/
*
for
hook new decompressed
buffer
0043119A
| FF75 E0 | push dword ptr ss:[ebp
-
20
]
0043119D
| E8 A1510000 | call lamune.
436343
| new
004311A2
| FF75 E4 | push dword ptr ss:[ebp
-
1C
] | [ebp
-
1c
] raw_size
004311A5
|
8945
F0 | mov dword ptr ss:[ebp
-
10
],eax
004311A8
| E8
96510000
| call lamune.
436343
| new raw_buf
*
/
const DWORD g_newrawbufi_4311A2
=
0x4311A2
;
const DWORD g_newrawbufo_4311A8
=
0x4311A8
;
/
*
for
hook decompress asb
.text:
004311D4
FF
75
E4 push [ebp
+
raw_size] ; raw_len
.text:
004311D7
8D
4D
EC lea ecx, [ebp
+
var_14]
.text:
004311DA
57
push edi ; raw_data
.text:
004311DB
FF
75
E0 push [ebp
+
compressed_size] ; compressed_len
.text:
004311DE
FF
75
F0 push [ebp
+
compressed_data] ; compressed_data
.text:
004311E1
E8
7F
99
FD FF call decompress_40AB65
*
/
const DWORD g_decompressasbi_4311E1
=
0x4311E1
;
const DWORD g_decompressasbo_40AB65
=
0x40AB65
;
/
/
inlinehook stubs
void __declspec(naked) newrawbuf_hook_4311A2()
{
__asm{
pushad;
xor eax, eax;
/
/
size_t __stdcall load_rawasb(char
*
name, PBYTE buf)
push eax;
push [ebp
+
8
];
call load_rawasb;
test eax, eax;
je newrawbuf_hook_end;
mov [ebp
-
0x1c
], eax;
/
/
change raw buf size
newrawbuf_hook_end:
popad;
/
/
fix origin code
push dword ptr [ebp
-
0x1c
];
mov dword ptr [ebp
-
0x10
], eax;
jmp dword ptr ds:[g_newrawbufo_4311A8];
}
}
void __declspec(naked) decompressasb_hook_4311E1()
{
/
/
sub_40AB65(char
*
compressed_data,
int
compressed_len, char
*
raw_data,
int
raw_len)
__asm {
push [esp
+
0xc
];
/
/
after push ret addr, above, raw_buf
push [ebp
+
0x8
];
/
/
asbname
call load_rawasb;
test eax, eax;
je decompress_origin;
ret
0x10
;
decompress_origin:
mov eax,
0x99E15CB4
;
/
/
this
is
the original corrent crc value
mov dword ptr ds:[
0x0047E718
], eax;
/
/
this
is
not
worked...
jmp dword ptr ds:[g_decompressasbo_40AB65];
}
}
/
/
hook install functions
void install_asbhook()
{
/
*
inlinehook check_valid
.text:
0040AB8A
6A
00
push
0
.text:
0040AB8C
8D
43
FC lea eax, [ebx
-
4
]
.text:
0040AB8F
50
push eax
.text:
0040AB90
8D
77
04
lea esi, [edi
+
4
]
.text:
0040AB93
56
push esi
.text:
0040AB94
E8
27
D9 FF FF call makecrc_4084C0
.text:
0040AB99
83
C4
0C
add esp,
0Ch
.text:
0040AB9C
39
07
cmp
[edi], eax
.text:
0040AB9E
75
64
jnz short loc_40AC04
*
/
BYTE nop2[
0x2
]
=
{
0x90
,
0x90
};
winhook_patchmemory((LPVOID)
0x4311d2
,
nop2, sizeof(nop2));
winhook_patchmemory((LPVOID)
0x40AB9E
,
nop2, sizeof(nop2));
/
/
inlinehook newrawdata
BYTE jmpE8buf[
0x5
]
=
{
0xE9
};
/
/
jmp relative
*
(DWORD
*
)(jmpE8buf
+
1
)
=
(DWORD)newrawbuf_hook_4311A2
-
((DWORD)g_newrawbufi_4311A2
+
sizeof(jmpE8buf));
winhook_patchmemory((LPVOID)g_newrawbufi_4311A2,
jmpE8buf, sizeof(jmpE8buf));
/
/
inlinehook decompress
BYTE callE9buf[
0x5
]
=
{
0xE8
};
/
/
call relative
*
(DWORD
*
)(callE9buf
+
1
)
=
(DWORD)decompressasb_hook_4311E1
-
((DWORD)g_decompressasbi_4311E1
+
sizeof(jmpE8buf));
winhook_patchmemory((LPVOID)g_decompressasbi_4311E1,
callE9buf, sizeof(callE9buf));
}