#include"WillPlus.h"
#include"embed_util.h"
#include"dyncodec/dynsjis.h"
/** 1/18/2015 jichi Add new WillPlus
 *  The old hook no longer works for new game.
 *  Sample game: [150129] [honeybee] RE:BIRTHDAY SONG
 *
 *  Note, WillPlus engine is migrating to UTF16 using GetGlyphOutlineW such as:
 *      [141218] [Guily] 手�めにされる九人の堕女
 *  This engine does not work for GetGlyphOutlineW, which, however, does not need a H-code.
 *
 *  See: http://sakuradite.com/topic/615
 *
 *  There WillPlus games have many hookable threads.
 *  But it is kind of important to find the best one.
 *
 *  By inserting hw point:
 *  - There is a clean text thread with fixed memory address.
 *    However, it cannot extract character name like GetGlyphOutlineA.
 *  - This is a non-clean text thread, but it contains garbage such as %LC.
 *
 *  By backtracking from GetGlyphOutlineA:
 *  - GetGlyphOutlineA sometimes can extract all text, sometimes not.
 *  - There are two GetGlyphOutlineA functions.
 *    Both of them are called statically in the same function.
 *    That function is hooked.
 *
 *  Hooked function:
 *  0041820c   cc               int3
 *  0041820d   cc               int3
 *  0041820e   cc               int3
 *  0041820f   cc               int3
 *  00418210   81ec b4000000    sub esp,0xb4
 *  00418216   8b8424 c4000000  mov eax,dword ptr ss:[esp+0xc4]
 *  0041821d   53               push ebx
 *  0041821e   8b9c24 d0000000  mov ebx,dword ptr ss:[esp+0xd0]
 *  00418225   55               push ebp
 *  00418226   33ed             xor ebp,ebp
 *  00418228   56               push esi
 *  00418229   8bb424 dc000000  mov esi,dword ptr ss:[esp+0xdc]
 *  00418230   03c3             add eax,ebx
 *  00418232   57               push edi
 *  00418233   8bbc24 d8000000  mov edi,dword ptr ss:[esp+0xd8]
 *  0041823a   896c24 14        mov dword ptr ss:[esp+0x14],ebp
 *  0041823e   894424 4c        mov dword ptr ss:[esp+0x4c],eax
 *  00418242   896c24 24        mov dword ptr ss:[esp+0x24],ebp
 *  00418246   39ac24 e8000000  cmp dword ptr ss:[esp+0xe8],ebp
 *  0041824d   75 29            jnz short .00418278
 *  0041824f   c74424 24 010000>mov dword ptr ss:[esp+0x24],0x1
 *
 *  ...
 *
 *  00418400   56               push esi
 *  00418401   52               push edx
 *  00418402   ff15 64c04b00    call dword ptr ds:[0x4bc064]             ; gdi32.getglyphoutlinea
 *  00418408   8bf8             mov edi,eax
 *
 *  The old WillPlus engine can also be inserted to the new games.
 *  But it has no effects.
 *
 *  A split value is used to get saving message out.
 *
 *  Runtime stack for the scenario thread:
 *  0012d9ec   00417371  return to .00417371 from .00418210
 *  0012d9f0   00000003  1
 *  0012d9f4   00000000  2
 *  0012d9f8   00000130  3
 *  0012d9fc   0000001a  4
 *  0012da00   0000000b  5
 *  0012da04   00000016  6
 *  0012da08   0092fc00  .0092fc00 ms gothic ; jichi: here's font
 *  0012da0c   00500aa0  .00500aa0 shun ; jichi: text is here in arg8
 *  0012da10   0217dcc0
 *
 *  Runtime stack for name:
 *  0012d9ec   00417371  return to .00417371 from .00418210
 *  0012d9f0   00000003
 *  0012d9f4   00000000
 *  0012d9f8   00000130
 *  0012d9fc   0000001a
 *  0012da00   0000000b
 *  0012da04   00000016
 *  0012da08   0092fc00  .0092fc00
 *  0012da0c   00500aa0  .00500aa0
 *  0012da10   0217dcc0
 *  0012da14   00000000
 *  0012da18   00000000
 *
 *  Runtime stack for non-dialog scenario text.
 *  0012e5bc   00438c1b  return to .00438c1b from .00418210
 *  0012e5c0   00000006
 *  0012e5c4   00000000
 *  0012e5c8   000001ae
 *  0012e5cc   000000c8
 *  0012e5d0   0000000c
 *  0012e5d4   00000018
 *  0012e5d8   0092fc00  .0092fc00
 *  0012e5dc   0012e628
 *  0012e5e0   0b0d0020
 *  0012e5e4   004fda98  .004fda98
 *
 *  Runtime stack for saving message
 *  0012ed44   00426003  return to .00426003 from .00418210
 *  0012ed48   000003c7
 *  0012ed4c   00000000
 *  0012ed50   000000d8
 *  0012ed54   0000012f
 *  0012ed58   00000008
 *  0012ed5c   00000010
 *  0012ed60   0092fc00  .0092fc00
 *  0012ed64   00951d88  ascii "2015/01/18"
 */

namespace { // unnamed


void SpecialHookWillPlus(hook_stack* stack,  HookParam *hp, uintptr_t *data, uintptr_t *split, size_t*len)
{
  //static DWORD detect_offset; // jichi 1/18/2015: this makes sure it only runs once
  //if (detect_offset)
  //  return;
  DWORD i,l;
  union {
    DWORD retn;
    WORD *pw;
    BYTE *pb;
  };
  retn = stack->retaddr; // jichi 1/18/2015: dynamically find function return address
  i = 0;
  while (*pw != 0xc483) { // add esp, $
    l = ::disasm(pb);
    if (++i == 5)
      //ConsoleOutput("Fail to detect offset.");
      break;
    retn += l;
  }
  // jichi 2/11/2015: Check baddaddr which might crash the game on Windows XP.
  if (*pw == 0xc483 && !::IsBadReadPtr((LPCVOID)(pb + 2), 1) && !::IsBadReadPtr((LPCVOID)(*(pb + 2) - 8), 1)) {
    ConsoleOutput("WillPlus1 pattern found");
    // jichi 1/18/2015:
    // By studying [honeybee] RE:BIRTHDAY SONG, it seems the scenario text is at fixed address
    // This offset might be used to find fixed address
    // However, this method cannot extract character name like GetGlyphOutlineA
    hp->offset = *(pb + 2) - 8;

    // Still extract the first text
    //hp->type ^= EXTERN_HOOK;
    char *str = *(char **)(stack->base + hp->offset);
    *data = (DWORD)str;
    *len = ::strlen(str);
    *split = 0; // 8/3/2014 jichi: use return address as split

  } else { // jichi 1/19/2015: Try willplus2
    ConsoleOutput("WillPlus1 pattern not found, try WillPlus2 instead");
    hp->offset = 4 * 8; // arg8, address of text
    hp->type = USING_STRING|NO_CONTEXT|USING_SPLIT; // merge different scenario threads
    hp->split = 4 * 1; // arg1 as split to get rid of saving message
    // The first text is skipped here
    //char *str = *(char **)(esp_base + hp->offset);
    //*data = (DWORD)str;
    //*len = ::strlen(str);
  }
  hp->text_fun = nullptr; // stop using text_fun any more
  //detect_offset = 1;
}

// Although the new hook also works for the old game, the old hook is still used by default for compatibility
bool InsertOldWillPlusHook()
{
  //__debugbreak();
  enum { sub_esp = 0xec81 }; // jichi: caller pattern: sub esp = 0x81,0xec byte
  ULONG addr = MemDbg::findCallerAddress((ULONG)::GetGlyphOutlineA, sub_esp, processStartAddress, processStopAddress);
  if (!addr) {
    ConsoleOutput("WillPlus: function call not found");
    return false;
  }

  HookParam hp;
  hp.address = addr;
  hp.text_fun = SpecialHookWillPlus;
  hp.type = USING_STRING;
  ConsoleOutput("INSERT WillPlus");
  return NewHook(hp, "WillPlus");
}

const char *_willplus_trim_a(const char *text, size_t *size)
{
  int textSize = ::strlen(text);
  int prefix = 0;
  if (text[0] == '%') {
    while (prefix < textSize - 1 && text[prefix] == '%' && ::isupper(text[prefix+1])) {
      prefix += 2;
      while (::isupper(text[prefix]))
        prefix++;
    }
  }
  {
    int pos = textSize;
    for (int i = textSize - 1; i >= prefix; i--) {
      char ch = text[i];
      if (::isupper(ch))
        ;
      else if (ch == '%')
        pos = i;
      else
        break;
    }
    int suffix = textSize - pos;
    if (size)
      *size = textSize - prefix - suffix;
  }
  return text + prefix;
}

const wchar_t *_willplus_trim_w(const wchar_t *text, size_t *size)
{
  int textSize = ::wcslen(text);
  int prefix = 0;
  if (text[0] == '%') {
    while (prefix < textSize - 1 && text[prefix] == '%' && ::isupper(text[prefix+1])) {
      prefix += 2;
      while (::isupper(text[prefix]))
        prefix++;
    }
  }
  {
    int pos = textSize;
    for (int i = textSize - 1; i >= prefix; i--) {
      wchar_t ch = text[i];
      if (::isupper(ch))
        ;
      else if (ch == '%')
        pos = i;
      else
        break;
    }
    int suffix = textSize - pos;
    if (size)
      *size = textSize - prefix - suffix;
  }
  return text + prefix;
}

void SpecialHookWillPlusA(hook_stack* stack,  HookParam *hp, uintptr_t *data, uintptr_t *split, size_t*len)
{
  int index=0;
  auto text = (LPCSTR)stack->eax;
  if (!text)
    return;
  if (index) // index == 1 is name
    text -= 1024;
  if (!*text)
    return;
  text = _willplus_trim_a(text, (size_t *)len);
  *data = (DWORD)text;
  *split = FIXED_SPLIT_VALUE << index;
}
bool WillPlus_extra_filter(void* data, size_t* size, HookParam*) {

  auto text = reinterpret_cast<LPWSTR>(data);
  StringFilter(text, size, L"%XS", 5); // remove %XS followed by 2 chars
  std::wstring str = text;
  str = str.substr(0,  *size /2); 
  strReplace(str, L"\\n", L"\n");  
  std::wregex reg1(L"\\{(.*?):(.*?)\\}");
  std::wstring result1 = std::regex_replace(str, reg1, L"$1");

  std::wregex reg11(L"\\{(.*?);(.*?)\\}");
  result1 = std::regex_replace(result1, reg11, L"$1");

  std::wregex reg2(L"%[A-Z]+");
  result1 = std::regex_replace(result1, reg2, L"");

  write_string_overwrite(data,size,result1);
  return true;
};
bool InsertWillPlusAHook()
{
    //by iov
    const BYTE bytes2[] = { 0x8B,0x00,0xFF,0x76,0xFC,0x8B,0xCF,0x50 };
    ULONG range2 = min(processStopAddress - processStartAddress, MAX_REL_ADDR);
    ULONG addr2 = MemDbg::findBytes(bytes2, sizeof(bytes2), processStartAddress, processStartAddress + range2);
    if (addr2) {
        HookParam myhp;
        myhp.address = addr2 + 2;

        myhp.type = CODEC_UTF16 | NO_CONTEXT | USING_STRING; 
        
        myhp.offset=get_reg(regs::eax);
        myhp.filter_fun=WillPlus_extra_filter;
        char nameForUser[HOOK_NAME_SIZE] = "WillPlus3_memcpy";
        
        ConsoleOutput("Insert: WillPlus3_memcpy Hook");
        return NewHook(myhp, nameForUser);
    }	
	
  const BYTE bytes[] = {
    0x81,0xec, 0x14,0x08,0x00,0x00 // 0042B5E0   81EC 14080000    SUB ESP,0x814	; jichi: text in eax, name in eax - 1024, able to copy
  };
  DWORD addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);
  if (!addr) {
    ConsoleOutput("WillPlusA: pattern not found");
    return false;
  }
  HookParam hp;
  hp.address = addr;
  hp.text_fun = SpecialHookWillPlusA;
  hp.type = NO_CONTEXT;
  hp.filter_fun = NewLineStringFilterA; // remove two characters of "\\n"
  ConsoleOutput("INSERT WillPlusA");
  return NewHook(hp, "WillPlusA");
}

void SpecialHookWillPlusW(hook_stack* stack,  HookParam *hp, uintptr_t *data, uintptr_t *split, size_t*len)
{
  auto text = (LPCWSTR)stack->ecx;
  if (!text || !*text)
    return;
  text = _willplus_trim_w(text, (size_t *)len);
  *len *= 2;
  *data = (DWORD)text;
  *split = FIXED_SPLIT_VALUE << hp->user_value;
}

bool InsertWillPlusWHook()
{
  const BYTE bytes1[] = { // scenario
    0x83,0xc0, 0x20,     // 00452b02   83c0 20     add eax,0x20    ; jichi: hook before here, text in ecx
    0x33,0xd2,           // 00452b05   33d2        xor edx,edx
    0x8b,0xc1,           // 00452b07   8bc1        mov eax,ecx
    0xc7,0x84,0x24, 0xe0,0x01,0x00,0x00, 0x07,0x00,0x00,0x00  // 00452b09   c78424 e0010000 07000000      mov dword ptr ss:[esp+0x1e0],0x7
                                                              // 00452b14   c78424 dc010000 00000000      mov dword ptr ss:[esp+0x1dc],0x0
  };
  const BYTE bytes2[] = { // name
    0x33,0xdb,   // 00453521   33db                            xor ebx,ebx  ; jichi: hook here, text in ecx
    0x33,0xd2,   // 00453523   33d2                            xor edx,edx
    0x8b,0xc1,   // 00453525   8bc1                            mov eax,ecx
    0xc7,0x84,0x24, 0x88,0x00,0x00,0x00, 0x07,0x00,0x00,0x00 // 00453527   c78424 88000000 07000000        mov dword ptr ss:[esp+0x88],0x7
                                                             // 00453532   899c24 84000000                 mov dword ptr ss:[esp+0x84],ebx
  };
  const BYTE *bytes[] = {bytes1, bytes2};
  const size_t sizes[] = {sizeof(bytes1), sizeof(bytes2)};
  auto succ=false;
  for (int i = 0; i < 2; i++) {
    DWORD addr = MemDbg::findBytes(bytes[i], sizes[i], processStartAddress, processStopAddress);
    if (!addr) {
      ConsoleOutput("WillPlusW: pattern not found");
      return false;
    }
    HookParam hp;
    hp.address = addr;
    hp.text_fun = SpecialHookWillPlusW;
    hp.type = NO_CONTEXT|CODEC_UTF16;
    hp.user_value = i;
    hp.filter_fun = NewLineStringFilterW; // remove two characters of "\\n"
    ConsoleOutput("INSERT WillPlusW");
    succ|=NewHook(hp, "WillPlusW");
  }
  return succ;
}
/*
	Artikash 9/29/2018: Updated WillPlus hook
	Sample games: https://vndb.org/r54549 https://vndb.org/v22705
	Not too sure about the stability of this pattern, but it works for both of the above
	Hook code for first game: /HQ-8*0@43D620. This seems fairly stable: __thiscall calling convention and first member points to string
	Method to find hook code: trace call stack from GetGlyphOutlineW
	Disassembly from first game (damekoi). The first few instructions are actually a common function prologue: not enough to locate hook
	Hooking SysAllocString also seems to work, but has some garbage
	0043D61D - C2 0800               - ret 0008 { 8 }
	0043D620 - 55                    - push ebp
	0043D621 - 8B EC                 - mov ebp,esp
	0043D623 - 6A FF                 - push -01 { 255 }
	0043D625 - 68 6B6D5400           - push 00546D6B { [139] }
	0043D62A - 64 A1 00000000        - mov eax,fs:[00000000] { 0 }
	0043D630 - 50                    - push eax
	0043D631 - 81 EC 30010000        - sub esp,00000130 { 304 }
	0043D637 - A1 08E05800           - mov eax,[0058E008] { [6A9138CD] }
	0043D63C - 33 C5                 - xor eax,ebp
	0043D63E - 89 45 EC              - mov [ebp-14],eax
	0043D641 - 53                    - push ebx
	0043D642 - 56                    - push esi
	0043D643 - 57                    - push edi
	0043D644 - 50                    - push eax
	0043D645 - 8D 45 F4              - lea eax,[ebp-0C]
	0043D648 - 64 A3 00000000        - mov fs:[00000000],eax { 0 }
	0043D64E - 8B F9                 - mov edi,ecx
	0043D650 - 89 BD E8FEFFFF        - mov [ebp-00000118],edi
	0043D656 - 8B 45 08              - mov eax,[ebp+08]
	0043D659 - 8B 4D 14              - mov ecx,[ebp+14]
	0043D65C - F3 0F10 45 1C         - movss xmm0,[ebp+1C]
	0043D661 - 8B 5D 18              - mov ebx,[ebp+18]
	0043D664 - 89 85 10FFFFFF        - mov [ebp-000000F0],eax
	0043D66A - 8B 45 10              - mov eax,[ebp+10]
	0043D66D - 89 85 08FFFFFF        - mov [ebp-000000F8],eax
	0043D673 - 89 47 68              - mov [edi+68],eax
	0043D676 - 8B 45 20              - mov eax,[ebp+20]
	0043D679 - 51                    - push ecx
	...
*/
static bool InsertNewWillPlusHook()
{
	bool found = false;
	const BYTE characteristicInstructions[] = 
	{ 
		0xc2, 0x08, 0, // ret 0008; Seems to always be ret 8 before the hookable function. not sure why, not sure if stable.
		0x55, // push ebp; hook here
		0x8b, 0xec, // mov ebp,esp
		0x6a, 0xff, // push -01
		0x68, XX4, // push ?
		0x64, 0xa1, 0, 0, 0, 0, // mov eax,fs:[0]
		0x50, // push eax
		0x81, 0xec, XX4, // sub esp,?
		0xa1, XX4, // mov eax,[?]
		0x33, 0xc5, // xor eax,ebp
		//0x89, 0x45, 0xec // mov [ebp-14],eax; not sure if 0x14 is stable
	};
	for (auto addr : Util::SearchMemory(characteristicInstructions, sizeof(characteristicInstructions), PAGE_EXECUTE, processStartAddress, processStopAddress))
	{ 
		HookParam hp;
		hp.address = addr + 3;
		hp.type = USING_STRING | CODEC_UTF16 | DATA_INDIRECT;
		hp.offset=get_reg(regs::ecx);
		hp.index = 0;
		found|=NewHook(hp, "WillPlus2");
	}
    /*
    hook cmp reg,0x3000
    Sample games:
    https://vndb.org/r54549
    https://vndb.org/v22705
    https://vndb.org/v24852
    https://vndb.org/v25719
    https://vndb.org/v27227
    https://vndb.org/v27385
    https://vndb.org/v34544
    https://vndb.org/v35279
    https://vndb.org/v36011
    */
    const BYTE pattern[] =
    {
        0x81,XX, 0x00,0x30,0x00,0x00    //    81FE 00300000  cmp esi,0x3000
                                        // or 81FB 00300000  cmp ebx,0x3000
                                        // or 81FF 00300000  cmp edi,0x3000
                                        //                   je xx
                                        //    8b4D A8        mov ecx,dword ptr ss:[ebp-??] hook here
                                        //    85C9           test ecx,ecx
    };
    for (auto addr : Util::SearchMemory(pattern, sizeof(pattern), PAGE_EXECUTE, processStartAddress, processStopAddress))
    {
        if (*(WORD*)(addr + 0xb) != 0xC985)
            continue;

        BYTE byte = *(BYTE*)(addr + 1);
        regs offset = regs::invalid;
        switch (byte) {
        case 0xf9:
            offset = regs::ecx;
            break;
        case 0xfa:
            offset = regs::edx;
            break;
        case 0xfb:
            offset = regs::ebx;
            break;
        case 0xfc:
            offset = regs::esp;
            break;
        case 0xfd:
            offset = regs::ebp;
            break;
        case 0xfe:
            offset = regs::esi;
            break;
        case 0xff:
            offset = regs::edi;
            break;
        };
        if (offset!=regs::invalid) {
            HookParam hp;
            hp.address = addr + 8;
            hp.type = CODEC_UTF16;
            hp.offset=get_reg(offset);
            found|=NewHook(hp, "WillPlus3");
        }
    }
    if (!found) ConsoleOutput("WillPlus: failed to find instructions");
    return found;
}

} // unnamed namespace
  
bool InsertWillPlusHook()
{
    bool ok = InsertOldWillPlusHook();
    ok = InsertWillPlusWHook() || InsertNewWillPlusHook() || InsertWillPlusAHook() ||ok;
    return ok;
}
namespace will3{
  
int kp = 0;int lf=0;int lc=0;
bool hookBefore(hook_stack*s,void* data, size_t* len,uintptr_t*role)
{  
    // DOUT(QString::fromUtf16((LPWSTR)s->stack[6]));//"MS UI Gothic"
    //DOUT(QString::fromUtf16((LPWSTR)s->stack[7]));//"���������ˤˤʤꤿ����%K%P"
      auto text = (LPWSTR)s->stack[7]; // text in arg1
      
      if (!text || !*text)
          return false;
      auto split = s->stack[0]; // retaddr
      
      std::wstring str =((LPWSTR)s->stack[7] );
      kp=0;lf=0;
      if (endWith(str,L"%K%P")){
          kp = 1;
          
          str = str.substr(0, str.size() - 4);
      }
        if(startWith(str,L"%LF")){
          lf=1;
          str=str.substr(3);
        }
      if(startWith(str,L"%LC")){
          lc=1;
          str=str.substr(3);
        }
      std::wregex reg1(L"\\{(.*?):(.*?)\\}");
      str = std::regex_replace(str, reg1, L"$1");

      std::wregex reg11(L"\\{(.*?);(.*?)\\}");
      str = std::regex_replace(str, reg11, L"$1");

      write_string_overwrite(data,len,str);
      
      return true;
      
}
void hookafter(hook_stack*s,void* data, size_t len){
        auto data_ =std::wstring((wchar_t*)data,len/2);// EngineController::instance()->dispatchTextWSTD(innner, Engine::ScenarioRole, 0); 
      if (kp) {
          data_.append(L"%K%P");
      } 
      if(lf){
        data_=L"%LF"+data_;
      }if(lc){
        data_=L"%LC"+data_;
      }
      s->stack[7] = (ULONG)(data_.c_str());
}
}
bool InsertWillPlus4Hook() {
  //星の乙女と六華の姉妹
  const BYTE bytes[] = {
        0xc7,0x45,0xfc,0x00,0x00,0x00,0x00,
        0x33,0xc9,
        0xc7,0x47,0x78,0x00,0x00,0x00,0x00
  }; 
  ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);

  if (addr == 0)return false;

  addr = MemDbg::findEnclosingFunctionBeforeDword(0x83dc8b53, addr, MemDbg::MaximumFunctionSize, 1);

  if (addr == 0)return false;
  HookParam hp;
  hp.address = addr;
  hp.offset =get_stack(7);
  //hp.filter_fun = WillPlus_extra_filter;
  hp.type = USING_STRING|CODEC_UTF16|EMBED_ABLE;
  hp.hook_before=will3::hookBefore;
  hp.newlineseperator=L"\\n";
  hp.hook_after=will3::hookafter;
  return NewHook(hp, "EmbedWillplus3");
}
bool InsertWillPlus5Hook() { 
  //ensemble 29th Project『乙女の剣と秘めごとコンチェルト』オフィシャルサイト 体验版

  const BYTE bytes[] = {
    0x3d,XX2,0x00,0x00,
    0x72,XX,
    0x3d,XX2,0x00,0x00,
    0x77
  };
    /*if (v26 >= 0xE63E)
      {
        if (v26 <= 0xE757)*/
      /*3D 3E E6 00 00                cmp     eax, 0E63Eh
.text:0040A24B 72 6C                         jb      short loc_40A2B9
.text : 0040A24B
.text : 0040A24D 3D 57 E7 00 00                cmp     eax, 0E757h
.text : 0040A252 77 71                         ja      short loc_40A2C5*/
  
  bool ok=false;
  auto addrs= Util::SearchMemory(bytes, sizeof(bytes), PAGE_EXECUTE, processStartAddress, processStopAddress);
  for (auto addr : addrs) { 
    HookParam hp;
    hp.address = addr;
    hp.offset=get_reg(regs::eax);
    hp.type =   CODEC_UTF16;
    ConsoleOutput("INSERT WillPlus_extra2");
    ok|=NewHook(hp, "WillPlus_extra2");
  } 
  return  ok;
}
bool insertwillplus6(){

/*  0x00492870
0:  50                      push   eax
1:  b8 01 00 00 00          mov    eax,0x1
6:  8d 74 24 18             lea    esi,[esp+0x18]
a:  e8 f1 f5 f6 ff          call   0xfff6f600
f:  6a 01                   push   0x1
11: 68 7c 47 55 00          push   0x55477c
16: 33 c0                   xor    eax,eax
18: 8b d6                   mov    edx,esi
1a: e8 21 8c f7 ff          call   0xfff78c40
//hook after call,但有的句子没有
1f: 83 f8 ff                cmp    eax,0xffffffff
22: 75 dc                   jne    0x0
//这里
24: 8d 44 24 14             lea    eax,[esp+0x14]
28: 8b cd                   mov    ecx,ebp
2a: e8 81 f3 04 00          call   0x4f3b0
2f: 83 7c 24 2c 08          cmp    DWORD PTR [esp+0x2c],0x8
34: 8b f0                   mov    esi,eax
36: 72 0d                   jb     0x45
38: 8b 44 24 18             mov    eax,DWORD PTR [esp+0x18]
3c: 50                      push   eax
3d: e8 5e d6 09 00          call   0x9d6a0
42: 83 c4 04                add    esp,0x4
45: 33 c9                   xor    ecx,ecx
47: c7 44 24 2c 07 00 00    mov    DWORD PTR [esp+0x2c],0x7
*/
//想いを捧げる乙女のメロディー
  const BYTE bytes[] = {
    0x6a,0x01,
    0x68,0x7c,0x47,0x55,0x00,
    0x33,0xc0,
    0x8b,0xd6,
    0xe8,XX4,
    0x83,0xf8,
    0xff,0x75,0xdc
  };
  auto addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);
    
  if(addr==0)return false;
  addr+=sizeof(bytes);
  ConsoleOutput("%p %p %p",addr,processStartAddress, processStopAddress);
  HookParam hp;
  hp.address = addr; 
  hp.offset = get_stack(6);
  hp.type =   CODEC_UTF16|USING_STRING;
  ConsoleOutput("INSERT WillPlus6");
  return NewHook(hp, "WillPlus6");
}
bool willX(){
//世界でいちばんNGな恋
// .text:0040EAE9 81 FE 94 81 00 00             cmp     esi, 8194h
// .text:0040EAEF 74 2C                         jz      short loc_40EB1D
// .text:0040EAEF
// .text:0040EAF1 81 FE 74 84 00 00             cmp     esi, 8474h
// .text:0040EAF7 74 24                         jz      short loc_40EB1D
// .text:0040EAF7
// .text:0040EAF9 81 FE 97 81 00 00             cmp     esi, 8197h
// .text:0040EAFF 74 1C                         jz      short loc_40EB1D
// .text:0040EAFF
// .text:0040EB01 81 FE 90 81 00 00             cmp     esi, 8190h
// .text:0040EB07 74 14                         jz      short loc_40EB1D
// .text:0040EB07
// .text:0040EB09 81 FE 59 81 00 00             cmp     esi, 8159h
// .text:0040EB0F 74 0C                         jz      short loc_40EB1D
// .text:0040EB0F
// .text:0040EB11 81 FE 96 81 00 00             cmp     esi, 8196h
// .text:0040EB17 0F 85 FF 00 00 00             jnz     loc_40EC1C
  const BYTE bytes[] = {
    0x81,0xFE,0x94,0x81,0x00,0x00,
    0x74,XX,
    0x81,0xFE,0x74,0x84,0x00,0x00,
    0x74,XX,
    0x81,0xFE,0x97,0x81,0x00,0x00,
    0x74,XX,
    0x81,0xFE,0x90,0x81,0x00,0x00,
    0x74,XX,
    0x81,0xFE,0x59,0x81,0x00,0x00,
    0x74,XX,
    0x81,0xFE,0x96,0x81,0x00,0x00
  };
  auto addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);
    
  if(addr==0)return false; 
  auto succ=false;
  {
    HookParam hp;
    hp.address = addr; 
    hp.offset=get_reg(regs::esi);
    hp.type =NO_CONTEXT|CODEC_ANSI_BE; 
    succ|=NewHook(hp, "willAN");
  }
  
  addr=MemDbg::findEnclosingAlignedFunction(addr);
  
  if(addr ) 
  {
    HookParam hp;
    hp.address = addr; 
    hp.offset =get_stack(7);
    hp.type =USING_STRING; 
    succ|=NewHook(hp, "willS");
  }
  return succ;
}






namespace { // unnamed

// Sample prefix: %LF
// Sample suffix: %L%P%W
template <typename strT>
strT trim(strT text, int *size)
{
  int length = *size;
  if (text[0] == '%') { // handle prefix
    int pos = 0;
    while (pos < length - 1 && text[pos] == '%' && ::isupper(text[pos+1])) {
      pos += 2;
      while (::isupper(text[pos]))
        pos++;
    }
    if (pos) {
      length -= pos;
      text += pos;
    }
  }
  { // handle suffix
    int pos = length;
    for (int i = length - 1; i >= 0; i--) {
      if (::isupper(text[i]))
        ;
      else if (text[i] == '%' && ::isupper(text[i+1]))
        pos = i;
      else
        break;
    }
    length = pos;
  }
  *size = length;
  return text;
}
struct textinfo{
  std::wstring text_;
  int stackIndex_;
  int role_;
  };
std::unordered_map<int,textinfo*>savetyperef;
namespace TextHookW
{

 // typedef TextHookW Self;
  
  template<int idx>
  bool hookBefore(hook_stack*s,void* data, size_t* len,uintptr_t*role)
  {
    auto info=savetyperef.at(idx);
    enum { sig = 0 };
    auto text = (LPCWSTR)s->stack[info->stackIndex_];
    if (!text || !*text)
      return false;
    int size = ::wcslen(text),
        trimmedSize = size;
    auto trimmedText = trim(text, &trimmedSize);
    if (!trimmedSize || !*trimmedText)
      return false;
    std::wstring oldText = std::wstring(trimmedText, trimmedSize);
    write_string_overwrite(data,len,oldText);
    return true;
  }
  template<int idx>
  void hookafter(hook_stack*s,void* data, size_t len){ 
      auto newText =std::wstring((LPWSTR)data,len/2);
     auto info=savetyperef.at(idx);
    enum { sig = 0 };
    auto text = (LPCWSTR)s->stack[info->stackIndex_];
    if (!text || !*text)
      return ;
    int size = ::wcslen(text),
        trimmedSize = size;
    auto trimmedText = trim(text, &trimmedSize);
    if (!trimmedSize || !*trimmedText)
      return ;
    std::wstring oldText = std::wstring(trimmedText, trimmedSize);
    if (newText == oldText)
      return ;
    int prefixSize = trimmedText - text,
        suffixSize = size - prefixSize - trimmedSize;
    if (prefixSize)
      newText.insert(0, std::wstring(text, prefixSize));
    if (suffixSize)
      newText.append(std::wstring(trimmedText + trimmedSize, suffixSize));
    info->text_ = newText;
    s->stack[info->stackIndex_] = (ULONG)info->text_.c_str();
  }
 // explicit TextHookW(int hookStackIndex, int role = Engine::UnknownRole) : stackIndex_(hookStackIndex), role_(role) {}
  template< int _type>
  bool attach(const uint8_t *pattern, size_t patternSize, ULONG startAddress, ULONG stopAddress,int hookStackIndex, int role = Engine::UnknownRole)
  {
    ULONG addr = MemDbg::findBytes(pattern, patternSize, startAddress, stopAddress);
    if(addr==0)return false;
    HookParam hp;
    hp.address=addr;
    auto _tinfo=new textinfo{};
    _tinfo->role_=role;
    _tinfo->stackIndex_=hookStackIndex;
    savetyperef[_type]=_tinfo;
    hp.hook_before=hookBefore<_type>;
    hp.type=EMBED_ABLE|CODEC_UTF16;
    hp.newlineseperator=L"\\n";
    hp.hook_after=hookafter<_type>;
    hp.hook_font=F_MultiByteToWideChar|F_GetGlyphOutlineW;
    char _[]="EmbedWillplusW0";
    _[sizeof(_)-2]+=_type;
    return NewHook(hp,_);
  }
};

/**
 *  Sample game: なついろレシピ
 *  See: http://capita.tistory.com/m/post/251
 *
 *  Scenario:
 *  00452A8F   77 05            JA SHORT .00452A96
 *  00452A91   E8 A25B0B00      CALL .00508638                           ; JMP to msvcr90._invalid_parameter_noinfo
 *  00452A96   8B43 0C          MOV EAX,DWORD PTR DS:[EBX+0xC]
 *  00452A99   8B48 18          MOV ECX,DWORD PTR DS:[EAX+0x18]
 *  00452A9C   83C0 10          ADD EAX,0x10
 *  00452A9F   33D2             XOR EDX,EDX
 *  00452AA1   8BC1             MOV EAX,ECX
 *  00452AA3   C78424 C4010000 >MOV DWORD PTR SS:[ESP+0x1C4],0x7
 *  00452AAE   C78424 C0010000 >MOV DWORD PTR SS:[ESP+0x1C0],0x0
 *  00452AB9   66:899424 B00100>MOV WORD PTR SS:[ESP+0x1B0],DX
 *  00452AC1   8D70 02          LEA ESI,DWORD PTR DS:[EAX+0x2]
 *  00452AC4   66:8B10          MOV DX,WORD PTR DS:[EAX]
 *  00452AC7   83C0 02          ADD EAX,0x2
 *  00452ACA   66:85D2          TEST DX,DX
 *  00452ACD  ^75 F5            JNZ SHORT .00452AC4
 *  00452ACF   2BC6             SUB EAX,ESI
 *  00452AD1   D1F8             SAR EAX,1
 *  00452AD3   50               PUSH EAX
 *  00452AD4   51               PUSH ECX
 *  00452AD5   8DB424 B4010000  LEA ESI,DWORD PTR SS:[ESP+0x1B4]
 *  00452ADC   E8 DF4DFBFF      CALL .004078C0
 *  00452AE1   C68424 B8020000 >MOV BYTE PTR SS:[ESP+0x2B8],0x8
 *  00452AE9   8B43 10          MOV EAX,DWORD PTR DS:[EBX+0x10]
 *  00452AEC   2B43 0C          SUB EAX,DWORD PTR DS:[EBX+0xC]
 *  00452AEF   C1F8 04          SAR EAX,0x4
 *  00452AF2   83F8 02          CMP EAX,0x2
 *  00452AF5   77 05            JA SHORT .00452AFC
 *  00452AF7   E8 3C5B0B00      CALL .00508638                           ; JMP to msvcr90._invalid_parameter_noinfo
 *  00452AFC   8B43 0C          MOV EAX,DWORD PTR DS:[EBX+0xC]
 *  00452AFF   8B48 28          MOV ECX,DWORD PTR DS:[EAX+0x28]
 *  00452B02   83C0 20          ADD EAX,0x20    ; jichi: hook before here, text in ecx
 *  00452B05   33D2             XOR EDX,EDX
 *  00452B07   8BC1             MOV EAX,ECX
 *  00452B09   C78424 E0010000 07000000        MOV DWORD PTR SS:[ESP+0x1E0],0x7 ; jichi: key pattern is here, text in eax
 *  00452B14   C78424 DC010000 00000000        MOV DWORD PTR SS:[ESP+0x1DC],0x0
 *  00452B27   8D70 02          LEA ESI,DWORD PTR DS:[EAX+0x2]
 *  00452B2A   33DB             XOR EBX,EBX
 *  00452B2C   8D6424 00        LEA ESP,DWORD PTR SS:[ESP]
 *  00452B30   66:8B10          MOV DX,WORD PTR DS:[EAX]
 *  00452B33   83C0 02          ADD EAX,0x2
 *  00452B36   66:3BD3          CMP DX,BX
 *  00452B39  ^75 F5            JNZ SHORT .00452B30
 *  00452B3B   2BC6             SUB EAX,ESI
 *  00452B3D   D1F8             SAR EAX,1
 *  00452B3F   50               PUSH EAX
 *  00452B40   51               PUSH ECX
 *  00452B41   8DB424 D0010000  LEA ESI,DWORD PTR SS:[ESP+0x1D0]
 *  00452B48   E8 734DFBFF      CALL .004078C0
 *  00452B4D   C68424 B8020000 >MOV BYTE PTR SS:[ESP+0x2B8],0x9
 *  00452B55   895C24 1C        MOV DWORD PTR SS:[ESP+0x1C],EBX
 *  00452B59   395C24 14        CMP DWORD PTR SS:[ESP+0x14],EBX
 *  00452B5D   0F84 77080000    JE .004533DA
 *  00452B63   BE 07000000      MOV ESI,0x7
 *  00452B68   33C0             XOR EAX,EAX
 *  00452B6A   895C24 20        MOV DWORD PTR SS:[ESP+0x20],EBX
 *  00452B6E   89B424 FC010000  MOV DWORD PTR SS:[ESP+0x1FC],ESI
 *  00452B75   899C24 F8010000  MOV DWORD PTR SS:[ESP+0x1F8],EBX
 *  00452B7C   66:898424 E80100>MOV WORD PTR SS:[ESP+0x1E8],AX
 *  00452B84   8D4C24 3C        LEA ECX,DWORD PTR SS:[ESP+0x3C]
 *  00452B88   51               PUSH ECX
 *  00452B89   C68424 BC020000 >MOV BYTE PTR SS:[ESP+0x2BC],0xA
 *  00452B91   E8 7AACFCFF      CALL .0041D810
 *  00452B96   C68424 B8020000 >MOV BYTE PTR SS:[ESP+0x2B8],0xB
 *  00452B9E   399C24 C0010000  CMP DWORD PTR SS:[ESP+0x1C0],EBX
 *  00452BA5   0F84 BB020000    JE .00452E66
 *  00452BAB   81C7 14010000    ADD EDI,0x114
 */
bool attachScenarioHookW1(ULONG startAddress, ULONG stopAddress)
{
  // ECX PTR: 83 C0 20 33 D2 8B C1 C7 84 24 E0 01 00 00 07 00 00 00
  const uint8_t bytes[] = {
    0x83,0xc0, 0x20,     // 00452b02   83c0 20     add eax,0x20    ; jichi: hook before here, text in ecx
    0x33,0xd2,           // 00452b05   33d2        xor edx,edx
    0x8b,0xc1,           // 00452b07   8bc1        mov eax,ecx
    0xc7,0x84,0x24, 0xe0,0x01,0x00,0x00, 0x07,0x00,0x00,0x00  // 00452b09   c78424 e0010000 07000000      mov dword ptr ss:[esp+0x1e0],0x7
                                                              // 00452b14   c78424 dc010000 00000000      mov dword ptr ss:[esp+0x1dc],0x0
  };
  int ecx = get_reg(regs::ecx)/4;
 return TextHookW::attach<1>(bytes, sizeof(bytes), startAddress, stopAddress,ecx,Engine::ScenarioRole);
}

/**
 *  1/9/2016: 見上げてごらん、夜空の星を　体験版
 *
 *  0045580D   C68424 B8020000 08             MOV BYTE PTR SS:[ESP+0x2B8],0x8
 *  00455815   8B47 10                        MOV EAX,DWORD PTR DS:[EDI+0x10]
 *  00455818   2B47 0C                        SUB EAX,DWORD PTR DS:[EDI+0xC]
 *  0045581B   C1F8 04                        SAR EAX,0x4
 *  0045581E   83F8 02                        CMP EAX,0x2
 *  00455821   77 05                          JA SHORT .00455828
 *  00455823   E8 A0F70B00                    CALL .00514FC8                           ; JMP to msvcr90._invalid_parameter_noinfo
 *  00455828   8B7F 0C                        MOV EDI,DWORD PTR DS:[EDI+0xC]
 *  0045582B   83C7 20                        ADD EDI,0x20
 *  0045582E   8B7F 08                        MOV EDI,DWORD PTR DS:[EDI+0x8]
 *  00455831   33C9                           XOR ECX,ECX
 *  00455833   8BC7                           MOV EAX,EDI ; jichi: hook befoe here, text in eax assigned from edi
 *  00455835   C78424 E0010000 07000000       MOV DWORD PTR SS:[ESP+0x1E0],0x7 ; jichi: key pattern is here, text i eax
 *  00455840   899C24 DC010000                MOV DWORD PTR SS:[ESP+0x1DC],EBX
 *  00455847   66:898C24 CC010000             MOV WORD PTR SS:[ESP+0x1CC],CX
 *  0045584F   8D50 02                        LEA EDX,DWORD PTR DS:[EAX+0x2]
 *  00455852   66:8B08                        MOV CX,WORD PTR DS:[EAX]
 *  00455855   83C0 02                        ADD EAX,0x2
 *  00455858   66:3BCB                        CMP CX,BX
 *  0045585B  ^75 F5                          JNZ SHORT .00455852
 *  0045585D   2BC2                           SUB EAX,EDX
 *  0045585F   D1F8                           SAR EAX,1
 *  00455861   50                             PUSH EAX
 *  00455862   57                             PUSH EDI
 *  00455863   8DB424 D0010000                LEA ESI,DWORD PTR SS:[ESP+0x1D0]
 *  0045586A   E8 2120FBFF                    CALL .00407890
 *  0045586F   C68424 B8020000 09             MOV BYTE PTR SS:[ESP+0x2B8],0x9
 *  00455877   895C24 30                      MOV DWORD PTR SS:[ESP+0x30],EBX
 *  0045587B   395C24 18                      CMP DWORD PTR SS:[ESP+0x18],EBX
 *  0045587F   0F84 D1080000                  JE .00456156
 *  00455885   33D2                           XOR EDX,EDX
 *  00455887   895C24 24                      MOV DWORD PTR SS:[ESP+0x24],EBX
 *  0045588B   C78424 FC010000 07000000       MOV DWORD PTR SS:[ESP+0x1FC],0x7
 *  00455896   899C24 F8010000                MOV DWORD PTR SS:[ESP+0x1F8],EBX
 *  0045589D   66:899424 E8010000             MOV WORD PTR SS:[ESP+0x1E8],DX
 *  004558A5   8D4424 3C                      LEA EAX,DWORD PTR SS:[ESP+0x3C]
 */
bool attachScenarioHookW2(ULONG startAddress, ULONG stopAddress)
{
  // key pattern: C78424 E0010000 07000000
  const uint8_t bytes[] = {
    0x8b,0xc7,                                               // 00455833   8bc7                           mov eax,edi ; jichi: text in eax assigned from edi
    0xc7,0x84,0x24, 0xe0,0x01,0x00,0x00, 0x07,0x00,0x00,0x00 // 00455835   c78424 e0010000 07000000       mov dword ptr ss:[esp+0x1e0],0x7 ; jichi: key pattern is here, text i eax
  };
   int edi = get_reg(regs::edi)/4;
 return TextHookW::attach<2>(bytes, sizeof(bytes), startAddress, stopAddress,edi,Engine::ScenarioRole);
  
}
/**
 *  Sample game: なついろレシピ
 *  See: http://capita.tistory.com/m/post/251
 *
 *  Name:
 *
 *  004534FA   64:A3 00000000                  MOV DWORD PTR FS:[0],EAX
 *  00453500   8B75 14                         MOV ESI,DWORD PTR SS:[EBP+0x14]
 *  00453503   8B46 10                         MOV EAX,DWORD PTR DS:[ESI+0x10]
 *  00453506   2B46 0C                         SUB EAX,DWORD PTR DS:[ESI+0xC]
 *  00453509   8BF9                            MOV EDI,ECX
 *  0045350B   C1F8 04                         SAR EAX,0x4
 *  0045350E   897C24 14                       MOV DWORD PTR SS:[ESP+0x14],EDI
 *  00453512   85C0                            TEST EAX,EAX
 *  00453514   77 05                           JA SHORT .0045351B
 *  00453516   E8 1D510B00                     CALL .00508638                           ; JMP to msvcr90._invalid_parameter_noinfo
 *  0045351B   8B76 0C                         MOV ESI,DWORD PTR DS:[ESI+0xC]
 *  0045351E   8B4E 08                         MOV ECX,DWORD PTR DS:[ESI+0x8]
 *  00453521   33DB                            XOR EBX,EBX  ; jichi: hook here, text in ecx
 *  00453523   33D2                            XOR EDX,EDX
 *  00453525   8BC1                            MOV EAX,ECX
 *  00453527   C78424 88000000 07000000        MOV DWORD PTR SS:[ESP+0x88],0x7
 *  00453532   899C24 84000000                 MOV DWORD PTR SS:[ESP+0x84],EBX
 *  00453539   66:895424 74                    MOV WORD PTR SS:[ESP+0x74],DX
 *  0045353E   8D70 02                         LEA ESI,DWORD PTR DS:[EAX+0x2]
 *  00453541   66:8B10                         MOV DX,WORD PTR DS:[EAX]
 *  00453544   83C0 02                         ADD EAX,0x2
 *  00453547   66:3BD3                         CMP DX,BX
 *  0045354A  ^75 F5                           JNZ SHORT .00453541
 *  0045354C   2BC6                            SUB EAX,ESI
 *  0045354E   D1F8                            SAR EAX,1
 *  00453550   50                              PUSH EAX
 *  00453551   51                              PUSH ECX
 *  00453552   8D7424 78                       LEA ESI,DWORD PTR SS:[ESP+0x78]
 *  00453556   E8 6543FBFF                     CALL .004078C0
 *  0045355B   899C24 70010000                 MOV DWORD PTR SS:[ESP+0x170],EBX
 *  00453562   A1 DCAA5500                     MOV EAX,DWORD PTR DS:[0x55AADC]
 *  00453567   894424 1C                       MOV DWORD PTR SS:[ESP+0x1C],EAX
 *  0045356B   B8 0F000000                     MOV EAX,0xF
 *  00453570   894424 6C                       MOV DWORD PTR SS:[ESP+0x6C],EAX
 *  00453574   895C24 68                       MOV DWORD PTR SS:[ESP+0x68],EBX
 *  00453578   885C24 58                       MOV BYTE PTR SS:[ESP+0x58],BL
 *  0045357C   894424 50                       MOV DWORD PTR SS:[ESP+0x50],EAX
 *  00453580   895C24 4C                       MOV DWORD PTR SS:[ESP+0x4C],EBX
 *  00453584   885C24 3C                       MOV BYTE PTR SS:[ESP+0x3C],BL
 *  00453588   C68424 70010000 02              MOV BYTE PTR SS:[ESP+0x170],0x2
 *  00453590   8B8424 84000000                 MOV EAX,DWORD PTR SS:[ESP+0x84]
 *  00453597   8BF0                            MOV ESI,EAX
 *  00453599   3BC3                            CMP EAX,EBX
 *  0045359B   74 3D                           JE SHORT .004535DA
 *  0045359D   83BC24 88000000 08              CMP DWORD PTR SS:[ESP+0x88],0x8
 *  004535A5   8B5424 74                       MOV EDX,DWORD PTR SS:[ESP+0x74]
 *  004535A9   73 04                           JNB SHORT .004535AF
 *  004535AB   8D5424 74                       LEA EDX,DWORD PTR SS:[ESP+0x74]
 */
bool attachNameHookW(ULONG startAddress, ULONG stopAddress)
{
  // ECX PTR: 33 DB 33 D2 8B C1 C7 84 24 88 00 00 00 07 00 00 00
  const uint8_t bytes[] = {
    0x33,0xdb,   // 00453521   33db                            xor ebx,ebx  ; jichi: hook here, text in ecx
    0x33,0xd2,   // 00453523   33d2                            xor edx,edx
    0x8b,0xc1,   // 00453525   8bc1                            mov eax,ecx
    0xc7,0x84,0x24, 0x88,0x00,0x00,0x00, 0x07,0x00,0x00,0x00 // 00453527   c78424 88000000 07000000        mov dword ptr ss:[esp+0x88],0x7
                                                             // 00453532   899c24 84000000                 mov dword ptr ss:[esp+0x84],ebx
  };
  
  int ecx = get_reg(regs::ecx)/4;
 return TextHookW::attach<3>(bytes, sizeof(bytes), startAddress, stopAddress,ecx,Engine::NameRole);
  
}

/**
 *  Sample game: なついろレシピ
 *  See: http://capita.tistory.com/m/post/251
 *
 *  Choice:
 *  00470D95   72 05                           JB SHORT .00470D9C
 *  00470D97   E8 9C780900                     CALL .00508638                           ; JMP to msvcr90._invalid_parameter_noinfo
 *  00470D9C   8BB5 EC020000                   MOV ESI,DWORD PTR SS:[EBP+0x2EC]
 *  00470DA2   037424 14                       ADD ESI,DWORD PTR SS:[ESP+0x14]
 *  00470DA6   8B4E 10                         MOV ECX,DWORD PTR DS:[ESI+0x10]
 *  00470DA9   2B4E 0C                         SUB ECX,DWORD PTR DS:[ESI+0xC]
 *  00470DAC   C1F9 04                         SAR ECX,0x4
 *  00470DAF   83F9 01                         CMP ECX,0x1
 *  00470DB2   77 05                           JA SHORT .00470DB9
 *  00470DB4   E8 7F780900                     CALL .00508638                           ; JMP to msvcr90._invalid_parameter_noinfo
 *  00470DB9   8B46 0C                         MOV EAX,DWORD PTR DS:[ESI+0xC]
 *  00470DBC   8B50 18                         MOV EDX,DWORD PTR DS:[EAX+0x18]
 *  00470DBF   83C0 10                         ADD EAX,0x10     ; jichi: text in edx
 *  00470DC2   52                              PUSH EDX
 *  00470DC3   8D8C24 7C040000                 LEA ECX,DWORD PTR SS:[ESP+0x47C]
 *  00470DCA   8D7424 4C                       LEA ESI,DWORD PTR SS:[ESP+0x4C]
 *  00470DCE   E8 EDA3F9FF                     CALL .0040B1C0
 *  00470DD3   83C4 04                         ADD ESP,0x4
 *  00470DD6   6A FF                           PUSH -0x1
 *  00470DD8   53                              PUSH EBX
 *  00470DD9   50                              PUSH EAX
 *  00470DDA   8D8424 84040000                 LEA EAX,DWORD PTR SS:[ESP+0x484]
 *  00470DE1   C68424 B0040000 07              MOV BYTE PTR SS:[ESP+0x4B0],0x7
 *  00470DE9   E8 1251F9FF                     CALL .00405F00
 *  00470DEE   BE 08000000                     MOV ESI,0x8
 *  00470DF3   C68424 A4040000 06              MOV BYTE PTR SS:[ESP+0x4A4],0x6
 *  00470DFB   397424 60                       CMP DWORD PTR SS:[ESP+0x60],ESI
 *  00470DFF   72 0D                           JB SHORT .00470E0E
 *  00470E01   8B4424 4C                       MOV EAX,DWORD PTR SS:[ESP+0x4C]
 *  00470E05   50                              PUSH EAX
 *  00470E06   E8 65770900                     CALL .00508570                           ; JMP to msvcr90.??3@YAXPAX@Z
 *  00470E0B   83C4 04                         ADD ESP,0x4
 *  00470E0E   8B9424 7C040000                 MOV EDX,DWORD PTR SS:[ESP+0x47C]
 *  00470E15   33C9                            XOR ECX,ECX
 *  00470E17   C74424 60 07000000              MOV DWORD PTR SS:[ESP+0x60],0x7
 *  00470E1F   895C24 5C                       MOV DWORD PTR SS:[ESP+0x5C],EBX
 *  00470E23   66:894C24 4C                    MOV WORD PTR SS:[ESP+0x4C],CX
 *  00470E28   39B424 90040000                 CMP DWORD PTR SS:[ESP+0x490],ESI
 *  00470E2F   73 07                           JNB SHORT .00470E38
 *  00470E31   8D9424 7C040000                 LEA EDX,DWORD PTR SS:[ESP+0x47C]
 *  00470E38   8B8424 44040000                 MOV EAX,DWORD PTR SS:[ESP+0x444]
 *  00470E3F   B9 10000000                     MOV ECX,0x10
 *  00470E44   398C24 58040000                 CMP DWORD PTR SS:[ESP+0x458],ECX
 *  00470E4B   73 07                           JNB SHORT .00470E54
 *  00470E4D   8D8424 44040000                 LEA EAX,DWORD PTR SS:[ESP+0x444]
 *  00470E54   398C24 74040000                 CMP DWORD PTR SS:[ESP+0x474],ECX
 *  00470E5B   8B8C24 60040000                 MOV ECX,DWORD PTR SS:[ESP+0x460]
 */
bool attachOtherHookW(ULONG startAddress, ULONG stopAddress)
{
  // EDX PTR : 83 C0 10 52 8D 8C 24 7C 04 00 00 8D 74 24 4C
  const uint8_t bytes[] = {
    0x83,0xc0, 0x10,                        // 00470dbf   83c0 10                         add eax,0x10     ; jichi: text in edx
    0x52,                                   // 00470dc2   52                              push edx
    0x8d,0x8c,0x24, 0x7c,0x04,0x00,0x00,    // 00470dc3   8d8c24 7c040000                 lea ecx,dword ptr ss:[esp+0x47c]
    0x8d,0x74,0x24, 0x4c                    // 00470dca   8d7424 4c                       lea esi,dword ptr ss:[esp+0x4c]
  };
  
  int edx = get_reg(regs::edx)/4;
 return TextHookW::attach<4>(bytes, sizeof(bytes), startAddress, stopAddress,edx,Engine::OtherRole);
   
}

namespace PatchA {

namespace Private {
  // The second argument is always 0 and not used
  bool isLeadByteChar(int ch, int)
  {
    return dynsjis::isleadchar(ch);
    //return ::IsDBCSLeadByte(HIBYTE(testChar));
  }

} // namespace Private

/**
 *  Sample game: Re:BIRTHDAY SONG
 *
 *  0x8140 is found by tracing the call of the caller of GetGlyphOutlineA.

 *  00487F8D   25 FF7F0000      AND EAX,0x7FFF
 *  00487F92   C3               RETN
 *  00487F93   8BFF             MOV EDI,EDI
 *  00487F95   55               PUSH EBP
 *  00487F96   8BEC             MOV EBP,ESP
 *  00487F98   83EC 10          SUB ESP,0x10
 *  00487F9B   FF75 0C          PUSH DWORD PTR SS:[EBP+0xC]
 *  00487F9E   8D4D F0          LEA ECX,DWORD PTR SS:[EBP-0x10]
 *  00487FA1   E8 02EEFFFF      CALL .00486DA8
 *  00487FA6   8B45 08          MOV EAX,DWORD PTR SS:[EBP+0x8]
 *  00487FA9   C1E8 08          SHR EAX,0x8
 *  00487FAC   0FB6C8           MOVZX ECX,AL
 *  00487FAF   8B45 F4          MOV EAX,DWORD PTR SS:[EBP-0xC]
 *  00487FB2   F64401 1D 04     TEST BYTE PTR DS:[ECX+EAX+0x1D],0x4
 *  00487FB7   74 10            JE SHORT .00487FC9
 *  00487FB9   0FB64D 08        MOVZX ECX,BYTE PTR SS:[EBP+0x8]
 *  00487FBD   F64401 1D 08     TEST BYTE PTR DS:[ECX+EAX+0x1D],0x8
 *  00487FC2   74 05            JE SHORT .00487FC9
 *  00487FC4   33C0             XOR EAX,EAX
 *  00487FC6   40               INC EAX
 *  00487FC7   EB 02            JMP SHORT .00487FCB
 *  00487FC9   33C0             XOR EAX,EAX
 *  00487FCB   807D FC 00       CMP BYTE PTR SS:[EBP-0x4],0x0
 *  00487FCF   74 07            JE SHORT .00487FD8
 *  00487FD1   8B4D F8          MOV ECX,DWORD PTR SS:[EBP-0x8]
 *  00487FD4   8361 70 FD       AND DWORD PTR DS:[ECX+0x70],0xFFFFFFFD
 *  00487FD8   C9               LEAVE
 *  00487FD9   C3               RETN
 *  00487FDA   8BFF             MOV EDI,EDI	; jichi: called here, text in arg1
 *  00487FDC   55               PUSH EBP
 *  00487FDD   8BEC             MOV EBP,ESP
 *  00487FDF   6A 00            PUSH 0x0
 *  00487FE1   FF75 08          PUSH DWORD PTR SS:[EBP+0x8]
 *  00487FE4   E8 AAFFFFFF      CALL .00487F93	; jichi: called here
 *  00487FE9   59               POP ECX
 *  00487FEA   59               POP ECX
 *  00487FEB   5D               POP EBP
 *  00487FEC   C3               RETN
 */
using ulong=ULONG;
#define s1_call_        0xe8            // near call, incomplete
#define s1_nop          0x90    // nop

bool csmemcpy(void *dst, const void *src, size_t size)
{
  //return memcpy_(dst, src, size);

  DWORD oldProtect;
  if (!::VirtualProtect(dst, size, PAGE_EXECUTE_READWRITE, &oldProtect))
    return false;
  //HANDLE hProc = OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE, FALSE, ::GetCurrentProcessId());
  //VirtualProtectEx(hProc, dst, size, PAGE_EXECUTE_READWRITE, &oldProtect);

  memcpy(dst, src, size);

  DWORD newProtect;
  ::VirtualProtect(dst, size, oldProtect, &newProtect); // the error code is not checked for this function
  //hProc = OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE, FALSE, ::GetCurrentProcessId());
  //VirtualProtectEx(hProc, dst, size, oldProtect, &newProtect);

  return true;
}
ulong replace_near_call(ulong addr, ulong val)
{
  DWORD ret;
  switch (::disasm((LPCVOID)addr)) {
  case 5:  // near call / short jmp: relative address
    ret = *(DWORD *)(addr + 1) + (addr + 5);
    val -= addr + 5;
    return csmemcpy((LPVOID)(addr + 1), &val, sizeof(val)) ? ret : 0;
  case 6:  // far car / long jmp: absolute address
    {
      ret = *(DWORD *)(addr + 2);
      BYTE data[6];
      data[0] = s1_call_;
      data[5] = s1_nop;
      *(DWORD *)(data + 1) = val - (addr + 5);
      return csmemcpy((LPVOID)addr, data, sizeof(data)) ? ret : 0;
    }
  default: return 0;
  }
}
ULONG patchEncoding(ULONG startAddress, ULONG stopAddress)
{
  const uint8_t bytes[] = {
    0x6a, 0x00,                 // 00487fdf   6a 00            push 0x0
    0xff,0x75, 0x08,            // 00487fe1   ff75 08          push dword ptr ss:[ebp+0x8]
    0xe8, 0xaa,0xff,0xff,0xff   // 00487fe4   e8 aaffffff      call .00487f93	; jichi: called here
  };
  enum { addr_offset = 5 };
  ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
   
  return  addr ;//&&  replace_near_call(addr + addr_offset, (ULONG)Private::isLeadByteChar);
}

} // namespace PatchA
 
namespace ScenarioHookA {

namespace Private {
/*
  void dispatch(LPSTR text, int role)
  {
    enum { sig = 0 };
    if (!Engine::isAddressWritable(text) || !*text) // isAddressWritable is not needed for correct games
      return;
    int size = ::strlen(text),
        trimmedSize = size;
    auto trimmedText = trim(text, &trimmedSize);
    if (!trimmedSize || !*trimmedText)
      return;
    std::string oldData(trimmedText, trimmedSize),
               newData = EngineController::instance()->dispatchTextASTD(oldData, role, sig);
    if (newData == oldData)
      return;
    if (trimmedText[trimmedSize])
      newData.append(trimmedText + trimmedSize); //, size - trimmedSize - (trimmedText - text));
    ::strcpy(text, newData.c_str());
  }
*/
  bool hookBefore(hook_stack*s,void* data, size_t* len,uintptr_t*role)
  {
    auto text = (LPSTR)s->eax;
    if (!text)
      return false;
   // dispatch(text - 1024, Engine::NameRole);
   // dispatch(text, Engine::ScenarioRole);

    enum { sig = 0 };
    if (!Engine::isAddressWritable(text) || !*text) // isAddressWritable is not needed for correct games
      return false;
    int size = ::strlen(text),
        trimmedSize = size;
    auto trimmedText = trim(text, &trimmedSize);
    if (!trimmedSize || !*trimmedText)
      return false;
    std::string oldData(trimmedText, trimmedSize);

    return write_string_overwrite(data,len,oldData);
    /*newData = EngineController::instance()->dispatchTextASTD(oldData, role, sig);
    if (newData == oldData)
      return;
    if (trimmedText[trimmedSize])
      newData.append(trimmedText + trimmedSize); //, size - trimmedSize - (trimmedText - text));
    ::strcpy(text, newData.c_str());
    return true;*/
  }
  void hookafter(hook_stack*s,void* data, size_t len){
      
      auto newData =std::string((char*)data,len); 
     auto text = (LPSTR)s->eax;
      int size = ::strlen(text),
        trimmedSize = size;
    auto trimmedText = trim(text, &trimmedSize);
    if (trimmedText[trimmedSize])
      newData.append(trimmedText + trimmedSize); //, size - trimmedSize - (trimmedText - text));
    ::strcpy(text, newData.c_str());
  }
} // namespace Private

/**
 *  Sample games
 *  - [111028][PULLTOP] 神聖にして侵すべからず
 *  - Re：BIRTHDAY SONG～恋を唄う死神～（体験版）
 *  See: http://capita.tistory.com/m/post/84
 *
 *  ENCODEKOR,FORCEFONT(5),HOOK(0x0042B5E0,TRANS(0x004FFBF8,OVERWRITE(IGNORE)),RETNPOS(COPY),TRANS(0x004FF7F8,OVERWRITE(IGNORE))),HOOK(0x00413204,TRANS([ESP+0x1c],PTRCHEAT),RETNPOS(SOURCE)),HOOK(0x00424004,TRANS([ESP+0x1c],PTRCHEAT),RETNPOS(SOURCE)),HOOK(0x004242B9,TRANS([ESP+0x1c],PTRCHEAT),RETNPOS(SOURCE)),HOOK(0x00424109,TRANS([ESP+0x1c],PTRCHEAT),RETNPOS(SOURCE))
 *
 *  Scenario in eax
 *  Name in (eax - 1024)
 *  Memory can be directly overridden.
 *
 *  0042B5DE   CC               INT3
 *  0042B5DF   CC               INT3
 *  0042B5E0   81EC 14080000    SUB ESP,0x814	; jichi: text in eax, name in eax - 1024, able to copy
 *  0042B5E6   53               PUSH EBX
 *  0042B5E7   55               PUSH EBP
 *  0042B5E8   56               PUSH ESI
 *  0042B5E9   33DB             XOR EBX,EBX
 *  0042B5EB   57               PUSH EDI
 *  0042B5EC   8BF8             MOV EDI,EAX
 *  0042B5EE   399C24 28080000  CMP DWORD PTR SS:[ESP+0x828],EBX
 *  0042B5F5   75 13            JNZ SHORT .0042B60A
 *  0042B5F7   68 74030000      PUSH 0x374
 *  0042B5FC   53               PUSH EBX
 *  0042B5FD   68 7CC44F00      PUSH .004FC47C
 *  0042B602   E8 09E60500      CALL .00489C10
 *  0042B607   83C4 0C          ADD ESP,0xC
 *  0042B60A   33F6             XOR ESI,ESI
 *  0042B60C   895C24 1C        MOV DWORD PTR SS:[ESP+0x1C],EBX
 *  0042B610   895C24 10        MOV DWORD PTR SS:[ESP+0x10],EBX
 *  0042B614   381F             CMP BYTE PTR DS:[EDI],BL
 *  0042B616   0F84 0D020000    JE .0042B829
 *  0042B61C   8D6424 00        LEA ESP,DWORD PTR SS:[ESP]
 *  0042B620   8A4C37 01        MOV CL,BYTE PTR DS:[EDI+ESI+0x1]
 *  0042B624   84C9             TEST CL,CL
 *  0042B626   0F84 E6010000    JE .0042B812
 *  0042B62C   66:0FB6043E      MOVZX AX,BYTE PTR DS:[ESI+EDI]
 *  0042B631   8D2C3E           LEA EBP,DWORD PTR DS:[ESI+EDI]
 *  0042B634   66:C1E0 08       SHL AX,0x8
 *  0042B638   0FB7C0           MOVZX EAX,AX
 *  0042B63B   0FB6C9           MOVZX ECX,CL
 *  0042B63E   0BC1             OR EAX,ECX
 *  0042B640   50               PUSH EAX
 *  0042B641   E8 34B40500      CALL .00486A7A
 *  0042B646   83C4 04          ADD ESP,0x4
 *  0042B649   85C0             TEST EAX,EAX
 *  0042B64B   74 14            JE SHORT .0042B661
 *  0042B64D   66:8B55 00       MOV DX,WORD PTR SS:[EBP]
 *  0042B651   66:89541C 24     MOV WORD PTR SS:[ESP+EBX+0x24],DX
 *  0042B656   83C3 02          ADD EBX,0x2
 *  0042B659   83C6 02          ADD ESI,0x2
 *  0042B65C   E9 BA010000      JMP .0042B81B
 *  0042B661   807D 00 7B       CMP BYTE PTR SS:[EBP],0x7B
 *  0042B665   0F85 60010000    JNZ .0042B7CB
 *  0042B66B   8BC3             MOV EAX,EBX
 *  0042B66D   2B4424 1C        SUB EAX,DWORD PTR SS:[ESP+0x1C]
 *  0042B671   46               INC ESI
 *  0042B672   33ED             XOR EBP,EBP
 *  0042B674   894424 20        MOV DWORD PTR SS:[ESP+0x20],EAX
 *  0042B678   896C24 14        MOV DWORD PTR SS:[ESP+0x14],EBP
 *  0042B67C   8D6424 00        LEA ESP,DWORD PTR SS:[ESP]
 *  0042B680   8A0C3E           MOV CL,BYTE PTR DS:[ESI+EDI]
 *  0042B683   84C9             TEST CL,CL
 *  0042B685   0F84 B5010000    JE .0042B840
 *  0042B68B   0FB64437 01      MOVZX EAX,BYTE PTR DS:[EDI+ESI+0x1]
 *  0042B690   66:0FB6C9        MOVZX CX,CL
 *  0042B694   66:C1E1 08       SHL CX,0x8
 *  0042B698   0FB7D1           MOVZX EDX,CX
 *  0042B69B   0BC2             OR EAX,EDX
 *  0042B69D   50               PUSH EAX
 *  0042B69E   E8 D7B30500      CALL .00486A7A
 *  0042B6A3   83C4 04          ADD ESP,0x4
 *  0042B6A6   85C0             TEST EAX,EAX
 *  0042B6A8   74 1A            JE SHORT .0042B6C4
 *  0042B6AA   66:8B043E        MOV AX,WORD PTR DS:[ESI+EDI]
 *  0042B6AE   834424 14 02     ADD DWORD PTR SS:[ESP+0x14],0x2
 *  0042B6B3   66:89441C 24     MOV WORD PTR SS:[ESP+EBX+0x24],AX
 *  0042B6B8   83C3 02          ADD EBX,0x2
 *  0042B6BB   895C24 10        MOV DWORD PTR SS:[ESP+0x10],EBX
 *  0042B6BF   83C6 02          ADD ESI,0x2
 *  0042B6C2  ^EB BC            JMP SHORT .0042B680
 *  0042B6C4   8A043E           MOV AL,BYTE PTR DS:[ESI+EDI]
 *  0042B6C7   3C 3A            CMP AL,0x3A
 *  0042B6C9   74 10            JE SHORT .0042B6DB
 *  0042B6CB   FF4424 14        INC DWORD PTR SS:[ESP+0x14]
 *  0042B6CF   88441C 24        MOV BYTE PTR SS:[ESP+EBX+0x24],AL
 *  0042B6D3   43               INC EBX
 *  0042B6D4   895C24 10        MOV DWORD PTR SS:[ESP+0x10],EBX
 *  0042B6D8   46               INC ESI
 *  0042B6D9  ^EB A5            JMP SHORT .0042B680
 *  0042B6DB   896C24 18        MOV DWORD PTR SS:[ESP+0x18],EBP
 *  0042B6DF   46               INC ESI
 *  0042B6E0   8A0C3E           MOV CL,BYTE PTR DS:[ESI+EDI]
 *  0042B6E3   84C9             TEST CL,CL
 *  0042B6E5   0F84 55010000    JE .0042B840
 *  0042B6EB   0FB64437 01      MOVZX EAX,BYTE PTR DS:[EDI+ESI+0x1]
 *  0042B6F0   66:0FB6C9        MOVZX CX,CL
 *  0042B6F4   66:C1E1 08       SHL CX,0x8
 *  0042B6F8   0FB7D1           MOVZX EDX,CX
 *  0042B6FB   0BC2             OR EAX,EDX
 *  0042B6FD   50               PUSH EAX
 *  0042B6FE   E8 77B30500      CALL .00486A7A
 *  0042B703   83C4 04          ADD ESP,0x4
 *  0042B706   85C0             TEST EAX,EAX
 *  0042B708   74 18            JE SHORT .0042B722
 *  0042B70A   66:8B043E        MOV AX,WORD PTR DS:[ESI+EDI]
 *  0042B70E   FF4424 18        INC DWORD PTR SS:[ESP+0x18]
 *  0042B712   66:89842C 240400>MOV WORD PTR SS:[ESP+EBP+0x424],AX
 *  0042B71A   83C5 02          ADD EBP,0x2
 *  0042B71D   83C6 02          ADD ESI,0x2
 *  0042B720  ^EB BE            JMP SHORT .0042B6E0
 *  0042B722   8A043E           MOV AL,BYTE PTR DS:[ESI+EDI]
 *  0042B725   3C 7D            CMP AL,0x7D
 *  0042B727   74 0E            JE SHORT .0042B737
 *  0042B729   FF4424 18        INC DWORD PTR SS:[ESP+0x18]
 *  0042B72D   88842C 24040000  MOV BYTE PTR SS:[ESP+EBP+0x424],AL
 *  0042B734   45               INC EBP
 *  0042B735  ^EB A8            JMP SHORT .0042B6DF
 *  0042B737   8D8424 24040000  LEA EAX,DWORD PTR SS:[ESP+0x424]
 *  0042B73E   46               INC ESI
 *  0042B73F   C6842C 24040000 >MOV BYTE PTR SS:[ESP+EBP+0x424],0x0
 *  0042B747   8D50 01          LEA EDX,DWORD PTR DS:[EAX+0x1]
 *  0042B74A   8D9B 00000000    LEA EBX,DWORD PTR DS:[EBX]
 *  0042B750   8A08             MOV CL,BYTE PTR DS:[EAX]
 *  0042B752   40               INC EAX
 *  0042B753   84C9             TEST CL,CL
 *  0042B755  ^75 F9            JNZ SHORT .0042B750
 *  0042B757   2BC2             SUB EAX,EDX
 *  0042B759   83F8 1E          CMP EAX,0x1E
 *  0042B75C   0F87 DE000000    JA .0042B840
 *  0042B762   8B15 7CC44F00    MOV EDX,DWORD PTR DS:[0x4FC47C]
 *  0042B768   83FA 14          CMP EDX,0x14
 *  0042B76B   0F8D AE000000    JGE .0042B81F
 *  0042B771   6BD2 2C          IMUL EDX,EDX,0x2C
 *  0042B774   8D8C24 24040000  LEA ECX,DWORD PTR SS:[ESP+0x424]
 *  0042B77B   81C2 8CC44F00    ADD EDX,.004FC48C
 *  0042B781   8A01             MOV AL,BYTE PTR DS:[ECX]
 *  0042B783   8802             MOV BYTE PTR DS:[EDX],AL
 *  0042B785   41               INC ECX
 *  0042B786   42               INC EDX
 *  0042B787   84C0             TEST AL,AL
 *  0042B789  ^75 F6            JNZ SHORT .0042B781
 *  0042B78B   8B0D 7CC44F00    MOV ECX,DWORD PTR DS:[0x4FC47C]
 *  0042B791   8B5424 14        MOV EDX,DWORD PTR SS:[ESP+0x14]
 *  0042B795   6BC9 2C          IMUL ECX,ECX,0x2C
 *  0042B798   8991 88C44F00    MOV DWORD PTR DS:[ECX+0x4FC488],EDX
 *  0042B79E   A1 7CC44F00      MOV EAX,DWORD PTR DS:[0x4FC47C]
 *  0042B7A3   8B4C24 20        MOV ECX,DWORD PTR SS:[ESP+0x20]
 *  0042B7A7   6BC0 2C          IMUL EAX,EAX,0x2C
 *  0042B7AA   8988 80C44F00    MOV DWORD PTR DS:[EAX+0x4FC480],ECX
 *  0042B7B0   8B15 7CC44F00    MOV EDX,DWORD PTR DS:[0x4FC47C]
 *  0042B7B6   8B4424 18        MOV EAX,DWORD PTR SS:[ESP+0x18]
 *  0042B7BA   6BD2 2C          IMUL EDX,EDX,0x2C
 *  0042B7BD   8982 84C44F00    MOV DWORD PTR DS:[EDX+0x4FC484],EAX
 *  0042B7C3   FF05 7CC44F00    INC DWORD PTR DS:[0x4FC47C]
 *  0042B7C9   EB 54            JMP SHORT .0042B81F
 *  0042B7CB   55               PUSH EBP
 *  0042B7CC   E8 7F000000      CALL .0042B850
 *  0042B7D1   8BD8             MOV EBX,EAX
 *  0042B7D3   83C4 04          ADD ESP,0x4
 *  0042B7D6   85DB             TEST EBX,EBX
 *  0042B7D8   74 23            JE SHORT .0042B7FD
 *  0042B7DA   53               PUSH EBX
 *  0042B7DB   55               PUSH EBP
 *  0042B7DC   8B6C24 18        MOV EBP,DWORD PTR SS:[ESP+0x18]
 *  0042B7E0   8D4C2C 2C        LEA ECX,DWORD PTR SS:[ESP+EBP+0x2C]
 *  0042B7E4   51               PUSH ECX
 *  0042B7E5   E8 A6E40500      CALL .00489C90
 *  0042B7EA   03EB             ADD EBP,EBX
 *  0042B7EC   03F3             ADD ESI,EBX
 *  0042B7EE   83C4 0C          ADD ESP,0xC
 *  0042B7F1   015C24 1C        ADD DWORD PTR SS:[ESP+0x1C],EBX
 *  0042B7F5   896C24 10        MOV DWORD PTR SS:[ESP+0x10],EBP
 *  0042B7F9   8BDD             MOV EBX,EBP
 *  0042B7FB   EB 22            JMP SHORT .0042B81F
 *  0042B7FD   8B4424 10        MOV EAX,DWORD PTR SS:[ESP+0x10]
 *  0042B801   8A55 00          MOV DL,BYTE PTR SS:[EBP]
 *  0042B804   40               INC EAX
 *  0042B805   885404 23        MOV BYTE PTR SS:[ESP+EAX+0x23],DL
 *  0042B809   894424 10        MOV DWORD PTR SS:[ESP+0x10],EAX
 *  0042B80D   46               INC ESI
 *  0042B80E   8BD8             MOV EBX,EAX
 *  0042B810   EB 0D            JMP SHORT .0042B81F
 *  0042B812   8A043E           MOV AL,BYTE PTR DS:[ESI+EDI]
 *  0042B815   88441C 24        MOV BYTE PTR SS:[ESP+EBX+0x24],AL
 *  0042B819   43               INC EBX
 *  0042B81A   46               INC ESI
 *  0042B81B   895C24 10        MOV DWORD PTR SS:[ESP+0x10],EBX
 *  0042B81F   803C3E 00        CMP BYTE PTR DS:[ESI+EDI],0x0
 *  0042B823  ^0F85 F7FDFFFF    JNZ .0042B620
 *  0042B829   8D4424 24        LEA EAX,DWORD PTR SS:[ESP+0x24]
 *  0042B82D   8BC8             MOV ECX,EAX
 *  0042B82F   C6441C 24 00     MOV BYTE PTR SS:[ESP+EBX+0x24],0x0
 *  0042B834   2BF9             SUB EDI,ECX
 *  0042B836   8A08             MOV CL,BYTE PTR DS:[EAX]
 *  0042B838   880C07           MOV BYTE PTR DS:[EDI+EAX],CL
 *  0042B83B   40               INC EAX
 *  0042B83C   84C9             TEST CL,CL
 *  0042B83E  ^75 F6            JNZ SHORT .0042B836
 *  0042B840   5F               POP EDI
 *  0042B841   5E               POP ESI
 *  0042B842   5D               POP EBP
 *  0042B843   5B               POP EBX
 *  0042B844   81C4 14080000    ADD ESP,0x814
 *  0042B84A   C3               RETN
 *  0042B84B   CC               INT3
 *  0042B84C   CC               INT3
 *  0042B84D   CC               INT3
 *  0042B84E   CC               INT3
 *
 *  Skip scenario text:
 *  00438EF1   51               PUSH ECX
 *  00438EF2   56               PUSH ESI
 *  00438EF3   57               PUSH EDI
 *  00438EF4   52               PUSH EDX
 *  00438EF5   6A 03            PUSH 0x3    ; jichi: scenario arg1 is always 3
 *  00438EF7   E8 14F3FDFF      CALL .00418210  ; jichi: text called here
 *  00438EFC   894424 4C        MOV DWORD PTR SS:[ESP+0x4C],EAX
 *  00438F00   8D4424 78        LEA EAX,DWORD PTR SS:[ESP+0x78]
 *  00438F04   83C4 30          ADD ESP,0x30
 *  00438F07   897C24 34        MOV DWORD PTR SS:[ESP+0x34],EDI
 *  00438F0B   897424 38        MOV DWORD PTR SS:[ESP+0x38],ESI
 *  00438F0F   8D48 01          LEA ECX,DWORD PTR DS:[EAX+0x1]
 *  00438F12   8A10             MOV DL,BYTE PTR DS:[EAX]
 *  00438F14   40               INC EAX
 *  00438F15   84D2             TEST DL,DL
 */
bool attach(ULONG startAddress, ULONG stopAddress)
{
  const uint8_t bytes[] = {
    0x81,0xec, 0x14,0x08,0x00,0x00 // 0042B5E0   81EC 14080000    SUB ESP,0x814	; jichi: text in eax, name in eax - 1024, able to copy
  };
  ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
  if(addr==0)return false;
    HookParam hp;
    hp.address=addr;
    
    hp.hook_before= Private::hookBefore;
    hp.type=EMBED_ABLE;
    hp.newlineseperator=L"\\n";
    hp.hook_after=Private::hookafter;
    hp.hook_font=F_GetGlyphOutlineA|F_TextOutA;
    static ULONG paddr=(PatchA::patchEncoding(startAddress, stopAddress));
    ConsoleOutput("%p",paddr);
    if(paddr){
      hp.type|=EMBED_DYNA_SJIS;
      hp.hook_font=F_GetGlyphOutlineA|F_TextOutA;
      patch_fun=[](){ 
       PatchA::replace_near_call(paddr + 5, (ULONG)PatchA::Private::isLeadByteChar);
       
      }; 
    }
  return NewHook(hp,"EmbedWillplusA");
}

} // namespace ScenarioHookA

namespace OtherHookA {

namespace Private {

  bool hookBefore(hook_stack*s,void* data, size_t* len,uintptr_t*role)
  {
    static std::string data_;
    if (s->stack[1] == 3) // skip scenario hook where arg1 is 3
      return false;
    auto text = (LPCSTR)s->stack[8]; // text in arg8
    if (!Engine::isAddressReadable(text) || !*text || ::strlen(text) <= 2) // do not translate single character
      return false;
   *role = Engine::OtherRole ;
   
    return write_string_overwrite(data,len,text);
  }

} // namespace Private

/**
 *  Sample games: Re：BIRTHDAY SONG～恋を唄う死神～（体験版）
 *
 *  There are two GetGlyphOutlineA, that are called in the same functions.
 *
 *  Caller of GetGlyphOutlineA, text in arg8.
 */
bool attach(ULONG startAddress, ULONG stopAddress)
{ 
  ULONG addr = MemDbg::findCallerAddressAfterInt3((ULONG)::GetGlyphOutlineA, startAddress, stopAddress);
  if(addr==0)return false;
  HookParam hp;
  hp.address=addr;
  hp.hook_before=Private::hookBefore;
  hp.type=EMBED_ABLE|EMBED_DYNA_SJIS|EMBED_AFTER_OVERWRITE;
  hp.offset=get_stack(8);
  return NewHook(hp,"EmbedWillplus_other");
}

} // namespace OtherHookA

} // unnamed namespace

/** Public class */
namespace WillPlusEngine{
bool attach()
{
  ULONG startAddress=processStartAddress, stopAddress=processStopAddress;
  

  if (::attachScenarioHookW1(startAddress, stopAddress) || ::attachScenarioHookW2(startAddress, stopAddress)) {
     
     (::attachNameHookW(startAddress, stopAddress)) ;

     (::attachOtherHookW(startAddress, stopAddress));
 
    return true;

  } else if (ScenarioHookA::attach(startAddress, stopAddress)) { // try widechar pattern first, which is more unique
  
    (OtherHookA::attach(startAddress, stopAddress)) ;
    // HijackManager::instance()->attachFunction((ULONG)::GetGlyphOutlineA);
    // HijackManager::instance()->attachFunction((ULONG)::TextOutA); // not called. hijack in case it is used
    return true;
  }

  return false;
}
}
 
namespace{ 

static bool InsertWillPlus4() 
{
  //by Blu3train
  /*
  * Sample games:
  * https://vndb.org/r71235
  */
  const BYTE bytes[] = {
    0x33, 0xC9,                         // xor ecx,ecx  <-- hook
    0x8B, 0xC7,                         // mov eax,edi
    0xC7, 0x84, 0x24, XX4, XX4,         // mov [esp+000001E0],00000007
    0x89, 0x9C, 0x24, XX4               // mov [esp+000001DC],ebx
  };
  ULONG range = min(processStopAddress - processStartAddress, MAX_REL_ADDR);
  ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStartAddress + range);
  if (!addr) {
    ConsoleOutput("WillPlus4: pattern not found");
    return false;
  }

  HookParam hp = {};
  hp.address = addr;
  hp.offset =get_reg(regs::edi);
  hp.type = CODEC_UTF16 | USING_STRING;
  hp.filter_fun = WillPlus_extra_filter;
  ConsoleOutput("INSERT WillPlus4");
  NewHook(hp, "WillPlus4");
  return true;
}

static bool InsertWillPlus5() 
{
  //by Blu3train
  /*
  * Sample games:
  * https://vndb.org/v29881
  */
  const BYTE bytes[] = {
    0xE8, XX4,                  // call AdvHD.exe+38550   <-- hook here
    0x8B, 0x4B, 0x08,           // mov ecx,[ebx+08]
    0x89, 0x8F, XX4,            // mov [edi+0000014C],ecx
    0x85, 0xC9,                 // test ecx,ecx
    0x74, 0x04                  // je AdvHD.exe+396C6
  };
  ULONG range = min(processStopAddress - processStartAddress, MAX_REL_ADDR);
  ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStartAddress + range);
  if (!addr) {
    ConsoleOutput("WillPlus5: pattern not found");
    return false;
  }

  HookParam hp = {};
  hp.address = addr;
  hp.offset = get_reg(regs::esi);
  hp.index = 0;
  hp.split = get_reg(regs::ebx);
  hp.split_index = 0;
  hp.type = CODEC_UTF16 | USING_STRING | NO_CONTEXT | USING_SPLIT;
  hp.filter_fun = WillPlus_extra_filter;
  ConsoleOutput("INSERT WillPlus5");
  NewHook(hp, "WillPlus5");
  return true;
}

bool _xxx(){
bool ok=false;
    ok = InsertWillPlus4() || ok;
  ok = InsertWillPlus5() || ok;
  return ok;
}
}

bool WillPlus::attach_function() {  
    bool succ=WillPlusEngine::attach();
    succ|=InsertWillPlusHook();
    succ|=InsertWillPlus4Hook();
		succ|=InsertWillPlus5Hook();
    succ|=insertwillplus6();
    succ|=willX();
    succ|=_xxx();
    
    return succ;
} 



bool Willold::attach_function() {  
    //https://vndb.org/v17755
    //凌辱鬼
    auto addr=MemDbg::findLongJumpAddress((ULONG)TextOutA,processStartAddress,processStopAddress);
    if(addr==0)return false;
    addr=MemDbg::findNearCallAddress(addr,processStartAddress,processStopAddress);
    if(addr==0)return false;
    addr=findfuncstart(addr,0x200);
    if(addr==0)return false;
    HookParam hp;
    hp.address=addr;
    hp.type=USING_CHAR|CODEC_ANSI_BE;
    hp.offset=get_stack(1);
    return NewHook(hp,"will");
}