# 5/10/2014

Failed engines are as follows.

# 7/6/2014 NeXAS for GIGA BALDRSKYZERO_EXTREME

2 x GetGlyphOutlineA
caller: 503620: [esi] -> eax
ushort char = [arg1 + 0x1a8]

caller: 500039, 4ffff0
arg1 = eax = [edi]
edi = [esi+0x1a0] # stack size 4x3
ecx is a linked list

data structure: edi = (char *)[] # pointers of words

# 7/6/2014 NScript for CAGE OPEN/CLOSE
NScript reference
http://senzogawa.s90.xrea.com/reference/NScrAPI.html
http://autumoon.s35.xrea.com/nscr/ns07.html

File pattern: exists nscript.dat

Sample game: CAGE-OPEN-
Main function: 00406E79 - 00462660

ITH text thread: TextOutA

read case :text
- 44a3f0: arg last or ecx is the text to modify
          issue: two lines are splitted

modify: case gettext, issue: text load before it is displayed
- 43b1c5
- 43b1de

# 6/6/2014 WolfRPG

淫乱勇者セフィのRPG
ITH: 0x50a400
call graph
0x50a400
< = 0x50aec0
<1 0x50f404 = 50f3d0, called multiple times
<1 0x471322 = 46ccc0, called once

<2 0x50f49c = 50f410
<2 0x510298 = 5100b0, called multiple times
<2 0x470dd5 = 46ccc0, called once

46ccc0 must be the function to hijack
; int __stdcall sub_46CCC0(char, double, double)

# 6/5/2014 Rejet
剣が君
call graph

ITH: b3578, at [ecx]
= a34b0
< 51d9d = 51c60
< 51c18 = 51b30 < this is the right one!!!!
sub_451b30, no parameter!

There must be some text decomposed in sub_451b30

push ebx
push esi
4ba44e0

--------------------

base: 1250000

1261240
< 12602db = 12602a0

< 1263a7f = 1263a70
< 126151f = 12614b0
< 126148b = 1261480
< 1263763 = 1263720
< 1289140 = 1289120
< 12866be = 12866a0 = sub_4366a0
12866a0 might be the one?

<1 127c6e9 = 127c6e0 = sub_42c6e0
<1 1287c35 = 1287c00 = sub_437c00

<2 1287c46 = 1287c00 = sub_437c00, no parameter
<2 12a3a3c = 12a39d0 = sub_4a539d0, arg1


# 6/5/2014 KiriKiri
KiriKiri1 GetGlyphOutlineW: Hook point is a function, but called with different texts
KiriKiri2 GetTextEstendPoint32W: Hook point is not a function

Sample game: 淫辱選挙戦～白濁に染まる会長選～
call graph
GetGlyphOutlineA = 541a08
54762c = 547598
< 5498c9 (one of it) = 5498bc
< 549a65 (one of it) = 549a60
558a66 = 558ad0
5678c0 = 567810
437976 (dynamic) = 4378a0, the same type as rejet... this is a thread

# 5/11/2014 YU-RIS
悪女装

base = 400000
TextOutA = 436a5c
< 4054b1 = 405474
< 4259d6 = 424488 this function is not called!
There must be a loop
also, it does not have any parameter, probabily class method

# 5/11/2014 CMVS2
Sample game: ハピメア
Issue: The paint thread cannot be blocked. Have tried mutex.

Callee:  int __stdcall sub_448FF0(HDC hdc, int, int, int)
Stack:
- tm = tagTEXTMETRICA ptr -68h <= jichi: hook here
- gm = _GLYPHMETRICS ptr -30h

Callers:
- int __stdcall sub_44A350(LPCSTR lpString2)
- int __stdcall sub_449360(LPCSTR lpString2)
- int __stdcall sub_44B5C0(int, int, int, LPCSTR lpString2, int, int)

# 5/10/2014 System43
The thread is called with different text.
This might not be the proper place to substitute.

# EOF
