This commit is contained in:
恍兮惚兮 2024-12-02 21:18:29 +08:00
parent 7f1cc7cad6
commit b7c173fb47
2 changed files with 100 additions and 52 deletions

View File

@ -1,67 +1,110 @@
#include"Bishop.h"
#include "Bishop.h"
bool bishopmbcjmstojis()
{
//特別授業
// 特別授業
const BYTE bytes[] = {
//unsigned int __cdecl _mbcjmstojis(unsigned int C)
0x55,0x8b,0xec,
0x8b,0x45,0x08, //mov eax, [ebp+C]
0x81, 0x3D,XX4, 0xA4 ,0x03 ,0x00 ,0x00, //cmp dword_4A1F0C, 3A4h //if ( dword_4A1F0C == 932 )
// unsigned int __cdecl _mbcjmstojis(unsigned int C)
0x55, 0x8b, 0xec,
0x8b, 0x45, 0x08, // mov eax, [ebp+C]
0x81, 0x3D, XX4, 0xA4, 0x03, 0x00, 0x00, // cmp dword_4A1F0C, 3A4h //if ( dword_4A1F0C == 932 )
XX2,
0xa9,0x00,0x00,0xff,0xff //if ( (C & 0xFFFF0000) != 0 )
0xa9, 0x00, 0x00, 0xff, 0xff // if ( (C & 0xFFFF0000) != 0 )
};
auto addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);
if (!addr) return false;
if (!addr)
return false;
HookParam hp;
hp.address = addr ;
hp.offset=get_stack(2);
hp.type = USING_SPLIT|USING_STRING;
hp.address = addr;
hp.offset = get_stack(2);
hp.type = USING_SPLIT | USING_STRING;
return NewHook(hp, "bishop");
}
bool Bishop::attach_function() {
bool Bishop::attach_function()
{
return bishopmbcjmstojis();
}
bool embedbishop()
{
// 黒の教室
const BYTE bytes[] = {
0x53,
0x8b, 0x5c, 0x24, 0x0c,
0x56,
0x8b, 0xf7,
0xe8, XX4,
0xd9, 0xee,
0xdd, 0x9f, XX4,
0x8b, 0xc3,
0xdb, 0x44, 0x24, 0x0c,
0x8d, 0x50, 0x02,
0xdd, 0x9f, XX4,
0x66, 0x8b, 0x08,
0x83, 0xc0, 0x02,
0x66, 0x85, 0xc9};
bool Bishop2::attach_function(){
auto addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStopAddress);
if (!addr)
return false;
HookParam hp;
hp.address = addr;
hp.offset = get_stack(2);
hp.type = USING_STRING | CODEC_UTF16 | EMBED_ABLE | EMBED_AFTER_NEW;
hp.embed_hook_font = F_GetGlyphOutlineW;
hp.lineSeparator = L"\\n";
return NewHook(hp, "bishop");
}
bool Bishop2attach_function()
{
//三射面談~連鎖する恥辱・調教の学園~
//特別授業3SLG
auto entry=Util::FindImportEntry(processStartAddress,(DWORD)GetGlyphOutlineW);
if(entry==0)return false;
bool ok=false;
for(auto addr:Util::SearchMemory(&entry, 4, PAGE_EXECUTE, processStartAddress, processStopAddress)){
// 三射面談~連鎖する恥辱・調教の学園~
// 特別授業3SLG
auto entry = Util::FindImportEntry(processStartAddress, (DWORD)GetGlyphOutlineW);
if (entry == 0)
return false;
bool ok = false;
for (auto addr : Util::SearchMemory(&entry, 4, PAGE_EXECUTE, processStartAddress, processStopAddress))
{
addr = MemDbg::findEnclosingAlignedFunction(addr);
if (!addr) continue;
auto xrefs=findxref_reverse_checkcallop(addr,max(processStartAddress,addr-0x100000),min(processStopAddress,addr+0x100000),0xe8);
for(auto addrx:xrefs){
//ConsoleOutput("xref %p",addrx);
const BYTE aligned [] = {0xCC,0xCC};
auto addrx1 = reverseFindBytes(aligned, sizeof(aligned), addrx-0x200, addrx);
//ConsoleOutput("Aligned %p",addrx1);
if (!addrx1) continue;
addrx1+=2;
BYTE __1[]={0xDC,0x0D,XX,XX,XX,0x00};
auto _1 = MemDbg::findBytes(__1, 6, addrx-0x30, addrx);
//ConsoleOutput("sig %p",_1);
if(_1==0 )continue;
BYTE checkthiscall[]={0x8B,0xF9};//mov edi, ecx
auto _3 = MemDbg::findBytes(checkthiscall,2, addrx1, addrx);
if (!addr)
continue;
auto xrefs = findxref_reverse_checkcallop(addr, max(processStartAddress, addr - 0x100000), min(processStopAddress, addr + 0x100000), 0xe8);
for (auto addrx : xrefs)
{
// ConsoleOutput("xref %p",addrx);
const BYTE aligned[] = {0xCC, 0xCC};
auto addrx1 = reverseFindBytes(aligned, sizeof(aligned), addrx - 0x200, addrx);
// ConsoleOutput("Aligned %p",addrx1);
if (!addrx1)
continue;
addrx1 += 2;
BYTE __1[] = {0xDC, 0x0D, XX, XX, XX, 0x00};
auto _1 = MemDbg::findBytes(__1, 6, addrx - 0x30, addrx);
// ConsoleOutput("sig %p",_1);
if (_1 == 0)
continue;
BYTE checkthiscall[] = {0x8B, 0xF9}; // mov edi, ecx
auto _3 = MemDbg::findBytes(checkthiscall, 2, addrx1, addrx);
HookParam hp;
hp.address = addrx1;
if(_3)
hp.offset=get_stack(3);
if (_3)
hp.offset = get_stack(3);
else
hp.offset=get_stack(4);
hp.offset = get_stack(4);
hp.type = CODEC_UTF16;
ok=NewHook(hp, "Bishop2");
ok = NewHook(hp, "Bishop2");
}
}
return ok;
}
bool Bishop2::attach_function()
{
return Bishop2attach_function() | embedbishop();
}

View File

@ -137,6 +137,11 @@ namespace
case HOST_NOTIFICATION_RMVHOOK:
{
auto info = *(HookRemovedNotif*)buffer;
auto sm = Host::GetCommonSharedMem(processId);
if (sm)
for (int i = 0; i < ARRAYSIZE(sm->embedtps); i++)
if (sm->embedtps[i].use && (sm->embedtps[i].tp.addr==info.address)&&(sm->embedtps[i].tp.processId==processId))
ZeroMemory(sm->embedtps + i, sizeof(sm->embedtps[i]));
RemoveThreads([&](ThreadParam tp) { return tp.processId == processId && tp.addr == info.address; });
}
break;