2024-11-02 15:49:09 +08:00
|
|
|
#include "ACTGS.h"
|
2024-02-07 20:59:24 +08:00
|
|
|
|
2024-11-02 15:49:09 +08:00
|
|
|
bool ACTGS::attach_function()
|
|
|
|
|
{
|
|
|
|
|
const BYTE bytes[] = {
|
|
|
|
|
0x0F, 0xBE, 0xD0,
|
|
|
|
|
0x83, 0xFA, 0x20,
|
|
|
|
|
0x74, XX,
|
|
|
|
|
0x83, 0xfa, 0x09,
|
|
|
|
|
0x75, XX
|
|
|
|
|
|
|
|
|
|
};
|
2024-02-07 20:59:24 +08:00
|
|
|
ULONG range = min(processStopAddress - processStartAddress, MAX_REL_ADDR);
|
|
|
|
|
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStartAddress + range);
|
2024-11-02 15:49:09 +08:00
|
|
|
if (!addr)
|
|
|
|
|
return false;
|
|
|
|
|
|
2024-02-07 20:59:24 +08:00
|
|
|
addr = findfuncstart(addr);
|
2024-11-02 15:49:09 +08:00
|
|
|
if (!addr)
|
|
|
|
|
return false;
|
2024-02-07 20:59:24 +08:00
|
|
|
HookParam hp;
|
|
|
|
|
hp.address = addr;
|
2024-11-02 15:49:09 +08:00
|
|
|
hp.offset = get_stack(2);
|
|
|
|
|
hp.type = USING_STRING;
|
2024-02-07 20:59:24 +08:00
|
|
|
hp.filter_fun = all_ascii_Filter;
|
2024-11-02 15:49:09 +08:00
|
|
|
|
2024-02-07 20:59:24 +08:00
|
|
|
return NewHook(hp, "ACTGS");
|
2024-11-02 15:49:09 +08:00
|
|
|
}
|
