Public-Mirror/LunaHook-mirror
1
0
Fork 0
mirror of https://github.com/HIllya51/LunaHook.git synced 2024-12-25 12:44:13 +08:00
Code Issues Projects Releases Wiki Activity
LunaHook-mirror/LunaHook/engine32/System4x.cpp
恍兮惚兮 6a43cd5b86 pch
2024-05-06 23:31:54 +08:00

1760 lines
79 KiB
C++
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

#include"System4x.h"
/**
* jichi 12/26/2013: Rance hook
*
* ランス01 光をもとめて: /HSN4:-14@5506A9
* - addr: 5572265 (0x5596a9)
* - off: 4
* - split: 4294967272 (0xffffffe8 = -0x18)
* - type: 1041 (0x411)
*
* the above code has the same pattern except int3.
* 005506a9 |. e8 f2fb1600 call Rance01.006c02a0 ; hook here
* 005506ae |. 83c4 0c add esp,0xc
* 005506b1 |. 5f pop edi
* 005506b2 |. 5e pop esi
* 005506b3 |. b0 01 mov al,0x1
* 005506b5 |. 5b pop ebx
* 005506b6 \. c2 0400 retn 0x4
* 005506b9 cc int3
*
* ランス・クエス<E382A8> /hsn4:-14@42e08a
* 0042e08a |. e8 91ed1f00 call Ranceque.0062ce20 ; hook here
* 0042e08f |. 83c4 0c add esp,0xc
* 0042e092 |. 5f pop edi
* 0042e093 |. 5e pop esi
* 0042e094 |. b0 01 mov al,0x1
* 0042e096 |. 5b pop ebx
* 0042e097 \. c2 0400 retn 0x4
* 0042e09a cc int3
*
* 5/7/2015 イブニクル version 1.0.1
* The hooked function is no longer get called after loading AliceRunPatch.dll.
* The hooked function is below.
* See also ATcode: http://capita.tistory.com/m/post/256
* 005C40AE CC INT3
* 005C40AF CC INT3
* 005C40B0 53 PUSH EBX
* 005C40B1 8B5C24 08 MOV EBX,DWORD PTR SS:[ESP+0x8]
* 005C40B5 56 PUSH ESI
* 005C40B6 57 PUSH EDI
* 005C40B7 8B7B 10 MOV EDI,DWORD PTR DS:[EBX+0x10]
* 005C40BA 8BF0 MOV ESI,EAX
* 005C40BC 47 INC EDI
* 005C40BD 3B7E 0C CMP EDI,DWORD PTR DS:[ESI+0xC]
* 005C40C0 76 0F JBE SHORT .005C40D1
* 005C40C2 E8 79F8FFFF CALL .005C3940
* 005C40C7 84C0 TEST AL,AL
* 005C40C9 75 06 JNZ SHORT .005C40D1
* 005C40CB 5F POP EDI
* 005C40CC 5E POP ESI
* 005C40CD 5B POP EBX
* 005C40CE C2 0400 RETN 0x4
* 005C40D1 837B 14 10 CMP DWORD PTR DS:[EBX+0x14],0x10
* 005C40D5 72 02 JB SHORT .005C40D9
* 005C40D7 8B1B MOV EBX,DWORD PTR DS:[EBX]
* 005C40D9 837E 0C 00 CMP DWORD PTR DS:[ESI+0xC],0x0
* 005C40DD 75 15 JNZ SHORT .005C40F4
* 005C40DF 57 PUSH EDI
* 005C40E0 33C0 XOR EAX,EAX
* 005C40E2 53 PUSH EBX
* 005C40E3 50 PUSH EAX
* 005C40E4 E8 B7400D00 CALL .006981A0
* 005C40E9 83C4 0C ADD ESP,0xC
* 005C40EC 5F POP EDI
* 005C40ED 5E POP ESI
* 005C40EE B0 01 MOV AL,0x1
* 005C40F0 5B POP EBX
* 005C40F1 C2 0400 RETN 0x4
* 005C40F4 8B46 08 MOV EAX,DWORD PTR DS:[ESI+0x8]
* 005C40F7 57 PUSH EDI
* 005C40F8 53 PUSH EBX
* 005C40F9 50 PUSH EAX
* 005C40FA E8 A1400D00 CALL .006981A0 ; jichi: call here
* 005C40FF 83C4 0C ADD ESP,0xC
* 005C4102 5F POP EDI
* 005C4103 5E POP ESI
* 005C4104 B0 01 MOV AL,0x1
* 005C4106 5B POP EBX
* 005C4107 C2 0400 RETN 0x4
* 005C410A CC INT3
* 005C410B CC INT3
* 005C410C CC INT3 *
*/
static bool InsertSystem43OldHook(ULONG startAddress, ULONG stopAddress, LPCSTR hookName)
{
// i.e. 83c40c5f5eb0015bc20400cccc without leading 0xe8
//const BYTE ins[] = { // 005506a9 |. e8 f2fb1600 call rance01.006c02a0 ; hook here
// 0x83,0xc4, 0x0c, // 005506ae |. 83c4 0c add esp,0xc
// 0x5f, // 005506b1 |. 5f pop edi
// 0x5e, // 005506b2 |. 5e pop esi
// 0xb0, 0x01, // 005506b3 |. b0 01 mov al,0x1
// 0x5b, // 005506b5 |. 5b pop ebx
// 0xc2, 0x04,0x00, // 005506b6 \. c2 0400 retn 0x4
// 0xcc, 0xcc // patching a few int3 to make sure that this is at the end of the code block
//};
//enum { addr_offset = -5 }; // the function call before the ins
//ULONG addr = processStartAddress; //- sizeof(ins);
////addr = 0x5506a9;
//enum { near_call = 0xe8 }; // intra-module function call
//do {
// //addr += sizeof(ins); // so that each time return diff address -- not needed
// ULONG range = min(processStopAddress - addr, MAX_REL_ADDR);
// addr = MemDbg::findBytes(ins, sizeof(ins), addr, addr + range);
// if (!addr) {
// //ITH_MSG(L"failed");
// ConsoleOutput("System43: pattern not found");
// return false;
// }
// addr += addr_offset;
//} while(near_call != *(BYTE *)addr); // function call
//GROWL_DWORD(addr);
// i.e. 83c40c5f5eb0015bc20400cccc without leading 0xe8
const BYTE bytes[] = {
0xe8, XX4, // 005506a9 |. e8 f2fb1600 call rance01.006c02a0 ; hook here
0x83,0xc4, 0x0c, // 005506ae |. 83c4 0c add esp,0xc
XX, // 005506b1 |. 5f pop edi ; Artikash 2/9/2019 change these to wildcards: Evenicle 2 has the pops and moves switched order
XX, // 005506b2 |. 5e pop esi
XX, XX, // 005506b3 |. b0 01 mov al,0x1
0x5b, // 005506b5 |. 5b pop ebx
0xc2, 0x04,0x00, // 005506b6 \. c2 0400 retn 0x4
0xcc, 0xcc // patching a few int3 to make sure that this is at the end of the code block
};
enum { addr_offset = 0 };
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);
//GROWL_DWORD(addr);
if (!addr) {
ConsoleOutput("System43: pattern not found");
return false;
}
HookParam hp;
hp.address = addr + addr_offset;
hp.offset=get_stack(1);
hp.split = get_reg(regs::esp);
hp.type = NO_CONTEXT|USING_SPLIT|USING_STRING|EMBED_ABLE|EMBED_BEFORE_SIMPLE|EMBED_AFTER_NEW|EMBED_DYNA_SJIS;
ConsoleOutput("INSERT System43");
ConsoleOutput("System43: disable GDI hooks"); // disable hooking to TextOutA, which is cached
return NewHook(hp, hookName);
}
/** 5/13/2015 Add new hook for System43 engine that has no garbage threads and can detect character name
* Sample game: Evenicle
* See: http://capita.tistory.com/m/post/256
*
* 004EEA6C CC INT3
* 004EEA6D CC INT3
* 004EEA6E CC INT3
* 004EEA6F CC INT3
* 004EEA70 6A FF PUSH -0x1
* 004EEA72 68 E8267000 PUSH .007026E8
* 004EEA77 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
* 004EEA7D 50 PUSH EAX
* 004EEA7E 83EC 20 SUB ESP,0x20
* 004EEA81 A1 DCC47700 MOV EAX,DWORD PTR DS:[0x77C4DC]
* 004EEA86 33C4 XOR EAX,ESP
* 004EEA88 894424 1C MOV DWORD PTR SS:[ESP+0x1C],EAX
* 004EEA8C 53 PUSH EBX
* 004EEA8D 55 PUSH EBP
* 004EEA8E 56 PUSH ESI
* 004EEA8F 57 PUSH EDI
* 004EEA90 A1 DCC47700 MOV EAX,DWORD PTR DS:[0x77C4DC]
* 004EEA95 33C4 XOR EAX,ESP
* 004EEA97 50 PUSH EAX
* 004EEA98 8D4424 34 LEA EAX,DWORD PTR SS:[ESP+0x34]
* 004EEA9C 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
* 004EEAA2 8B4424 44 MOV EAX,DWORD PTR SS:[ESP+0x44]
* 004EEAA6 8BF1 MOV ESI,ECX
* 004EEAA8 E8 8346FBFF CALL .004A3130
* 004EEAAD 8BE8 MOV EBP,EAX
* 004EEAAF 33DB XOR EBX,EBX
* 004EEAB1 3BEB CMP EBP,EBX
* 004EEAB3 75 07 JNZ SHORT .004EEABC
* 004EEAB5 32C0 XOR AL,AL
* 004EEAB7 E9 92000000 JMP .004EEB4E
* 004EEABC 8B06 MOV EAX,DWORD PTR DS:[ESI]
* 004EEABE 8B10 MOV EDX,DWORD PTR DS:[EAX]
* 004EEAC0 8BCE MOV ECX,ESI
* 004EEAC2 FFD2 CALL EDX
* 004EEAC4 8BC8 MOV ECX,EAX
* 004EEAC6 C74424 28 0F0000>MOV DWORD PTR SS:[ESP+0x28],0xF
* 004EEACE 895C24 24 MOV DWORD PTR SS:[ESP+0x24],EBX
* 004EEAD2 885C24 14 MOV BYTE PTR SS:[ESP+0x14],BL
* 004EEAD6 8D71 01 LEA ESI,DWORD PTR DS:[ECX+0x1]
* 004EEAD9 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
* 004EEAE0 8A11 MOV DL,BYTE PTR DS:[ECX]
* 004EEAE2 41 INC ECX
* 004EEAE3 3AD3 CMP DL,BL
* 004EEAE5 ^75 F9 JNZ SHORT .004EEAE0
* 004EEAE7 2BCE SUB ECX,ESI
* 004EEAE9 50 PUSH EAX
* 004EEAEA 8BF9 MOV EDI,ECX
* 004EEAEC 8D7424 18 LEA ESI,DWORD PTR SS:[ESP+0x18]
* 004EEAF0 E8 CB27F1FF CALL .004012C0
* 004EEAF5 8B7C24 48 MOV EDI,DWORD PTR SS:[ESP+0x48]
* 004EEAF9 895C24 3C MOV DWORD PTR SS:[ESP+0x3C],EBX
* 004EEAFD 8B75 3C MOV ESI,DWORD PTR SS:[EBP+0x3C]
* 004EEB00 E8 1B4A0100 CALL .00503520
* 004EEB05 8BF8 MOV EDI,EAX
* 004EEB07 8DB7 E4000000 LEA ESI,DWORD PTR DS:[EDI+0xE4]
* 004EEB0D 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+0x14]
* 004EEB11 8BD6 MOV EDX,ESI
* 004EEB13 E8 985CF1FF CALL .004047B0
* 004EEB18 BD 10000000 MOV EBP,0x10
* 004EEB1D 84C0 TEST AL,AL
* 004EEB1F 75 18 JNZ SHORT .004EEB39
* 004EEB21 895E 10 MOV DWORD PTR DS:[ESI+0x10],EBX
* 004EEB24 396E 14 CMP DWORD PTR DS:[ESI+0x14],EBP
* 004EEB27 72 02 JB SHORT .004EEB2B
* 004EEB29 8B36 MOV ESI,DWORD PTR DS:[ESI]
* 004EEB2B 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+0x14]
* 004EEB2F 50 PUSH EAX
* 004EEB30 8BCF MOV ECX,EDI
* 004EEB32 881E MOV BYTE PTR DS:[ESI],BL
* 004EEB34 E8 67CB0100 CALL .0050B6A0 ; jichi: ATcode modified here, text is on the top of the stack
* 004EEB39 396C24 28 CMP DWORD PTR SS:[ESP+0x28],EBP
* 004EEB3D 72 0D JB SHORT .004EEB4C
* 004EEB3F 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+0x14]
* 004EEB43 51 PUSH ECX
* 004EEB44 E8 42DC1900 CALL .0068C78B
* 004EEB49 83C4 04 ADD ESP,0x4
* 004EEB4C B0 01 MOV AL,0x1
* 004EEB4E 8B4C24 34 MOV ECX,DWORD PTR SS:[ESP+0x34]
* 004EEB52 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
* 004EEB59 59 POP ECX
* 004EEB5A 5F POP EDI
* 004EEB5B 5E POP ESI
* 004EEB5C 5D POP EBP
* 004EEB5D 5B POP EBX
* 004EEB5E 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+0x1C]
* 004EEB62 33CC XOR ECX,ESP
* 004EEB64 E8 9CD61900 CALL .0068C205
* 004EEB69 83C4 2C ADD ESP,0x2C
* 004EEB6C C3 RETN
* 004EEB6D CC INT3
* 004EEB6E CC INT3
*
* Actual binary patch for Evenicle exe: http://capita.tistory.com/m/post/256
* {005E393B(EB), 004EEB34(E9 13 B6 21 00), 005C71E0(E9 48 2F 14 00), 005B6494(E9 10 3D 15 00), 0070A10F(90 90 90 90 90 E8 F7 9F EB FF E9 C7 D0 EB FF 90 90 90 90 90 E8 78 15 E0 FF E9 0C 4A DE FF 50 8B 87 B0 00 00 00 66 81 38 84 00 75 0E 83 78 EA 5B 75 08 E8 A2 00 00 00 58 EB C6 58 EB C8 50 52 BA E0 0B 7A 00 60 89 D7 8B 74 E4 28 B9 06 00 00 00 F3 A5 61 8B 44 E4 08 8B 40 10 85 C0 74 29 8B 44 E4 08 8B 40 14 83 F8 0F 75 08 89 54 E4 08 5A 58 EB 9D 8D 42 20 60 89 C7 8B 32 8B 4A 14 83 C1 09 F3 A4 61 89 02 EB E3 5A 58 EB 89 90 90 90 90 90 E8 6C 9F EB FF E9 F0 C2 EA FF 50 8B 44 E4 04 83 78 0C 01 76 31 8B 87 84 02 00 00 66 83 78 FC 46 75 24 83 78 F8 22 74 16 83 78 F8 13 75 18 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E8 06 00 00 00 58 EB B5 58 EB B7 60 8B 74 E4 28 BF E0 0B 7A 00 89 7C E4 28 B9 0C 00 00 00 F3 A5 61 C3)}
*
* ATcode: FORCEFONT(5),ENCODEKOR,FONT(Malgun Gothic,-13),HOOK(0x0070A10F,TRANS([[ESP]+0x8],LEN([ESP]+0XC),PTRCHEAT),RETNPOS(COPY)),HOOK(0x0070A11E,TRANS([ESP],SMSTR(IGNORE)),RETNPOS(COPY)),HOOK(0x0070A19A,TRANS([[ESP]+0x8],LEN([ESP]+0XC),PTRCHEAT),RETNPOS(COPY))
* FilterCode: DenyWord{CUT(2)},FixLine{},KoFilter{},DumpText{},CustomDic{CDic},CustomScript{Write,Pass(-1),Cache}
*
* The second hooked address pointed to the text address.
* The logic here is simplify buffer the read text, and replace the text by zero
* Then translate/paint them together.
* Several variables near the text address is used to check if the text is finished or not.
*
* Function immediately before patched code:
* 0070A09E CC INT3
* 0070A09F CC INT3
* 0070A0A0 6A FF PUSH -0x1
* 0070A0A2 68 358A7000 PUSH .00708A35
* 0070A0A7 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
* 0070A0AD 50 PUSH EAX
* 0070A0AE 51 PUSH ECX
* 0070A0AF 56 PUSH ESI
* 0070A0B0 A1 DCC47700 MOV EAX,DWORD PTR DS:[0x77C4DC]
* 0070A0B5 33C4 XOR EAX,ESP
* 0070A0B7 50 PUSH EAX
* 0070A0B8 8D4424 0C LEA EAX,DWORD PTR SS:[ESP+0xC]
* 0070A0BC 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
* 0070A0C2 C74424 14 000000>MOV DWORD PTR SS:[ESP+0x14],0x0
* 0070A0CA A1 54D17900 MOV EAX,DWORD PTR DS:[0x79D154]
* 0070A0CF 8B08 MOV ECX,DWORD PTR DS:[EAX]
* 0070A0D1 50 PUSH EAX
* 0070A0D2 51 PUSH ECX
* 0070A0D3 8D7424 10 LEA ESI,DWORD PTR SS:[ESP+0x10]
* 0070A0D7 E8 6416F8FF CALL .0068B740
* 0070A0DC A1 54D17900 MOV EAX,DWORD PTR DS:[0x79D154]
* 0070A0E1 50 PUSH EAX
* 0070A0E2 E8 A426F8FF CALL .0068C78B
* 0070A0E7 83C4 04 ADD ESP,0x4
* 0070A0EA 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+0xC]
* 0070A0EE 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
* 0070A0F5 59 POP ECX
* 0070A0F6 5E POP ESI
* 0070A0F7 83C4 10 ADD ESP,0x10
* 0070A0FA C3 RETN
* 0070A0FB C705 C4C17900 64>MOV DWORD PTR DS:[0x79C1C4],.0070B664
* 0070A105 B9 C4C17900 MOV ECX,.0079C1C4
* 0070A10A ^E9 0722F8FF JMP .0068C316
*
* Patched code:
* 0070A10F 90 NOP ; jichi: ATcode hooked here
* 0070A110 90 NOP
* 0070A111 90 NOP
* 0070A112 90 NOP
* 0070A113 90 NOP
* 0070A114 E8 F79FEBFF CALL .005C4110
* 0070A119 ^E9 C7D0EBFF JMP .005C71E5
* 0070A11E 90 NOP
* 0070A11F 90 NOP
* 0070A120 90 NOP
* 0070A121 90 NOP
* 0070A122 90 NOP
* 0070A123 E8 7815E0FF CALL .0050B6A0 ; jichi: call the original function for hookpoint #2
* 0070A128 ^E9 0C4ADEFF JMP .004EEB39 ; jichi: come back to hookpoint#2
* 0070A12D 50 PUSH EAX ; jichi: this is for hookpoint #3, translate the text before send it to paint
* 0070A12E 8B87 B0000000 MOV EAX,DWORD PTR DS:[EDI+0xB0]
* 0070A134 66:8138 8400 CMP WORD PTR DS:[EAX],0x84
* 0070A139 75 0E JNZ SHORT .0070A149
* 0070A13B 8378 EA 5B CMP DWORD PTR DS:[EAX-0x16],0x5B
* 0070A13F 75 08 JNZ SHORT .0070A149
* 0070A141 E8 A2000000 CALL .0070A1E8
* 0070A146 58 POP EAX
* 0070A147 ^EB C6 JMP SHORT .0070A10F
* 0070A149 58 POP EAX
* 0070A14A ^EB C8 JMP SHORT .0070A114
* 0070A14C 50 PUSH EAX ; jichi: hookpoint#2 jmp here, text address is in [esp]
* 0070A14D 52 PUSH EDX
* 0070A14E BA E00B7A00 MOV EDX,.007A0BE0 ; jichi: 007A0BE0 points to unused zeroed memory
* 0070A153 60 PUSHAD ; jichi esp -= 0x20, now, esp[0x28] is text address, esp[0x24] = eax, and esp[0x20] = edx
* 0070A154 89D7 MOV EDI,EDX ; set 007A0BE0 as the target buffer to save text, edx is never modified
* 0070A156 8B74E4 28 MOV ESI,DWORD PTR SS:[ESP+0x28] ; set source text as target
* 0070A15A B9 06000000 MOV ECX,0x6 ; move for 6 bytes
* 0070A15F F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
* 0070A161 61 POPAD ; finished saving text, now [esp] is old edx, esp[0x4] is old eax, esp[0x8] is old text address
* 0070A162 8B44E4 08 MOV EAX,DWORD PTR SS:[ESP+0x8] ; eax = original text address
* 0070A166 8B40 10 MOV EAX,DWORD PTR DS:[EAX+0x10] ; eax = text[0x10]
* 0070A169 85C0 TEST EAX,EAX ; if end of text,
* 0070A16B 74 29 JE SHORT .0070A196 ; jump if eax is zero, comeback to hookpoint and ignore it
* 0070A16D 8B44E4 08 MOV EAX,DWORD PTR SS:[ESP+0x8] ; otherwise, if eax is not zero
* 0070A171 8B40 14 MOV EAX,DWORD PTR DS:[EAX+0x14] ; eax = text[0x14]
* 0070A174 83F8 0F CMP EAX,0xF ; jichi: compare text[0x14] with 0xf
* 0070A177 75 08 JNZ SHORT .0070A181 ; jump if not zero leaving text not modified, other continue and modify the text
* 0070A179 8954E4 08 MOV DWORD PTR SS:[ESP+0x8],EDX ; override esp+8 with edx, i.e. override text address by new text address and do translation
* 0070A17D 5A POP EDX
* 0070A17E 58 POP EAX ; jichi: restore edx and eax, now esp is back to normal. [esp] is the new text address
* 0070A17F ^EB 9D JMP SHORT .0070A11E ; jichi: jump to the top of the hooked place (nop) and do translation before coming back
* 0070A181 8D42 20 LEA EAX,DWORD PTR DS:[EDX+0x20] ; text is not modified, esp[0x8] is the text address, edx is the modified buffer, eax = buffer[0x20] address
* 0070A184 60 PUSHAD ; jichi: esp[0x28] is now the text address
* 0070A185 89C7 MOV EDI,EAX ; jichi: edx[0x20] is the target
* 0070A187 8B32 MOV ESI,DWORD PTR DS:[EDX] ; jichi: edx is the source
* 0070A189 8B4A 14 MOV ECX,DWORD PTR DS:[EDX+0x14]
* 0070A18C 83C1 09 ADD ECX,0x9 ; move for [edx+0x14]+0x9 time
* 0070A18F F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI] ; jichi: shift text by 0x14 dword ptr
* 0070A191 61 POPAD ; jichi: now esp[0x8] is the text address
* 0070A192 8902 MOV DWORD PTR DS:[EDX],EAX ; eax is the new text address (edx+0x20), move the address to beginning of buffer ([edx]), i.e. edx is pointed to zero memory now
* 0070A194 ^EB E3 JMP SHORT .0070A179 ; come bback to modify the text address
* 0070A196 5A POP EDX
* 0070A197 58 POP EAX
* 0070A198 ^EB 89 JMP SHORT .0070A123 ; jichi: come back to call
* 0070A19A 90 NOP
* 0070A19B 90 NOP
* 0070A19C 90 NOP
* 0070A19D 90 NOP
* 0070A19E 90 NOP
* 0070A19F E8 6C9FEBFF CALL .005C4110
* 0070A1A4 ^E9 F0C2EAFF JMP .005B6499
* 0070A1A9 50 PUSH EAX ; jichi: from hookpoint #4
* 0070A1AA 8B44E4 04 MOV EAX,DWORD PTR SS:[ESP+0x4] ; jichi: move top of the old stack address to eax
* 0070A1AE 8378 0C 01 CMP DWORD PTR DS:[EAX+0xC],0x1
* 0070A1B2 76 31 JBE SHORT .0070A1E5 ; jichi: jump to leave if text[0xc] <= 0x1
* 0070A1B4 8B87 84020000 MOV EAX,DWORD PTR DS:[EDI+0x284]
* 0070A1BA 66:8378 FC 46 CMP WORD PTR DS:[EAX-0x4],0x46
* 0070A1BF 75 24 JNZ SHORT .0070A1E5
* 0070A1C1 8378 F8 22 CMP DWORD PTR DS:[EAX-0x8],0x22
* 0070A1C5 74 16 JE SHORT .0070A1DD
* 0070A1C7 8378 F8 13 CMP DWORD PTR DS:[EAX-0x8],0x13
* 0070A1CB 75 18 JNZ SHORT .0070A1E5
* 0070A1CD 90 NOP
* 0070A1CE 90 NOP
* 0070A1CF 90 NOP
* 0070A1D0 90 NOP
* 0070A1D1 90 NOP
* 0070A1D2 90 NOP
* 0070A1D3 90 NOP
* 0070A1D4 90 NOP
* 0070A1D5 90 NOP
* 0070A1D6 90 NOP
* 0070A1D7 90 NOP
* 0070A1D8 90 NOP
* 0070A1D9 90 NOP
* 0070A1DA 90 NOP
* 0070A1DB 90 NOP
* 0070A1DC 90 NOP
* 0070A1DD E8 06000000 CALL .0070A1E8
* 0070A1E2 58 POP EAX
* 0070A1E3 ^EB B5 JMP SHORT .0070A19A
* 0070A1E5 58 POP EAX
* 0070A1E6 ^EB B7 JMP SHORT .0070A19F
* 0070A1E8 60 PUSHAD
* 0070A1E9 8B74E4 28 MOV ESI,DWORD PTR SS:[ESP+0x28]
* 0070A1ED BF E00B7A00 MOV EDI,.007A0BE0
* 0070A1F2 897CE4 28 MOV DWORD PTR SS:[ESP+0x28],EDI
* 0070A1F6 B9 0C000000 MOV ECX,0xC
* 0070A1FB F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
* 0070A1FD 61 POPAD
* 0070A1FE C3 RETN
* 0070A1FF 0000 ADD BYTE PTR DS:[EAX],AL
* 0070A201 0000 ADD BYTE PTR DS:[EAX],AL
* 0070A203 0000 ADD BYTE PTR DS:[EAX],AL
*
* Modified places:
*
* 005E391C CC INT3
* 005E391D CC INT3
* 005E391E CC INT3
* 005E391F CC INT3
* 005E3920 55 PUSH EBP
* 005E3921 8BEC MOV EBP,ESP
* 005E3923 83E4 C0 AND ESP,0xFFFFFFC0
* 005E3926 83EC 34 SUB ESP,0x34
* 005E3929 53 PUSH EBX
* 005E392A 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+0x8]
* 005E392D 817B 04 00010000 CMP DWORD PTR DS:[EBX+0x4],0x100
* 005E3934 56 PUSH ESI
* 005E3935 57 PUSH EDI
* 005E3936 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+0xC]
* 005E3939 8BF0 MOV ESI,EAX
* 005E393B EB 67 JMP SHORT .005E39A4 ; jichi: here modified point#1, change to always jump to 5e39a4, when enabled it will change font size
* 005E393D 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+0x28]
* 005E3941 50 PUSH EAX
* 005E3942 8D4C24 30 LEA ECX,DWORD PTR SS:[ESP+0x30]
*
* 004EEA6E CC INT3
* 004EEA6F CC INT3
* 004EEA70 6A FF PUSH -0x1
* 004EEA72 68 E8267000 PUSH .007026E8
* 004EEA77 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
* 004EEA7D 50 PUSH EAX
* 004EEA7E 83EC 20 SUB ESP,0x20
* 004EEA81 A1 DCC47700 MOV EAX,DWORD PTR DS:[0x77C4DC]
* 004EEA86 33C4 XOR EAX,ESP
* 004EEA88 894424 1C MOV DWORD PTR SS:[ESP+0x1C],EAX
* 004EEA8C 53 PUSH EBX
* 004EEA8D 55 PUSH EBP
* 004EEA8E 56 PUSH ESI
* 004EEA8F 57 PUSH EDI
* 004EEA90 A1 DCC47700 MOV EAX,DWORD PTR DS:[0x77C4DC]
* 004EEA95 33C4 XOR EAX,ESP
* 004EEA97 50 PUSH EAX
* 004EEA98 8D4424 34 LEA EAX,DWORD PTR SS:[ESP+0x34]
* 004EEA9C 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
* 004EEAA2 8B4424 44 MOV EAX,DWORD PTR SS:[ESP+0x44]
* 004EEAA6 8BF1 MOV ESI,ECX
* 004EEAA8 E8 8346FBFF CALL .004A3130
* 004EEAAD 8BE8 MOV EBP,EAX
* 004EEAAF 33DB XOR EBX,EBX
* 004EEAB1 3BEB CMP EBP,EBX
* 004EEAB3 75 07 JNZ SHORT .004EEABC
* 004EEAB5 32C0 XOR AL,AL
* 004EEAB7 E9 92000000 JMP .004EEB4E
* 004EEABC 8B06 MOV EAX,DWORD PTR DS:[ESI]
* 004EEABE 8B10 MOV EDX,DWORD PTR DS:[EAX]
* 004EEAC0 8BCE MOV ECX,ESI
* 004EEAC2 FFD2 CALL EDX
* 004EEAC4 8BC8 MOV ECX,EAX
* 004EEAC6 C74424 28 0F0000>MOV DWORD PTR SS:[ESP+0x28],0xF
* 004EEACE 895C24 24 MOV DWORD PTR SS:[ESP+0x24],EBX
* 004EEAD2 885C24 14 MOV BYTE PTR SS:[ESP+0x14],BL
* 004EEAD6 8D71 01 LEA ESI,DWORD PTR DS:[ECX+0x1]
* 004EEAD9 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
* 004EEAE0 8A11 MOV DL,BYTE PTR DS:[ECX]
* 004EEAE2 41 INC ECX
* 004EEAE3 3AD3 CMP DL,BL
* 004EEAE5 ^75 F9 JNZ SHORT .004EEAE0
* 004EEAE7 2BCE SUB ECX,ESI
* 004EEAE9 50 PUSH EAX
* 004EEAEA 8BF9 MOV EDI,ECX
* 004EEAEC 8D7424 18 LEA ESI,DWORD PTR SS:[ESP+0x18]
* 004EEAF0 E8 CB27F1FF CALL .004012C0
* 004EEAF5 8B7C24 48 MOV EDI,DWORD PTR SS:[ESP+0x48]
* 004EEAF9 895C24 3C MOV DWORD PTR SS:[ESP+0x3C],EBX
* 004EEAFD 8B75 3C MOV ESI,DWORD PTR SS:[EBP+0x3C]
* 004EEB00 E8 1B4A0100 CALL .00503520
* 004EEB05 8BF8 MOV EDI,EAX
* 004EEB07 8DB7 E4000000 LEA ESI,DWORD PTR DS:[EDI+0xE4]
* 004EEB0D 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+0x14]
* 004EEB11 8BD6 MOV EDX,ESI
* 004EEB13 E8 985CF1FF CALL .004047B0
* 004EEB18 BD 10000000 MOV EBP,0x10
* 004EEB1D 84C0 TEST AL,AL
* 004EEB1F 75 18 JNZ SHORT .004EEB39
* 004EEB21 895E 10 MOV DWORD PTR DS:[ESI+0x10],EBX
* 004EEB24 396E 14 CMP DWORD PTR DS:[ESI+0x14],EBP
* 004EEB27 72 02 JB SHORT .004EEB2B
* 004EEB29 8B36 MOV ESI,DWORD PTR DS:[ESI]
* 004EEB2B 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+0x14]
* 004EEB2F 50 PUSH EAX
* 004EEB30 8BCF MOV ECX,EDI
* 004EEB32 881E MOV BYTE PTR DS:[ESI],BL
* 004EEB34 E9 13B62100 JMP .0070A14C ; jichi: here hookpoint#2, name is modified here, scenario and names are here accessed char by char on the top of the stack
* 004EEB39 396C24 28 CMP DWORD PTR SS:[ESP+0x28],EBP
* 004EEB3D 72 0D JB SHORT .004EEB4C
* 004EEB3F 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+0x14]
* 004EEB43 51 PUSH ECX
* 004EEB44 E8 42DC1900 CALL .0068C78B
* 004EEB49 83C4 04 ADD ESP,0x4
* 004EEB4C B0 01 MOV AL,0x1
* 004EEB4E 8B4C24 34 MOV ECX,DWORD PTR SS:[ESP+0x34]
* 004EEB52 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
* 004EEB59 59 POP ECX
* 004EEB5A 5F POP EDI
* 004EEB5B 5E POP ESI
* 004EEB5C 5D POP EBP
* 004EEB5D 5B POP EBX
* 004EEB5E 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+0x1C]
* 004EEB62 33CC XOR ECX,ESP
* 004EEB64 E8 9CD61900 CALL .0068C205
* 004EEB69 83C4 2C ADD ESP,0x2C
* 004EEB6C C3 RETN
* 004EEB6D CC INT3
* 004EEB6E CC INT3
*
* 005C70EE CC INT3
* 005C70EF CC INT3
* 005C70F0 83EC 18 SUB ESP,0x18
* 005C70F3 A1 DCC47700 MOV EAX,DWORD PTR DS:[0x77C4DC]
* 005C70F8 33C4 XOR EAX,ESP
* 005C70FA 894424 14 MOV DWORD PTR SS:[ESP+0x14],EAX
* 005C70FE 53 PUSH EBX
* 005C70FF 8B5C24 20 MOV EBX,DWORD PTR SS:[ESP+0x20]
* 005C7103 55 PUSH EBP
* 005C7104 8B6C24 2C MOV EBP,DWORD PTR SS:[ESP+0x2C]
* 005C7108 8B45 1C MOV EAX,DWORD PTR SS:[EBP+0x1C]
* 005C710B 56 PUSH ESI
* 005C710C 8BF2 MOV ESI,EDX
* 005C710E 57 PUSH EDI
* 005C710F 8BF9 MOV EDI,ECX
* 005C7111 897424 10 MOV DWORD PTR SS:[ESP+0x10],ESI
* 005C7115 83F8 44 CMP EAX,0x44
* 005C7118 77 7A JA SHORT .005C7194
* 005C711A 0FB680 7C735C00 MOVZX EAX,BYTE PTR DS:[EAX+0x5C737C]
* 005C7121 FF2485 60735C00 JMP DWORD PTR DS:[EAX*4+0x5C7360]
* 005C7128 8B4B 0C MOV ECX,DWORD PTR DS:[EBX+0xC]
* 005C712B 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+0x30]
* 005C712F C1E9 02 SHR ECX,0x2
* 005C7132 3BC1 CMP EAX,ECX
* 005C7134 73 5E JNB SHORT .005C7194
* 005C7136 837B 0C 00 CMP DWORD PTR DS:[EBX+0xC],0x0
* 005C713A 75 1C JNZ SHORT .005C7158
* 005C713C 33DB XOR EBX,EBX
* 005C713E 5F POP EDI
* 005C713F 893483 MOV DWORD PTR DS:[EBX+EAX*4],ESI
* 005C7142 5E POP ESI
* 005C7143 5D POP EBP
* 005C7144 B0 01 MOV AL,0x1
* 005C7146 5B POP EBX
* 005C7147 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+0x14]
* 005C714B 33CC XOR ECX,ESP
* 005C714D E8 B3500C00 CALL .0068C205
* 005C7152 83C4 18 ADD ESP,0x18
* 005C7155 C2 0C00 RETN 0xC
* 005C7158 8B5B 08 MOV EBX,DWORD PTR DS:[EBX+0x8]
* 005C715B 5F POP EDI
* 005C715C 893483 MOV DWORD PTR DS:[EBX+EAX*4],ESI
* 005C715F 5E POP ESI
* 005C7160 5D POP EBP
* 005C7161 B0 01 MOV AL,0x1
* 005C7163 5B POP EBX
* 005C7164 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+0x14]
* 005C7168 33CC XOR ECX,ESP
* 005C716A E8 96500C00 CALL .0068C205
* 005C716F 83C4 18 ADD ESP,0x18
* 005C7172 C2 0C00 RETN 0xC
* 005C7175 F3:0F104424 10 MOVSS XMM0,DWORD PTR SS:[ESP+0x10]
* 005C717B 51 PUSH ECX
* 005C717C 8B4C24 34 MOV ECX,DWORD PTR SS:[ESP+0x34]
* 005C7180 8BC3 MOV EAX,EBX
* 005C7182 F3:0F110424 MOVSS DWORD PTR SS:[ESP],XMM0
* 005C7187 E8 14C7FFFF CALL .005C38A0
* 005C718C 84C0 TEST AL,AL
* 005C718E 0F85 B2010000 JNZ .005C7346
* 005C7194 5F POP EDI
* 005C7195 5E POP ESI
* 005C7196 5D POP EBP
* 005C7197 32C0 XOR AL,AL
* 005C7199 5B POP EBX
* 005C719A 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+0x14]
* 005C719E 33CC XOR ECX,ESP
* 005C71A0 E8 60500C00 CALL .0068C205
* 005C71A5 83C4 18 ADD ESP,0x18
* 005C71A8 C2 0C00 RETN 0xC
* 005C71AB 8B4C24 30 MOV ECX,DWORD PTR SS:[ESP+0x30]
* 005C71AF 8D5424 10 LEA EDX,DWORD PTR SS:[ESP+0x10]
* 005C71B3 52 PUSH EDX
* 005C71B4 8BC3 MOV EAX,EBX
* 005C71B6 E8 25C7FFFF CALL .005C38E0
* 005C71BB 84C0 TEST AL,AL
* 005C71BD ^74 D5 JE SHORT .005C7194
* 005C71BF 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+0x10]
* 005C71C3 8BC7 MOV EAX,EDI
* 005C71C5 E8 D6F0FFFF CALL .005C62A0
* 005C71CA 8BD8 MOV EBX,EAX
* 005C71CC 8BCE MOV ECX,ESI
* 005C71CE 8BC7 MOV EAX,EDI
* 005C71D0 E8 CBF0FFFF CALL .005C62A0
* 005C71D5 85DB TEST EBX,EBX
* 005C71D7 ^74 BB JE SHORT .005C7194
* 005C71D9 85C0 TEST EAX,EAX
* 005C71DB ^74 B7 JE SHORT .005C7194
* 005C71DD 50 PUSH EAX
* 005C71DE 8BC3 MOV EAX,EBX
* 005C71E0 E8 2BCFFFFF CALL .005C4110 ; original function call
* //005C71E0 E9 482F1400 JMP .0070A12D ; jichi: here hookpoint#3, text is modified here, text in [[esp]+0x8]], length in [esp]+0xc
* 005C71E5 ^EB A5 JMP SHORT .005C718C
* 005C71E7 8B47 08 MOV EAX,DWORD PTR DS:[EDI+0x8]
* 005C71EA 8B4F 0C MOV ECX,DWORD PTR DS:[EDI+0xC]
* 005C71ED 2BC8 SUB ECX,EAX
* 005C71EF C1F9 02 SAR ECX,0x2
* 005C71F2 3BF1 CMP ESI,ECX
* 005C71F4 ^73 9E JNB SHORT .005C7194
* 005C71F6 8B34B0 MOV ESI,DWORD PTR DS:[EAX+ESI*4]
* 005C71F9 85F6 TEST ESI,ESI
* 005C71FB ^74 97 JE SHORT .005C7194
*
* 005B640E CC INT3
* 005B640F CC INT3
* 005B6410 53 PUSH EBX
* 005B6411 56 PUSH ESI
* 005B6412 B9 FCFFFFFF MOV ECX,-0x4
* 005B6417 57 PUSH EDI
* 005B6418 8BF8 MOV EDI,EAX
* 005B641A 018F B0020000 ADD DWORD PTR DS:[EDI+0x2B0],ECX
* 005B6420 8B87 B0020000 MOV EAX,DWORD PTR DS:[EDI+0x2B0]
* 005B6426 8B30 MOV ESI,DWORD PTR DS:[EAX]
* 005B6428 018F B0020000 ADD DWORD PTR DS:[EDI+0x2B0],ECX
* 005B642E 8B87 B0020000 MOV EAX,DWORD PTR DS:[EDI+0x2B0]
* 005B6434 8B08 MOV ECX,DWORD PTR DS:[EAX]
* 005B6436 8B87 E0010000 MOV EAX,DWORD PTR DS:[EDI+0x1E0]
* 005B643C 2B87 DC010000 SUB EAX,DWORD PTR DS:[EDI+0x1DC]
* 005B6442 C1F8 02 SAR EAX,0x2
* 005B6445 3BF0 CMP ESI,EAX
* 005B6447 73 0D JNB SHORT .005B6456
* 005B6449 8B87 DC010000 MOV EAX,DWORD PTR DS:[EDI+0x1DC]
* 005B644F 8B14B0 MOV EDX,DWORD PTR DS:[EAX+ESI*4]
* 005B6452 85D2 TEST EDX,EDX
* 005B6454 75 13 JNZ SHORT .005B6469
* 005B6456 68 70757200 PUSH .00727570
* 005B645B 8BCF MOV ECX,EDI
* 005B645D E8 AEC9FFFF CALL .005B2E10
* 005B6462 83C4 04 ADD ESP,0x4
* 005B6465 5F POP EDI
* 005B6466 5E POP ESI
* 005B6467 5B POP EBX
* 005B6468 C3 RETN
* 005B6469 8B9F E0010000 MOV EBX,DWORD PTR DS:[EDI+0x1E0]
* 005B646F 2BD8 SUB EBX,EAX
* 005B6471 C1FB 02 SAR EBX,0x2
* 005B6474 3BCB CMP ECX,EBX
* 005B6476 73 07 JNB SHORT .005B647F
* 005B6478 8B0488 MOV EAX,DWORD PTR DS:[EAX+ECX*4]
* 005B647B 85C0 TEST EAX,EAX
* 005B647D 75 14 JNZ SHORT .005B6493
* 005B647F 51 PUSH ECX
* 005B6480 68 A0757200 PUSH .007275A0
* 005B6485 8BCF MOV ECX,EDI
* 005B6487 E8 84C9FFFF CALL .005B2E10
* 005B648C 83C4 08 ADD ESP,0x8
* 005B648F 5F POP EDI
* 005B6490 5E POP ESI
* 005B6491 5B POP EBX
* 005B6492 C3 RETN
* 005B6493 52 PUSH EDX
* 005B6494 E8 77DC0000 CALL .005C4110
* //005B6494 E9 103D1500 JMP .0070A1A9 ; jichi: here hookpoint#4
* 005B6499 84C0 TEST AL,AL
* 005B649B 75 16 JNZ SHORT .005B64B3
* 005B649D 68 D4757200 PUSH .007275D4
* 005B64A2 B9 F0757200 MOV ECX,.007275F0 ; ASCII "S_ASSIGN"
* 005B64A7 E8 84C8FFFF CALL .005B2D30
* 005B64AC 83C4 04 ADD ESP,0x4
* 005B64AF 5F POP EDI
* 005B64B0 5E POP ESI
* 005B64B1 5B POP EBX
* 005B64B2 C3 RETN
* 005B64B3 8B8F B0020000 MOV ECX,DWORD PTR DS:[EDI+0x2B0]
* 005B64B9 8931 MOV DWORD PTR DS:[ECX],ESI
* 005B64BB 8387 B0020000 04 ADD DWORD PTR DS:[EDI+0x2B0],0x4
* 005B64C2 5F POP EDI
* 005B64C3 5E POP ESI
* 005B64C4 5B POP EBX
* 005B64C5 C3 RETN
* 005B64C6 CC INT3
* 005B64C7 CC INT3
* 005B64C8 CC INT3
*
* Slightly modified #4 in AliceRunPatch.dll
* 101B6C10 5B POP EBX
* 101B6C11 59 POP ECX
* 101B6C12 C3 RETN
* 101B6C13 52 PUSH EDX
* 101B6C14 8BC1 MOV EAX,ECX
* 101B6C16 E9 4E7D1600 JMP .1031E969 ; jichi: hook here
* 101B6C1B 84C0 TEST AL,AL
* 101B6C1D 75 18 JNZ SHORT .101B6C37
* 101B6C1F 68 FCB53310 PUSH .1033B5FC
* 101B6C24 B9 18B63310 MOV ECX,.1033B618 ; ASCII "S_ASSIGN"
* 101B6C29 E8 92B8FFFF CALL .101B24C0
* 101B6C2E 83C4 04 ADD ESP,0x4
* 101B6C31 5F POP EDI
* 101B6C32 5E POP ESI
* 101B6C33 5D POP EBP
* 101B6C34 5B POP EBX
* 101B6C35 59 POP ECX
* 101B6C36 C3 RETN
* 101B6C37 53 PUSH EBX
* 101B6C38 56 PUSH ESI
* 101B6C39 E8 E29C0100 CALL .101D0920
* 101B6C3E 5F POP EDI
* 101B6C3F 5E POP ESI
* 101B6C40 5D POP EBP
* 101B6C41 5B POP EBX
* 101B6C42 59 POP ECX
* 101B6C43 C3 RETN
* 101B6C44 CC INT3
* 101B6C45 CC INT3
* 101B6C46 CC INT3
*
* The function get called to paint string of names for hookpoint #2, text in arg1:
* 0050B69E CC INT3
* 0050B69F CC INT3
* 0050B6A0 55 PUSH EBP
* 0050B6A1 8BEC MOV EBP,ESP
* 0050B6A3 83E4 F8 AND ESP,0xFFFFFFF8
* 0050B6A6 6A FF PUSH -0x1
* 0050B6A8 68 F8277000 PUSH .007027F8
* 0050B6AD 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
* 0050B6B3 50 PUSH EAX
* 0050B6B4 83EC 18 SUB ESP,0x18
* 0050B6B7 53 PUSH EBX
* 0050B6B8 56 PUSH ESI
* 0050B6B9 57 PUSH EDI
* 0050B6BA A1 DCC47700 MOV EAX,DWORD PTR DS:[0x77C4DC]
* 0050B6BF 33C4 XOR EAX,ESP
* 0050B6C1 50 PUSH EAX
* 0050B6C2 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+0x28]
* 0050B6C6 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
* 0050B6CC 8BF9 MOV EDI,ECX
* 0050B6CE 57 PUSH EDI
* 0050B6CF E8 5CEAFFFF CALL .0050A130
* 0050B6D4 8B45 08 MOV EAX,DWORD PTR SS:[EBP+0x8]
* 0050B6D7 6A FF PUSH -0x1
* 0050B6D9 33DB XOR EBX,EBX
* 0050B6DB 53 PUSH EBX
* 0050B6DC 8DB7 E4000000 LEA ESI,DWORD PTR DS:[EDI+0xE4]
* 0050B6E2 50 PUSH EAX
* 0050B6E3 E8 886BEFFF CALL .00402270
* 0050B6E8 895C24 14 MOV DWORD PTR SS:[ESP+0x14],EBX
* 0050B6EC 895C24 18 MOV DWORD PTR SS:[ESP+0x18],EBX
* 0050B6F0 895C24 1C MOV DWORD PTR SS:[ESP+0x1C],EBX
* 0050B6F4 56 PUSH ESI
* 0050B6F5 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+0x18]
* 0050B6F9 51 PUSH ECX
* 0050B6FA 57 PUSH EDI
* 0050B6FB 895C24 3C MOV DWORD PTR SS:[ESP+0x3C],EBX
* 0050B6FF E8 6C290000 CALL .0050E070
* 0050B704 8D5424 14 LEA EDX,DWORD PTR SS:[ESP+0x14]
* 0050B708 8BCF MOV ECX,EDI
* 0050B70A E8 B1010000 CALL .0050B8C0
* 0050B70F 8B7424 14 MOV ESI,DWORD PTR SS:[ESP+0x14]
* 0050B713 C687 E0000000 01 MOV BYTE PTR DS:[EDI+0xE0],0x1
* 0050B71A 3BF3 CMP ESI,EBX
* 0050B71C 74 14 JE SHORT .0050B732
* 0050B71E 8B7C24 18 MOV EDI,DWORD PTR SS:[ESP+0x18]
* 0050B722 8BC6 MOV EAX,ESI
* 0050B724 E8 7751F0FF CALL .004108A0
* 0050B729 56 PUSH ESI
* 0050B72A E8 5C101800 CALL .0068C78B
* 0050B72F 83C4 04 ADD ESP,0x4
* 0050B732 8B4C24 28 MOV ECX,DWORD PTR SS:[ESP+0x28]
* 0050B736 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
* 0050B73D 59 POP ECX
* 0050B73E 5F POP EDI
* 0050B73F 5E POP ESI
* 0050B740 5B POP EBX
* 0050B741 8BE5 MOV ESP,EBP
* 0050B743 5D POP EBP
* 0050B744 C2 0400 RETN 0x4
* 0050B747 CC INT3
* 0050B748 CC INT3
* 0050B749 CC INT3
* 0050B74A CC INT3
* 0050B74B CC INT3
* 0050B74C CC INT3
*
* Function get called for hookpoint #3, text in [arg1+0x10], length in arg1+0xc, only for scenario, function call is looped
* 005C410D CC INT3
* 005C410E CC INT3
* 005C410F CC INT3
* 005C4110 53 PUSH EBX
* 005C4111 8B5C24 08 MOV EBX,DWORD PTR SS:[ESP+0x8]
* 005C4115 837B 0C 00 CMP DWORD PTR DS:[EBX+0xC],0x0
* 005C4119 56 PUSH ESI
* 005C411A 57 PUSH EDI
* 005C411B 8BF0 MOV ESI,EAX
* 005C411D 74 07 JE SHORT .005C4126
* 005C411F 8B43 08 MOV EAX,DWORD PTR DS:[EBX+0x8]
* 005C4122 85C0 TEST EAX,EAX
* 005C4124 75 04 JNZ SHORT .005C412A
* 005C4126 33C0 XOR EAX,EAX
* 005C4128 EB 0F JMP SHORT .005C4139
* 005C412A 8D50 01 LEA EDX,DWORD PTR DS:[EAX+0x1]
* 005C412D 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
* 005C4130 8A08 MOV CL,BYTE PTR DS:[EAX]
* 005C4132 40 INC EAX
* 005C4133 84C9 TEST CL,CL
* 005C4135 ^75 F9 JNZ SHORT .005C4130
* 005C4137 2BC2 SUB EAX,EDX
* 005C4139 8D78 01 LEA EDI,DWORD PTR DS:[EAX+0x1]
* 005C413C 3B7E 0C CMP EDI,DWORD PTR DS:[ESI+0xC]
* 005C413F 76 0F JBE SHORT .005C4150
* 005C4141 E8 FAF7FFFF CALL .005C3940
* 005C4146 84C0 TEST AL,AL
* 005C4148 75 06 JNZ SHORT .005C4150
* 005C414A 5F POP EDI
* 005C414B 5E POP ESI
* 005C414C 5B POP EBX
* 005C414D C2 0400 RETN 0x4
* 005C4150 837B 0C 00 CMP DWORD PTR DS:[EBX+0xC],0x0
* 005C4154 75 04 JNZ SHORT .005C415A
* 005C4156 33C9 XOR ECX,ECX
* 005C4158 EB 03 JMP SHORT .005C415D
* 005C415A 8B4B 08 MOV ECX,DWORD PTR DS:[EBX+0x8]
* 005C415D 837E 0C 00 CMP DWORD PTR DS:[ESI+0xC],0x0
* 005C4161 75 15 JNZ SHORT .005C4178
* 005C4163 57 PUSH EDI
* 005C4164 33C0 XOR EAX,EAX
* 005C4166 51 PUSH ECX
* 005C4167 50 PUSH EAX
* 005C4168 E8 33400D00 CALL .006981A0
* 005C416D 83C4 0C ADD ESP,0xC
* 005C4170 5F POP EDI
* 005C4171 5E POP ESI
* 005C4172 B0 01 MOV AL,0x1
* 005C4174 5B POP EBX
* 005C4175 C2 0400 RETN 0x4
* 005C4178 8B46 08 MOV EAX,DWORD PTR DS:[ESI+0x8]
* 005C417B 57 PUSH EDI
* 005C417C 51 PUSH ECX
* 005C417D 50 PUSH EAX
* 005C417E E8 1D400D00 CALL .006981A0
* 005C4183 83C4 0C ADD ESP,0xC
* 005C4186 5F POP EDI
* 005C4187 5E POP ESI
* 005C4188 B0 01 MOV AL,0x1
* 005C418A 5B POP EBX
* 005C418B C2 0400 RETN 0x4
* 005C418E CC INT3
*/
static bool InsertSystem43NewHook(ULONG startAddress, ULONG stopAddress, LPCSTR hookName)
{
const BYTE bytes[] = {
0xe8, XX4, // 004eeb34 e8 67cb0100 call .0050b6a0 ; jichi: hook here, text on the top of the stack
0x39,0x6c,0x24, 0x28, // 004eeb39 396c24 28 cmp dword ptr ss:[esp+0x28],ebp
0x72, 0x0d, // 004eeb3d 72 0d jb short .004eeb4c
0x8b,0x4c,0x24, 0x14, // 004eeb3f 8b4c24 14 mov ecx,dword ptr ss:[esp+0x14]
0x51, // 004eeb43 51 push ecx
0xe8 //, XX4, // 004eeb44 e8 42dc1900 call .0068c78b
};
enum { addr_offset = 0 };
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);
//GROWL_DWORD(addr);
if (!addr) {
ConsoleOutput("System43+: pattern not found");
return false;
}
//addr = *(DWORD *)(addr+1) + addr + 5; // change to hook to the actual address of function being called
HookParam hp;
hp.address = addr;
hp.type = NO_CONTEXT|USING_STRING|USING_SPLIT|SPLIT_INDIRECT;
//hp.type = NO_CONTEXT|USING_STRING|FIXING_SPLIT;
hp.split_index = 0x10; // use [[esp]+0x10] to differentiate name and thread
// Only name can be modified here, where the value of split is 0x6, and text in 0x2
ConsoleOutput("INSERT System43+");
ConsoleOutput("System43+: disable GDI hooks"); // disable hooking to TextOutA, which is cached
return NewHook(hp, hookName);
}
bool System43New2Filter(LPVOID data, size_t *size, HookParam *)
{
auto text = reinterpret_cast<LPSTR>(data);
auto len = reinterpret_cast<size_t *>(size);
CharReplacer(text, len, '\n', ' ');
if (cpp_strnstr(text, "${", *len)) {
StringFilterBetween(text, len, "${", 3, "}", 1);
}
return true;
}
bool InsertSystem43New2Hook()
{
/*
* Sample games:
* https://vndb.org/r84067
*/
const BYTE bytes[] = {
0xC7, 0x46, 0x10, XX4, // mov [esi+10],00000000
0x72, 0x02, // jb dohnadohna.exe+1BFA7E
0x8B, 0x36, // mov esi,[esi]
0x8B, 0x4C, 0x24, 0x14, // mov ecx,[esp+14]
0x57, // push edi
0xC6, 0x06, 0x00 // mov byte ptr [esi],00 << hook here
};
enum { addr_offset = sizeof(bytes) - 3 };
ULONG range = min(processStopAddress - processStartAddress, MAX_REL_ADDR);
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStartAddress + range);
if (!addr) {
ConsoleOutput("System43new: pattern not found");
return false;
}
HookParam hp;
hp.address = addr + addr_offset;
hp.offset=get_reg(regs::edx);
hp.split = get_reg(regs::esp);
hp.type = NO_CONTEXT | USING_STRING | USING_SPLIT;
hp.filter_fun = System43New2Filter;
ConsoleOutput("INSERT System43new");
return NewHook(hp, "System43new");
}
bool InsertSystem43Hook()
{
if (InsertSystem43New2Hook())
return true;
//bool patched = Util::CheckFile(L"AliceRunPatch.dll");
bool patched = ::GetModuleHandleA("AliceRunPatch.dll");
// Insert new hook first
bool ok = InsertSystem43OldHook(processStartAddress, processStopAddress, patched ? "AliceRunPatch43" : "System43");
ok = InsertSystem43NewHook(processStartAddress, processStopAddress, "System43+") || ok;
return ok;
}
namespace { // unnamed
struct TextArgument // first argument of the scenario hook
{
ULONG *unknown[2];
LPCSTR text;
int size; // text data size including '\0', length = size - 1
int capacity;
ULONG split;
bool isValid() const
{
return size <= capacity && size >= 4 && text && ::strlen(text) + 1 == size // skip translating single text
//&& !Util::allAscii(text)
&& (UINT8)text[0] > 127 && (UINT8)text[size - 3] > 127 // skip text beginning / ending with ascii
&& !::strstr(text, "\x81\x5e"); // "／"
}
};
enum : UINT64 { djb2_hash0 = 5381 };
inline UINT64 djb2(const UINT8 *str, UINT64 hash = djb2_hash0)
{
UINT8 c;
while ((c = *str++))
hash = ((hash << 5) + hash) + c; // hash * 33 + c
return hash;
}inline UINT64 djb2_n2(const char* str, size_t len, UINT64 hash = djb2_hash0)
{
while (len--)
hash = ((hash << 5) + hash) + (*str++); // hash * 33 + c
return hash;
}
inline UINT64 hashByteArraySTD(const std::string& b, UINT64 h = djb2_hash0)
{
return djb2_n2(b.c_str(), b.size(), h);
}
inline UINT64 hashCharArray(const void *lp)
{ return djb2(reinterpret_cast<const UINT8 *>(lp)); }
namespace ScenarioHook {
namespace Private {
bool isOtherText(LPCSTR text)
{
static const char *s[] = {
"\x82\xa2\x82\xa2\x82\xa6" /* いいえ */
, "\x82\xcd\x82\xa2" /* はい */
};
for (int i = 0; i < sizeof(s)/sizeof(*s); i++)
if (::strcmp(text, s[i]) == 0)
return true;
return false;
}
TextArgument *arg_,
argValue_;
/**
* Sample game: Rance03
*
* Caller that related to load/save, which is the only caller get kept:
* 005C68A7 8B86 74010000 MOV EAX,DWORD PTR DS:[ESI+0x174]
* 005C68AD 8B1CA8 MOV EBX,DWORD PTR DS:[EAX+EBP*4]
* 005C68B0 85DB TEST EBX,EBX
* 005C68B2 74 63 JE SHORT Rance03T.005C6917
* 005C68B4 8B86 78010000 MOV EAX,DWORD PTR DS:[ESI+0x178]
* 005C68BA 2B86 74010000 SUB EAX,DWORD PTR DS:[ESI+0x174]
* 005C68C0 C1F8 02 SAR EAX,0x2
* 005C68C3 3BD0 CMP EDX,EAX
* 005C68C5 73 3C JNB SHORT Rance03T.005C6903
* 005C68C7 8B86 74010000 MOV EAX,DWORD PTR DS:[ESI+0x174]
* 005C68CD 8B0C90 MOV ECX,DWORD PTR DS:[EAX+EDX*4]
* 005C68D0 85C9 TEST ECX,ECX
* 005C68D2 74 2F JE SHORT Rance03T.005C6903
* 005C68D4 53 PUSH EBX
* 005C68D5 -E9 26976B09 JMP 09C80000 ; jichi: called
* 005C68DA 84C0 TEST AL,AL
* 005C68DC 75 18 JNZ SHORT Rance03T.005C68F6
* 005C68DE 68 94726E00 PUSH Rance03T.006E7294
* 005C68E3 68 00736E00 PUSH Rance03T.006E7300 ; ASCII "S_ASSIGN"
* 005C68E8 56 PUSH ESI
* 005C68E9 E8 12BBFFFF CALL Rance03T.005C2400
* 005C68EE 83C4 0C ADD ESP,0xC
* 005C68F1 5F POP EDI
* 005C68F2 5E POP ESI
*
* Caller of the scenario thread:
*
* 005D6F80 ^74 BE JE SHORT Rance03T.005D6F40
* 005D6F82 85C0 TEST EAX,EAX
* 005D6F84 ^74 BA JE SHORT Rance03T.005D6F40
* 005D6F86 50 PUSH EAX
* 005D6F87 8BCF MOV ECX,EDI
* 005D6F89 -E9 72907009 JMP 09CE0000 ; jichi: called here
* 005D6F8E ^EB A8 JMP SHORT Rance03T.005D6F38
* 005D6F90 8B46 0C MOV EAX,DWORD PTR DS:[ESI+0xC]
* 005D6F93 2B46 08 SUB EAX,DWORD PTR DS:[ESI+0x8]
* 005D6F96 C1F8 02 SAR EAX,0x2
* 005D6F99 3BD8 CMP EBX,EAX
* 005D6F9B ^73 A3 JNB SHORT Rance03T.005D6F40
* 005D6F9D 8B46 08 MOV EAX,DWORD PTR DS:[ESI+0x8]
* 005D6FA0 8B1C98 MOV EBX,DWORD PTR DS:[EAX+EBX*4]
*/
std::unordered_set<uint64_t> hashes_;
void hookafter2(hook_stack*s,void* data, size_t len){
auto newData =std::string((char*)data,len);
static std::string data_;
data_ = newData;
auto arg = (TextArgument *)s->stack[0]; // arg1
arg_ = arg;
argValue_ = *arg;
arg->text = data_.c_str();
arg->size = data_.size() + 1;
arg->capacity = arg->size;
hashes_.insert(hashCharArray(arg->text));
}
bool hookBefore(hook_stack*s,void* data, size_t* len1,uintptr_t*role)
{
static std::string data_; // persistent storage, which makes this function not thread-safe
//auto split = s->stack[5]; // parent function return address
//auto split = s->stack[10]; // parent's parent function return address
//auto split = *(DWORD *)(s->ecx + 0x10);
auto split = *(DWORD *)(s->ecx + 0x34);
//auto split = *(DWORD *)(s->ecx + 0x48);
// 005C68DA 84C0 TEST AL,AL
//if (*(WORD *)retaddr == 0xc084) // otherwise system text will be translated
// return true;
//if (*(WORD *)retaddr != 0xc084) // only translate one caller
// return true;
// 005D6F8E ^EB A8 JMP SHORT Rance03T.005D6F38
//if (*(WORD *)retaddr != 0xa8eb) // this function has 7 callers, and only one is kept
// return true;
if (split > 0xff || split && split < 0xf)
return false;
auto arg = (TextArgument *)s->stack[0]; // arg1
if (!arg || !arg->isValid()
|| hashes_.find(hashCharArray(arg->text)) != hashes_.end())
return false;
if (arg->size < 0xf && split > 0 && !isOtherText(arg->text))
return false;
//auto sig = Engine::hashThreadSignature(role, split);
//auto role = Engine::OtherRole;
* role = Engine::OtherRole;
if (!isOtherText(arg->text)) {
if (split == 0 && arg->size <= 0x10)
*role = Engine::NameRole;
else if (split >= 2 && split <= 0x14 && split != 3 && split != 0xb || split == 0x22)
*role = Engine::ScenarioRole;
}
write_string_overwrite(data,len1,arg->text);
return true;
}
bool hookAfter(hook_stack*s,void* data, size_t* len1,uintptr_t*role)
{
if (arg_) {
*arg_ = argValue_;
arg_ = nullptr;
}
return false;
}
} // namespace Private
/**
* Sample game: Rance03
*
* Function that is similar to memcpy, found by debugging where game text get modified:
*
* 0069D84F CC INT3
* 0069D850 57 PUSH EDI
* 0069D851 56 PUSH ESI
* 0069D852 8B7424 10 MOV ESI,DWORD PTR SS:[ESP+0x10]
* 0069D856 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+0x14]
* 0069D85A 8B7C24 0C MOV EDI,DWORD PTR SS:[ESP+0xC]
* 0069D85E 8BC1 MOV EAX,ECX
* 0069D860 8BD1 MOV EDX,ECX
* 0069D862 03C6 ADD EAX,ESI
* 0069D864 3BFE CMP EDI,ESI
* 0069D866 76 08 JBE SHORT Rance03T.0069D870
* 0069D868 3BF8 CMP EDI,EAX
* 0069D86A 0F82 68030000 JB Rance03T.0069DBD8
* 0069D870 0FBA25 5CC97500 >BT DWORD PTR DS:[0x75C95C],0x1
* 0069D878 73 07 JNB SHORT Rance03T.0069D881
* 0069D87A F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]
* 0069D87C E9 17030000 JMP Rance03T.0069DB98
* 0069D881 81F9 80000000 CMP ECX,0x80
* 0069D887 0F82 CE010000 JB Rance03T.0069DA5B
* 0069D88D 8BC7 MOV EAX,EDI
* 0069D88F 33C6 XOR EAX,ESI
* 0069D891 A9 0F000000 TEST EAX,0xF
* 0069D896 75 0E JNZ SHORT Rance03T.0069D8A6
* 0069D898 0FBA25 10A47400 >BT DWORD PTR DS:[0x74A410],0x1
* 0069D8A0 0F82 DA040000 JB Rance03T.0069DD80
* 0069D8A6 0FBA25 5CC97500 >BT DWORD PTR DS:[0x75C95C],0x0
* 0069D8AE 0F83 A7010000 JNB Rance03T.0069DA5B
* 0069D8B4 F7C7 03000000 TEST EDI,0x3
* 0069D8BA 0F85 B8010000 JNZ Rance03T.0069DA78
* 0069D8C0 F7C6 03000000 TEST ESI,0x3
* 0069D8C6 0F85 97010000 JNZ Rance03T.0069DA63
* 0069D8CC 0FBAE7 02 BT EDI,0x2
* 0069D8D0 73 0D JNB SHORT Rance03T.0069D8DF
* 0069D8D2 8B06 MOV EAX,DWORD PTR DS:[ESI]
* 0069D8D4 83E9 04 SUB ECX,0x4
* 0069D8D7 8D76 04 LEA ESI,DWORD PTR DS:[ESI+0x4]
* 0069D8DA 8907 MOV DWORD PTR DS:[EDI],EAX
* 0069D8DC 8D7F 04 LEA EDI,DWORD PTR DS:[EDI+0x4]
* 0069D8DF 0FBAE7 03 BT EDI,0x3
* 0069D8E3 73 11 JNB SHORT Rance03T.0069D8F6
* 0069D8E5 F3: PREFIX REP: ; Superfluous prefix
* 0069D8E6 0F7E0E MOVD DWORD PTR DS:[ESI],MM1
* 0069D8E9 83E9 08 SUB ECX,0x8
* 0069D8EC 8D76 08 LEA ESI,DWORD PTR DS:[ESI+0x8]
* 0069D8EF 66:0FD6 ??? ; Unknown command
* 0069D8F2 -0F8D 7F08F7C6 JGE C760E177
* 0069D8F8 07 POP ES ; Modification of segment register
* 0069D8F9 0000 ADD BYTE PTR DS:[EAX],AL
* 0069D8FB 007463 0F ADD BYTE PTR DS:[EBX+0xF],DH
* 0069D8FF BA E6030F83 MOV EDX,0x830F03E6
* 0069D904 B2 00 MOV DL,0x0
* 0069D906 0000 ADD BYTE PTR DS:[EAX],AL
* 0069D908 66:0F6F4E F4 MOVQ MM1,QWORD PTR DS:[ESI-0xC]
* 0069D90D 8D76 F4 LEA ESI,DWORD PTR DS:[ESI-0xC]
* 0069D910 66:0F6F5E 10 MOVQ MM3,QWORD PTR DS:[ESI+0x10]
* 0069D915 83E9 30 SUB ECX,0x30
* 0069D918 66:0F6F46 20 MOVQ MM0,QWORD PTR DS:[ESI+0x20]
* 0069D91D 66:0F6F6E 30 MOVQ MM5,QWORD PTR DS:[ESI+0x30]
* 0069D922 8D76 30 LEA ESI,DWORD PTR DS:[ESI+0x30]
* 0069D925 83F9 30 CMP ECX,0x30
* 0069D928 66:0F6FD3 MOVQ MM2,MM3
* 0069D92C 66:0F3A ??? ; Unknown command
* 0069D92F 0FD90C66 PSUBUSW MM1,QWORD PTR DS:[ESI]
* 0069D933 0F7F1F MOVQ QWORD PTR DS:[EDI],MM3
* 0069D936 66:0F6FE0 MOVQ MM4,MM0
* 0069D93A 66:0F3A ??? ; Unknown command
* 0069D93D 0FC20C66 0F CMPPS XMM1,DQWORD PTR DS:[ESI],0xF
* 0069D942 7F 47 JG SHORT Rance03T.0069D98B
* 0069D944 1066 0F ADC BYTE PTR DS:[ESI+0xF],AH
* 0069D947 6F OUTS DX,DWORD PTR ES:[EDI] ; I/O command
* 0069D948 CD 66 INT 0x66
* 0069D94A 0F3A ??? ; Unknown command
* 0069D94C 0FEC0C66 PADDSB MM1,QWORD PTR DS:[ESI]
* 0069D950 0F7F6F 20 MOVQ QWORD PTR DS:[EDI+0x20],MM5
* 0069D954 8D7F 30 LEA EDI,DWORD PTR DS:[EDI+0x30]
* 0069D957 ^7D B7 JGE SHORT Rance03T.0069D910
* 0069D959 8D76 0C LEA ESI,DWORD PTR DS:[ESI+0xC]
* 0069D95C E9 AF000000 JMP Rance03T.0069DA10
* 0069D961 66:0F6F4E F8 MOVQ MM1,QWORD PTR DS:[ESI-0x8]
* 0069D966 8D76 F8 LEA ESI,DWORD PTR DS:[ESI-0x8]
* 0069D969 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
* 0069D96C 66:0F6F5E 10 MOVQ MM3,QWORD PTR DS:[ESI+0x10]
* 0069D971 83E9 30 SUB ECX,0x30
* 0069D974 66:0F6F46 20 MOVQ MM0,QWORD PTR DS:[ESI+0x20]
* 0069D979 66:0F6F6E 30 MOVQ MM5,QWORD PTR DS:[ESI+0x30]
* 0069D97E 8D76 30 LEA ESI,DWORD PTR DS:[ESI+0x30]
* 0069D981 83F9 30 CMP ECX,0x30
* 0069D984 66:0F6FD3 MOVQ MM2,MM3
* 0069D988 66:0F3A ??? ; Unknown command
* 0069D98B 0FD908 PSUBUSW MM1,QWORD PTR DS:[EAX]
* 0069D98E 66:0F7F1F MOVQ QWORD PTR DS:[EDI],MM3
* 0069D992 66:0F6FE0 MOVQ MM4,MM0
* 0069D996 66:0F3A ??? ; Unknown command
* 0069D999 0FC208 66 CMPPS XMM1,DQWORD PTR DS:[EAX],0x66
* 0069D99D 0F7F47 10 MOVQ QWORD PTR DS:[EDI+0x10],MM0
* 0069D9A1 66:0F6FCD MOVQ MM1,MM5
* 0069D9A5 66:0F3A ??? ; Unknown command
* 0069D9A8 0FEC08 PADDSB MM1,QWORD PTR DS:[EAX]
* 0069D9AB 66:0F7F6F 20 MOVQ QWORD PTR DS:[EDI+0x20],MM5
* 0069D9B0 8D7F 30 LEA EDI,DWORD PTR DS:[EDI+0x30]
* 0069D9B3 ^7D B7 JGE SHORT Rance03T.0069D96C
* 0069D9B5 8D76 08 LEA ESI,DWORD PTR DS:[ESI+0x8]
* 0069D9B8 EB 56 JMP SHORT Rance03T.0069DA10
* 0069D9BA 66:0F6F4E FC MOVQ MM1,QWORD PTR DS:[ESI-0x4]
* 0069D9BF 8D76 FC LEA ESI,DWORD PTR DS:[ESI-0x4]
* 0069D9C2 8BFF MOV EDI,EDI
* 0069D9C4 66:0F6F5E 10 MOVQ MM3,QWORD PTR DS:[ESI+0x10]
* 0069D9C9 83E9 30 SUB ECX,0x30
* 0069D9CC 66:0F6F46 20 MOVQ MM0,QWORD PTR DS:[ESI+0x20]
* 0069D9D1 66:0F6F6E 30 MOVQ MM5,QWORD PTR DS:[ESI+0x30]
* 0069D9D6 8D76 30 LEA ESI,DWORD PTR DS:[ESI+0x30]
* 0069D9D9 83F9 30 CMP ECX,0x30
* 0069D9DC 66:0F6FD3 MOVQ MM2,MM3
* 0069D9E0 66:0F3A ??? ; Unknown command
* 0069D9E3 0FD90466 PSUBUSW MM0,QWORD PTR DS:[ESI]
* 0069D9E7 0F7F1F MOVQ QWORD PTR DS:[EDI],MM3
* 0069D9EA 66:0F6FE0 MOVQ MM4,MM0
* 0069D9EE 66:0F3A ??? ; Unknown command
* 0069D9F1 0FC20466 0F CMPPS XMM0,DQWORD PTR DS:[ESI],0xF
* 0069D9F6 7F 47 JG SHORT Rance03T.0069DA3F
* 0069D9F8 1066 0F ADC BYTE PTR DS:[ESI+0xF],AH
* 0069D9FB 6F OUTS DX,DWORD PTR ES:[EDI] ; I/O command
* 0069D9FC CD 66 INT 0x66
* 0069D9FE 0F3A ??? ; Unknown command
* 0069DA00 0FEC0466 PADDSB MM0,QWORD PTR DS:[ESI]
* 0069DA04 0F7F6F 20 MOVQ QWORD PTR DS:[EDI+0x20],MM5
* 0069DA08 8D7F 30 LEA EDI,DWORD PTR DS:[EDI+0x30]
* 0069DA0B ^7D B7 JGE SHORT Rance03T.0069D9C4
* 0069DA0D 8D76 04 LEA ESI,DWORD PTR DS:[ESI+0x4]
* 0069DA10 83F9 10 CMP ECX,0x10
* 0069DA13 7C 13 JL SHORT Rance03T.0069DA28
* 0069DA15 F3: PREFIX REP: ; Superfluous prefix
* 0069DA16 0F6F0E MOVQ MM1,QWORD PTR DS:[ESI]
* 0069DA19 83E9 10 SUB ECX,0x10
* 0069DA1C 8D76 10 LEA ESI,DWORD PTR DS:[ESI+0x10]
* 0069DA1F 66:0F7F0F MOVQ QWORD PTR DS:[EDI],MM1
* 0069DA23 8D7F 10 LEA EDI,DWORD PTR DS:[EDI+0x10]
* 0069DA26 ^EB E8 JMP SHORT Rance03T.0069DA10
* 0069DA28 0FBAE1 02 BT ECX,0x2
* 0069DA2C 73 0D JNB SHORT Rance03T.0069DA3B
* 0069DA2E 8B06 MOV EAX,DWORD PTR DS:[ESI]
* 0069DA30 83E9 04 SUB ECX,0x4
* 0069DA33 8D76 04 LEA ESI,DWORD PTR DS:[ESI+0x4]
* 0069DA36 8907 MOV DWORD PTR DS:[EDI],EAX
* 0069DA38 8D7F 04 LEA EDI,DWORD PTR DS:[EDI+0x4]
* 0069DA3B 0FBAE1 03 BT ECX,0x3
* 0069DA3F 73 11 JNB SHORT Rance03T.0069DA52
* 0069DA41 F3: PREFIX REP: ; Superfluous prefix
* 0069DA42 0F7E0E MOVD DWORD PTR DS:[ESI],MM1
* 0069DA45 83E9 08 SUB ECX,0x8
* 0069DA48 8D76 08 LEA ESI,DWORD PTR DS:[ESI+0x8]
* 0069DA4B 66:0FD6 ??? ; Unknown command
* 0069DA4E -0F8D 7F088B04 JGE 04F4E2D3
* 0069DA54 8D88 DB6900FF LEA ECX,DWORD PTR DS:[EAX+0xFF0069DB]
* 0069DA5A ^E0 F7 LOOPDNE SHORT Rance03T.0069DA53
* 0069DA5C C703 00000075 MOV DWORD PTR DS:[EBX],0x75000000
* 0069DA62 15 C1E90283 ADC EAX,0x8302E9C1
* 0069DA67 E2 03 LOOPD SHORT Rance03T.0069DA6C
* 0069DA69 83F9 08 CMP ECX,0x8
* 0069DA6C 72 2A JB SHORT Rance03T.0069DA98
* 0069DA6E F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI>
* 0069DA70 FF2495 88DB6900 JMP DWORD PTR DS:[EDX*4+0x69DB88]
* 0069DA77 90 NOP
*
* 0012F810 0B4D3F30
* 0012F814 06128970
* 0012F818 005D3E12 RETURN to Rance03T.005D3E12 from Rance03T.0069D850
* 0012F81C 06160B98 ; jichi: target text
* 0012F820 07F8CA80 ; jichi: source text
* 0012F824 00000017 ; jichi: size including \0
* 0012F828 00384460
* 0012F82C 00384240
* 0012F830 0B4D3F30
* 0012F834 005C68DA RETURN to Rance03T.005C68DA from Rance03T.005D3D90
* 0012F838 0B4D3F30
* 0012F83C 0012FAA8
* 0012F840 00384240
* 0012F844 0012F85C
* 0012F848 0012FF18
* 0012F84C 005C1693 RETURN to Rance03T.005C1693 from Rance03T.005C6870
* 0012F850 0012FAA8
* 0012F854 00384240
* 0012F858 0000000F
* 0012F85C /0012FF3C
*
* Actual hooked function:
* 005D3D8B CC INT3
* 005D3D8C CC INT3
* 005D3D8D CC INT3
* 005D3D8E CC INT3
* 005D3D8F CC INT3
* 005D3D90 53 PUSH EBX
* 005D3D91 56 PUSH ESI
* 005D3D92 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+0xC]
* 005D3D96 57 PUSH EDI
* 005D3D97 8BF9 MOV EDI,ECX
* 005D3D99 837E 0C 00 CMP DWORD PTR DS:[ESI+0xC],0x0
* 005D3D9D 74 1C JE SHORT Rance03T.005D3DBB
* 005D3D9F 8B56 08 MOV EDX,DWORD PTR DS:[ESI+0x8]
* 005D3DA2 85D2 TEST EDX,EDX
* 005D3DA4 74 15 JE SHORT Rance03T.005D3DBB
* 005D3DA6 8D4A 01 LEA ECX,DWORD PTR DS:[EDX+0x1]
* 005D3DA9 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
* 005D3DB0 8A02 MOV AL,BYTE PTR DS:[EDX]
* 005D3DB2 42 INC EDX
* 005D3DB3 84C0 TEST AL,AL
* 005D3DB5 ^75 F9 JNZ SHORT Rance03T.005D3DB0
* 005D3DB7 2BD1 SUB EDX,ECX
* 005D3DB9 EB 02 JMP SHORT Rance03T.005D3DBD
* 005D3DBB 33D2 XOR EDX,EDX
* 005D3DBD 8D5A 01 LEA EBX,DWORD PTR DS:[EDX+0x1]
* 005D3DC0 3B5F 0C CMP EBX,DWORD PTR DS:[EDI+0xC]
* 005D3DC3 76 1A JBE SHORT Rance03T.005D3DDF
* 005D3DC5 53 PUSH EBX
* 005D3DC6 8D4F 04 LEA ECX,DWORD PTR DS:[EDI+0x4]
* 005D3DC9 C747 0C 00000000 MOV DWORD PTR DS:[EDI+0xC],0x0
* 005D3DD0 E8 DB700700 CALL Rance03T.0064AEB0
* 005D3DD5 84C0 TEST AL,AL
* 005D3DD7 75 06 JNZ SHORT Rance03T.005D3DDF
* 005D3DD9 5F POP EDI
* 005D3DDA 5E POP ESI
* 005D3DDB 5B POP EBX
* 005D3DDC C2 0400 RETN 0x4
* 005D3DDF 837E 0C 00 CMP DWORD PTR DS:[ESI+0xC],0x0
* 005D3DE3 75 04 JNZ SHORT Rance03T.005D3DE9
* 005D3DE5 33C9 XOR ECX,ECX
* 005D3DE7 EB 03 JMP SHORT Rance03T.005D3DEC
* 005D3DE9 8B4E 08 MOV ECX,DWORD PTR DS:[ESI+0x8]
* 005D3DEC 837F 0C 00 CMP DWORD PTR DS:[EDI+0xC],0x0
* 005D3DF0 75 15 JNZ SHORT Rance03T.005D3E07
* 005D3DF2 53 PUSH EBX
* 005D3DF3 33C0 XOR EAX,EAX
* 005D3DF5 51 PUSH ECX
* 005D3DF6 50 PUSH EAX
* 005D3DF7 E8 549A0C00 CALL Rance03T.0069D850
* 005D3DFC 83C4 0C ADD ESP,0xC
* 005D3DFF B0 01 MOV AL,0x1
* 005D3E01 5F POP EDI
* 005D3E02 5E POP ESI
* 005D3E03 5B POP EBX
* 005D3E04 C2 0400 RETN 0x4
* 005D3E07 8B47 08 MOV EAX,DWORD PTR DS:[EDI+0x8]
* 005D3E0A 53 PUSH EBX
* 005D3E0B 51 PUSH ECX
* 005D3E0C 50 PUSH EAX
* 005D3E0D -E9 EEC1A201 JMP 02000000 ; jichi: called here
* 005D3E12 83C4 0C ADD ESP,0xC
* 005D3E15 B0 01 MOV AL,0x1
* 005D3E17 5F POP EDI
* 005D3E18 5E POP ESI
* 005D3E19 5B POP EBX
* 005D3E1A C2 0400 RETN 0x4
* 005D3E1D CC INT3
* 005D3E1E CC INT3
* 005D3E1F CC INT3
*
* Arg1 of this function:
* 07B743F8 90 7A 70 00 F4 87 70 00 70 0E 27 08 1B 00 00 00 諏p.p.p'...
* 07B74408 20 00 00 00 02 00 00 00 01 00 00 00 CC 7F 2D 00 .........ﾌ-.
* 07B74418 B3 52 41 00 FF FF FF FF EC 87 70 00 10 E3 1D 08 ｳRA.・p.・
*
* Caller that preserved:
* 005C68A7 8B86 74010000 MOV EAX,DWORD PTR DS:[ESI+0x174]
* 005C68AD 8B1CA8 MOV EBX,DWORD PTR DS:[EAX+EBP*4]
* 005C68B0 85DB TEST EBX,EBX
* 005C68B2 74 63 JE SHORT Rance03T.005C6917
* 005C68B4 8B86 78010000 MOV EAX,DWORD PTR DS:[ESI+0x178]
* 005C68BA 2B86 74010000 SUB EAX,DWORD PTR DS:[ESI+0x174]
* 005C68C0 C1F8 02 SAR EAX,0x2
* 005C68C3 3BD0 CMP EDX,EAX
* 005C68C5 73 3C JNB SHORT Rance03T.005C6903
* 005C68C7 8B86 74010000 MOV EAX,DWORD PTR DS:[ESI+0x174]
* 005C68CD 8B0C90 MOV ECX,DWORD PTR DS:[EAX+EDX*4]
* 005C68D0 85C9 TEST ECX,ECX
* 005C68D2 74 2F JE SHORT Rance03T.005C6903
* 005C68D4 53 PUSH EBX
* 005C68D5 E8 B6D40000 CALL Rance03T.005D3D90 ; jichi: called
* 005C68DA 84C0 TEST AL,AL ; jichi: retaddr
* 005C68DC 75 18 JNZ SHORT Rance03T.005C68F6
* 005C68DE 68 94726E00 PUSH Rance03T.006E7294
* 005C68E3 68 00736E00 PUSH Rance03T.006E7300 ; ASCII "S_ASSIGN"
* 005C68E8 56 PUSH ESI
* 005C68E9 E8 12BBFFFF CALL Rance03T.005C2400
* 005C68EE 83C4 0C ADD ESP,0xC
* 005C68F1 5F POP EDI
* 005C68F2 5E POP ESI
*/
bool attach(ULONG startAddress, ULONG stopAddress)
{
const uint8_t bytes[] = {
0x53, // 005D3D90 53 PUSH EBX
0x56, // 005D3D91 56 PUSH ESI
0x8B,0x74,0x24, 0x0C, // 005D3D92 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+0xC]
0x57, // 005D3D96 57 PUSH EDI
0x8B,0xF9, // 005D3D97 8BF9 MOV EDI,ECX
0x83,0x7E, 0x0C, 0x00, // 005D3D99 837E 0C 00 CMP DWORD PTR DS:[ESI+0xC],0x0
0x74, 0x1C, // 005D3D9D 74 1C JE SHORT Rance03T.005D3DBB
0x8B,0x56, 0x08, // 005D3D9F 8B56 08 MOV EDX,DWORD PTR DS:[ESI+0x8]
0x85,0xD2, // 005D3DA2 85D2 TEST EDX,EDX
0x74, 0x15, // 005D3DA4 74 15 JE SHORT Rance03T.005D3DBB
0x8D,0x4A, 0x01, // 005D3DA6 8D4A 01 LEA ECX,DWORD PTR DS:[EDX+0x1]
0x8D,0xA4,0x24, 0x00,0x00,0x00,0x00, // 005D3DA9 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
0x8A,0x02, // 005D3DB0 8A02 MOV AL,BYTE PTR DS:[EDX]
0x42, // 005D3DB2 42 INC EDX
0x84,0xC0 // 005D3DB3 84C0 TEST AL,AL
};
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
if (!addr)
return false;
//addr = MemDbg::findEnclosingAlignedFunction(addr);
//if (!addr)
// return false;
//addr = 0x005D3D90;
//return winhook::hook_before(addr, Private::hookBefore);
int count = 0;
auto fun = [&count](ULONG addr) -> bool {
auto retaddr = addr + 5;
// 005C68DA 84C0 TEST AL,AL
if (*(WORD *)retaddr == 0xc084)
//auto before = std::bind(Private::hookBefore, addr + 5, std::placeholders::_1);
count +=1;
HookParam hp;
hp.address=addr;
hp.type=EMBED_ABLE|EMBED_DYNA_SJIS;
hp.hook_before=Private::hookBefore;
hp.hook_after=Private::hookafter2;
auto succ=NewHook(hp,"EmbedSysmtem44");
hp.address=addr+5;
hp.hook_before=Private::hookAfter;
succ|=NewHook(hp,"EmbedSysmtem44");
return succ; // replace all functions
};
MemDbg::iterNearCallAddress(fun, addr, startAddress, stopAddress);
return count;
}
} // namespace ScenarioHook
} // unnamed namespace
bool attachSystem44(ULONG startAddress, ULONG stopAddress)
{ return ScenarioHook::attach(startAddress, stopAddress); }
namespace { // unnamed
// - Search -
ULONG searchScenarioAddress(ULONG startAddress, ULONG stopAddress)
{
const uint8_t bytes[] = {
0xe8, XX4, // 005c71e0 e8 2bcfffff call .005c4110 ; original function call
0xeb, 0xa5, // 005c71e5 ^eb a5 jmp short .005c718c
0x8b,0x47, 0x08, // 005c71e7 8b47 08 mov eax,dword ptr ds:[edi+0x8]
0x8b,0x4f, 0x0c // 005c71ea 8b4f 0c mov ecx,dword ptr ds:[edi+0xc]
};
return MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
}
ULONG searchNameAddress(ULONG startAddress, ULONG stopAddress)
{
const uint8_t bytes[] = {
0xe8, XX4, // 004eeb34 e8 67cb0100 call .0050b6a0 ; jichi: hook here
0x39,0x6c,0x24, 0x28, // 004eeb39 396c24 28 cmp dword ptr ss:[esp+0x28],ebp
0x72, 0x0d, // 004eeb3d 72 0d jb short .004eeb4c
0x8b,0x4c,0x24, 0x14, // 004eeb3f 8b4c24 14 mov ecx,dword ptr ss:[esp+0x14]
0x51, // 004eeb43 51 push ecx
0xe8 //, XX4, // 004eeb44 e8 42dc1900 call .0068c78b
};
return MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
}
ULONG searchOtherAddress(ULONG startAddress, ULONG stopAddress)
{
const char *pattern = "S_ASSIGN";
const uint8_t bytes[] = {
//0xc3, // 005b6492 c3 retn
//0x52, // 005b6493 52 push edx
0xe8, XX4, // 005b6494 e8 77dc0000 call .005c4110 ; jichi: hook here
0x84,0xc0, // 005b6499 84c0 test al,al
0x75, XX, // 005b649b 75 16 jnz short .005b64b3
0x68, XX4, // 005b649d 68 d4757200 push .007275d4
0xb9 //, XX4, // 005b64a2 b9 f0757200 mov ecx,.007275f0 ; ascii "S_ASSIGN"
//0xe8, XX4 // 005b64a7 e8 84c8ffff call .005b2d30
};
for (ULONG addr = startAddress; addr < stopAddress;) {
addr = MemDbg::findBytes(bytes, sizeof(bytes), addr, stopAddress);
if (!addr)
return 0;
addr += sizeof(bytes);
DWORD ecx = *(DWORD *)addr;
if (::strcmp((LPCSTR)ecx, pattern) == 0)
return addr - sizeof(bytes);
};
return 0;
}
// - Hook -
struct TextHookBase
{
struct TextArgument // first argument of the scenario hook
{
DWORD unknown1,
unknown2;
LPCSTR text;
DWORD size; // text data size, length = size - 1
//DWORD split; // not a good split to distinguish translable text out
};
bool enabled_,
editable_; // for debugging only, whether text is not read-only
std::string buffer_; // persistent storage, which makes this function not thread-safe
TextArgument *arg_; // last argument
LPCSTR text_; // last text
DWORD size_; // last size
TextHookBase()
: enabled_(true)
, editable_(true)
, arg_(nullptr)
, text_(nullptr)
, size_(0)
{}
};
class ScenarioHook43 : protected TextHookBase
{
public:
bool hookBefore(hook_stack*s,void* data, size_t* len,uintptr_t*role)
{
// See ATcode patch:
// 0070A12E 8B87 B0000000 MOV EAX,DWORD PTR DS:[EDI+0xB0]
// 0070A134 66:8138 8400 CMP WORD PTR DS:[EAX],0x84
// 0070A139 75 0E JNZ SHORT .0070A149
// 0070A13B 8378 EA 5B CMP DWORD PTR DS:[EAX-0x16],0x5B
// 0070A13F 75 08 JNZ SHORT .0070A149
DWORD split = *(WORD *)(s->edi + 0xb0);
if (split && split != 0x27f2) // new System43 after Evenicle
return false;
if (!split) { // old System43 before Evenicle where edi split is zero
split = s->stack[1];
if (split != 0x84)
return false;
// Stack structure observed from 武想少女隊
// 0012F4BC 07EAFD48 ; text address
// 0012F4C0 000002EC ; use this value as split
// 0012F4C4 00000011
// 0012F4C8 0012F510
// 0012F4CC 00000012
// 0012F4D0 00001BAA
// 0012F4D4 00000012
// 0012F4D8 06D2E24C
// 0012F4DC 00581125 RETURN to .00581125 from .0057DC30
//if (s->stack[1] != 0x84)
// return true;
//if (s->stack[2] != 0x3)
// return true;
}
auto arg = (TextArgument *)s->stack[0]; // top of the stack
LPCSTR text = arg->text;
if (arg->size <= 1 || !text || !*text || all_ascii(text))
return false;
*role = Engine::ScenarioRole ;
return write_string_overwrite(data,len,text);
}
bool hookAfter(hook_stack*s,void* data, size_t* len,uintptr_t*role)
{
if (arg_) {
arg_->text = text_;
arg_->size = size_;
arg_ = nullptr;
}
return true;
}
};
class OtherHook43 : protected TextHookBase
{
public:
bool hookBefore(hook_stack*s,void* data, size_t* len,uintptr_t*role)
{
if (!enabled_)
return false;
DWORD splitBase = *(DWORD *)(s->edi + 0x284); // [edi + 0x284]
if (!Engine::isAddressReadable(splitBase)) {
enabled_ = false;
return false;
}
DWORD split1 = *(WORD *)(splitBase - 0x4), // word [[edi + 0x284] - 0x4]
split2 = *(WORD *)(splitBase - 0x8); // word [[edi + 0x284] - 0x8]
enum : WORD { OtherSplit = 0x46 }; // 0x440046 if use dword split
if (split1 != OtherSplit || split2 <= 2) // split internal system messages
return false;
auto arg = (TextArgument *)s->stack[0]; // top of the stack
// auto g = EngineController::instance();
LPCSTR text = arg->text;
if (arg->size <= 1 || !text || !*text || all_ascii(text))
return false;
return write_string_overwrite(data,len,text);
}
bool hookAfter(hook_stack*s,void* data, size_t* len,uintptr_t*role)
{
if (arg_) {
arg_->text = text_;
arg_->size = size_;
arg_ = nullptr;
}
return false;
}
};
// Text with fixed size
bool fixedTextHook(hook_stack*s,void* data, size_t* len,uintptr_t*role)
{
enum { FixedSize = 0x10 };
struct FixedArgument // first argument of the name hook
{
char text[FixedSize]; // 0x10
DWORD type, // [[esp]+0x10]
type2; // [[esp]+0x14]
};
auto arg = (FixedArgument *)s->stack[0];
if (arg->type2 != 0xf) // non 0xf is garbage text
return false;
char *text = arg->text;
if (!text || !*text || all_ascii(text))
return false;
* role;
long sig;
if (arg->type == 0x6 || arg->type == 0xc) {
*role = Engine::NameRole;
} else if (::strlen(text) <= 2) // skip translating very short other text
return false;
else {
*role = Engine::OtherRole;
}
return write_string_overwrite(data,len,text);
}
} // unnamed namespace
bool attachSystem43(ULONG startAddress, ULONG stopAddress)
{
//太麻煩 放棄。
return false;
{
//ULONG addr = 0x005c71e0;
ULONG addr = ::searchScenarioAddress(startAddress, stopAddress);
if (!addr)
return false;
/* static auto h = new ScenarioHook43; // never deleted
if (!winhook::hook_both(addr,
std::bind(&ScenarioHook43::hookBefore, h, _1),
std::bind(&ScenarioHook43::hookAfter, h, _1)))
return false;
*/
}
/*
if (ULONG addr = ::searchOtherAddress(startAddress, stopAddress)) {
static auto h = new OtherHook; // never deleted
if (!winhook::hook_both(addr,
std::bind(&OtherHook43::hookBefore, h, _1),
std::bind(&OtherHook43::hookAfter, h, _1)))
DOUT("other text NOT FOUND");
else
DOUT("other text address" << QString::number(addr, 16));
}
if (ULONG addr = ::searchNameAddress(startAddress, stopAddress)) {
if (winhook::hook_before(addr, ::fixedTextHook))
DOUT("name text address" << QString::number(addr, 16));
else
DOUT("name text NOT FOUND");
}
*/
//HijackManager::instance()->attachFunction((ULONG)::MultiByteToWideChar);
return true;
}
namespace{
bool system4X(ULONG startAddress, ULONG stopAddress){
if (attachSystem43(startAddress, stopAddress)) {
return true;
} else if (attachSystem44(startAddress, stopAddress)) {
return true;
} else
return false;
}
}
namespace{
bool System42Filter(LPVOID data, size_t *size, HookParam *)
{
auto text = reinterpret_cast<LPSTR>(data);
auto len = reinterpret_cast<size_t *>(size);
if (*len == 1)
return false;
if (all_ascii(text, *len)) {
CharReplacer(text, len, '`', ' ');
CharReplacer(text, len, '\x7D', '-');
}
return true;
}
bool InsertSystem42Hook() {
/*
* Sample games:
* https://vndb.org/v1427
*/
const BYTE bytes[] = {
0x8B, 0x46, 0x04, // mov eax,[esi+04]
0x57, // push edi
0x52, // push edx
0x50, // push eax
0xE8, XX4 // call Sys42VM.DLL+4B5B0
};
HMODULE module = GetModuleHandleW(L"Sys42VM.dll");
auto [minAddress, maxAddress] = Util::QueryModuleLimits(module);
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), minAddress, maxAddress);
if (!addr)
return false;
HookParam hp;
hp.address = addr;
hp.offset=get_reg(regs::edx);
hp.split =get_reg(regs::esp);
hp.type = NO_CONTEXT | USING_STRING | USING_SPLIT;
hp.filter_fun = System42Filter;
ConsoleOutput("INSERT System42");
return NewHook(hp, "System42");
}
}
bool System4x::attach_function() {
if (Util::CheckFile(L"DLL/Sys42VM.dll"))
if (InsertSystem42Hook())
return true;
auto _=system4X(processStartAddress,processStopAddress);
return InsertSystem43Hook()||_;
}
Reference in New Issue View Git Blame Copy Permalink