Advertisement
Riremito

v399.1 GMフラグ

Nov 1st, 2021
2,098
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. // https://pastebin.com/1Rh6yd21 からv399.1用に更新 ><
  2. [Enable]
  3. Alloc(IAT_Hook_GetLastError, 256)
  4. Label(Return)
  5. Label(IAT)
  6. Label(ModifyGMFlag)
  7.  
  8. IAT_Hook_GetLastError:
  9. // Return Address Filter
  10. cmp [esp],03227CB6
  11. jne Return
  12. cmp [esp+C],03210B27
  13. jne Return
  14. cmp [esp+10],030189C2
  15. jne Return
  16. mov [esp+10],ModifyGMFlag
  17. Return:
  18. jmp dword ptr [IAT]
  19.  
  20. ModifyGMFlag:
  21. mov ecx,[edi+00002230]
  22. mov edx,00009A65
  23. mov [ecx+01],al
  24. mov ecx,[edi+00002230]
  25. mov al,[ecx+01]
  26. mov [ecx+04],dx
  27. test al,al
  28. movzx ebx,al
  29. mov edx,0000002A
  30. cmove ebx,edx
  31. mov al,bl
  32. mov byte ptr [ebp+0C],01
  33. xor al,[ebp+0C]
  34. mov [ecx],al
  35. jmp 030189F1
  36.  
  37. IAT:
  38. dd KERNEL32.GetLastError
  39.  
  40.  
  41. 037FE0FC:
  42. dd IAT_Hook_GetLastError
  43.  
  44. [Disable]
  45. 037FE0FC:
  46. dd KERNEL32.GetLastError
  47.  
  48. DeAlloc(IAT_Hook_GetLastError)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement