首页
社区
课程
招聘
[原创]调试外挂经验记录[更新]
发表于: 2013-4-10 15:23 9260

[原创]调试外挂经验记录[更新]

2013-4-10 15:23
9260
0041A4C0  /$  55            push ebp
0041A4C1  |.  8BEC          mov ebp,esp
0041A4C3  |.  83EC 18       sub esp,0x18
0041A4C6  |.  53            push ebx
0041A4C7  |.  56            push esi
0041A4C8  |.  57            push edi
0041A4C9  |.  894D E8       mov [local.6],ecx
0041A4CC  |.  8B45 08       mov eax,[arg.1]
0041A4CF  |.  8B48 0C       mov ecx,dword ptr ds:[eax+0xC]
0041A4D2  |.  51            push ecx
0041A4D3  |.  8B55 08       mov edx,[arg.1]
0041A4D6  |.  8B42 08       mov eax,dword ptr ds:[edx+0x8]
0041A4D9  |.  50            push eax
0041A4DA  |.  8B4D 08       mov ecx,[arg.1]
0041A4DD  |.  8B51 04       mov edx,dword ptr ds:[ecx+0x4]
0041A4E0  |.  52            push edx
0041A4E1  |.  8B45 08       mov eax,[arg.1]
0041A4E4  |.  8B08          mov ecx,dword ptr ds:[eax]
0041A4E6  |.  51            push ecx
0041A4E7  |.  8B4D E8       mov ecx,[local.6]
0041A4EA  |.  E8 419CFFFF   call 易语言试.00414130
0041A4EF  |.  8945 FC       mov [local.1],eax
0041A4F2  |.  837D FC 00    cmp [local.1],0x0
0041A4F6  |.  75 04         jnz short 易语言试.0041A4FC
0041A4F8  |.  33C0          xor eax,eax
0041A4FA  |.  EB 67         jmp short 易语言试.0041A563
0041A4FC  |>  56            push esi
0041A4FD  |.  57            push edi
0041A4FE  |.  8B55 08       mov edx,[arg.1]
0041A501  |.  8B42 0C       mov eax,dword ptr ds:[edx+0xC]
0041A504  |.  83E8 01       sub eax,0x1
0041A507  |.  8945 EC       mov [local.5],eax
0041A50A  |.  EB 09         jmp short 易语言试.0041A515
0041A50C  |>  8B4D EC       /mov ecx,[local.5]
0041A50F  |.  83E9 01       |sub ecx,0x1
0041A512  |.  894D EC       |mov [local.5],ecx
0041A515  |>  837D EC 00     cmp [local.5],0x0
0041A519  |.  7C 12         |jl short 易语言试.0041A52D
0041A51B  |.  8B55 EC       |mov edx,[local.5]
0041A51E  |.  8B45 08       |mov eax,[arg.1]
0041A521  |.  8B4C90 10     |mov ecx,dword ptr ds:[eax+edx*4+0x10]
0041A525  |.  894D F0       |mov [local.4],ecx
0041A528  |.  FF75 F0       |push [local.4]
0041A52B  |.^ EB DF         \jmp short 易语言试.0041A50C
0041A52D  |>  FF55 FC       call [local.1]
0041A530  |.  5F            pop edi
0041A531  |.  5E            pop esi
0041A532  |.  895D F4       mov [local.3],ebx
0041A535  |.  8945 F8       mov [local.2],eax
0041A538  |.  8B55 E8       mov edx,[local.6]
0041A53B  |.  C782 F0010000>mov dword ptr ds:[edx+0x1F0],0x0
0041A545  |.  837D F4 00    cmp [local.3],0x0
0041A549  |.  74 13         je short 易语言试.0041A55E
0041A54B  |.  8B45 08       mov eax,[arg.1]
0041A54E  |.  C740 24 01000>mov dword ptr ds:[eax+0x24],0x1
0041A555  |.  8B4D 08       mov ecx,[arg.1]
0041A558  |.  8B55 F8       mov edx,[local.2]
0041A55B  |.  8951 28       mov dword ptr ds:[ecx+0x28],edx
0041A55E  |>  B8 01000000   mov eax,0x1
0041A563  |>  5F            pop edi
0041A564  |.  5E            pop esi
0041A565  |.  5B            pop ebx
0041A566  |.  8BE5          mov esp,ebp
0041A568  |.  5D            pop ebp
0041A569  \.  C2 0400       retn 0x4
0041A50C  |> /8B4D EC       /mov ecx,[local.5]
0041A50F  |. |83E9 01       |sub ecx,0x1
0041A512  |. |894D EC       |mov [local.5],ecx
0041A515  |> |837D EC 00     cmp [local.5],0x0
0041A519  |. |7C 12         |jl short 易语言试.0041A52D
0041A51B  |. |8B55 EC       |mov edx,[local.5]
0041A51E  |. |8B45 08       |mov eax,[arg.1]
0041A521  |. |8B4C90 10     |mov ecx,dword ptr ds:[eax+edx*4+0x10]
0041A525  |. |894D F0       |mov [local.4],ecx
0041A528  |. |FF75 F0       |push [local.4]
0041A52B  |.^\EB DF         \jmp short 易语言试.0041A50C
0041A52D  |>  FF55 FC       call [local.1]
8B4DEC83E901894DEC837DEC007C128B55EC8B45088B4C9010894DF0FF75F0EBDFFF55FC

[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

上传的附件:
收藏
免费 6
支持
分享
最新回复 (7)
雪    币: 458
活跃值: (306)
能力值: ( LV12,RANK:400 )
在线值:
发帖
回帖
粉丝
2
感谢 楼主 分享思路。。期待后续。
2013-4-10 15:43
0
雪    币: 64
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
嘿嘿,期待把E的菊花全部暴露出来~~
2013-4-10 16:49
0
雪    币: 709
活跃值: (2420)
能力值: ( LV12,RANK:1010 )
在线值:
发帖
回帖
粉丝
4
外挂都加VMP了,呵呵。

一些外挂是输入法注入DLL到游戏进程,DLL加了VMP,不好调试写的数据
一些外挂是调用封装好的驱动,和驱动通信读写游戏进程。这类驱动功能单一,就是读写进程内存,容易调试。

易语言写的挂调试起来有点费劲。。
2013-4-10 18:58
0
雪    币: 74
活跃值: (748)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
感谢分享
2013-4-13 15:01
0
雪    币: 4361
活跃值: (4343)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
6
有VMP的大部分没什么戏.
2013-4-14 10:09
0
雪    币: 46
活跃值: (12)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
7
VMP怎么办
2013-4-14 10:19
0
雪    币: 44
活跃值: (25)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
8
坐等后续。。
2013-4-16 13:05
0
游客
登录 | 注册 方可回帖
返回
//