-
-
[原创]植物大战僵尸叠加种植植物
-
发表于: 2018-1-13 22:08
-
谢谢各位的支持，祝论坛越办越好！！！
ggsuper
2018.1.13
可能存在判断土地是否可种植的语句，判断若土地可种植，则种植植物成功，阳光减少。找出并修改该语句，实现叠加种植效果。一、实验目的
在一块土地上种植多棵植物，效果图如下：
二、思路
在一块土地上种植多棵植物，效果图如下：
CE找到阳光地址，OD中在该地址处下硬件写入断点，随便种植一棵植物，OD中断如下：
观察发现该call可以直接NOP掉，不影响堆栈平衡。取消硬件断点，NOP掉该call,回到游戏,种植一棵植物，发现阳光值不再减少。则此call应该是阳光减少call。0041E82F CC int3
0041E830 56 push esi
0041E831 8BB7 78550000 mov esi, dword ptr [edi+5578]
0041E837 8BD7 mov edx, edi
0041E839 E8 12FFFFFF call 0041E750
0041E83E 03C6 add eax, esi
0041E840 3BD8 cmp ebx, eax
0041E842 7F 0C jg short 0041E850
0041E844 2BF3 sub esi, ebx
0041E846 89B7 78550000 mov dword ptr [edi+5578], esi ; 阳光减少后赋值语句
0041E84C B0 01 mov al, 1
0041E84E 5E pop esi
0041E84F C3 retnOD中按Alt + K查看调用堆栈，如下：
先转到00413232处的call语句,如下：0041322B E8 B0D60000 call 004208E000413230 8BD8 mov ebx, eax00413232 E8 F9B50000 call 0041E830 ; 阳光减少call00413237 84C0 test al, al00413239 0F84 C1060000 je 00413900
0041E82F CC int3
0041E830 56 push esi
0041E831 8BB7 78550000 mov esi, dword ptr [edi+5578]
0041E837 8BD7 mov edx, edi
0041E839 E8 12FFFFFF call 0041E750
0041E83E 03C6 add eax, esi
0041E840 3BD8 cmp ebx, eax
0041E842 7F 0C jg short 0041E850
0041E844 2BF3 sub esi, ebx
0041E846 89B7 78550000 mov dword ptr [edi+5578], esi ; 阳光减少后赋值语句
0041E84C B0 01 mov al, 1
0041E84E 5E pop esi
0041E84F C3 retn
0041E830 56 push esi
0041E831 8BB7 78550000 mov esi, dword ptr [edi+5578]
0041E837 8BD7 mov edx, edi
0041E839 E8 12FFFFFF call 0041E750
0041E83E 03C6 add eax, esi
0041E840 3BD8 cmp ebx, eax
0041E842 7F 0C jg short 0041E850
0041E844 2BF3 sub esi, ebx
0041E846 89B7 78550000 mov dword ptr [edi+5578], esi ; 阳光减少后赋值语句
0041E84C B0 01 mov al, 1
0041E84E 5E pop esi
0041E84F C3 retn
OD中按Alt + K查看调用堆栈，如下：
先转到00413232处的call语句,如下：
0041322B E8 B0D60000 call 004208E0
00413230 8BD8 mov ebx, eax
00413232 E8 F9B50000 call 0041E830 ; 阳光减少call
00413237 84C0 test al, al
00413239 0F84 C1060000 je 00413900
0041322B E8 B0D60000 call 004208E0
00413230 8BD8 mov ebx, eax
00413232 E8 F9B50000 call 0041E830 ; 阳光减少call
00413237 84C0 test al, al
00413239 0F84 C1060000 je 00413900
0041322B E8 B0D60000 call 004208E0
00413230 8BD8 mov ebx, eax
00413232 E8 F9B50000 call 0041E830 ; 阳光减少call
00413237 84C0 test al, al
00413239 0F84 C1060000 je 00413900
再转到00414BBB处的call语句，如下：
00414BAE /74 1E je short 00414BCE
00414BB0 |8B4D 0C mov ecx, dword ptr [ebp+C]
00414BB3 |8B55 08 mov edx, dword ptr [ebp+8]
00414BB6 |51 push ecx
00414BB7 |52 push edx
00414BB8 |57 push edi
00414BB9 |8BCB mov ecx, ebx
00414BBB |E8 30DBFFFF call 004126F0 ; 植物种植call
00414BAE /74 1E je short 00414BCE
00414BB0 |8B4D 0C mov ecx, dword ptr [ebp+C]
00414BB3 |8B55 08 mov edx, dword ptr [ebp+8]
00414BB6 |51 push ecx
00414BB7 |52 push edx
00414BB8 |57 push edi
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
