Advertisement
NotKit

Sonic Generations - Add StageID slot

Jun 28th, 2014
291
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. format PE GUI 4.0 DLL  
  2. entry DllEntryPoint  
  3.  
  4. ;***************** !!! ******************************
  5. include 'win32a.inc' ;<<<<<<--------- macros and constants !!!
  6. ;***************** !!! ******************************
  7. section '.code' code readable executable
  8.  
  9. macro   makejmp offset, addr
  10.   {
  11.     local .copy, .end
  12.     jmp .end
  13.     .copy:
  14.     mov eax, addr
  15.     jmp eax
  16.     .end:
  17.     stdcall  memcpy, .copy, offset, .end-.copy }
  18.  
  19. macro   eaxcall addr
  20.   { mov eax, addr
  21.     call eax }
  22.  
  23. proc DllEntryPoint hinstDLL,fdwReason,lpvReserved
  24.     invoke  VirtualProtect, 400100h, 0fc1000h, 0x40, lpflOldProtect ; Remove write protection from executable section
  25.  
  26.     makejmp 1296FCFh, ExtendStageTable
  27.     ; patch access to stage table
  28.     mov dword[0D40076h], newStageTable
  29.     mov dword[0D401FEh], newStageTable
  30.     mov dword[0D41239h], newStageTable
  31.     mov dword[0D56D13h], newStageTable
  32.     mov dword[0D56D2Ah], newStageTable
  33.     ;mov dword[0D56D4Ch], newStageTable ; need to check this function later
  34.     mov dword[0D5785Ah], newStageTable
  35.     mov dword[0D5A17Eh], newStageTable
  36.     mov dword[0D92656h], newStageTable
  37.     mov dword[0D96030h], newStageTable
  38.     mov dword[1067B0Ch], newStageTable
  39.     mov dword[107C5C8h], newStageTable
  40.  
  41.     invoke  VirtualProtect, 401000h, 0fc1000h, [lpflOldProtect], lpflOldProtect
  42.     mov eax,TRUE
  43.     ret  
  44. endp
  45.  
  46. proc ExtendStageTable
  47.     stageTable = 1E66B48h
  48.     StringContainer = 6621A0h
  49.  
  50.     stdcall  memcpy, stageTable, newStageTable, 80h ; copy original stage table
  51.  
  52. ; As a test, modify stage 2 (cpz100) to be ghz100
  53.     push ghz100
  54.     mov ecx, newStageTable + 2 * 4
  55.     eaxcall StringContainer
  56.  
  57. ; Slots for stages 19-26 are probably left unused
  58. ; Set stage 20 to be myk100 as example
  59.     push myk100
  60.     mov ecx, newStageTable + 20 * 4
  61.     eaxcall StringContainer
  62.  
  63. ; Original MakeStageTable (sub_1296DE0) function tail
  64.     push 13C05C0h
  65.     eaxcall 0A68D92h
  66.     pop ecx
  67.     ret
  68. endp
  69.  
  70. proc memcpy, lpSource, lpDest, Count
  71.     push esi edi ecx
  72.     mov esi, [lpSource]
  73.     mov edi, [lpDest]
  74.     mov ecx, [Count]
  75. .copy_loop:
  76.     mov al, byte [esi]
  77.     mov byte [edi], al
  78.     inc edi
  79.     inc esi
  80.     dec ecx
  81.     test ecx, ecx
  82.     jnz .copy_loop
  83.  
  84.     pop ecx edi esi
  85.     ret
  86. endp
  87.  
  88. section '.data' readable writable
  89. lpflOldProtect dd ?
  90.  
  91. align 4
  92. newStageTable  db 100h dup ? ; original one is 80h, but we plan on adding more stages, right?
  93. ghz100 db 'ghz100',0
  94. myk100 db 'myk100',0
  95.  
  96. section '.idata' import data readable writeable
  97.  library kernel32,'KERNEL32.DLL',\
  98.       user32,'USER32.DLL'
  99.  
  100.   include 'api/kernel32.inc'
  101.   include 'api/user32.inc'
  102.  
  103. section '.reloc' fixups data readable discardable
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement