Categories > Coding > C++ >

print exploit

Posts: 59

Threads: 12

Joined: Feb, 2020

Reputation: 2

Posted

it prints to the roblox console in-game

 

#include <iostream>
#include <Windows.h>
#include <thread>
#include <string>

#define ASLR(x)(x - 0x400000)

using namespace std;
void console(const char* title);// i defined the function here to make the code cleaner 

void main() {
    console("Prrr");// makes the console name "Prrr"

    typedef int(__cdecl* printf)(int, const char*, ...);
    printf print = reinterpret_cast<printf>(reinterpret_cast<std::uintptr_t>(GetModuleHandle(nullptr)) + ASLR(0x10570C0));

    string typ;
    string pr;
    bool t = true;

    cout << "*************************START**********************\n";
    cout << "Types are, normal = 0, info = 1, warn = 2, error = 3\n";

    do { // a do loop
        cout << "Text: ";
        getline(cin, pr);// get the input

        const char* v = pr.c_str(); // make a const char variable to store the input and read it using pr.c_str()
        bool valid_input = false;

        while (!valid_input) {// a while loop that checks if the entered input is not a number between 0-3
            cout << "Type: ";
            getline(cin, typ);
            if (typ[0] == '0') {
                print(0, v);
                valid_input = true;//if its valid it will stop the loop but the loop will run again because of the do loop
            }
            else if (typ[0] == '1') {
                print(1, v);
                valid_input = true;
            }
            else if (typ[0] == '2') {
                print(2, v);
                valid_input = true;
            }
            else if (typ[0] == '3') {
                print(3, v);
                valid_input = true;
            }
            else {
                cout << "Please Enter A Valid Type Number\n";
                Sleep(1000);
            }
        }

    } while (t);//if the bool t is = true it will continue to run

}



void console(const char* title) {
    DWORD old;
    VirtualProtect(reinterpret_cast <PVOID> (&FreeConsole), 1, PAGE_EXECUTE_READWRITE, &old);
    *reinterpret_cast <std::uint8_t*> (&FreeConsole) = 0xC3;
    VirtualProtect(&FreeConsole, 1, old, &old);
    AllocConsole();
    SetConsoleTitleA(title);
    FILE* file_stream;
    freopen_s(&file_stream, "CONOUT$", "w", stdout);
    freopen_s(&file_stream, "CONOUT$", "w", stderr);
    freopen_s(&file_stream, "CONIN$", "r", stdin);
}

BOOL __stdcall DllMain(HINSTANCE Dll, DWORD Reason, LPVOID Reserved) {
    if (Reason == DLL_PROCESS_ATTACH) {
        CreateThread(0, 0, (LPTHREAD_START_ROUTINE)main, 0, 0, 0);
    }
    return TRUE;
}
  • 0

want something? add me on disccord !Spl||HasH!#7562

Posts: 1996

Threads: 198

Joined: Apr, 2021

Reputation: 13

Replied

messy code but nice ig

  • 0

Random quote here...

Posts: 59

Threads: 12

Joined: Feb, 2020

Reputation: 2

Replied

  • 0

want something? add me on disccord !Spl||HasH!#7562

mliny

Mattress kidnapper 3000

Posts: 92

Threads: 14

Joined: Jan, 2023

Reputation: 6

Replied

It took me 30 seconds to realize that this ain't lua

  • 0

DeepPain

Wyvern

Posts: 476

Threads: 5

Joined: Jul, 2020

Reputation: 55

Replied

This code is absolutely abhorrent, and it's probably not even yours. I get you're trying to do something good (I think?) by posting this, but you didn't even provide an explanation of how it works. Please educate yourself.

  • 0

My Discord is xwyvern

https://i.imgur.com/mH521VR.png

Posts: 59

Threads: 12

Joined: Feb, 2020

Reputation: 2

Replied

@DeepPain,its all mine except the console function and the print, i just started learning c++ and i will comment it  

  • 0

want something? add me on disccord !Spl||HasH!#7562

Posts: 34

Threads: 8

Joined: Jul, 2022

Reputation: 10

Replied

modernized a bit for you

#include <iostream>
#include <Windows.h>
#include <thread>
#include <string_view>
#include <string>
#include <type_traits>

template<typename _to, typename _ty> requires(std::is_integral_v<_ty>)
auto rebase(const _ty address)
{
    static auto base = GetModuleHandleA(nullptr);
    return reinterpret_cast<_to>(base + (address - 0x400000));
}

void console(const std::string_view title)
{
    DWORD old{ 0 };

    // imp module
    const auto free_console = GetProcAddress(
        LoadLibraryA("api-ms-win-core-console-l1-1-0.dll"), "FreeConsole");

    VirtualProtect(free_console, 5, PAGE_EXECUTE_READWRITE, &old);

    // EXPL: this is fundamentally useless, roblox = checking if only c3 or 90. They also might check 4 this but some time since then
    /*
     PAYLOAD:
     xor eax, eax
     xor eax, eax ; does nothing
     ret ; c3
     */
    std::memcpy(free_console, "\x31\xC0\x31\xC0\xC3", 5);

    VirtualProtect(free_console, 5, old, &old);

    using freeconsole_tt = std::uint32_t(__stdcall*)(void);
    const auto free_console_pt = reinterpret_cast<freeconsole_tt>(free_console);

    AllocConsole();

    // if something went wrong, we're freeing console before roblox can do anything abt it.
    // this call shouldnt go through.
    free_console_pt();

    FILE* file_stream{ nullptr };

    freopen_s(&file_stream, "CONIN$", "r", stdin);
    freopen_s(&file_stream, "CONOUT$", "w", stdout);
    freopen_s(&file_stream, "CONOUT$", "w", stderr);

    SetConsoleTitleA(title.data());
}

int main()
{
    console("Console output thing");

    using conout_t = std::uint32_t(__cdecl*)(std::uint32_t, const char*, ...);
    const auto conout = rebase<conout_t>(0x400000);

    std::string in_str;

    std::cout << "Types are, normal = 0, info = 1, warn = 2, error = 3\n";
    std::cout << "Text: ";

    while (std::getline(std::cin, in_str))
    {
        switch (const auto ty = std::stoi(in_str))
        {
            // this can be shortened to 0..3 if using gcc
        case 0:
        case 1:
        case 2:
        case 3:
            conout(ty, in_str.c_str());
            break;
        default:
            std::cout << "Please enter a value between 0 and 3.\n";
            break;
        }
    }
    // this will never happen
    return 0;
}

int __stdcall DllMain(HINSTANCE__* main_inst, std::uint32_t reason_for_call, void* unused)
{
    if (reason_for_call == DLL_PROCESS_ATTACH) 
        std::thread{main}.detach();

    return 1;
}
  • 1

veh_handler and seh_handler disliker

<p>enis</p>

Users viewing this thread:

( Members: 0, Guests: 1, Total: 1 )