This is a tool created to inject strings using low level code
- Help translate a game without discovery about he packget/encryption.
- Help use Non-ASCII Characters.
- Help with a customizable Auto-WordWrap.
- Help translating text from native window controls.
- Help translate strings with unpredictable content using masks
- Allow put your group logo in the game startup
- Can use with just a small assembly knowledge
Our strategy to inject the string is create a new section using tools like the Stud_PE or CFF Explorer to have space in the executable to append the new code, a commom method is replace a original command and jump to your code, generally a jump have 5 bytes of length, sometimes you need replace more than one command and don't forget to place original commands like CMP and TEST after the execution of your code, of course, if have one.
Sample Call Algorithm:
@StrInject: ;Declare StrInject Label push EDX ;Backup EDX, ECX, EBX Registers push ECX push EBX push EAX ;The EAX is the string pointer or a unicode character call GetProc ;Here the Srl.Process Pointer is catched call EAX ;The next line is to the SRL.Process only add ESP, 0x4 ;Discard the last "Push EAX" (The SRL.Process is Cdecl) pop EBX ;Restore EDX, ECX, EBX Registers from the "Backup" pop ECX pop EDX jmp RetPnt ;Continue the Execution
Keep in mind, the add ESP, 0x4 is required when you use the SRL.Process export, if you use the SRL.ProcessSTD or SRL.GetDirectProcess you can't put this line.
We have various method to catch the Srl.Process Pointer, this one is to games who have a dynamic main module alocation, is possible use the sample bellow if you have injected the export in the game executable, you can use Stud_PE or CFF Explorer to do this, You need too create a new executable section to append our new code.
In the case of this Sample the Srl.Process address in the import table is allways relative to the our new executable section.
In the code bellow the catched EIP is to the "pop EAX" and the Srl.Process in the import table is for example 0x02B9C400 and the "pop EAX" is at 0x02B9E44C, so... 0x02B9E44C - 0x02B9C400 = 0x204C, now if we subtract this value of the EIP we can get the position of the Srl.Process pointer.
If you wanna use the SRL to put Non-ASCII Characters you need call the Srl.Process and give the char of a GetGlyph function to he.
Sample Catch Srl.Process:
@GetProc: call @Nxt ;Call the label Nxt @Nxt: ;Declare the Nxt label pop EAX ;Catch the EIP :) sub EAX, 0x204C ;Subtract the Difference from the EIP and Import Address mov EAX, [EAX] ;Read the import table ret
Fastest Reload Method:
After some problems with games that reload string inside a loop I created the GetDirectProcess, to import this function use the same method of the SRL.Process above, But you will change the GetProc, here a example code:
@GetProc: call @Nxt ;Call the label Nxt @Nxt: ;Declare the Nxt label pop EAX ;Catch the EIP :) cmp dword [EAX+0x21], 0;Verify if already have the Address jne @Finish push EAX ;Backup NXT Address sub EAX, 0x2050 ;Subtract the Difference from the EIP and Import Address mov EAX, [EAX] ;Read the import table call EAX ;Calls the GetDirectProcess pop EBX ;Recovery NXT Address mov [EBX+0x21], EAX ;Save the Process Address mov EAX, EBX ;Prepare to Finish @Finish: add EAX, 0x21 ;Ajust Pointer mov EAX, [EAX] ;Read the Process Address ret @Ptr: dd 0 ;Here is the @Nxt: + 0x21
You don't give pass nothing to this method, just call and catch the EAX, the EAX is a pointer to the Process function, using this pointer will be more fast to call the function, Keep in mind, the pointer given by the GetDirectProcess, is a STDCall function, so, you don't need pop the pointer given to the Process before
The SRL have a feature to automatically install the SRL in the game engine without you need know how to patch the game, just rename the SRLx32.dll to d3d9.dll; dinput8.dll or any other supported wrapper See Here what is supported, then in the SRL.ini set the AutoEngineHook to true.
Currently only the AdvHD and SoftPal engine is supported by this feature.