#include"Lucifen.h"
/********************************************************************************************
Lucifen hook:
  Game folder contains *.lpk. Used by Navel games.
  Hook is same to GetTextExtentPoint32A, use ESP to split name.
********************************************************************************************/
bool InsertLucifenHook()
{
  // BOOL GetTextExtentPoint32(
  //   _In_   HDC hdc,
  //   _In_   LPCTSTR lpString,
  //   _In_   int c,
  //   _Out_  LPSIZE lpSize
  // );
  HookParam hp;
  hp.address = (DWORD)::GetTextExtentPoint32A;
  hp.offset=get_stack(2); // arg2 lpString
  hp.split = get_reg(regs::esp);
  hp.length_offset = 3;
  hp.type = USING_STRING|USING_SPLIT;
  ConsoleOutput("INSERT Lucifen");
  return NewHook(hp, "Lucifen");
  //RegisterEngineType(ENGINE_LUCIFEN);
}
namespace{
  bool hook(){ 
    //まじかるカナン -RISEA-
    auto oldoutline=(ULONG)GetProcAddress(GetModuleHandle(L"gdi32.dll"),"GetGlyphOutline");
    auto addr=MemDbg::findCallerAddress(oldoutline, 0xec8b55,processStartAddress, processStopAddress); 
    if (addr == 0)
      addr=MemDbg::findCallerAddress((ULONG)GetGlyphOutlineA, 0xec8b55,processStartAddress, processStopAddress); 
    if (addr == 0)
      return false;
    HookParam hp;
    hp.address = addr;
    hp.offset=get_stack(1); 
    hp.split=get_stack(6);
    hp.type = CODEC_ANSI_BE |USING_SPLIT;
    return NewHook(hp, "Lucifen2"); 
  }
}

 bool hookBefore_navel(hook_stack*s,void* data, size_t* len,uintptr_t*role)
  {  
    
      auto text = std::string((char*)s->stack[1]); // text in arg1  
       

      if(text.find("$&")!=text.npos){
          text=text.substr(text.find("$&")+2);
      }
      if(text[text.size()-1]=='$')
        text=text.substr(0,text.size()-1);
       
      write_string_overwrite(data,len,text);
      return true;
  }
 void hookafter_navel(hook_stack*s,void* data, size_t len)
  {  
      auto text = std::string((char*)s->stack[1]); // text in arg1  
      auto split = s->stack[0]; // retaddr 
       
      std::string  newData = std::string((char*)data,len); 

      if(text.find("$&")!=text.npos){ 
          newData=text.substr(0,text.find("$&")+2)+newData;
      }
      if(text[text.size()-1]=='$')
        newData=newData+"$";
       
      strcpy((char*)s->stack[1], newData.c_str());
      //s->stack[1] = (ULONG)newData.data();
  }

bool attach_navel(ULONG startAddress, ULONG stopAddress) // attach scenario
{
// 通过搜索3C 9F(i > 0x9Fu shiftjis范围判断)找到。
//   int __thiscall sub_455AB0(int this, _BYTE *a2)
// {
//   LPCSTR **v2; // ebx
//   int v3; // edi
//   _BYTE *v4; // ebp
//   char v5; // cl
//   _BYTE *v6; // ebx
//   int v7; // esi
//   unsigned __int8 v8; // al
//   char v9; // al
//   const CHAR **v10; // ebx
//   bool v11; // zf
//   const CHAR *v12; // eax
//   unsigned int v13; // esi
//   char *v14; // eax
//   char *v16; // ecx
//   unsigned __int8 v17; // al
//   char v18; // al
//   const CHAR ***v19; // ebp
//   const CHAR *v20; // esi
//   int v21; // eax
//   unsigned __int8 v22; // al
//   char v23; // cl
//   int v24; // esi
//   LPCSTR **j; // ebp
//   char v26; // al
//   LPCSTR **v27; // ebx
//   char v28; // al
//   char v29; // al
//   char v30; // al
//   unsigned int v31; // esi
//   unsigned __int8 *v32; // eax
//   char v33; // al
//   int v34; // eax
//   unsigned __int8 *v35; // ebx
//   unsigned __int8 v36; // al
//   char v37; // al
//   const CHAR ***v38; // ebp
//   const CHAR *v39; // esi
//   int v40; // eax
//   CHAR *v41; // edi
//   char v42; // al
//   unsigned __int8 v43; // al
//   unsigned __int8 v44; // al
//   unsigned __int16 *v45; // ebp
//   unsigned __int16 *v46; // edi
//   unsigned int v47; // eax
//   __int16 v48; // dx
//   unsigned __int16 *v49; // esi
//   unsigned int v51; // [esp+14h] [ebp-4h]
//   char *i; // [esp+1Ch] [ebp+4h]
//   unsigned int v53; // [esp+1Ch] [ebp+4h]

    const uint8_t bytes[] = {
      0x50,
      0xff,0x15,0xfc,0xd0,0x4e,0x00,
      0x03,0xf0,
      0x83,0xc3,0x04,
      0xb1,0x01
    };
    ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
    if (addr == 0)return false;
      
    addr = MemDbg::findEnclosingAlignedFunction(addr);
    if (!addr) return false;
    HookParam hp;
    hp.address = addr; 
    hp.type = EMBED_ABLE|EMBED_DYNA_SJIS;
    hp.hook_before=hookBefore_navel;
    hp.hook_after=hookafter_navel;
    hp.hook_font=F_GetGlyphOutlineA|F_GetTextExtentPoint32A;
    return NewHook(hp, "LucifenEmbed"); 
}
namespace { // unnamed
namespace ScenarioHook {

std::unordered_set<UINT64> textHashes_;

namespace Private {

  ULONG scenarioOffset_,
        nameOffset_;

  std::string replaceNewLines(const std::string &data)
  {
    std::string ret;
    //ret.replace("\n", 1, "\x00\x5b\x0c\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00", 0xc + 2);
    for (auto p = data.c_str(); *p;)
      if (*p == '\n') {
        ret.append("\x00\x5b\x0c\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00", 0xc + 2);
        p++;
      } else {
        ret.push_back(*p++);
        if (*p && dynsjis::isleadbyte(p[-1]))
          ret.push_back(*p++);
      }

    //std::string ret;
    //do {
    //  ret.append(start, p - start);
    //  if (dynsjis::prevchar(p, start) == p - 1) {
    //    ret.append("\x00\x5b\x0c\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00", 0xc + 2);
    //    p++;
    //  } else {
    //    start = p;
    //    p = ::strchr(p, '\n');
    //  }
    //} while (p && *p);
    return ret;
  }

  /**
   *  Sample game: 猫撫ディストーション
   *
   *  0x5b is the text to skip next character
   *
   *  Ruby:
   *  014BB52C  81 77 8C F5 00 5B 1C 00 00 00 1B 00 00 00 01 00  『光.[......
.
   *  014BB53C  00 00 03 0B 00 00 00 83 72 83 62 83 4F 83 6F 83  .....ビッグバ・
   *  014BB54C  93 00 81 78 82 CC 91 4F 81 5C 81 5C 00 5B 0C 00  ・』の前――.[..
   *  014BB55C  00 00 0E 00 00 00 00 00 00 00 82 C2 82 DC 82 E8  .........つまり
   *  014BB56C  81 41 89 46 92 88 82 AA 90 B6 82 DC 82 EA 82 E9  、宇宙が生まれる
   *  014BB57C  91 4F 82 A9 82 E7 82 A0 82 C1 82 BD 82 E0 82 CC  前からあったもの
   *  014BB58C  81 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00  。..............
   *  014BB59C  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *
   *  No ruby:
   *  014BB52C  82 B6 82 E1 82 A0 81 41 81 77 8C BE 97 74 81 78  じゃあ、『言葉』
   *  014BB53C  82 C1 82 C4 89 BD 82 C8 82 F1 82 BE 81 48 6F 83  って何なんだ？o・
   *  014BB54C  93 00 81 78 82 CC 91 4F 81 5C 81 5C 00 5B 0C 00  ・』の前――.[..
   *  014BB55C  00 00 0E 00 00 00 00 00 00 00 82 C2 82 DC 82 E8  .........つまり
   *  014BB56C  81 41 89 46 92 88 82 AA 90 B6 82 DC 82 EA 82 E9  、宇宙が生まれる
   *  014BB57C  91 4F 82 A9 82 E7 82 A0 82 C1 82 BD 82 E0 82 CC  前からあったもの
   *  014BB58C  81 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00  。..............
   *  014BB59C  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014BB5AC  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014BB5BC  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014BB5CC  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *
   *  014BB52C  96 85 82 CC 8B D5 00 5B 16 00 00 00 1B 00 00 00  妹の琴.[......
   *  014BB53C  01 00 00 00 03 05 00 00 00 82 B1 82 C6 00 8E 71  
......こと.子
   *  014BB54C  00 5B 14 00 00 00 1B 00 00 00 01 00 00 00 03 03  .[......
...
   *  014BB55C  00 00 00 82 B1 00 82 CD 82 BB 82 A4 8C BE 82 C1  ...こ.はそう言っ
   *  014BB56C  82 BD 81 42 82 C6 82 A2 82 A4 88 D3 96 A1 82 F0  た。という意味を
   *  014BB57C  97 5E 82 A6 82 BD 82 CC 81 76 82 BD 82 E0 82 CC  与えたの」たもの
   *  014BB58C  81 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00  。..............
   *  014BB59C  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014BB5AC  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014BB5BC  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014BB5CC  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *
   *  New line:
   *  014D7D39  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014D7D49  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014D7D59  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014D7D69  00 00 00 00 00 01 00 E6 01 00 00 54 01 00 00 00  .....
.・..T
...
   *  014D7D79  00 00 00 B0 11 52 00 D8 CD 4D 01 44 EE E9 07 D8  ...ｰR.ﾘﾍM
D鵫ﾘ
   *  014D7D89  CD 4D 01 00 00 00 00 00 00 00 00 00 00 00 00 00  ﾍM
.............
   *  014D7D99  00 00 00 F0 50 4E 01 0C 53 4E 01 F0 54 4E 01 10  ...N
.SN
N

   *  014D7DA9  00 00 00 00 00 00 00 82 BB 82 B5 82 C4 89 B4 82  .......そして俺・
   *  014D7DB9  C9 82 E0 81 41 00 5B 0C 00 00 00 0E 00 00 00 00  ﾉも、.[........
   *  014D7DC9  00 00 00 90 7E 96 5B 82 CC 82 B1 82 EB 82 A9 82  ...厨房のころか・
   *  014D7DD9  E7 8E 6C 94 4E 8A D4 81 41 96 88 93 FA 91 B1 82  邇l年間、毎日続・
   *  014D7DE9  AF 82 C4 82 A2 82 E9 82 B1 82 C6 82 AA 82 A0 82  ｯていることがあ・
   *  014D7DF9  E9 81 42 00 00 00 00 00 00 00 00 00 00 00 00 00  驕B.............
   *  014D7E09  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014D7E19  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014D7E29  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014D7E39  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014D7E49  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014D7E59  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014D7E69  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014D7E79  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014D7E89  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   *  014D7E99  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   */
  template <typename strT>
  strT ltrimScenarioText(strT p)
  {
    while (p[0] == 0 && p[1] == 0x5b && p[2] > 0)
      p += p[2] + 2;
    return p;
  }
  std::string parseScenarioText(const char *p, const char *end)
  {
    int size = ::strlen(p);
    if (end > p && end - p < size)
      size = end - p;
    std::string ret;
    if (size)
      ret=std::string(p, size);
    //if ((uint8_t)p[ret.size() - 1] == 0x93 && (uint8_t)p[ret.size() - 1] == 0x83)// trim encindg \x83\x93
    //  return ret.left(ret.size() - 2);
    for (p += ret.size(); (!end || p < end) && p[1] == 0x5b && p[2] > 0; p += ret.size()) {
      //if (p[2] == 0xc && p[6] == 0xe) {
      //  ret.push_back('\n');
      //  ret.push_back('\n'); // insert double new lines
      //}
      p += p[2] + 2;
      size = ::strlen(p);
      if (end > p && end - p < size)
        size = end - p;
      ret.append(p, size);
    }
    return ret;
  }

  bool dispatchNameText(char *text, ULONG split,hook_stack*s,void* data, size_t* len1,uintptr_t*role)
  {
    enum { capacity = 0x10 }; // excluding '\0'
    *role = Engine::NameRole ;

    if (!*text)
      return false;
 
    write_string_overwrite(data,len1,text);
    return true;
  }

  bool dispatchScenarioText(char *text, ULONG split,hook_stack*s,void* data, size_t* len1,uintptr_t*role)
  {
    // text[0] could be \0
    * role = Engine::ScenarioRole ;
    auto scenarioEndAddress = (LPSTR *)(text + 0x1000);
    auto scenarioEnd = *scenarioEndAddress;
    if (!Engine::isAddressReadable(scenarioEnd))
      scenarioEnd = nullptr;
      //DOUT("warning: scenario end NOT FOUND");
 

    text = ltrimScenarioText(text);
    if (!*text)
      return false;
    std::string oldData = parseScenarioText(text, scenarioEnd);
    write_string_overwrite(data,len1,oldData);
    return true;
  }
bool dispatchNameTextafter(char *text, ULONG split,hook_stack*s,void* data, uintptr_t  len1 )
  {
    std::string oldData = text;
     auto newData=std::string((char*)data,len1);
     enum { capacity = 0x10 }; // excluding '\0'
    int size = newData.size();
    if (size > capacity)
      size = capacity;
    else if (size < oldData.size())
      ::memset(text + size, 0, oldData.size() - size);

    ::memcpy(text, newData.c_str(), size);
    return true;
  }

  void dispatchScenarioTextafter(char *text, ULONG split,hook_stack*s,void* data, uintptr_t len1 )
  { 
    auto scenarioEndAddress = (LPSTR *)(text + 0x1000);
    auto scenarioEnd = *scenarioEndAddress;
    if (!Engine::isAddressReadable(scenarioEnd))
      scenarioEnd = nullptr;
      //DOUT("warning: scenario end NOT FOUND");
 
    text = ltrimScenarioText(text);
    if (!*text)
      return;
    std::string oldData = parseScenarioText(text, scenarioEnd);
    auto newData=std::string((char*)data,len1);
    if (newData.empty() || newData == oldData)
      return;

    if (newData.find('\n')!=newData.npos)
      newData = replaceNewLines(newData);

    if (scenarioEnd > text && scenarioEnd - text > newData.size())
      ::memset(text + newData.size(), 0, scenarioEnd - text - newData.size());
    else if (oldData.size() > newData.size())
      ::memset(text + newData.size(), 0, oldData.size() - newData.size());

    //::strcpy(text, newData.constData());
    ::memcpy(text, newData.c_str(), newData.size() + 1);

    *scenarioEndAddress = text + newData.size(); // FIXME: THis sometimes does not work
  }
  bool hookBefore(hook_stack*s,void* data, size_t* len1,uintptr_t*role)
  {
    auto self = (LPSTR)s->ecx;
    ULONG retaddr = s->stack[0];
  //  bool b1=  dispatchNameText(self + nameOffset_, retaddr,s,data,len1,role);
    bool b2=dispatchScenarioText(self + scenarioOffset_, retaddr,s,data,len1,role);
    return  b2;
  }
    void hookafter(hook_stack*s,void* data, uintptr_t len1)
  {
    auto self = (LPSTR)s->ecx;
    ULONG retaddr = s->stack[0];
   //  dispatchNameTextafter(self + nameOffset_, retaddr,s,data,len1);
     dispatchScenarioTextafter(self + scenarioOffset_, retaddr,s,data,len1); 
  }
} // namespace Private

/**
 *  Debugging method:
 *  - Hijack GetGlyphOutlineA
 *    There is only one GetGlyphOutlineA
 *  - Find all text in memory
 *    There are two matches.
 *    One is current text with fixed address
 *    One is all text with fixed address
 *  - Find all text address on the stack
 *    There is one function use it as arg1 and as future text
 *    ecx is the current text instead
 *
 *  Sample game: プリズム・プリンセス
 *  name = ecx + 0xadd1
 *  scenario = ecx + 0xae48
 *  scenario end = ecx + 0xbe48
 *
 *  00441E3F   90               NOP
 *  00441E40   83EC 1C          SUB ESP,0x1C
 *  00441E43   53               PUSH EBX
 *  00441E44   56               PUSH ESI
 *  00441E45   8BF1             MOV ESI,ECX
 *  00441E47   8B9E 48BE0000    MOV EBX,DWORD PTR DS:[ESI+0xBE48]
 *  00441E4D   2BDE             SUB EBX,ESI
 *  00441E4F   81EB 48AE0000    SUB EBX,0xAE48
 *  00441E55   75 0B            JNZ SHORT .00441E62
 *  00441E57   5E               POP ESI
 *  00441E58   B8 01000000      MOV EAX,0x1
 *  00441E5D   5B               POP EBX
 *  00441E5E   83C4 1C          ADD ESP,0x1C
 *  00441E61   C3               RETN
 *  00441E62   8B86 AC040000    MOV EAX,DWORD PTR DS:[ESI+0x4AC]
 *  00441E68   55               PUSH EBP
 *  00441E69   57               PUSH EDI
 *  00441E6A   50               PUSH EAX
 *  00441E6B   8BCE             MOV ECX,ESI
 *  00441E6D   E8 9E6CFFFF      CALL .00438B10
 *  00441E72   8A96 DE050000    MOV DL,BYTE PTR DS:[ESI+0x5DE]
 *  00441E78   8B8E 909E0000    MOV ECX,DWORD PTR DS:[ESI+0x9E90]
 *  00441E7E   8BBE 489E0000    MOV EDI,DWORD PTR DS:[ESI+0x9E48]
 *  00441E84   84D2             TEST DL,DL
 *  00441E86   0F94C0           SETE AL
 *  00441E89   84C0             TEST AL,AL
 *  00441E8B   884424 13        MOV BYTE PTR SS:[ESP+0x13],AL
 *  00441E8F   C741 20 00000000 MOV DWORD PTR DS:[ECX+0x20],0x0
 *  00441E96   74 0D            JE SHORT .00441EA5
 *  00441E98   8BCE             MOV ECX,ESI
 *
 *  00441E9A   E8 4136FFFF      CALL .004354E0
 *  00441E9F   8987 A8030000    MOV DWORD PTR DS:[EDI+0x3A8],EAX
 *  00441EA5   8D86 48AE0000    LEA EAX,DWORD PTR DS:[ESI+0xAE48]	; jichi: this is the scenari text
 *  00441EAB   53               PUSH EBX
 *  00441EAC   50               PUSH EAX
 *  00441EAD   8BCF             MOV ECX,EDI
 *  00441EAF   E8 EC6B0000      CALL .00448AA0
 *  00441EB4   8D9E E2AD0000    LEA EBX,DWORD PTR DS:[ESI+0xADE2]	; jichi: this is the character name
 *  00441EBA   8D86 D1AD0000    LEA EAX,DWORD PTR DS:[ESI+0xADD1]	; jichi: this is the name text
 *  00441EC0   53               PUSH EBX
 *  00441EC1   50               PUSH EAX
 *  00441EC2   8BCF             MOV ECX,EDI
 *  00441EC4   894424 1C        MOV DWORD PTR SS:[ESP+0x1C],EAX
 *  00441EC8   E8 836B0000      CALL .00448A50
 *
 *  00441ECD   8A4424 13        MOV AL,BYTE PTR SS:[ESP+0x13]
 *  00441ED1   84C0             TEST AL,AL
 *  00441ED3   74 30            JE SHORT .00441F05
 *  00441ED5   6A 01            PUSH 0x1
 *  00441ED7   8BCF             MOV ECX,EDI
 *  00441ED9   E8 726D0000      CALL .00448C50
 *  00441EDE   803B 00          CMP BYTE PTR DS:[EBX],0x0
 *  00441EE1   74 22            JE SHORT .00441F05
 *  00441EE3   8B86 00AE0000    MOV EAX,DWORD PTR DS:[ESI+0xAE00]
 *  00441EE9   85C0             TEST EAX,EAX
 *  00441EEB   75 18            JNZ SHORT .00441F05
 *  00441EED   8B86 AC040000    MOV EAX,DWORD PTR DS:[ESI+0x4AC]
 *  00441EF3   8D97 D1030000    LEA EDX,DWORD PTR DS:[EDI+0x3D1]
 *  00441EF9   8996 00AE0000    MOV DWORD PTR DS:[ESI+0xAE00],EDX
 *  00441EFF   8986 C0040000    MOV DWORD PTR DS:[ESI+0x4C0],EAX
 *  00441F05   8A86 30A60000    MOV AL,BYTE PTR DS:[ESI+0xA630]
 *  00441F0B   84C0             TEST AL,AL
 *  00441F0D   0F84 DB000000    JE .00441FEE
 *  00441F13   8B86 C0A00000    MOV EAX,DWORD PTR DS:[ESI+0xA0C0]
 *  00441F19   85C0             TEST EAX,EAX
 *  00441F1B   0F84 CD000000    JE .00441FEE
 *  00441F21   8B96 E0A00000    MOV EDX,DWORD PTR DS:[ESI+0xA0E0]
 *  00441F27   8DAE E0A00000    LEA EBP,DWORD PTR DS:[ESI+0xA0E0]
 *  00441F2D   6A 00            PUSH 0x0
 *  00441F2F   8BCD             MOV ECX,EBP
 *  00441F31   FF92 B4000000    CALL DWORD PTR DS:[EDX+0xB4]
 *  00441F37   8B86 489E0000    MOV EAX,DWORD PTR DS:[ESI+0x9E48]
 *  00441F3D   8D8E 5C470000    LEA ECX,DWORD PTR DS:[ESI+0x475C]
 *  00441F43   8D96 14680000    LEA EDX,DWORD PTR DS:[ESI+0x6814]
 *  00441F49   898E E4050000    MOV DWORD PTR DS:[ESI+0x5E4],ECX
 *  00441F4F   894424 18        MOV DWORD PTR SS:[ESP+0x18],EAX
 *  00441F53   89AE 489E0000    MOV DWORD PTR DS:[ESI+0x9E48],EBP
 *  00441F59   C686 D8A00000 01 MOV BYTE PTR DS:[ESI+0xA0D8],0x1
 *  00441F60   8996 E8050000    MOV DWORD PTR DS:[ESI+0x5E8],EDX
 *  00441F66   8B87 B4030000    MOV EAX,DWORD PTR DS:[EDI+0x3B4]
 *  00441F6C   6A 01            PUSH 0x1
 *  00441F6E   8D4C24 20        LEA ECX,DWORD PTR SS:[ESP+0x20]
 *  00441F72   6A 01            PUSH 0x1
 *  00441F74   51               PUSH ECX
 *  00441F75   50               PUSH EAX
 *  00441F76   8BCD             MOV ECX,EBP
 *  00441F78   E8 935D0000      CALL .00447D10
 *  00441F7D   8B5424 18        MOV EDX,DWORD PTR SS:[ESP+0x18]
 *  00441F81   8D8E EC050000    LEA ECX,DWORD PTR DS:[ESI+0x5EC]
 *  00441F87   8996 489E0000    MOV DWORD PTR DS:[ESI+0x9E48],EDX
 *  00441F8D   8D96 A4260000    LEA EDX,DWORD PTR DS:[ESI+0x26A4]
 *  00441F93   85C0             TEST EAX,EAX
 *  00441F95   C686 D8A00000 00 MOV BYTE PTR DS:[ESI+0xA0D8],0x0
 *  00441F9C   898E E4050000    MOV DWORD PTR DS:[ESI+0x5E4],ECX
 *  00441FA2   8996 E8050000    MOV DWORD PTR DS:[ESI+0x5E8],EDX
 *  00441FA8   7E 44            JLE SHORT .00441FEE
 *  00441FAA   8A86 31A60000    MOV AL,BYTE PTR DS:[ESI+0xA631]
 *  00441FB0   84C0             TEST AL,AL
 *  00441FB2   74 0A            JE SHORT .00441FBE
 *  00441FB4   33C0             XOR EAX,EAX
 *  00441FB6   8A86 32A60000    MOV AL,BYTE PTR DS:[ESI+0xA632]
 *  00441FBC   EB 02            JMP SHORT .00441FC0
 *  00441FBE   33C0             XOR EAX,EAX
 *  00441FC0   8B4C24 28        MOV ECX,DWORD PTR SS:[ESP+0x28]
 *  00441FC4   8B6C24 20        MOV EBP,DWORD PTR SS:[ESP+0x20]
 *  00441FC8   8B97 B8030000    MOV EDX,DWORD PTR DS:[EDI+0x3B8]
 *  00441FCE   50               PUSH EAX
 *  00441FCF   8B4424 18        MOV EAX,DWORD PTR SS:[ESP+0x18]
 *  00441FD3   2BCD             SUB ECX,EBP
 *  00441FD5   53               PUSH EBX
 *  00441FD6   83C1 04          ADD ECX,0x4
 *  00441FD9   50               PUSH EAX
 *  00441FDA   8B87 B4030000    MOV EAX,DWORD PTR DS:[EDI+0x3B4]
 *  00441FE0   51               PUSH ECX
 *  00441FE1   52               PUSH EDX
 *  00441FE2   50               PUSH EAX
 *  00441FE3   8D8E B8A00000    LEA ECX,DWORD PTR DS:[ESI+0xA0B8]
 *  00441FE9   E8 72290000      CALL .00444960
 *  00441FEE   8B4C24 14        MOV ECX,DWORD PTR SS:[ESP+0x14]
 *  00441FF2   8D86 48AE0000    LEA EAX,DWORD PTR DS:[ESI+0xAE48]
 *  00441FF8   5F               POP EDI
 *  00441FF9   8986 48BE0000    MOV DWORD PTR DS:[ESI+0xBE48],EAX
 *  00441FFF   5D               POP EBP
 *  00442000   C603 00          MOV BYTE PTR DS:[EBX],0x0
 *  00442003   5E               POP ESI
 *  00442004   C601 00          MOV BYTE PTR DS:[ECX],0x0
 *  00442007   33C0             XOR EAX,EAX
 *  00442009   5B               POP EBX
 *  0044200A   83C4 1C          ADD ESP,0x1C
 *  0044200D   C3               RETN
 *  0044200E   90               NOP
 *  0044200F   90               NOP
 *
 *  Sample game: 猫撫ディストーション
 *  name = ecx + 0xc60f
 *  scenario = ecx + 0xc684
 *  scenario end = ecx + 0xd684
 *
 *  0043E11E   90               NOP
 *  0043E11F   90               NOP
 *  0043E120   83EC 18          SUB ESP,0x18
 *  0043E123   53               PUSH EBX
 *  0043E124   55               PUSH EBP
 *  0043E125   56               PUSH ESI
 *  0043E126   8BF1             MOV ESI,ECX
 *  0043E128   57               PUSH EDI
 *  0043E129   8BAE 84D60000    MOV EBP,DWORD PTR DS:[ESI+0xD684]	; jichi: overall offset is around 0xD684
 *  0043E12F   2BEE             SUB EBP,ESI
 *  0043E131   81ED 84C60000    SUB EBP,0xC684
 *  0043E137   896C24 10        MOV DWORD PTR SS:[ESP+0x10],EBP
 *  0043E13B   75 0D            JNZ SHORT .0043E14A
 *  0043E13D   5F               POP EDI
 *  0043E13E   5E               POP ESI
 *  0043E13F   5D               POP EBP
 *  0043E140   B8 01000000      MOV EAX,0x1
 *  0043E145   5B               POP EBX
 *  0043E146   83C4 18          ADD ESP,0x18
 *  0043E149   C3               RETN
 *  0043E14A   8B86 A8040000    MOV EAX,DWORD PTR DS:[ESI+0x4A8]
 *  0043E150   8BCE             MOV ECX,ESI
 *  0043E152   50               PUSH EAX
 *  0043E153   E8 3875FFFF      CALL .00435690
 *  0043E158   8B9E F4B20000    MOV EBX,DWORD PTR DS:[ESI+0xB2F4]
 *  0043E15E   8BBE D8B10000    MOV EDI,DWORD PTR DS:[ESI+0xB1D8]
 *  0043E164   8B43 14          MOV EAX,DWORD PTR DS:[EBX+0x14]
 *  0043E167   85C0             TEST EAX,EAX
 *  0043E169   7D 7C            JGE SHORT .0043E1E7
 *  0043E16B   8B8E 70040000    MOV ECX,DWORD PTR DS:[ESI+0x470]
 *  0043E171   6A 00            PUSH 0x0
 *  0043E173   8D96 20C60000    LEA EDX,DWORD PTR DS:[ESI+0xC620]	; jichi: 0xc620 is the nearest position
 *  0043E179   6A 00            PUSH 0x0
 *  0043E17B   52               PUSH EDX
 *  0043E17C   6A FE            PUSH -0x2
 *  0043E17E   E8 ED93FEFF      CALL .00427570
 *  0043E183   8BE8             MOV EBP,EAX
 *  0043E185   85ED             TEST EBP,EBP
 *  0043E187   7C 0D            JL SHORT .0043E196
 *  0043E189   45               INC EBP
 *  0043E18A   83FD 08          CMP EBP,0x8
 *  0043E18D   7C 09            JL SHORT .0043E198
 *  0043E18F   BD 07000000      MOV EBP,0x7
 *  0043E194   EB 02            JMP SHORT .0043E198
 *  0043E196   33ED             XOR EBP,EBP
 *  0043E198   396B 1C          CMP DWORD PTR DS:[EBX+0x1C],EBP
 *  0043E19B   74 46            JE SHORT .0043E1E3
 *  0043E19D   8B8F 4C020000    MOV ECX,DWORD PTR DS:[EDI+0x24C]
 *  0043E1A3   85C9             TEST ECX,ECX
 *  0043E1A5   75 0D            JNZ SHORT .0043E1B4
 *  0043E1A7   5F               POP EDI
 *  0043E1A8   5E               POP ESI
 *  0043E1A9   5D               POP EBP
 *  0043E1AA   B8 02000000      MOV EAX,0x2
 *  0043E1AF   5B               POP EBX
 *  0043E1B0   83C4 18          ADD ESP,0x18
 *  0043E1B3   C3               RETN
 *  0043E1B4   8BC5             MOV EAX,EBP
 *  0043E1B6   6A 00            PUSH 0x0
 *  0043E1B8   C1E0 04          SHL EAX,0x4
 *  0043E1BB   03C5             ADD EAX,EBP
 *  0043E1BD   6A 00            PUSH 0x0
 *  0043E1BF   6A 00            PUSH 0x0
 *  0043E1C1   6A 00            PUSH 0x0
 *  0043E1C3   8D94C6 48BA0000  LEA EDX,DWORD PTR DS:[ESI+EAX*8+0xBA48]
 *  0043E1CA   52               PUSH EDX
 *  0043E1CB   E8 E0DD0200      CALL .0046BFB0
 *  0043E1D0   896B 1C          MOV DWORD PTR DS:[EBX+0x1C],EBP
 *  0043E1D3   8B07             MOV EAX,DWORD PTR DS:[EDI]
 *  0043E1D5   6A 01            PUSH 0x1
 *  0043E1D7   6A 01            PUSH 0x1
 *  0043E1D9   6A 01            PUSH 0x1
 *  0043E1DB   8BCF             MOV ECX,EDI
 *  0043E1DD   FF90 4C010000    CALL DWORD PTR DS:[EAX+0x14C]
 *  0043E1E3   8B6C24 10        MOV EBP,DWORD PTR SS:[ESP+0x10]
 *  0043E1E7   8BCE             MOV ECX,ESI
 *  0043E1E9   C743 20 00000000 MOV DWORD PTR DS:[EBX+0x20],0x0
 *
 *  0043E1F0   E8 3B46FFFF      CALL .00432830
 *  0043E1F5   8987 A0030000    MOV DWORD PTR DS:[EDI+0x3A0],EAX
 *  0043E1FB   8D86 84C60000    LEA EAX,DWORD PTR DS:[ESI+0xC684]	; jichi: this is scenario
 *  0043E201   55               PUSH EBP
 *  0043E202   50               PUSH EAX
 *  0043E203   8BCF             MOV ECX,EDI
 *  0043E205   E8 765F0000      CALL .00444180
 *  0043E20A   8D9E 20C60000    LEA EBX,DWORD PTR DS:[ESI+0xC620]	; jichi: this is the chara name, such as KOT0
 *  0043E210   8D86 0FC60000    LEA EAX,DWORD PTR DS:[ESI+0xC60F]	; jichi: this is the name address
 *  0043E216   53               PUSH EBX
 *  0043E217   50               PUSH EAX
 *  0043E218   8BCF             MOV ECX,EDI
 *  0043E21A   894424 18        MOV DWORD PTR SS:[ESP+0x18],EAX
 *  0043E21E   E8 0D5F0000      CALL .00444130
 *
 *  0043E223   6A 01            PUSH 0x1
 *  0043E225   8BCF             MOV ECX,EDI
 *  0043E227   E8 04600000      CALL .00444230
 *  0043E22C   8A86 40BA0000    MOV AL,BYTE PTR DS:[ESI+0xBA40]
 *  0043E232   84C0             TEST AL,AL
 *  0043E234   0F84 DB000000    JE .0043E315
 *  0043E23A   8B86 18B50000    MOV EAX,DWORD PTR DS:[ESI+0xB518]
 *  0043E240   85C0             TEST EAX,EAX
 *  0043E242   0F84 CD000000    JE .0043E315
 *  0043E248   8B96 38B50000    MOV EDX,DWORD PTR DS:[ESI+0xB538]
 *  0043E24E   8DAE 38B50000    LEA EBP,DWORD PTR DS:[ESI+0xB538]
 *  0043E254   6A 00            PUSH 0x0
 *  0043E256   8BCD             MOV ECX,EBP
 *  0043E258   FF92 B4000000    CALL DWORD PTR DS:[EDX+0xB4]
 *  0043E25E   8B86 D8B10000    MOV EAX,DWORD PTR DS:[ESI+0xB1D8]
 *  0043E264   8D8E 70460000    LEA ECX,DWORD PTR DS:[ESI+0x4670]
 *  0043E26A   8D96 28670000    LEA EDX,DWORD PTR DS:[ESI+0x6728]
 *  0043E270   898E F8040000    MOV DWORD PTR DS:[ESI+0x4F8],ECX
 *  0043E276   894424 14        MOV DWORD PTR SS:[ESP+0x14],EAX
 *  0043E27A   89AE D8B10000    MOV DWORD PTR DS:[ESI+0xB1D8],EBP
 *  0043E280   C686 30B50000 01 MOV BYTE PTR DS:[ESI+0xB530],0x1
 *  0043E287   8996 FC040000    MOV DWORD PTR DS:[ESI+0x4FC],EDX
 *  0043E28D   8B87 AC030000    MOV EAX,DWORD PTR DS:[EDI+0x3AC]
 *  0043E293   6A 01            PUSH 0x1
 *  0043E295   8D4C24 1C        LEA ECX,DWORD PTR SS:[ESP+0x1C]
 *  0043E299   6A 01            PUSH 0x1
 *  0043E29B   51               PUSH ECX
 *  0043E29C   50               PUSH EAX
 *  0043E29D   8BCD             MOV ECX,EBP
 *  0043E29F   E8 DC570000      CALL .00443A80
 *  0043E2A4   8B5424 14        MOV EDX,DWORD PTR SS:[ESP+0x14]
 *  0043E2A8   8D8E 00050000    LEA ECX,DWORD PTR DS:[ESI+0x500]
 *  0043E2AE   8996 D8B10000    MOV DWORD PTR DS:[ESI+0xB1D8],EDX
 *  0043E2B4   8D96 B8250000    LEA EDX,DWORD PTR DS:[ESI+0x25B8]
 *  0043E2BA   85C0             TEST EAX,EAX
 *  0043E2BC   C686 30B50000 00 MOV BYTE PTR DS:[ESI+0xB530],0x0
 *  0043E2C3   898E F8040000    MOV DWORD PTR DS:[ESI+0x4F8],ECX
 *  0043E2C9   8996 FC040000    MOV DWORD PTR DS:[ESI+0x4FC],EDX
 *  0043E2CF   7E 44            JLE SHORT .0043E315
 *  0043E2D1   8A86 41BA0000    MOV AL,BYTE PTR DS:[ESI+0xBA41]
 *  0043E2D7   84C0             TEST AL,AL
 *  0043E2D9   74 0A            JE SHORT .0043E2E5
 *  0043E2DB   33C0             XOR EAX,EAX
 *  0043E2DD   8A86 42BA0000    MOV AL,BYTE PTR DS:[ESI+0xBA42]
 *  0043E2E3   EB 02            JMP SHORT .0043E2E7
 *  0043E2E5   33C0             XOR EAX,EAX
 *  0043E2E7   8B4C24 24        MOV ECX,DWORD PTR SS:[ESP+0x24]
 *  0043E2EB   8B6C24 1C        MOV EBP,DWORD PTR SS:[ESP+0x1C]
 *  0043E2EF   8B97 B0030000    MOV EDX,DWORD PTR DS:[EDI+0x3B0]
 *  0043E2F5   50               PUSH EAX
 *  0043E2F6   8B4424 14        MOV EAX,DWORD PTR SS:[ESP+0x14]
 *  0043E2FA   2BCD             SUB ECX,EBP
 *  0043E2FC   53               PUSH EBX
 *  0043E2FD   83C1 04          ADD ECX,0x4
 *  0043E300   50               PUSH EAX
 *  0043E301   8B87 AC030000    MOV EAX,DWORD PTR DS:[EDI+0x3AC]
 *  0043E307   51               PUSH ECX
 *  0043E308   52               PUSH EDX
 *  0043E309   50               PUSH EAX
 *  0043E30A   8D8E 10B50000    LEA ECX,DWORD PTR DS:[ESI+0xB510]
 *  0043E310   E8 7B270000      CALL .00440A90
 *  0043E315   803B 00          CMP BYTE PTR DS:[EBX],0x0
 *  0043E318   74 0C            JE SHORT .0043E326
 *  0043E31A   81C7 C9030000    ADD EDI,0x3C9
 *  0043E320   89BE 3CC60000    MOV DWORD PTR DS:[ESI+0xC63C],EDI
 *  0043E326   8B4C24 10        MOV ECX,DWORD PTR SS:[ESP+0x10]
 *  0043E32A   8D86 84C60000    LEA EAX,DWORD PTR DS:[ESI+0xC684]
 *  0043E330   8986 84D60000    MOV DWORD PTR DS:[ESI+0xD684],EAX
 *  0043E336   5F               POP EDI
 *  0043E337   5E               POP ESI
 *  0043E338   C603 00          MOV BYTE PTR DS:[EBX],0x0
 *  0043E33B   5D               POP EBP
 *  0043E33C   C601 00          MOV BYTE PTR DS:[ECX],0x0
 *  0043E33F   33C0             XOR EAX,EAX
 *  0043E341   5B               POP EBX
 *  0043E342   83C4 18          ADD ESP,0x18
 *  0043E345   C3               RETN
 *  0043E346   90               NOP
 *  0043E347   90               NOP
 *  0043E348   90               NOP
 *  0043E349   90               NOP
 *  0043E34A   90               NOP
 *  0043E34B   90               NOP
 */
bool attach(ULONG startAddress, ULONG stopAddress) // attach scenario
{
  const uint8_t bytes[] = {
    0xe8, XX4,              // 0043e1f0   e8 3b46ffff      call .00432830
    0x89,0x87, XX4,         // 0043e1f5   8987 a0030000    mov dword ptr ds:[edi+0x3a0],eax
    0x8d,0x86, XX4,         // 0043e1fb   8d86 84c60000    lea eax,dword ptr ds:[esi+0xc684]	; jichi: this is scenario
                            // 0043e201   55               push ebp
                            // 0043e202   50               push eax
    XX4,                    // 0043e203   8bcf             mov ecx,edi
    0xe8, XX4,              // 0043e205   e8 765f0000      call .00444180
    0x8d,0x9e, XX4,         // 0043e20a   8d9e 20c60000    lea ebx,dword ptr ds:[esi+0xc620]	; jichi: this is the chara name, such as kot0
    0x8d,0x86, XX4,         // 0043e210   8d86 0fc60000    lea eax,dword ptr ds:[esi+0xc60f]	; jichi: this is the name address
    0x53,                   // 0043e216   53               push ebx
    0x50,                   // 0043e217   50               push eax
    0x8b,0xcf,              // 0043e218   8bcf             mov ecx,edi
    0x89,0x44,0x24, XX,     // 0043e21a   894424 18        mov dword ptr ss:[esp+0x18],eax
    0xe8 //, XX4            // 0043e21e   e8 0d5f0000      call .00444130
  };
  ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
  if (!addr)
    return false;

  Private::scenarioOffset_ = *(DWORD *)(addr + 2 + 0x0043e1fb - 0x0043e1f0);
  Private::nameOffset_ = *(DWORD *)(addr + 2 + 0x0043e210 - 0x0043e1f0);
  if ((Private::scenarioOffset_ >> 16) || // offset high bits are zero
      (Private::nameOffset_ >> 16))
    return false;

  addr = MemDbg::findEnclosingAlignedFunction(addr);
  if (!addr)
    return false;
  HookParam hp;
  hp.address=addr;
  hp.type=EMBED_ABLE|EMBED_DYNA_SJIS;
  hp.hook_before=Private::hookBefore;
  hp.hook_after=Private::hookafter; 
  hp.hook_font=F_GetGlyphOutlineA|F_GetTextExtentPoint32A;
  return NewHook(hp,"EmbedLucifen");
} 
} // namespace ScenarioHook

namespace ChoiceHook {
namespace Private {

  bool hookBefore(hook_stack*s,void* data, size_t* len1,uintptr_t*role)
  {
    static std::string data_;
    auto text = (LPCSTR)s->stack[0]; // arg1 is text
    if (!text || !*text)
      return text;
    *role=Engine::ChoiceRole;
    write_string_overwrite(data,len1,text);
    return true; 
  }
   void hookafter(hook_stack*s,void* data, size_t len1){
      
      auto newData =std::string((char*)data,len1); 
   strcpy((char*)s->stack[0], newData.c_str()); 
  }

} // namespace Private

/**
 *  Debugging method:
 *  - Hijack GetGlyphOutlineA
 *  - Backtrack stack to find text that used as argument
 *
 *  Sample game: プリズム・プリンセス
 *
 *  Text in arg1.
 *
 *  The function is only called by one caller.
 *  I suspect it is a virtual function, and hence caller is hooked.
 *
 *  0044235E   90               NOP
 *  0044235F   90               NOP
 *  00442360   83EC 08          SUB ESP,0x8
 *  00442363   53               PUSH EBX
 *  00442364   56               PUSH ESI
 *  00442365   8BF1             MOV ESI,ECX
 *  00442367   BB 01000000      MOV EBX,0x1
 *  0044236C   8A86 E2050000    MOV AL,BYTE PTR DS:[ESI+0x5E2]
 *  00442372   84C0             TEST AL,AL
 *  00442374   75 14            JNZ SHORT .0044238A
 *  00442376   889E BD040000    MOV BYTE PTR DS:[ESI+0x4BD],BL
 *  0044237C   E8 BFFAFFFF      CALL .00441E40
 *  00442381   85C0             TEST EAX,EAX
 *  00442383   0F94C0           SETE AL
 *  00442386   84C0             TEST AL,AL
 *  00442388   74 16            JE SHORT .004423A0
 *  0044238A   53               PUSH EBX
 *  0044238B   6A 00            PUSH 0x0
 *  0044238D   8BCE             MOV ECX,ESI
 *  0044238F   E8 2C80FFFF      CALL .0043A3C0
 *  00442394   85C0             TEST EAX,EAX
 *  00442396   74 16            JE SHORT .004423AE
 *  00442398   5E               POP ESI
 *  00442399   5B               POP EBX
 *  0044239A   83C4 08          ADD ESP,0x8
 *  0044239D   C2 0400          RETN 0x4
 *  004423A0   8B86 88040000    MOV EAX,DWORD PTR DS:[ESI+0x488]
 *  004423A6   8BCE             MOV ECX,ESI
 *  004423A8   50               PUSH EAX
 *  004423A9   E8 32120700      CALL .004B35E0
 *  004423AE   8B96 949E0000    MOV EDX,DWORD PTR DS:[ESI+0x9E94]
 *  004423B4   55               PUSH EBP
 *  004423B5   8DAE 949E0000    LEA EBP,DWORD PTR DS:[ESI+0x9E94]
 *  004423BB   57               PUSH EDI
 *  004423BC   8BCD             MOV ECX,EBP
 *  004423BE   C686 BD040000 00 MOV BYTE PTR DS:[ESI+0x4BD],0x0
 *  004423C5   FF92 80000000    CALL DWORD PTR DS:[EDX+0x80]
 *  004423CB   8B86 44040000    MOV EAX,DWORD PTR DS:[ESI+0x444]
 *  004423D1   85C0             TEST EAX,EAX
 *  004423D3   74 05            JE SHORT .004423DA
 *  004423D5   83C0 18          ADD EAX,0x18
 *  004423D8   EB 02            JMP SHORT .004423DC
 *  004423DA   33C0             XOR EAX,EAX
 *  004423DC   8B8E A0A00000    MOV ECX,DWORD PTR DS:[ESI+0xA0A0]
 *  004423E2   8B7C24 1C        MOV EDI,DWORD PTR SS:[ESP+0x1C]
 *  004423E6   8B55 00          MOV EDX,DWORD PTR SS:[EBP]
 *  004423E9   51               PUSH ECX
 *  004423EA   8B4F 4C          MOV ECX,DWORD PTR DS:[EDI+0x4C]
 *  004423ED   51               PUSH ECX
 *  004423EE   50               PUSH EAX
 *  004423EF   8BCD             MOV ECX,EBP
 *  004423F1   FF92 AC000000    CALL DWORD PTR DS:[EDX+0xAC]
 *  004423F7   B8 02000000      MOV EAX,0x2
 *  004423FC   8D4F 08          LEA ECX,DWORD PTR DS:[EDI+0x8]
 *  004423FF   8339 00          CMP DWORD PTR DS:[ECX],0x0
 *  00442402   74 0B            JE SHORT .0044240F
 *  00442404   83C0 02          ADD EAX,0x2
 *  00442407   83C1 08          ADD ECX,0x8
 *  0044240A   83F8 12          CMP EAX,0x12
 *  0044240D  ^7C F0            JL SHORT .004423FF
 *  0044240F   D1F8             SAR EAX,1
 *  00442411   48               DEC EAX
 *  00442412   8BF8             MOV EDI,EAX
 *  00442414   8A86 30A60000    MOV AL,BYTE PTR DS:[ESI+0xA630]
 *  0044241A   84C0             TEST AL,AL
 *  0044241C   897C24 14        MOV DWORD PTR SS:[ESP+0x14],EDI
 *  00442420   89BE 9CA00000    MOV DWORD PTR DS:[ESI+0xA09C],EDI
 *  00442426   0F84 B9000000    JE .004424E5
 *  0044242C   8B86 C0A00000    MOV EAX,DWORD PTR DS:[ESI+0xA0C0]
 *  00442432   85C0             TEST EAX,EAX
 *  00442434   0F84 AB000000    JE .004424E5
 *  0044243A   57               PUSH EDI
 *  0044243B   8D8E B8A00000    LEA ECX,DWORD PTR DS:[ESI+0xA0B8]
 *  00442441   885C24 17        MOV BYTE PTR SS:[ESP+0x17],BL
 *  00442445   E8 46270000      CALL .00444B90
 *  0044244A   33DB             XOR EBX,EBX
 *  0044244C   85FF             TEST EDI,EDI
 *  0044244E   7E 64            JLE SHORT .004424B4
 *  00442450   8B5424 1C        MOV EDX,DWORD PTR SS:[ESP+0x1C]
 *  00442454   8D7A 0C          LEA EDI,DWORD PTR DS:[EDX+0xC]
 *  00442457   8A941E B8040000  MOV DL,BYTE PTR DS:[ESI+EBX+0x4B8]
 *  0044245E   8B45 00          MOV EAX,DWORD PTR SS:[EBP]
 *  00442461   6A 00            PUSH 0x0
 *  00442463   6A 00            PUSH 0x0
 *  00442465   84D2             TEST DL,DL
 *  00442467   8B17             MOV EDX,DWORD PTR DS:[EDI]
 *  00442469   6A 00            PUSH 0x0
 *  0044246B   0F954424 28      SETNE BYTE PTR SS:[ESP+0x28]
 *  00442470   8B4C24 28        MOV ECX,DWORD PTR SS:[ESP+0x28]
 *  00442474   6A 00            PUSH 0x0
 *  00442476   6A FF            PUSH -0x1
 *  00442478   6A 00            PUSH 0x0
 *  0044247A   6A FF            PUSH -0x1
 *  0044247C   51               PUSH ECX
 *  0044247D   6A 00            PUSH 0x0
 *  0044247F   52               PUSH EDX
 *  00442480   8BCD             MOV ECX,EBP
 *  00442482   FF90 84000000    CALL DWORD PTR DS:[EAX+0x84]             ; .004BBD00	; jichi: text called here, text on the top
 *  00442488   8A4424 13        MOV AL,BYTE PTR SS:[ESP+0x13]
 *  0044248C   84C0             TEST AL,AL
 *  0044248E   74 18            JE SHORT .004424A8
 *  00442490   8A5424 1C        MOV DL,BYTE PTR SS:[ESP+0x1C]
 *  00442494   8B0F             MOV ECX,DWORD PTR DS:[EDI]
 *  00442496   84D2             TEST DL,DL
 *  00442498   0F94C0           SETE AL
 *  0044249B   50               PUSH EAX
 *  0044249C   51               PUSH ECX
 *  0044249D   8D8E B8A00000    LEA ECX,DWORD PTR DS:[ESI+0xA0B8]
 *  004424A3   E8 48280000      CALL .00444CF0
 *  004424A8   8B4424 14        MOV EAX,DWORD PTR SS:[ESP+0x14]
 *  004424AC   83C7 08          ADD EDI,0x8
 *  004424AF   43               INC EBX
 *  004424B0   3BD8             CMP EBX,EAX
 *  004424B2  ^7C A3            JL SHORT .00442457
 *  004424B4   8A4424 13        MOV AL,BYTE PTR SS:[ESP+0x13]
 *  004424B8   5F               POP EDI
 *  004424B9   84C0             TEST AL,AL
 *  004424BB   5D               POP EBP
 *  004424BC   74 12            JE SHORT .004424D0
 *  004424BE   8D96 34A60000    LEA EDX,DWORD PTR DS:[ESI+0xA634]
 *  004424C4   8D8E B8A00000    LEA ECX,DWORD PTR DS:[ESI+0xA0B8]
 *  004424CA   52               PUSH EDX
 *  004424CB   E8 B0280000      CALL .00444D80
 *  004424D0   33C0             XOR EAX,EAX
 *  004424D2   81C6 B8040000    ADD ESI,0x4B8
 *  004424D8   8906             MOV DWORD PTR DS:[ESI],EAX
 *  004424DA   8846 04          MOV BYTE PTR DS:[ESI+0x4],AL
 *  004424DD   5E               POP ESI
 *  004424DE   5B               POP EBX
 *  004424DF   83C4 08          ADD ESP,0x8
 *  004424E2   C2 0400          RETN 0x4
 *  004424E5   C64424 13 00     MOV BYTE PTR SS:[ESP+0x13],0x0
 *  004424EA  ^E9 5BFFFFFF      JMP .0044244A
 *  004424EF   90               NOP
 *  004424F0   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+0x4]
 *  004424F4   8B40 04          MOV EAX,DWORD PTR DS:[EAX+0x4]
 *  004424F7   85C0             TEST EAX,EAX
 *  004424F9   7C 0D            JL SHORT .00442508
 *  004424FB   83F8 05          CMP EAX,0x5
 *  004424FE   7D 08            JGE SHORT .00442508
 *  00442500   C68408 B8040000 >MOV BYTE PTR DS:[EAX+ECX+0x4B8],0x1
 *  00442508   33C0             XOR EAX,EAX
 *  0044250A   C2 0400          RETN 0x4
 *  0044250D   90               NOP
 *  0044250E   90               NOP
 */
bool attach(ULONG startAddress, ULONG stopAddress) // attach scenario
{
  const uint8_t bytes[] = {
    0xff,0x90, 0x84,0x00,0x00,0x00, // 00442482   ff90 84000000    call dword ptr ds:[eax+0x84]             ; .004bbd00	; jichi: text called here, text on the top
    0x8a,0x44,0x24, 0x13            // 00442488   8a4424 13        mov al,byte ptr ss:[esp+0x13]
  };
  ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
  if(addr==0)return false;
  HookParam hp;
  hp.address=addr;
  hp.type=EMBED_ABLE|EMBED_DYNA_SJIS;
  hp.hook_before=Private::hookBefore;
  hp.hook_after=Private::hookafter; 
  hp.hook_font=F_GetGlyphOutlineA|F_GetTextExtentPoint32A;
  return NewHook(hp,"lucifen_choice");
}
} // namespace ChoiceHook
 
  size_t  countZero(const char *s, size_t limit=1500)
{
  size_t count = 0;
  for (auto p = s; !*p && count < limit; p++, count++);
  return count == limit ? 0 : count;
}bool hookBefore(hook_stack*s,void* data, size_t* len1,uintptr_t*role)
  {
    auto text = (LPSTR)s->stack[1]; // arg1 is text
    if (!text || ::strlen(text) <= 2 )
      return false;
    *role=Engine::OtherRole;
    std::string oldData =text;
    strcpy((char*)data,oldData.c_str());*len1=oldData.size();
    return true; 
  }
  void hookafter(hook_stack*s,void* data, size_t len1){
     auto text = (LPSTR)s->stack[1]; // arg1 is text
     
    enum { role = Engine::OtherRole };std::string oldData = text ;
    auto split = s->stack[0]; 
       auto newData =std::string((char*)data,len1); 
    size_t capacity =  countZero(text + oldData.size());
    if (!capacity)
      return  ;
    capacity += oldData.size() - 1;
    if (newData.size() > capacity)
      newData = newData.substr(0,capacity);
   if (newData.size() < oldData.size())
     ::memset(text + newData.size(), 0, oldData.size() - newData.size());
    ::strcpy(text, newData.c_str()); 
    return  ;
  }
bool attach11(ULONG startAddress, ULONG stopAddress) // attach scenario
{
  //这个的对话都是一个个字的，但是名字是连续的。
  const uint8_t bytes[] = {
    0x83,0xec, 0x14,                // 00461ca0   83ec 14          sub esp,0x14
    0x33,0xd2,                      // 00461ca3   33d2             xor edx,edx
    0x55,                           // 00461ca5   55               push ebp
    0x56,                           // 00461ca6   56               push esi
    0x8b,0x74,0x24, 0x20,           // 00461ca7   8b7424 20        mov esi,dword ptr ss:[esp+0x20]
    0x8b,0xe9,                      // 00461cab   8be9             mov ebp,ecx
    0x3b,0xf2,                      // 00461cad   3bf2             cmp esi,edx
    0x0f,0x84, 0x55,0x02,0x00,0x00, // 00461caf   0f84 55020000    je .00461f0a
    0x39,0x55, 0x08,                // 00461cb5   3955 08          cmp dword ptr ss:[ebp+0x8],edx
    0x0f,0x84, 0x4c,0x02,0x00,0x00, // 00461cb8   0f84 4c020000    je .00461f0a
    0x8b,0x85, 0x74,0x20,0x00,0x00  // 00461cbe   8b85 74200000    mov eax,dword ptr ss:[ebp+0x2074]
  };
  ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
  if(addr==0)return false;
  HookParam hp;
  hp.address=addr;
  hp.offset=get_stack(1); 
  hp.type=EMBED_ABLE|EMBED_DYNA_SJIS; 
  hp.hook_after=hookafter; 
  hp.hook_before=hookBefore;
  hp.hook_font=F_GetGlyphOutlineA|F_GetTextExtentPoint32A;
  return NewHook(hp,"Embedlucifen2");
  
}
}
bool Lucifen::attach_function() {
    bool b1=ScenarioHook::attach(processStartAddress,processStopAddress)||  attach_navel(processStartAddress,processStopAddress);
    if(b1){
      ChoiceHook::attach(processStartAddress,processStopAddress);
      attach11(processStartAddress,processStopAddress);
    }
    
    bool succ=InsertLucifenHook();
    succ|=hook();
    return succ;
}