Home

Awesome

Scatter Manual Mapper

A DLL manual mapper with two main purposes:

This mapper is designed for an x64 target process and DLL.

Procedure

  1. Scan the target process for non-standard executable alignments inside modules.
  2. Analyze and adjust the DLL's executable code so that it could be scattered to 1 instruction per page - change all relative instructions and jump tables so that they reference absolute addresses.
  3. If the DLL has exports, then place as many instructions of the exports as possible into the found alignments. The alignments are split evenly across the exports so each export can be guaranteed to at least have its starting address in a valid module. For all other instructions, scatter them across newly allocated RX regions.
  4. Hijack control flow temporarily to call the DLL's entry.

Usage

smap [OPTIONS] <PID|PROCESS> <DLL>

Options:

Example

The DLL used can be found in the example directory. It consists of a basic D3D11 hook using MinHook and ImGui to showcase hooks on protected functions (IDXGISwapChain::Present and IDXGISwapChain::ResizeBuffers). If you want to use this project on protected games, a bypass for RW handle access is required or consider using access.

Fortnite

Apex