heavensgate log pasta

void* lpJmpRealloc = nullptr;

const DWORD_PTR __declspec( naked ) GetGateAddress( ) {
    __asm
    {
        mov eax, dword ptr fs : [0xC0]
        ret
    }
}

DWORD tmp_eax = 0x0;

__declspec( naked ) void hk_Wow64Trampoline( ) {
    __asm pushad

    __asm mov tmp_eax, eax
    printf( "Index: 0x%x\n", tmp_eax );

    __asm popad
    __asm jmp lpJmpRealloc
}
//
//void __declspec( naked ) hk_Wow64Trampoline( ) {
//  __asm
//  {
//      cmp eax, 0x3f //64bit Syscall id of NtRVM
//      je hk_NtReadVirtualMemory
//      cmp eax, 0x50 //64bit Syscall id of NtPVM
//      je hk_NtProtectVirtualMemory
//      jmp lpJmpRealloc
//  }
//}

const LPVOID CreateNewJump( ) {
    DWORD_PTR Gate = GetGateAddress( );
    lpJmpRealloc = VirtualAlloc( nullptr, 0x1000, MEM_RESERVE | MEM_COMMIT,
                                 PAGE_EXECUTE_READWRITE );
    memcpy( lpJmpRealloc, ( void* )Gate, 9 );

    return lpJmpRealloc;
}

const void WriteJump( const DWORD_PTR dwWow64Address, const void* pBuffer, size_t ulSize ) {
    DWORD dwOldProtect = 0;
    VirtualProtect( ( LPVOID )dwWow64Address, 0x1000, PAGE_EXECUTE_READWRITE, &dwOldProtect );
    ( void )memcpy( ( void* )dwWow64Address, pBuffer, ulSize );
    VirtualProtect( ( LPVOID )dwWow64Address, 0x1000, dwOldProtect, &dwOldProtect );
}


const void EnableWow64Redirect( ) {
    LPVOID Hook_Gate = &hk_Wow64Trampoline;

    char trampolineBytes[ ] =
    {
        0x68, 0xDD, 0xCC, 0xBB, 0xAA,       /*push 0xAABBCCDD*/
        0xC3,                               /*ret*/
        0xCC, 0xCC, 0xCC                    /*padding*/
    };
    memcpy( &trampolineBytes[ 1 ], &Hook_Gate, 4 );
    WriteJump( GetGateAddress( ), trampolineBytes, sizeof( trampolineBytes ) );
}


__forceinline static void init(
    uintptr_t base_addr,
    uintptr_t paste_base_addr
) noexcept {
    log( PREFIX"base_addr: 0x%x | paste_base_addr: 0x%x\n", base_addr, paste_base_addr );
    g::meme_base = base_addr;
    g::paste_base = paste_base_addr;
    g::nt_suspend = ( uintptr_t )GetProcAddress( GetModuleHandleA( "ntdll.dll" ), "NtSuspendProcess" );

    log( PREFIX"Gate: %p\n", GetGateAddress( ) );
    log( PREFIX"Trampoline Gate: %p\n", CreateNewJump( ) );
    log( PREFIX"Hook gate: %p\n", hk_Wow64Trampoline );
    EnableWow64Redirect( );
}