1 游戏主窗口句柄

  1. #define Base_GameWndHandle 0x1196F88 //游戏主窗口句柄
  3. 8B086A1652508B4134——游戏主窗口句柄 = ndLocateAddr - 4
  5. 0044F770    68 1812AA00              push Client.00AA1218                       ; ASCII "m_pKeyboard->SetDataFormat( &c_dfDIKeyboard )"
  6. 0044F775    E8 76E40C00              call Client.0051DBF0
  7. 0044F77A    E9 5C010000              jmp Client.0044F8DB
  8. 0044F77F    A1 946F1901              mov eax,dword ptr ds:[0x1196F94]
  9. 0044F784    8B15 886F1901            mov edx,dword ptr ds:[0x1196F88]           ; 游戏主窗口句柄基址
  10. 0044F78A    8B08                     mov ecx,dword ptr ds:[eax]
  11. 0044F78C    6A 16                    push 0x16
  12. 0044F78E    52                       push edx
  13. 0044F78F    50                       push eax
  14. 0044F790    8B41 34                  mov eax,dword ptr ds:[ecx+0x34]
  15. 0044F793    FFD0                     call eax
  16. 0044F795    8BF0                     mov esi,eax
  17. 0044F797    33C0                     xor eax,eax
  18. 0044F799    3BF0                     cmp esi,eax

2 所有对象列表基址

  1. #define Base_AllObjList 0x02E65A28    //所有对象列表基址
  3. 83C404A308C0C0008B018B50045757——所有对象列表基址 = ndLocateAddr - 4
  5. 0040D802    6A 3C               push 0x3C
  6. 0040D804    E8 E7B74800         call Client.00898FF0
  7. 0040D809    8B40 0C             mov eax,dword ptr ds:[eax+0xC]
  8. 0040D80C    8B0C85 285AE602     mov ecx,dword ptr ds:[eax*4+0x2E65A28]   ; 所有对象列表基址
  9. 0040D813    83C4 04             add esp,0x4
  10. 0040D816    A3 08C0C000         mov dword ptr ds:[0xC0C008],eax
  11. 0040D81B    8B01                mov eax,dword ptr ds:[ecx]
  12. 0040D81D    8B50 04             mov edx,dword ptr ds:[eax+0x4]
  13. 0040D820    57                  push edi
  14. 0040D821    57                  push edi
  15. 0040D822    68 03040000         push 0x403
  16. 0040D827    FFD2                call edx
  17. 0040D829    89BB 00010000       mov dword ptr ds:[ebx+0x100],edi
  18. 0040D82F    897B 60             mov dword ptr ds:[ebx+0x60],edi
  19. 0040D832    B8 01000000         mov eax,0x1

3 人物属性基址

  1. #define Base_RoleProperty 0x02C186D8    //人物属性基址
  3. 558BEC83EC085356B8——人物属性基址 = ndLocateAddr + 9
  5. 0066AB70    55                       push ebp
  6. 0066AB71    8BEC                     mov ebp,esp
  7. 0066AB73    83EC 08                  sub esp,0x8
  8. 0066AB76    53                       push ebx
  9. 0066AB77    56                       push esi
  10. 0066AB78    B8 D886C102              mov eax,Client.02C186D8                    ; 人物属性基址
  11. 0066AB7D    57                       push edi
  12. 0066AB7E    C705 9C05BC00 FFFFFFFF   mov dword ptr ds:[0xBC059C],-0x1
  13. 0066AB88    33DB                     xor ebx,ebx
  14. 0066AB8A    8D50 01                  lea edx,dword ptr ds:[eax+0x1]
  15. 0066AB8D    8D49 00                  lea ecx,dword ptr ds:[ecx]
  16. 0066AB90    8A08                     mov cl,byte ptr ds:[eax]
  17. 0066AB92    40                       inc eax
  18. 0066AB93    84C9                     test cl,cl

4 装备列表基址

  1. #define Base_EquipList 0x02E3D3E0               //装备列表基址
  3. BF3C0400008D9B00000000833C070074**8B0C07——装备列表基址 = ndLocateAddr - 4
  5. 00417F3D  |.  8B8E 540B0000        mov ecx,dword ptr ds:[esi+0xB54]
  6. 00417F43  |.  8988 98010000        mov dword ptr ds:[eax+0x198],ecx
  7. 00417F49  |.  8B96 580B0000        mov edx,dword ptr ds:[esi+0xB58]
  8. 00417F4F  |.  8990 9C010000        mov dword ptr ds:[eax+0x19C],edx
  9. 00417F55  |.  0FB707               movzx eax,word ptr ds:[edi]
  10. 00417F58  |.  3B05 185AE602        cmp eax,dword ptr ds:[0x2E65A18]
  11. 00417F5E  |.  75 39                jnz XClient.00417F99
  12. 00417F60  |.  A1 E0D3E302          mov eax,dword ptr ds:[0x2E3D3E0]         ; 装备列表基址
  13. 00417F65  |.  BF 3C040000          mov edi,0x43C
  14. 00417F6A  |.  8D9B 00000000        lea ebx,dword ptr ds:[ebx]
  15. 00417F70  |>  833C07 00            /cmp dword ptr ds:[edi+eax],0x0
  16. 00417F74  |.  74 18                |je XClient.00417F8E
  17. 00417F76  |.  8B0C07               |mov ecx,dword ptr ds:[edi+eax]
  18. 00417F79  |.  83B9 A80D0000 02     |cmp dword ptr ds:[ecx+0xDA8],0x2
  19. 00417F80  |.  75 0C                |jnz XClient.00417F8E
  20. 00417F82  |.  56                   |push esi
  21. 00417F83  |.  51                   |push ecx

5 商店列表基址

  1. #define Base_ShopList 0x119B7B0                        //商店列表基址
  3. 6A0050E8********8B4F0883C40C51B9——商店列表基址 = ndLocateAddr + 16
  5. 004F769D  |> \3D FFFFFF0F       cmp eax,0xFFFFFFF
  6. 004F76A2  |.  75 60             jnz XClient.004F7704
  7. 004F76A4  |>  68 80000000       push 0x80
  8. 004F76A9  |.  8D85 70FFFFFF     lea eax,[local.36]
  9. 004F76AF  |.  6A 00             push 0x0
  10. 004F76B1  |.  50                push eax
  11. 004F76B2  |.  E8 B9984F00       call Client.009F0F70
  12. 004F76B7  |.  8B4F 08           mov ecx,dword ptr ds:[edi+0x8]
  13. 004F76BA  |.  83C4 0C           add esp,0xC
  14. 004F76BD  |.  51                push ecx
  15. 004F76BE  |.  B9 B0B71901       mov ecx,Client.0119B7B0
  16. 004F76C3  |.  E8 080C0000       call Client.004F82D0
  17. 004F76C8  |.  50                push eax
  18. 004F76C9  |.  68 F0BDAA00       push Client.00AABDF0                     ;  ASCII "keyhandler full! lstHandler count = %d, ClassID = %d"
  19. 004F76CE  |.  8D95 70FFFFFF     lea edx,[local.36]
  20. 004F76D4  |.  68 80000000       push 0x80
  21. 004F76D9  |.  52                push edx
  22. 004F76DA  |.  E8 D16D0600       call Client.0055E4B0
  23. 004F76DF  |.  8D85 70FFFFFF     lea eax,[local.36]
  24. 004F76E5  |.  50                push eax

6 仓库列表基址

  1. #define Base_DepotList 0x02E4692C               //仓库列表基址
  3. C78134160000080000008B152C69E402899A6C020000——仓库列表基址 = ndLocateAddr - 4
  5. 007EFA23  |.  68 802EBC00               push Client.00BC2E80
  6. 007EFA28  |.  885D FC                   mov byte ptr ss:[ebp-0x4],bl
  7. 007EFA2B  |.  E8 10F20300               call Client.0082EC40
  8. 007EFA30  |.  8B0D 2C69E402             mov ecx,dword ptr ds:[0x2E4692C]         ;  仓库列表基址
  9. 007EFA36  |.  C781 34160000 08000000    mov dword ptr ds:[ecx+0x1634],0x8
  10. 007EFA40  |.  8B15 2C69E402             mov edx,dword ptr ds:[0x2E4692C]
  11. 007EFA46  |.  899A 6C020000             mov dword ptr ds:[edx+0x26C],ebx
  12. 007EFA4C  |.  8B86 30020000             mov eax,dword ptr ds:[esi+0x230]
  13. 007EFA52  |.  8B0D 2C69E402             mov ecx,dword ptr ds:[0x2E4692C]
  14. 007EFA58  |.  8981 68020000             mov dword ptr ds:[ecx+0x268],eax
  15. 007EFA5E  |.  8B15 5C30BC00             mov edx,dword ptr ds:[0xBC305C]
  16. 007EFA64  |.  A1 842EBC00               mov eax,dword ptr ds:[0xBC2E84]
  17. 007EFA69  |.  8B0D 2C69E402             mov ecx,dword ptr ds:[0x2E4692C]
  18. 007EFA6F  |.  83C2 21                   add edx,0x21
  19. 007EFA72  |.  52                        push edx
  20. 007EFA73  |.  48                        dec eax
  21. 007EFA74  |.  50                        push eax

7 背包列表基址

  1. #define Base_BackPackList 0x02E3D3E4    //背包列表基址
  3. 8B848A3C0400008BB0E40C00008BB8E80C00008BC60BC7——背包基址 = ndLocateAddr - 4
  5. 00838E22   /75 32           jnz short Client.00838E56
  6. 00838E24   |A1 F0D3E302     mov eax,dword ptr ds:[0x2E3D3F0]
  7. 00838E29   |8B8488 3C040000 mov eax,dword ptr ds:[eax+ecx*4+0x43C]
  8. 00838E30   |8B48 58         mov ecx,dword ptr ds:[eax+0x58]
  9. 00838E33   |8B50 54         mov edx,dword ptr ds:[eax+0x54]
  10. 00838E36   |A1 5C452501     mov eax,dword ptr ds:[0x125455C]
  11. 00838E3B   |51              push ecx
  12. 00838E3C   |8B88 30020000   mov ecx,dword ptr ds:[eax+0x230]
  13. 00838E42   |52              push edx
  14. 00838E43   |E8 F8D8FDFF     call Client.00816740
  15. 00838E48   |85C0            test eax,eax
  16. 00838E4A   |0F85 925C0000   jnz Client.0083EAE2
  17. 00838E50   |8B8D 200FFFFF   mov ecx,dword ptr ss:[ebp+0xFFFF0F20]
  18. 00838E56   \83FB 01         cmp ebx,0x1
  19. 00838E59    0F85 FA000000   jnz Client.00838F59
  20. 00838E5F    8B15 E4D3E302   mov edx,dword ptr ds:[0x2E3D3E4]         ; 背包基址
  21. 00838E65    8B848A 3C040000 mov eax,dword ptr ds:[edx+ecx*4+0x43C]   ; 背包列表
  22. 00838E6C    8BB0 E40C0000   mov esi,dword ptr ds:[eax+0xCE4]
  23. 00838E72    8BB8 E80C0000   mov edi,dword ptr ds:[eax+0xCE8]
  24. 00838E78    8BC6            mov eax,esi
  25. 00838E7A    0BC7            or eax,edi
  26. 00838E7C    0F84 97010000   je Client.00839019
  27. 00838E82    837D 08 00      cmp dword ptr ss:[ebp+0x8],0x0
  28. 00838E86    0F85 36030000   jnz Client.008391C2

8 背包物品使用CALL

  1. #define Call_UseObjForIndex 0x00838EA0    //背包物品使用CALL
  3. 8B87601C00005651508BCFE8——物品使用CALL = ndLocateAddr+12 + ndLocateAddr+16      （即 偏移+EIP）
  5. 00854E7F    8B84B7 3C040000 mov eax,dword ptr ds:[edi+esi*4+0x43C]
  6. 00854E86    85C0            test eax,eax
  7. 00854E88    74 3F           je short Client.00854EC9
  8. 00854E8A    BA C6E1143C     mov edx,0x3C14E1C6
  9. 00854E8F    3950 54         cmp dword ptr ds:[eax+0x54],edx
  10. 00854E92    75 35           jnz short Client.00854EC9
  11. 00854E94    8378 58 00      cmp dword ptr ds:[eax+0x58],0x0
  12. 00854E98    75 2F           jnz short Client.00854EC9
  13. 00854E9A    56              push esi
  14. 00854E9B    51              push ecx
  15. 00854E9C    8995 38AFFFFF   mov dword ptr ss:[ebp+0xFFFFAF38],edx
  16. 00854EA2    8B15 6C452501   mov edx,dword ptr ds:[0x125456C]
  17. 00854EA8    8D8D 38AFFFFF   lea ecx,dword ptr ss:[ebp+0xFFFFAF38]
  18. 00854EAE    C785 3CAFFFFF 0>mov dword ptr ss:[ebp+0xFFFFAF3C],0x0
  19. 00854EB8    51              push ecx
  20. 00854EB9    8B8A 94020000   mov ecx,dword ptr ds:[edx+0x294]
  21. 00854EBF    E8 ECE9F4FF     call Client.007A38B0
  22. 00854EC4    E9 B5000000     jmp Client.00854F7E
  23. 00854EC9    8B87 601C0000   mov eax,dword ptr ds:[edi+0x1C60]
  24. 00854ECF    56              push esi                                 ; 下标
  25. 00854ED0    51              push ecx                                 ; 1
  26. 00854ED1    50              push eax                                 ; 0
  27. 00854ED2    8BCF            mov ecx,edi                              ; [背包列表基址]
  28. 00854ED4    E8 C73FFEFF     call Client.00838EA0                     ; 背包物品使用CALL
  29. 00854ED9    83BF 34160000 3>cmp dword ptr ds:[edi+0x1634],0x35
  30. 00854EE0    75 20           jnz short Client.00854F02
  31. 00854EE2    8B84B7 3C040000 mov eax,dword ptr ds:[edi+esi*4+0x43C]
  32. 00854EE9    85C0            test eax,eax
  33. 00854EEB    74 15           je short Client.00854F02
  34. 00854EED    8B48 54         mov ecx,dword ptr ds:[eax+0x54]
  35. 00854EF0    8B15 6C452501   mov edx,dword ptr ds:[0x125456C]
  36. 00854EF6    51              push ecx
  37. 00854EF7    8B8A 8C020000   mov ecx,dword ptr ds:[edx+0x28C]
  38. 00854EFD    E8 1EF3EBFF     call Client.00714220
  40. printf("找到特征码,所在虚拟地址为： %X\n", ndAddr);
  41. //读出偏移
  42. ndAddr += 12;
  43. DWORD ndBaseBuffer = 0;
  44. ReadProcessMemory(hProcess, (LPCVOID)ndAddr, (LPVOID)&ndBaseBuffer,  4, NULL);
  45. //读出EIP
  46. ndAddr += 4;
  47. printf("执行完CALL语句的EIP为：%X\n", ndAddr);
  48. //获取真正的基址
  49. ndAddr += ndBaseBuffer;
  50. printf("基址为：%X\n", ndAddr);

9 发送数据CALL

  1. #define Call_SendData 0x004F8740            //发送数据CALL
  3. 6689B5FED7FFFF66899500D8FFFF66898502D8FFFFE8——发送数据CALL = ndLocateAddr+22 + ndLocateAddr+26      （即 偏移+EIP）
  5. 00409828  |> \66:8B55 0C               mov dx,word ptr ss:[ebp+0xC]
  6. 0040982C  |.  56                       push esi
  7. 0040982D  |.  8B75 08                  mov esi,[arg.1]
  8. 00409830  |.  6A 12                    push 0x12
  9. 00409832  |.  8D8D F4D7FFFF            lea ecx,[local.2563]
  10. 00409838  |.  33C0                     xor eax,eax
  11. 0040983A  |.  51                       push ecx
  12. 0040983B  |.  8B0D 00701901            mov ecx,dword ptr ds:[0x1197000]
  13. 00409841  |.  66:89B5 FED7FFFF         mov word ptr ss:[ebp-0x2802],si
  14. 00409848  |.  66:8995 00D8FFFF         mov word ptr ss:[ebp-0x2800],dx
  15. 0040984F  |.  66:8985 02D8FFFF         mov word ptr ss:[ebp-0x27FE],ax
  16. 00409856  |.  E8 E5EE0E00              call Client.004F8740
  17. 0040985B  |.  56                       push esi
  18. 0040985C  |.  68 2CD0A900              push Client.00A9D02C                     ;  ASCII "SZONE REQ : %d"
  19. 00409861  |.  E8 6A451100              call Client.0051DDD0
  20. 00409866  |.  8B4D FC                  mov ecx,[local.1]
  21. 00409869  |.  83C4 08                  add esp,0x8
  22. 0040986C  |.  33CD                     xor ecx,ebp
  23. 0040986E  |.  5E                       pop esi
  1. #define Call_SendData_Ecx 0x1197000         //发送数据CALL的Ecx
  2. 6689B5FED7FFFF66899500D8FFFF66898502D8FFFFE8——发送数据CALL的Ecx = ndLocateAddr-4
  3. 同上

10 周围对象列表基址

  1. #define Base_NearObjList 0x04280BA0    //周围对象列表基址
  3. 8B118B420453536A02FFD003F7——周围对象列表基址 = ndLocateAddr - 4
  5. 008A1FC0    8B11                  mov edx,dword ptr ds:[ecx]
  6. 008A1FC2    8B42 04               mov eax,dword ptr ds:[edx+0x4]
  7. 008A1FC5    53                    push ebx
  8. 008A1FC6    53                    push ebx
  9. 008A1FC7    6A 02                 push 0x2
  10. 008A1FC9    FFD0                  call eax
  11. 008A1FCB    33F6                  xor esi,esi
  12. 008A1FCD    391D B044E702         cmp dword ptr ds:[0x2E744B0],ebx
  13. 008A1FD3    7E 27                 jle XClient.008A1FFC
  14. 008A1FD5    EB 09                 jmp XClient.008A1FE0
  15. 008A1FD7    8DA424 00000000       lea esp,dword ptr ss:[esp]
  16. 008A1FDE    8BFF                  mov edi,edi
  17. 008A1FE0    8B0CB5 A00B2804       mov ecx,dword ptr ds:[esi*4+0x4280BA0]   ; 周围对象列表基址
  18. 008A1FE7    8B11                  mov edx,dword ptr ds:[ecx]
  19. 008A1FE9    8B42 04               mov eax,dword ptr ds:[edx+0x4]
  20. 008A1FEC    53                    push ebx
  21. 008A1FED    53                    push ebx
  22. 008A1FEE    6A 02                 push 0x2
  23. 008A1FF0    FFD0                  call eax
  24. 008A1FF2    03F7                  add esi,edi
  25. 008A1FF4    3B35 B044E702         cmp esi,dword ptr ds:[0x2E744B0]
  26. 008A1FFA  ^ 7C E4                 jl XClient.008A1FE0
  27. 008A1FFC    A1 C0701501           mov eax,dword ptr ds:[0x11570C0]
  28. 008A2001    3BC3                  cmp eax,ebx
  29. 008A2003    74 12                 je XClient.008A2017
  30. 008A2005    8B0D 8C842401         mov ecx,dword ptr ds:[0x124848C]
  31. 008A200B    53                    push ebx
  32. 008A200C    50                    push eax
  33. 008A200D    68 40C71101           push Client.0111C740

11 玩家对象基址

  1. #define Base_PlayerObj 0x02E65A24    //玩家对象基址
  3. 85C074**83B8880100000074**8D8D30FCFFFF——玩家对象基址 = ndLocateAddr - 4
  5. 00402FD2    83C4 04                   add esp,0x4
  6. 00402FD5    3946 28                   cmp dword ptr ds:[esi+0x28],eax
  7. 00402FD8    74 5A                     je XClient.00403034
  8. 00402FDA    8BB5 00F8FFFF             mov esi,dword ptr ss:[ebp-0x800]
  9. 00402FE0    C786 F8290000 01000000    mov dword ptr ds:[esi+0x29F8],0x1
  10. 00402FEA    A1 245AE602               mov eax,dword ptr ds:[0x2E65A24]         ; 玩家对象基址
  11. 00402FEF    85C0                      test eax,eax
  12. 00402FF1    74 47                     je XClient.0040303A
  13. 00402FF3    83B8 88010000 00          cmp dword ptr ds:[eax+0x188],0x0
  14. 00402FFA    74 3E                     je XClient.0040303A
  15. 00402FFC    8D8D 30FCFFFF             lea ecx,dword ptr ss:[ebp-0x3D0]
  16. 00403002    51                        push ecx
  17. 00403003    68 1CCAA900               push Client.00A9CA1C                     ; ASCII "falseAni=%s"
  18. 00403008    8D95 B0FBFFFF             lea edx,dword ptr ss:[ebp-0x450]
  19. 0040300E    68 80000000               push 0x80
  20. 00403013    52                        push edx
  21. 00403014    E8 97B41500               call Client.0055E4B0
  22. 00403019    83C4 10                   add esp,0x10
  23. 0040301C    6A 00                     push 0x0

12 未知基址1

  1. #define Base_Unknown 0x0125456C                  //未知对象基址
  3. 6A09E8********5F5E5B8BE55DC2——未知对象基址 = ndLocateAddr - 4
  5. 0040938B    83FA 03         cmp edx,0x3
  6. 0040938E    75 12           jnz XClient.004093A2
  7. 00409390    68 680B0000     push 0xB68
  8. 00409395    8B0D 6C452501   mov ecx,dword ptr ds:[0x125456C]         ; 未知对象基址
  9. 0040939B    6A 09           push 0x9
  10. 0040939D    E8 FE902600     call Client.006724A0
  11. 004093A2    5F              pop edi
  12. 004093A3    5E              pop esi
  13. 004093A4    5B              pop ebx
  14. 004093A5    8BE5            mov esp,ebp
  15. 004093A7    5D              pop ebp
  16. 004093A8    C2 0400         retn 0x4

13 未知对象基址2

  1. #define Base_Unknown2 0x02C1EA6C                //未知对象基址2
  3. 8B15********3BC274**8B083BCB——未知对象基址 = ndLocateAddr - 4
  5. 0048EE39  |> \83C7 15            add edi,0x15
  6. 0048EE3C  |>  89BE F0020000      mov dword ptr ds:[esi+0x2F0],edi
  7. 0048EE42  |.  E9 F0000000        jmp Client.0048EF37
  8. 0048EE47  |>  A1 6CEAC102        mov eax,dword ptr ds:[0x2C1EA6C]         ;  未知对象基址2
  9. 0048EE4C  |.  8B15 70EAC102      mov edx,dword ptr ds:[0x2C1EA70]
  10. 0048EE52  |.  3BC2               cmp eax,edx
  11. 0048EE54  |.  74 18              je XClient.0048EE6E
  12. 0048EE56  |>  8B08               /mov ecx,dword ptr ds:[eax]
  13. 0048EE58  |.  3BCB               |cmp ecx,ebx
  14. 0048EE5A  |.  74 09              |je XClient.0048EE65
  15. 0048EE5C  |.  3B8CBE F0020000    |cmp ecx,dword ptr ds:[esi+edi*4+0x2F0]
  16. 0048EE63  |.  74 1F              |je XClient.0048EE84
  17. 0048EE65  |>  05 D4000000        |add eax,0xD4
  18. 0048EE6A  |.  3BC2               |cmp eax,edx

14 动作列表基址

  1. #define Base_ActionList 0x02E3DD58    //动作列表基址
  3. 833C0600743C8B04068B50548B7858——动作列表基址 = ndLocateAddr - 4
  5. 00702541    56                        push esi
  6. 00702542    57                        push edi
  7. 00702543    BE 3C040000               mov esi,0x43C
  8. 00702548    EB 06                     jmp XClient.00702550
  9. 0070254A    8D9B 00000000             lea ebx,dword ptr ds:[ebx]
  10. 00702550    A1 58DDE302               mov eax,dword ptr ds:[0x2E3DD58]         ; 动作列表基址
  11. 00702555    833C06 00                 cmp dword ptr ds:[esi+eax],0x0
  12. 00702559    74 3C                     je XClient.00702597
  13. 0070255B    8B0406                    mov eax,dword ptr ds:[esi+eax]
  14. 0070255E    8B50 54                   mov edx,dword ptr ds:[eax+0x54]
  15. 00702561    8B78 58                   mov edi,dword ptr ds:[eax+0x58]
  16. 00702564    81FA 06127A00             cmp edx,Client.007A1206
  17. 0070256A    75 04                     jnz XClient.00702570
  18. 0070256C    85FF                      test edi,edi

15 动作使用CALL

  2. #define Call_ActionUse 0x00714220    //动作使用CALL
  4. 83BF341600003675**8B84B73C04000085C0——物品使用CALL = ndLocateAddr - 4 + ndLocateAddr     （偏移+EIP）
  6. 00854EED    8B48 54                   mov ecx,dword ptr ds:[eax+0x54]
  7. 00854EF0    8B15 6C452501             mov edx,dword ptr ds:[0x125456C]
  8. 00854EF6    51                        push ecx
  9. 00854EF7    8B8A 8C020000             mov ecx,dword ptr ds:[edx+0x28C]
  10. 00854EFD    E8 1EF3EBFF               call Client.00714220                     ; 动作使用CALL
  11. 00854F02    83BF 34160000 36          cmp dword ptr ds:[edi+0x1634],0x36
  12. 00854F09    75 20                     jnz XClient.00854F2B
  13. 00854F0B    8B84B7 3C040000           mov eax,dword ptr ds:[edi+esi*4+0x43C]
  14. 00854F12    85C0                      test eax,eax
  15. 00854F14    74 15                     je XClient.00854F2B
  16. 00854F16    8B40 54                   mov eax,dword ptr ds:[eax+0x54]
  17. 00854F19    8B0D 6C452501             mov ecx,dword ptr ds:[0x125456C]
  18. 00854F1F    8B89 8C020000             mov ecx,dword ptr ds:[ecx+0x28C]
  19. 00854F25    50                        push eax
  20. 00854F26    E8 05F9EBFF               call Client.00714830
  21. 00854F2B    83BF 34160000 46          cmp dword ptr ds:[edi+0x1634],0x46
  23. printf("找到特征码,所在虚拟地址为： %X\n", ndAddr);
  24. //读出偏移
  25. ndAddr += 12;
  26. DWORD ndBaseBuffer = 0;
  27. ReadProcessMemory(hProcess, (LPCVOID)ndAddr, (LPVOID)&ndBaseBuffer,  4, NULL);
  28. //读出EIP
  29. ndAddr += 4;
  30. printf("执行完CALL语句的EIP为：%X\n", ndAddr);
  31. //获取真正的基址
  32. ndAddr += ndBaseBuffer;
  33. printf("基址为：%X\n", ndAddr);

16 技能列表基址

  1. #define Base_SkillList 0x02E3EF64 //技能列表基址
  3. 33C0A3********8B96C00B000083C2288950388B86C00B00008B0D——技能列表基址 = ndLocateAddr + 3
  5. 004A5B46    56                    push esi
  6. 004A5B47    6A 19                 push 0x19
  7. 004A5B49    6A 02                 push 0x2
  8. 004A5B4B    8BC8                  mov ecx,eax
  9. 004A5B4D    E8 4EF13800           call Client.00834CA0
  10. 004A5B52    EB 02                 jmp XClient.004A5B56
  11. 004A5B54    33C0                  xor eax,eax
  12. 004A5B56    A3 64EFE302           mov dword ptr ds:[0x2E3EF64],eax         ; 技能列表基址
  13. 004A5B5B    8B96 C00B0000         mov edx,dword ptr ds:[esi+0xBC0]
  14. 004A5B61    83C2 28               add edx,0x28
  15. 004A5B64    8950 38               mov dword ptr ds:[eax+0x38],edx
  16. 004A5B67    8B86 C00B0000         mov eax,dword ptr ds:[esi+0xBC0]
  17. 004A5B6D    8B0D 64EFE302         mov ecx,dword ptr ds:[0x2E3EF64]
  18. 004A5B73    83C0 2C               add eax,0x2C
  19. 004A5B76    8941 3C               mov dword ptr ds:[ecx+0x3C],eax
  20. 004A5B79    8B15 64EFE302         mov edx,dword ptr ds:[0x2E3EF64]
  21. 004A5B7F    6A 19                 push 0x19
  22. 004A5B81    89BA 34160000         mov dword ptr ds:[edx+0x1634],edi
  23. 004A5B87    8B0D 64EFE302         mov ecx,dword ptr ds:[0x2E3EF64]

17 修炼技能CALL

  1. #define Call_LearnSkill 0x00555B80    //修炼技能CALL
  3. 8B94B78C0300008B0D********8B425451508D8DF4D7FFFF518B0D——修炼技能CALL = ndLocateAddr+32 + ndLocateAddr+36      （即 偏移+EIP）
  5. 00751B5C    8B94B7 8C030000       mov edx,dword ptr ds:[edi+esi*4+0x38C]
  6. 00751B63    8B0D 8487C102         mov ecx,dword ptr ds:[0x2C18784]
  7. 00751B69    8B42 54               mov eax,dword ptr ds:[edx+0x54]
  8. 00751B6C    51                    push ecx
  9. 00751B6D    50                    push eax
  10. 00751B6E    8D8D F4D7FFFF         lea ecx,dword ptr ss:[ebp-0x280C]
  11. 00751B74    51                    push ecx
  12. 00751B75    8B0D 245AE602         mov ecx,dword ptr ds:[0x2E65A24]
  13. 00751B7B    E8 0040E0FF           call Client.00555B80                     ; 修炼技能CALL
  14. 00751B80    E9 53020000           jmp Client.00751DD8
  15. 00751B85    83FE 48               cmp esi,0x48
  16. 00751B88    0F8C E3000000         jl Client.00751C71
  17. 00751B8E    83FE 68               cmp esi,0x68
  19. printf("找到特征码,所在虚拟地址为： %X\n", ndAddr);
  20. //读出偏移
  21. ndAddr += 32;
  22. DWORD ndBaseBuffer = 0;
  23. ReadProcessMemory(hProcess, (LPCVOID)ndAddr, (LPVOID)&ndBaseBuffer,  4, NULL);
  24. //读出EIP
  25. ndAddr += 4;
  26. printf("执行完CALL语句的EIP为：%X\n", ndAddr);
  27. //获取真正的基址
  28. ndAddr += ndBaseBuffer;
  29. printf("基址为：%X\n", ndAddr);

18 修炼技能CALL的ECX

  1. #define Call_LearnSkill_Ecx 0x2C18784       //修炼技能CALL的ECX
  3. 5068********8D4DBC6A4051E8********8B8E2C0F0000——修炼技能CALL的ECX = ndLocateAddr - 4
  5. 004A4E76    8B8E 280F0000               mov ecx,dword ptr ds:[esi+0xF28]
  6. 004A4E7C    83C4 1C                     add esp,0x1C
  7. 004A4E7F    6A 00                       push 0x0
  8. 004A4E81    8D55 BC                     lea edx,dword ptr ss:[ebp-0x44]
  9. 004A4E84    52                          push edx
  10. 004A4E85    E8 86AD3B00                 call Client.0085FC10
  11. 004A4E8A    A1 8487C102                 mov eax,dword ptr ds:[0x2C18784]         ; 修炼技能CALL的ECX
  12. 004A4E8F    50                          push eax
  13. 004A4E90    68 F019AA00                 push Client.00AA19F0                     ; ASCII "%d"
  14. 004A4E95    8D4D BC                     lea ecx,dword ptr ss:[ebp-0x44]
  15. 004A4E98    6A 40                       push 0x40
  16. 004A4E9A    51                          push ecx
  17. 004A4E9B    E8 10960B00                 call Client.0055E4B0
  18. 004A4EA0    8B8E 2C0F0000               mov ecx,dword ptr ds:[esi+0xF2C]

19 鼠标拖起的对象基址

  1. #define Base_MouseSelObj 0x0125455C    //鼠标拖起的对象基址            鼠标拖起的对象：[0x0125455C]+230
  3. 85D274**833C070074**8B0C078B59588B49548B400C——鼠标拖起的对象基址 = ndLocateAddr - 4
  5. 004A6D9F    49                          dec ecx
  6. 004A6DA0    83C9 FC                     or ecx,0xFFFFFFFC
  7. 004A6DA3    41                          inc ecx
  8. 004A6DA4    0F84 71010000               je Client.004A6F1B
  9. 004A6DAA    8B15 5C452501               mov edx,dword ptr ds:[0x125455C]         ; 鼠标拖起的对象基址
  10. 004A6DB0    85D2                        test edx,edx
  11. 004A6DB2    74 21                       je XClient.004A6DD5
  12. 004A6DB4    833C07 00                   cmp dword ptr ds:[edi+eax],0x0
  13. 004A6DB8    74 1B                       je XClient.004A6DD5
  14. 004A6DBA    8B0C07                      mov ecx,dword ptr ds:[edi+eax]
  15. 004A6DBD    8B59 58                     mov ebx,dword ptr ds:[ecx+0x58]
  16. 004A6DC0    8B49 54                     mov ecx,dword ptr ds:[ecx+0x54]
  17. 004A6DC3    8B40 0C                     mov eax,dword ptr ds:[eax+0xC]
  18. 004A6DC6    53                          push ebx
  19. 004A6DC7    51                          push ecx
  20. 004A6DC8    50                          push eax
  21. 004A6DC9    8BCA                        mov ecx,edx
  22. 004A6DCB    E8 90FEF7FF                 call Client.00426C60

20 快捷栏基址

  1. #define Base_ShortcutBar 0x02E3EF08    //快捷栏基址
  3. 33C08D8E3C040000EB**8D490083390074——快捷栏基址 = ndLocateAddr - 4
  5. 00413EDD    6A 01                       push 0x1
  6. 00413EDF    8D55 F8                     lea edx,dword ptr ss:[ebp-0x8]
  7. 00413EE2    C745 F8 88130000            mov dword ptr ss:[ebp-0x8],0x1388
  8. 00413EE9    C745 FC 00000000            mov dword ptr ss:[ebp-0x4],0x0
  9. 00413EF0    8B8C8E 3C040000             mov ecx,dword ptr ds:[esi+ecx*4+0x43C]
  10. 00413EF7    52                          push edx
  11. 00413EF8    E8 C35E4000                 call Client.00819DC0
  12. 00413EFD    8B35 08EFE302               mov esi,dword ptr ds:[0x2E3EF08]         ; 快捷栏基址
  13. 00413F03    33C0                        xor eax,eax
  14. 00413F05    8D8E 3C040000               lea ecx,dword ptr ds:[esi+0x43C]
  15. 00413F0B    EB 03                       jmp XClient.00413F10
  16. 00413F0D    8D49 00                     lea ecx,dword ptr ds:[ecx]
  17. 00413F10    8339 00                     cmp dword ptr ds:[ecx],0x0
  18. 00413F13    74 0D                       je XClient.00413F22
  19. 00413F15    8B11                        mov edx,dword ptr ds:[ecx]
  20. 00413F17    397A 54                     cmp dword ptr ds:[edx+0x54],edi

21 移动对象到列表CALL

  1. #define Call_MoveObjToList 0x84A180         //移动对象到列表CALL
  3. 8B86900200008B0D********8B9134160000508B81601C00005250E8——移动对象到列表CALL = ndLocateAddr+28 + ndLocateAddr+32    （偏移+EIP）
  5. 006F59A5    8B86 90020000               mov eax,dword ptr ds:[esi+0x290]
  6. 006F59AB    8B0D E4D3E302               mov ecx,dword ptr ds:[0x2E3D3E4]
  7. 006F59B1    8B91 34160000               mov edx,dword ptr ds:[ecx+0x1634]
  8. 006F59B7    50                          push eax
  9. 006F59B8    8B81 601C0000               mov eax,dword ptr ds:[ecx+0x1C60]
  10. 006F59BE    52                          push edx
  11. 006F59BF    50                          push eax
  12. 006F59C0    E8 BB471500                 call Client.0084A180         ; 移动对象到列表CALL
  13. 006F59C5    5F                          pop edi
  14. 006F59C6    C786 90020000 FFFFFFFF      mov dword ptr ds:[esi+0x290],-0x1
  15. 006F59D0    5E                          pop esi
  16. 006F59D1    B8 01000000                 mov eax,0x1
  17. 006F59D6    5B                          pop ebx
  18. 006F59D7    5D                          pop ebp
  20. printf("找到特征码,所在虚拟地址为： %X\n", ndAddr);
  21. //读出偏移
  22. ndAddr += 28;
  23. DWORD ndBaseBuffer = 0;
  24. ReadProcessMemory(hProcess, (LPCVOID)ndAddr, (LPVOID)&ndBaseBuffer,  4, NULL);
  25. //读出EIP
  26. ndAddr += 4;
  27. printf("执行完CALL语句的EIP为：%X\n", ndAddr);
  28. //获取真正的基址
  29. ndAddr += ndBaseBuffer;
  30. printf("基址为：%X\n", ndAddr);

22 快捷栏使用CALL

  1. 83BC8A3C040000000F84********A16C452501518B888C020000E8——快捷栏使用CALL = ndLocateAddr+27 + ndLocateAddr+31    （偏移+EIP）
  3. 008391F4    8B95 180FFFFF               mov edx,dword ptr ss:[ebp+0xFFFF0F18]
  4. 008391FA    83BC8A 3C040000 00          cmp dword ptr ds:[edx+ecx*4+0x43C],0x0
  5. 00839202    0F84 DA590000               je Client.0083EBE2
  6. 00839208    A1 6C452501                 mov eax,dword ptr ds:[0x125456C]
  7. 0083920D    51                          push ecx
  8. 0083920E    8B88 8C020000               mov ecx,dword ptr ds:[eax+0x28C]
  9. 00839214    E8 07A2EEFF                 call Client.00723420                     ; 快捷栏使用CALL
  10. 00839219    E9 C4590000                 jmp Client.0083EBE2
  11. 0083921E    83FB 01                     cmp ebx,0x1
  12. 00839221    0F85 AF000000               jnz Client.008392D6
  13. 00839227    8B0D 6C452501               mov ecx,dword ptr ds:[0x125456C]
  14. 0083922D    8B89 2C030000               mov ecx,dword ptr ds:[ecx+0x32C]
  16. printf("找到特征码,所在虚拟地址为： %X\n", ndAddr);
  17. //读出偏移
  18. ndAddr += 27;
  19. DWORD ndBaseBuffer = 0;
  20. ReadProcessMemory(hProcess, (LPCVOID)ndAddr, (LPVOID)&ndBaseBuffer,  4, NULL);
  21. //读出EIP
  22. ndAddr += 4;
  23. printf("执行完CALL语句的EIP为：%X\n", ndAddr);
  24. //获取真正的基址
  25. ndAddr += ndBaseBuffer;
  26. printf("基址为：%X\n", ndAddr);

23 寻路CALL

  1. #define Call_RunToXY 0x0051FFE0             //寻路CALL
  3. 8B8E641C000083EC0C8BC489108B96681C00008948048BCE895008E8——寻路CALL = ndLocateAddr+28 + ndLocateAddr+32    （偏移+EIP）
  5. 0052228B    33C2            xor eax,edx
  6. 0052228D    2BC2            sub eax,edx
  7. 0052228F    3D DC050000     cmp eax,0x5DC
  8. 00522294    7E 3B           jle XClient.005222D1
  9. 00522296    6A 03           push 0x3
  10. 00522298    8B96 601C0000   mov edx,dword ptr ds:[esi+0x1C60]        ; esi=[02E65A24]
  11. 0052229E    8B8E 641C0000   mov ecx,dword ptr ds:[esi+0x1C64]
  12. 005222A4    83EC 0C         sub esp,0xC
  13. 005222A7    8BC4            mov eax,esp
  14. 005222A9    8910            mov dword ptr ds:[eax],edx
  15. 005222AB    8B96 681C0000   mov edx,dword ptr ds:[esi+0x1C68]
  16. 005222B1    8948 04         mov dword ptr ds:[eax+0x4],ecx
  17. 005222B4    8BCE            mov ecx,esi
  18. 005222B6    8950 08         mov dword ptr ds:[eax+0x8],edx
  19. 005222B9    E8 22DDFFFF     call Client.0051FFE0                     ; 寻路CALL
  20. 005222BE    FFD7            call edi
  22. printf("找到特征码,所在虚拟地址为： %X\n", ndAddr);
  23. //读出偏移
  24. ndAddr += 28;
  25. DWORD ndBaseBuffer = 0;
  26. ReadProcessMemory(hProcess, (LPCVOID)ndAddr, (LPVOID)&ndBaseBuffer,  4, NULL);
  27. //读出EIP
  28. ndAddr += 4;
  29. printf("执行完CALL语句的EIP为：%X\n", ndAddr);
  30. //获取真正的基址
  31. ndAddr += ndBaseBuffer;
  32. printf("基址为：%X\n", ndAddr);

24 与NPC对话CALL

  1. #define Call_ChatWithNPC 0x50D3F0                  //与NPC对话CALL
  3. 33C05DC20C008B5510528B550C5250E8——与NPC对话CALL = ndLocateAddr+16 + ndLocateAddr+20    （偏移+EIP）
  5. 00512BD6  |.  33C0                     xor eax,eax
  6. 00512BD8  |.  5D                       pop ebp
  7. 00512BD9  |.  C2 0C00                  retn 0xC
  8. 00512BDC  |>  8B55 10                  mov edx,[arg.3]
  9. 00512BDF  |.  52                       push edx
  10. 00512BE0  |.  8B55 0C                  mov edx,[arg.2]
  11. 00512BE3  |.  52                       push edx
  12. 00512BE4  |.  50                       push eax
  13. 00512BE5  |.  E8 06A8FFFF              call Client.0050D3F0
  14. 00512BEA  |.  5D                       pop ebp
  15. 00512BEB  \.  C2 0C00                  retn 0xC

25 点击对话菜单选项CALL

  1. #define Call_ClickChatMenuOption 0x007D5B30 //点击对话菜单选项CALL
  3. 8B9C9EA801000081FB3C0100000F8D********538BCEE8——点击对话菜单选项CALL = ndLocateAddr+23 + ndLocateAddr+27    （偏移+EIP）
  5. 007DC438   .^\0F84 16FFFFFF            je Client.007DC354
  6. 007DC43E   .  8B9C9E A8010000          mov ebx,dword ptr ds:[esi+ebx*4+0x1A8]
  7. 007DC445   .  81FB 3C010000            cmp ebx,0x13C
  8. 007DC44B   .^ 0F8D 03FFFFFF            jge Client.007DC354
  9. 007DC451   .  53                       push ebx                                 ;  打开仓库=5
  10. 007DC452   .  8BCE                     mov ecx,esi                              ;  0FA98BA8
  11. 007DC454   .  E8 D796FFFF              call Client.007D5B30                     ;  打开仓库3 点击对话菜单选项CALL
  12. 007DC459   .^ E9 F6FEFFFF              jmp Client.007DC354
  13. 007DC45E   >  2D 30040000              sub eax,0x430
  14. 007DC463   .  0F84 13030000            je Client.007DC77C
  15. 007DC469   .  83E8 1A                  sub eax,0x1A
  16. 007DC46C   .^ 0F85 E2FEFFFF            jnz Client.007DC354
  17. 007DC472   .  8D55 E0                  lea edx,dword ptr ss:[ebp-0x20]          ;  Case 44A of switch 007DBDC8
  18. 007DC475   .  52                       push edx
  19. 007DC476   .  68 1865AA00              push Client.00AA6518                     ;  ASCII "..\datas\interface\DATA\window_npc\window_exchangebox.bmp"

26 玩家可视范围基址

  1. #define Base_ViewRange 0x00AA1DBC    //玩家可视范围基址
  3. 6A016A006A006A006A0068********525056E8********D905——玩家可视范围基址 = ndLocateAddr+25
  5. 0046FF16  |.  6A 01              push 0x1
  6. 0046FF18  |.  6A 00              push 0x0
  7. 0046FF1A  |.  6A 00              push 0x0
  8. 0046FF1C  |.  6A 00              push 0x0
  9. 0046FF1E  |.  6A 00              push 0x0
  10. 0046FF20  |.  68 1C2FAA00        push Client.00AA2F1C                     ;  ASCII "..\datas\interface\DATA\window_npc\system_m02.bmp"
  11. 0046FF25  |.  52                 push edx
  12. 0046FF26  |.  50                 push eax
  13. 0046FF27  |.  56                 push esi
  14. 0046FF28  |.  E8 3392FEFF        call Client.00459160
  15. 0046FF2D  |.  D905 BC1DAA00      fld dword ptr ds:[0xAA1DBC]              ;  玩家可视范围
  16. 0046FF33  |.  6A 01              push 0x1
  17. 0046FF35  |.  D95D DC            fstp dword ptr ss:[ebp-0x24]
  18. 0046FF38  |.  D905 24D3A900      fld dword ptr ds:[0xA9D324]
  19. 0046FF3E  |.  8B55 DC            mov edx,dword ptr ss:[ebp-0x24]