#include "pch.h"
#include "GameProc.h"
#include "extern_all.h"

// typedef bool(GameWinSock::* U)(char*, unsigned);



bool _OnConnect(HOOKREFS2) {
	/*
		根據(jù)虛函數(shù)表做HOOK的操作
		截取 ecx 獲取 winsock 的值(指針)
	*/
	unsigned* vtable = (unsigned*)_EDX;
	//WinSock = (GameWinSock *)_ECX;
	/*
		聯(lián)合體的特點(diǎn)是共用一個(gè)內(nèi)存
		由于 GameWinSock::OnConnect 的 OnConnect函數(shù)是 GameWinSock類的成員函數(shù)
		直接 vtable[0x34 / 4] = (unsigned)&GameWinSock::OnConnect; 這樣寫語法不通過
		所以使用聯(lián)合體，讓語法通過
	*/
	union {
		unsigned value;
		bool(GameWinSock::* _proc)(char*, unsigned);
	} vproc;

	/*
		vproc._proc = &GameWinSock::OnConnect;  這一句是把我們自己寫的調(diào)用connect函數(shù)的地址的出來
	*/ 
	vproc._proc = &GameWinSock::OnConnect; 
	/*
		InitClassProc函數(shù)里做的是給指針賦值的操作
		InitClassProc(&GameWinSock::_OnConnect, vtable[0x34/4]);這一句的意思是把
		GameWinSock類里的_OnConnect變量的值賦值成vtable[0x34/4]，這個(gè) vtable[0x34/4] 是虛表里的函數(shù)
		vtable[0x34/4]是游戲中調(diào)用connect函數(shù)的函數(shù)地址，經(jīng)過之前的分析調(diào)用connect是先調(diào)用了虛表中的
		一個(gè)函數(shù)，然后從這個(gè)函數(shù)中調(diào)用了connect函數(shù)
	*/
	InitClassProc(&GameWinSock::_OnConnect, vtable[0x34/4]);
	CString str;
	str.Format(L"===vtable：%X", vtable[0x34 / 4]);
	AfxMessageBox(str);
	DWORD oldPro,backProc;
	VirtualProtect(vtable, 0x100, PAGE_EXECUTE_READWRITE, &oldPro);
	vtable[0x34 / 4] = vproc.value;
	VirtualProtect(vtable, 0x100, oldPro, &backProc);
	return true;
}

GameProc::GameProc()
{
	hooker = new htd::hook::htdHook2();
	Init();
	InitInterface();
}

void GameProc::LoadBase()
{
	LoadLibraryA("fxnet2.dll");
}

void GameProc::Init()
{
}



void GameProc::InitInterface()
{
	LoadBase();
	MessageBoxA(0, "1", "1", MB_OK);
	hooker->SetHook((LPVOID)0x10617046, 0x1, _OnConnect, 0, true);
}

#pragma once
class GameWinSock
{
	typedef bool(GameWinSock::* PROC)(char*, unsigned);
public:
	static PROC _OnConnect;
	bool OnConnect(char* ip, unsigned port);
};

#include "pch.h"
#include "GameWinSock.h"
#include "extern_all.h"

GameWinSock::PROC GameWinSock::_OnConnect{};
// 這個(gè)函數(shù)攔截了游戲的連接
bool GameWinSock::OnConnect(char* ip, unsigned port)
{
    // this是ecx，HOOK的點(diǎn)已經(jīng)有ecx了
    WinSock = this;
    MessageBoxA(0, ip, ip, MB_OK);
	bool b = (this->*_OnConnect)(ip, port);
	// 下方注釋的代碼時(shí)為了防止多次注入，導(dǎo)致虛函數(shù)地址不恢復(fù)問題導(dǎo)致死循環(huán)，通過一次性HOOK也能解決
	/*unsigned* vtable = (unsigned*)this;
	vtable = (unsigned*)vtable[0];
	union {
		unsigned value;
		bool(GameWinSock::* _proc)(char*, unsigned);
	} vproc;

	vproc._proc = _OnConnect;

	DWORD oldPro, backProc;
	VirtualProtect(vtable, 0x100, PAGE_EXECUTE_READWRITE, &oldPro);
	vtable[0x34 / 4] = vproc.value;
	VirtualProtect(vtable, 0x100, oldPro, &backProc);*/

    return b;
}

// htdMfcDll.cpp: 定義 DLL 的初始化例程。這是一個(gè)MFC的dll
//

#include "pch.h"
#include "framework.h"
#include "htdMfcDll.h"
#include "extern_all.h"

#ifdef _DEBUG
#define new DEBUG_NEW
#endif

// 注釋掉下方宏，以入口點(diǎn)注入的方式注入
// #define WNDHOOK
#ifdef WNDHOOK
typedef struct htdDll
{
	HHOOK     keyHook;
	unsigned  KbdProc;
	unsigned  SetDll;

}*PHtdDll;
void htdSetDll(htdDll hDll);
htdDll mDll;
#endif

BEGIN_MESSAGE_MAP(ChtdMfcDllApp, CWinApp)
END_MESSAGE_MAP()


// ChtdMfcDllApp 構(gòu)造

ChtdMfcDllApp::ChtdMfcDllApp()
{
	
}

ChtdMfcDllApp theApp;
ChtdMfcDllApp* PtheApp;

HHOOK keyHook;
LRESULT CALLBACK KeyCallBack(int nCode, WPARAM w, LPARAM l);

BOOL ChtdMfcDllApp::InitInstance()
{
	CWinApp::InitInstance();
	PtheApp = this;
#ifdef WNDHOOK
	mDll.KbdProc = (DWORD)(KeyCallBack);
	mDll.SetDll = 0;
#else
	keyHook = SetWindowsHook(WH_KEYBOARD, KeyCallBack);// 代碼一開始，在這注冊(cè)一個(gè)鍵盤事件的鉤子
#endif
	PGameProc = new GameProc();
	return TRUE;
}

// 鉤子處理事件
LRESULT CALLBACK KeyCallBack(int nCode, WPARAM w, LPARAM l)
{

	if (nCode == 0)
	{
		if ((l & (1 << 31)) == 0)
		{
			switch (w)
			{
			case VK_HOME:

				if (PtheApp->wndMain == NULL)
				{

					PtheApp->wndMain = new CUI();
					PtheApp->wndMain->Create(IDD_MAIN);

				}

				PtheApp->wndMain->ShowWindow(TRUE);
				break;
			}
		}
	}
	return CallNextHookEx(keyHook, nCode, w, l);
}
#ifdef WNDHOOK
void htdInit(htdDll* hDll)
{
	hDll->KbdProc = mDll.KbdProc;
	hDll->keyHook = mDll.keyHook;
	hDll->SetDll = mDll.SetDll;
}

void htdSetDll(htdDll hDll)
{
	mDll = hDll;
}
#else
void htdInit()
{
}
#endif

/*
	此文件是用來存放全局變量、全局函數(shù)（通用函數(shù)）
*/
#pragma once
#include "GameWinSock.h"
#include "GameProc.h"

extern 	GameWinSock* WinSock;
extern GameProc* PGameProc;
extern void InitClassProc(LPVOID proc_addr, unsigned value);

/*
	此文件是用來存放全局變量、全局函數(shù)（通用函數(shù)）
*/
#include "pch.h"
#include "extern_all.h"
GameWinSock* WinSock = nullptr;
GameProc* PGameProc = nullptr;

void InitClassProc(LPVOID proc_addr, unsigned value)
{
	unsigned* writer = (unsigned*)proc_addr;
	writer[0] = value;
}