I_Jemin / ITHVNR_kor

Go to a project
Toggle navigation Toggle navigation pinning
mireado
e9a703c3 1 parent 14f251b2

starting commit

Inline Side-by-side
Showing 7 changed files with 600 additions and 0 deletions
1 +// disasm.cc
2 +// 1/27/2013 jichi
3 +// Original source: http://hack-expo.void.ru/groups/blt/text/disasm.txt
4 +//
5 +// 7/19/2014 jichi: Need to add SSE instruction support for PCSX2
6 +// Sample problematic input from Fate/Stay night PS2:
7 +// 3024b80c -0f88 ae58dbd2 js pcsx2.030010c0
8 +// 3024b812 0f1201 movlps xmm0,qword ptr ds:[ecx] ; jichi: hook here
9 +// 3024b815 0f1302 movlps qword ptr ds:[edx],xmm0
10 +
11 +#include "disasm.h"
12 +
13 +// disasm_flag values:
14 +enum : unsigned {
15 + C_66 = 0x00000001 // 66-prefix
16 + , C_67 = 0x00000002 // 67-prefix
17 + , C_LOCK = 0x00000004 // lock
18 + , C_REP = 0x00000008 // repz/repnz
19 + , C_SEG = 0x00000010 // seg-prefix
20 + , C_OPCODE2 = 0x00000020 // 2nd opcode present (1st==0f)
21 + , C_MODRM = 0x00000040 // modrm present
22 + , C_SIB = 0x00000080 // sib present
23 + , C_ANYPREFIX = (C_66|C_67|C_LOCK|C_REP|C_SEG)
24 +};
25 +
26 +DISASM_BEGIN_NAMESPACE
27 +
28 +// These values are served as the output of disasm
29 +// But the are currently unused and could make disasm thread-unsafe
30 +namespace { // unnamed
31 +
32 +BYTE disasm_seg, // CS DS ES SS FS GS
33 + disasm_rep, // REPZ/REPNZ
34 + disasm_opcode, // opcode
35 + disasm_opcode2, // used when opcode==0f
36 + disasm_modrm, // modxxxrm
37 + disasm_sib, // scale-index-base
38 + disasm_mem[8], // mem addr value
39 + disasm_data[8]; // data value
40 +
41 +} // unnamed namespace
42 +
43 +// return: length if success, 0 if error
44 +int disasm(const BYTE *opcode0)
45 +{
46 + const BYTE *opcode = opcode0;
47 +
48 + DWORD disasm_len = 0, // 0 if error
49 + disasm_flag = 0, // C_xxx
50 + disasm_memsize = 0, // value = disasm_mem
51 + disasm_datasize = 0, // value = disasm_data
52 + disasm_defdata = 4, // == C_66 ? 2 : 4
53 + disasm_defmem = 4; // == C_67 ? 2 : 4
54 +
55 +retry:
56 + disasm_opcode = *opcode++;
57 +
58 + switch (disasm_opcode) {
59 + case 0x99: // 7/20/2014 jichi: CDQ, size = 1
60 + break;
61 +
62 + case 0x00: case 0x01: case 0x02: case 0x03:
63 + case 0x08: case 0x09: case 0x0a: case 0x0b:
64 + case 0x10: case 0x11: case 0x12: case 0x13:
65 + case 0x18: case 0x19: case 0x1a: case 0x1b:
66 + case 0x20: case 0x21: case 0x22: case 0x23:
67 + case 0x28: case 0x29: case 0x2a: case 0x2b:
68 + case 0x30: case 0x31: case 0x32: case 0x33:
69 + case 0x38: case 0x39: case 0x3a: case 0x3b:
70 + case 0x62: case 0x63:
71 + case 0x84: case 0x85: case 0x86: case 0x87:
72 + case 0x88: case 0x89: case 0x8a: case 0x8b:
73 + case 0x8c: case 0x8d: case 0x8e: case 0x8f:
74 + case 0xc4: case 0xc5:
75 + case 0xd0: case 0xd1: case 0xd2: case 0xd3:
76 + case 0xd8: case 0xd9: case 0xda: case 0xdb:
77 + case 0xdc: case 0xdd: case 0xde: case 0xdf:
78 + case 0xfe: case 0xff:
79 + disasm_flag |= C_MODRM;
80 + break;
81 + case 0xcd: disasm_datasize += *opcode==0x20 ? 1+4 : 1;
82 + break;
83 + case 0xf6:
84 + case 0xf7: disasm_flag |= C_MODRM;
85 + if (*opcode & 0x38) break;
86 + // continue if <test ..., xx>
87 + case 0x04: case 0x05: case 0x0c: case 0x0d:
88 + case 0x14: case 0x15: case 0x1c: case 0x1d:
89 + case 0x24: case 0x25: case 0x2c: case 0x2d:
90 + case 0x34: case 0x35: case 0x3c: case 0x3d:
91 + if (disasm_opcode & 1)
92 + disasm_datasize += disasm_defdata;
93 + else
94 + disasm_datasize++;
95 + break;
96 + case 0x6a:
97 + case 0xa8:
98 + case 0xb0: case 0xb1: case 0xb2: case 0xb3:
99 + case 0xb4: case 0xb5: case 0xb6: case 0xb7:
100 + case 0xd4: case 0xd5:
101 + case 0xe4: case 0xe5: case 0xe6: case 0xe7:
102 + case 0x70: case 0x71: case 0x72: case 0x73:
103 + case 0x74: case 0x75: case 0x76: case 0x77:
104 + case 0x78: case 0x79: case 0x7a: case 0x7b:
105 + case 0x7c: case 0x7d: case 0x7e: case 0x7f:
106 + case 0xeb:
107 + case 0xe0: case 0xe1: case 0xe2: case 0xe3:
108 + disasm_datasize++;
109 + break;
110 + case 0x26: case 0x2e: case 0x36: case 0x3e:
111 + case 0x64: case 0x65:
112 + if (disasm_flag & C_SEG) return 0;
113 + disasm_flag |= C_SEG;
114 + disasm_seg = disasm_opcode;
115 + goto retry;
116 + case 0xf0:
117 + if (disasm_flag & C_LOCK) return 0;
118 + disasm_flag |= C_LOCK;
119 + goto retry;
120 + case 0xf2: case 0xf3:
121 + if (disasm_flag & C_REP) return 0;
122 + disasm_flag |= C_REP;
123 + disasm_rep = disasm_opcode;
124 + goto retry;
125 + case 0x66:
126 + if (disasm_flag & C_66) return 0;
127 + disasm_flag |= C_66;
128 + disasm_defdata = 2;
129 + goto retry;
130 + case 0x67:
131 + if (disasm_flag & C_67) return 0;
132 + disasm_flag |= C_67;
133 + disasm_defmem = 2;
134 + goto retry;
135 + case 0x6b:
136 + case 0x80:
137 + case 0x82:
138 + case 0x83:
139 + case 0xc0:
140 + case 0xc1:
141 + case 0xc6: disasm_datasize++;
142 + disasm_flag |= C_MODRM;
143 + break;
144 + case 0x69:
145 + case 0x81:
146 + case 0xc7:
147 + disasm_datasize += disasm_defdata;
148 + disasm_flag |= C_MODRM;
149 + break;
150 + case 0x9a:
151 + case 0xea: disasm_datasize += 2 + disasm_defdata;
152 + break;
153 + case 0xa0:
154 + case 0xa1:
155 + case 0xa2:
156 + case 0xa3: disasm_memsize += disasm_defmem;
157 + break;
158 + case 0x68:
159 + case 0xa9:
160 + case 0xb8: case 0xb9: case 0xba: case 0xbb:
161 + case 0xbc: case 0xbd: case 0xbe: case 0xbf:
162 + case 0xe8:
163 + case 0xe9:
164 + disasm_datasize += disasm_defdata;
165 + break;
166 + case 0xc2:
167 + case 0xca: disasm_datasize += 2;
168 + break;
169 + case 0xc8:
170 + disasm_datasize += 3;
171 + break;
172 + case 0xf1:
173 + return 0;
174 + case 0x0f:
175 + // 7/19/2014 jichi: 0x0f1201 = movlps xmm0,qword ptr ds:[ecx]
176 + // Given 0x0f1201, 0x0f will be strip off here and left 0x1201
177 + disasm_flag |= C_OPCODE2;
178 + disasm_opcode2 = *opcode++;
179 + switch (disasm_opcode2) {
180 + case 0x00: case 0x01: case 0x02: case 0x03:
181 + case 0x90: case 0x91: case 0x92: case 0x93:
182 + case 0x94: case 0x95: case 0x96: case 0x97:
183 + case 0x98: case 0x99: case 0x9a: case 0x9b:
184 + case 0x9c: case 0x9d: case 0x9e: case 0x9f:
185 + case 0xa3:
186 + case 0xa5:
187 + case 0xab:
188 + case 0xad:
189 + case 0xaf:
190 + case 0xb0: case 0xb1: case 0xb2: case 0xb3:
191 + case 0xb4: case 0xb5: case 0xb6: case 0xb7:
192 + case 0xbb:
193 + case 0xbc: case 0xbd: case 0xbe: case 0xbf:
194 + case 0xc0:
195 + case 0xc1:
196 + // 7/19/2014 jichi: Add more cases for SSE instructions
197 + // Sample instructions I need to consider
198 + // 0f1201 movlps xmm0,qword ptr ds:[ecx] ; jichi: hook here
199 + // 0f1302 movlps qword ptr ds:[edx],xmm0
200 + case 0x12:
201 + case 0x13:
202 + disasm_flag |= C_MODRM;
203 + break;
204 + case 0x06:
205 + case 0x08: case 0x09: case 0x0a: case 0x0b:
206 + case 0xa0: case 0xa1: case 0xa2: case 0xa8:
207 + case 0xa9:
208 + case 0xaa:
209 + case 0xc8: case 0xc9: case 0xca: case 0xcb:
210 + case 0xcc: case 0xcd: case 0xce: case 0xcf:
211 + break;
212 + case 0x80: case 0x81: case 0x82: case 0x83:
213 + case 0x84: case 0x85: case 0x86: case 0x87:
214 + case 0x88: case 0x89: case 0x8a: case 0x8b:
215 + case 0x8c: case 0x8d: case 0x8e: case 0x8f:
216 + disasm_datasize += disasm_defdata;
217 + break;
218 + case 0xa4:
219 + case 0xac:
220 + case 0xba:
221 + default: return 0; // 7/19/2014 jichi: error
222 + } // 0F-switch
223 + break;
224 +
225 + } // switch
226 +
227 + if (disasm_flag & C_MODRM) {
228 + disasm_modrm = *opcode++;
229 + BYTE mod = disasm_modrm & 0xc0;
230 + BYTE rm = disasm_modrm & 0x07;
231 + if (mod != 0xc0) {
232 + if (mod == 0x40)
233 + disasm_memsize++;
234 + if (mod == 0x80)
235 + disasm_memsize += disasm_defmem;
236 + if (disasm_defmem == 2) { // modrm16
237 + if (mod == 0x00 && rm == 0x06)
238 + disasm_memsize += 2;
239 + } else { // modrm32
240 + if (rm == 0x04) {
241 + disasm_flag |= C_SIB;
242 + disasm_sib = *opcode++;
243 + rm = disasm_sib & 0x07;
244 + }
245 + if (rm == 0x05 && mod == 0x00)
246 + disasm_memsize += 4;
247 + }
248 + }
249 + } // C_MODRM
250 +
251 + for (DWORD i = 0; i < disasm_memsize; i++)
252 + disasm_mem[i] = *opcode++;
253 + for (DWORD i = 0; i < disasm_datasize; i++)
254 + disasm_data[i] = *opcode++;
255 +
256 + disasm_len = opcode - opcode0;
257 +
258 + return disasm_len;
259 +} // disasm
260 +
261 +DISASM_END_NAMESPACE
262 +
263 +// EOF
1 +#pragma once
2 +// disasm.h
3 +// 1/27/2013 jichi
4 +
5 +// Include typedef of BYTE
6 +//#include <windef.h>
7 +#include <windows.h>
8 +
9 +//#ifdef QT_CORE_LIB
10 +//# include <qt_windows.h>
11 +//#else
12 +//# include <windows.h>
13 +//#endif
14 +
15 +#ifndef DISASM_BEGIN_NAMESPACE
16 +# define DISASM_BEGIN_NAMESPACE
17 +#endif
18 +#ifndef DISASM_END_NAMESPACE
19 +# define DISASM_END_NAMESPACE
20 +#endif
21 +
22 +DISASM_BEGIN_NAMESPACE
23 +int disasm(const BYTE *opcode0); // return: op length if success, 0 if error
24 +DISASM_END_NAMESPACE
25 +
26 +// EOF
1 +# disasm.pri
2 +# 1/31/2012 jichi
3 +win32 {
4 +
5 +DEFINES += WITH_LIB_DISASM
6 +LIBS += -ldisasm
7 +DEPENDPATH += $$PWD
8 +HEADERS += $$PWD/disasm.h
9 +#SOURCES += $$PWD/disasm.cc
10 +
11 +}
12 +
13 +# EOF
1 +# sys.pro
2 +# 8/21/2013 jichi
3 +# Build ITH_engine.dll
4 +
5 +CONFIG += noqt noeh staticlib
6 +include(../../../config.pri)
7 +
8 +## Sources
9 +
10 +TEMPLATE = lib
11 +TARGET = disasm
12 +
13 +HEADERS += disasm.h
14 +SOURCES += disasm.cc
15 +
16 +# EOF
1 +# ith/common/common.pri
2 +# 8/9/2011 jichi
3 +# Overwrite ITH headers
4 +
5 +#DEFINES += ITH_HAS_CRT # whether ITH is linked with msvcrt
6 +#DEFINES += ITH_HAS_CXX # whether ITH has access to native C++ syntax
7 +
8 +DEPENDPATH += $$PWD
9 +
10 +HEADERS += \
11 + $$PWD/const.h \
12 + $$PWD/defs.h \
13 + $$PWD/except.h \
14 + $$PWD/growl.h \
15 + $$PWD/memory.h \
16 + $$PWD/string.h \
17 + $$PWD/types.h
18 +
19 +DEFINES += _CRT_NON_CONFORMING_SWPRINTFS
20 +
21 +# jichi 9/14/2013: Whether using SEH exception handle.
22 +# msvcrt on Windows XP is missin EH
23 +#DEFINES += ITH_HAS_SEH
24 +
25 +# jichi 9/22/2013: Whether let ITH manage heap
26 +#DEFINES += ITH_HAS_HEAP
27 +
28 +# EOF
1 +#pragma once
2 +
3 +// ith/common/const.h
4 +// 8/23/2013 jichi
5 +// Branch: ITH/common.h, rev 128
6 +
7 +// jichi 9/9/2013: Another importnat function is lstrcatA, which is already handled by
8 +// Debonosu hooks. Wait until it is really needed by certain games.
9 +// The order of the functions is used in several place.
10 +// I need to recompile all of the dlls to modify the order.
11 +enum HookFunType {
12 + HF_Null = -1
13 + , HF_GetTextExtentPoint32A
14 + , HF_GetGlyphOutlineA
15 + , HF_ExtTextOutA
16 + , HF_TextOutA
17 + , HF_GetCharABCWidthsA
18 + , HF_DrawTextA
19 + , HF_DrawTextExA
20 + //, HF_lstrlenA
21 + , HF_GetTextExtentPoint32W
22 + , HF_GetGlyphOutlineW
23 + , HF_ExtTextOutW
24 + , HF_TextOutW
25 + , HF_GetCharABCWidthsW
26 + , HF_DrawTextW
27 + , HF_DrawTextExW
28 + //, HF_lstrlenW
29 + , HookFunCount // 14
30 +};
31 +
32 +// jichi 10/14/2014
33 +#define HOOK_GDI_FUNCTION_LIST \
34 + GetTextExtentPoint32A \
35 + , GetGlyphOutlineA \
36 + , ExtTextOutA \
37 + , TextOutA \
38 + , GetCharABCWidthsA \
39 + , GetTextExtentPoint32W \
40 + , GetGlyphOutlineW \
41 + , ExtTextOutW \
42 + , TextOutW \
43 + , GetCharABCWidthsW \
44 + , DrawTextA \
45 + , DrawTextExA \
46 + , DrawTextW \
47 + , DrawTextExW
48 +
49 +enum { HOOK_FUN_COUNT = HookFunCount };
50 +// jichi 1/16/2015: Though called max hook, it means max number of text threads
51 +enum { MAX_HOOK = 32 }; // must be larger than HookFunCount
52 +//enum { HOOK_SECTION_SIZE = 0x2000 }; // default ITH value
53 +// jichi 1/16/2015: Change to a very large number to prevent crash
54 +//enum { MAX_HOOK = 0x100 }; // must be larger than HookFunCount
55 +enum { HOOK_SECTION_SIZE = MAX_HOOK * 0x100 }; // default ITH value is 0x2000 for 32 hook (0x100 per hook)
56 +
57 +// jichi 375/2014: Add offset of pusha/pushad
58 +// http://faydoc.tripod.com/cpu/pushad.htm
59 +// http://agth.wikia.com/wiki/Cheat_Engine_AGTH_Tutorial
60 +//
61 +// Warning: The offset in ITH has -4 offset comparing to pusha and AGTH
62 +enum pusha_off {
63 + pusha_eax_off = -0x4
64 + , pusha_ecx_off = -0x8
65 + , pusha_edx_off = -0xc
66 + , pusha_ebx_off = -0x10
67 + , pusha_esp_off = -0x14
68 + , pusha_ebp_off = -0x18
69 + , pusha_esi_off = -0x1c
70 + , pusha_edi_off = -0x20
71 + , pusha_off = -0x24 // pushad offset
72 +};
73 +
74 +enum IhfCommandType {
75 + IHF_COMMAND = -1 // null type
76 + , IHF_COMMAND_NEW_HOOK = 0
77 + , IHF_COMMAND_REMOVE_HOOK = 1
78 + , IHF_COMMAND_MODIFY_HOOK = 2
79 + , IHF_COMMAND_DETACH = 3
80 +};
81 +
82 +enum IhfNotificationType {
83 + IHF_NOTIFICATION = -1 // null type
84 + , IHF_NOTIFICATION_TEXT = 0
85 + , IHF_NOTIFICATION_NEWHOOK = 1
86 +};
87 +
88 +// jichi 9/8/2013: The meaning are guessed
89 +// Values must be within DWORD
90 +// Unused values are as follows:
91 +// - 0x100
92 +enum HookParamType : unsigned long {
93 + USING_STRING = 0x1 // type(data) is char* or wchar_t* and has length
94 + , USING_UTF8 = USING_STRING // jichi 10/21/2014: temporarily handled the same way as USING_STRING
95 + , USING_UNICODE = 0x2 // type(data) is wchar_t or wchar_t*
96 + , BIG_ENDIAN = 0x4 // type(data) is char
97 + , DATA_INDIRECT = 0x8
98 + , USING_SPLIT = 0x10 // aware of split time?
99 + , SPLIT_INDIRECT = 0x20
100 + , MODULE_OFFSET = 0x40 // do hash module, and the address is relative to module
101 + , FUNCTION_OFFSET = 0x80 // do hash function, and the address is relative to funccion
102 + , PRINT_DWORD = 0x100 // jichi 12/7/2014: Removed
103 + , STRING_LAST_CHAR = 0x200
104 + , NO_CONTEXT = 0x400
105 + //, EXTERN_HOOK = 0x800 // jichi 10/24/2014: Removed
106 + //, HOOK_AUXILIARY = 0x2000 // jichi 12/13/2013: None of known hooks are auxiliary
107 + , HOOK_ENGINE = 0x4000
108 + , HOOK_ADDITIONAL = 0x8000
109 +
110 + // jichi 10/24/2014: Only trigger the dynamic function, do not return any data
111 + , HOOK_EMPTY = 0x800
112 + // jichi 6/1/2014: fix the split value to 0x10001
113 + , FIXING_SPLIT = 0x1000
114 + , RELATIVE_SPLIT = 0x2000 // relative split return address
115 +};
116 +
117 +// 6/1/2014: Fixed split value for hok parameter
118 +// Fuse all threads, and prevent floating
119 +enum { FIXED_SPLIT_VALUE = 0x10001 };
120 +
121 +// jichi 12/18/2013:
122 +// These dlls are used to guess the range for non-NO_CONTEXT hooks.
123 +//
124 +// Disabling uxtheme.dll would crash certain system: http://tieba.baidu.com/p/2764436254
125 +#define IHF_FILTER_DLL_LIST \
126 + /* ITH original filters */ \
127 + L"gdiplus.dll" /* Graphics functions like TextOutA */ \
128 + , L"lpk.dll" /* Language package scripts and fonts */ \
129 + , L"msctf.dll" /* Text service */ \
130 + , L"psapi.dll" /* Processes */ \
131 + , L"usp10.dll" /* UNICODE rendering */ \
132 + , L"user32.dll" /* Non-graphics functions like lstrlenA */ \
133 + , L"uxtheme.dll" /* Theme */ \
134 + \
135 + /* Windows DLLs */ \
136 + , L"advapi32.dll" /* Advanced services */ \
137 + , L"apphelp.dll" /* Appliation help */ \
138 + , L"audioses.dll" /* Audios */ \
139 + , L"avrt.dll" /* Audio video runtime */ \
140 + , L"cfgmgr32.dll" /* Configuration manager */ \
141 + , L"clbcatq.dll" /* COM query service */ \
142 + , L"comctl32.dll" /* Common control library */ \
143 + , L"comdlg32.dll" /* Common dialogs */ \
144 + , L"crypt32.dll" /* Security cryption */ \
145 + , L"cryptbase.dll"/* Security cryption */ \
146 + , L"cryptsp.dll" /* Security cryption */ \
147 + , L"d3d8thk.dll" /* Direct3D 8 */ \
148 + , L"d3d9.dll" /* Direct3D 9 */ \
149 + , L"dbghelp.dll" /* Debug help */ \
150 + , L"dciman32.dll" /* Display cotrol */ \
151 + , L"devobj.dll" /* Device object */ \
152 + , L"ddraw.dll" /* Direct draw */ \
153 + , L"dinput.dll" /* Diret input */ \
154 + , L"dsound.dll" /* Direct sound */ \
155 + , L"DShowRdpFilter.dll" /* Direct show */ \
156 + , L"dwmapi.dll" /* Windows manager */ \
157 + , L"gdi32.dll" /* GDI32 */ \
158 + , L"hid.dll" /* HID user library */ \
159 + , L"iertutil.dll" /* IE runtime */ \
160 + , L"imagehlp.dll" /* Image help */ \
161 + , L"imm32.dll" /* Input method */ \
162 + , L"ksuser.dll" /* Kernel service */ \
163 + , L"ole32.dll" /* COM OLE */ \
164 + , L"oleacc.dll" /* OLE access */ \
165 + , L"oleaut32.dll" /* COM OLE */ \
166 + , L"kernel.dll" /* Kernel functions */ \
167 + , L"kernelbase.dll" /* Kernel functions */ \
168 + , L"midimap.dll" /* MIDI */ \
169 + , L"mmdevapi.dll" /* Audio device */ \
170 + , L"mpr.dll" /* Winnet */ \
171 + , L"msacm32.dll" /* MS ACM */ \
172 + , L"msacm32.drv" /* MS ACM */ \
173 + , L"msasn1.dll" /* Encoding/decoding */ \
174 + , L"msimg32.dll" /* Image */ \
175 + , L"msvfw32.dll" /* Media play */ \
176 + , L"netapi32.dll" /* Network service */ \
177 + , L"normaliz.dll" /* Normalize */ \
178 + , L"nsi.dll" /* NSI */ \
179 + , L"ntdll.dll" /* NT functions */ \
180 + , L"ntmarta.dll" /* NT MARTA */ \
181 + , L"nvd3dum.dll" /* Direct 3D */ \
182 + , L"powerprof.dll"/* Power profile */ \
183 + , L"profapi.dll" /* Profile API */ \
184 + , L"propsys.dll" /* System properties */ \
185 + , L"quartz.dll" /* OpenGL */ \
186 + , L"rpcrt4.dll" /* RPC runtime */ \
187 + , L"rpcrtremote.dll" /* RPC runtime */ \
188 + , L"rsabase.dll" /* RSA cryption */ \
189 + , L"rsaenh.dll" /* RSA cryption */ \
190 + , L"schannel.dll" /* Security channel */ \
191 + , L"sechost.dll" /* Service host */ \
192 + , L"setupapi.dll" /* Setup service */ \
193 + , L"shell32.dll" /* Windows shell */ \
194 + , L"shlwapi.dll" /* Light-weighted shell */ \
195 + , L"slc.dll" /* SLC */ \
196 + , L"srvcli.dll" /* Service client */ \
197 + , L"version.dll" /* Windows version */ \
198 + , L"wdmaud.drv" /* Wave output */ \
199 + , L"wldap32.dll" /* Wireless */ \
200 + , L"wininet.dll" /* Internet access */ \
201 + , L"winmm.dll" /* Windows sound */ \
202 + , L"winsta.dll" /* Connection system */ \
203 + , L"wtsapi32.dll" /* Windows terminal server */ \
204 + , L"wintrust.dll" /* Windows trust */ \
205 + , L"wsock32.dll" /* Windows sock */ \
206 + , L"ws2_32.dll" /* Terminal server */ \
207 + , L"wkscli.dll" /* ACIS */ \
208 + \
209 + /* MSVCRT */ \
210 + , L"msvcrt.dll" /* VC rutime */ \
211 + , L"msvcr80.dll" /* VC rutime 8 */ \
212 + , L"msvcp80.dll" /* VC rutime 8 */ \
213 + , L"msvcr90.dll" /* VC rutime 9 */ \
214 + , L"msvcp90.dll" /* VC rutime 9 */ \
215 + , L"msvcr100.dll" /* VC rutime 10 */ \
216 + , L"msvcp100.dll" /* VC rutime 10 */ \
217 + , L"msvcr110.dll" /* VC rutime 11 */ \
218 + , L"msvcp110.dll" /* VC rutime 11 */ \
219 + \
220 + /* VNR */ \
221 + , L"vnrhook.dll" \
222 + , L"vnrhookxp.dll" \
223 + \
224 + /* Sogou IME */ \
225 + , L"sogoupy.ime" \
226 + , L"PicFace.dll" \
227 + , L"AddressSearch.dll" \
228 + \
229 + /* QQ IME */ \
230 + , L"QQPINYIN.IME" \
231 + \
232 + /* AlphaROM */ \
233 + , L"kDays.dll" \
234 + \
235 + /* 360Safe */ \
236 + , L"safemon.dll" \
237 + \
238 + /* Locale changers */ \
239 + , L"AlLayer.dll" /* AppLocale */ \
240 + , L"LocaleEmulator.dll" /* Locale Emulator */ \
241 + , L"LSH.dll" /* LocaleSwitch */ \
242 + , L"ntleah.dll" /* NTLEA */
243 +
244 + // Google Japanese IME
245 + //, L"GoogleIMEJaTIP32.dll"
246 +
247 +enum {
248 + //IHF_FILTER_COUNT = 7
249 + IHF_FILTER_COUNT = 7 + 72 + 9 + 4 + 3 + 1 + 1 + 1 + 4 // count of total dlls to filter
250 + , IHF_FILTER_CAPACITY = IHF_FILTER_COUNT + 1 // one more than the dll count
251 +};
252 +
253 +// EOF