Created
November 20, 2014 09:43
-
-
Save asm256/f049eb6a5f31601f9689 to your computer and use it in GitHub Desktop.
持ち運び地蔵
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include "stdafx.h" | |
#include "..\commonLib\PEHeader.h" | |
#include "..\JG2toys\jg2.h" | |
extern "C" | |
__declspec(dllexport) bool CheckVersion(const BYTE hash[16], LPCWSTR inipath) | |
{ | |
return memcmp(v12md5, hash, 16) == 0; | |
} | |
void __stdcall jizou(LPDWORD mode){ | |
if(GetAsyncKeyState(VK_SHIFT) & 0x8000) *mode = 0; | |
else if(GetAsyncKeyState(VK_SPACE) & 0x8000) *mode = 1; | |
else if(GetAsyncKeyState(VK_RBUTTON) & 0x8000) *mode = 2; | |
else if(GetAsyncKeyState(VK_CONTROL) & 0x8000) *mode = 3; | |
} | |
DWORD seen_change; | |
__declspec(naked) DWORD hook_jizou(){ | |
__asm{ | |
pusha | |
//add eax , 0e2cch | |
lea eax, [eax+0e2cch] | |
push eax | |
call jizou | |
popa | |
jmp [seen_change] | |
} | |
} | |
extern "C" | |
__declspec(dllexport) bool Initialize(HMODULE hMyModule, HMODULE hParentModule){ | |
PEHeader pe((BYTE*)GetModuleHandle(NULL)); | |
pe.UnGuard(); | |
//TamperNearJmpOpr(pe.offset2addr(0x0004679A), (DWORD)&hook_jizou); | |
seen_change = TamperNearJmpOpr(pe.offset2addr(0x0016383E), (DWORD)&hook_jizou); | |
pe.Guard(); | |
return true; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment