This commit is contained in:
恍兮惚兮 2024-02-09 00:42:25 +08:00
parent 487006b680
commit 4d382d5a1c
4 changed files with 42 additions and 1 deletions

View File

@ -25,6 +25,7 @@ class ENGINE{
ALL_TRUE,
FILE, FILE_ALL,FILE_ANY,
RESOURCE_STR,
RESOURCE_STR_A,
CUSTOM,
};
CHECK_BY check_by;
@ -34,7 +35,8 @@ class ENGINE{
typedef std::function<bool()> check_by_custom_function;
typedef std::vector<const wchar_t*> check_by_list;
typedef const wchar_t* check_by_single;
std::variant<check_by_single,check_by_list,check_by_custom_function>check_by_target;
typedef const char* check_by_single_A;
std::variant<check_by_single_A,check_by_single,check_by_list,check_by_custom_function>check_by_target;
//virtual bool check_by_target(){return false;};
virtual bool attach_function()=0;
virtual const char* getenginename(){

View File

@ -402,3 +402,29 @@ bool elf2(){
bool Elf2::attach_function(){
return elf2()||Elf2attach_function();
}
bool ElfFunClubFinal::attach_function(){
auto entry=Util::FindImportEntry(processStartAddress,(DWORD)TextOutA);
if(entry==0)return false;
BYTE bytes[]={0x8b,XX,XX4};//mov reg,ds:TextOutA
memcpy(bytes+2,&entry,4);
bool succ=false;
for(auto addr:Util::SearchMemory(bytes, sizeof(bytes), PAGE_EXECUTE, processStartAddress, processStopAddress)){
BYTE s[]={XX,0xCC,0xCC,0xCC};
addr=reverseFindBytes(s,4,addr-0x100,addr);
if(addr==0)continue;
HookParam hp;
hp.address=addr+4;
hp.type=CODEC_ANSI_BE|USING_CHAR;
hp.text_fun=[](hook_stack* stack, HookParam *hp, uintptr_t* data, uintptr_t* split, size_t* len){
*data=(WORD)stack->stack[3];
*len=2;
*split=stack->stack[2]>8;
};
succ|= NewHook(hp,"ElfFunClubFinal");
}
return succ;
}

View File

@ -21,3 +21,15 @@ class Elf2:public ENGINE{
};
bool attach_function();
};
class ElfFunClubFinal:public ENGINE{
public:
ElfFunClubFinal(){
is_engine_certain=false;
check_by=CHECK_BY::CUSTOM;
check_by_target=[](){
return wcscmp(processName_lower,L"fanclub.exe")==0;
};
};
bool attach_function();
};

View File

@ -300,6 +300,7 @@ std::vector<ENGINE*> check_engines(){
new SYSD,
new IGScript,
new ScrPlayer,
new ElfFunClubFinal
};
}