Skip to content

Instantly share code, notes, and snippets.

@pushedx
Created August 23, 2021 19:35
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save pushedx/0da4c7f8675baed762c2dd2d8c4a4aa6 to your computer and use it in GitHub Desktop.
Save pushedx/0da4c7f8675baed762c2dd2d8c4a4aa6 to your computer and use it in GitHub Desktop.
// LocalData/InstanceInfo pivot
if (true)
{
// "Just before calling client instance session"
std::vector<uint16_t> strSig;
if (!CompileSignatureA("4A 75 73 74 20 62 65 66 6F 72 65 20 63 61 6C 6C 69 6E 67 20 63 6C 69 65 6E 74 20 69 6E 73 74 61 6E 63 65 20 73 65 73 73 69 6F 6E 00", strSig))
throw std::runtime_error("[LDII] 'CompileSignatureA' failed.");
// Find the sig in the rdata section.
auto results = FindSignature(strSig, modEx.Mod.Rdata);
if (results.size() != 1)
{
std::stringstream ss;
ss << "[LDII] 'FindSignature' returned (" << results.size() << ") results.";
throw std::runtime_error(ss.str());
}
auto strAddr = modEx.Mod.Rdata->Address + results.front();
std::wprintf(L"[LDII] Offset: 0x%I64X | Address: 0x%I64X\r\n", results.front(), strAddr);
// Build the list of str loads
std::list<std::pair<uint64_t, uint64_t>> strLoads;
auto itrs = modEx.Leas.equal_range(strAddr);
for (auto itr = itrs.first; itr != itrs.second; ++itr)
{
strLoads.push_back(*itr);
}
// We should only ever have 1 load
if (strLoads.size() != 1)
{
std::stringstream ss;
ss << "[LDII] Expected 1 string load, but found (" << strLoads.size() << ").";
throw std::runtime_error(ss.str());
}
std::wprintf(L"[LDII] Load found @ 0x%I64X\r\n", strLoads.front().second);
for (auto itr = m_newCalls.begin(); itr != m_newCalls.end(); ++itr)
{
auto addr = *itr;
if (addr > strLoads.front().second)
{
m_instanceInfoNewCall = addr;
break;
}
m_localDataNewCall = addr;
}
std::wprintf(L"[LDII] LocalData new found @ 0x%I64X\r\n", m_localDataNewCall);
std::wprintf(L"[LDII] InstanceInfo new found @ 0x%I64X\r\n", m_instanceInfoNewCall);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment