Esempio n. 1
0
        void FIND_ISGFlag()
        {
            _context.Name = "ISGFlag";

            _subContext1.Name = "ivp_mindist_recursive function";

            IntPtr    tmp = _scanner.FindStringPtr("IVP Failed at %s %d");
            Signature sig = new Signature($"68 ?? ?? ?? ?? 68 {tmp.GetByteString()}", 1);

            sig.EvaluateMatch = (f_ptr) =>
            {
                IntPtr ptr2 = Game.ReadPointer(f_ptr);
                if (_scanner.IsWithin(ptr2))
                {
                    return(Game.ReadString(ptr2, 256).Contains("ivp_collision\\ivp_mindist_recursive.cxx"));
                }
                return(false);
            };

            tmp = _scanner.Scan(sig);
            tmp = _scanner.BackTraceToFuncStart(tmp, Intermediate.Modify(vftable: 1));

            tmp.Report(_pr, level: BlueFG);

            _subContext1.Name = "Recheck_ov_element";

            SigScanner    scanner = new SigScanner(Game, tmp, 0x700);
            SigCollection sc1     = new SigCollection(
                new Signature("E? ?? ?? ?? 00", 0),
                new Signature("E? ?? ?? ?? FF", 0));

            SigCollection sc2 = new SigCollection(
                new Signature("E8 ?? ?? ?? ?? ?? ?? ?? ?? E8", 0),
                new Signature("E8 ?? ?? ?? ?? ?? ?? ?? E8", 0));

            sc1.EvaluateMatch = (f_ptr) =>
            {
                IntPtr ptr2 = Game.ReadRelativeReference(f_ptr);
                if (_scanner.IsWithin(ptr2))
                {
                    ptr2 = _scanner.FindVFTableEntries(ptr2, true).FirstOrDefault();
                    if (ptr2 != IntPtr.Zero)
                    {
                        ptr2.Report(_pr, "Candidate");
                        ptr2 = Game.ReadPointer(ptr2 - 4);
                        SigScanner tmpScanner = new SigScanner(Game, ptr2, 0x20);
                        if (tmpScanner.Scan(sc2) != IntPtr.Zero)
                        {
                            return(true);
                        }
                    }
                }
                return(false);
            };

            tmp = Game.ReadRelativeReference(scanner.Scan(sc1));
            _subContext1.Name = "";
            tmp.Report(_pr, level: BlueBG);
        }
Esempio n. 2
0
 void FIND_DoImageSpaceMotionBlur()
 {
     _context.Name = "DoImageSpaceMotionBlur";
     _scanner.FindFuncThroughStringRef("dev/motion_blur", Intermediate.Modify(0x10000), pr: _pr);
 }
Esempio n. 3
0
        void FIND_SleepUntilInput()
        {
            _context.Name = "SleepUntilInput";

            _subContext1.Name = "CEngine::Frame";

            IntPtr ptr = _scanner.FindStringPtr("fs_report_sync_opens");

            ptr.Report(_pr, "string");
            if (ptr == IntPtr.Zero)
            {
                return;
            }

            ptr = _scanner.Scan(new Signature("68" + ptr.GetByteString()));
            ptr = _scanner.BackTraceToFuncStart(ptr, Intermediate.Modify(vftable: 1));
            ptr.Report(_pr, level: BlueFG);

            if (ptr == IntPtr.Zero)
            {
                return;
            }

            SigScanner    tmpScanner = new SigScanner(Game, ptr, _scanner.TraceToFuncEnd(ptr));
            SigCollection sc         = new SigCollection(
                new Signature("75 ?? ?? ?? ?? ?? ?? ?? 75", 9),
                new Signature("0F 85 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F 85", 0xE));

            ptr = tmpScanner.Scan(sc);
            ptr.Report(_pr, "Target instructions");

            if (ptr == IntPtr.Zero)
            {
                return;
            }

            tmpScanner = new SigScanner(Game, ptr, Game.ReadValue <byte>(ptr) + 1);
            Signature sig = new Signature("8B 0D", 2);

            ptr = tmpScanner.Scan(sig);
            IntPtr inputDLLBase = Game.ReadPointer(ptr);

            inputDLLBase.Report(_pr, "Input DLL base", BlueFG);
            tmpScanner.Limit(ptr + 4);

            sig = new Signature("FF");
            sig.EvaluateMatch = (a) =>
            {
                for (int i = 0; i < 4; i++)
                {
                    if (_scanner.IsWithin(Game.ReadRelativeReference(a - i)))
                    {
                        return(false);
                    }
                }
                return(true);
            };
            ptr = tmpScanner.Scan(sig);
            ptr.Report(_pr, "Scan region end");

            if (ptr == IntPtr.Zero)
            {
                return;
            }

            _subContext1.Name = "";

            int[] possibleOffsets = new int[2];
            possibleOffsets[0] = Game.ReadValue <byte>(ptr + 0x2);
            byte[] bytes = Game.ReadBytes(tmpScanner.Start, ptr.SubtractI(tmpScanner.Start) + 2);
            for (int i = bytes.Count() - 1; i >= 0; i--)
            {
                if (bytes[i] == 0x8B)
                {
                    possibleOffsets[1] = bytes[i + 2];
                    break;
                }
            }

            _pr.Print($"Possible offsets include 0x{possibleOffsets[0]:X} and 0x{possibleOffsets[1]:X}, testing both...", BlueFG);
            ProcessModuleWow64Safe inputDLL        = Game.GetModuleWow64Safe("inputsystem.dll");
            SigScanner             inputDLLScanner = inputDLL == null ? null : new SigScanner(Game, inputDLL.BaseAddress, inputDLL.ModuleMemorySize);

            foreach (int off in possibleOffsets)
            {
                new DeepPointer(inputDLLBase, 0x0, off, 0x0).DerefOffsets(Game, out ptr);
                _pr.Print($"Offset 0x{off:X} leads to 0x{ptr.ToString("X8")}");
                if (ptr != IntPtr.Zero)
                {
                    if (!_scanner.IsWithin(ptr))
                    {
                        if (inputDLLScanner != null)
                        {
                            if (!inputDLLScanner.IsWithin(ptr))
                            {
                                continue;
                            }
                        }
                        else
                        {
                            continue;
                        }
                    }

                    ptr.Report(_pr, "candidate", BlueBG);
                    break;
                }
            }
        }
Esempio n. 4
0
        void FIND_FinishGravity()
        {
            IntPtr    ptr;
            Signature sig;
            int       matchCount = 0, i = 0;

            _context.Name = "FinishGravity";

            _pr.Print("Running method 1 -- looking 1 above CheckJumpButton in CGameMovement vftable", BlueFG);
            _subContext1.Name = "1";

            foreach (IntPtr cjbMatch in _listCheckJumpButtonMatches)
            {
                var matches = _scanner.FindVFTableEntries(cjbMatch);
                foreach (var match in matches)
                {
                    ptr = Game.ReadPointer(match - 0x8);
                    byte[] bytes = Game.ReadBytes(ptr, 10);
                    if (bytes[5] != 0xCC && bytes[5] != 0x90)
                    {
                        ptr.Report(_pr, $"candidate #{++matchCount}", BlueBG);
                    }
                }
            }

            //-------------------

            _subContext1.Name = "";
            _pr.Print("Running method 2 -- looking for references to CheckVelocity and comparing results to calls found in CheckJumpButton", BlueFG);
            _subContext1.Name = "2";
            _subContext2.Name = "CheckVelocity";

            List <IntPtr> tmp          = _scanner.FindRelativeCalls(_ptrCheckVelocity, 0x100000);
            List <IntPtr> checkVelRefs = new List <IntPtr>();

            foreach (IntPtr checkVelRef in tmp)
            {
                ptr = _scanner.BackTraceToFuncStart(checkVelRef, Intermediate.Modify(vftable: 1));
                if (!checkVelRefs.Contains(ptr))
                {
                    checkVelRefs.Add(ptr);
                    ptr.Report(_pr, $"called from 0x{checkVelRef.ToString("X")} under function");
                }
            }

            _subContext2.Name = "branching";
            _pr.Print("Comparing calls to those found in CheckJumpButtons");

            i = 0;
            foreach (IntPtr cjbMatch in _listCheckJumpButtonMatches)
            {
                IntPtr end = _scanner.TraceToFuncEnd(cjbMatch);

                _subContext3.Name = $"CJB at 0x{cjbMatch.ToString("X")}";
                _pr.Print($"Searching through candidate #{++i} to 0x{end.ToString("X")}", BlueFG);


                foreach (IntPtr checkVelRef in checkVelRefs)
                {
                    List <IntPtr> calls = _scanner.FindRelativeCalls(checkVelRef, cjbMatch, end);
                    if (calls.Count() > 0)
                    {
                        calls.ForEach(x => x.Report(_pr, "caller"));
                        checkVelRef.Report(_pr, level: BlueBG);
                    }
                }
            }
        }