Update Cotopha.cpp

This commit is contained in:
恍兮惚兮 2024-04-19 17:42:57 +08:00
parent 146dbe19f2
commit 5bb1f09a2c

View File

@ -632,17 +632,13 @@ bool InsertCotophaHook1()
{ {
enum : DWORD { ins = 0xec8b55 }; // mov ebp,esp, sub esp,* ; jichi 7/12/2014 enum : DWORD { ins = 0xec8b55 }; // mov ebp,esp, sub esp,* ; jichi 7/12/2014
ULONG addr = MemDbg::findCallerAddress((ULONG)::GetTextMetricsA, ins, processStartAddress, processStopAddress); ULONG addr = MemDbg::findCallerAddress((ULONG)::GetTextMetricsA, ins, processStartAddress, processStopAddress);
if (!addr) { if (!addr)return false;
ConsoleOutput("Cotopha: pattern not exist");
return false;
}
HookParam hp; HookParam hp;
hp.address = addr; hp.address = addr;
hp.offset=get_stack(1); hp.offset=get_stack(1);
hp.split = get_reg(regs::ebp); hp.split = get_reg(regs::ebp);
hp.type = CODEC_UTF16|USING_SPLIT|USING_STRING|EMBED_ABLE|EMBED_AFTER_NEW; hp.type = CODEC_UTF16|USING_SPLIT|USING_STRING|EMBED_ABLE|EMBED_AFTER_NEW;
hp.hook_before=ScenarioHook::Private::hookBefore; hp.hook_before=ScenarioHook::Private::hookBefore;
hp.filter_fun = CotophaFilter;
ConsoleOutput("INSERT Cotopha"); ConsoleOutput("INSERT Cotopha");
//RegisterEngineType(ENGINE_COTOPHA); //RegisterEngineType(ENGINE_COTOPHA);
@ -657,14 +653,7 @@ bool InsertCotophaHook2()
hp.address = (uintptr_t)addr; hp.address = (uintptr_t)addr;
hp.offset=get_stack(2); hp.offset=get_stack(2);
hp.type = CODEC_UTF16 | USING_STRING; hp.type = CODEC_UTF16 | USING_STRING;
hp.filter_fun = [](void* data, size_t* len, HookParam*) hp.filter_fun = CotophaFilter;
{
if(*len > VNR_TEXT_CAPACITY*2)return false;
return std::wstring_view((wchar_t*)data, *len / sizeof(wchar_t)).find(L'\\') != std::wstring_view::npos;
};
ConsoleOutput("INSERT Cotopha 2");
return NewHook(hp, "Cotopha2"); return NewHook(hp, "Cotopha2");
} }
return false; return false;
@ -673,10 +662,7 @@ bool InsertCotophaHook3() {
const BYTE bytes[] = { 0x8B,0x75,0xB8,0x8B,0xCE,0x50,0xC6,0x45,0xFC,0x01,0xE8 }; const BYTE bytes[] = { 0x8B,0x75,0xB8,0x8B,0xCE,0x50,0xC6,0x45,0xFC,0x01,0xE8 };
ULONG range = min(processStopAddress - processStartAddress, MAX_REL_ADDR); ULONG range = min(processStopAddress - processStartAddress, MAX_REL_ADDR);
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStartAddress + range); ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStartAddress + range);
if (!addr) { if (!addr)return false;
ConsoleOutput("Cotopha3: Cotopha3 not found");
return false;
}
HookParam myhp; HookParam myhp;
myhp.address = addr; myhp.address = addr;
@ -708,10 +694,7 @@ bool InsertCotophaHook4()
ULONG range = min(processStopAddress - processStartAddress, MAX_REL_ADDR); ULONG range = min(processStopAddress - processStartAddress, MAX_REL_ADDR);
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStartAddress + range); ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStartAddress + range);
if (!addr) { if (!addr)return false;
ConsoleOutput("Cotopha4: pattern not found");
return false;
}
HookParam hp = {}; HookParam hp = {};
hp.address = addr + 1; hp.address = addr + 1;
@ -723,8 +706,8 @@ bool InsertCotophaHook4()
} }
bool InsertCotophaHook() bool InsertCotophaHook()
{ {
InsertCotophaHook1(); auto _old=InsertCotophaHook1();
return (InsertCotophaHook4()|InsertCotophaHook3()) || InsertCotophaHook2(); return (InsertCotophaHook4()|InsertCotophaHook3()) || InsertCotophaHook2()||_old;
} }
bool Cotopha::attach_function() { bool Cotopha::attach_function() {