squalr / squalr Goto Github PK

View Code? Open in Web Editor NEW

1.4K 62.0 222.0 104.59 MB

Squalr Memory Editor - Game Hacking Tool Written in C#

Home Page: https://www.squalr.com/

C# 99.79% Assembly 0.02% PowerShell 0.12% Smalltalk 0.01% Python 0.07%

csharp memory-hacking memory-editor x86 x86-64 windows cheat-engine game-hacking

squalr's Introduction

Squalr

Squalr Official Website

Join us on our Discord Channel

Squalr is performant Memory Editing software that allows users to create and share cheats in their windows desktop games. This includes memory scanning, pointers, x86/x64 assembly injection, and so on.

Squalr achieves fast scans through multi-threading combined with SIMD instructions. See this article: SIMD in .NET. To take advantage of these gains, your CPU needs to have support for SSE, AVX, or AVX-512.

Documentation

You can find detailed documentation on the Wiki. There are three ways to use Squalr:

Front end GUI
Scripting API
Back end NuGet packages

Below is some brief documentation on the NuGet package APIs

Receiving Engine Output:

If using the NuGet packages, it is important to hook into the engine's output to receive logs of events. These are invaluable for diagnosing issues.

using Squalr.Engine.Logging;

...

// Receive logs from the engine
Logger.Subscribe(new EngineLogEvents());

...

class EngineLogEvents : ILoggerObserver
{
	public void OnLogEvent(LogLevel logLevel, string message, string innerMessage)
	{
		Console.WriteLine(message);
		Console.WriteLine(innerMessage);
	}
}

Attaching The Engine

using Squalr.Engine.OS;
...

IEnumerable<Process> processes = Processes.Default.GetProcesses();

// Pick a process. For this example, we are just grabbing the first one.
Process process = processes.FirstOrDefault();

Processes.Default.OpenedProcess = process;

Manipulating Memory:

using Squalr.Engine.Memory;

...

Reader.Default.Read<Int32>(address);
Writer.Default.Write<Int32>(address);
Allocator.Alloc(address, 256);
IEnumerable<NormalizedRegion> regions = Query.GetVirtualPages(requiredProtection, excludedProtection, allowedTypes, startAddress, endAddress);
IEnumerable<NormalizedModule> modules = Query.GetModules();

Assembling/Disassembling:

Squalr can assemble and disassemble x86/x64 instructions, leveraging NASM.

using Squalr.Engine.Architecture;
using Squalr.Engine.Architecture.Assemblers;

...

// Perform assembly
AssemblerResult result = Assembler.Default.Assemble(assembly: "mov eax, 5", isProcess32Bit: true, baseAddress: 0x10000);

Console.WriteLine(BitConverter.ToString(result.Bytes).Replace("-", " "));

// Disassemble the result (we will get the same instructions back)
Instruction[] instructions = Disassembler.Default.Disassemble(bytes: result.Bytes, isProcess32Bit: true, baseAddress: 0x10000);

Console.WriteLine(instructions[0].Mnemonic);

Scanning:

Squalr has an API for performing high performance memory scanning:

using Squalr.Engine.Scanning;
using Squalr.Engine.Scanning.Scanners;
using Squalr.Engine.Scanning.Scanners.Constraints;
using Squalr.Engine.Scanning.Snapshots;

...

DataType dataType = DataType.Int32;

// Collect values
TrackableTask<Snapshot> valueCollectorTask = ValueCollector.CollectValues(
	SnapshotManager.GetSnapshot(Snapshot.SnapshotRetrievalMode.FromActiveSnapshotOrPrefilter, dataType));

// Perform manual scan on value collection complete
valueCollectorTask.CompletedCallback += ((completedValueCollection) =>
{
	Snapshot snapshot = completedValueCollection.Result;
	
	// Constraints
	ScanConstraintCollection scanConstraints = new ScanConstraintCollection();
	scanConstraints.AddConstraint(new ScanConstraint(ScanConstraint.ConstraintType.Equal, 25));

	TrackableTask<Snapshot> scanTask = ManualScanner.Scan(
		snapshot,
		allScanConstraints);

	SnapshotManager.SaveSnapshot(scanTask.Result);
});
	
	
for (UInt64 index = 0; index < snapshot.ElementCount; index++)
{
	SnapshotElementIndexer element = snapshot[index];

	Object currentValue = element.HasCurrentValue() ? element.LoadCurrentValue() : null;
	Object previousValue = element.HasPreviousValue() ? element.LoadPreviousValue() : null;
}

Debugging:

// Example: Tracing write events on a float
BreakpointSize size = Debugger.Default.SizeToBreakpointSize(sizeof(float));
CancellationTokenSource cancellationTokenSource = Debugger.Default.FindWhatWrites(0x10000, size, this.CodeTraceEvent);

...

// When finished, cancel the instruction collection
cancellationTokenSource.cancel();

...

private void CodeTraceEvent(CodeTraceInfo codeTraceInfo)
{
	Console.WriteLine(codeTraceInfo.Instruction.Address.ToString("X"));
	Console.WriteLine(codeTraceInfo.Instruction.Mnemonic);
}

Recommended Visual Studio Extensions

Reference	Description
XAML Formatter	XAML should be run through this formatter
StyleCop	StyleCop to enforce code conventions. Note that we deviate on some standard conventions. We use the full type name for variables (ex Int32 rather than int). The reasoning is that this is a memory editor, so we prefer to use the type name that is most explicit to avoid coding mistakes.

Build

In order to compile Squalr, you should only need Visual Studio 2017. This should be up to date, we frequently update Squalr to use the latest version of the .NET framework. Here are the important 3rd party libraries that this project uses:

Library	Description
EasyHook	Managed/Unmanaged API Hooking
SharpDisasm	Udis86 Assembler Ported to C#
CsScript	C# Scripting Library
AvalonEdit	Code Editing Library
SharpDX	DirectX Wrapper
CLRMD	.NET Application Inspection Library
AvalonDock	Docking Library
LiveCharts	WPF Charts

Planned Features

Library	Description	Purpose
AsmJit	x86/x64 Assembler	Replace FASM, improve scripting drastically
AsmJit	x86/x64 Assembler	Original C++ project. May port/interop this if the above version does not work (Neither may fully work, and something custom may be needed)
WpfHexEditorControl	Hex Editor	Hex editor / Memory Hex Editor
OpenTK	OpenGL Wrapper	Graphics Injection
SharpDX	DirectX Wrapper	Graphics Injection (Currently using SharpDX just for input)
SharpPCap	Packet Capture	Packet Editor
Packet.Net	Packet Capture	Packet Editor

squalr's People

Contributors

Stargazers

Watchers

Forkers

zcanann techlord-rce idkwim sk8tz richlinnell immutableglitch mvladk vebin igoryunusov rajkumarpandey samshine m1090c rcg4u ericwu inarikami dongtaoy boyyao awesomedotnetcore lvydra arocarlisle legobear2 eantoniobr zerocry lfyg jeffli678 justinhachemeister ryanbekabe staneee chinasmu m2m0ryz tevfikoguz alexrios cristiandsk kingkarlito themadjoker csharphub icxldd infistar seabreg peepeeepoooooooooooooopooooooooo alehacksp zanzo420 vnvizitiu linmerovingian codefather-labs peterg75 reversetools rdbo foxthealmighty zh4x pakrik limbo0x01 xhaplo thenurd xen0byte solotov vaultadi naguilar2 5l1v3r1 zhouzu 7eg mellopublic demonxjj rikumyo thespitefuloctopus jacszczurek jontheseeker dekoder marv21 celuni gmaf sylian1337 ztdf123 kebinuchiousu unrealskill-vip rodrigoieh ttuanhung vinojrajendran slimballin wildgenie chrisanlung ibrahim-elsakka ariffinaldo ilikemlik marciopocebon zepholos soobik ubuntulover09 anr2me qqq-tech subjectmatteregnoramoose enllune ju-87 enginelabs a157034816 stepzdjm pizza-prime monarchsolutions ulasguner zhcharlie1

squalr's Issues

Mask Before New Scans

Masking before scans scan help in situations where many regions get deallocated, causing a huge performance hit when throwing all of the ScanFailedExceptions

Documentation on MemoryBasicInformation64

Its non existent, add it to the struct.

Manual Scanner

Add a manual scanning mode similar to CE, except with the option to apply multiple constraints.

When this is functional, this will be the foundation for creating FSM scans

Generalized MVP Framework

The MVPs scattered around make this project much easier to maintain, however they are highly redundant, and can likely be combined into a generalized framework.

They are generally quite confusing to create under the current system, although they are rather clear in functionality once finished. Preferably both of these things would be easy.

Ideally they would allow the user to specify upsteam and downstream 'events' and 'Actions', though the details of this need to be explored

Proper IntPtr and Regionsize types

UIntPtr makes the most sense, as a pointer should be positive, but changing this would be painful. Does this matter?

RegionSize is being casted to an int from the Virutalpage's Information.RegionSize field, this is probably fine, but perhaps technically invalid.

32 Bit Version

Test code for 32 bit.

Remove all of the #if x86 preprocessing and instead rely on IsWoW64 or the size of IntPtr in some sort of helper class as the previous versions of Anathema did.

Send Updated Project Directory to Hooked Target

Send updated project directory to target process so that content loading works properly when the project directory changes (ie save as -> new location)

This will matter for hooked graphics that use the project root to find relative locations for file loading

Update: This is low priority, as the graphics hook has not been in development for awhile

Virtual ListView in Results

There is no reason not to and this solves a lot of problems.

Locking on Tables

Just like photoshop layers, things should be lockable.

Discard Previous Values on Bulk Scans

Tree Scans, Chunk Scans should not have previous values saved, wastes memory.

MemoryBasicInformation32 and 64 usage

The current one in use is the structure defined in MemoryBasic32. This should be switched around. MemoryBasic64 should be the standard, and in the case of calls to 32, the information should be copied to the 64 bit version of the struct.

UI Heat Map + Correlation System

Details of this are too underdeveloped right now.

Add WaterMark to Table Entry Editor

http://www.codeproject.com/Articles/27849/WaterMark-TextBox-For-Desktop-Applications-Using-C

Watermark text should indicate that the value parameter is optional or some shit

Results Read Displayed Addresses

Results should only be querying the OS for updates on the < 20 addresses that are shown. This requires some info to be passed up and down the MVP.

Add Region.CanCompare() method

Right now each individual element is tested, this can likely be moved to the prior abstraction level with a performance gain.

Remove InputHook from GUI

This needs to be moved into the model layer of the MVP and sent up to the GUI as needed

FSM Scanner

Event driven finite state machine filter implementation. Requires specification of data type it is tracking. Should watch each variable, take snapshots to determine if the state has changed.

Events can be:
Increased/Decreased
Changed
Comparison
Unchanged (Loop to self)

Abort Action Implementation

Slow tasks (ie 10 levels deep pointer scan) will pretty much never end, and the program will get locked up.

All scans should be cancelable

Snapshot Deletion

Be able to delete old snapshots

Mouse Correlation System

Details of this are too underdeveloped right now.

Advanced FSM Features

It may be possible to add complex but powerful events, such as the ability to cache seen values, and if the state changes but arrives at a seen value, then we can raise an event for that. (onDuplicate)

FSM Builder GUI with MVP

Implement some sort of GUI to build FSMs, using an MVP.

I am very unconcerned with the looks of this currently. In the future I will likely switch to WPF, in which case if this uses ugly winforms painting it will not be the end of the world.

Snapshot Mask on ReadAllMemory Fail

Since we aggressively merge, we need to be masking on read fail to prevent the entire region from going down

This will take some care to prevent issues down the road in the various scanners

Input manager controller support / general input

Add support for various game controllers, or just some form of mapping of all possible input events if this is possible.

Better Element Accessing OR Element Caching

Elements are getting bulky, and as an effect costly to allocate and deallocate constantly. Just make some sort of caching for these (Dictionary<Index, SnapshotElement>)

Cap Results ListView

Max displayed is Int.MaxValue so we need to cap at 2 billion (or less, honestly)

Snapshot history/branching

Loading an old snapshot and creating a new snapshot dependent should cause a 'fork' in the history, and this should probably be reflected somehow.

Region Merging on Labeled Snapshots

Determine how to preserve labels and merge labeled snapshot regions. May need some form of tie breaker on labels for duplicate entries, though this should never happen.

Input Correlation Search Control

Need to allow option of forward/backwards/nearest searches (comparing input to nearest scan data point).

Region Masking

Implement region masking. Simply call virtualqueryex and mask the results with a dead memory region (which may be discovered during filtering or labeling). This will allow the recovery of valid regions after an invalid read to a memory chunk.

MemoryRegions to Snapshots

In filters/labelers, instead of keeping a list of memory regions just grab a reference to the initial snapshot.

Element Wrapper

Rather than accessing the parallel arrays it may be useful to make manipulations via some form of element wrapper, where paired items (current/previous/label) can be read and written without concern for the underlying arrays.

Active snapshot changing

Be able to change the active snapshot

Remove Hooks on Target Process Change

Right now the hook will persist in the original process, which is bad

Update: This is super low priority, the graphics hooks are not being developed right now

Snapshot I/O

As many snapshots become in active use, RAM utilization will be high, and I/O will be needed. Keep the active snapshot in RAM.

EDIT: This may not be as bad as I thought. I'll need to figure this out regardless.

The bottleneck for scans is the actual iteration, not reading the large chunks of memory. It is unclear if switching to I/O storage for this memory will greatly influence scan times.

Syntax Checking Library Templating

The classes for syntax checking of each data type are highly redundant and require templating, and perhaps some reorganization in general.

Implement MVP for process selector

All of the functionality is in the GUI. This should be separated into an MVP design.

Individual Element Types

This is useful when we move to finite state scanners, which should be pretty fucking awesome.

Change Counter Labeler

Implement labeler which labels based on number of increases, decreases, or changes.

Process Selector Column Style

When adding a process, the following code is used to keep alignment:
ProcessListView.Columns.Add(" Processes");

Which is bad and non-adaptive.

Combine Scanner class and the MVP code

Right now scanners must inherit both from the abstract class and the MVP, there is probably a way to merge these. Perhaps by making all models abstract?

Allow Multi-Edit in Table

Editing attributes for multiple address items at once needs to be enabled

Chunk Scanner Auto Chunk Size

The chunk size should be determined algorithmically based on the initial input size

1GB -> 1KB
1MB -> 32B

Find a formula bitch

Batch Read/Write

Memory editor batch read/write calls would be a good addition for the far future, as the OS API calls are the bottleneck for most of these types of operations.

Concatenating contiguous memory accesses would be ideal.

Input Correlator MVP

Move functionality to an MVP

Memory Tables

Implement memory tables. This entails:
An MVP to interact with the class. GUI will need to be able to edit a table and send updates to the state of an entry (checked, unchecked).

Backend will need to propagate new labels back to the GUI (values)

Items that can make it to a table are:
Script (Enable/Disable - ASM)
Address (Freeze/Unfreeze - Description - Address - DataType - Value)

Process Comparer InvalidOperationException

A process can close before comparisons, raising this exception.

Input Correlator In-Place Correlation Statistic

Figure out if there is some sort of way to compute the correlation in the form of an online algorithm. Although the current implementation will generally not cause issues when used with hash trees for the most part, eventually the input correlator will run out of memory if left on its own.

Scan Settings

Based on the disabled Settings class, standard virtual memory pre-filtering settings should be enabled, with the ability for the user to update and save them.

Combine Snapshot Attributes as Struct

The values are meant to be kept together, so a struct can solve this. Since snapshot and snapshot are different, we may be able to use the new keyword to hide the base struct.

Snapshot
struct{
Address,
CurrentValue
PreviousValue}

snapshot
new struct{
Address,
CurrentValue
PreviousValue
Label}