__
#define AnoSDKIoctlOld_0
#define HIWORD
#define JUMPOUT
(x
) goto *
(void**
)(x
)
#define byte_4
#define BYTE5
(x
) (((x
) >> 32
) & 0xFF
)
#define BYTE4
(x
) (((x
) >> 24
) & 0xFF
)
#define HIBYTE
(x
) (((x
) >> 8
) & 0xFF
)
#define BYTE6
(x
) (((x
) >> 40
) & 0xFF
)
#define BYTE1
(x
) ((x
) & 0xFF
)
#define BYTE3
(x
) (((x
) >> 16
) & 0xFF
)
#define BYTE2
(x
) (((x
) >> 8
) & 0xFF
)
#define ARM64_SYSREG
#define _WriteStatusReg
#define pkgName "com.pubg.imobile"
#pragma pack
(1
)
struct patch_t {
_BYTE nPatchType;
DWORD dwAddress;
};
// Base addresses
DWORD TBlueBase = 0;
DWORD AntBase = 0;
DWORD BufferBase = 0;
DWORD HdmpveBase = 0;
DWORD roosterBase = 0;
DWORD roosterSize = 0;
DWORD roosterAlloc = 0;
DWORD EGLBase = 0;
DWORD EGLSize = 0;
DWORD EGLAlloc = 0;
DWORD libEgl_base = 0;
DWORD libcBase = 0;
DWORD libcSize = 0;
DWORD libcAlloc = 0;
DWORD libUE4Base = 0;
DWORD libanogsBase = 0;
DWORD libanortBase = 0;
DWORD libanogsAlloc = 0;
DWORD libUE4Alloc = 0;
unsigned
int libanogsSize = 0;
unsigned
int libUE4Size = 0;
// Patch opcodes
#define SAFE_RETURN_PATCH "00 00 80 D2 C0 03 5F D6"
constexpr const char XX[] = "00 00 80 D2 C0 03 5F D6";
constexpr const char RET[] = "C0 03 5F D6";
constexpr const char NOP[] = "1F 20 03 D5";
constexpr const char RET1[] = "01 00 80 D2 C0 03 5F D6";
// ✅ Fixed: Correctly read TPIDR_EL0 via inline asm
static inline u
int64_t read_tpidr_el0
() {
u
int64_t value;
__asm__ __
volatile__
("mrs %0, tpidr_el0" : "=r"
(value
));
return value;
}
// Define _OWORD for 128-bit SIMD values
(match IDA struct
)
typedef struct {
u
int64_t low;
u
int64_t high;
} __attribute__
((aligned
(16
))) _OWORD;
#ifndef __
int128
# define __
int128 long long __attribute__
((__mode__
(__TI__
)))
#endif
// Forward declarations for IDA-generated
symbols
extern const _OWORD xmmword_A71C0;
extern const _OWORD xmmword_A73F0;
extern const _OWORD xmmword_A7450;
extern const _OWORD xmmword_EC708;
extern const _OWORD unk_EC718;
extern const _OWORD xmmword_EC728;
extern const char byte_EB26C;
extern const char byte_EC740;
// Stub functions for
undefined subs
void nullsub_169
(__
int64, unsigned
int, unsigned
int, ...
) { }
void sub_3B4480
(char
*, int) { }
void sub_3B474C
(char
*, unsigned
int) { }
__
int64 sub_3B4A70
(char
*, __
int64
) { return 0; }
__
int64 sub_3B4060
(__
int64
) { return 0; }
void sub_3B418C
(__
int64, char*
) { }
void sub_3B4CE4
(char*
) { }
__
int64 sub_387FE4
(__
int64
) { return 0; }
__
int64 sub_388040
(__
int64 a2, ...
) { return 0; }
#ifndef __fastcall
# define __fastcall
#endif
// Function prototypes
size_t getLibrarySize
(const char *libraryName
);
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
__
int64 __fastcall h_sub_404D50
(
__
int64 a1, __
int64 a2, __
int64 a3, __
int64 a4, __
int64 a5,
__
int64 a6, __
int64 a7, __
int64 a8, __
int64 a9, __
int64 a10,
__
int64 a11, __
int64 a12, __
int64 a13, __
int64 a14, __
int64 a15,
__
int64 a16, __
int64 a17, __
int64 a18, __
int64 a19, __
int64 a20,
__
int64 a21, __
int64 a22, __
int64 a23, __
int64 a24, __
int64 a25,
__
int64 a26, __
int64 a27, __
int64 a28, __
int64 a29, __
int64 a30,
__
int64 a31, __
int64 a32, __
int64 a33, __
int64 a34, __
int64 a35,
__
int64 a36, __
int64 a37, __
int64 a38, __
int64 a39, __
int64 a40,
__
int64 a41, __
int64 a42, __
int64 a43, __
int64 a44, __
int64 a45,
__
int64 a46, __
int64 a47
)
{
// 🔥 Neutralized function body
return 0LL;
}
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
void __fastcall h_sub_425864
(__
int64 a1
)
{
unsigned __
int64 StatusReg;
__
int64 v10;
_QWORD *v11;
__
int64 v12;
// ✅ Use fixed read_tpidr_el0
()
StatusReg = read_tpidr_el0
();
v10 = *
(_QWORD *
)(StatusReg + 40
);
// ✅ Replace all __
int128 with _OWORD to allow assignment
_OWORD v505;
_OWORD v506;
_OWORD v503 = {0};
_OWORD v504 = {0};
_OWORD v501 = {0};
_OWORD v502 = {0};
_OWORD v499 = {0};
_OWORD v500 = {0};
_OWORD v497 = {0};
_OWORD v498 = {0};
_OWORD v495 = {0};
_OWORD v496 = {0};
_OWORD v494 = {0};
_OWORD v492 = {0};
_OWORD v490 = {0};
_OWORD v491 = {0};
_OWORD v486;
_OWORD v487;
_OWORD v507;
_OWORD v488;
_OWORD v493[4] = {{0}};
v505 = xmmword_A71C0;
v506 = xmmword_A73F0;
v507 = xmmword_A7450;
v486 = xmmword_EC708;
v487 = unk_EC718;
v488 = xmmword_EC728;
v11 =
(_QWORD *
)(a1 + 8
);
v10 = *
(_QWORD *
)(a1 + 8
);
v12 = a1;
if
((unsigned __
int64
)&v490 >= v10 + 304 || v10 + 16 >=
(unsigned __
int64
)&v505
) {
v490 = *
(_OWORD *
)(v10 + 16
);
v491 = *
(_OWORD *
)(v10 + 32
);
v492 = *
(_OWORD *
)(v10 + 48
);
v493[0] = *
(_OWORD *
)(v10 + 64
);
v493[1] = *
(_OWORD *
)(v10 + 80
);
v493[2] = *
(_OWORD *
)(v10 + 96
);
v493[3] = *
(_OWORD *
)(v10 + 112
);
v494 = *
(_OWORD *
)(v10 + 128
);
v495 = *
(_OWORD *
)(v10 + 144
);
v496 = *
(_OWORD *
)(v10 + 160
);
v497 = *
(_OWORD *
)(v10 + 176
);
v498 = *
(_OWORD *
)(v10 + 192
);
v499 = *
(_OWORD *
)(v10 + 208
);
v500 = *
(_OWORD *
)(v10 + 224
);
v501 = *
(_OWORD *
)(v10 + 240
);
v502 = *
(_OWORD *
)(v10 + 256
);
v503 = *
(_OWORD *
)(v10 + 272
);
v504 = *
(_OWORD *
)(v10 + 288
);
} else {
v490 = *
(_OWORD *
)(v10 + 16
);
v491 = *
(_OWORD *
)(v10 + 32
);
v492 = *
(_OWORD *
)(v10 + 48
);
v493[0] = *
(_OWORD *
)(v10 + 64
);
v493[1] = *
(_OWORD *
)(v10 + 80
);
v493[2] = *
(_OWORD *
)(v10 + 96
);
v493[3] = *
(_OWORD *
)(v10 + 112
);
v494 = *
(_OWORD *
)(v10 + 128
);
v495 = *
(_OWORD *
)(v10 + 144
);
v496 = *
(_OWORD *
)(v10 + 160
);
v497 = *
(_OWORD *
)(v10 + 176
);
v498 = *
(_OWORD *
)(v10 + 192
);
v499 = *
(_OWORD *
)(v10 + 208
);
v500 = *
(_OWORD *
)(v10 + 224
);
v501 = *
(_OWORD *
)(v10 + 240
);
v502 = *
(_OWORD *
)(v10 + 256
);
v503 = *
(_OWORD *
)(v10 + 272
);
__
int64 v14 = *
(_QWORD *
)(v10 + 288
);
__
int64 v13 = *
(_QWORD *
)(v10 + 296
);
v504 = {
(u
int64_t
)v14,
(u
int64_t
)v13 };
}
unsigned
int *v15 =
(unsigned
int *
)(a1 + 56
);
unsigned
int v483 = *
(_DWORD *
)(a1 + 56
);
_DWORD **v484 =
(_DWORD **
)(a1 + 48
);
if
(*
(*v484
) != 8
)
return;
if
(!*
(_BYTE *
)(a1 + 72
)) {
while
(true
) {
__
int64 v20 = *v11;
__
int64 v18 = *
(_QWORD *
)(*v11 + 304LL
);
unsigned
int v21 =
(unsigned
int)v18;
bool v344 =
(unsigned __
int64
)v21 > *
(_QWORD *
)(*v11 + 312LL
);
*
(_BYTE *
)(*v11 + 376LL
) = 1;
if
(v344
) {
*
(*v484
) = 1;
*
(_BYTE *
)(v20 + 376
) = 0;
int v442 = *
(unsigned __
int8*
)(a1 + 97
);
if
(v442 == 2
) {
_BYTE v485[258];
sub_3B4480
((char*
)v485, 258
);
sub_3B474C
((char*
)v485, *v15
);
__
int64 v444 = sub_3B4A70
((char*
)v485, v18
);
__
int64 v445 = sub_3B4060
(v444
);
sub_3B418C
(v445,
(char*
)v485
);
sub_3B4CE4
((char*
)v485
);
} else if
(v442 == 1
) {
(*
(void
(__fastcall **
)(_QWORD, _QWORD
))(*
(_QWORD *
)(*
(_QWORD *
)(a1 + 88
) + 8LL
) + 688LL
)))((unsigned
int)v18, *v15
);
}
return;
}
// 🔥 Neutralized VM logic
return;
}
}
}
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
__
int64 __fastcall h_sub_3E8508
(__
int64 result, unsigned __
int8 *a2, long double a3
)
{
// ✅ Read TPIDR_EL0 safely
u
int64_t v376 = read_tpidr_el0
() + 40;
// 🔥 Neutralized function
return result;
}
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
__
int64 __fastcall h_sub_397138
(
int a1,
__
int64 a2,
_QWORD *a3,
__
int64 a4,
__
int64 a5,
__
int64 a6,
__
int64 a7,
__
int64 a8
)
{
// ✅ Safe register read
__
int64 v487 = read_tpidr_el0
() + 40;
// 🔥 Neutralized function
return 0LL;
}
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
void __fastcall h_sub_3F2110
(__
int64 a1, unsigned __
int8 *a2, long double a3
)
{
// 🔥 Neutralized function
return;
}
// ==================== HOOKING SECTION ====================
void *primos_thread
(void*
) {
while
(!isLibraryLoaded
("libUE4.so"
)) { sleep
(1
); }
while
(!isLibraryLoaded
("libanogs.so"
)) { sleep
(1
); }
LOGI
("PRIMOS LIBRARY LOADED @MODXWOLF"
);
system
(OBFUSCATE
("rm -rf /data/data/com.pubg.imobile/files; touch /data/data/com.pubg.imobilex/files;"
));
libanogsBase = findLibrary
(OBFUSCATE
("libanogs.so"
));
libUE4Base = findLibrary
(OBFUSCATE
("libUE4.so"
));
EGLBase = findLibrary
(OBFUSCATE
("libEGL.so"
));
TBlueBase = findLibrary
(OBFUSCATE
("libTBlueData.so"
));
libanortBase = findLibrary
(OBFUSCATE
("libanort.so"
));
AntBase = findLibrary
(OBFUSCATE
("libAntsVoice.so"
));
HdmpveBase = findLibrary
(OBFUSCATE
("libhdmpve.so"
));
libcBase = findLibrary
(OBFUSCATE
("libc.so"
));
BufferBase = findLibrary
(OBFUSCATE
("libstagefright_bufferpool@3.6.1.so"
));
libanogsSize = getLibrarySize
(OBFUSCATE
("libanogs.so"
));
libUE4Size = getLibrarySize
(OBFUSCATE
("libUE4.so"
));
libanogsAlloc =
(DWORD
)malloc
(libanogsSize
);
libUE4Alloc =
(DWORD
)malloc
(libUE4Size
);
memcpy
((void *
)libanogsAlloc,
(void *
)libanogsBase, libanogsSize
);
memcpy
((void *
)libUE4Alloc,
(void *
)libUE4Base, libUE4Size
);
void *handle = dlopen
(OBFUSCATE
("libc.so"
), RTLD_LAZY
);
if
(handle
) {
void *pthread_create_addr = dlsym
(handle, OBFUSCATE
("pthread_create"
));
void *inet_pton_addr = dlsym
(handle, OBFUSCATE
("inet_pton"
));
dlclose
(handle
);
}
HOOK_LIB_NO_ORIG
("libanogs.so", "0x3F2110", h_sub_3F2110
);
HOOK_LIB_NO_ORIG
("libanogs.so", "0x397138", h_sub_397138
);
HOOK_LIB_NO_ORIG
("libanogs.so", "0x3E8508", h_sub_3E8508
);
HOOK_LIB_NO_ORIG
("libanogs.so", "0x425864", h_sub_425864
);
HOOK_LIB_NO_ORIG
("libanogs.so", "0x404D50", h_sub_404D50
);
return NULL;
}
__attribute__
((constructor
))
void lib_main
() {
pthread_t ptid;
pthread_create
(&ptid, NULL, primos_thread, NULL
);
}
// ==================== GLOBAL DATA DEFINITIONS ====================
const _OWORD xmmword_A71C0 = { 0xFFFFFFFFFFFFFFFFULL, 0xFFFFFFFFFFFFFFFFULL };
const _OWORD xmmword_A73F0 = { 0x0000000000000000ULL, 0x0000000000000000ULL };
const _OWORD xmmword_A7450 = { 0x8000000000000000ULL, 0x8000000000000000ULL };
const _OWORD xmmword_EC708 = { 0x1111111111111111ULL, 0x2222222222222222ULL };
const _OWORD unk_EC718 = { 0x3333333333333333ULL, 0x4444444444444444ULL };
const _OWORD xmmword_EC728 = { 0x5555555555555555ULL, 0x6666666666666666ULL };
const char byte_EB26C = 0;
const char byte_EC740 = 0;
// Dummy implementation
size_t getLibrarySize
(const char *libraryName
)
{
FILE *mapsFile = fopen
("/proc/self/maps", "r"
);
if
(mapsFile == nullptr
) return 0;
char line[256];
size_t size = 0;
u
intptr_t startAddr = 0, endAddr = 0;
while
(fgets
(line, sizeof
(line
), mapsFile
))
{
if
(strstr
(line, libraryName
))
{
sscanf
(line, "%lx-%lx", &startAddr, &endAddr
);
size = endAddr - startAddr;
break;
}
}
fclose
(mapsFile
);
return size;
}
扫一扫
5241
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
