| | 36 | |
| | 37 | void trackValJutsu(char *name, DWORD size, DWORD value) { |
| | 38 | struct trackedVal *newTrackedVal, *parent = NULL; |
| | 39 | struct valInstance *last, *curr; |
| | 40 | char findValExpression[18] = {'\x00'}; |
| | 41 | |
| | 42 | newTrackedVal = trackedValList; |
| | 43 | while (newTrackedVal != NULL) { |
| | 44 | if (!_stricmp(newTrackedVal->valName, name)) |
| | 45 | break; |
| | 46 | newTrackedVal = newTrackedVal->next; |
| | 47 | } |
| | 48 | |
| | 49 | // Search the list for the new value, purge old addresses |
| | 50 | if (newTrackedVal) { |
| | 51 | dprintf("[J] Narrowing down candidate list for %s from %d candidates.\n", name, newTrackedVal->candidates); |
| | 52 | curr = newTrackedVal->instances; |
| | 53 | last = NULL; |
| | 54 | while (curr != NULL) { |
| | 55 | StringCchPrintf(findValExpression, sizeof(findValExpression), "poi(0x%08x)", curr->address); |
| | 56 | if (value != GetExpression(findValExpression)) { |
| | 57 | if (last) { |
| | 58 | last->next = curr->next; |
| | 59 | free(curr); |
| | 60 | curr = last->next; |
| | 61 | } else { |
| | 62 | newTrackedVal->instances = curr->next; |
| | 63 | free(curr); |
| | 64 | curr = newTrackedVal->instances; |
| | 65 | } |
| | 66 | newTrackedVal->candidates--; |
| | 67 | if (newTrackedVal->candidates == 1) { |
| | 68 | dprintf("[J] Value %s is stored at address 0x%08x\n", |
| | 69 | newTrackedVal->valName, newTrackedVal->instances->address); |
| | 70 | return; |
| | 71 | } |
| | 72 | } else { |
| | 73 | last = curr; curr = curr->next; |
| | 74 | } |
| | 75 | } |
| | 76 | dprintf("[J] Narrowed down address of %s to %d possible candidates.\n", name, newTrackedVal->candidates); |
| | 77 | return; |
| | 78 | } |
| | 79 | dprintf("[J] Creating new list of candidates for %s.\n", name); |
| | 80 | |
| | 81 | // Create a new list and search all memory for the value |
| | 82 | newTrackedVal = (struct trackedVal *) malloc(sizeof (struct trackedVal)); |
| | 83 | if (newTrackedVal == NULL) { |
| | 84 | dprintf("[J] OOM!"); |
| | 85 | return; |
| | 86 | } |
| | 87 | newTrackedVal->next = NULL; |
| | 88 | newTrackedVal->valSize = size; |
| | 89 | newTrackedVal->valName = _strdup(name); |
| | 90 | if(!newTrackedVal->valName) { |
| | 91 | free(newTrackedVal); |
| | 92 | dprintf("[J] OOM!\n"); |
| | 93 | return; |
| | 94 | } |
| | 95 | |
| | 96 | newTrackedVal->candidates = findAllVals((BYTE*) &value, size, &(newTrackedVal->instances)); |
| | 97 | dprintf("[J] Discovered %d possible candidate addresses for %s\n", newTrackedVal->candidates, name); |
| | 98 | |
| | 99 | newTrackedVal->next = trackedValList; |
| | 100 | trackedValList = newTrackedVal; |
| | 101 | |
| | 102 | return; |
| | 103 | } |
| | 104 | |
| | 105 | void listTrackedVals() { |
| | 106 | } |
| | 107 | |
| | 544 | DWORD findAllVals(unsigned char *byteBuffer, BYTE size, struct valInstance **instance) { |
| | 545 | ULONG64 addressHit = 0; |
| | 546 | DWORD addressCount = 0; |
| | 547 | HRESULT memSearch; |
| | 548 | struct valInstance *newValInstance; |
| | 549 | |
| | 550 | *instance = NULL; |
| | 551 | |
| | 552 | while ((memSearch = g_ExtData->SearchVirtual(addressHit+size, (ULONG64)-1, byteBuffer, |
| | 553 | size, 1, &addressHit)) == S_OK) { |
| | 554 | |
| | 555 | if (!*instance) { |
| | 556 | *instance = (struct valInstance *) malloc(sizeof (struct valInstance)); |
| | 557 | newValInstance = *instance; |
| | 558 | } else { |
| | 559 | newValInstance->next = (struct valInstance *) malloc(sizeof (struct valInstance)); |
| | 560 | newValInstance = newValInstance->next; |
| | 561 | } |
| | 562 | newValInstance->address = addressHit; |
| | 563 | newValInstance->next = NULL; |
| | 564 | addressCount++; |
| | 565 | } |
| | 566 | |
| | 567 | return (addressCount); |
| | 568 | } |
| | 569 | |
