This commit is contained in:
恍兮惚兮 2024-12-04 00:46:49 +08:00
parent 987a4ebd52
commit de02e310ff

View File

@ -60,7 +60,78 @@ namespace
return NewHook(hp, "UnrealEngine5");
}
}
namespace
{
bool xxx()
{
// 逸剑风云决
const BYTE BYTES[] = {
/*
.text:0000000143B4E330 movzx esi, word ptr [rcx+r15*2]
.text:0000000143B4E335 inc edx
.text:0000000143B4E337 mov r8d, [rsp+498h+var_458]
.text:0000000143B4E33C mov eax, esi
.text:0000000143B4E33E inc r8d
.text:0000000143B4E341 mov [rsp+498h+var_474], edx
.text:0000000143B4E345 and eax, 0FFFFFC00h
.text:0000000143B4E34A mov [rsp+498h+var_458], r8d
.text:0000000143B4E34F inc r15
.text:0000000143B4E352 cmp eax, 0D800h
.text:0000000143B4E357 jnz short loc_143B4E392
.text:0000000143B4E359 movsxd r9, [rsp+498h+var_46C]
.text:0000000143B4E35E cmp r15, r9
.text:0000000143B4E361 jz short loc_143B4E392
.text:0000000143B4E363 movzx ecx, word ptr [rcx+r15*2]
.text:0000000143B4E368 mov eax, ecx
.text:0000000143B4E36A and eax, 0FFFFFC00h
.text:0000000143B4E36F cmp eax, 0DC00h
.text:0000000143B4E374 jnz short loc_143B4E392
.text:0000000143B4E376 add esi, 0FFFF2809h*/
0x42, 0x0f, 0xb7, 0x34, 0x79,
0xff, 0xc2,
0x44, 0x8b, 0x44, 0x24, XX,
0x8b, 0xc6,
0x41, 0xff, 0xc0,
0x89, 0x54, 0x24, XX,
0x25, 0x00, 0xfc, 0xff, 0xff,
0x44, 0x89, 0x44, 0x24, XX,
0x49, 0xff, 0xc7,
0x3d, 0x00, 0xd8, 0x00, 0x00,
0x75, XX,
0x4c, 0x63, 0x4c, 0x24, 0x2c,
0x4d, 0x3b, 0xf9,
0x74, 0x2f,
0x42, 0x0f, 0xb7, 0x0c, 0x79,
0x8b, 0xc1,
0x25, 0x00, 0xfc, 0xff, 0xff,
0x3d, 0x00, 0xdc, 0x00, 0x00,
0x75, XX,
0x81, 0xc6, 0x09, 0x28, 0xff, 0xff};
auto addr = MemDbg::findBytes(BYTES, sizeof(BYTES), processStartAddress, processStopAddress);
if (!addr)
return false;
BYTE start[] = {
0x48, 0x89, 0x5c, 0x24, 0x10,
0x48, 0x89, 0x6c, 0x24, 0x18,
0x48, 0x89, 0x74, 0x24, 0x20};
auto func = reverseFindBytes(start, sizeof(start), addr - 0x200, addr, 0, true);
if (!func)
return false;
HookParam hp;
hp.address = func;
hp.type = USING_STRING | CODEC_UTF16 | USING_SPLIT; // 会提取出所有TextBlock文字。怎么split都不完美就这样吧。
hp.offset = get_reg(regs::rsi);
hp.split = get_reg(regs::rsi); // rcx
hp.filter_fun = [](TextBuffer *buffer, HookParam *)
{
if (all_ascii((wchar_t *)buffer->buff, buffer->size / 2))
return buffer->clear();
};
return NewHook(hp, "UnrealEngine");
}
}
bool UnrealEngine::attach_function()
{
return InsertENTERGRAM() || ue5();
return InsertENTERGRAM() || ue5() || xxx();
}