support more BB save slots; add client patch

system/client-functions/System/WriteCallToCode-59NL.x86.inc.s

@@ -3,15 +3,15 @@
 #     const void* patch_code,
 #     size_t patch_code_size,
 #     void* call_opcode_address,
-#     size_t call_opcode_bytes);
+#     ssize_t call_opcode_bytes);
 # This function allocates memory for patch_code, copies patch_code to that
-# memory, then writes a call opcode to call_opcode_address that calls the code
-# in the allocated memory region. The allocated memory is never freed.
+# memory, then writes a call or jmp opcode to call_opcode_address that calls
+# the code in the allocated memory region. The allocated memory is never freed.
 # call_opcode_bytes specifies how many bytes at the callsite should be
-# overwritten; this value must be at least 5. The first 5 bytes are overwritten
-# with the call opcode itself; the rest are overwritten with nop opcodes. If
-# the existing data at the call address is already a call opcode, this function
-# does nothing.
+# overwritten. This value must be at least 5; the first 5 bytes are overwritten
+# with the call/jmp opcode itself; the rest are overwritten with nop opcodes.
+# If call_opcode_bytes is positive, a call opcode is written; if it's negative,
+# a jmp opcode is written.
 # This function pops its arguments off the stack before returning.
 
 write_call_to_code:
@@ -20,11 +20,6 @@ write_call_to_code:
   # [esp + 0x0C] = jump callsite
   # [esp + 0x10] = callsite size
 
-  # Check if the opcode is already a call; if so, do nothing
-  mov       edx, [esp + 0x0C]
-  cmp       byte [edx], 0xE8
-  je        done
-
   # Allocate memory for the copied code
   mov       ecx, [0x00AAB404]
   push      dword [esp + 0x08]
@@ -46,16 +41,22 @@ memcpy_again:
   jne       memcpy_again
   pop       ebx
 
-  # Write the call opcode
+  # Write the call or jmp opcode
   mov       edx, [esp + 0x0C]  # edx = jump callsite
   lea       ecx, [eax - 5]
   sub       ecx, edx  # ecx = (dest code addr) - (jump callsite) - 5
-  mov       byte [edx], 0xE8
+  cmp       dword [esp + 0x10], 0
+  setl      al
+  or        al, 0xE8
+  mov       [edx], al  # Write E8 (call), or E9 (jmp) if size was negative
   mov       [edx + 1], ecx  # Write E8 (call) followed by delta
 
   # Write as many nops after the call opcode as necessary
   mov       ecx, 5
   mov       eax, [esp + 0x10]
+  cmp       eax, 0
+  jge       write_nop_again
+  neg       eax
 write_nop_again:
   cmp       ecx, eax
   jge       done