1 |
|
#include "Daodan_Patch.h" |
2 |
+ |
#include "Daodan_Utility.h" |
3 |
+ |
#include <beaengine/BeaEngine.h> |
4 |
+ |
|
5 |
|
#include <windows.h> |
6 |
|
#include <stdlib.h> |
7 |
|
#include <string.h> |
38 |
|
return false; |
39 |
|
} |
40 |
|
|
41 |
+ |
void* DDrPatch_MakeDetour(void* from, void* to) |
42 |
+ |
{ |
43 |
+ |
int len = 0; |
44 |
+ |
/* |
45 |
+ |
DISASM MyDisasm; |
46 |
+ |
int i = 0; |
47 |
+ |
DDrStartupMessage(""); |
48 |
+ |
DDrStartupMessage(""); |
49 |
+ |
|
50 |
+ |
memset (&MyDisasm, 0, sizeof(DISASM)); |
51 |
+ |
MyDisasm.EIP = (UIntPtr) from; |
52 |
+ |
i = 0; |
53 |
+ |
DDrStartupMessage("Orig before @ 0x%06x", from); |
54 |
+ |
while (i<10){ |
55 |
+ |
len = Disasm(&MyDisasm); |
56 |
+ |
if (len != UNKNOWN_OPCODE) { |
57 |
+ |
DDrStartupMessage("%s, Opcode: 0x%x, len: %d, branch: %d, to: 0x%06x", MyDisasm.CompleteInstr, MyDisasm.Instruction.Opcode, len, MyDisasm.Instruction.BranchType, MyDisasm.Instruction.AddrValue); |
58 |
+ |
DDrStartupMessage(" Cat: 0x%04x, prefix count: %d", MyDisasm.Instruction.Category & 0xffff, MyDisasm.Prefix.Number ); |
59 |
+ |
MyDisasm.EIP += (UIntPtr)len; |
60 |
+ |
i++; |
61 |
+ |
} |
62 |
+ |
}; |
63 |
+ |
DDrStartupMessage(""); |
64 |
+ |
*/ |
65 |
+ |
|
66 |
+ |
DISASM disasm; |
67 |
+ |
memset(&disasm, 0, sizeof(DISASM)); |
68 |
+ |
disasm.EIP = (UIntPtr) from; |
69 |
+ |
|
70 |
+ |
char* trampoline = malloc(40); |
71 |
+ |
DDrPatch_NOOP(trampoline, 40); |
72 |
+ |
int pos = 0; |
73 |
+ |
int branches = 0; |
74 |
+ |
|
75 |
+ |
while (((void*)disasm.EIP - from) < 5) { |
76 |
+ |
len = Disasm(&disasm); |
77 |
+ |
if (len != UNKNOWN_OPCODE) { |
78 |
+ |
if ((disasm.Instruction.Category & 0xffff) == CONTROL_TRANSFER) { |
79 |
+ |
if (disasm.Prefix.Number > 0) { |
80 |
+ |
DDrStartupMessage("Daodan: Detour: Branch in trampoline area from address 0x%08x with prefixes", from); |
81 |
+ |
return (void*)-1; |
82 |
+ |
} |
83 |
+ |
branches++; |
84 |
+ |
int target = disasm.Instruction.AddrValue; |
85 |
+ |
bool targetInTrampoline = ((void*)disasm.Instruction.AddrValue - from) < 5; |
86 |
+ |
switch (disasm.Instruction.BranchType) { |
87 |
+ |
case JmpType: |
88 |
+ |
case CallType: |
89 |
+ |
if (targetInTrampoline) { |
90 |
+ |
int offset = disasm.Instruction.AddrValue - disasm.EIP; |
91 |
+ |
if (disasm.Instruction.BranchType == JmpType) |
92 |
+ |
DDrPatch_MakeJump(&trampoline[pos], &trampoline[pos]+offset); |
93 |
+ |
else |
94 |
+ |
DDrPatch_MakeCall(&trampoline[pos], &trampoline[pos]+offset); |
95 |
+ |
} else { |
96 |
+ |
if (disasm.Instruction.BranchType == JmpType) |
97 |
+ |
DDrPatch_MakeJump(&trampoline[pos], (void*)target); |
98 |
+ |
else |
99 |
+ |
DDrPatch_MakeCall(&trampoline[pos], (void*)target); |
100 |
+ |
} |
101 |
+ |
pos += 5; |
102 |
+ |
break; |
103 |
+ |
case RetType: |
104 |
+ |
case JECXZ: |
105 |
+ |
memcpy(&trampoline[pos], (void*)disasm.EIP, len); |
106 |
+ |
pos += len; |
107 |
+ |
break; |
108 |
+ |
// Opcode +1 |
109 |
+ |
case JO: |
110 |
+ |
case JC: |
111 |
+ |
case JE: |
112 |
+ |
case JNA: |
113 |
+ |
case JS: |
114 |
+ |
case JP: |
115 |
+ |
case JL: |
116 |
+ |
case JNG: |
117 |
+ |
if (targetInTrampoline) { |
118 |
+ |
memcpy(&trampoline[pos], (void*)disasm.EIP, len); |
119 |
+ |
pos += len; |
120 |
+ |
} else { |
121 |
+ |
trampoline[pos++] = disasm.Instruction.Opcode + 1; |
122 |
+ |
trampoline[pos++] = 5; |
123 |
+ |
DDrPatch_MakeJump(&trampoline[pos], (void*)target); |
124 |
+ |
pos += 5; |
125 |
+ |
} |
126 |
+ |
break; |
127 |
+ |
// Opcode -1 |
128 |
+ |
case JNO: |
129 |
+ |
case JNC: |
130 |
+ |
case JNE: |
131 |
+ |
case JA: |
132 |
+ |
case JNS: |
133 |
+ |
case JNP: |
134 |
+ |
case JNL: |
135 |
+ |
case JG: |
136 |
+ |
if (targetInTrampoline) { |
137 |
+ |
memcpy(&trampoline[pos], (void*)disasm.EIP, len); |
138 |
+ |
pos += len; |
139 |
+ |
} else { |
140 |
+ |
trampoline[pos++] = disasm.Instruction.Opcode - 1; |
141 |
+ |
trampoline[pos++] = 5; |
142 |
+ |
DDrPatch_MakeJump(&trampoline[pos], (void*)target); |
143 |
+ |
pos += 5; |
144 |
+ |
} |
145 |
+ |
break; |
146 |
+ |
default: |
147 |
+ |
DDrStartupMessage("Daodan: Detour: Unknown branch in trampoline area from address 0x%08x", from); |
148 |
+ |
return (void*)-1; |
149 |
+ |
} |
150 |
+ |
} else { |
151 |
+ |
memcpy(&trampoline[pos], (void*)disasm.EIP, len); |
152 |
+ |
pos += len; |
153 |
+ |
} |
154 |
+ |
disasm.EIP += (UIntPtr)len; |
155 |
+ |
} |
156 |
+ |
else { |
157 |
+ |
DDrStartupMessage("Daodan: Detour: Unknown opcode in trampoline area from address 0x%08x", from); |
158 |
+ |
return (void*)-1; |
159 |
+ |
} |
160 |
+ |
} |
161 |
+ |
|
162 |
+ |
if (branches > 1) { |
163 |
+ |
DDrStartupMessage("Daodan: Detour: Too many branches in trampoline'd code from address 0x%08x: %d", from, branches); |
164 |
+ |
return (void*)-1; |
165 |
+ |
} |
166 |
+ |
|
167 |
+ |
|
168 |
+ |
DDrPatch_MakeJump(&trampoline[pos], (void*)disasm.EIP); |
169 |
+ |
DDrPatch_NOOP(from, (void*)disasm.EIP - from); |
170 |
+ |
DDrPatch_MakeJump(from, to); |
171 |
+ |
/* |
172 |
+ |
memset (&MyDisasm, 0, sizeof(DISASM)); |
173 |
+ |
MyDisasm.EIP = (UIntPtr) trampoline; |
174 |
+ |
i = 0; |
175 |
+ |
DDrStartupMessage("Trampoline @ 0x%06x", trampoline); |
176 |
+ |
while (i<10){ |
177 |
+ |
len = Disasm(&MyDisasm); |
178 |
+ |
if (len != UNKNOWN_OPCODE) { |
179 |
+ |
DDrStartupMessage(MyDisasm.CompleteInstr); |
180 |
+ |
MyDisasm.EIP += (UIntPtr)len; |
181 |
+ |
i++; |
182 |
+ |
} |
183 |
+ |
}; |
184 |
+ |
DDrStartupMessage(""); |
185 |
+ |
|
186 |
+ |
memset (&MyDisasm, 0, sizeof(DISASM)); |
187 |
+ |
MyDisasm.EIP = disasm.EIP; |
188 |
+ |
i = 0; |
189 |
+ |
DDrStartupMessage("Orig after @ 0x%06x", disasm.EIP); |
190 |
+ |
while (i<7){ |
191 |
+ |
len = Disasm(&MyDisasm); |
192 |
+ |
if (len != UNKNOWN_OPCODE) { |
193 |
+ |
DDrStartupMessage(MyDisasm.CompleteInstr); |
194 |
+ |
MyDisasm.EIP += (UIntPtr)len; |
195 |
+ |
i++; |
196 |
+ |
} |
197 |
+ |
}; |
198 |
+ |
DDrStartupMessage(""); |
199 |
+ |
|
200 |
+ |
memset (&MyDisasm, 0, sizeof(DISASM)); |
201 |
+ |
MyDisasm.EIP = (UIntPtr) from; |
202 |
+ |
i = 0; |
203 |
+ |
DDrStartupMessage("Orig start after @ 0x%06x", from); |
204 |
+ |
while (i<3){ |
205 |
+ |
len = Disasm(&MyDisasm); |
206 |
+ |
if (len != UNKNOWN_OPCODE) { |
207 |
+ |
DDrStartupMessage(MyDisasm.CompleteInstr); |
208 |
+ |
MyDisasm.EIP += (UIntPtr)len; |
209 |
+ |
i++; |
210 |
+ |
} |
211 |
+ |
}; |
212 |
+ |
DDrStartupMessage(""); |
213 |
+ |
DDrStartupMessage(""); |
214 |
+ |
DDrStartupMessage(""); |
215 |
+ |
*/ |
216 |
+ |
return trampoline; |
217 |
+ |
} |
218 |
+ |
|
219 |
|
bool DDrPatch_String(char* dest, const unsigned char* string, int length) |
220 |
|
{ |
221 |
|
DWORD oldp; |