Skip to content

Instantly share code, notes, and snippets.

@Konctantin
Created January 24, 2016 14:58
Show Gist options
  • Select an option

  • Save Konctantin/903bd229173b08402e0a to your computer and use it in GitHub Desktop.

Select an option

Save Konctantin/903bd229173b08402e0a to your computer and use it in GitHub Desktop.
wow-64 injection point
signed __int64 __usercall Script_UnitName@<rax>(signed __int64 a1@<rbx>, __int64 a2@<rdi>)
{
...
LODWORD(v5) = sub_140A29990();
lua_pushstring(v1, v5);
lua_pushnil(v1);
return 2i64;
}
__int64 __fastcall lua_pushstring(__int64 a1, __int64 a2)
{
__int64 v2; // r9@1
__int64 v3; // rdx@2
__int64 result; // rax@2
signed __int64 v5; // rcx@3
__int64 v6; // rdi@3
bool v7; // zf@5
v2 = a1;
if ( a2 )
{
v5 = -1i64;
v6 = a2;
do
{
if ( !v5 )
break;
v7 = *(_BYTE *)v6++ == 0;
--v5;
}
while ( !v7 );
result = lua_pushlstring(v2, a2, ~v5 - 1);
}
else
{
v3 = *(_QWORD *)(a1 + 24);
result = qword_1414519E8;
*(_QWORD *)(v3 + 16) = qword_1414519E8;
*(_DWORD *)(v3 + 8) = 0;
*(_QWORD *)(a1 + 24) += 24i64;
}
return result;
}
__int64 __fastcall lua_pushlstring(__int64 a1, __int64 a2, __int64 a3)
{
__int64 v3; // rsi@1
__int64 v4; // rbp@1
__int64 v5; // rdi@1
__int64 v6; // rbx@3
__int64 result; // rax@3
v3 = a3;
v4 = a2;
v5 = a1;
if ( *(_QWORD *)(*(_QWORD *)(a1 + 40) + 120i64) >= *(_QWORD *)(*(_QWORD *)(a1 + 40) + 112i64) )
sub_1401252A0(a1);
v6 = *(_QWORD *)(v5 + 24);
*(_QWORD *)(v6 + 16) = qword_1414519E8;
result = luaS_newlstr(v5, (const void *)v4, v3);
*(_QWORD *)v6 = result;
*(_DWORD *)(v6 + 8) = 4;
*(_QWORD *)(v5 + 24) += 24i64;
return result;
}
// function size ~400 bytes
__int64 __fastcall luaS_newlstr(__int64 a1, const void *a2, unsigned __int64 a3)
{
size_t v3; // rsi@1
unsigned int v4; // edi@1
signed __int64 v5; // r8@1
const void *v6; // rbp@1
__int64 v7; // r12@1
size_t i; // r9@1
int v9; // ecx@2
__int64 v10; // rdx@3
__int64 v11; // rbx@3
__int64 v12; // rax@9
char v13; // dl@9
__int64 v14; // rax@10
__int64 v15; // r8@12
__int64 v16; // rdx@12
signed int v17; // edx@12
v3 = a3;
v4 = a3;
v5 = (a3 >> 5) + 1;
v6 = a2;
v7 = a1;
for ( i = v3; i >= v5; v4 ^= (v4 >> 2) + 32 * v4 + v9 )
{
v9 = *((char *)a2 + i - 1);
i -= v5;
}
v10 = *(_QWORD *)(v7 + 40);
v11 = *(_QWORD *)(*(_QWORD *)v10 + 8 * ((signed int)v4 & (unsigned __int64)(*(_DWORD *)(v10 + 12) - 1)));
if ( v11 )
{
while ( *(_QWORD *)(v11 + 24) != v3 || memcmp(v6, (const void *)(v11 + 32), v3) )
{
v11 = *(_QWORD *)v11;
if ( !v11 )
goto LABEL_7;
}
if ( (unsigned __int8)~*(_BYTE *)(*(_QWORD *)(v7 + 40) + 33i64) & *(_BYTE *)(v11 + 17) & 3 )
*(_BYTE *)(v11 + 17) ^= 3u;
}
else
{
LABEL_7:
if ( v3 + 1 > 0xFFFFFFFFFFFFFFDDui64 )
sub_140127500(v7, v10, v5, i);
LODWORD(v12) = sub_140127520(v7, 0i64, 0i64, v3 + 33);
v11 = v12;
*(_QWORD *)(v12 + 24) = v3;
*(_DWORD *)(v12 + 20) = v4;
v13 = *(_BYTE *)(*(_QWORD *)(v7 + 40) + 33i64);
*(_BYTE *)(v12 + 16) = 4;
*(_BYTE *)(v12 + 17) = v13 & 3;
if ( !qword_1414519E8 || (v14 = qword_141451A00) == 0 )
v14 = qword_1414519E8;
*(_QWORD *)(v11 + 8) = v14;
*(_BYTE *)(v11 + 18) = 0;
memmove((void *)(v11 + 32), v6, v3);
*(_BYTE *)(v11 + v3 + 32) = 0;
v15 = *(_QWORD *)(v7 + 40);
v16 = v4 & (*(_DWORD *)(v15 + 12) - 1);
*(_QWORD *)v11 = *(_QWORD *)(*(_QWORD *)v15 + 8 * v16);
*(_QWORD *)(*(_QWORD *)v15 + 8 * v16) = v11;
v17 = *(_DWORD *)(v15 + 12);
++*(_DWORD *)(v15 + 8);
if ( *(_DWORD *)(v15 + 8) > (unsigned int)v17 && v17 <= 1073741822 )
sub_14011DFD0(v7, (unsigned int)(2 * v17));
}
return v11;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment