Skip to content

Instantly share code, notes, and snippets.

@ahmetabdi
Last active March 7, 2020 20:38
Show Gist options
  • Save ahmetabdi/e8efbc3d8d21cd1f123cad63ee8be5b2 to your computer and use it in GitHub Desktop.
Save ahmetabdi/e8efbc3d8d21cd1f123cad63ee8be5b2 to your computer and use it in GitHub Desktop.
uint64_t scan_for_camera_list() {
const auto base = reinterpret_cast<uint64_t>(LI_MODULE("UnityPlayer.dll").get());
if (!base)
return 0;
const auto dos_header = reinterpret_cast<IMAGE_DOS_HEADER*>(base);
const auto nt_header = reinterpret_cast<IMAGE_NT_HEADERS64*>(base + dos_header->e_lfanew);
uint64_t data_base;
uint64_t data_size;
for (int i = 0;;)
{
const auto section = reinterpret_cast<IMAGE_SECTION_HEADER*>(
base + dos_header->e_lfanew + // nt_header base
sizeof(IMAGE_NT_HEADERS64) + // start of section headers
(i * sizeof(IMAGE_SECTION_HEADER))); // section header at our index
if (RUNTIME_CRC32((char*)section->Name) == STATIC_CRC32(".data"))
{
data_base = section->VirtualAddress + base;
data_size = section->SizeOfRawData;
break;
}
i++;
if (i >= nt_header->FileHeader.NumberOfSections)
{
DEBUG("[!] Section not found\n");
return 0;
}
}
uint64_t camera_table = 0;
const auto camera_string = memstr((char*)data_base, XOR_STR("AllCameras"), data_size);
for (auto walker = (uint64_t*)camera_string; walker > 0; walker -= 1)
{
if (*walker > 0x100000 && *walker < 0xF00000000000000)
{
// [[[[unityplayer.dll + ctable offset]]] + 0x30] = Camera
camera_table = *walker;
break;
}
}
if (camera_table)
return camera_table;
DEBUG("[!] Unable to locate camera\n");
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment