Created
January 24, 2016 14:58
-
-
Save Konctantin/903bd229173b08402e0a to your computer and use it in GitHub Desktop.
wow-64 injection point
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| signed __int64 __usercall Script_UnitName@<rax>(signed __int64 a1@<rbx>, __int64 a2@<rdi>) | |
| { | |
| ... | |
| LODWORD(v5) = sub_140A29990(); | |
| lua_pushstring(v1, v5); | |
| lua_pushnil(v1); | |
| return 2i64; | |
| } | |
| __int64 __fastcall lua_pushstring(__int64 a1, __int64 a2) | |
| { | |
| __int64 v2; // r9@1 | |
| __int64 v3; // rdx@2 | |
| __int64 result; // rax@2 | |
| signed __int64 v5; // rcx@3 | |
| __int64 v6; // rdi@3 | |
| bool v7; // zf@5 | |
| v2 = a1; | |
| if ( a2 ) | |
| { | |
| v5 = -1i64; | |
| v6 = a2; | |
| do | |
| { | |
| if ( !v5 ) | |
| break; | |
| v7 = *(_BYTE *)v6++ == 0; | |
| --v5; | |
| } | |
| while ( !v7 ); | |
| result = lua_pushlstring(v2, a2, ~v5 - 1); | |
| } | |
| else | |
| { | |
| v3 = *(_QWORD *)(a1 + 24); | |
| result = qword_1414519E8; | |
| *(_QWORD *)(v3 + 16) = qword_1414519E8; | |
| *(_DWORD *)(v3 + 8) = 0; | |
| *(_QWORD *)(a1 + 24) += 24i64; | |
| } | |
| return result; | |
| } | |
| __int64 __fastcall lua_pushlstring(__int64 a1, __int64 a2, __int64 a3) | |
| { | |
| __int64 v3; // rsi@1 | |
| __int64 v4; // rbp@1 | |
| __int64 v5; // rdi@1 | |
| __int64 v6; // rbx@3 | |
| __int64 result; // rax@3 | |
| v3 = a3; | |
| v4 = a2; | |
| v5 = a1; | |
| if ( *(_QWORD *)(*(_QWORD *)(a1 + 40) + 120i64) >= *(_QWORD *)(*(_QWORD *)(a1 + 40) + 112i64) ) | |
| sub_1401252A0(a1); | |
| v6 = *(_QWORD *)(v5 + 24); | |
| *(_QWORD *)(v6 + 16) = qword_1414519E8; | |
| result = luaS_newlstr(v5, (const void *)v4, v3); | |
| *(_QWORD *)v6 = result; | |
| *(_DWORD *)(v6 + 8) = 4; | |
| *(_QWORD *)(v5 + 24) += 24i64; | |
| return result; | |
| } | |
| // function size ~400 bytes | |
| __int64 __fastcall luaS_newlstr(__int64 a1, const void *a2, unsigned __int64 a3) | |
| { | |
| size_t v3; // rsi@1 | |
| unsigned int v4; // edi@1 | |
| signed __int64 v5; // r8@1 | |
| const void *v6; // rbp@1 | |
| __int64 v7; // r12@1 | |
| size_t i; // r9@1 | |
| int v9; // ecx@2 | |
| __int64 v10; // rdx@3 | |
| __int64 v11; // rbx@3 | |
| __int64 v12; // rax@9 | |
| char v13; // dl@9 | |
| __int64 v14; // rax@10 | |
| __int64 v15; // r8@12 | |
| __int64 v16; // rdx@12 | |
| signed int v17; // edx@12 | |
| v3 = a3; | |
| v4 = a3; | |
| v5 = (a3 >> 5) + 1; | |
| v6 = a2; | |
| v7 = a1; | |
| for ( i = v3; i >= v5; v4 ^= (v4 >> 2) + 32 * v4 + v9 ) | |
| { | |
| v9 = *((char *)a2 + i - 1); | |
| i -= v5; | |
| } | |
| v10 = *(_QWORD *)(v7 + 40); | |
| v11 = *(_QWORD *)(*(_QWORD *)v10 + 8 * ((signed int)v4 & (unsigned __int64)(*(_DWORD *)(v10 + 12) - 1))); | |
| if ( v11 ) | |
| { | |
| while ( *(_QWORD *)(v11 + 24) != v3 || memcmp(v6, (const void *)(v11 + 32), v3) ) | |
| { | |
| v11 = *(_QWORD *)v11; | |
| if ( !v11 ) | |
| goto LABEL_7; | |
| } | |
| if ( (unsigned __int8)~*(_BYTE *)(*(_QWORD *)(v7 + 40) + 33i64) & *(_BYTE *)(v11 + 17) & 3 ) | |
| *(_BYTE *)(v11 + 17) ^= 3u; | |
| } | |
| else | |
| { | |
| LABEL_7: | |
| if ( v3 + 1 > 0xFFFFFFFFFFFFFFDDui64 ) | |
| sub_140127500(v7, v10, v5, i); | |
| LODWORD(v12) = sub_140127520(v7, 0i64, 0i64, v3 + 33); | |
| v11 = v12; | |
| *(_QWORD *)(v12 + 24) = v3; | |
| *(_DWORD *)(v12 + 20) = v4; | |
| v13 = *(_BYTE *)(*(_QWORD *)(v7 + 40) + 33i64); | |
| *(_BYTE *)(v12 + 16) = 4; | |
| *(_BYTE *)(v12 + 17) = v13 & 3; | |
| if ( !qword_1414519E8 || (v14 = qword_141451A00) == 0 ) | |
| v14 = qword_1414519E8; | |
| *(_QWORD *)(v11 + 8) = v14; | |
| *(_BYTE *)(v11 + 18) = 0; | |
| memmove((void *)(v11 + 32), v6, v3); | |
| *(_BYTE *)(v11 + v3 + 32) = 0; | |
| v15 = *(_QWORD *)(v7 + 40); | |
| v16 = v4 & (*(_DWORD *)(v15 + 12) - 1); | |
| *(_QWORD *)v11 = *(_QWORD *)(*(_QWORD *)v15 + 8 * v16); | |
| *(_QWORD *)(*(_QWORD *)v15 + 8 * v16) = v11; | |
| v17 = *(_DWORD *)(v15 + 12); | |
| ++*(_DWORD *)(v15 + 8); | |
| if ( *(_DWORD *)(v15 + 8) > (unsigned int)v17 && v17 <= 1073741822 ) | |
| sub_14011DFD0(v7, (unsigned int)(2 * v17)); | |
| } | |
| return v11; | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment