Textractor_test/texthook/engine/match64.cc

#include "match.h"
#include "main.h"
#include "texthook.h"
#include "native/pchooks.h"
#include "mono/monoobject.h"
#include "mono/funcinfo.h"
#include "engine.h"
#include "util.h"
#include "cpputil/cppcstring.h"

// Warning: The offset in ITH has -4 offset comparing to pusha and AGTH
enum pusha_off
{
	pusha_rax_off = -0xC,
	pusha_rbx_off = -0x14,
	pusha_rcx_off = -0x1c,
	pusha_rdx_off = -0x24,
	pusha_rsp_off = -0x2c,
	pusha_rbp_off = -0x34,
	pusha_rsi_off = -0x3c,
	pusha_rdi_off = -0x44,
	pusha_r8_off  = -0x4c,
	pusha_r9_off  = -0x54,
	pusha_r10_off = -0x5c,
	pusha_r11_off = -0x64,
	pusha_r12_off = -0x6c,
	pusha_r13_off = -0x74,
	pusha_r14_off = -0x7c,
	pusha_r15_off = -0x84,
	pusha_off     = -0x8c // pushad offset
};

#define retof(rsp_base)         *(uintptr_t *)(rsp_base) // return address
#define regof(name, rsp_base)   *(uintptr_t *)((rsp_base) + pusha_##name##_off - 4)
#define argof(count, rsp_base)  *(uintptr_t *)((rsp_base) + 4 * (count)) // starts from 1 instead of 0

enum { VNR_TEXT_CAPACITY = 1500 }; // estimated max number of bytes allowed in VNR, slightly larger than VNR's text limit (1000)

namespace { // unnamed helpers

#define XX2 XX,XX       // WORD
#define XX4 XX2,XX2     // DWORD
#define XX8 XX4,XX4     // QWORD

// jichi 8/18/2013: Original maximum relative address in ITH
//enum { MAX_REL_ADDR = 0x200000 };

// jichi 10/1/2013: Increase relative address limit. Certain game engine like Artemis has larger code region
enum : DWORD { MAX_REL_ADDR = 0x00300000 };

static union {
  char text_buffer[0x1000];
  wchar_t wc_buffer[0x800];

  struct { // CodeSection
    DWORD base;
    DWORD size;
  } code_section[0x200];
};
DWORD text_buffer_length;

// 7/29/2014 jichi: I should move these functions to different files
// String utilities
// Return the address of the first non-zero address
LPCSTR reverse_search_begin(const char *s, int maxsize = VNR_TEXT_CAPACITY)
{
  if (*s)
    for (int i = 0; i < maxsize; i++, s--)
      if (!*s)
        return s + 1;
  return nullptr;
}

bool all_ascii(const char *s, int maxsize = VNR_TEXT_CAPACITY)
{
  if (s)
    for (int i = 0; i < maxsize && *s; i++, s++)
      if ((BYTE)*s > 127) // unsigned char
        return false;
  return true;
}

bool all_ascii(const wchar_t *s, int maxsize = VNR_TEXT_CAPACITY)
{
  if (s)
    for (int i = 0; i < maxsize && *s; i++, s++)
      if (*s > 127) // unsigned char
        return false;
  return true;
}

// String filters

void CharReplacer(char *str, size_t *size, char fr, char to)
{
  size_t len = *size;
  for (size_t i = 0; i < len; i++)
    if (str[i] == fr)
      str[i] = to;
}

void WideCharReplacer(wchar_t *str, size_t *size, wchar_t fr, wchar_t to)
{
  size_t len = *size / 2;
  for (size_t i = 0; i < len; i++)
    if (str[i] == fr)
      str[i] = to;
}

void CharFilter(char *str, size_t *size, char ch)
{
  size_t len = *size,
         curlen;
  for (char *cur = (char *)::memchr(str, ch, len);
       (cur && --len && (curlen = len - (cur - str)));
       cur = (char *)::memchr(cur, ch, curlen))
    ::memmove(cur, cur + 1, curlen);
  *size = len;
}

void WideCharFilter(wchar_t *str, size_t *size, wchar_t ch)
{
  size_t len = *size / 2,
         curlen;
  for (wchar_t *cur = cpp_wcsnchr(str, ch, len);
       (cur && --len && (curlen = len - (cur - str)));
       cur = cpp_wcsnchr(cur, ch, curlen))
    ::memmove(cur, cur + 1, 2 * curlen);
  *size = len * 2;
}

void CharsFilter(char *str, size_t *size, const char *chars)
{
  size_t len = *size,
         curlen;
  for (char *cur = cpp_strnpbrk(str, chars, len);
       (cur && --len && (curlen = len - (cur - str)));
       cur = cpp_strnpbrk(cur, chars, curlen))
    ::memmove(cur, cur + 1, curlen);
  *size = len;
}

void WideCharsFilter(wchar_t *str, size_t *size, const wchar_t *chars)
{
  size_t len = *size / 2,
         curlen;
  for (wchar_t *cur = cpp_wcsnpbrk(str, chars, len);
       (cur && --len && (curlen = len - (cur - str)));
       cur = cpp_wcsnpbrk(cur, chars, curlen))
    ::memmove(cur, cur + 1, 2 * curlen);
  *size = len * 2;
}

void StringFilter(char *str, size_t *size, const char *remove, size_t removelen)
{
  size_t len = *size,
         curlen;
  for (char *cur = cpp_strnstr(str, remove, len);
       (cur && (len -= removelen) && (curlen = len - (cur - str)));
       cur = cpp_strnstr(cur, remove, curlen))
    ::memmove(cur, cur + removelen, curlen);
  *size = len;
}

void WideStringFilter(wchar_t *str, size_t *size, const wchar_t *remove, size_t removelen)
{
  size_t len = *size / 2,
         curlen;
  for (wchar_t *cur = cpp_wcsnstr(str, remove, len);
       (cur && (len -= removelen) && (curlen = len - (cur - str)));
       cur = cpp_wcsnstr(cur, remove, curlen))
    ::memmove(cur, cur + removelen, 2 * curlen);
  *size = len * 2;
}

void StringFilterBetween(char *str, size_t *size, const char *fr, size_t frlen, const char *to, size_t tolen)
{
  size_t len = *size,
         curlen;
  for (char *cur = cpp_strnstr(str, fr, len);
       cur;
       cur = cpp_strnstr(cur, fr, curlen)) {
    curlen = (len - frlen) - (cur - str);
    auto end = cpp_strnstr(cur + frlen, to, curlen);
    if (!end)
      break;
    curlen = len - (end - str) - tolen;
    ::memmove(cur, end + tolen, curlen);
    len -= tolen + (end - cur);
  }
  *size = len;
}

void WideStringFilterBetween(wchar_t *str, size_t *size, const wchar_t *fr, size_t frlen, const wchar_t *to, size_t tolen)
{
  size_t len = *size / 2,
         curlen;
  for (wchar_t *cur = cpp_wcsnstr(str, fr, len);
       cur;
       cur = cpp_wcsnstr(cur, fr, curlen)) {
    curlen = (len - frlen) - (cur - str);
    auto end = cpp_wcsnstr(cur + frlen, to, curlen);
    if (!end)
      break;
    curlen = len - (end - str) - tolen;
    ::memmove(cur, end + tolen, 2 * curlen);
    len -= tolen + (end - cur);
  }
  *size = len * 2;
}

void StringCharReplacer(char *str, size_t *size, const char *src, size_t srclen, char ch)
{
  size_t len = *size,
         curlen;
  for (char *cur = cpp_strnstr(str, src, len);
       cur && len;
       cur = cpp_strnstr(cur, src, curlen)) {
    *cur++ = ch;
    len -= srclen - 1;
    curlen = len - (cur - str);
    if (curlen == 0)
      break;
    ::memmove(cur, cur + srclen - 1, curlen);
  }
  *size = len;
}

void WideStringCharReplacer(wchar_t *str, size_t *size, const wchar_t *src, size_t srclen, wchar_t ch)
{
  size_t len = *size / 2,
         curlen;
  for (wchar_t *cur = cpp_wcsnstr(str, src, len);
       cur && len;
       cur = cpp_wcsnstr(cur, src, curlen)) {
    *cur++ = ch;
    len -= srclen - 1;
    curlen = len - (cur - str);
    if (curlen == 0)
      break;
    ::memmove(cur, cur + srclen -1, 2 * curlen);
  }
  *size = len * 2;
}

// NOTE: I assume srclen >= dstlen
void StringReplacer(char *str, size_t *size, const char *src, size_t srclen, const char *dst, size_t dstlen)
{
  size_t len = *size,
         curlen;
  for (char *cur = cpp_strnstr(str, src, len);
       cur && len;
       cur = cpp_strnstr(cur, src, curlen)) {
    ::memcpy(cur, dst, dstlen);
    cur += dstlen;
    len -= srclen - dstlen;
    curlen = len - (cur - str);
    if (curlen == 0)
      break;
    if (srclen > dstlen)
      ::memmove(cur, cur + srclen - dstlen, curlen);
  }
  *size = len;
}

void WideStringReplacer(wchar_t *str, size_t *size, const wchar_t *src, size_t srclen, const wchar_t *dst, size_t dstlen)
{
  size_t len = *size / 2,
         curlen;
  for (wchar_t *cur = cpp_wcsnstr(str, src, len);
       cur && len;
       cur = cpp_wcsnstr(cur, src, curlen)) {
    ::memcpy(cur, dst, 2 * dstlen);
    cur += dstlen;
    len -= srclen - dstlen;
    curlen = len - (cur - str);
    if (curlen == 0)
      break;
    if (srclen > dstlen)
      ::memmove(cur, cur + srclen - dstlen, 2 * curlen);
  }
  *size = len * 2;
}

bool NewLineCharFilter(LPVOID data, DWORD *size, HookParam *, BYTE)
{
  CharFilter(reinterpret_cast<LPSTR>(data), reinterpret_cast<size_t *>(size),
      '\n');
  return true;
}
bool NewLineWideCharFilter(LPVOID data, DWORD *size, HookParam *, BYTE)
{
  CharFilter(reinterpret_cast<LPSTR>(data), reinterpret_cast<size_t *>(size),
      L'\n');
  return true;
}
bool NewLineStringFilter(LPVOID data, DWORD *size, HookParam *, BYTE)
{
  StringFilter(reinterpret_cast<LPSTR>(data), reinterpret_cast<size_t *>(size),
      "\\n", 2);
  return true;
}
bool NewLineWideStringFilter(LPVOID data, DWORD *size, HookParam *, BYTE)
{
  WideStringFilter(reinterpret_cast<LPWSTR>(data), reinterpret_cast<size_t *>(size),
      L"\\n", 2);
  return true;
}
bool NewLineCharToSpaceFilter(LPVOID data, DWORD *size, HookParam *, BYTE)
{
  CharReplacer(reinterpret_cast<LPSTR>(data), reinterpret_cast<size_t *>(size), '\n', ' ');
  return true;
}
bool NewLineWideCharToSpaceFilter(LPVOID data, DWORD *size, HookParam *, BYTE)
{
  WideCharReplacer(reinterpret_cast<LPWSTR>(data), reinterpret_cast<size_t *>(size), L'\n', L' ');
  return true;
}

// Remove every characters <= 0x1f (i.e. before space ' ') except 0xa and 0xd.
bool IllegalCharsFilter(LPVOID data, DWORD *size, HookParam *, BYTE)
{
  CharsFilter(reinterpret_cast<LPSTR>(data), reinterpret_cast<size_t *>(size),
      "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0b\x0c\x0e\x0f\x10\x11\x12\x12\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f");
  return true;
}
bool IllegalWideCharsFilter(LPVOID data, DWORD *size, HookParam *, BYTE)
{
  WideCharsFilter(reinterpret_cast<LPWSTR>(data), reinterpret_cast<size_t *>(size),
      L"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0b\x0c\x0e\x0f\x10\x11\x12\x12\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f");
  return true;
}

} // unnamed namespace


#define XX2 XX,XX       // WORD
#define XX4 XX2,XX2     // DWORD
#define XX8 XX4,XX4     // QWORD

namespace Engine
{
	enum : DWORD { X64_MAX_REL_ADDR = 0x00300000 };
	/** Artikash 6/7/2019
*   PPSSPP JIT code has pointers, but they are all added to an offset before being used.
	Find that offset so that hook searching works properly.
	To find the offset, find a page of mapped memory with size 0x1f00000, read and write permissions, take its address and subtract 0x8000000.
	The above is useful for emulating PSP hardware, so unlikely to change between versions.
*/
	bool FindPPSSPP()
	{
		bool found = false;
		SYSTEM_INFO systemInfo;
		GetNativeSystemInfo(&systemInfo);
		for (BYTE* probe = NULL; probe < systemInfo.lpMaximumApplicationAddress;)
		{
			MEMORY_BASIC_INFORMATION info;
			if (!VirtualQuery(probe, &info, sizeof(info)))
			{
				probe += systemInfo.dwPageSize;
			}
			else
			{
				if (info.RegionSize == 0x1f00000 && info.Protect == PAGE_READWRITE && info.Type == MEM_MAPPED)
				{
					found = true;
					ConsoleOutput("Textractor: PPSSPP memory found: searching for hooks should yield working hook codes");
					// PPSSPP 1.8.0 compiles jal to sub dword ptr [r14+0x360],??
					memcpy(spDefault.pattern, Array<BYTE>{ 0x41, 0x83, 0xae, 0x60, 0x03, 0x00, 0x00 }, spDefault.length = 7);
					spDefault.offset = 0;
					spDefault.minAddress = 0;
					spDefault.maxAddress = -1ULL;
					spDefault.padding = (uintptr_t)probe - 0x8000000;
					spDefault.hookPostProcessor = [](HookParam& hp)
					{
						hp.type |= NO_CONTEXT | USING_SPLIT | SPLIT_INDIRECT;
						hp.split = -0x80; // r14
						hp.split_index = -8; // this is where PPSSPP 1.8.0 stores its return address stack
					};
				}
				probe += info.RegionSize;
			}
		}
		return found;
	}
		//MonoImage* mono_assembly_get_image(MonoAssembly* assembly)：获取程序集的镜像。后面几乎所有的操作都会以MonoImage* 为第一个参数。
	static uintptr_t (*mono_assembly_get_image)(uintptr_t) = NULL;
	// const char* mono_image_get_name(MonoImage * image) :获取程序集名。我们用它判断哪个程序集是我们的目标
	static char* (*mono_image_get_name)(uintptr_t) = NULL;
	//MonoClass* mono_class_from_name (MonoImage *image, const char* name_space, const char *name):通过类名获取类(非实例)。
	static uintptr_t(*mono_class_from_name)(uintptr_t, char*, char*) = NULL;
	//MonoVTable* mono_class_vtable (MonoDomain *domain, MonoClass *klass)：获取vtable，我们通过它可以找到静态字段的起始地址。
	static uintptr_t(*mono_class_vtable)(uintptr_t, uintptr_t) = NULL;
	//void* mono_vtable_get_static_field_data (MonoVTable *vt)：获取静态字段的起始地址。
	static void*  (*mono_vtable_get_static_field_data)(uintptr_t) = NULL;
	//MonoMethod* mono_class_get_method_from_name (MonoClass *klass, const char *name, int param_count):获取方法(非native code地址)。
	//其中param_count是参数数量，可以输入-1来省略。此函数无法获取重载的方法，但对于我们来说足够了。
	static uintptr_t(*mono_class_get_method_from_name)(uintptr_t, char*,int) = NULL;
	//获取属性。用它可以进一步获得属性的getter和setter。
	//MonoProperty* mono_class_get_property_from_name(MonoClass* klass, const char* name)：
	static uintptr_t(*mono_class_get_property_from_name)(uintptr_t, char*) = NULL;
	//获取属性的getter和setter。
	//MonoMethod* mono_property_get_get_method(MonoProperty* prop) 与 MonoMethod* mono_property_get_set_method(MonoProperty* prop)：
	static uintptr_t(*mono_property_get_set_method)(uintptr_t) = NULL;
	// （不安全）返回方法的地址，如果方法尚未编译，则JIT开始编译。这个是解决问题的核心方法。 gpointer mono_compile_method (MonoMethod *method):
	static  uint64_t* (*mono_compile_method)(uintptr_t) = NULL;

	//获取函数的非托管块指针 (native)   gpointer mono_method_get_unmanaged_thunk (MonoMethod *method)
	//使用这个来获取native代码 方法尚未编译，会执行编译 并提取 x86版本可能使用的是__stdcall
	static  uint64_t* (*mono_method_get_unmanaged_thunk)(uintptr_t) = NULL;
	//MonoDomain* mono_get_root_domain (void) ：获取主作用域。用于附加线程以及获取静态字段的地址。
	static  MonoDomain* (*mono_get_root_domain)() = NULL;
	//void mono_thread_attach (MonoDomain*)：附加到进程的主线程。这个操作是必须的。
	static  void (*mono_thread_attach)(MonoDomain*) = NULL;

	//MonoAssembly* assembly，而后者则是void* user_data
	int getV8StringLength(uintptr_t stack, uintptr_t data) {
		int len = *(int*)(data - 4);
		int checkLength = len > 0 && len < PIPE_BUFFER_SIZE ? len : 0;
		//检查是否为错误的unicode字符
		for (size_t i = 0; i < checkLength; i++)
		{
			if (*(WORD*)(data + i * 2) == 0x0)
				return 0;
		}
		return checkLength * 2;

	}
	void MonoCallBack(uintptr_t assembly, void* userData) {
		uintptr_t mono_property = NULL;
		uintptr_t image=mono_assembly_get_image(assembly);
		// TMP_Text TextMeshProUGUI
	auto mono_tmp_class=mono_class_from_name(image, "TMPro", "TMP_Text");
	auto mono_ugui_class = mono_class_from_name(image, "UnityEngine.UI", "Text");
	auto mono_ngui_class = mono_class_from_name(image, "", "UILabel");
	if (!mono_tmp_class && !mono_ugui_class && !mono_ngui_class)
		return;
	if (mono_tmp_class) {
		mono_property = mono_class_get_property_from_name(mono_tmp_class, "text");
	}
	else if (mono_ugui_class)
	{
		mono_property = mono_class_get_property_from_name(mono_ugui_class, "text");
	}
	else if (mono_ngui_class) {
		mono_property = mono_class_get_property_from_name(mono_ngui_class, "text");
	}
				
	if (mono_property == NULL)
		return;
	auto mono_set_method= mono_property_get_set_method(mono_property);
	//注意必须调用mono_thread_attach 附加到主domain 才能调用 mono_method_get_unmanaged_thunk mono_compile_method 或mono_runtime_invoke
	mono_thread_attach(mono_get_root_domain());
	uint64_t* method_pointer= mono_compile_method(mono_set_method);
	if (method_pointer) {
		HookParam hp = {};
		hp.type = USING_STRING | USING_UNICODE;
		hp.address = (uint64_t)method_pointer;
		hp.offset = -0x28; // rdx
		//hp.index = 0;
		hp.padding = 0x14;
		if (mono_tmp_class) {
			ConsoleOutput("Mono_X64,Insert: TextMeshProUGUI_set_text Hook BY:IOV");
			hp.length_fun = getV8StringLength;
			NewHook(hp, "TextMeshProUGUI_set_text");
		}
		else if (mono_ugui_class)
		{
			ConsoleOutput("Mono_X64,Insert: UGUI_set_text Hook BY:IOV");
			hp.length_fun = getV8StringLength;
			NewHook(hp, "UGUI_set_text");
		}
		else if (mono_ngui_class)
		{
			ConsoleOutput("Mono_X64,Insert: NGUI_set_text Hook BY:IOV");
			hp.length_fun = getV8StringLength;
			NewHook(hp, "NGUI_set_text");
		}

	}
	
	}

	bool InsertMonoHooksByAssembly(HMODULE module) {
		//void mono_assembly_foreach (GFunc func, gpointer user_data)
		//遍历程序集。用于获取目标程序集的指针。其中的func 是一个回调函数，要自己写。它有两个参数，前者就是MonoAssembly*，而后者则是user_data
		static auto mono_assembly_foreach = (void (*)(void (*)(uintptr_t, void*), uintptr_t))GetProcAddress(module, "mono_assembly_foreach");
		mono_assembly_get_image= (uintptr_t(*)(uintptr_t))GetProcAddress(module, "mono_assembly_get_image");
		mono_image_get_name = (char* (*)(uintptr_t))GetProcAddress(module, "mono_image_get_name");
		mono_class_from_name = (uintptr_t(*)(uintptr_t, char*, char*))GetProcAddress(module, "mono_class_from_name");
		mono_class_get_property_from_name = (uintptr_t(*)(uintptr_t, char*))GetProcAddress(module, "mono_class_get_property_from_name");
		mono_property_get_set_method = (uintptr_t(*)(uintptr_t))GetProcAddress(module, "mono_property_get_set_method");
		mono_compile_method = (uint64_t * (*)(uintptr_t))GetProcAddress(module, "mono_compile_method");
		//mono_method_get_unmanaged_thunk= (uint64_t * (*)(uintptr_t))GetProcAddress(module, "mono_method_get_unmanaged_thunk");
		mono_get_root_domain = (MonoDomain * (*)())GetProcAddress(module, "mono_get_root_domain");
		
		mono_thread_attach = (void (*)(MonoDomain*))GetProcAddress(module, "mono_thread_attach");
		if (mono_assembly_foreach && mono_assembly_get_image && mono_image_get_name && mono_class_from_name &&
			mono_class_get_property_from_name && mono_property_get_set_method && mono_compile_method &&
			 mono_get_root_domain && mono_thread_attach) {
			mono_assembly_foreach(MonoCallBack, NULL);
			return true;
		}
		else
		{
			return false;
		}
	}	
	bool InsertMonoHooks(HMODULE module)
	{
		return InsertMonoHooksByAssembly(module);
		auto SpecialHookMonoString = nullptr;
		static HMODULE mono = module;
		bool ret = false;
		for (auto func : Array<MonoFunction>{ MONO_FUNCTIONS_INITIALIZER })
		{
			HookParam hp = {};
			if (!(hp.address = (uintptr_t)GetProcAddress(mono, func.functionName))) continue;
			hp.type = HOOK_EMPTY;
			NewHook(hp, "Mono Searcher");
			ret = true;
		}
		/* Artikash 2/13/2019:
		How to hook Mono/Unity3D:
		Find all standard function prologs in memory with write/execute permission: these represent possible JIT compiled functions
		Then use Mono APIs to reflect what these functions are, and hook them if they are string member functions
		Mono calling convention uses 'this' as first argument
		Must be dynamic hook bootstrapped from other mono api or mono_domain_get won't work
		*/
		trigger_fun = [](LPVOID addr, DWORD, DWORD)
		{
			static auto getDomain = (MonoDomain*(*)())GetProcAddress(mono, "mono_domain_get");
			static auto getJitInfo = (MonoObject*(*)(MonoDomain*, uintptr_t))GetProcAddress(mono, "mono_jit_info_table_find");
			static auto getName = (char*(*)(uintptr_t))GetProcAddress(mono, "mono_pmip");
			if (!getDomain || !getName || !getJitInfo) goto failed;
			static auto domain = getDomain();
			if (!domain) goto failed;
			ConsoleOutput("Textractor: Mono Dynamic ENTER (hooks = %s)", *loadedConfig ? loadedConfig : "brute force");
			const BYTE prolog1[] = { 0x55, 0x48, 0x8b, 0xec };
			const BYTE prolog2[] = { 0x48, 0x83, 0xec };
			for (auto [prolog, size] : Array<const BYTE*, size_t>{ { prolog1, sizeof(prolog1) }, { prolog2, sizeof(prolog2) } })
			for (auto addr : Util::SearchMemory(prolog, size, PAGE_EXECUTE_READWRITE))
			{
				[](uint64_t addr)
				{
					__try
					{
						if (getJitInfo(domain, addr))
							if (char* name = getName(addr))
								if (strstr(name, "0x0") && ShouldMonoHook(name))
								{
									HookParam hp = {};
									hp.address = addr;
									hp.type = USING_STRING | USING_UNICODE | FULL_STRING;
									if (!*loadedConfig) hp.type |= KNOWN_UNSTABLE;
									hp.offset = -0x20; // rcx
									hp.padding = 20;
									char nameForUser[HOOK_NAME_SIZE] = {};
									strncpy_s(nameForUser, name + 1, HOOK_NAME_SIZE - 1);
									if (char* end = strstr(nameForUser, " + 0x0")) *end = 0;
									if (char* end = strstr(nameForUser, "{")) *end = 0;
									hp.length_fun = [](uintptr_t, uintptr_t data)
									{
										/* Artikash 6/18/2019:
										even though this should get the true length mono uses internally
										there's still some garbage picked up on https://vndb.org/v20403 demo, don't know why */
										int len = *(int*)(data - 4);
										return len > 0 && len < PIPE_BUFFER_SIZE ? len * 2 : 0;
									};
									NewHook(hp, nameForUser);
								}
					}
					__except (EXCEPTION_EXECUTE_HANDLER) {}
				}(addr);
			}

			if (!*loadedConfig) ConsoleOutput("Textractor: Mono Dynamic used brute force: if performance issues arise, please specify the correct hook in the game configuration");
			return true;
		failed:
			ConsoleOutput("Textractor: Mono Dynamic failed");
			return true;
		};
		return ret;
	}

	// Artikash 6/23/2019: V8 (JavaScript runtime) has rcx = string** at v8::String::Write
	// sample game https://www.freem.ne.jp/dl/win/18963
	bool InsertV8Hook(HMODULE module)
	{
		auto getV8Length =  [](uintptr_t, uintptr_t data)
		{
			int len = *(int*)(data - 4);
			return len > 0 && len < PIPE_BUFFER_SIZE ? len * 2 : 0;
		};

		uint64_t addr1 = (uint64_t)GetProcAddress(module, "?Write@String@v8@@QEBAHPEAGHHH@Z"),
			// Artikash 6/7/2021: Add new hook for new version of V8 used by RPG Maker MZ
			addr2 = (uint64_t)GetProcAddress(module, "??$WriteToFlat@G@String@internal@v8@@SAXV012@PEAGHH@Z");

		if (addr1 || addr2)
		{
			std::tie(spDefault.minAddress, spDefault.maxAddress) = Util::QueryModuleLimits(module);
			spDefault.maxRecords = Util::SearchMemory(spDefault.pattern, spDefault.length, PAGE_EXECUTE, spDefault.minAddress, spDefault.maxAddress).size() * 20;
			ConsoleOutput("Textractor: JavaScript hook is known to be low quality: try searching for hooks if you don't like it");
		}
		if (addr1)
		{
			HookParam hp = {};
			hp.type = USING_STRING | USING_UNICODE | DATA_INDIRECT;
			hp.address = addr1;
			hp.offset = -0x20; // rcx
			hp.index = 0;
			hp.padding = 23;
			hp.length_fun = getV8Length;
			NewHook(hp, "JavaScript");
		}
		if (addr2)
		{
			HookParam hp = {};
			hp.type = USING_STRING | USING_UNICODE;
			hp.address = addr2;
			hp.offset = -0x20; // rcx
			hp.padding = 11;
			hp.length_fun = getV8Length;
			NewHook(hp, "JavaScript");
		}
		return addr1 || addr2;
	}

	/** Artikash 8/10/2018: Ren'py
	*
	*  Sample games: https://vndb.org/v19843 https://vndb.org/v12038 and many more OELVNs
	*
	*  Uses CPython, and links to python27.dll. PyUicodeUCS2_Format is the function used to process text.
	*  first argument. offset 0x18 from that is a wchar_t* to the actual string
	*  ebx seems to work well as the split param, not sure why
	*/
	bool InsertRenpyHook()
	{
		wchar_t python[] = L"python2X.dll", libpython[] = L"libpython2.X.dll";
		for (wchar_t* name : { python, libpython })
		{
			wchar_t* pos = wcschr(name, L'X');
			for (int pythonMinorVersion = 0; pythonMinorVersion <= 8; ++pythonMinorVersion)
			{
				*pos = L'0' + pythonMinorVersion;
				if (HMODULE module = GetModuleHandleW(name))
				{
					wcscpy_s(spDefault.exportModule, name);
					HookParam hp = {};
					hp.address = (uintptr_t)GetProcAddress(module, "PyUnicodeUCS2_Format");
					if (!hp.address)
					{
						ConsoleOutput("Textractor: Ren'py failed: failed to find PyUnicodeUCS2_Format");
						return false;
					}
					hp.offset = pusha_rcx_off -4; // rcx
					hp.index = 0x18;
					hp.length_offset = 0;
					//hp.split = pusha_rsp_off -4;
					hp.type = USING_STRING | USING_UNICODE | NO_CONTEXT | DATA_INDIRECT /* | USING_SPLIT*/;
					hp.filter_fun = [](LPVOID data, DWORD *size, HookParam *, BYTE)
					{
						static std::wstring prevText;
						auto text = reinterpret_cast<LPWSTR>(data);
						auto len = reinterpret_cast<size_t *>(size);

						if (cpp_wcsnstr(text, L"%", *len/sizeof(wchar_t)))
							return false;

						if (cpp_wcsnstr(text, L"{", *len/sizeof(wchar_t))) {
							WideStringCharReplacer(text, len, L"{i}", 3, L'\'');
							WideStringCharReplacer(text, len, L"{/i}", 4, L'\'');
							WideStringFilterBetween(text, len, L"{", 1, L"}", 1);
						}
						WideStringFilter(text, len, L"^", 2); // remove ^ followed by 1 char
						WideCharReplacer(text, len, L'\n', L' ');

						if (prevText.length()==*len/sizeof(wchar_t) && prevText.find(text, 0, *len/sizeof(wchar_t))!=std::string::npos) // Check if the string is the same as the previous one
							return false;
						prevText.assign(text, *len/sizeof(wchar_t));
						
						return true;
					};
					NewHook(hp, "Ren'py");
					return true;
				}
			}
		}
		ConsoleOutput("Textractor: Ren'py failed: failed to find python2X.dll");
		return false;
	}
	int getGodoStringLength(uintptr_t stack, uintptr_t data) {
		int len = *(int*)(data - 4);
		len--;
		int checkLength = len > 0 && len < PIPE_BUFFER_SIZE ? len : 0;
		//检查是否为错误的unicode字符
		for (size_t i = 0; i < checkLength; i++)
		{
			if (*(WORD*)(data + i * 2) == 0x0)
				return 0;
		}
		return checkLength * 2;

	}
	//BY:IOV
	bool InsertGodotHook_X64() {
		const BYTE bytes[] = { 0x8B,0x40,0xFC,0x83,0xF8,0x01,0x83,0xD0,0xFF,0x41,0x39,0xC6 };

		ULONG64 range = min(processStopAddress - processStartAddress, X64_MAX_REL_ADDR);
		for (auto addr : Util::SearchMemory(bytes, sizeof(bytes), PAGE_EXECUTE, processStartAddress, processStartAddress + range)) {
			HookParam myhp = {};
			myhp.address = addr;

			myhp.type = USING_STRING | USING_UNICODE | NO_CONTEXT; // /HQ 不使用上下文区分 把所有线程的文本都提取
			//myhp.padding = 0xc;//[esp+4]+padding
			// data_offset
			myhp.offset = -0xC-4;//RCX
			myhp.length_fun = getGodoStringLength;
			char nameForUser[HOOK_NAME_SIZE] = "RichTextLabel_add_text";
			NewHook(myhp, nameForUser);
			ConsoleOutput("Insert: Godot_add_text_X64 Hook ");
			return true;
		}

		ConsoleOutput("vnreng:Godot_x64: pattern not found");
		return false;
	}	bool InsertGodotHook2_X64() {
		//by Blu3train
		/*
		* Sample games:
		* https://vndb.org/r109138
		*/
		const BYTE bytes[] = {
			0x48, 0x8B, 0x94, 0x24, XX4,       // mov rdx,[rsp+000001C0]	<- hook here
			0x4C, 0x89, 0xE1,                  // mov rcx,r12
			0xE8, XX4,                         // call NULL-Windows.exe+D150
			0x49, 0x8B, 0x06,                  // mov rax,[r14]
			0x48, 0x85, 0xC0,                  // test rax,rax
			0x0F, 0x85, XX4                    // jne NULL-Windows.exe+A359D4

		};

		ULONG64 range = min(processStopAddress - processStartAddress, X64_MAX_REL_ADDR);
		for (auto addr : Util::SearchMemory(bytes, sizeof(bytes), PAGE_EXECUTE, processStartAddress, processStartAddress + range)) {
			HookParam hp = {};
			hp.address = addr;
			hp.offset = pusha_rcx_off -4; //RCX
			hp.type = USING_STRING | USING_UNICODE;
			ConsoleOutput("vnreng: INSERT Godot2_x64 Hook ");
			NewHook(hp, "Godot2_x64");
			return true;
		}

		ConsoleOutput("vnreng:Godot2_x64: pattern not found");
		return false;
	}

	bool InsertGodotHooks_X64()
	{
	  return InsertGodotHook2_X64();
	}
	bool InsertRenpy3Hook()
	{
		//by Blu3train
		/*
		* Sample games:
		* https://vndb.org/v45820
		* https://vndb.org/v26318
		* https://vndb.org/v39954
		* https://vndb.org/r110220
		* https://vndb.org/r114981
		* https://vndb.org/v33647
		* https://vndb.org/r73160
		* https://vndb.org/v44518
		* https://vndb.org/v31994
		* https://vndb.org/r115756
		*/
		wchar_t python[] = L"python3X.dll", libpython[] = L"libpython3.X.dll";
		for (wchar_t* name : { python, libpython })
		{
			wchar_t* pos = wcschr(name, L'X');
			for (int pythonMinorVersion = 0; pythonMinorVersion <= 9; ++pythonMinorVersion)
			{
				*pos = L'0' + pythonMinorVersion;
				if (HMODULE module = GetModuleHandleW(name))
				{
					wcscpy_s(spDefault.exportModule, name);
					HookParam hp = {};
					hp.address = (uintptr_t)GetProcAddress(module, "PyUnicode_Format");
					if (!hp.address)
					{
						ConsoleOutput("Textractor: Ren'py 3 failed: failed to find PyUnicode_Format");
						return false;
					}
					hp.offset = pusha_rcx_off -4; // rcx
					hp.padding = 0x48;
					hp.length_offset = 0;
					hp.text_fun = [](DWORD rsp_base, HookParam *pHp, BYTE, DWORD* data, DWORD* split, DWORD* count)
					{
						uint64_t r10 = regof(r10, rsp_base);
						uint64_t r11 = regof(r11, rsp_base);
						if (r10==0x03FF || r11==0x03FF) {
							uint64_t rcx = regof(rcx, rsp_base);
							BYTE unicode = !(*(BYTE*)(rcx + 0x20) & 0x40); // [rcx+0x20) bit 0x40 == 0
							if (unicode) {
								*data += 0x48; //padding
								*count = wcslen((wchar_t*)*data) * sizeof(wchar_t);
								return;
							}
						}
						*count = 0;
					};
					hp.type = USING_STRING | USING_UNICODE | NO_CONTEXT;
					hp.filter_fun = [](LPVOID data, DWORD *size, HookParam *, BYTE)
					{
						auto text = reinterpret_cast<LPWSTR>(data);
						auto len = reinterpret_cast<size_t *>(size);

						if (cpp_wcsnstr(text, L"%", *len/sizeof(wchar_t)))
							return false;
						if (cpp_wcsnstr(text, L"{", *len/sizeof(wchar_t))) {
							WideStringCharReplacer(text, len, L"{i}", 3, L'\'');
							WideStringCharReplacer(text, len, L"{/i}", 4, L'\'');
							WideStringFilterBetween(text, len, L"{", 1, L"}", 1);
						}

						//CP_OEMCP -The current system OEM code page
						WideCharToMultiByte(CP_OEMCP, 0, text, -1, text_buffer, 0x1000, NULL, NULL);
						text_buffer_length = *len/sizeof(wchar_t); // saved for not unicode hook
						
						return true;
					};
					NewHook(hp, "Ren'py 3 unicode");

					hp.address += 6;
					hp.padding = 0x30;
					hp.text_fun = [](DWORD rsp_base, HookParam *pHp, BYTE, DWORD* data, DWORD* split, DWORD* count)
					{
						uint64_t r10 = regof(r10, rsp_base);
						uint64_t r11 = regof(r11, rsp_base);
						if (r10==0x03FF || r11==0x03FF) {
							uint64_t rcx = regof(rcx, rsp_base);
							BYTE unicode = !(*(BYTE*)(rcx + 0x20) & 0x40); // [rcx+0x20) bit 0x40 == 0

							*data += unicode ? 0x48 : 0x30; //padding
							*count = ::strlen((char*)*data);
							if (!cpp_strnstr((char*)*data, "%", *count)) // not garbage
								return;
						}
						*count = 0;
					};
					hp.type = USING_STRING | NO_CONTEXT;
					hp.filter_fun = [](LPVOID data, DWORD *size, HookParam *, BYTE)
					{
						auto text = reinterpret_cast<LPSTR>(data);
						auto len = reinterpret_cast<size_t *>(size);

						if (text[0]!=0 && text[1]==0) {
							// text from unicode hook
							*len = text_buffer_length;
							::memmove(text, text_buffer, *len);
						}
						if (cpp_strnstr(text, "%", *len))
							return false;
						if (cpp_strnstr(text, "{", *len)) {
							StringCharReplacer(text, len, "{i}", 3, L'\'');
							StringCharReplacer(text, len, "{/i}", 4, L'\'');
							StringFilterBetween(text, len, "{", 1, "}", 1);
						}

						return true;
					};
					NewHook(hp, "Ren'py 3");

					return true;
				}
			}
		}
		ConsoleOutput("Textractor: Ren'py 3 failed: failed to find python3X.dll");
		return false;
	}
	bool InsertLucaSystemHook()
	{
		//by Blu3train
		/*
		* Sample games:
		* https://vndb.org/r108105
		*/
		const BYTE bytes[] = {
			0xCC,                                // int 3 
			0x48, XX4,                           // mov [rsp+18],rbx       <- hook here
			0x55,                                // push rbp
			0x56,                                // push rsi
			0x57,                                // push rdi
			0x41, 0x54,                          // push r12
			0x41, 0x55,                          // push r13
			0x41, 0x56,                          // push r14
			0x41, 0x57,                          // push r15
			0x48, 0x8D, 0xAC, 0x24, XX4,         // lea rbp,[rsp-00003810]
			0xB8, XX4                            // mov eax,00003910
		};

		ULONG64 range = min(processStopAddress - processStartAddress, X64_MAX_REL_ADDR);
		for (auto addr : Util::SearchMemory(bytes, sizeof(bytes), PAGE_EXECUTE, processStartAddress, processStartAddress + range)) {
			HookParam hp = {};
			hp.address = addr + 1;
			hp.offset = pusha_rdx_off -4; //RDX
			hp.filter_fun = [](LPVOID data, DWORD *size, HookParam *, BYTE)
			{
				auto text = reinterpret_cast<LPWSTR>(data);
				auto len = reinterpret_cast<size_t *>(size);

				if (text[0] == L'\x3000') { //removes space at the beginning of the sentence
					*len -= 2;
					::memmove(text, text + 1, *len);
				}

				if ( *text == L'@' ) //Name in square brackets instead of '@'
					if ( wchar_t *match2 = cpp_wcsnchr(text+1, L'@', *len/2-1) ) {
						*text = L'[';
						*match2 = L']';
					}

				WideStringFilterBetween(text, len, L"$C(", 3, L")", 1);
				WideStringFilter(text, len, L"$A", 3); // remove $A followed by 1 char
				WideStringCharReplacer(text, len, L"$d", 2, L'\n');
				WideCharFilter(text, len, L'\xFF3F');
				//ruby
				WideStringFilter(text, len, L"$[", 2);
				WideStringFilterBetween(text, len, L"$/", 2, L"$]", 2);

				return true;
			};
			hp.type = USING_UNICODE | USING_STRING;
			ConsoleOutput("vnreng: INSERT LucaSystem Hook ");
			NewHook(hp, "LucaSystem");
			return true;
		}

		ConsoleOutput("vnreng:LucaSystem: pattern not found");
		return false;
	}

	bool InsertArtemisHook() {
		//by Blu3train
		/*
		* Sample games:
		* https://vndb.org/v45247
		*/
		const BYTE bytes[] = {
			0xCC,                               // int 3
			0x40, 0x57,                         // push rdi          <- hook here
			0x48, 0x83, 0xEC, 0x40,             // sub rsp,40
			0x48, 0xC7, 0x44, 0x24, 0x30, XX4,  // mov qword ptr [rsp+30],FFFFFFFFFFFFFFFE
			0x48, 0x89, 0x5C, 0x24, 0x50        // mov [rsp+50],rbx
		};

		ULONG64 range = min(processStopAddress - processStartAddress, X64_MAX_REL_ADDR);
		for (auto addr : Util::SearchMemory(bytes, sizeof(bytes), PAGE_EXECUTE, processStartAddress, processStartAddress + range)) {
			HookParam hp = {};
			hp.address = addr + 1;
			hp.offset = -0x44 -4; //RDI
			hp.type = USING_STRING | USING_UTF8 | NO_CONTEXT;
			ConsoleOutput("vnreng: INSERT Artemis Hook ");
			NewHook(hp, "Artemis");
			return true;
		}

		ConsoleOutput("vnreng:Artemis: pattern not found");
		return false;
	}

	bool InsertKiriKiriZHook()
	{
		//by Blu3train
		/*
		* Sample games:
		* RJ351843
		*/
		const BYTE bytes[] = {
			0xCC,                                                // int 3 
			0x4C, 0x89, 0x44, 0x24, 0x18,                        // mov [rsp+18],r8       <- hook here
			0x48, 0x89, 0x54, 0x24, 0x10,                        // mov [rsp+10],rdx
			0x53,                                                // push rbx
			0x56,                                                // push rsi
			0x57,                                                // push rdi
			0x41, 0x54,                                          // push r12
			0x41, 0x55,                                          // push r13
			0x41, 0x56,                                          // push r14
			0x41, 0x57,                                          // push r15
			0x48, 0x83, 0xEC, 0x40,                              // sub rsp,40
			0x48, 0xC7, 0x44, 0x24, 0x30, 0xFE, 0xFF, 0xFF, 0xFF // mov qword ptr [rsp+30],FFFFFFFFFFFFFFFE
		};

		ULONG64 range = min(processStopAddress - processStartAddress, X64_MAX_REL_ADDR);
		for (auto addr : Util::SearchMemory(bytes, sizeof(bytes), PAGE_EXECUTE, processStartAddress, processStartAddress + range)) {
			HookParam hp = {};
			hp.address = addr + 1;
			hp.offset = -0x1C -4; //RCX
			hp.index = 0x18;
			hp.length_offset = 1;
			hp.type = USING_UNICODE | DATA_INDIRECT;
			ConsoleOutput("vnreng: INSERT KiriKiriZ Hook ");
			NewHook(hp, "KiriKiriZ");
			return true;
		}

		ConsoleOutput("vnreng:KiriKiriZ: pattern not found");
		return false;
	}

	bool UnsafeDetermineEngineType()
	{
		if (Util::CheckFile(L"PPSSPP*.exe") && FindPPSSPP()) return true;

		if (Util::CheckFile(L"*.pck")) {
			return InsertGodotHooks_X64();			 
		}

		for (const wchar_t* moduleName : { (const wchar_t*)NULL, L"node.dll", L"nw.dll" }) if (InsertV8Hook(GetModuleHandleW(moduleName))) return true;

		if (GetModuleHandleW(L"GameAssembly.dll")) // TODO: is there a way to autofind hook?
		{
			ConsoleOutput("Textractor: Precompiled Unity found (searching for hooks should work)");
			wcscpy_s(spDefault.boundaryModule, L"GameAssembly.dll");
			spDefault.padding = 20;
			return true;
		}

		if (Util::CheckFile(L"files/*.PAK")) {
			InsertLucaSystemHook();
			return true;
		}

		if (Util::CheckFile(L"*.pfs")) {
			InsertArtemisHook();
			return true;
		}

		if (Util::CheckFile(L"*.py") && InsertRenpyHook()) return true;

		for (const wchar_t* monoName : { L"mono.dll", L"mono-2.0-bdwgc.dll" }) if (HMODULE module = GetModuleHandleW(monoName)) if (InsertMonoHooks(module)) return true;

		if (Util::CheckFile(L"*.xp3") || Util::SearchResourceString(L"TVP(KIRIKIRI) Z ")) { // TVP(KIRIKIRI) Z CORE
			if (InsertKiriKiriZHook())
				return true;
		}

		for (std::wstring DXVersion : { L"d3dx9", L"d3dx10" })
			if (HMODULE module = GetModuleHandleW(DXVersion.c_str())) PcHooks::hookD3DXFunctions(module);
			else for (int i = 0; i < 50; ++i)
				if (HMODULE module = GetModuleHandleW((DXVersion + L"_" + std::to_wstring(i)).c_str())) PcHooks::hookD3DXFunctions(module);

		PcHooks::hookGDIFunctions();
		PcHooks::hookGDIPlusFunctions();
		return false;
	}
}