Probe route observer service lookup

This commit is contained in:
2026-06-20 01:21:14 -05:00
parent 22ad253fe7
commit ad4907040a
3 changed files with 66 additions and 1 deletions
+35
View File
@@ -137,6 +137,7 @@ constexpr uintptr_t kRouteObserver23ActivateRva = 0x0AA63E0;
constexpr uintptr_t kRouteObserver0DeactivateRva = 0x27B10C0;
constexpr uintptr_t kRouteObserver1DeactivateRva = 0x295D4A0;
constexpr uintptr_t kRouteObserver23DeactivateRva = 0x286A85C;
constexpr uintptr_t kObserver1SystemTypeGlobalRva = 0x342F6A8;
HMODULE gModule = nullptr;
std::mutex gLogMutex;
@@ -677,12 +678,17 @@ void LogMappinRouteCollections(const char* aName, uint32_t aCount, void* aSystem
void LogRouteObserverContext(const char* aName, uint32_t aCount, void* aObserver, void* aRouteEntry)
{
auto* observerInner = ReadPointerField(aObserver, 0x08);
auto* observerInnerServiceOwner = ReadPointerField(observerInner, 0x18);
auto* observer1SystemType =
ReadPointerField(reinterpret_cast<void*>(GetImageBase() + kObserver1SystemTypeGlobalRva), 0x00);
auto* routeObject = ReadPointerField(aRouteEntry, 0x00);
std::ostringstream line;
line << "hook " << aName << " call=" << aCount;
AppendPointerWithRva(line, "observer", aObserver);
AppendPointerWithRva(line, "observerInner", observerInner);
AppendPointerWithRva(line, "observerInnerServiceOwner", observerInnerServiceOwner);
AppendPointerWithRva(line, "observer1SystemType342f6a8", observer1SystemType);
AppendPointerWithRva(line, "routeEntry", aRouteEntry);
AppendPointerWithRva(line, "routeObject", routeObject);
AppendPointerField(line, "routeEntry_f08", aRouteEntry, 0x08);
@@ -696,6 +702,31 @@ void LogRouteObserverContext(const char* aName, uint32_t aCount, void* aObserver
AppendObjectVtableSlots(observerLine, aObserver, {0x48, 0x50});
LogRed4ext(observerLine.str());
if (observerInner)
{
std::ostringstream innerLine;
innerLine << "route-observer-inner " << aName << " call=" << aCount;
AppendPointerWithRva(innerLine, "observerInner", observerInner);
AppendObjectVtableSlots(innerLine, observerInner, {0x08});
AppendPointerField(innerLine, "field18", observerInner, 0x18);
AppendPointerField(innerLine, "field180", observerInner, 0x180);
AppendPointerField(innerLine, "field1a0", observerInner, 0x1A0);
AppendPointerField(innerLine, "field1c0", observerInner, 0x1C0);
AppendPointerField(innerLine, "field1e0", observerInner, 0x1E0);
AppendPointerField(innerLine, "field1e8", observerInner, 0x1E8);
AppendPointerField(innerLine, "field1f0", observerInner, 0x1F0);
LogRed4ext(innerLine.str());
}
if (observerInnerServiceOwner)
{
std::ostringstream serviceOwnerLine;
serviceOwnerLine << "route-observer-service-owner " << aName << " call=" << aCount;
AppendPointerWithRva(serviceOwnerLine, "serviceOwner", observerInnerServiceOwner);
AppendObjectVtableSlots(serviceOwnerLine, observerInnerServiceOwner, {0x08});
LogRed4ext(serviceOwnerLine.str());
}
if (!routeObject)
{
return;
@@ -710,9 +741,13 @@ void LogRouteObserverContext(const char* aName, uint32_t aCount, void* aObserver
AppendPointerField(routeLine, "field78", routeObject, 0x78);
AppendUint32Field(routeLine, "field80", routeObject, 0x80);
AppendByteField(routeLine, "active84", routeObject, 0x84);
AppendUint32Field(routeLine, "field8C", routeObject, 0x8C);
AppendUint32Field(routeLine, "field90", routeObject, 0x90);
AppendPointerField(routeLine, "field98", routeObject, 0x98);
AppendPointerField(routeLine, "field88", routeObject, 0x88);
AppendPointerField(routeLine, "fieldF8", routeObject, 0xF8);
AppendPointerField(routeLine, "field120", routeObject, 0x120);
AppendByteField(routeLine, "fieldE2", routeObject, 0xE2);
LogRed4ext(routeLine.str());
}