123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146 |
- #include "PatchSolutions.hpp"
- #include <xstring.hpp>
- #undef NKG_CURRENT_SOURCE_FILE
- #undef NKG_CURRENT_SOURCE_LINE
- #define NKG_CURRENT_SOURCE_FILE() TEXT(".\\navicat-patcher\\PatchSolution4-i386.cpp")
- #define NKG_CURRENT_SOURCE_LINE() __LINE__
- namespace nkg {
- PatchSolution4::PatchSolution4(const ImageInterpreter& Image) :
- _Image(Image),
- _DisassemblyEngine(CS_ARCH_X86, CS_MODE_32),
- _AssemblyEngine(KS_ARCH_X86, KS_MODE_32),
- _pbPatchMachineCode(nullptr),
- _pbPatchNewPublicKey(nullptr) { _DisassemblyEngine.Option(CS_OPT_DETAIL, CS_OPT_ON); }
- PatchSolution4::PatchSolution4(const ImageInterpreter* Image) :
- _Image(*Image),
- _DisassemblyEngine(CS_ARCH_X86, CS_MODE_32),
- _AssemblyEngine(KS_ARCH_X86, KS_MODE_32),
- _pbPatchMachineCode(nullptr),
- _pbPatchNewPublicKey(nullptr) { _DisassemblyEngine.Option(CS_OPT_DETAIL, CS_OPT_ON); }
- bool PatchSolution4::FindPatchOffset() noexcept {
- try {
- _pbPatchMachineCode = _Image.SearchSection<uint8_t*>(".text", [](const uint8_t* p) {
- __try {
- return
- p[0] == 0x83 &&
- p[4] == 0x8d &&
- p[7] == 0x8d &&
- p[10] == 0x0f && p[11] == 0x43 &&
- p[14] == 0x83 &&
- p[18] == 0x0f && p[19] == 0x43 &&
- p[22] == 0x8a &&
- p[25] == 0x02;
-
- } __except (EXCEPTION_EXECUTE_HANDLER) {
- return false;
- }
- });
- auto RegisterIndex = X86_REG_INVALID;
- auto RegisterFinalValue = X86_REG_INVALID;
- auto Disassembler = _DisassemblyEngine.CreateDisassembler();
- Disassembler.SetContext({ _pbPatchMachineCode, 28, _Image.PointerToVa(_pbPatchMachineCode) });
- if (Disassembler.Next() && Disassembler.Next() && Disassembler.Next() && Disassembler.Next() && Disassembler.Next() && Disassembler.Next() && Disassembler.Next()) {
- auto lpInsn = Disassembler.GetInstruction();
- if (_stricmp(lpInsn->mnemonic, "mov") == 0 &&
- lpInsn->detail->x86.op_count == 2 &&
- lpInsn->detail->x86.operands[0].type == X86_OP_REG &&
- lpInsn->detail->x86.operands[1].type == X86_OP_MEM &&
- lpInsn->detail->x86.operands[1].size == 1 &&
- lpInsn->detail->x86.operands[1].mem.scale == 1)
- {
- RegisterIndex = lpInsn->detail->x86.operands[1].mem.index;
- } else {
- throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("Unexpected machine code."));
- }
- } else {
- throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("Disassemble failed."));
- }
- if (Disassembler.Next()) {
- auto lpInsn = Disassembler.GetInstruction();
- if (_stricmp(lpInsn->mnemonic, "add") == 0 &&
- lpInsn->detail->x86.op_count >= 1 &&
- lpInsn->detail->x86.operands[0].type == X86_OP_REG &&
- lpInsn->detail->x86.operands[0].size == 1)
- {
- RegisterFinalValue = lpInsn->detail->x86.operands[0].reg;
- } else {
- throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("Unexpected machine code."));
- }
- } else {
- throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("Disassemble failed."));
- }
- for (size_t i = 0; i < _Image.NumberOfSections(); ++i) {
- auto lpSectionHeader = _Image.ImageSectionHeader(i);
- if (lpSectionHeader->SizeOfRawData > lpSectionHeader->Misc.VirtualSize) {
- auto cbReserved =
- lpSectionHeader->SizeOfRawData -
- lpSectionHeader->Misc.VirtualSize;
- if (cbReserved >= 0x188) {
- _pbPatchNewPublicKey = _Image.ImageSectionView<uint8_t*>(lpSectionHeader, lpSectionHeader->Misc.VirtualSize);
- auto Assembler = _AssemblyEngine.CreateAssembler();
- _NewMachineCode = Assembler.GenerateMachineCode(
- std::xstring::format(
- TEXT(
- "call +5;"
- "pop eax;"
- "add eax, 0x%.8x;"
- "mov %hs, byte ptr [eax + %hs];"
- ),
- _Image.PointerToVa(_pbPatchNewPublicKey) - (_Image.PointerToVa(_pbPatchMachineCode) + 5),
- _DisassemblyEngine.GetRegisterName(RegisterFinalValue),
- _DisassemblyEngine.GetRegisterName(RegisterIndex)
- ).explicit_string().c_str()
- );
-
-
-
-
-
-
-
-
- while (_NewMachineCode.size() < 28) {
- _NewMachineCode.emplace_back(0x90);
- }
- if (_NewMachineCode.size() != 28) {
- throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("Something unexpected happens."));
- }
- LOG_SUCCESS(0, "PatchSolution4 ...... Ready to apply");
- LOG_HINT(4, "Machine code patch VA = 0x%zx", _Image.PointerToVa(_pbPatchMachineCode));
- LOG_HINT(4, "New public key VA = 0x%zx", _Image.PointerToVa(_pbPatchNewPublicKey));
- LOG_HINT(4, "New public key offset = 0x%zx", _Image.PointerToFileOffset(_pbPatchNewPublicKey));
- return true;
- }
- }
- }
- throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("No space to store public key."));
- } catch (nkg::Exception&) {
- _pbPatchMachineCode = nullptr;
- _pbPatchNewPublicKey = nullptr;
- _NewMachineCode.clear();
- LOG_FAILURE(0, "PatchSolution4 ...... Omitted");
- return false;
- }
- }
- }
|