Add Waffle3 hook, from Blu3train via Artikash/Textractor#1218

Zoltanar · Jan 6, 2024 · 5657c8e · 5657c8e
1 parent f4a331b
commit 5657c8e
Showing 1 changed file with 45 additions and 0 deletions.
diff --git a/vnr/src/vnrhook/src/engine/engine.cc b/vnr/src/vnrhook/src/engine/engine.cc
@@ -5877,6 +5877,27 @@ bool InsertShinaHook()
   return false;
 }
 
+bool Waffle3Filter(LPVOID data, DWORD* size, HookParam*, BYTE)
+{
+    auto text = reinterpret_cast<LPSTR>(data);
+    auto len = reinterpret_cast<size_t*>(size);
+    static std::string prevText;
+
+    if (LPSTR bs = cpp_strnstr(text, "\\", *len))
+        if (bs > text && *--bs >= 65 && *bs <= 122) // garbage text
+            return false;
+
+    if (prevText.find(text, 0, *len) != std::string::npos) // Check if the string is present in the previous one
+        return false;
+    prevText.assign(text, *len);
+
+    StringCharReplacer(text, len, "\r\n\x81\x40", 4, ' ');
+    StringCharReplacer(text, len, "\r\n", 2, ' ');
+    StringCharReplacer(text, len, "\x81\x40", 2, ' ');
+
+    return true;
+}
+
 bool InsertWaffleDynamicHook(LPVOID addr, DWORD frame, DWORD stack)
 {
   if (addr != ::GetTextExtentPoint32A)
@@ -5967,6 +5988,30 @@ void InsertWaffleHook()
     NewHook(hp, "WAFFLE2");
     found = true;
   }
+	//by Blu3train
+/** new waffle3
+*   test on https://vndb.org/v31003
+*/
+    const BYTE bytes2[] = {
+        0xCC,                     // int 3 
+        0x55,                     // push ebp     <- hook here
+        0x8B, 0xEC,               // mov ebp,esp
+        0x8B, 0x55, 0x0C,         // mov edx,[ebp+0C]
+        0x53                      // push ebx
+    };
+    ULONG range = min(module_limit_ - module_base_, MAX_REL_ADDR);
+    if (DWORD addr = MemDbg::findBytes(bytes2, sizeof(bytes2), module_base_, module_base_ + range))
+    {
+        HookParam hp = {};
+        hp.address = addr + 1;
+        hp.offset = pusha_eax_off - 4;
+        hp.index = 0x00;
+        hp.filter_fun = Waffle3Filter;
+        hp.type = USING_STRING;
+        ConsoleOutput("Textractor: INSERT WAFFLE3");
+        NewHook(hp, "WAFFLE3");
+        found = true;
+    }
   //ConsoleOutput("Probably Waffle. Wait for text.");
   if (!found) trigger_fun_ = InsertWaffleDynamicHook;
   SwitchTrigger(true);