unstable patch for 202312+

include/api_logger.h

@@ -0,0 +1,6 @@
+#pragma once
+
+void LogAPIRequest(
+    const char *method,
+    const char *url
+);

include/common.h

@@ -0,0 +1,25 @@
+#pragma once
+
+#define WIN32_LEAN_AND_MEAN
+#define _CRT_SECURE_NO_WARNINGS
+
+#include <windows.h>
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#include <tlhelp32.h>
+#include <dbghelp.h>
+#include <psapi.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdarg.h>
+
+#pragma comment(lib,"ws2_32.lib")
+#pragma comment(lib,"dbghelp.lib")
+#pragma comment(lib,"psapi.lib")
+
+#ifndef ARRAYSIZE
+#define ARRAYSIZE(x) (sizeof(x)/sizeof((x)[0]))
+#endif

include/config.h

@@ -0,0 +1,24 @@
+#pragma once
+
+#include "common.h"
+
+#define CONFIG_FILE "redirector.json"
+#define MAX_REDIRECTS 64
+#define MAX_REWRITES 32
+#define DEFAULT_IP "127.0.0.1"
+#define DEFAULT_PORT 443
+
+// Static-IP redirect (used only by the disabled connect hook; DNS uses host rewrite below).
+extern char redirect_ip[16];
+extern int redirect_port;
+
+extern char *redirect_domains[MAX_REDIRECTS];
+extern int redirect_count_config;
+
+// Host rewrite pairs: a DNS lookup for exactly <from> is resolved as <to> instead, so real DNS
+// returns the target's current (possibly dynamic) IP.
+extern char *rewrite_from[MAX_REWRITES];
+extern char *rewrite_to[MAX_REWRITES];
+extern int rewrite_count;
+
+void LoadConfig(void);

include/connect_hook.h

@@ -0,0 +1,20 @@
+#pragma once
+
+#include "common.h"
+
+typedef int (WSAAPI *connect_t)(
+    SOCKET,
+    const struct sockaddr *,
+    int
+);
+
+extern connect_t real_connect;
+extern connect_t original_connect;
+
+extern BYTE backup_connect[14];
+
+int WSAAPI hook_connect(
+    SOCKET,
+    const struct sockaddr *,
+    int
+);

include/detour.h

@@ -0,0 +1,10 @@
+#pragma once
+
+#include "common.h"
+
+int InstallDetour(
+    LPVOID target,
+    LPVOID hook,
+    BYTE *backup,
+    LPVOID *outTrampoline
+);

include/dns_hook.h

@@ -0,0 +1,32 @@
+#pragma once
+
+#include "common.h"
+
+typedef int (WSAAPI *getaddrinfo_t)(
+    PCSTR,
+    PCSTR,
+    const ADDRINFOA *,
+    PADDRINFOA *
+);
+
+typedef struct hostent *(WSAAPI *gethostbyname_t)(
+    const char *
+);
+
+extern getaddrinfo_t real_getaddrinfo;
+extern getaddrinfo_t original_getaddrinfo;
+
+extern gethostbyname_t real_gethostbyname;
+
+extern BYTE backup_getaddrinfo[32];   // holds whole stolen instructions (>= 14 bytes)
+
+int WSAAPI hook_getaddrinfo(
+    PCSTR,
+    PCSTR,
+    const ADDRINFOA *,
+    PADDRINFOA *
+);
+
+struct hostent *WSAAPI hook_gethostbyname(
+    const char *
+);

include/eac_patch.h

@@ -0,0 +1,9 @@
+#pragma once
+
+#include "common.h"
+
+// Neutralizes EasyAntiCheat integration so the client runs against the self-hosted server. Ports the
+// managed EACPatches: (1) force EACManager's readiness check true, (2) make GenerateChallengeResponse
+// return base64(challenge). Resolves EACManager by its (unobfuscated) name and the readiness method by
+// signature (its obfuscated name rotates per build). Waits for the il2cpp runtime; safe on its own thread.
+void PatchEAC(void);

include/hook_manager.h

@@ -0,0 +1,7 @@
+#pragma once
+
+#include "common.h"
+
+DWORD WINAPI HookThread(LPVOID);
+
+BOOL InstallHooks(void);

include/http_rewrite.h

@@ -0,0 +1,9 @@
+#pragma once
+
+#include "common.h"
+
+// Installs the HTTP-layer host rewrite: hooks BestHTTP.HTTPManager.SendRequest(HTTPRequest) and
+// rewrites the request's Uri (ns.rec.net -> ns.recflare.net) so the URL, TLS SNI and Host header all
+// carry the target host -- a genuine request to the alternate backend, not just a redirected IP.
+// Waits for the il2cpp runtime; safe to call on its own thread. No-op if no rewrite pairs configured.
+void PatchHttpHostRewrite(void);

include/logger.h

@@ -0,0 +1,8 @@
+#pragma once
+
+#include "common.h"
+
+void InitConsole(void);
+void InitLogger(void);
+
+void Log(const char *fmt, ...);

include/memcheck_patch.h

@@ -0,0 +1,14 @@
+#pragma once
+
+#include "common.h"
+
+// Neutralizes the client's native memory-integrity scan, which otherwise fails boot with
+// "Launch validation failed. Is Rec Room installed correctly?" because it hashes GameAssembly.dll's
+// executable memory and our inline hooks (SendRequest, NotifyServerCertificate) change it.
+//
+// Mirrors the managed MemoryIntegrityPatch: find the scanner by signature (a class with both a
+// Thread and a CancellationTokenSource field), detour its public 0-param scan-start method to return
+// an already-resolved promise, so the boot step never sees a mismatch. All resolution is by
+// signature at runtime -- no obfuscated names, survives per-build name rotation. Waits for the
+// il2cpp runtime; safe on its own thread.
+void PatchMemoryIntegrityCheck(void);

include/module_watch.h

@@ -0,0 +1,5 @@
+#pragma once
+
+#include "common.h"
+
+void WatchModules(void);

include/packet_logger.h

@@ -0,0 +1,9 @@
+#pragma once
+
+#include <stddef.h>
+
+void LogPacket(
+    const char *direction,
+    const void *data,
+    size_t size
+);

include/process.h

@@ -0,0 +1,13 @@
+#pragma once
+
+#include "common.h"
+
+BOOL IsGameProcess(void);
+
+void LogProcessInfo(void);
+
+void DumpLoadedModules(void);
+
+void LogStack(void);
+
+LONG WINAPI MyExceptionHandler(EXCEPTION_POINTERS *e);

include/ssl_patch.h

@@ -0,0 +1,5 @@
+#pragma once
+
+#include "common.h"
+
+void PatchBestHTTPSSL(void);

include/strings.h

@@ -0,0 +1,10 @@
+#pragma once
+
+#include "common.h"
+
+int ShouldRedirect(const char *host);
+
+// If host exactly matches a configured rewrite pair's <from>, writes <to> into out (up to outlen)
+// and returns 1; otherwise returns 0 and leaves out untouched.
+// Example: host "ns.rec.net", from "ns.rec.net", to "ns.recflare.net" -> "ns.recflare.net".
+int RewriteHost(const char *host, char *out, size_t outlen);

include/tls_logger.h

@@ -0,0 +1,5 @@
+#pragma once
+
+void LogTLS(
+    const char *event
+);