From f22ccbd90921abd5e286fe62cddf8c31e7064fcd Mon Sep 17 00:00:00 2001 From: Akash Mozumdar Date: Sat, 4 Aug 2018 01:27:28 -0400 Subject: [PATCH] clean up engine more, prepare for 64-bit support --- vnrhook/include/types.h | 18 ++++------ vnrhook/src/engine/engine.cc | 5 +-- vnrhook/src/hijack/texthook.cc | 5 ++- vnrhook/src/util/ithsys/ithsys.cc | 40 ---------------------- vnrhook/src/util/ithsys/ithsys.h | 1 - vnrhook/src/util/util.cc | 57 +++++-------------------------- vnrhook/src/util/util.h | 18 ---------- 7 files changed, 19 insertions(+), 125 deletions(-) diff --git a/vnrhook/include/types.h b/vnrhook/include/types.h index 442b766..6d9e2db 100644 --- a/vnrhook/include/types.h +++ b/vnrhook/include/types.h @@ -27,13 +27,13 @@ struct HookParam { // jichi 10/24/2014: Add generic hook function, return false if stop execution. typedef bool (*hook_fun_t)(DWORD esp, HookParam *hp); - DWORD address; // absolute or relative address - DWORD offset, // offset of the data in the memory - index, // ? - split, // esp offset of the split character = pusha offset - 4 - split_index; // ? - DWORD module, // hash of the module - function; + unsigned __int64 address; // absolute or relative address + short offset, // offset of the data in the memory + index, + split, // offset of the split character + split_index; + + DWORD module; // hash of the module text_fun_t text_fun; filter_fun_t filter_fun; hook_fun_t hook_fun; @@ -42,10 +42,6 @@ struct HookParam { BYTE hook_len, // ? recover_len; // ? - // 2/2/2015: jichi number of times - 1 to run the hook - BYTE extra_text_count; - BYTE _unused; // jichi 2/2/2015: add a BYTE type to make to total sizeof(HookParam) even. - // 7/20/2014: jichi additional parameters for PSP games DWORD user_flags, user_value; diff --git a/vnrhook/src/engine/engine.cc b/vnrhook/src/engine/engine.cc index 4245670..9ae821f 100644 --- a/vnrhook/src/engine/engine.cc +++ b/vnrhook/src/engine/engine.cc @@ -9291,7 +9291,6 @@ bool InsertWillPlusAHook() hp.address = addr; hp.text_fun = SpecialHookWillPlusA; hp.type = NO_CONTEXT; - hp.extra_text_count = 1; hp.filter_fun = NewLineStringFilter; // remove two characters of "\\n" ConsoleOutput("vnreng: INSERT WillPlusA"); NewHook(hp, "WillPlusA"); @@ -13946,7 +13945,6 @@ bool Insert5pbHook3() hp.address = addr; hp.type = USING_STRING|NO_CONTEXT; hp.text_fun = SpecialHook5pb3; - hp.extra_text_count = 1; // extract character name in arg1 hp.filter_fun = NewLineCharToSpaceFilter; // replace '\n' by ' ' ConsoleOutput("vnreng: INSERT 5pb3"); NewHook(hp, "5pb3"); @@ -16024,8 +16022,7 @@ bool InsertLovaGameHook() */ bool InsertAdobeAirHook() { - enum { module = 0xd107ed5f }; // hash of "Adobe AIR.dll" - DWORD base = Util::FindModuleBase(module); + DWORD base = (DWORD)GetModuleHandleW(L"Adobe AIR.dll"); if (!base) { ConsoleOutput("vnreng:Adobe AIR: module not found"); return false; diff --git a/vnrhook/src/hijack/texthook.cc b/vnrhook/src/hijack/texthook.cc index 9d6b587..35a51e6 100644 --- a/vnrhook/src/hijack/texthook.cc +++ b/vnrhook/src/hijack/texthook.cc @@ -392,8 +392,7 @@ int TextHook::UnsafeInsertHookCode() memcpy(inst + 1, &relRecover, sizeof(void*)); r += sizeof(common_hook); hp.hook_len = 5; - //bool jmpflag=false; // jichi 9/28/2013: nto used - // Copy original code. + int address = hp.address; switch (MapInstruction(hp.address, (DWORD)r, hp.hook_len, hp.recover_len)) { case -1: ConsoleOutput("vnrcli:UnsafeInsertHookCode: FAILED: failed to map instruction"); @@ -404,7 +403,7 @@ int TextHook::UnsafeInsertHookCode() mov ecx,this movzx eax,[ecx]hp.hook_len movzx edx,[ecx]hp.recover_len - add edx,[ecx]hp.address + add edx,address add eax,r add eax,5 sub edx,eax diff --git a/vnrhook/src/util/ithsys/ithsys.cc b/vnrhook/src/util/ithsys/ithsys.cc index d671feb..bc304f8 100644 --- a/vnrhook/src/util/ithsys/ithsys.cc +++ b/vnrhook/src/util/ithsys/ithsys.cc @@ -76,46 +76,6 @@ inline DWORD GetHash(LPSTR str) return hash; } -//Query module export table. Return function address if found. -//Similar to GetProcAddress -DWORD GetExportAddress(DWORD hModule,DWORD hash) -{ - IMAGE_DOS_HEADER *DosHdr; - IMAGE_NT_HEADERS *NtHdr; - IMAGE_EXPORT_DIRECTORY *ExtDir; - UINT uj; - char* pcExportAddr,*pcFuncPtr,*pcBuffer; - DWORD dwReadAddr,dwFuncAddr,dwFuncName; - WORD wOrd; - DosHdr = (IMAGE_DOS_HEADER*)hModule; - if (IMAGE_DOS_SIGNATURE==DosHdr->e_magic) { - dwReadAddr=hModule+DosHdr->e_lfanew; - NtHdr=(IMAGE_NT_HEADERS*)dwReadAddr; - if (IMAGE_NT_SIGNATURE == NtHdr->Signature) { - pcExportAddr = (char*)((DWORD)hModule+ - (DWORD)NtHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); - if (!pcExportAddr) - return 0; - ExtDir = (IMAGE_EXPORT_DIRECTORY*)pcExportAddr; - pcExportAddr = (char*)((DWORD)hModule+(DWORD)ExtDir->AddressOfNames); - - for (uj = 0; uj < ExtDir->NumberOfNames; uj++) { - dwFuncName = *(DWORD *)pcExportAddr; - pcBuffer = (char*)((DWORD)hModule+dwFuncName); - if (GetHash(pcBuffer) == hash) { - pcFuncPtr = (char*)((DWORD)hModule+(DWORD)ExtDir->AddressOfNameOrdinals+(uj*sizeof(WORD))); - wOrd = *(WORD*)pcFuncPtr; - pcFuncPtr = (char*)((DWORD)hModule+(DWORD)ExtDir->AddressOfFunctions+(wOrd*sizeof(DWORD))); - dwFuncAddr = *(DWORD *)pcFuncPtr; - return hModule+dwFuncAddr; - } - pcExportAddr += sizeof(DWORD); - } - } - } - return 0; -} - } // extern "C" // EOF \ No newline at end of file diff --git a/vnrhook/src/util/ithsys/ithsys.h b/vnrhook/src/util/ithsys/ithsys.h index 381f01b..a5ed46a 100644 --- a/vnrhook/src/util/ithsys/ithsys.h +++ b/vnrhook/src/util/ithsys/ithsys.h @@ -16,7 +16,6 @@ extern "C" { DWORD SearchPattern(DWORD base, DWORD base_length, LPCVOID search, DWORD search_length); // KMP DWORD IthGetMemoryRange(LPCVOID mem, DWORD *base, DWORD *size); -DWORD GetExportAddress(DWORD hModule,DWORD hash); } // extern "C" extern BYTE LeadByteTable[]; diff --git a/vnrhook/src/util/util.cc b/vnrhook/src/util/util.cc index a522b77..3babc7b 100644 --- a/vnrhook/src/util/util.cc +++ b/vnrhook/src/util/util.cc @@ -13,15 +13,15 @@ DWORD SigMask(DWORD sig) { __asm { - xor ecx,ecx - mov eax,sig + xor ecx,ecx //ecx = 0 + mov eax,sig //eax = sig _mask: - shr eax,8 - inc ecx - test eax,eax - jnz _mask - sub ecx,4 - neg ecx + shr eax,8 // eax >>= 8 + inc ecx //++ecx + test eax,eax // if (eax > 0) + jnz _mask //goto _mask + sub ecx,4 //ecx -= 4 + neg ecx //ecx *= -1 or eax,-1 shl ecx,3 shr eax,cl @@ -265,7 +265,7 @@ DWORD Util::FindImportEntry(DWORD hModule, DWORD fun) // Search string in rsrc section. This section usually contains version and copyright info. bool Util::SearchResourceString(LPCWSTR str) { - DWORD hModule = Util::GetModuleBase(); + DWORD hModule = (DWORD)GetModuleHandleW(nullptr); IMAGE_DOS_HEADER *DosHdr; IMAGE_NT_HEADERS *NtHdr; DosHdr = (IMAGE_DOS_HEADER *)hModule; @@ -286,43 +286,4 @@ bool Util::SearchResourceString(LPCWSTR str) return false; } -// jichi 4/15/2014: Copied from GetModuleBase in ITH CLI, for debugging purpose -DWORD Util::FindModuleBase(DWORD hash) -{ - __asm - { - mov eax,fs:[0x30] - mov eax,[eax+0xc] - mov esi,[eax+0x14] - mov edi,_wcslwr -listfind: - mov edx,[esi+0x28] - test edx,edx - jz notfound - push edx - call edi - pop edx - xor eax,eax -calc: - movzx ecx, word ptr [edx] - test cl,cl - jz fin - ror eax,7 - add eax,ecx - add edx,2 - jmp calc -fin: - cmp eax,[hash] - je found - mov esi,[esi] - jmp listfind -notfound: - xor eax,eax - jmp termin -found: - mov eax,[esi+0x10] -termin: - } -} - // EOF diff --git a/vnrhook/src/util/util.h b/vnrhook/src/util/util.h index 409058e..2788d87 100644 --- a/vnrhook/src/util/util.h +++ b/vnrhook/src/util/util.h @@ -20,26 +20,8 @@ DWORD FindEntryAligned(DWORD start, DWORD back_range); DWORD FindImportEntry(DWORD hModule, DWORD fun); bool CheckFile(LPCWSTR name); -// jichi 4/15/2014: Copied from ITH CLI, for debugging purpose -DWORD FindModuleBase(DWORD hash); - bool SearchResourceString(LPCWSTR str); -/** - * @return HANDLE module handle - */ -inline DWORD GetModuleBase() -{ - __asm - { - mov eax,fs:[0x18] - mov eax,[eax+0x30] - mov eax,[eax+0xc] - mov eax,[eax+0xc] - mov eax,[eax+0x18] - } -} - } // namespace Util // EOF