| 44 |  | /* | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 45 |  | DISASM MyDisasm; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 46 |  | int i = 0; | 
 
 
 
 
 
 
 
 
 
 
 | 47 | < | DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 48 | < | DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 | 47 | > | STARTUPMESSAGE("", 0); | 
 
 
 
 
 | 48 | > | STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 
 
 
 
 
 | 49 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 50 |  | memset (&MyDisasm, 0, sizeof(DISASM)); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 51 |  | MyDisasm.EIP = (UIntPtr) from; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 52 |  | i = 0; | 
 
 
 
 
 
 
 
 
 
 
 | 53 | < | DDrStartupMessage("Orig before @ 0x%06x", from); | 
 
 
 
 
 
 
 
 
 | 53 | > | STARTUPMESSAGE("Orig before @ 0x%06x", from); | 
 
 
 
 
 
 
 
 
 
 
 | 54 |  | while (i<10){ | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 55 |  | len = Disasm(&MyDisasm); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 56 |  | if (len != UNKNOWN_OPCODE) { | 
 
 
 
 
 
 
 
 
 
 
 | 57 | < | DDrStartupMessage("%s, Opcode: 0x%x, len: %d, branch: %d, to: 0x%06x", MyDisasm.CompleteInstr, MyDisasm.Instruction.Opcode, len, MyDisasm.Instruction.BranchType, MyDisasm.Instruction.AddrValue); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 58 | < | DDrStartupMessage("    Cat: 0x%04x, prefix count: %d", MyDisasm.Instruction.Category & 0xffff, MyDisasm.Prefix.Number ); | 
 
 
 
 
 
 
 
 
 | 57 | > | STARTUPMESSAGE("%s, Opcode: 0x%x, len: %d, branch: %d, to: 0x%06x", MyDisasm.CompleteInstr, MyDisasm.Instruction.Opcode, len, MyDisasm.Instruction.BranchType, MyDisasm.Instruction.AddrValue); | 
 
 
 
 
 | 58 | > | STARTUPMESSAGE("    Cat: 0x%04x, prefix count: %d", MyDisasm.Instruction.Category & 0xffff, MyDisasm.Prefix.Number ); | 
 
 
 
 
 
 
 
 
 
 
 | 59 |  | MyDisasm.EIP += (UIntPtr)len; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 60 |  | i++; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 61 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 62 |  | }; | 
 
 
 
 
 
 
 
 
 
 
 | 63 | < | DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 | 63 | > | STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 
 
 
 
 
 | 64 |  | */ | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 65 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 66 |  | DISASM disasm; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 77 |  | if (len != UNKNOWN_OPCODE) { | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 78 |  | if ((disasm.Instruction.Category & 0xffff) == CONTROL_TRANSFER) { | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 79 |  | if (disasm.Prefix.Number > 0) { | 
 
 
 
 
 
 
 
 
 
 
 | 80 | < | DDrStartupMessage("Daodan: Detour: Branch in trampoline area from address 0x%08x with prefixes", from); | 
 
 
 
 
 
 
 
 
 | 80 | > | STARTUPMESSAGE("Detour: Branch in trampoline area from address 0x%08x with prefixes", from); | 
 
 
 
 
 
 
 
 
 
 
 | 81 |  | return (void*)-1; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 82 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 83 |  | branches++; | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 144 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 145 |  | break; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 146 |  | default: | 
 
 
 
 
 
 
 
 
 
 
 | 147 | < | DDrStartupMessage("Daodan: Detour: Unknown branch in trampoline area from address 0x%08x", from); | 
 
 
 
 
 
 
 
 
 | 147 | > | STARTUPMESSAGE("Detour: Unknown branch in trampoline area from address 0x%08x", from); | 
 
 
 
 
 
 
 
 
 
 
 | 148 |  | return (void*)-1; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 149 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 150 |  | } else { | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 154 |  | disasm.EIP += (UIntPtr)len; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 155 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 156 |  | else { | 
 
 
 
 
 
 
 
 
 
 
 | 157 | < | DDrStartupMessage("Daodan: Detour: Unknown opcode in trampoline area from address 0x%08x", from); | 
 
 
 
 
 
 
 
 
 | 157 | > | STARTUPMESSAGE("Detour: Unknown opcode in trampoline area from address 0x%08x", from); | 
 
 
 
 
 
 
 
 
 
 
 | 158 |  | return (void*)-1; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 159 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 160 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 161 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 162 |  | if (branches > 1) { | 
 
 
 
 
 
 
 
 
 
 
 | 163 | < | DDrStartupMessage("Daodan: Detour: Too many branches in trampoline'd code from address 0x%08x: %d", from, branches); | 
 
 
 
 
 
 
 
 
 | 163 | > | STARTUPMESSAGE("Detour: Too many branches in trampoline'd code from address 0x%08x: %d", from, branches); | 
 
 
 
 
 
 
 
 
 
 
 | 164 |  | return (void*)-1; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 165 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 166 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 170 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 171 |  | DWORD oldp; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 172 |  | if (!VirtualProtect(trampoline, 40, PAGE_EXECUTE_READWRITE, &oldp)) { | 
 
 
 
 
 
 
 
 
 
 
 | 173 | < | DDrStartupMessage("Daodan: Detour: Could not mark page for trampoline as executable: from address 0x%08x", from); | 
 
 
 
 
 
 
 
 
 | 173 | > | STARTUPMESSAGE("Detour: Could not mark page for trampoline as executable: from address 0x%08x", from); | 
 
 
 
 
 
 
 
 
 
 
 | 174 |  | return (void*)-1; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 175 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 176 |  | DDrPatch_MakeJump(from, to); | 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 | 178 |  | memset (&MyDisasm, 0, sizeof(DISASM)); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 179 |  | MyDisasm.EIP = (UIntPtr) trampoline; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 180 |  | i = 0; | 
 
 
 
 
 
 
 
 
 
 
 | 181 | < | DDrStartupMessage("Trampoline @ 0x%06x", trampoline); | 
 
 
 
 
 
 
 
 
 | 181 | > | STARTUPMESSAGE("Trampoline @ 0x%06x", trampoline); | 
 
 
 
 
 
 
 
 
 
 
 | 182 |  | while (i<10){ | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 183 |  | len = Disasm(&MyDisasm); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 184 |  | if (len != UNKNOWN_OPCODE) { | 
 
 
 
 
 
 
 
 
 
 
 | 185 | < | DDrStartupMessage(MyDisasm.CompleteInstr); | 
 
 
 
 
 
 
 
 
 | 185 | > | STARTUPMESSAGE("%s", MyDisasm.CompleteInstr); | 
 
 
 
 
 
 
 
 
 
 
 | 186 |  | MyDisasm.EIP += (UIntPtr)len; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 187 |  | i++; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 188 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 189 |  | }; | 
 
 
 
 
 
 
 
 
 
 
 | 190 | < | DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 | 190 | > | STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 
 
 
 
 
 | 191 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 192 |  | memset (&MyDisasm, 0, sizeof(DISASM)); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 193 |  | MyDisasm.EIP = disasm.EIP; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 194 |  | i = 0; | 
 
 
 
 
 
 
 
 
 
 
 | 195 | < | DDrStartupMessage("Orig after @ 0x%06x", disasm.EIP); | 
 
 
 
 
 
 
 
 
 | 195 | > | STARTUPMESSAGE("Orig after @ 0x%06x", disasm.EIP); | 
 
 
 
 
 
 
 
 
 
 
 | 196 |  | while (i<7){ | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 197 |  | len = Disasm(&MyDisasm); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 198 |  | if (len != UNKNOWN_OPCODE) { | 
 
 
 
 
 
 
 
 
 
 
 | 199 | < | DDrStartupMessage(MyDisasm.CompleteInstr); | 
 
 
 
 
 
 
 
 
 | 199 | > | STARTUPMESSAGE("%s", MyDisasm.CompleteInstr); | 
 
 
 
 
 
 
 
 
 
 
 | 200 |  | MyDisasm.EIP += (UIntPtr)len; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 201 |  | i++; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 202 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 203 |  | }; | 
 
 
 
 
 
 
 
 
 
 
 | 204 | < | DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 | 204 | > | STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 
 
 
 
 
 | 205 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 206 |  | memset (&MyDisasm, 0, sizeof(DISASM)); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 207 |  | MyDisasm.EIP = (UIntPtr) from; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 208 |  | i = 0; | 
 
 
 
 
 
 
 
 
 
 
 | 209 | < | DDrStartupMessage("Orig start after @ 0x%06x", from); | 
 
 
 
 
 
 
 
 
 | 209 | > | STARTUPMESSAGE("Orig start after @ 0x%06x", from); | 
 
 
 
 
 
 
 
 
 
 
 | 210 |  | while (i<3){ | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 211 |  | len = Disasm(&MyDisasm); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 212 |  | if (len != UNKNOWN_OPCODE) { | 
 
 
 
 
 
 
 
 
 
 
 | 213 | < | DDrStartupMessage(MyDisasm.CompleteInstr); | 
 
 
 
 
 
 
 
 
 | 213 | > | STARTUPMESSAGE("%s", MyDisasm.CompleteInstr); | 
 
 
 
 
 
 
 
 
 
 
 | 214 |  | MyDisasm.EIP += (UIntPtr)len; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 215 |  | i++; | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 216 |  | } | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 217 |  | }; | 
 
 
 
 
 
 
 
 
 
 
 | 218 | < | DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 219 | < | DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 220 | < | DDrStartupMessage(""); | 
 
 
 
 
 
 
 
 
 | 218 | > | STARTUPMESSAGE("", 0); | 
 
 
 
 
 | 219 | > | STARTUPMESSAGE("", 0); | 
 
 
 
 
 | 220 | > | STARTUPMESSAGE("", 0); | 
 
 
 
 
 
 
 
 
 
 
 | 221 |  | */ | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 222 |  |  | 
 
 
 
 
 
 
 
 
 
 
 
 
 | 223 |  | return trampoline; |