以前的学习笔记 蜀门-人物属性的查找笔记

笨鸟我先飞

粘贴自自己当时的学习笔记的mht文件,不会上传排版...图片没啥东西,仅仅是CE或OD当时的截图而已我会把整个网页的截图放到最后

通过来回变动人物的血量,找出4个地址来

再次变动人物血量发现有两个地址是和当前血量有关系的

	[img=606,146][/img]

OD里分别DD这两个地址

通过对这两个地址分别下写入内点后追出来的表达式几乎一样, 都是

dd [14855fc]+1290+298]=HP

只不过第一个的后面还有一个类似数组一样的表达式

	[img=687,90][/img]

第二个地址好追一点

1	第二步
2	00489730	/.	55		PUSH EBP
3	00489731	|.	8BEC		MOV EBP,ESP
4	00489733	|.	83EC	0C	SUB ESP,0C
5	00489736	|.	53		PUSH EBX
6	00489737	|.	8B5D	08	MOV EBX,DWORD	PTR	SS:[EBP+8]
7	0048973A	|.	56		PUSH ESI
8	0048973B	|.	57		PUSH EDI
9	0048973C	|.	8D45	F4	LEA EAX,DWORD	PTR	SS:[EBP-C]
10	0048973F	|.	50		PUSH EAX

11	00489740 |. 53 PUSH EBX
12	00489741 |. 33F6 XOR ESI,ESI
13	00489743 |. 6A 04 PUSH 4
14	00489745 |. 8BF9 MOV EDI,ECX
	;EDI=ecx,对象的指针来源于上层,继续返回
15	00489747 |. 8975 F4 MOV DWORD PTR SS:[EBP-C],ESI
16	0048974A |. E8 E1C57600 CALL client.00BF5D30
17	0048974F |. 8975 FC MOV DWORD PTR SS:[EBP-4],ESI
18	00489752 |. 8975 F8 MOV DWORD PTR SS:[EBP-8],ESI
19	00489755 |. BE 01000000 MOV ESI,1
20	0048975A |. 3973 04 CMP DWORD PTR DS:[EBX+4],ESI
21	0048975D |. 75 41 JNZ SHORT client.004897A0
22	0048975F |. 56 PUSH ESI
23	00489760 |. 8D4D FC LEA ECX,DWORD PTR SS:[EBP-4]
24	00489763 |. 51 PUSH ECX
25	00489764 |. 8BCB MOV ECX,EBX
26	00489766 |. E8 256C7500 CALL client.00BE0390
27	0048976B |. 3975 FC CMP DWORD PTR SS:[EBP-4],ESI
28	0048976E |. 75 10 JNZ SHORT client.00489780
29	00489770 |. 8D87 90120000 LEA EAX,DWORD PTR DS:[EDI+1290]					;
	大偏移
30	00489776 |. 50 PUSH EAX
31	00489777 |. 8D4F 58 LEA ECX,DWORD PTR DS:[EDI+58]
32	0048977A |. 53 PUSH EBX
33	33 F6 6A 04 8B F9 89 75 F4 E8 ?? ?? ?? ?? 89 75 FC 89 75 F8 BE	01	00	00	00	39
	73 04 75 ?? 56 8D 4D FC 51 8B CB E8 ?? ?? ?? ?? 39 75 FC 75 ??	8D
34	+0x31

1	第一步
2	004ADE1D	|.	83C4 0C	ADD ESP,0C
3	004ADE20	|.	837E 04 01	CMP DWORD PTR DS:[ESI+4],1
4	004ADE24	|.	6A 01	PUSH 1
5	004ADE26	|.	75 1F	JNZ SHORT client.004ADE47
6	004ADE28	|.	8D4D 08	LEA ECX,DWORD PTR SS:[EBP+8]
7	004ADE2B	|.	51	PUSH ECX
8	004ADE2C	|.	8BCE	MOV ECX,ESI
9	004ADE2E	|.	E8 5D257300	CALL client.00BE0390
10	004ADE33	|.	837D 08 01	CMP DWORD PTR SS:[EBP+8],1
11	004ADE37	|.	74 33	JE SHORT client.004ADE6C
12	004ADE39	|.	8B97 98020000	MOV EDX,DWORD PTR DS:[EDI+298]

13	004ADE3F |.	8993 98020000	MOV DWORD PTR DS:[EBX+298],EDX
14	004ADE45 |.	EB 35	JMP SHORT client.004ADE7C
15	004ADE47 |>	8B83 98020000	MOV EAX,DWORD PTR DS:[EBX+298]
16	004ADE4D |.	33C9	XOR ECX,ECX
17	004ADE4F |.	3B87 98020000	CMP EAX,DWORD PTR DS:[EDI+298]
18	004ADE55 |.	8D55 0C	LEA EDX,DWORD PTR SS:[EBP+C]
19	004ADE58 |.	0F95C1	SETNZ CL
20	004ADE5B |.	52	PUSH EDX
21	004ADE5C |.	894D 0C	MOV DWORD PTR SS:[EBP+C],ECX
22	004ADE5F |.	8BCE	MOV ECX,ESI
23	004ADE61 |.	E8 2A257300	CALL client.00BE0390
24	004ADE66 |.	837D 0C 01	CMP DWORD PTR SS:[EBP+C],1
25	004ADE6A |.	75 10	JNZ SHORT client.004ADE7C
26	004ADE6C |>	6A 04	PUSH 4
27	004ADE6E |.	8D83 98020000	LEA EAX,DWORD PTR DS:[EBX+298]					;
	血量的偏移
28	004ADE74 |.	50	PUSH EAX
29	8B 83 ?? ?? ??	?? 33 C9 3B 87	?? ?? ?? ?? 8D 55 0C 0F 95 C1 52	89	4D	0C	8B	CE
	E8 ?? ?? ?? ??	83 7D 0C 01 75	?? 6A 04 8D 83 98 02 00 00 50
30	+0x29

1	第三步
2	0086AF70	/. 55	PUSH EBP
3	0086AF71	|. 8BEC	MOV EBP,ESP
4	0086AF73	|. 8B0D FC554801	MOV ECX,DWORD PTR DS:[14855FC]	;
	人物对象	的基地址
5	0086AF79	|. 83EC 08	SUB ESP,8
6	0086AF7C	|. 85C9	TEST ECX,ECX
7	0086AF7E	|. 0F84 77010000	JE client.0086B0FB
8	0086AF84	|. 8B01	MOV EAX,DWORD PTR DS:[ECX]
9	0086AF86	|. 8B90 C0010000	MOV EDX,DWORD PTR DS:[EAX+1C0]
10	0086AF8C	|. 56	PUSH ESI
11	0086AF8D	|. 8B75 08	MOV ESI,DWORD PTR SS:[EBP+8]
12	0086AF90	|. 56	PUSH ESI
13	0086AF91	|. FFD2	CALL EDX
14	0086AF93	|. A1 FC554801	MOV EAX,DWORD PTR DS:[14855FC]
15	0086AF98	|. 6A 04	PUSH 4
16	0086AF9A	|. 05 70170000	ADD EAX,1770
17	0086AF9F	|. 50	PUSH EAX
18	0086AFA0	|. 8BCE	MOV ECX,ESI

19	0086AFA2	|.	E8 894C3700 CALL client.00BDFC30
20	0086AFA7	|.	8B0D FC554801 MOV ECX,DWORD PTR DS:[14855FC]
21	0086AFAD	|.	81C1 74170000 ADD ECX,1774
22	0086AFB3	|.	6A 04 PUSH 4
23	0086AFB5	|.	51 PUSH ECX
24	0086AFB6	|.	8BCE MOV ECX,ESI
25	0086AFB8	|.	E8 734C3700 CALL client.00BDFC30
26	0086AFBD	|.	803D C43C4801>CMP BYTE PTR DS:[1483CC4],0
27	0086AFC4	|.	0F84 B0000000 JE client.0086B07A
28	0086AFCA	|.	A1 FC554801 MOV EAX,DWORD PTR DS:[14855FC]
29	0086AFCF	|.	D980 70170000 FLD DWORD PTR DS:[EAX+1770]
30	0086AFD5	|.	53 PUSH EBX
31	0086AFD6	|.	D95D FC FSTP DWORD PTR SS:[EBP-4]
32	0086AFD9	|.	57 PUSH EDI
33	0086AFDA	|.	D980 74170000 FLD DWORD PTR DS:[EAX+1774]
34	0086AFE0	|.	D95D F8 FSTP DWORD PTR SS:[EBP-8]
35	0086AFE3	|.	D980 70030000 FLD DWORD PTR DS:[EAX+370]
36	0086AFE9	|.	D865 FC FSUB DWORD PTR SS:[EBP-4]
37	0086AFEC	|.	D980 74030000 FLD DWORD PTR DS:[EAX+374]
38	0086AFF2	|.	D865 F8 FSUB DWORD PTR SS:[EBP-8]
39	0086AFF5	|.	DCC8 FMUL ST,ST
40	0086AFF7	|.	D9C1 FLD ST(1)
41	0086AFF9	|.	DECA FMULP ST(2),ST
42	0086AFFB	|.	DEC1 FADDP ST(1),ST
43	0086AFFD	|.	D95D F8 FSTP DWORD PTR SS:[EBP-8]
44
45	53 D9 5D	FC 57	D9 80 ?? ?? ?? ?? D9 5D F8 D9 80 ?? ?? ?? ?? D8	65	FC	D9	80	??
	?? ?? ??	D8 65	F8 DC C8 D9 C1 DE CA DE C1 D9 5D F8 E8 ?? ?? ??	??	8B	10	8B	C8
	8B 42 50
46	-0a

由于后期有事此游戏略过了.记录以便以后学习.

BY:笨鸟我先飞

f88u8

先学习了，高手，谢谢