| 44 | 
   | 
 /* | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 45 | 
   | 
     DISASM MyDisasm; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 46 | 
   | 
     int i = 0; | 
 
 
 
 
 
 
 
 
 
 
 
 | 47 | 
 < | 
     DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 48 | 
 < | 
     DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 
 | 47 | 
 > | 
     STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 | 48 | 
 > | 
     STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 
 
 
 
 
 
 | 49 | 
   | 
  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 50 | 
   | 
     memset (&MyDisasm, 0, sizeof(DISASM)); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 51 | 
   | 
     MyDisasm.EIP = (UIntPtr) from; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 52 | 
   | 
     i = 0; | 
 
 
 
 
 
 
 
 
 
 
 
 | 53 | 
 < | 
     DDrStartupMessage("Orig before @ 0x%06x", from); | 
 
 
 
 
 
 
 
 
 
 | 53 | 
 > | 
     STARTUPMESSAGE("Orig before @ 0x%06x", from); | 
 
 
 
 
 
 
 
 
 
 
 
 | 54 | 
   | 
     while (i<10){ | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 55 | 
   | 
         len = Disasm(&MyDisasm); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 56 | 
   | 
         if (len != UNKNOWN_OPCODE) { | 
 
 
 
 
 
 
 
 
 
 
 
 | 57 | 
 < | 
                         DDrStartupMessage("%s, Opcode: 0x%x, len: %d, branch: %d, to: 0x%06x", MyDisasm.CompleteInstr, MyDisasm.Instruction.Opcode, len, MyDisasm.Instruction.BranchType, MyDisasm.Instruction.AddrValue); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 58 | 
 < | 
                         DDrStartupMessage("    Cat: 0x%04x, prefix count: %d", MyDisasm.Instruction.Category & 0xffff, MyDisasm.Prefix.Number ); | 
 
 
 
 
 
 
 
 
 
 | 57 | 
 > | 
                         STARTUPMESSAGE("%s, Opcode: 0x%x, len: %d, branch: %d, to: 0x%06x", MyDisasm.CompleteInstr, MyDisasm.Instruction.Opcode, len, MyDisasm.Instruction.BranchType, MyDisasm.Instruction.AddrValue); | 
 
 
 
 
 
 | 58 | 
 > | 
                         STARTUPMESSAGE("    Cat: 0x%04x, prefix count: %d", MyDisasm.Instruction.Category & 0xffff, MyDisasm.Prefix.Number ); | 
 
 
 
 
 
 
 
 
 
 
 
 | 59 | 
   | 
             MyDisasm.EIP += (UIntPtr)len; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 60 | 
   | 
             i++; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 61 | 
   | 
         } | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 62 | 
   | 
     }; | 
 
 
 
 
 
 
 
 
 
 
 
 | 63 | 
 < | 
     DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 
 | 63 | 
 > | 
     STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 
 
 
 
 
 
 | 64 | 
   | 
 */ | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 65 | 
   | 
  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 66 | 
   | 
         DISASM disasm; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 77 | 
   | 
                 if (len != UNKNOWN_OPCODE) { | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 78 | 
   | 
                         if ((disasm.Instruction.Category & 0xffff) == CONTROL_TRANSFER) { | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 79 | 
   | 
                                 if (disasm.Prefix.Number > 0) { | 
 
 
 
 
 
 
 
 
 
 
 
 | 80 | 
 < | 
                                                 DDrStartupMessage("Daodan: Detour: Branch in trampoline area from address 0x%08x with prefixes", from); | 
 
 
 
 
 
 
 
 
 
 | 80 | 
 > | 
                                                 STARTUPMESSAGE("Detour: Branch in trampoline area from address 0x%08x with prefixes", from); | 
 
 
 
 
 
 
 
 
 
 
 
 | 81 | 
   | 
                                                 return (void*)-1; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 82 | 
   | 
                                 } | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 83 | 
   | 
                                 branches++; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 144 | 
   | 
                                                 } | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 145 | 
   | 
                                                 break; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 146 | 
   | 
                                         default: | 
 
 
 
 
 
 
 
 
 
 
 
 | 147 | 
 < | 
                                                 DDrStartupMessage("Daodan: Detour: Unknown branch in trampoline area from address 0x%08x", from); | 
 
 
 
 
 
 
 
 
 
 | 147 | 
 > | 
                                                 STARTUPMESSAGE("Detour: Unknown branch in trampoline area from address 0x%08x", from); | 
 
 
 
 
 
 
 
 
 
 
 
 | 148 | 
   | 
                                                 return (void*)-1; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 149 | 
   | 
                                 } | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 150 | 
   | 
                         } else { | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 154 | 
   | 
                         disasm.EIP += (UIntPtr)len; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 155 | 
   | 
                 } | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 156 | 
   | 
                 else { | 
 
 
 
 
 
 
 
 
 
 
 
 | 157 | 
 < | 
                         DDrStartupMessage("Daodan: Detour: Unknown opcode in trampoline area from address 0x%08x", from); | 
 
 
 
 
 
 
 
 
 
 | 157 | 
 > | 
                         STARTUPMESSAGE("Detour: Unknown opcode in trampoline area from address 0x%08x", from); | 
 
 
 
 
 
 
 
 
 
 
 
 | 158 | 
   | 
                         return (void*)-1; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 159 | 
   | 
                 } | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 160 | 
   | 
         } | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 161 | 
   | 
  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 162 | 
   | 
         if (branches > 1) { | 
 
 
 
 
 
 
 
 
 
 
 
 | 163 | 
 < | 
                 DDrStartupMessage("Daodan: Detour: Too many branches in trampoline'd code from address 0x%08x: %d", from, branches); | 
 
 
 
 
 
 
 
 
 
 | 163 | 
 > | 
                 STARTUPMESSAGE("Detour: Too many branches in trampoline'd code from address 0x%08x: %d", from, branches); | 
 
 
 
 
 
 
 
 
 
 
 
 | 164 | 
   | 
                 return (void*)-1; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 165 | 
   | 
         } | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 166 | 
   | 
  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 170 | 
   | 
  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 171 | 
   | 
         DWORD oldp; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 172 | 
   | 
         if (!VirtualProtect(trampoline, 40, PAGE_EXECUTE_READWRITE, &oldp)) { | 
 
 
 
 
 
 
 
 
 
 
 
 | 173 | 
 < | 
                 DDrStartupMessage("Daodan: Detour: Could not mark page for trampoline as executable: from address 0x%08x", from); | 
 
 
 
 
 
 
 
 
 
 | 173 | 
 > | 
                 STARTUPMESSAGE("Detour: Could not mark page for trampoline as executable: from address 0x%08x", from); | 
 
 
 
 
 
 
 
 
 
 
 
 | 174 | 
   | 
                 return (void*)-1; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 175 | 
   | 
         } | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 176 | 
   | 
         DDrPatch_MakeJump(from, to); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 178 | 
   | 
     memset (&MyDisasm, 0, sizeof(DISASM)); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 179 | 
   | 
     MyDisasm.EIP = (UIntPtr) trampoline; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 180 | 
   | 
     i = 0; | 
 
 
 
 
 
 
 
 
 
 
 
 | 181 | 
 < | 
     DDrStartupMessage("Trampoline @ 0x%06x", trampoline); | 
 
 
 
 
 
 
 
 
 
 | 181 | 
 > | 
     STARTUPMESSAGE("Trampoline @ 0x%06x", trampoline); | 
 
 
 
 
 
 
 
 
 
 
 
 | 182 | 
   | 
     while (i<10){ | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 183 | 
   | 
         len = Disasm(&MyDisasm); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 184 | 
   | 
         if (len != UNKNOWN_OPCODE) { | 
 
 
 
 
 
 
 
 
 
 
 
 | 185 | 
 < | 
             DDrStartupMessage(MyDisasm.CompleteInstr); | 
 
 
 
 
 
 
 
 
 
 | 185 | 
 > | 
             STARTUPMESSAGE("%s", MyDisasm.CompleteInstr); | 
 
 
 
 
 
 
 
 
 
 
 
 | 186 | 
   | 
             MyDisasm.EIP += (UIntPtr)len; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 187 | 
   | 
             i++; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 188 | 
   | 
         } | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 189 | 
   | 
     }; | 
 
 
 
 
 
 
 
 
 
 
 
 | 190 | 
 < | 
     DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 
 | 190 | 
 > | 
     STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 
 
 
 
 
 
 | 191 | 
   | 
       | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 192 | 
   | 
     memset (&MyDisasm, 0, sizeof(DISASM)); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 193 | 
   | 
     MyDisasm.EIP = disasm.EIP; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 194 | 
   | 
     i = 0; | 
 
 
 
 
 
 
 
 
 
 
 
 | 195 | 
 < | 
     DDrStartupMessage("Orig after @ 0x%06x", disasm.EIP); | 
 
 
 
 
 
 
 
 
 
 | 195 | 
 > | 
     STARTUPMESSAGE("Orig after @ 0x%06x", disasm.EIP); | 
 
 
 
 
 
 
 
 
 
 
 
 | 196 | 
   | 
     while (i<7){ | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 197 | 
   | 
         len = Disasm(&MyDisasm); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 198 | 
   | 
         if (len != UNKNOWN_OPCODE) { | 
 
 
 
 
 
 
 
 
 
 
 
 | 199 | 
 < | 
             DDrStartupMessage(MyDisasm.CompleteInstr); | 
 
 
 
 
 
 
 
 
 
 | 199 | 
 > | 
             STARTUPMESSAGE("%s", MyDisasm.CompleteInstr); | 
 
 
 
 
 
 
 
 
 
 
 
 | 200 | 
   | 
             MyDisasm.EIP += (UIntPtr)len; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 201 | 
   | 
             i++; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 202 | 
   | 
         } | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 203 | 
   | 
     }; | 
 
 
 
 
 
 
 
 
 
 
 
 | 204 | 
 < | 
     DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 
 | 204 | 
 > | 
     STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 
 
 
 
 
 
 | 205 | 
   | 
  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 206 | 
   | 
     memset (&MyDisasm, 0, sizeof(DISASM)); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 207 | 
   | 
     MyDisasm.EIP = (UIntPtr) from; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 208 | 
   | 
     i = 0; | 
 
 
 
 
 
 
 
 
 
 
 
 | 209 | 
 < | 
     DDrStartupMessage("Orig start after @ 0x%06x", from); | 
 
 
 
 
 
 
 
 
 
 | 209 | 
 > | 
     STARTUPMESSAGE("Orig start after @ 0x%06x", from); | 
 
 
 
 
 
 
 
 
 
 
 
 | 210 | 
   | 
     while (i<3){ | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 211 | 
   | 
         len = Disasm(&MyDisasm); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 212 | 
   | 
         if (len != UNKNOWN_OPCODE) { | 
 
 
 
 
 
 
 
 
 
 
 
 | 213 | 
 < | 
             DDrStartupMessage(MyDisasm.CompleteInstr); | 
 
 
 
 
 
 
 
 
 
 | 213 | 
 > | 
             STARTUPMESSAGE("%s", MyDisasm.CompleteInstr); | 
 
 
 
 
 
 
 
 
 
 
 
 | 214 | 
   | 
             MyDisasm.EIP += (UIntPtr)len; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 215 | 
   | 
             i++; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 216 | 
   | 
         } | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 217 | 
   | 
     }; | 
 
 
 
 
 
 
 
 
 
 
 
 | 218 | 
 < | 
     DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 219 | 
 < | 
     DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 220 | 
 < | 
     DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 
 | 218 | 
 > | 
     STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 | 219 | 
 > | 
     STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 | 220 | 
 > | 
     STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 
 
 
 
 
 
 | 221 | 
   | 
 */ | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 222 | 
   | 
  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 223 | 
   | 
         return trampoline; |