WillPlus3 hook (#18)
Fixed By [lgztx96](https://github.com/Artikash/Textractor/pull/880) Co-authored-by: lgztx <z2337878191@outlook.com>
This commit is contained in:
parent
1f7d8d77a8
commit
ff5ea30230
@ -9672,7 +9672,7 @@ static bool InsertNewWillPlusHook()
|
||||
found = true;
|
||||
}
|
||||
/*
|
||||
hook cmp esi,0x3000
|
||||
hook cmp esi or ebx,0x3000
|
||||
Sample games:
|
||||
https://vndb.org/r54549
|
||||
https://vndb.org/v22705
|
||||
@ -9680,17 +9680,25 @@ static bool InsertNewWillPlusHook()
|
||||
https://vndb.org/v25719
|
||||
https://vndb.org/v27227
|
||||
https://vndb.org/v27385
|
||||
https://vndb.org/v34544
|
||||
https://vndb.org/v35279
|
||||
https://vndb.org/r94284
|
||||
*/
|
||||
const BYTE pattern[] =
|
||||
{
|
||||
0x81,0xfe,0x00,0x30,0x00,0x00 //81FE 00300000 cmp esi,0x3000
|
||||
0x81,XX, 0x00,0x30,0x00,0x00 // 81FE or FB 00300000 cmp esi or ebx,0x3000
|
||||
// je xx
|
||||
// hook here
|
||||
};
|
||||
for (auto addr : Util::SearchMemory(pattern, sizeof(pattern), PAGE_EXECUTE, processStartAddress, processStopAddress))
|
||||
{
|
||||
BYTE byte = *(BYTE*)(addr + 1);
|
||||
if (byte != 0xfe && byte != 0xfb)
|
||||
continue;
|
||||
HookParam hp = {};
|
||||
hp.address = addr;
|
||||
hp.address = addr + 8;
|
||||
hp.type = USING_UNICODE;
|
||||
hp.offset = pusha_esi_off - 4;
|
||||
hp.offset = byte == 0xfe ? pusha_esi_off - 4 : pusha_ebx_off - 4;
|
||||
hp.length_offset = 1;
|
||||
NewHook(hp, "WillPlus3");
|
||||
found = true;
|
||||
@ -9704,7 +9712,7 @@ static bool InsertNewWillPlusHook()
|
||||
bool InsertWillPlusHook()
|
||||
{
|
||||
bool ok = InsertOldWillPlusHook();
|
||||
ok = InsertWillPlusWHook() || InsertWillPlusAHook() || InsertNewWillPlusHook() || ok;
|
||||
ok = InsertWillPlusWHook() || InsertNewWillPlusHook() || InsertWillPlusAHook() || ok;
|
||||
if (!ok) PcHooks::hookOtherPcFunctions();
|
||||
return ok;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user