From 0b1cd7f36842abc4537bd3d8faafa52ec87c24b5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=81=8D=E5=85=AE=E6=83=9A=E5=85=AE?= <1173718158@qq.com> Date: Fri, 20 Dec 2024 12:50:42 +0800 Subject: [PATCH] . --- cpp/LunaHook/LunaHook/engine64/BGI.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cpp/LunaHook/LunaHook/engine64/BGI.cpp b/cpp/LunaHook/LunaHook/engine64/BGI.cpp index de34bd60..a85f7fcc 100644 --- a/cpp/LunaHook/LunaHook/engine64/BGI.cpp +++ b/cpp/LunaHook/LunaHook/engine64/BGI.cpp @@ -54,7 +54,7 @@ CHAR *__fastcall sub_1400F5BC0(LPSTR lpMultiByteStr, LPCWCH lpWideCharStr) .text:00000001400F5BFD mov ebx, 3A4h*/ const BYTE bytes[] = { 0xBB, 0xE9, 0xFD, 0x00, 0x00, // cp=65001 - 0xe8,XX, + 0xe8, XX, 0xBB, 0xA4, 0x03, 0x00, 0x00 // cp=932 }; auto addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress); @@ -108,6 +108,8 @@ bool BGIattach_function2() HookParam hp; hp.address = addrs[0] + 5; hp.type = CODEC_UTF16 | USING_STRING | EMBED_ABLE | EMBED_AFTER_NEW; + // 虽然不知道什么原因,但会正确分成三个thread: name+historytext, text, skiptext,且ret值固定,所以不NO_CONTEXT比较好 + // EnclosingAlignedFunction r8 sjit 会分成2个: name+historytext+skiptext, text,所以不如不align hp.embed_hook_font = F_TextOutW | F_GetTextExtentPoint32W; hp.filter_fun = BGI7Filter; hp.offset = regoffset(rax);