mirror of
https://github.com/HIllya51/LunaHook.git
synced 2024-11-23 22:05:36 +08:00
621 lines
24 KiB
C++
621 lines
24 KiB
C++
#include"GXP.h"
|
||
/**
|
||
* jichi 5/11/2014: Hook to the beginning of a function
|
||
*
|
||
* Executable description shows "AVGEngineV2"
|
||
*
|
||
* Cached wrong text can also be found in GetGlyphOutlineW.
|
||
*
|
||
* 4/27/2015 old logic:
|
||
* 1. find the following location
|
||
* 00A78144 66:833C70 00 CMP WORD PTR DS:[EAX+ESI*2],0x0
|
||
* i.e. 0x66833C7000
|
||
* There are several matches, the first one is used.
|
||
* 2. find the first push operation after it
|
||
* 3. find the function call after push, and hook to it
|
||
* The text is in the arg1, which is character by character
|
||
*
|
||
* But in the new game since ウルスラグ<E383A9> there the function call is not immediately after 0x66833C7000 any more.
|
||
* My own way to find the function to hook is as follows:
|
||
* 1. find the following location
|
||
* 00A78144 66:833C70 00 CMP WORD PTR DS:[EAX+ESI*2],0x0
|
||
* i.e. 0x66833C7000
|
||
* There are several matches, the first one is used.
|
||
* 2. Use Ollydbg to debug step by step until the first function call is encountered
|
||
* Then, the text character is directly on the stack
|
||
*
|
||
* Here's an example of Demonion II (reladdr = 0x18c540):
|
||
* The text is displayed character by character.
|
||
* sub_58C540 proc near
|
||
* arg_0 = dword ptr 8 // LPCSTR with 1 character
|
||
*
|
||
* 0138C540 /$ 55 PUSH EBP
|
||
* 0138C541 |. 8BEC MOV EBP,ESP
|
||
* 0138C543 |. 83E4 F8 AND ESP,0xFFFFFFF8
|
||
* 0138C546 |. 8B43 0C MOV EAX,DWORD PTR DS:[EBX+0xC]
|
||
* 0138C549 |. 83EC 08 SUB ESP,0x8
|
||
* 0138C54C |. 56 PUSH ESI
|
||
* 0138C54D |. 57 PUSH EDI
|
||
* 0138C54E |. 85C0 TEST EAX,EAX
|
||
* 0138C550 |. 75 04 JNZ SHORT demonion.0138C556
|
||
* 0138C552 |. 33F6 XOR ESI,ESI
|
||
* 0138C554 |. EB 18 JMP SHORT demonion.0138C56E
|
||
* 0138C556 |> 8B4B 14 MOV ECX,DWORD PTR DS:[EBX+0x14]
|
||
* 0138C559 |. 2BC8 SUB ECX,EAX
|
||
* 0138C55B |. B8 93244992 MOV EAX,0x92492493
|
||
* 0138C560 |. F7E9 IMUL ECX
|
||
* 0138C562 |. 03D1 ADD EDX,ECX
|
||
* 0138C564 |. C1FA 04 SAR EDX,0x4
|
||
* 0138C567 |. 8BF2 MOV ESI,EDX
|
||
* 0138C569 |. C1EE 1F SHR ESI,0x1F
|
||
* 0138C56C |. 03F2 ADD ESI,EDX
|
||
* 0138C56E |> 8B7B 10 MOV EDI,DWORD PTR DS:[EBX+0x10]
|
||
* 0138C571 |. 8BCF MOV ECX,EDI
|
||
* 0138C573 |. 2B4B 0C SUB ECX,DWORD PTR DS:[EBX+0xC]
|
||
* 0138C576 |. B8 93244992 MOV EAX,0x92492493
|
||
* 0138C57B |. F7E9 IMUL ECX
|
||
* 0138C57D |. 03D1 ADD EDX,ECX
|
||
* 0138C57F |. C1FA 04 SAR EDX,0x4
|
||
* 0138C582 |. 8BC2 MOV EAX,EDX
|
||
* 0138C584 |. C1E8 1F SHR EAX,0x1F
|
||
* 0138C587 |. 03C2 ADD EAX,EDX
|
||
* 0138C589 |. 3BC6 CMP EAX,ESI
|
||
* 0138C58B |. 73 2F JNB SHORT demonion.0138C5BC
|
||
* 0138C58D |. C64424 08 00 MOV BYTE PTR SS:[ESP+0x8],0x0
|
||
* 0138C592 |. 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+0x8]
|
||
* 0138C596 |. 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+0x8]
|
||
* 0138C59A |. 51 PUSH ECX
|
||
* 0138C59B |. 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+0x8]
|
||
* 0138C59E |. 52 PUSH EDX
|
||
* 0138C59F |. B8 01000000 MOV EAX,0x1
|
||
* 0138C5A4 |. 8BD7 MOV EDX,EDI
|
||
* 0138C5A6 |. E8 F50E0000 CALL demonion.0138D4A0
|
||
* 0138C5AB |. 83C4 08 ADD ESP,0x8
|
||
* 0138C5AE |. 83C7 1C ADD EDI,0x1C
|
||
* 0138C5B1 |. 897B 10 MOV DWORD PTR DS:[EBX+0x10],EDI
|
||
* 0138C5B4 |. 5F POP EDI
|
||
* 0138C5B5 |. 5E POP ESI
|
||
* 0138C5B6 |. 8BE5 MOV ESP,EBP
|
||
* 0138C5B8 |. 5D POP EBP
|
||
* 0138C5B9 |. C2 0400 RETN 0x4
|
||
* 0138C5BC |> 397B 0C CMP DWORD PTR DS:[EBX+0xC],EDI
|
||
* 0138C5BF |. 76 05 JBE SHORT demonion.0138C5C6
|
||
* 0138C5C1 |. E8 1B060D00 CALL demonion.0145CBE1
|
||
* 0138C5C6 |> 8B03 MOV EAX,DWORD PTR DS:[EBX]
|
||
* 0138C5C8 |. 57 PUSH EDI ; /Arg4
|
||
* 0138C5C9 |. 50 PUSH EAX ; |Arg3
|
||
* 0138C5CA |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+0x8] ; |
|
||
* 0138C5CD |. 50 PUSH EAX ; |Arg2
|
||
* 0138C5CE |. 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+0x14] ; |
|
||
* 0138C5D2 |. 51 PUSH ECX ; |Arg1
|
||
* 0138C5D3 |. 8BC3 MOV EAX,EBX ; |
|
||
* 0138C5D5 |. E8 D6010000 CALL demonion.0138C7B0 ; \demonion.0138C7B0
|
||
* 0138C5DA |. 5F POP EDI
|
||
* 0138C5DB |. 5E POP ESI
|
||
* 0138C5DC |. 8BE5 MOV ESP,EBP
|
||
* 0138C5DE |. 5D POP EBP
|
||
* 0138C5DF \. C2 0400 RETN 0x4
|
||
*
|
||
* 4/26/2015 ウルスラグ<E383A9> * base = 0xa30000, old hook addr = 0xbe6360
|
||
*
|
||
* 00A7813A EB 02 JMP SHORT .00A7813E
|
||
* 00A7813C 8BC7 MOV EAX,EDI
|
||
* 00A7813E 8BB3 E4020000 MOV ESI,DWORD PTR DS:[EBX+0x2E4]
|
||
* 00A78144 66:833C70 00 CMP WORD PTR DS:[EAX+ESI*2],0x0 ; jich: here's the first found segment
|
||
* 00A78149 74 36 JE SHORT .00A78181
|
||
* 00A7814B 837F 14 08 CMP DWORD PTR DS:[EDI+0x14],0x8
|
||
* 00A7814F 72 08 JB SHORT .00A78159
|
||
* 00A78151 8B07 MOV EAX,DWORD PTR DS:[EDI]
|
||
*
|
||
* 00A7883A 24 3C AND AL,0x3C
|
||
* 00A7883C 50 PUSH EAX
|
||
* 00A7883D C74424 4C 000000>MOV DWORD PTR SS:[ESP+0x4C],0x0
|
||
* 00A78845 0F5B ??? ; Unknown command
|
||
* 00A78847 C9 LEAVE
|
||
* 00A78848 F3:0F114424 44 MOVSS DWORD PTR SS:[ESP+0x44],XMM0
|
||
* 00A7884E F3:0F114C24 48 MOVSS DWORD PTR SS:[ESP+0x48],XMM1
|
||
* 00A78854 E8 37040000 CALL .00A78C90 ; jichi: here's the target function to hook to, text char on the stack[0]
|
||
* 00A78859 A1 888EDD00 MOV EAX,DWORD PTR DS:[0xDD8E88]
|
||
* 00A7885E A8 01 TEST AL,0x1
|
||
* 00A78860 75 30 JNZ SHORT .00A78892
|
||
* 00A78862 83C8 01 OR EAX,0x1
|
||
* 00A78865 A3 888EDD00 MOV DWORD PTR DS:[0xDD8E88],EAX
|
||
*
|
||
* Here's the new function call:
|
||
* 00A78C8A CC INT3
|
||
* 00A78C8B CC INT3
|
||
* 00A78C8C CC INT3
|
||
* 00A78C8D CC INT3
|
||
* 00A78C8E CC INT3
|
||
* 00A78C8F CC INT3
|
||
* 00A78C90 55 PUSH EBP
|
||
* 00A78C91 8BEC MOV EBP,ESP
|
||
* 00A78C93 56 PUSH ESI
|
||
* 00A78C94 8BF1 MOV ESI,ECX
|
||
* 00A78C96 57 PUSH EDI
|
||
* 00A78C97 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+0x8]
|
||
* 00A78C9A 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+0x4]
|
||
* 00A78C9D 3BF9 CMP EDI,ECX
|
||
* 00A78C9F 73 76 JNB SHORT .00A78D17
|
||
* 00A78CA1 8B06 MOV EAX,DWORD PTR DS:[ESI]
|
||
* 00A78CA3 3BC7 CMP EAX,EDI
|
||
* 00A78CA5 77 70 JA SHORT .00A78D17
|
||
* 00A78CA7 2BF8 SUB EDI,EAX
|
||
* 00A78CA9 B8 93244992 MOV EAX,0x92492493
|
||
* 00A78CAE F7EF IMUL EDI
|
||
* 00A78CB0 03D7 ADD EDX,EDI
|
||
* 00A78CB2 C1FA 04 SAR EDX,0x4
|
||
* 00A78CB5 8BFA MOV EDI,EDX
|
||
* 00A78CB7 C1EF 1F SHR EDI,0x1F
|
||
* 00A78CBA 03FA ADD EDI,EDX
|
||
* 00A78CBC 3B4E 08 CMP ECX,DWORD PTR DS:[ESI+0x8]
|
||
* 00A78CBF 75 09 JNZ SHORT .00A78CCA
|
||
* 00A78CC1 6A 01 PUSH 0x1
|
||
* 00A78CC3 8BCE MOV ECX,ESI
|
||
* 00A78CC5 E8 36030000 CALL .00A79000
|
||
* 00A78CCA 8B56 04 MOV EDX,DWORD PTR DS:[ESI+0x4]
|
||
* 00A78CCD 8D0CFD 00000000 LEA ECX,DWORD PTR DS:[EDI*8]
|
||
* 00A78CD4 2BCF SUB ECX,EDI
|
||
* 00A78CD6 8B3E MOV EDI,DWORD PTR DS:[ESI]
|
||
* 00A78CD8 85D2 TEST EDX,EDX
|
||
* 00A78CDA 74 7B JE SHORT .00A78D57
|
||
* 00A78CDC 66:8B048F MOV AX,WORD PTR DS:[EDI+ECX*4]
|
||
* 00A78CE0 66:8902 MOV WORD PTR DS:[EDX],AX
|
||
* 00A78CE3 8B448F 04 MOV EAX,DWORD PTR DS:[EDI+ECX*4+0x4]
|
||
* 00A78CE7 8942 04 MOV DWORD PTR DS:[EDX+0x4],EAX
|
||
* 00A78CEA 8B448F 08 MOV EAX,DWORD PTR DS:[EDI+ECX*4+0x8]
|
||
* 00A78CEE 8942 08 MOV DWORD PTR DS:[EDX+0x8],EAX
|
||
* 00A78CF1 8B448F 0C MOV EAX,DWORD PTR DS:[EDI+ECX*4+0xC]
|
||
* 00A78CF5 8942 0C MOV DWORD PTR DS:[EDX+0xC],EAX
|
||
* 00A78CF8 C742 10 00000000 MOV DWORD PTR DS:[EDX+0x10],0x0
|
||
* 00A78CFF 8B448F 14 MOV EAX,DWORD PTR DS:[EDI+ECX*4+0x14]
|
||
* 00A78D03 8942 14 MOV DWORD PTR DS:[EDX+0x14],EAX
|
||
* 00A78D06 8A448F 18 MOV AL,BYTE PTR DS:[EDI+ECX*4+0x18]
|
||
* 00A78D0A 8842 18 MOV BYTE PTR DS:[EDX+0x18],AL
|
||
* 00A78D0D 8346 04 1C ADD DWORD PTR DS:[ESI+0x4],0x1C
|
||
* 00A78D11 5F POP EDI
|
||
* 00A78D12 5E POP ESI
|
||
* 00A78D13 5D POP EBP
|
||
* 00A78D14 C2 0400 RETN 0x4
|
||
* 00A78D17 3B4E 08 CMP ECX,DWORD PTR DS:[ESI+0x8]
|
||
* 00A78D1A 75 09 JNZ SHORT .00A78D25
|
||
* 00A78D1C 6A 01 PUSH 0x1
|
||
* 00A78D1E 8BCE MOV ECX,ESI
|
||
* 00A78D20 E8 DB020000 CALL .00A79000
|
||
* 00A78D25 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+0x4]
|
||
* 00A78D28 85C9 TEST ECX,ECX
|
||
* 00A78D2A 74 2B JE SHORT .00A78D57
|
||
* 00A78D2C 66:8B07 MOV AX,WORD PTR DS:[EDI]
|
||
* 00A78D2F 66:8901 MOV WORD PTR DS:[ECX],AX
|
||
* 00A78D32 8B47 04 MOV EAX,DWORD PTR DS:[EDI+0x4]
|
||
* 00A78D35 8941 04 MOV DWORD PTR DS:[ECX+0x4],EAX
|
||
* 00A78D38 8B47 08 MOV EAX,DWORD PTR DS:[EDI+0x8]
|
||
* 00A78D3B 8941 08 MOV DWORD PTR DS:[ECX+0x8],EAX
|
||
* 00A78D3E 8B47 0C MOV EAX,DWORD PTR DS:[EDI+0xC]
|
||
* 00A78D41 8941 0C MOV DWORD PTR DS:[ECX+0xC],EAX
|
||
* 00A78D44 C741 10 00000000 MOV DWORD PTR DS:[ECX+0x10],0x0
|
||
* 00A78D4B 8B47 14 MOV EAX,DWORD PTR DS:[EDI+0x14]
|
||
* 00A78D4E 8941 14 MOV DWORD PTR DS:[ECX+0x14],EAX
|
||
* 00A78D51 8A47 18 MOV AL,BYTE PTR DS:[EDI+0x18]
|
||
* 00A78D54 8841 18 MOV BYTE PTR DS:[ECX+0x18],AL
|
||
* 00A78D57 8346 04 1C ADD DWORD PTR DS:[ESI+0x4],0x1C
|
||
* 00A78D5B 5F POP EDI
|
||
* 00A78D5C 5E POP ESI
|
||
* 00A78D5D 5D POP EBP
|
||
* 00A78D5E C2 0400 RETN 0x4
|
||
* 00A78D61 CC INT3
|
||
* 00A78D62 CC INT3
|
||
* 00A78D63 CC INT3
|
||
* 00A78D64 CC INT3
|
||
* 00A78D65 CC INT3
|
||
*/
|
||
static bool InsertGXP1Hook()
|
||
{
|
||
union {
|
||
DWORD i;
|
||
DWORD *id;
|
||
BYTE *ib;
|
||
};
|
||
for (i = processStartAddress + 0x1000; i < processStopAddress - 4; i++) {
|
||
// jichi example:
|
||
// 00A78144 66:833C70 00 CMP WORD PTR DS:[EAX+ESI*2],0x0
|
||
|
||
//find cmp word ptr [esi*2+eax],0
|
||
if (*id != 0x703c8366)
|
||
continue;
|
||
i += 4;
|
||
if (*ib != 0)
|
||
continue;
|
||
i++;
|
||
DWORD j = i + 0x200;
|
||
j = j < (processStopAddress - 8) ? j : (processStopAddress - 8);
|
||
|
||
DWORD flag = false;
|
||
while (i < j) {
|
||
DWORD k = disasm(ib);
|
||
if (k == 0)
|
||
break;
|
||
if (k == 1 && (*ib & 0xf8) == 0x50) { // push reg
|
||
flag = true;
|
||
break;
|
||
}
|
||
i += k;
|
||
}
|
||
if (flag)
|
||
while (i < j) {
|
||
if (*ib == 0xe8) { // jichi: find first long call after the push operation
|
||
i++;
|
||
DWORD addr = *id + i + 4;
|
||
if (addr > processStartAddress && addr < processStopAddress) {
|
||
HookParam hp;
|
||
hp.address = addr;
|
||
//hp.type = CODEC_UTF16|DATA_INDIRECT;
|
||
hp.type = USING_STRING|CODEC_UTF16|DATA_INDIRECT|NO_CONTEXT|FIXING_SPLIT; // jichi 4/25/2015: Fixing split
|
||
hp.offset=get_stack(1);
|
||
|
||
//GROWL_DWORD3(hp.address, processStartAddress, hp.address - processStartAddress);
|
||
|
||
//DWORD call = Util::FindCallAndEntryAbs(hp.address, processStopAddress - processStartAddress, processStartAddress, 0xec81); // zero
|
||
//DWORD call = Util::FindCallAndEntryAbs(hp.address, processStopAddress - processStartAddress, processStartAddress, 0xec83); // zero
|
||
//DWORD call = Util::FindCallAndEntryAbs(hp.address, processStopAddress - processStartAddress, processStartAddress, 0xec8b55); // zero
|
||
//GROWL_DWORD3(call, processStartAddress, call - processStartAddress);
|
||
|
||
ConsoleOutput("INSERT GXP");
|
||
|
||
|
||
// jichi 5/13/2015: Disable hooking to GetGlyphOutlineW
|
||
// FIXME: GetGlyphOutlineW can extract name, but GXP cannot
|
||
ConsoleOutput("GXP: disable GDI hooks");
|
||
|
||
return NewHook(hp, "GXP");
|
||
}
|
||
}
|
||
i++;
|
||
}
|
||
}
|
||
//ConsoleOutput("Unknown GXP engine.");
|
||
ConsoleOutput("GXP: failed");
|
||
return false;
|
||
}
|
||
|
||
static bool InsertGXP2Hook()
|
||
{
|
||
// pattern = 0x0f5bc9f30f11442444f30f114c2448e8
|
||
const BYTE bytes[] = {
|
||
0x0f,0x5b, // 00A78845 0F5B ??? ; Unknown command
|
||
0xc9, // 00A78847 C9 LEAVE
|
||
0xf3,0x0f,0x11,0x44,0x24, 0x44, // 00A78848 F3:0F114424 44 MOVSS DWORD PTR SS:[ESP+0x44],XMM0
|
||
0xf3,0x0f,0x11,0x4c,0x24, 0x48, // 00A7884E F3:0F114C24 48 MOVSS DWORD PTR SS:[ESP+0x48],XMM1
|
||
0xe8 //37040000 // 00A78854 E8 37040000 CALL .00A78C90 ; jichi: here's the target function to hook to, text char on the stack[0]
|
||
};
|
||
enum { addr_offset = sizeof(bytes) - 1 }; // 0x00a78854 - 0x00a78845
|
||
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);
|
||
if (!addr) {
|
||
ConsoleOutput("GXP2: pattern not found");
|
||
return false;
|
||
}
|
||
|
||
HookParam hp;
|
||
hp.address = addr + addr_offset;
|
||
hp.type = CODEC_UTF16|NO_CONTEXT|DATA_INDIRECT|FIXING_SPLIT|USING_STRING;
|
||
ConsoleOutput("INSERT GXP2");
|
||
|
||
ConsoleOutput("GXP: disable GDI hooks");
|
||
|
||
return NewHook(hp, "GXP2");
|
||
}
|
||
|
||
bool InsertGXPHook()
|
||
{
|
||
// GXP1 and GXP2 are harmless to each other
|
||
bool ok = InsertGXP1Hook();
|
||
ok = InsertGXP2Hook() || ok;
|
||
return ok;
|
||
}
|
||
#include"util/textunion.h"
|
||
namespace { // unnamed
|
||
|
||
ULONG moduleBaseAddress_; // saved only for debugging purposes
|
||
|
||
bool isBadText(LPCWSTR text)
|
||
{
|
||
return text[0] <= 127 || text[::wcslen(text) - 1] <= 127 // skip ascii text
|
||
|| ::wcschr(text, 0xff3f); // Skip system text containing: ＿
|
||
}
|
||
|
||
namespace ScenarioHook1 { // for old GXP1
|
||
namespace Private {
|
||
TextUnionW *arg_,
|
||
argValue_;
|
||
bool hookBefore(hook_stack*s,void* data1, size_t* len,uintptr_t*role)
|
||
{
|
||
|
||
static std::wstring text_; // persistent storage, which makes this function not thread-safe
|
||
|
||
auto arg = (TextUnionW *)(s->stack[0] + 4); // arg1 + 0x4
|
||
if (!arg->isValid())
|
||
return 0;
|
||
|
||
auto text = arg->getText();
|
||
if (isBadText(text))
|
||
return 0;
|
||
return write_string_overwrite(data1,len,text);
|
||
}
|
||
void hook2a(hook_stack*s,void* data1, size_t len)
|
||
{
|
||
auto text_=new wchar_t[len/2+1];
|
||
auto n=std::wstring((LPWSTR)data1,len/2);
|
||
wcscpy(text_,n.c_str());
|
||
auto arg = (TextUnionW *)(s->stack[0] + 4); // arg1 + 0x4
|
||
arg_ = arg;
|
||
argValue_ = *arg;
|
||
|
||
arg->setText(text_);
|
||
//if (arg->size)
|
||
// hashes_.insert(Engine::hashWCharArray(arg->text, arg->size));
|
||
// return true;
|
||
}
|
||
bool hookAfter(hook_stack*s,void* data1, size_t* len,uintptr_t*role)
|
||
{
|
||
if (arg_) {
|
||
*arg_ = argValue_;
|
||
arg_ = nullptr;
|
||
}
|
||
return 0;
|
||
}
|
||
} // namespace Private
|
||
|
||
/**
|
||
* Sample game: 塔の下のエクセルキトゥス体験版
|
||
* Executable description shows "AVGEngineV2"
|
||
*
|
||
* Debugging method: Find the fixed text address, and check when it is being modified
|
||
*
|
||
* Scenario caller, text in the struct of arg1 + 0x4.
|
||
*/
|
||
bool attach(ULONG startAddress, ULONG stopAddress)
|
||
{
|
||
const uint8_t bytes[] = {
|
||
0xeb, 0x02, // 01313bb6 eb 02 jmp short trial.01313bba
|
||
0x8b,0xc5, // 01313bb8 8bc5 mov eax,ebp
|
||
0x8b,0x54,0x24, 0x18, // 01313bba 8b5424 18 mov edx,dword ptr ss:[esp+0x18]
|
||
0x8d,0x0c,0x51, // 01313bbe 8d0c51 lea ecx,dword ptr ds:[ecx+edx*2]
|
||
0x8d,0x1c,0x3f // 01313bc1 8d1c3f lea ebx,dword ptr ds:[edi+edi]
|
||
};
|
||
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
|
||
if (!addr)
|
||
return addr;
|
||
addr = MemDbg::findEnclosingAlignedFunction(addr);
|
||
if (!addr)
|
||
return addr;
|
||
//return winhook::hook_before(addr, Private::hookBefore);
|
||
|
||
int count = 0;
|
||
auto fun = [&count](ULONG addr) -> bool {
|
||
auto retaddr=addr+5;
|
||
|
||
if (*(DWORD *)retaddr!= 0x0c244c8a)
|
||
return true;
|
||
if (*(BYTE *)retaddr == 0x4f ||
|
||
(*(DWORD *)retaddr & 0x00ff00ff) == 0x0024008b) // skip truncated texts
|
||
return true;
|
||
HookParam hp;
|
||
hp.address=addr;
|
||
hp.hook_before=Private::hookBefore;
|
||
hp.hook_after=Private::hook2a;
|
||
hp.type=EMBED_ABLE|CODEC_UTF16|USING_STRING;
|
||
hp.newlineseperator=L"%r";
|
||
hp.hook_font=F_GetGlyphOutlineW;
|
||
bool succ=NewHook(hp,"EmbedGXP");
|
||
hp.address=addr+5;
|
||
hp.hook_before=Private::hookAfter;
|
||
succ|=NewHook(hp,"EmbedGXP");
|
||
count+=1;
|
||
return succ; // replace all functions
|
||
};
|
||
MemDbg::iterNearCallAddress(fun, addr, startAddress, stopAddress);
|
||
return count;
|
||
}
|
||
} // namespace ScenarioHook1
|
||
|
||
namespace ScenarioHook2 { // for new GXP2
|
||
namespace Private {
|
||
TextUnionW *arg_,
|
||
argValue_;
|
||
bool hookBefore(hook_stack*s,void* data1, size_t* len,uintptr_t*role)
|
||
{
|
||
static std::wstring text_; // persistent storage, which makes this function not thread-safe
|
||
auto arg = (TextUnionW *)s->stack[0]; // arg1
|
||
if (!arg->isValid())
|
||
return 0;
|
||
|
||
auto text = arg->getText();
|
||
if (isBadText(text))
|
||
return 0;
|
||
return write_string_overwrite(data1,len,text);
|
||
|
||
}
|
||
void hook2a(hook_stack*s,void* data1, size_t len)
|
||
{
|
||
auto text_=new wchar_t[len/2+1];
|
||
auto n=std::wstring((LPWSTR)data1,len/2);
|
||
wcscpy(text_,n.c_str());
|
||
auto arg = (TextUnionW *)s->stack[0]; // arg1 + 0x4
|
||
arg_ = arg;
|
||
argValue_ = *arg;
|
||
|
||
arg->setText(text_);
|
||
}
|
||
|
||
bool hookAfter(hook_stack*s,void* data1, size_t* len,uintptr_t*role)
|
||
{
|
||
if (arg_) {
|
||
*arg_ = argValue_;
|
||
arg_ = nullptr;
|
||
}
|
||
return 0;
|
||
}
|
||
} // namespace Private
|
||
|
||
bool attach(ULONG startAddress, ULONG stopAddress)
|
||
{
|
||
const uint8_t bytes[] = {
|
||
0x8d,0x04,0x3f, // 08159fd |. 8d043f lea eax,dword ptr ds:[edi+edi] ; jichi: edi *= 2 for wchar_t
|
||
0x50, // 0815a00 |. 50 push eax ; jichi: size
|
||
0x8d,0x04,0x4b, // 0815a01 |. 8d044b lea eax,dword ptr ds:[ebx+ecx*2]
|
||
0x50, // 0815a04 |. 50 push eax ; jichi: source text
|
||
0x52 // 0815a05 |. 52 push edx ; jichi: target text
|
||
};
|
||
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
|
||
if (!addr)
|
||
return addr;
|
||
addr = MemDbg::findEnclosingAlignedFunction(addr);
|
||
if (!addr)
|
||
return addr;
|
||
//return winhook::hook_before(addr, Private::hookBefore);
|
||
|
||
int count = 0;
|
||
auto fun = [&count](ULONG addr) -> bool {
|
||
auto retaddr=addr+5;
|
||
if (*(WORD *)retaddr != 0x458a)
|
||
return true;
|
||
if (*(BYTE *)retaddr == 0xa1)
|
||
return true;
|
||
HookParam hp;
|
||
hp.address=addr;
|
||
hp.hook_before=Private::hookBefore;
|
||
hp.hook_after=Private::hook2a;
|
||
hp.type=EMBED_ABLE|CODEC_UTF16|USING_STRING;
|
||
hp.newlineseperator=L"%r";
|
||
hp.hook_font=F_GetGlyphOutlineW;
|
||
bool succ=NewHook(hp,"EmbedGXP2");
|
||
hp.address=addr+5;
|
||
hp.hook_before=Private::hookAfter;
|
||
succ|=NewHook(hp,"EmbedGXP2");
|
||
count+=1;
|
||
return succ; // replace all functions
|
||
};
|
||
MemDbg::iterNearCallAddress(fun, addr, startAddress, stopAddress);
|
||
return count;
|
||
}
|
||
} // namespace ScenarioHook2
|
||
/*
|
||
namespace PopupHook1 { // only for old GXP1 engine
|
||
namespace Private {
|
||
bool hookBefore(winhook::hook_stack *s)
|
||
{
|
||
static std::wstring text_; // persistent storage, which makes this function not thread-safe
|
||
auto arg = (TextUnionW *)(s->ecx + 0x1ec); // [ecx + 0x1ec]
|
||
if (!arg->isValid())
|
||
return true;
|
||
auto text = arg->getText();
|
||
if (isBadText(text))
|
||
return true;
|
||
auto retaddr = s->stack[0];
|
||
auto reladdr = retaddr - moduleBaseAddress_;
|
||
enum { role = Engine::OtherRole };
|
||
std::wstring oldText = std::wstring(text),
|
||
newText = EngineController::instance()->dispatchTextWSTD(oldText, role, reladdr);
|
||
if (newText == oldText)
|
||
return true;
|
||
text_ = newText;
|
||
arg->setText(text_);
|
||
return true;
|
||
}
|
||
} // Private
|
||
bool attach(ULONG startAddress, ULONG stopAddress)
|
||
{
|
||
const uint8_t bytes[] = {
|
||
0x8b,0x86, 0xec,0x01,0x00,0x00, // 001092a9 8b86 ec010000 mov eax,dword ptr ds:[esi+0x1ec] ; jichi: text in eax
|
||
0xeb, 0x06, // 001092af eb 06 jmp short trial.001092b7
|
||
0x8d,0x86, 0xec,0x01,0x00,0x00, // 001092b1 8d86 ec010000 lea eax,dword ptr ds:[esi+0x1ec]
|
||
0x0f,0xb7,0x14,0x78, // 001092b7 0fb71478 movzx edx,word ptr ds:[eax+edi*2]
|
||
0x52 // 001092bb 52 push edx
|
||
};
|
||
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), startAddress, stopAddress);
|
||
if (!addr)
|
||
return false;
|
||
addr = MemDbg::findEnclosingAlignedFunction(addr);
|
||
if (!addr)
|
||
return false;
|
||
return winhook::hook_before(addr, Private::hookBefore);
|
||
// Function called at runtime
|
||
//int count = 0;
|
||
//auto fun = [&count](ULONG addr) -> bool {
|
||
// auto before = std::bind(Private::hookBefore, addr + 5, std::placeholders::_1);
|
||
// count += winhook::hook_both(addr, before, Private::hookAfter);
|
||
// return true; // replace all functions
|
||
//};
|
||
//MemDbg::iterNearCallAddress(fun, addr, startAddress, stopAddress);
|
||
//DOUT("call number =" << count);
|
||
//return count;
|
||
}
|
||
} // namespace PopupHook1
|
||
|
||
namespace OtherHook { // for all GXP engines
|
||
namespace Private {
|
||
bool hookBefore(winhook::hook_stack *s)
|
||
{
|
||
static std::wstring text_;
|
||
auto text = (LPCWSTR)s->stack[3]; // arg3
|
||
if (!text || !*text)
|
||
return true;
|
||
auto retaddr = s->stack[0];
|
||
auto reladdr = retaddr - moduleBaseAddress_;
|
||
enum { role = Engine::OtherRole };
|
||
std::wstring oldText = std::wstring(text),
|
||
newText = EngineController::instance()->dispatchTextWSTD(oldText, role, reladdr);
|
||
if (newText.empty() || oldText == newText)
|
||
return true;
|
||
strReplace(newText, L"%r", L"\n");
|
||
//newText.replace("%r", "\n");
|
||
text_ = newText;
|
||
s->stack[3] = (ULONG)text_.c_str();
|
||
return true;
|
||
}
|
||
} // Private
|
||
bool attach(ULONG startAddress, ULONG stopAddress)
|
||
{
|
||
const uint8_t bytes[] = {
|
||
0x99, // 014d45ae 99 cdq
|
||
0x2b,0xc2, // 014d45af 2bc2 sub eax,edx
|
||
0xd1,0xf8, // 014d45b1 d1f8 sar eax,1
|
||
0x03 //,0xf0, // 014d45b3 03f0 add esi,eax
|
||
};
|
||
int count = 0;
|
||
auto fun = [&count](ULONG addr) -> bool {
|
||
count +=
|
||
(addr = MemDbg::findEnclosingAlignedFunction(addr))
|
||
&& winhook::hook_before(addr, Private::hookBefore);
|
||
return true;
|
||
};
|
||
MemDbg::iterFindBytes(fun, bytes, sizeof(bytes), startAddress, stopAddress);
|
||
DOUT("call number =" << count);
|
||
return count;
|
||
}
|
||
} // namespace OtherHook
|
||
*/
|
||
|
||
bool attach()
|
||
{
|
||
ULONG startAddress=processStartAddress, stopAddress=processStopAddress;
|
||
|
||
moduleBaseAddress_ = startAddress; // used to calculate reladdr for debug purposes
|
||
if (ScenarioHook2::attach(startAddress, stopAddress)) {
|
||
|
||
} else if (ScenarioHook1::attach(startAddress, stopAddress)) {
|
||
|
||
// (PopupHook1::attach(startAddress, stopAddress));
|
||
|
||
} else
|
||
return false;
|
||
// (OtherHook::attach(startAddress, stopAddress))
|
||
|
||
return true;
|
||
}
|
||
|
||
} // unnamed namespace
|
||
bool GXP::attach_function() {
|
||
auto _=InsertGXPHook();
|
||
return attach()||_;
|
||
}
|