TwMS v1.47.2_ICS_物品過濾

//TwMS v1.47.2_ICS_物品過濾
//Update:Onion

[Enable]
Registersymbol(CheckESP)
Alloc(CheckESP,512)
Registersymbol(ItemList)
Alloc(ItemList,204800)
Label(HookESP)
Label(HookFun)
Label(HookOr1)
Label(HookOr2)
Label(Filter)
Label(Skip)
Label(End)

ItemList:
//請在以下加入欲過濾名單
DD 3D0B1E
//請在以上加入欲過濾名單
DD 00

CheckESP:
CMP DWORD PTR DS:[ESP+64],004E8777
JE HookESP
Jmp 00700511
HookESP:
MOV DWORD PTR DS:[ESP+64],HookFun
Jmp 00700511

HookFun:
MOV EAX,DWORD PTR SS:[EBP-1C]
MOV ESI,DWORD PTR SS:[EBP-50]
MOV BYTE PTR DS:[ESI+1C],AL
CMP EAX,1
JE HookOr1
CMP EAX,2
JE HookOr1
XOR AL,AL
JMP HookOr2
HookOr1:
MOV AL,1
HookOr2:
MOV BYTE PTR DS:[ESI+1D],AL
MOV DWORD PTR DS:[ESI+20],EDI
MOV EDI,DWORD PTR SS:[EBP+8]
MOV ECX,EDI
call 004088CD
MOVZX EAX,AL
MOV ECX,EDI
MOV DWORD PTR DS:[ESI+30],EAX
call 00408929
PUSH ESI
MOV ESI,ItemList

Filter:
CMP EAX,C350
JLE End
CMP DWORD PTR DS:[ESI],0
Je End
CMP DWORD PTR DS:[ESI],EAX
Je Skip
ADD ESI,4
JMP Filter
Skip:
XOR EAX,EAX
End:
POP ESI
MOV ECX,EDI
MOV [ESI+34],EAX
Jmp 004E87B2

00D927C4:
DD CheckESP

[Disable]

00D927C4:
DD 00700511
UnRegistersymbol(CheckESP)
DeAlloc(CheckESP)
UnRegistersymbol(ItemList)
DeAlloc(ItemList)