#include "WillPlus.h"
/** 1/18/2015 jichi Add new WillPlus
 *  The old hook no longer works for new game.
 *  Sample game: [150129] [honeybee] RE:BIRTHDAY SONG
 *
 *  Note, WillPlus engine is migrating to UTF16 using GetGlyphOutlineW such as:
 *      [141218] [Guily] 手�めにされる九人の堕女
 *  This engine does not work for GetGlyphOutlineW, which, however, does not need a H-code.
 *
 *  See: http://sakuradite.com/topic/615
 *
 *  There WillPlus games have many hookable threads.
 *  But it is kind of important to find the best one.
 *
 *  By inserting hw point:
 *  - There is a clean text thread with fixed memory address.
 *    However, it cannot extract character name like GetGlyphOutlineA.
 *  - This is a non-clean text thread, but it contains garbage such as %LC.
 *
 *  By backtracking from GetGlyphOutlineA:
 *  - GetGlyphOutlineA sometimes can extract all text, sometimes not.
 *  - There are two GetGlyphOutlineA functions.
 *    Both of them are called statically in the same function.
 *    That function is hooked.
 *
 *  Hooked function:
 *  0041820c   cc               int3
 *  0041820d   cc               int3
 *  0041820e   cc               int3
 *  0041820f   cc               int3
 *  00418210   81ec b4000000    sub esp,0xb4
 *  00418216   8b8424 c4000000  mov eax,dword ptr ss:[esp+0xc4]
 *  0041821d   53               push ebx
 *  0041821e   8b9c24 d0000000  mov ebx,dword ptr ss:[esp+0xd0]
 *  00418225   55               push ebp
 *  00418226   33ed             xor ebp,ebp
 *  00418228   56               push esi
 *  00418229   8bb424 dc000000  mov esi,dword ptr ss:[esp+0xdc]
 *  00418230   03c3             add eax,ebx
 *  00418232   57               push edi
 *  00418233   8bbc24 d8000000  mov edi,dword ptr ss:[esp+0xd8]
 *  0041823a   896c24 14        mov dword ptr ss:[esp+0x14],ebp
 *  0041823e   894424 4c        mov dword ptr ss:[esp+0x4c],eax
 *  00418242   896c24 24        mov dword ptr ss:[esp+0x24],ebp
 *  00418246   39ac24 e8000000  cmp dword ptr ss:[esp+0xe8],ebp
 *  0041824d   75 29            jnz short .00418278
 *  0041824f   c74424 24 010000>mov dword ptr ss:[esp+0x24],0x1
 *
 *  ...
 *
 *  00418400   56               push esi
 *  00418401   52               push edx
 *  00418402   ff15 64c04b00    call dword ptr ds:[0x4bc064]             ; gdi32.getglyphoutlinea
 *  00418408   8bf8             mov edi,eax
 *
 *  The old WillPlus engine can also be inserted to the new games.
 *  But it has no effects.
 *
 *  A split value is used to get saving message out.
 *
 *  Runtime stack for the scenario thread:
 *  0012d9ec   00417371  return to .00417371 from .00418210
 *  0012d9f0   00000003  1
 *  0012d9f4   00000000  2
 *  0012d9f8   00000130  3
 *  0012d9fc   0000001a  4
 *  0012da00   0000000b  5
 *  0012da04   00000016  6
 *  0012da08   0092fc00  .0092fc00 ms gothic ; jichi: here's font
 *  0012da0c   00500aa0  .00500aa0 shun ; jichi: text is here in arg8
 *  0012da10   0217dcc0
 *
 *  Runtime stack for name:
 *  0012d9ec   00417371  return to .00417371 from .00418210
 *  0012d9f0   00000003
 *  0012d9f4   00000000
 *  0012d9f8   00000130
 *  0012d9fc   0000001a
 *  0012da00   0000000b
 *  0012da04   00000016
 *  0012da08   0092fc00  .0092fc00
 *  0012da0c   00500aa0  .00500aa0
 *  0012da10   0217dcc0
 *  0012da14   00000000
 *  0012da18   00000000
 *
 *  Runtime stack for non-dialog scenario text.
 *  0012e5bc   00438c1b  return to .00438c1b from .00418210
 *  0012e5c0   00000006
 *  0012e5c4   00000000
 *  0012e5c8   000001ae
 *  0012e5cc   000000c8
 *  0012e5d0   0000000c
 *  0012e5d4   00000018
 *  0012e5d8   0092fc00  .0092fc00
 *  0012e5dc   0012e628
 *  0012e5e0   0b0d0020
 *  0012e5e4   004fda98  .004fda98
 *
 *  Runtime stack for saving message
 *  0012ed44   00426003  return to .00426003 from .00418210
 *  0012ed48   000003c7
 *  0012ed4c   00000000
 *  0012ed50   000000d8
 *  0012ed54   0000012f
 *  0012ed58   00000008
 *  0012ed5c   00000010
 *  0012ed60   0092fc00  .0092fc00
 *  0012ed64   00951d88  ascii "2015/01/18"
 */

namespace
{ // unnamed

  void SpecialHookWillPlus(hook_stack *stack, HookParam *hp, uintptr_t *data, uintptr_t *split, size_t *len)
  {
    // static DWORD detect_offset; // jichi 1/18/2015: this makes sure it only runs once
    // if (detect_offset)
    //   return;
    DWORD i, l;
    union
    {
      DWORD retn;
      WORD *pw;
      BYTE *pb;
    };
    retn = stack->retaddr; // jichi 1/18/2015: dynamically find function return address
    i = 0;
    while (*pw != 0xc483)
    { // add esp, $
      l = ::disasm(pb);
      if (++i == 5)
        // ConsoleOutput("Fail to detect offset.");
        break;
      retn += l;
    }
    // jichi 2/11/2015: Check baddaddr which might crash the game on Windows XP.
    if (*pw == 0xc483 && !::IsBadReadPtr((LPCVOID)(pb + 2), 1) && !::IsBadReadPtr((LPCVOID)(*(pb + 2) - 8), 1))
    {
      ConsoleOutput("WillPlus1 pattern found");
      // jichi 1/18/2015:
      // By studying [honeybee] RE:BIRTHDAY SONG, it seems the scenario text is at fixed address
      // This offset might be used to find fixed address
      // However, this method cannot extract character name like GetGlyphOutlineA
      hp->offset = *(pb + 2) - 8;

      // Still extract the first text
      // hp->type ^= EXTERN_HOOK;
      char *str = *(char **)(stack->base + hp->offset);
      *data = (DWORD)str;
      *len = ::strlen(str);
      *split = 0; // 8/3/2014 jichi: use return address as split
    }
    else
    { // jichi 1/19/2015: Try willplus2
      ConsoleOutput("WillPlus1 pattern not found, try WillPlus2 instead");
      hp->offset = 4 * 8;                                 // arg8, address of text
      hp->type = USING_STRING | NO_CONTEXT | USING_SPLIT; // merge different scenario threads
      hp->split = 4 * 1;                                  // arg1 as split to get rid of saving message
      // The first text is skipped here
      // char *str = *(char **)(esp_base + hp->offset);
      //*data = (DWORD)str;
      //*len = ::strlen(str);
    }
    hp->text_fun = nullptr; // stop using text_fun any more
    // detect_offset = 1;
  }

  // Although the new hook also works for the old game, the old hook is still used by default for compatibility
  bool InsertOldWillPlusHook()
  {
    //__debugbreak();
    enum
    {
      sub_esp = 0xec81
    }; // jichi: caller pattern: sub esp = 0x81,0xec byte
    ULONG addr = MemDbg::findCallerAddress((ULONG)::GetGlyphOutlineA, sub_esp, processStartAddress, processStopAddress);
    if (!addr)
    {
      ConsoleOutput("WillPlus: function call not found");
      return false;
    }

    HookParam hp;
    hp.address = addr;
    hp.text_fun = SpecialHookWillPlus;
    hp.type = USING_STRING;
    ConsoleOutput("INSERT WillPlus");
    return NewHook(hp, "WillPlus");
  }

  const char *_willplus_trim_a(const char *text, size_t *size)
  {
    int textSize = ::strlen(text);
    int prefix = 0;
    if (text[0] == '%')
    {
      while (prefix < textSize - 1 && text[prefix] == '%' && ::isupper(text[prefix + 1]))
      {
        prefix += 2;
        while (::isupper(text[prefix]))
          prefix++;
      }
    }
    {
      int pos = textSize;
      for (int i = textSize - 1; i >= prefix; i--)
      {
        char ch = text[i];
        if (::isupper(ch))
          ;
        else if (ch == '%')
          pos = i;
        else
          break;
      }
      int suffix = textSize - pos;
      if (size)
        *size = textSize - prefix - suffix;
    }
    return text + prefix;
  }

  const wchar_t *_willplus_trim_w(const wchar_t *text, size_t *size)
  {
    int textSize = ::wcslen(text);
    int prefix = 0;
    if (text[0] == '%')
    {
      while (prefix < textSize - 1 && text[prefix] == '%' && ::isupper(text[prefix + 1]))
      {
        prefix += 2;
        while (::isupper(text[prefix]))
          prefix++;
      }
    }
    {
      int pos = textSize;
      for (int i = textSize - 1; i >= prefix; i--)
      {
        wchar_t ch = text[i];
        if (::isupper(ch))
          ;
        else if (ch == '%')
          pos = i;
        else
          break;
      }
      int suffix = textSize - pos;
      if (size)
        *size = textSize - prefix - suffix;
    }
    return text + prefix;
  }

  void SpecialHookWillPlusA(hook_stack *stack, HookParam *hp, uintptr_t *data, uintptr_t *split, size_t *len)
  {
    int index = 0;
    auto text = (LPCSTR)stack->eax;
    if (!text)
      return;
    if (index) // index == 1 is name
      text -= 1024;
    if (!*text)
      return;
    text = _willplus_trim_a(text, (size_t *)len);
    *data = (DWORD)text;
    *split = FIXED_SPLIT_VALUE << index;
  }
  bool WillPlus_extra_filter(void *data, size_t *size, HookParam *)
  {

    auto text = reinterpret_cast<LPWSTR>(data);
    StringFilter(text, size, L"%XS", 5); // remove %XS followed by 2 chars
    std::wstring str = text;
    str = str.substr(0, *size / 2);
    strReplace(str, L"\\n", L"\n");
    std::wregex reg1(L"\\{(.*?):(.*?)\\}");
    std::wstring result1 = std::regex_replace(str, reg1, L"$1");

    std::wregex reg11(L"\\{(.*?);(.*?)\\}");
    result1 = std::regex_replace(result1, reg11, L"$1");

    std::wregex reg2(L"%[A-Z]+");
    result1 = std::regex_replace(result1, reg2, L"");

    write_string_overwrite(data, size, result1);
    return true;
  };
  bool InsertWillPlusAHook()
  {
    // by iov
    const BYTE bytes2[] = {0x8B, 0x00, 0xFF, 0x76, 0xFC, 0x8B, 0xCF, 0x50};
    ULONG range2 = min(processStopAddress - processStartAddress, MAX_REL_ADDR);
    ULONG addr2 = MemDbg::findBytes(bytes2, sizeof(bytes2), processStartAddress, processStartAddress + range2);
    if (addr2)
    {
      HookParam myhp;
      myhp.address = addr2 + 2;

      myhp.type = CODEC_UTF16 | NO_CONTEXT | USING_STRING;

      myhp.offset = get_reg(regs::eax);
      myhp.filter_fun = WillPlus_extra_filter;
      char nameForUser[HOOK_NAME_SIZE] = "WillPlus3_memcpy";

      ConsoleOutput("Insert: WillPlus3_memcpy Hook");
      return NewHook(myhp, nameForUser);
    }

    const BYTE bytes[] = {
        0x81, 0xec, 0x14, 0x08, 0x00, 0x00 // 0042B5E0   81EC 14080000    SUB ESP,0x814	; jichi: text in eax, name in eax - 1024, able to copy
    };
    DWORD addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);
    if (!addr)
    {
      ConsoleOutput("WillPlusA: pattern not found");
      return false;
    }
    HookParam hp;
    hp.address = addr;
    hp.text_fun = SpecialHookWillPlusA;
    hp.type = NO_CONTEXT;
    hp.filter_fun = NewLineStringFilterA; // remove two characters of "\\n"
    ConsoleOutput("INSERT WillPlusA");
    return NewHook(hp, "WillPlusA");
  }

  void SpecialHookWillPlusW(hook_stack *stack, HookParam *hp, uintptr_t *data, uintptr_t *split, size_t *len)
  {
    auto text = (LPCWSTR)stack->ecx;
    if (!text || !*text)
      return;
    text = _willplus_trim_w(text, (size_t *)len);
    *len *= 2;
    *data = (DWORD)text;
    *split = FIXED_SPLIT_VALUE << hp->user_value;
  }

  bool InsertWillPlusWHook()
  {
    const BYTE bytes1[] = {
        // scenario
        0x83, 0xc0, 0x20,                                                // 00452b02   83c0 20     add eax,0x20    ; jichi: hook before here, text in ecx
        0x33, 0xd2,                                                      // 00452b05   33d2        xor edx,edx
        0x8b, 0xc1,                                                      // 00452b07   8bc1        mov eax,ecx
        0xc7, 0x84, 0x24, 0xe0, 0x01, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00 // 00452b09   c78424 e0010000 07000000      mov dword ptr ss:[esp+0x1e0],0x7
                                                                         // 00452b14   c78424 dc010000 00000000      mov dword ptr ss:[esp+0x1dc],0x0
    };
    const BYTE bytes2[] = {
        // name
        0x33, 0xdb,                                                      // 00453521   33db                            xor ebx,ebx  ; jichi: hook here, text in ecx
        0x33, 0xd2,                                                      // 00453523   33d2                            xor edx,edx
        0x8b, 0xc1,                                                      // 00453525   8bc1                            mov eax,ecx
        0xc7, 0x84, 0x24, 0x88, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00 // 00453527   c78424 88000000 07000000        mov dword ptr ss:[esp+0x88],0x7
                                                                         // 00453532   899c24 84000000                 mov dword ptr ss:[esp+0x84],ebx
    };
    const BYTE *bytes[] = {bytes1, bytes2};
    const size_t sizes[] = {sizeof(bytes1), sizeof(bytes2)};
    auto succ = false;
    for (int i = 0; i < 2; i++)
    {
      DWORD addr = MemDbg::findBytes(bytes[i], sizes[i], processStartAddress, processStopAddress);
      if (!addr)
      {
        ConsoleOutput("WillPlusW: pattern not found");
        return false;
      }
      HookParam hp;
      hp.address = addr;
      hp.text_fun = SpecialHookWillPlusW;
      hp.type = NO_CONTEXT | CODEC_UTF16;
      hp.user_value = i;
      hp.filter_fun = NewLineStringFilterW; // remove two characters of "\\n"
      ConsoleOutput("INSERT WillPlusW");
      succ |= NewHook(hp, "WillPlusW");
    }
    return succ;
  }
  /*
    Artikash 9/29/2018: Updated WillPlus hook
    Sample games: https://vndb.org/r54549 https://vndb.org/v22705
    Not too sure about the stability of this pattern, but it works for both of the above
    Hook code for first game: /HQ-8*0@43D620. This seems fairly stable: __thiscall calling convention and first member points to string
    Method to find hook code: trace call stack from GetGlyphOutlineW
    Disassembly from first game (damekoi). The first few instructions are actually a common function prologue: not enough to locate hook
    Hooking SysAllocString also seems to work, but has some garbage
    0043D61D - C2 0800               - ret 0008 { 8 }
    0043D620 - 55                    - push ebp
    0043D621 - 8B EC                 - mov ebp,esp
    0043D623 - 6A FF                 - push -01 { 255 }
    0043D625 - 68 6B6D5400           - push 00546D6B { [139] }
    0043D62A - 64 A1 00000000        - mov eax,fs:[00000000] { 0 }
    0043D630 - 50                    - push eax
    0043D631 - 81 EC 30010000        - sub esp,00000130 { 304 }
    0043D637 - A1 08E05800           - mov eax,[0058E008] { [6A9138CD] }
    0043D63C - 33 C5                 - xor eax,ebp
    0043D63E - 89 45 EC              - mov [ebp-14],eax
    0043D641 - 53                    - push ebx
    0043D642 - 56                    - push esi
    0043D643 - 57                    - push edi
    0043D644 - 50                    - push eax
    0043D645 - 8D 45 F4              - lea eax,[ebp-0C]
    0043D648 - 64 A3 00000000        - mov fs:[00000000],eax { 0 }
    0043D64E - 8B F9                 - mov edi,ecx
    0043D650 - 89 BD E8FEFFFF        - mov [ebp-00000118],edi
    0043D656 - 8B 45 08              - mov eax,[ebp+08]
    0043D659 - 8B 4D 14              - mov ecx,[ebp+14]
    0043D65C - F3 0F10 45 1C         - movss xmm0,[ebp+1C]
    0043D661 - 8B 5D 18              - mov ebx,[ebp+18]
    0043D664 - 89 85 10FFFFFF        - mov [ebp-000000F0],eax
    0043D66A - 8B 45 10              - mov eax,[ebp+10]
    0043D66D - 89 85 08FFFFFF        - mov [ebp-000000F8],eax
    0043D673 - 89 47 68              - mov [edi+68],eax
    0043D676 - 8B 45 20              - mov eax,[ebp+20]
    0043D679 - 51                    - push ecx
    ...
  */
  static bool InsertNewWillPlusHook()
  {
    bool found = false;
    const BYTE characteristicInstructions[] =
        {
            0xc2, 0x08, 0,          // ret 0008; Seems to always be ret 8 before the hookable function. not sure why, not sure if stable.
            0x55,                   // push ebp; hook here
            0x8b, 0xec,             // mov ebp,esp
            0x6a, 0xff,             // push -01
            0x68, XX4,              // push ?
            0x64, 0xa1, 0, 0, 0, 0, // mov eax,fs:[0]
            0x50,                   // push eax
            0x81, 0xec, XX4,        // sub esp,?
            0xa1, XX4,              // mov eax,[?]
            0x33, 0xc5,             // xor eax,ebp
                                    // 0x89, 0x45, 0xec // mov [ebp-14],eax; not sure if 0x14 is stable
        };
    for (auto addr : Util::SearchMemory(characteristicInstructions, sizeof(characteristicInstructions), PAGE_EXECUTE, processStartAddress, processStopAddress))
    {
      HookParam hp;
      hp.address = addr + 3;
      hp.type = USING_STRING | CODEC_UTF16 | DATA_INDIRECT;
      hp.offset = get_reg(regs::ecx);
      hp.index = 0;
      found |= NewHook(hp, "WillPlus2");
    }
    /*
    hook cmp reg,0x3000
    Sample games:
    https://vndb.org/r54549
    https://vndb.org/v22705
    https://vndb.org/v24852
    https://vndb.org/v25719
    https://vndb.org/v27227
    https://vndb.org/v27385
    https://vndb.org/v34544
    https://vndb.org/v35279
    https://vndb.org/v36011
    */
    const BYTE pattern[] =
        {
            0x81, XX, 0x00, 0x30, 0x00, 0x00 //    81FE 00300000  cmp esi,0x3000
                                             // or 81FB 00300000  cmp ebx,0x3000
                                             // or 81FF 00300000  cmp edi,0x3000
                                             //                   je xx
                                             //    8b4D A8        mov ecx,dword ptr ss:[ebp-??] hook here
                                             //    85C9           test ecx,ecx
        };
    for (auto addr : Util::SearchMemory(pattern, sizeof(pattern), PAGE_EXECUTE, processStartAddress, processStopAddress))
    {
      if (*(WORD *)(addr + 0xb) != 0xC985)
        continue;

      BYTE byte = *(BYTE *)(addr + 1);
      regs offset = regs::invalid;
      switch (byte)
      {
      case 0xf9:
        offset = regs::ecx;
        break;
      case 0xfa:
        offset = regs::edx;
        break;
      case 0xfb:
        offset = regs::ebx;
        break;
      case 0xfc:
        offset = regs::esp;
        break;
      case 0xfd:
        offset = regs::ebp;
        break;
      case 0xfe:
        offset = regs::esi;
        break;
      case 0xff:
        offset = regs::edi;
        break;
      };
      if (offset != regs::invalid)
      {
        HookParam hp;
        hp.address = addr + 8;
        hp.type = CODEC_UTF16;
        hp.offset = get_reg(offset);
        found |= NewHook(hp, "WillPlus3");
      }
    }
    if (!found)
      ConsoleOutput("WillPlus: failed to find instructions");
    return found;
  }

} // unnamed namespace

bool InsertWillPlusHook()
{
  bool ok = InsertOldWillPlusHook();
  ok = InsertWillPlusWHook() || InsertNewWillPlusHook() || InsertWillPlusAHook() || ok;
  return ok;
}
namespace will3
{

  int kp = 0;
  int lf = 0;
  int lc = 0;
  bool hookBefore(hook_stack *s, void *data, size_t *len, uintptr_t *role)
  {
    // DOUT(QString::fromUtf16((LPWSTR)s->stack[6]));//"MS UI Gothic"
    // DOUT(QString::fromUtf16((LPWSTR)s->stack[7]));//"���������ˤˤʤꤿ����%K%P"
    auto text = (LPWSTR)s->stack[7]; // text in arg1

    if (!text || !*text)
      return false;
    auto split = s->stack[0]; // retaddr

    std::wstring str = ((LPWSTR)s->stack[7]);
    kp = 0;
    lf = 0;
    if (endWith(str, L"%K%P"))
    {
      kp = 1;

      str = str.substr(0, str.size() - 4);
    }
    if (startWith(str, L"%LF"))
    {
      lf = 1;
      str = str.substr(3);
    }
    if (startWith(str, L"%LC"))
    {
      lc = 1;
      str = str.substr(3);
    }
    std::wregex reg1(L"\\{(.*?):(.*?)\\}");
    str = std::regex_replace(str, reg1, L"$1");

    std::wregex reg11(L"\\{(.*?);(.*?)\\}");
    str = std::regex_replace(str, reg11, L"$1");

    write_string_overwrite(data, len, str);

    return true;
  }
  void hookafter(hook_stack *s, void *data, size_t len)
  {
    auto data_ = std::wstring((wchar_t *)data, len / 2); // EngineController::instance()->dispatchTextWSTD(innner, Engine::ScenarioRole, 0);
    if (kp)
    {
      data_.append(L"%K%P");
    }
    if (lf)
    {
      data_ = L"%LF" + data_;
    }
    if (lc)
    {
      data_ = L"%LC" + data_;
    }
    s->stack[7] = (ULONG)(data_.c_str());
  }
}
bool InsertWillPlus4Hook()
{
  // 星の乙女と六華の姉妹
  const BYTE bytes[] = {
      0xc7, 0x45, 0xfc, 0x00, 0x00, 0x00, 0x00,
      0x33, 0xc9,
      0xc7, 0x47, 0x78, 0x00, 0x00, 0x00, 0x00};
  ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);

  if (addr == 0)
    return false;

  addr = MemDbg::findEnclosingFunctionBeforeDword(0x83dc8b53, addr, MemDbg::MaximumFunctionSize, 1);

  if (addr == 0)
    return false;
  HookParam hp;
  hp.address = addr;
  hp.offset = get_stack(7);
  // hp.filter_fun = WillPlus_extra_filter;
  hp.type = USING_STRING | CODEC_UTF16 | EMBED_ABLE;
  hp.hook_before = will3::hookBefore;
  hp.newlineseperator = L"\\n";
  hp.hook_after = will3::hookafter;
  return NewHook(hp, "EmbedWillplus3");
}
bool InsertWillPlus5Hook()
{
  // ensemble 29th Project『乙女の剣と秘めごとコンチェルト』オフィシャルサイト 体验版

  const BYTE bytes[] = {
      0x3d, XX2, 0x00, 0x00,
      0x72, XX,
      0x3d, XX2, 0x00, 0x00,
      0x77};
  /*if (v26 >= 0xE63E)
    {
      if (v26 <= 0xE757)*/
  /*3D 3E E6 00 00                cmp     eax, 0E63Eh
.text:0040A24B 72 6C                         jb      short loc_40A2B9
.text : 0040A24B
.text : 0040A24D 3D 57 E7 00 00                cmp     eax, 0E757h
.text : 0040A252 77 71                         ja      short loc_40A2C5*/

  bool ok = false;
  auto addrs = Util::SearchMemory(bytes, sizeof(bytes), PAGE_EXECUTE, processStartAddress, processStopAddress);
  for (auto addr : addrs)
  {
    HookParam hp;
    hp.address = addr;
    hp.offset = get_reg(regs::eax);
    hp.type = CODEC_UTF16;
    ConsoleOutput("INSERT WillPlus_extra2");
    ok |= NewHook(hp, "WillPlus_extra2");
  }
  return ok;
}
bool insertwillplus6()
{

  /*  0x00492870
  0:  50                      push   eax
  1:  b8 01 00 00 00          mov    eax,0x1
  6:  8d 74 24 18             lea    esi,[esp+0x18]
  a:  e8 f1 f5 f6 ff          call   0xfff6f600
  f:  6a 01                   push   0x1
  11: 68 7c 47 55 00          push   0x55477c
  16: 33 c0                   xor    eax,eax
  18: 8b d6                   mov    edx,esi
  1a: e8 21 8c f7 ff          call   0xfff78c40
  //hook after call,但有的句子没有
  1f: 83 f8 ff                cmp    eax,0xffffffff
  22: 75 dc                   jne    0x0
  //这里
  24: 8d 44 24 14             lea    eax,[esp+0x14]
  28: 8b cd                   mov    ecx,ebp
  2a: e8 81 f3 04 00          call   0x4f3b0
  2f: 83 7c 24 2c 08          cmp    DWORD PTR [esp+0x2c],0x8
  34: 8b f0                   mov    esi,eax
  36: 72 0d                   jb     0x45
  38: 8b 44 24 18             mov    eax,DWORD PTR [esp+0x18]
  3c: 50                      push   eax
  3d: e8 5e d6 09 00          call   0x9d6a0
  42: 83 c4 04                add    esp,0x4
  45: 33 c9                   xor    ecx,ecx
  47: c7 44 24 2c 07 00 00    mov    DWORD PTR [esp+0x2c],0x7
  */
  // 想いを捧げる乙女のメロディー
  const BYTE bytes[] = {
      0x6a, 0x01,
      0x68, 0x7c, 0x47, 0x55, 0x00,
      0x33, 0xc0,
      0x8b, 0xd6,
      0xe8, XX4,
      0x83, 0xf8,
      0xff, 0x75, 0xdc};
  auto addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);

  if (addr == 0)
    return false;
  addr += sizeof(bytes);
  ConsoleOutput("%p %p %p", addr, processStartAddress, processStopAddress);
  HookParam hp;
  hp.address = addr;
  hp.offset = get_stack(6);
  hp.type = CODEC_UTF16 | USING_STRING;
  ConsoleOutput("INSERT WillPlus6");
  return NewHook(hp, "WillPlus6");
}
bool willX()
{
  // 世界でいちばんNGな恋
  //  .text:0040EAE9 81 FE 94 81 00 00             cmp     esi, 8194h
  //  .text:0040EAEF 74 2C                         jz      short loc_40EB1D
  //  .text:0040EAEF
  //  .text:0040EAF1 81 FE 74 84 00 00             cmp     esi, 8474h
  //  .text:0040EAF7 74 24                         jz      short loc_40EB1D
  //  .text:0040EAF7
  //  .text:0040EAF9 81 FE 97 81 00 00             cmp     esi, 8197h
  //  .text:0040EAFF 74 1C                         jz      short loc_40EB1D
  //  .text:0040EAFF
  //  .text:0040EB01 81 FE 90 81 00 00             cmp     esi, 8190h
  //  .text:0040EB07 74 14                         jz      short loc_40EB1D
  //  .text:0040EB07
  //  .text:0040EB09 81 FE 59 81 00 00             cmp     esi, 8159h
  //  .text:0040EB0F 74 0C                         jz      short loc_40EB1D
  //  .text:0040EB0F
  //  .text:0040EB11 81 FE 96 81 00 00             cmp     esi, 8196h
  //  .text:0040EB17 0F 85 FF 00 00 00             jnz     loc_40EC1C
  const BYTE bytes[] = {
      0x81, 0xFE, 0x94, 0x81, 0x00, 0x00,
      0x74, XX,
      0x81, 0xFE, 0x74, 0x84, 0x00, 0x00,
      0x74, XX,
      0x81, 0xFE, 0x97, 0x81, 0x00, 0x00,
      0x74, XX,
      0x81, 0xFE, 0x90, 0x81, 0x00, 0x00,
      0x74, XX,
      0x81, 0xFE, 0x59, 0x81, 0x00, 0x00,
      0x74, XX,
      0x81, 0xFE, 0x96, 0x81, 0x00, 0x00};
  auto addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);

  if (addr == 0)
    return false;
  auto succ = false;
  {
    HookParam hp;
    hp.address = addr;
    hp.offset = get_reg(regs::esi);
    hp.type = NO_CONTEXT | CODEC_ANSI_BE;
    succ |= NewHook(hp, "willAN");
  }

  addr = MemDbg::findEnclosingAlignedFunction(addr);

  if (addr)
  {
    HookParam hp;
    hp.address = addr;
    hp.offset = get_stack(7);
    hp.type = USING_STRING;
    succ |= NewHook(hp, "willS");
  }
  return succ;
}

namespace
{ // unnamed

  // Sample prefix: %LF
  // Sample suffix: %L%P%W
  template <typename strT>
  strT trim(strT text, int *size)
  {
    int length = *size;
    if (text[0] == '%')
    { // handle prefix
      int pos = 0;
      while (pos < length - 1 && text[pos] == '%' && ::isupper(text[pos + 1]))
      {
        pos += 2;
        while (::isupper(text[pos]))
          pos++;
      }
      if (pos)
      {
        length -= pos;
        text += pos;
      }
    }
    { // handle suffix
      int pos = length;
      for (int i = length - 1; i >= 0; i--)
      {
        if (::isupper(text[i]))
          ;
        else if (text[i] == '%' && ::isupper(text[i + 1]))
          pos = i;
        else
          break;
      }
      length = pos;
    }
    *size = length;
    return text;
  }
  struct textinfo
  {
    std::wstring text_;
    int stackIndex_;
    int role_;
  };
  std::unordered_map<int, textinfo *> savetyperef;
  namespace TextHookW
  {

    // typedef TextHookW Self;

    template <int idx>
    bool hookBefore(hook_stack *s, void *data, size_t *len, uintptr_t *role)
    {
      auto info = savetyperef.at(idx);
      enum
      {
        sig = 0
      };
      auto text = (LPCWSTR)s->stack[info->stackIndex_];
      if (!text || !*text)
        return false;
      int size = ::wcslen(text),
          trimmedSize = size;
      auto trimmedText = trim(text, &trimmedSize);
      if (!trimmedSize || !*trimmedText)
        return false;
      std::wstring oldText = std::wstring(trimmedText, trimmedSize);
      write_string_overwrite(data, len, oldText);
      return true;
    }
    template <int idx>
    void hookafter(hook_stack *s, void *data, size_t len)
    {
      auto newText = std::wstring((LPWSTR)data, len / 2);
      auto info = savetyperef.at(idx);
      enum
      {
        sig = 0
      };
      auto text = (LPCWSTR)s->stack[info->stackIndex_];
      if (!text || !*text)
        return;
      int size = ::wcslen(text),
          trimmedSize = size;
      auto trimmedText = trim(text, &trimmedSize);
      if (!trimmedSize || !*trimmedText)
        return;
      std::wstring oldText = std::wstring(trimmedText, trimmedSize);
      if (newText == oldText)
        return;
      int prefixSize = trimmedText - text,
          suffixSize = size - prefixSize - trimmedSize;
      if (prefixSize)
        newText.insert(0, std::wstring(text, prefixSize));
      if (suffixSize)
        newText.append(std::wstring(trimmedText + trimmedSize, suffixSize));
      info->text_ = newText;
      s->stack[info->stackIndex_] = (ULONG)info->text_.c_str();
    }
    // explicit TextHookW(int hookStackIndex, int role = Engine::UnknownRole) : stackIndex_(hookStackIndex), role_(role) {}
    template <int _type>
    bool attach(const uint8_t *pattern, size_t patternSize, ULONG startAddress, ULONG stopAddress, int hookStackIndex, int role = Engine::UnknownRole)
    {
      ULONG addr = MemDbg::findBytes(pattern, patternSize, startAddress, stopAddress);
      if (addr == 0)
        return false;
      HookParam hp;
      hp.address = addr;
      auto _tinfo = new textinfo{};
      _tinfo->role_ = role;
      _tinfo->stackIndex_ = hookStackIndex;
      savetyperef[_type] = _tinfo;
      hp.hook_before = hookBefore<_type>;
      hp.type = EMBED_ABLE | CODEC_UTF16;
      hp.newlineseperator = L"\\n";
      hp.hook_after = hookafter<_type>;
      hp.hook_font = F_MultiByteToWideChar | F_GetGlyphOutlineW;
      char _[] = "EmbedWillplusW0";
      _[sizeof(_) - 2] += _type;
      return NewHook(hp, _);
    }
  };

  /**
   *  Sample game: なついろレシピ
   *  See: http://capita.tistory.com/m/post/251
   *
   *  Scenario:
   *  00452A8F   77 05            JA SHORT .00452A96
   *  00452A91   E8 A25B0B00      CALL .00508638                           ; JMP to msvcr90._invalid_parameter_noinfo
   *  00452A96   8B43 0C          MOV EAX,DWORD PTR DS:[EBX+0xC]
   *  00452A99   8B48 18          MOV ECX,DWORD PTR DS:[EAX+0x18]
   *  00452A9C   83C0 10          ADD EAX,0x10
   *  00452A9F   33D2             XOR EDX,EDX
   *  00452AA1   8BC1             MOV EAX,ECX
   *  00452AA3   C78424 C4010000 >MOV DWORD PTR SS:[ESP+0x1C4],0x7
   *  00452AAE   C78424 C0010000 >MOV DWORD PTR SS:[ESP+0x1C0],0x0
   *  00452AB9   66:899424 B00100>MOV WORD PTR SS:[ESP+0x1B0],DX
   *  00452AC1   8D70 02          LEA ESI,DWORD PTR DS:[EAX+0x2]
   *  00452AC4   66:8B10          MOV DX,WORD PTR DS:[EAX]
   *  00452AC7   83C0 02          ADD EAX,0x2
   *  00452ACA   66:85D2          TEST DX,DX
   *  00452ACD  ^75 F5            JNZ SHORT .00452AC4
   *  00452ACF   2BC6             SUB EAX,ESI
   *  00452AD1   D1F8             SAR EAX,1
   *  00452AD3   50               PUSH EAX
   *  00452AD4   51               PUSH ECX
   *  00452AD5   8DB424 B4010000  LEA ESI,DWORD PTR SS:[ESP+0x1B4]
   *  00452ADC   E8 DF4DFBFF      CALL .004078C0
   *  00452AE1   C68424 B8020000 >MOV BYTE PTR SS:[ESP+0x2B8],0x8
   *  00452AE9   8B43 10          MOV EAX,DWORD PTR DS:[EBX+0x10]
   *  00452AEC   2B43 0C          SUB EAX,DWORD PTR DS:[EBX+0xC]
   *  00452AEF   C1F8 04          SAR EAX,0x4
   *  00452AF2   83F8 02          CMP EAX,0x2
   *  00452AF5   77 05            JA SHORT .00452AFC
   *  00452AF7   E8 3C5B0B00      CALL .00508638                           ; JMP to msvcr90._invalid_parameter_noinfo
   *  00452AFC   8B43 0C          MOV EAX,DWORD PTR DS:[EBX+0xC]
   *  00452AFF   8B48 28          MOV ECX,DWORD PTR DS:[EAX+0x28]
   *  00452B02   83C0 20          ADD EAX,0x20    ; jichi: hook before here, text in ecx
   *  00452B05   33D2             XOR EDX,EDX
   *  00452B07   8BC1             MOV EAX,ECX
   *  00452B09   C78424 E0010000 07000000        MOV DWORD PTR SS:[ESP+0x1E0],0x7 ; jichi: key pattern is here, text in eax
   *  00452B14   C78424 DC010000 00000000        MOV DWORD PTR SS:[ESP+0x1DC],0x0
   *  00452B27   8D70 02          LEA ESI,DWORD PTR DS:[EAX+0x2]
   *  00452B2A   33DB             XOR EBX,EBX
   *  00452B2C   8D6424 00        LEA ESP,DWORD PTR SS:[ESP]
   *  00452B30   66:8B10          MOV DX,WORD PTR DS:[EAX]
   *  00452B33   83C0 02          ADD EAX,0x2
   *  00452B36   66:3BD3          CMP DX,BX
   *  00452B39  ^75 F5            JNZ SHORT .00452B30
   *  00452B3B   2BC6             SUB EAX,ESI
   *  00452B3D   D1F8             SAR EAX,1
   *  00452B3F   50               PUSH EAX
   *  00452B40   51               PUSH ECX
   *  00452B41   8DB424 D0010000  LEA ESI,DWORD PTR SS:[ESP+0x1D0]
   *  00452B48   E8 734DFBFF      CALL .004078C0
   *  00452B4D   C68424 B8020000 >MOV BYTE PTR SS:[ESP+0x2B8],0x9
   *  00452B55   895C24 1C        MOV DWORD PTR SS:[ESP+0x1C],EBX
   *  00452B59   395C24 14        CMP DWORD PTR SS:[ESP+0x14],EBX
   *  00452B5D   0F84 77080000    JE .004533DA
   *  00452B63   BE 07000000      MOV ESI,0x7
   *  00452B68   33C0             XOR EAX,EAX
   *  00452B6A   895C24 20        MOV DWORD PTR SS:[ESP+0x20],EBX
   *  00452B6E   89B424 FC010000  MOV DWORD PTR SS:[ESP+0x1FC],ESI
   *  00452B75   899C24 F8010000  MOV DWORD PTR SS:[ESP+0x1F8],EBX
   *  00452B7C   66:898424 E80100>MOV WORD PTR SS:[ESP+0x1E8],AX
   *  00452B84   8D4C24 3C        LEA ECX,DWORD PTR SS:[ESP+0x3C]
   *  00452B88   51               PUSH ECX
   *  00452B89   C68424 BC020000 >MOV BYTE PTR SS:[ESP+0x2BC],0xA
   *  00452B91   E8 7AACFCFF      CALL .0041D810
   *  00452B96   C68424 B8020000 >MOV BYTE PTR SS:[ESP+0x2B8],0xB
   *  00452B9E   399C24 C0010000  CMP DWORD PTR SS:[ESP+0x1C0],EBX
   *  00452BA5   0F84 BB020000    JE .00452E66
   *  00452BAB   81C7 14010000    ADD EDI,0x114
   */
  bool attachScenarioHookW1(ULONG startAddress, ULONG stopAddress)
  {
    // ECX PTR: 83 C0 20 33 D2 8B C1 C7 84 24 E0 01 00 00 07 00 00 00
    const uint8_t bytes[] = {
        0x83, 0xc0, 0x20,                                                // 00452b02   83c0 20     add eax,0x20    ; jichi: hook before here, text in ecx
        0x33, 0xd2,                                                      // 00452b05   33d2        xor edx,edx
        0x8b, 0xc1,                                                      // 00452b07   8bc1        mov eax,ecx
        0xc7, 0x84, 0x24, 0xe0, 0x01, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00 // 00452b09   c78424 e0010000 07000000      mov dword ptr ss:[esp+0x1e0],0x7
                                                                         // 00452b14   c78424 dc010000 00000000      mov dword ptr ss:[esp+0x1dc],0x0
    };
    int ecx = get_reg(regs::ecx) / 4;
    return TextHookW::attach<1>(bytes, sizeof(bytes), startAddress, stopAddress, ecx, Engine::ScenarioRole);
  }

  /**
   *  1/9/2016: 見上げてごらん、夜空の星を　体験版
   *
   *  0045580D   C68424 B8020000 08             MOV BYTE PTR SS:[ESP+0x2B8],0x8
   *  00455815   8B47 10                        MOV EAX,DWORD PTR DS:[EDI+0x10]
   *  00455818   2B47 0C                        SUB EAX,DWORD PTR DS:[EDI+0xC]
   *  0045581B   C1F8 04                        SAR EAX,0x4
   *  0045581E   83F8 02                        CMP EAX,0x2
   *  00455821   77 05                          JA SHORT .00455828
   *  00455823   E8 A0F70B00                    CALL .00514FC8                           ; JMP to msvcr90._invalid_parameter_noinfo
   *  00455828   8B7F 0C                        MOV EDI,DWORD PTR DS:[EDI+0xC]
   *  0045582B   83C7 20                        ADD EDI,0x20
   *  0045582E   8B7F 08                        MOV EDI,DWORD PTR DS:[EDI+0x8]
   *  00455831   33C9                           XOR ECX,ECX
   *  00455833   8BC7                           MOV EAX,EDI ; jichi: hook befoe here, text in eax assigned from edi
   *  00455835   C78424 E0010000 07000000       MOV DWORD PTR SS:[ESP+0x1E0],0x7 ; jichi: key pattern is here, text i eax
   *  00455840   899C24 DC010000                MOV DWORD PTR SS:[ESP+0x1DC],EBX
   *  00455847   66:898C24 CC010000             MOV WORD PTR SS:[ESP+0x1CC],CX
   *  0045584F   8D50 02                        LEA EDX,DWORD PTR DS:[EAX+0x2]
   *  00455852   66:8B08                        MOV CX,WORD PTR DS:[EAX]
   *  00455855   83C0 02                        ADD EAX,0x2
   *  00455858   66:3BCB                        CMP CX,BX
   *  0045585B  ^75 F5                          JNZ SHORT .00455852
   *  0045585D   2BC2                           SUB EAX,EDX
   *  0045585F   D1F8                           SAR EAX,1
   *  00455861   50                             PUSH EAX
   *  00455862   57                             PUSH EDI
   *  00455863   8DB424 D0010000                LEA ESI,DWORD PTR SS:[ESP+0x1D0]
   *  0045586A   E8 2120FBFF                    CALL .00407890
   *  0045586F   C68424 B8020000 09             MOV BYTE PTR SS:[ESP+0x2B8],0x9
   *  00455877   895C24 30                      MOV DWORD PTR SS:[ESP+0x30],EBX
   *  0045587B   395C24 18                      CMP DWORD PTR SS:[ESP+0x18],EBX
   *  0045587F   0F84 D1080000                  JE .00456156
   *  00455885   33D2                           XOR EDX,EDX
   *  00455887   895C24 24                      MOV DWORD PTR SS:[ESP+0x24],EBX
   *  0045588B   C78424 FC010000 07000000       MOV DWORD PTR SS:[ESP+0x1FC],0x7
   *  00455896   899C24 F8010000                MOV DWORD PTR SS:[ESP+0x1F8],EBX
   *  0045589D   66:899424 E8010000             MOV WORD PTR SS:[ESP+0x1E8],DX
   *  004558A5   8D4424 3C                      LEA EAX,DWORD PTR SS:[ESP+0x3C]
   */
  bool attachScenarioHookW2(ULONG startAddress, ULONG stopAddress)
  {
    // key pattern: C78424 E0010000 07000000
    const uint8_t bytes[] = {
        0x8b, 0xc7,                                                      // 00455833   8bc7                           mov eax,edi ; jichi: text in eax assigned from edi
        0xc7, 0x84, 0x24, 0xe0, 0x01, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00 // 00455835   c78424 e0010000 07000000       mov dword ptr ss:[esp+0x1e0],0x7 ; jichi: key pattern is here, text i eax
    };
    int edi = get_reg(regs::edi) / 4;
    return TextHookW::attach<2>(bytes, sizeof(bytes), startAddress, stopAddress, edi, Engine::ScenarioRole);
  }
  /**
   *  Sample game: なついろレシピ
   *  See: http://capita.tistory.com/m/post/251
   *
   *  Name:
   *
   *  004534FA   64:A3 00000000                  MOV DWORD PTR FS:[0],EAX
   *  00453500   8B75 14                         MOV ESI,DWORD PTR SS:[EBP+0x14]
   *  00453503   8B46 10                         MOV EAX,DWORD PTR DS:[ESI+0x10]
   *  00453506   2B46 0C                         SUB EAX,DWORD PTR DS:[ESI+0xC]
   *  00453509   8BF9                            MOV EDI,ECX
   *  0045350B   C1F8 04                         SAR EAX,0x4
   *  0045350E   897C24 14                       MOV DWORD PTR SS:[ESP+0x14],EDI
   *  00453512   85C0                            TEST EAX,EAX
   *  00453514   77 05                           JA SHORT .0045351B
   *  00453516   E8 1D510B00                     CALL .00508638                           ; JMP to msvcr90._invalid_parameter_noinfo
   *  0045351B   8B76 0C                         MOV ESI,DWORD PTR DS:[ESI+0xC]
   *  0045351E   8B4E 08                         MOV ECX,DWORD PTR DS:[ESI+0x8]
   *  00453521   33DB                            XOR EBX,EBX  ; jichi: hook here, text in ecx
   *  00453523   33D2                            XOR EDX,EDX
   *  00453525   8BC1                            MOV EAX,ECX
   *  00453527   C78424 88000000 07000000        MOV DWORD PTR SS:[ESP+0x88],0x7
   *  00453532   899C24 84000000                 MOV DWORD PTR SS:[ESP+0x84],EBX
   *  00453539   66:895424 74                    MOV WORD PTR SS:[ESP+0x74],DX
   *  0045353E   8D70 02                         LEA ESI,DWORD PTR DS:[EAX+0x2]
   *  00453541   66:8B10                         MOV DX,WORD PTR DS:[EAX]
   *  00453544   83C0 02                         ADD EAX,0x2
   *  00453547   66:3BD3                         CMP DX,BX
   *  0045354A  ^75 F5                           JNZ SHORT .00453541
   *  0045354C   2BC6                            SUB EAX,ESI
   *  0045354E   D1F8                            SAR EAX,1
   *  00453550   50                              PUSH EAX
   *  00453551   51                              PUSH ECX
   *  00453552   8D7424 78                       LEA ESI,DWORD PTR SS:[ESP+0x78]
   *  00453556   E8 6543FBFF                     CALL .004078C0
   *  0045355B   899C24 70010000                 MOV DWORD PTR SS:[ESP+0x170],EBX
   *  00453562   A1 DCAA5500                     MOV EAX,DWORD PTR DS:[0x55AADC]
   *  00453567   894424 1C                       MOV DWORD PTR SS:[ESP+0x1C],EAX
   *  0045356B   B8 0F000000                     MOV EAX,0xF
   *  00453570   894424 6C                       MOV DWORD PTR SS:[ESP+0x6C],EAX
   *  00453574   895C24 68                       MOV DWORD PTR SS:[ESP+0x68],EBX
   *  00453578   885C24 58                       MOV BYTE PTR SS:[ESP+0x58],BL
   *  0045357C   894424 50                       MOV DWORD PTR SS:[ESP+0x50],EAX
   *  00453580   895C24 4C                       MOV DWORD PTR SS:[ESP+0x4C],EBX
   *  00453584   885C24 3C                       MOV BYTE PTR SS:[ESP+0x3C],BL
   *  00453588   C68424 70010000 02              MOV BYTE PTR SS:[ESP+0x170],0x2
   *  00453590   8B8424 84000000                 MOV EAX,DWORD PTR SS:[ESP+0x84]
   *  00453597   8BF0                            MOV ESI,EAX
   *  00453599   3BC3                            CMP EAX,EBX
   *  0045359B   74 3D                           JE SHORT .004535DA
   *  0045359D   83BC24 88000000 08              CMP DWORD PTR SS:[ESP+0x88],0x8
   *  004535A5   8B5424 74                       MOV EDX,DWORD PTR SS:[ESP+0x74]
   *  004535A9   73 04                           JNB SHORT .004535AF
   *  004535AB   8D5424 74                       LEA EDX,DWORD PTR SS:[ESP+0x74]
   */
  bool attachNameHookW(ULONG startAddress, ULONG stopAddress)
  {
    // ECX PTR: 33 DB 33 D2 8B C1 C7 84 24 88 00 00 00 07 00 00 00
    const uint8_t bytes[] = {
        0x33, 0xdb,                                                      // 00453521   33db                            xor ebx,ebx  ; jichi: hook here, text in ecx
        0x33, 0xd2,                                                      // 00453523   33d2                            xor edx,edx
        0x8b, 0xc1,                                                      // 00453525   8bc1                            mov eax,ecx
        0xc7, 0x84, 0x24, 0x88, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00 // 00453527   c78424 88000000 07000000        mov dword ptr ss:[esp+0x88],0x7
                                                                         // 00453532   899c24 84000000                 mov dword ptr ss:[esp+0x84],ebx
    };

    int ecx = get_reg(regs::ecx) / 4;
    return TextHookW::attach<3>(bytes, sizeof(bytes), startAddress, stopAddress, ecx, Engine::NameRole);
  }

  /**
   *  Sample game: なついろレシピ
   *  See: http://capita.tistory.com/m/post/251
   *
   *  Choice:
   *  00470D95   72 05                           JB SHORT .00470D9C
   *  00470D97   E8 9C780900                     CALL .00508638                           ; JMP to msvcr90._invalid_parameter_noinfo
   *  00470D9C   8BB5 EC020000                   MOV ESI,DWORD PTR SS:[EBP+0x2EC]
   *  00470DA2   037424 14                       ADD ESI,DWORD PTR SS:[ESP+0x14]
   *  00470DA6   8B4E 10                         MOV ECX,DWORD PTR DS:[ESI+0x10]
   *  00470DA9   2B4E 0C                         SUB ECX,DWORD PTR DS:[ESI+0xC]
   *  00470DAC   C1F9 04                         SAR ECX,0x4
   *  00470DAF   83F9 01                         CMP ECX,0x1
   *  00470DB2   77 05                           JA SHORT .00470DB9
   *  00470DB4   E8 7F780900                     CALL .00508638                           ; JMP to msvcr90._invalid_parameter_noinfo
   *  00470DB9   8B46 0C                         MOV EAX,DWORD PTR DS:[ESI+0xC]
   *  00470DBC   8B50 18                         MOV EDX,DWORD PTR DS:[EAX+0x18]
   *  00470DBF   83C0 10                         ADD EAX,0x10     ; jichi: text in edx
   *  00470DC2   52                              PUSH EDX
   *  00470DC3   8D8C24 7C040000                 LEA ECX,DWORD PTR SS:[ESP+0x47C]
   *  00470DCA   8D7424 4C                       LEA ESI,DWORD PTR SS:[ESP+0x4C]
   *  00470DCE   E8 EDA3F9FF                     CALL .0040B1C0
   *  00470DD3   83C4 04                         ADD ESP,0x4
   *  00470DD6   6A FF                           PUSH -0x1
   *  00470DD8   53                              PUSH EBX
   *  00470DD9   50                              PUSH EAX
   *  00470DDA   8D8424 84040000                 LEA EAX,DWORD PTR SS:[ESP+0x484]
   *  00470DE1   C68424 B0040000 07              MOV BYTE PTR SS:[ESP+0x4B0],0x7
   *  00470DE9   E8 1251F9FF                     CALL .00405F00
   *  00470DEE   BE 08000000                     MOV ESI,0x8
   *  00470DF3   C68424 A4040000 06              MOV BYTE PTR SS:[ESP+0x4A4],0x6
   *  00470DFB   397424 60                       CMP DWORD PTR SS:[ESP+0x60],ESI
   *  00470DFF   72 0D                           JB SHORT .00470E0E
   *  00470E01   8B4424 4C                       MOV EAX,DWORD PTR SS:[ESP+0x4C]
   *  00470E05   50                              PUSH EAX
   *  00470E06   E8 65770900                     CALL .00508570                           ; JMP to msvcr90.??3@YAXPAX@Z
   *  00470E0B   83C4 04                         ADD ESP,0x4
   *  00470E0E   8B9424 7C040000                 MOV EDX,DWORD PTR SS:[ESP+0x47C]
   *  00470E15   33C9                            XOR ECX,ECX
   *  00470E17   C74424 60 07000000              MOV DWORD PTR SS:[ESP+0x60],0x7
   *  00470E1F   895C24 5C                       MOV DWORD PTR SS:[ESP+0x5C],EBX
   *  00470E23   66:894C24 4C                    MOV WORD PTR SS:[ESP+0x4C],CX
   *  00470E28   39B424 90040000                 CMP DWORD PTR SS:[ESP+0x490],ESI
   *  00470E2F   73 07                           JNB SHORT .00470E38
   *  00470E31   8D9424 7C040000                 LEA EDX,DWORD PTR SS:[ESP+0x47C]
   *  00470E38   8B8424 44040000                 MOV EAX,DWORD PTR SS:[ESP+0x444]
   *  00470E3F   B9 10000000                     MOV ECX,0x10
   *  00470E44   398C24 58040000                 CMP DWORD PTR SS:[ESP+0x458],ECX
   *  00470E4B   73 07                           JNB SHORT .00470E54
   *  00470E4D   8D8424 44040000                 LEA EAX,DWORD PTR SS:[ESP+0x444]
   *  00470E54   398C24 74040000                 CMP DWORD PTR SS:[ESP+0x474],ECX
   *  00470E5B   8B8C24 60040000                 MOV ECX,DWORD PTR SS:[ESP+0x460]
   */
  bool attachOtherHookW(ULONG startAddress, ULONG stopAddress)
  {
    // EDX PTR : 83 C0 10 52 8D 8C 24 7C 04 00 00 8D 74 24 4C
    const uint8_t bytes[] = {
        0x83, 0xc0, 0x10,                         // 00470dbf   83c0 10                         add eax,0x10     ; jichi: text in edx
        0x52,                                     // 00470dc2   52                              push edx
        0x8d, 0x8c, 0x24, 0x7c, 0x04, 0x00, 0x00, // 00470dc3   8d8c24 7c040000                 lea ecx,dword ptr ss:[esp+0x47c]
        0x8d, 0x74, 0x24, 0x4c                    // 00470dca   8d7424 4c                       lea esi,dword ptr ss:[esp+0x4c]
    };

    int edx = get_reg(regs::edx) / 4;
    return TextHookW::attach<4>(bytes, sizeof(bytes), startAddress, stopAddress, edx, Engine::OtherRole);
  }

  namespace PatchA
  {

    namespace Private
    {
      // The second argument is always 0 and not used
      bool isLeadByteChar(int ch, int)
      {
        return dynsjis::isleadchar(ch);
        // return ::IsDBCSLeadByte(HIBYTE(testChar));
      }

    } // namespace Private

    /**
     *  Sample game: Re:BIRTHDAY SONG
     *
     *  0x8140 is found by tracing the call of the caller of GetGlyphOutlineA.

     *  00487F8D   25 FF7F0000      AND EAX,0x7FFF
     *  00487F92   C3               RETN
     *  00487F93   8BFF             MOV EDI,EDI
     *  00487F95   55               PUSH EBP
     *  00487F96   8BEC             MOV EBP,ESP
     *  00487F98   83EC 10          SUB ESP,0x10
     *  00487F9B   FF75 0C          PUSH DWORD PTR SS:[EBP+0xC]
     *  00487F9E   8D4D F0          LEA ECX,DWORD PTR SS:[EBP-0x10]
     *  00487FA1   E8 02EEFFFF      CALL .00486DA8
     *  00487FA6   8B45 08          MOV EAX,DWORD PTR SS:[EBP+0x8]
     *  00487FA9   C1E8 08          SHR EAX,0x8
     *  00487FAC   0FB6C8           MOVZX ECX,AL
     *  00487FAF   8B45 F4          MOV EAX,DWORD PTR SS:[EBP-0xC]
     *  00487FB2   F64401 1D 04     TEST BYTE PTR DS:[ECX+EAX+0x1D],0x4
     *  00487FB7   74 10            JE SHORT .00487FC9
     *  00487FB9   0FB64D 08        MOVZX ECX,BYTE PTR SS:[EBP+0x8]
     *  00487FBD   F64401 1D 08     TEST BYTE PTR DS:[ECX+EAX+0x1D],0x8
     *  00487FC2   74 05            JE SHORT .00487FC9
     *  00487FC4   33C0             XOR EAX,EAX
     *  00487FC6   40               INC EAX
     *  00487FC7   EB 02            JMP SHORT .00487FCB
     *  00487FC9   33C0             XOR EAX,EAX
     *  00487FCB   807D FC 00       CMP BYTE PTR SS:[EBP-0x4],0x0
     *  00487FCF   74 07            JE SHORT .00487FD8
     *  00487FD1   8B4D F8          MOV ECX,DWORD PTR SS:[EBP-0x8]
     *  00487FD4   8361 70 FD       AND DWORD PTR DS:[ECX+0x70],0xFFFFFFFD
     *  00487FD8   C9               LEAVE
     *  00487FD9   C3               RETN
     *  00487FDA   8BFF             MOV EDI,EDI	; jichi: called here, text in arg1
     *  00487FDC   55               PUSH EBP
     *  00487FDD   8BEC             MOV EBP,ESP
     *  00487FDF   6A 00            PUSH 0x0
     *  00487FE1   FF75 08          PUSH DWORD PTR SS:[EBP+0x8]
     *  00487FE4   E8 AAFFFFFF      CALL .00487F93	; jichi: called here
     *  00487FE9   59               POP ECX
     *  00487FEA   59               POP ECX
     *  00487FEB   5D               POP EBP
     *  00487FEC   C3               RETN
     */
    using ulong = ULONG;
#define s1_call_ 0xe8 // near call, incomplete
#define s1_nop 0x90   // nop

    bool csmemcpy(void *dst, const void *src, size_t size)
    {
      // return memcpy_(dst, src, size);

      DWORD oldProtect;
      if (!::VirtualProtect(dst, size, PAGE_EXECUTE_READWRITE, &oldProtect))
        return false;
      // HANDLE hProc = OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE, FALSE, ::GetCurrentProcessId());
      // VirtualProtectEx(hProc, dst, size, PAGE_EXECUTE_READWRITE, &oldProtect);

      memcpy(dst, src, size);

      DWORD newProtect;
      ::VirtualProtect(dst, size, oldProtect, &newProtect); // the error code is not checked for this function
      // hProc = OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE, FALSE, ::GetCurrentProcessId());
      // VirtualProtectEx(hProc, dst, size, oldProtect, &newProtect);

      return true;
    }
    ulong replace_near_call(ulong addr, ulong val)
    {
      DWORD ret;
      switch (::disasm((LPCVOID)addr))
      {
      case 5: // near call / short jmp: relative address
        ret = *(DWORD *)(addr + 1) + (addr + 5);
        val -= addr + 5;
        return csmemcpy((LPVOID)(addr + 1), &val, sizeof(val)) ? ret : 0;
      case 6: // far car / long jmp: absolute address
      {
        ret = *(DWORD *)(addr + 2);
        BYTE data[6];
        data[0] = s1_call_;
        data[5] = s1_nop;
        *(DWORD *)(data + 1) = val - (addr + 5);
        return csmemcpy((LPVOID)addr, data, sizeof(data)) ? ret : 0;
      }
      default:
        return 0;
      }
    }
    ULONG patchEncoding(ULONG startAddress, ULONG stopAddress)
    {
      const uint8_t bytes[] = {
          0x6a, 0x00,                  // 00487fdf   6a 00            push 0x0
          0xff, 0x75, 0x08,            // 00487fe1   ff75 08          push dword ptr ss:[ebp+0x8]
          0xe8, 0xaa, 0xff, 0xff, 0xff // 00487fe4   e8 aaffffff      call .00487f93	; jichi: called here
      };
      enum
      {
        addr_offset = 5
      };
      ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);

      return addr; //&&  replace_near_call(addr + addr_offset, (ULONG)Private::isLeadByteChar);
    }

  } // namespace PatchA

  namespace ScenarioHookA
  {

    namespace Private
    {
      /*
        void dispatch(LPSTR text, int role)
        {
          enum { sig = 0 };
          if (!Engine::isAddressWritable(text) || !*text) // isAddressWritable is not needed for correct games
            return;
          int size = ::strlen(text),
              trimmedSize = size;
          auto trimmedText = trim(text, &trimmedSize);
          if (!trimmedSize || !*trimmedText)
            return;
          std::string oldData(trimmedText, trimmedSize),
                     newData = EngineController::instance()->dispatchTextASTD(oldData, role, sig);
          if (newData == oldData)
            return;
          if (trimmedText[trimmedSize])
            newData.append(trimmedText + trimmedSize); //, size - trimmedSize - (trimmedText - text));
          ::strcpy(text, newData.c_str());
        }
      */
      bool hookBefore(hook_stack *s, void *data, size_t *len, uintptr_t *role)
      {
        auto text = (LPSTR)s->eax;
        if (!text)
          return false;
        // dispatch(text - 1024, Engine::NameRole);
        // dispatch(text, Engine::ScenarioRole);

        enum
        {
          sig = 0
        };
        if (!Engine::isAddressWritable(text) || !*text) // isAddressWritable is not needed for correct games
          return false;
        int size = ::strlen(text),
            trimmedSize = size;
        auto trimmedText = trim(text, &trimmedSize);
        if (!trimmedSize || !*trimmedText)
          return false;
        std::string oldData(trimmedText, trimmedSize);

        return write_string_overwrite(data, len, oldData);
        /*newData = EngineController::instance()->dispatchTextASTD(oldData, role, sig);
        if (newData == oldData)
          return;
        if (trimmedText[trimmedSize])
          newData.append(trimmedText + trimmedSize); //, size - trimmedSize - (trimmedText - text));
        ::strcpy(text, newData.c_str());
        return true;*/
      }
      void hookafter(hook_stack *s, void *data, size_t len)
      {

        auto newData = std::string((char *)data, len);
        auto text = (LPSTR)s->eax;
        int size = ::strlen(text),
            trimmedSize = size;
        auto trimmedText = trim(text, &trimmedSize);
        if (trimmedText[trimmedSize])
          newData.append(trimmedText + trimmedSize); //, size - trimmedSize - (trimmedText - text));
        ::strcpy(text, newData.c_str());
      }
    } // namespace Private

    /**
     *  Sample games
     *  - [111028][PULLTOP] 神聖にして侵すべからず
     *  - Re：BIRTHDAY SONG～恋を唄う死神～（体験版）
     *  See: http://capita.tistory.com/m/post/84
     *
     *  ENCODEKOR,FORCEFONT(5),HOOK(0x0042B5E0,TRANS(0x004FFBF8,OVERWRITE(IGNORE)),RETNPOS(COPY),TRANS(0x004FF7F8,OVERWRITE(IGNORE))),HOOK(0x00413204,TRANS([ESP+0x1c],PTRCHEAT),RETNPOS(SOURCE)),HOOK(0x00424004,TRANS([ESP+0x1c],PTRCHEAT),RETNPOS(SOURCE)),HOOK(0x004242B9,TRANS([ESP+0x1c],PTRCHEAT),RETNPOS(SOURCE)),HOOK(0x00424109,TRANS([ESP+0x1c],PTRCHEAT),RETNPOS(SOURCE))
     *
     *  Scenario in eax
     *  Name in (eax - 1024)
     *  Memory can be directly overridden.
     *
     *  0042B5DE   CC               INT3
     *  0042B5DF   CC               INT3
     *  0042B5E0   81EC 14080000    SUB ESP,0x814	; jichi: text in eax, name in eax - 1024, able to copy
     *  0042B5E6   53               PUSH EBX
     *  0042B5E7   55               PUSH EBP
     *  0042B5E8   56               PUSH ESI
     *  0042B5E9   33DB             XOR EBX,EBX
     *  0042B5EB   57               PUSH EDI
     *  0042B5EC   8BF8             MOV EDI,EAX
     *  0042B5EE   399C24 28080000  CMP DWORD PTR SS:[ESP+0x828],EBX
     *  0042B5F5   75 13            JNZ SHORT .0042B60A
     *  0042B5F7   68 74030000      PUSH 0x374
     *  0042B5FC   53               PUSH EBX
     *  0042B5FD   68 7CC44F00      PUSH .004FC47C
     *  0042B602   E8 09E60500      CALL .00489C10
     *  0042B607   83C4 0C          ADD ESP,0xC
     *  0042B60A   33F6             XOR ESI,ESI
     *  0042B60C   895C24 1C        MOV DWORD PTR SS:[ESP+0x1C],EBX
     *  0042B610   895C24 10        MOV DWORD PTR SS:[ESP+0x10],EBX
     *  0042B614   381F             CMP BYTE PTR DS:[EDI],BL
     *  0042B616   0F84 0D020000    JE .0042B829
     *  0042B61C   8D6424 00        LEA ESP,DWORD PTR SS:[ESP]
     *  0042B620   8A4C37 01        MOV CL,BYTE PTR DS:[EDI+ESI+0x1]
     *  0042B624   84C9             TEST CL,CL
     *  0042B626   0F84 E6010000    JE .0042B812
     *  0042B62C   66:0FB6043E      MOVZX AX,BYTE PTR DS:[ESI+EDI]
     *  0042B631   8D2C3E           LEA EBP,DWORD PTR DS:[ESI+EDI]
     *  0042B634   66:C1E0 08       SHL AX,0x8
     *  0042B638   0FB7C0           MOVZX EAX,AX
     *  0042B63B   0FB6C9           MOVZX ECX,CL
     *  0042B63E   0BC1             OR EAX,ECX
     *  0042B640   50               PUSH EAX
     *  0042B641   E8 34B40500      CALL .00486A7A
     *  0042B646   83C4 04          ADD ESP,0x4
     *  0042B649   85C0             TEST EAX,EAX
     *  0042B64B   74 14            JE SHORT .0042B661
     *  0042B64D   66:8B55 00       MOV DX,WORD PTR SS:[EBP]
     *  0042B651   66:89541C 24     MOV WORD PTR SS:[ESP+EBX+0x24],DX
     *  0042B656   83C3 02          ADD EBX,0x2
     *  0042B659   83C6 02          ADD ESI,0x2
     *  0042B65C   E9 BA010000      JMP .0042B81B
     *  0042B661   807D 00 7B       CMP BYTE PTR SS:[EBP],0x7B
     *  0042B665   0F85 60010000    JNZ .0042B7CB
     *  0042B66B   8BC3             MOV EAX,EBX
     *  0042B66D   2B4424 1C        SUB EAX,DWORD PTR SS:[ESP+0x1C]
     *  0042B671   46               INC ESI
     *  0042B672   33ED             XOR EBP,EBP
     *  0042B674   894424 20        MOV DWORD PTR SS:[ESP+0x20],EAX
     *  0042B678   896C24 14        MOV DWORD PTR SS:[ESP+0x14],EBP
     *  0042B67C   8D6424 00        LEA ESP,DWORD PTR SS:[ESP]
     *  0042B680   8A0C3E           MOV CL,BYTE PTR DS:[ESI+EDI]
     *  0042B683   84C9             TEST CL,CL
     *  0042B685   0F84 B5010000    JE .0042B840
     *  0042B68B   0FB64437 01      MOVZX EAX,BYTE PTR DS:[EDI+ESI+0x1]
     *  0042B690   66:0FB6C9        MOVZX CX,CL
     *  0042B694   66:C1E1 08       SHL CX,0x8
     *  0042B698   0FB7D1           MOVZX EDX,CX
     *  0042B69B   0BC2             OR EAX,EDX
     *  0042B69D   50               PUSH EAX
     *  0042B69E   E8 D7B30500      CALL .00486A7A
     *  0042B6A3   83C4 04          ADD ESP,0x4
     *  0042B6A6   85C0             TEST EAX,EAX
     *  0042B6A8   74 1A            JE SHORT .0042B6C4
     *  0042B6AA   66:8B043E        MOV AX,WORD PTR DS:[ESI+EDI]
     *  0042B6AE   834424 14 02     ADD DWORD PTR SS:[ESP+0x14],0x2
     *  0042B6B3   66:89441C 24     MOV WORD PTR SS:[ESP+EBX+0x24],AX
     *  0042B6B8   83C3 02          ADD EBX,0x2
     *  0042B6BB   895C24 10        MOV DWORD PTR SS:[ESP+0x10],EBX
     *  0042B6BF   83C6 02          ADD ESI,0x2
     *  0042B6C2  ^EB BC            JMP SHORT .0042B680
     *  0042B6C4   8A043E           MOV AL,BYTE PTR DS:[ESI+EDI]
     *  0042B6C7   3C 3A            CMP AL,0x3A
     *  0042B6C9   74 10            JE SHORT .0042B6DB
     *  0042B6CB   FF4424 14        INC DWORD PTR SS:[ESP+0x14]
     *  0042B6CF   88441C 24        MOV BYTE PTR SS:[ESP+EBX+0x24],AL
     *  0042B6D3   43               INC EBX
     *  0042B6D4   895C24 10        MOV DWORD PTR SS:[ESP+0x10],EBX
     *  0042B6D8   46               INC ESI
     *  0042B6D9  ^EB A5            JMP SHORT .0042B680
     *  0042B6DB   896C24 18        MOV DWORD PTR SS:[ESP+0x18],EBP
     *  0042B6DF   46               INC ESI
     *  0042B6E0   8A0C3E           MOV CL,BYTE PTR DS:[ESI+EDI]
     *  0042B6E3   84C9             TEST CL,CL
     *  0042B6E5   0F84 55010000    JE .0042B840
     *  0042B6EB   0FB64437 01      MOVZX EAX,BYTE PTR DS:[EDI+ESI+0x1]
     *  0042B6F0   66:0FB6C9        MOVZX CX,CL
     *  0042B6F4   66:C1E1 08       SHL CX,0x8
     *  0042B6F8   0FB7D1           MOVZX EDX,CX
     *  0042B6FB   0BC2             OR EAX,EDX
     *  0042B6FD   50               PUSH EAX
     *  0042B6FE   E8 77B30500      CALL .00486A7A
     *  0042B703   83C4 04          ADD ESP,0x4
     *  0042B706   85C0             TEST EAX,EAX
     *  0042B708   74 18            JE SHORT .0042B722
     *  0042B70A   66:8B043E        MOV AX,WORD PTR DS:[ESI+EDI]
     *  0042B70E   FF4424 18        INC DWORD PTR SS:[ESP+0x18]
     *  0042B712   66:89842C 240400>MOV WORD PTR SS:[ESP+EBP+0x424],AX
     *  0042B71A   83C5 02          ADD EBP,0x2
     *  0042B71D   83C6 02          ADD ESI,0x2
     *  0042B720  ^EB BE            JMP SHORT .0042B6E0
     *  0042B722   8A043E           MOV AL,BYTE PTR DS:[ESI+EDI]
     *  0042B725   3C 7D            CMP AL,0x7D
     *  0042B727   74 0E            JE SHORT .0042B737
     *  0042B729   FF4424 18        INC DWORD PTR SS:[ESP+0x18]
     *  0042B72D   88842C 24040000  MOV BYTE PTR SS:[ESP+EBP+0x424],AL
     *  0042B734   45               INC EBP
     *  0042B735  ^EB A8            JMP SHORT .0042B6DF
     *  0042B737   8D8424 24040000  LEA EAX,DWORD PTR SS:[ESP+0x424]
     *  0042B73E   46               INC ESI
     *  0042B73F   C6842C 24040000 >MOV BYTE PTR SS:[ESP+EBP+0x424],0x0
     *  0042B747   8D50 01          LEA EDX,DWORD PTR DS:[EAX+0x1]
     *  0042B74A   8D9B 00000000    LEA EBX,DWORD PTR DS:[EBX]
     *  0042B750   8A08             MOV CL,BYTE PTR DS:[EAX]
     *  0042B752   40               INC EAX
     *  0042B753   84C9             TEST CL,CL
     *  0042B755  ^75 F9            JNZ SHORT .0042B750
     *  0042B757   2BC2             SUB EAX,EDX
     *  0042B759   83F8 1E          CMP EAX,0x1E
     *  0042B75C   0F87 DE000000    JA .0042B840
     *  0042B762   8B15 7CC44F00    MOV EDX,DWORD PTR DS:[0x4FC47C]
     *  0042B768   83FA 14          CMP EDX,0x14
     *  0042B76B   0F8D AE000000    JGE .0042B81F
     *  0042B771   6BD2 2C          IMUL EDX,EDX,0x2C
     *  0042B774   8D8C24 24040000  LEA ECX,DWORD PTR SS:[ESP+0x424]
     *  0042B77B   81C2 8CC44F00    ADD EDX,.004FC48C
     *  0042B781   8A01             MOV AL,BYTE PTR DS:[ECX]
     *  0042B783   8802             MOV BYTE PTR DS:[EDX],AL
     *  0042B785   41               INC ECX
     *  0042B786   42               INC EDX
     *  0042B787   84C0             TEST AL,AL
     *  0042B789  ^75 F6            JNZ SHORT .0042B781
     *  0042B78B   8B0D 7CC44F00    MOV ECX,DWORD PTR DS:[0x4FC47C]
     *  0042B791   8B5424 14        MOV EDX,DWORD PTR SS:[ESP+0x14]
     *  0042B795   6BC9 2C          IMUL ECX,ECX,0x2C
     *  0042B798   8991 88C44F00    MOV DWORD PTR DS:[ECX+0x4FC488],EDX
     *  0042B79E   A1 7CC44F00      MOV EAX,DWORD PTR DS:[0x4FC47C]
     *  0042B7A3   8B4C24 20        MOV ECX,DWORD PTR SS:[ESP+0x20]
     *  0042B7A7   6BC0 2C          IMUL EAX,EAX,0x2C
     *  0042B7AA   8988 80C44F00    MOV DWORD PTR DS:[EAX+0x4FC480],ECX
     *  0042B7B0   8B15 7CC44F00    MOV EDX,DWORD PTR DS:[0x4FC47C]
     *  0042B7B6   8B4424 18        MOV EAX,DWORD PTR SS:[ESP+0x18]
     *  0042B7BA   6BD2 2C          IMUL EDX,EDX,0x2C
     *  0042B7BD   8982 84C44F00    MOV DWORD PTR DS:[EDX+0x4FC484],EAX
     *  0042B7C3   FF05 7CC44F00    INC DWORD PTR DS:[0x4FC47C]
     *  0042B7C9   EB 54            JMP SHORT .0042B81F
     *  0042B7CB   55               PUSH EBP
     *  0042B7CC   E8 7F000000      CALL .0042B850
     *  0042B7D1   8BD8             MOV EBX,EAX
     *  0042B7D3   83C4 04          ADD ESP,0x4
     *  0042B7D6   85DB             TEST EBX,EBX
     *  0042B7D8   74 23            JE SHORT .0042B7FD
     *  0042B7DA   53               PUSH EBX
     *  0042B7DB   55               PUSH EBP
     *  0042B7DC   8B6C24 18        MOV EBP,DWORD PTR SS:[ESP+0x18]
     *  0042B7E0   8D4C2C 2C        LEA ECX,DWORD PTR SS:[ESP+EBP+0x2C]
     *  0042B7E4   51               PUSH ECX
     *  0042B7E5   E8 A6E40500      CALL .00489C90
     *  0042B7EA   03EB             ADD EBP,EBX
     *  0042B7EC   03F3             ADD ESI,EBX
     *  0042B7EE   83C4 0C          ADD ESP,0xC
     *  0042B7F1   015C24 1C        ADD DWORD PTR SS:[ESP+0x1C],EBX
     *  0042B7F5   896C24 10        MOV DWORD PTR SS:[ESP+0x10],EBP
     *  0042B7F9   8BDD             MOV EBX,EBP
     *  0042B7FB   EB 22            JMP SHORT .0042B81F
     *  0042B7FD   8B4424 10        MOV EAX,DWORD PTR SS:[ESP+0x10]
     *  0042B801   8A55 00          MOV DL,BYTE PTR SS:[EBP]
     *  0042B804   40               INC EAX
     *  0042B805   885404 23        MOV BYTE PTR SS:[ESP+EAX+0x23],DL
     *  0042B809   894424 10        MOV DWORD PTR SS:[ESP+0x10],EAX
     *  0042B80D   46               INC ESI
     *  0042B80E   8BD8             MOV EBX,EAX
     *  0042B810   EB 0D            JMP SHORT .0042B81F
     *  0042B812   8A043E           MOV AL,BYTE PTR DS:[ESI+EDI]
     *  0042B815   88441C 24        MOV BYTE PTR SS:[ESP+EBX+0x24],AL
     *  0042B819   43               INC EBX
     *  0042B81A   46               INC ESI
     *  0042B81B   895C24 10        MOV DWORD PTR SS:[ESP+0x10],EBX
     *  0042B81F   803C3E 00        CMP BYTE PTR DS:[ESI+EDI],0x0
     *  0042B823  ^0F85 F7FDFFFF    JNZ .0042B620
     *  0042B829   8D4424 24        LEA EAX,DWORD PTR SS:[ESP+0x24]
     *  0042B82D   8BC8             MOV ECX,EAX
     *  0042B82F   C6441C 24 00     MOV BYTE PTR SS:[ESP+EBX+0x24],0x0
     *  0042B834   2BF9             SUB EDI,ECX
     *  0042B836   8A08             MOV CL,BYTE PTR DS:[EAX]
     *  0042B838   880C07           MOV BYTE PTR DS:[EDI+EAX],CL
     *  0042B83B   40               INC EAX
     *  0042B83C   84C9             TEST CL,CL
     *  0042B83E  ^75 F6            JNZ SHORT .0042B836
     *  0042B840   5F               POP EDI
     *  0042B841   5E               POP ESI
     *  0042B842   5D               POP EBP
     *  0042B843   5B               POP EBX
     *  0042B844   81C4 14080000    ADD ESP,0x814
     *  0042B84A   C3               RETN
     *  0042B84B   CC               INT3
     *  0042B84C   CC               INT3
     *  0042B84D   CC               INT3
     *  0042B84E   CC               INT3
     *
     *  Skip scenario text:
     *  00438EF1   51               PUSH ECX
     *  00438EF2   56               PUSH ESI
     *  00438EF3   57               PUSH EDI
     *  00438EF4   52               PUSH EDX
     *  00438EF5   6A 03            PUSH 0x3    ; jichi: scenario arg1 is always 3
     *  00438EF7   E8 14F3FDFF      CALL .00418210  ; jichi: text called here
     *  00438EFC   894424 4C        MOV DWORD PTR SS:[ESP+0x4C],EAX
     *  00438F00   8D4424 78        LEA EAX,DWORD PTR SS:[ESP+0x78]
     *  00438F04   83C4 30          ADD ESP,0x30
     *  00438F07   897C24 34        MOV DWORD PTR SS:[ESP+0x34],EDI
     *  00438F0B   897424 38        MOV DWORD PTR SS:[ESP+0x38],ESI
     *  00438F0F   8D48 01          LEA ECX,DWORD PTR DS:[EAX+0x1]
     *  00438F12   8A10             MOV DL,BYTE PTR DS:[EAX]
     *  00438F14   40               INC EAX
     *  00438F15   84D2             TEST DL,DL
     */
    bool attach(ULONG startAddress, ULONG stopAddress)
    {
      const uint8_t bytes[] = {
          0x81, 0xec, 0x14, 0x08, 0x00, 0x00 // 0042B5E0   81EC 14080000    SUB ESP,0x814	; jichi: text in eax, name in eax - 1024, able to copy
      };
      ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
      if (addr == 0)
        return false;
      HookParam hp;
      hp.address = addr;

      hp.hook_before = Private::hookBefore;
      hp.type = EMBED_ABLE;
      hp.newlineseperator = L"\\n";
      hp.hook_after = Private::hookafter;
      hp.hook_font = F_GetGlyphOutlineA | F_TextOutA;
      static ULONG paddr = (PatchA::patchEncoding(startAddress, stopAddress));
      ConsoleOutput("%p", paddr);
      if (paddr)
      {
        hp.type |= EMBED_DYNA_SJIS;
        hp.hook_font = F_GetGlyphOutlineA | F_TextOutA;
        patch_fun = []()
        {
          PatchA::replace_near_call(paddr + 5, (ULONG)PatchA::Private::isLeadByteChar);
        };
      }
      return NewHook(hp, "EmbedWillplusA");
    }

  } // namespace ScenarioHookA

  namespace OtherHookA
  {

    namespace Private
    {

      bool hookBefore(hook_stack *s, void *data, size_t *len, uintptr_t *role)
      {
        static std::string data_;
        if (s->stack[1] == 3) // skip scenario hook where arg1 is 3
          return false;
        auto text = (LPCSTR)s->stack[8];                                       // text in arg8
        if (!Engine::isAddressReadable(text) || !*text || ::strlen(text) <= 2) // do not translate single character
          return false;
        *role = Engine::OtherRole;

        return write_string_overwrite(data, len, text);
      }

    } // namespace Private

    /**
     *  Sample games: Re：BIRTHDAY SONG～恋を唄う死神～（体験版）
     *
     *  There are two GetGlyphOutlineA, that are called in the same functions.
     *
     *  Caller of GetGlyphOutlineA, text in arg8.
     */
    bool attach(ULONG startAddress, ULONG stopAddress)
    {
      ULONG addr = MemDbg::findCallerAddressAfterInt3((ULONG)::GetGlyphOutlineA, startAddress, stopAddress);
      if (addr == 0)
        return false;
      HookParam hp;
      hp.address = addr;
      hp.hook_before = Private::hookBefore;
      hp.type = EMBED_ABLE | EMBED_DYNA_SJIS | EMBED_AFTER_OVERWRITE;
      hp.offset = get_stack(8);
      return NewHook(hp, "EmbedWillplus_other");
    }

  } // namespace OtherHookA

} // unnamed namespace

/** Public class */
namespace WillPlusEngine
{
  bool attach()
  {
    ULONG startAddress = processStartAddress, stopAddress = processStopAddress;

    if (::attachScenarioHookW1(startAddress, stopAddress) || ::attachScenarioHookW2(startAddress, stopAddress))
    {

      (::attachNameHookW(startAddress, stopAddress));

      (::attachOtherHookW(startAddress, stopAddress));

      return true;
    }
    else if (ScenarioHookA::attach(startAddress, stopAddress))
    { // try widechar pattern first, which is more unique

      (OtherHookA::attach(startAddress, stopAddress));
      // HijackManager::instance()->attachFunction((ULONG)::GetGlyphOutlineA);
      // HijackManager::instance()->attachFunction((ULONG)::TextOutA); // not called. hijack in case it is used
      return true;
    }

    return false;
  }
}

namespace
{

  static bool InsertWillPlus4()
  {
    // by Blu3train
    /*
     * Sample games:
     * https://vndb.org/r71235
     */
    const BYTE bytes[] = {
        0x33, 0xC9,                 // xor ecx,ecx  <-- hook
        0x8B, 0xC7,                 // mov eax,edi
        0xC7, 0x84, 0x24, XX4, XX4, // mov [esp+000001E0],00000007
        0x89, 0x9C, 0x24, XX4       // mov [esp+000001DC],ebx
    };
    ULONG range = min(processStopAddress - processStartAddress, MAX_REL_ADDR);
    ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStartAddress + range);
    if (!addr)
    {
      ConsoleOutput("WillPlus4: pattern not found");
      return false;
    }

    HookParam hp = {};
    hp.address = addr;
    hp.offset = get_reg(regs::edi);
    hp.type = CODEC_UTF16 | USING_STRING;
    hp.filter_fun = WillPlus_extra_filter;
    ConsoleOutput("INSERT WillPlus4");
    NewHook(hp, "WillPlus4");
    return true;
  }

  static bool InsertWillPlus5()
  {
    // by Blu3train
    /*
     * Sample games:
     * https://vndb.org/v29881
     */
    const BYTE bytes[] = {
        0xE8, XX4,        // call AdvHD.exe+38550   <-- hook here
        0x8B, 0x4B, 0x08, // mov ecx,[ebx+08]
        0x89, 0x8F, XX4,  // mov [edi+0000014C],ecx
        0x85, 0xC9,       // test ecx,ecx
        0x74, 0x04        // je AdvHD.exe+396C6
    };
    ULONG range = min(processStopAddress - processStartAddress, MAX_REL_ADDR);
    ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStartAddress + range);
    if (!addr)
    {
      ConsoleOutput("WillPlus5: pattern not found");
      return false;
    }

    HookParam hp = {};
    hp.address = addr;
    hp.offset = get_reg(regs::esi);
    hp.index = 0;
    hp.split = get_reg(regs::ebx);
    hp.split_index = 0;
    hp.type = CODEC_UTF16 | USING_STRING | NO_CONTEXT | USING_SPLIT;
    hp.filter_fun = WillPlus_extra_filter;
    ConsoleOutput("INSERT WillPlus5");
    NewHook(hp, "WillPlus5");
    return true;
  }

  bool _xxx()
  {
    bool ok = false;
    ok = InsertWillPlus4() || ok;
    ok = InsertWillPlus5() || ok;
    return ok;
  }
}

bool WillPlus::attach_function()
{
  bool succ = WillPlusEngine::attach();
  succ |= InsertWillPlusHook();
  succ |= InsertWillPlus4Hook();
  succ |= InsertWillPlus5Hook();
  succ |= insertwillplus6();
  succ |= willX();
  succ |= _xxx();

  return succ;
}

bool Willold::attach_function()
{
  // https://vndb.org/v17755
  // 凌辱鬼
  auto addr = MemDbg::findLongJumpAddress((ULONG)TextOutA, processStartAddress, processStopAddress);
  if (addr == 0)
    return false;
  addr = MemDbg::findNearCallAddress(addr, processStartAddress, processStopAddress);
  if (addr == 0)
    return false;
  addr = findfuncstart(addr, 0x200);
  if (addr == 0)
    return false;
  HookParam hp;
  hp.address = addr;
  hp.type = USING_CHAR | CODEC_ANSI_BE;
  hp.offset = get_stack(1);
  return NewHook(hp, "will");
}