[RELEASE] proxy based retcheck bypass

Saw some guy make a thread on a pretty stupid way of bypassing retcheck, so I decided to reimplement it using more modern C++

basically, it writes a return at the start of the retcheck function before calling your function, then caches the original byte, and finally sets it back.

People have been using this stupid "method" for a while, but I decided it'd be fun to embed it in a wrapper instead.

 

code:

#pragma once
#include <Windows.h>
#include <cstdint>
#include <utility>
#include <type_traits>

namespace roblox::retcheck::proxy
{
	template <typename T1, typename T2>
	const T1 functional_cast(const T2 value)
	{
		return T1(value);
	}

	template <typename T, typename T2>
	const T rebase(const T2 value)
	{
		return functional_cast<T>((functional_cast<std::uintptr_t>(value) - 0x400000 + reinterpret_cast<std::uintptr_t>(GetModuleHandle(0))));
	}

	const auto retcheck_addr = rebase<std::uintptr_t>(0x6E6890);		/* this should be the address of the retcheck function, I'll make an auto updating vers later */

	template <typename T>
	class retcheck
	{
		const std::uintptr_t ptr{};

		template <typename T1>
		class proxy
		{
			const T1 ptr{};

		public:

			template <typename... T2>
			auto operator()(T2 ... args) const
			{
				return ptr(args...);
			}

			template <typename... T2>
			void operator()(std::is_void<void> is_void, T2 ... args) const
			{
				ptr(args...);
			}

			explicit proxy(T1 ptr) : ptr(ptr) {};
		};

		const std::uint32_t set_page(const std::uintptr_t ptr, const size_t sz, const std::uint32_t page) const
		{
			DWORD old{};
			VirtualProtect(reinterpret_cast<LPVOID>(ptr), sz, page, &old);
			return old;
		}

		const std::uint8_t write_byte(const std::uintptr_t ptr, const std::uint8_t byte) const
		{
			const auto original = set_page(ptr, 1, PAGE_EXECUTE_READWRITE);
			auto virtual_ptr = reinterpret_cast<std::uint8_t*>(ptr);
			const auto original_byte = *virtual_ptr;
			*virtual_ptr = byte;
			set_page(ptr, 1, original);
			return original_byte;
		}

	public:

		template <typename... T2 >
		auto operator()(T2... args) const
		{
			const auto prox = proxy<T>(functional_cast<T>(ptr));
			const auto original_byte = write_byte(retcheck_addr, 0xC3);
			const auto result = prox(args...);
			write_byte(retcheck_addr, original_byte);
			return result;
		}

		template <typename... T2 >
		void operator()(std::is_void<void> void_enforced, T2... args) const
		{
			const auto prox = proxy<T>(functional_cast<T>(ptr));
			const auto original_byte = write_byte(retcheck_addr, 0xC3);
			prox(args...);
			write_byte(retcheck_addr, original_byte);
		}

		template <typename T1>
		explicit retcheck(const T1 val) : ptr(rebase<std::uintptr_t>(val)) {}
	};
}

 

declaration:

	using getfield_t = int(__fastcall*)(roblox::types::lua_State*, int, const char*);
	static const auto getfield = retcheck::proxy::retcheck<getfield_t>(0x015268D0);

 

calling it:

addresses::getfield(RL, idx, name);

the problems:

Besides speed and the fact that this method requires an extra address, there really isn't that much wrong with it.

The real problem resides in my implementation of the proxy, so you can declare a function's return type automatically, and it'll work perfectly, however this function MUST return.

The issue resides in whether or not the function it's wrapping returns void, as a standalone type you can not return an actual value from void, and in order to keep it 100% compatible and easy to write there had to be a pretty stupid method behind solving it.

 

Instead of using C++20 concepts, or confusing type_trait magic, I just decided it'd be easier to overload the operator, I simply added an extra argument to determine whether or not the function returns void.

 

It also automatically rebases addresses, I really should've made a template argument as to whether or not this should be done, but I just didn't think about it in the moment, feel free to update it yourself.

 

Here's how you'd call a function that returns void using the proxy:

addresses::pushlstring(std::is_void<void>(), RL, str, len)

so if your function has a void return type, always supply std::is_void<void>() as the very first argument to it.

 

I wrote this wrapper based on this guy's thread https://wearedevs.net/forum/t/20356

I'll probably write an auto updating implementation soon, but if you can't get the address of the retcheck function

this thread probably isn't for you anyway