-
-
[原创]如何用IDA 或者OD、CE找d3d9.dll中的虚函数表？
-
发表于: 2018-8-14 15:28
-
void d3dHook()
{
DWORD hD3D = NULL;
while (!hD3D) hD3D = (DWORD)GetModuleHandle("d3d9.dll");
////这种HOOK方式就是找到d3d9.dll的接口，搜索特征码，找到Vtable（虚函数表）
DWORD PPPDevice = FindPattern(hD3D, 0x128000, (PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
WriteMemory(&VTable, (void *)(PPPDevice + 2), 4);
dwEndscene_hook = VTable[42] + 0x2A;
dwEndscene_ret = dwEndscene_hook + 0x6;
Detour((PBYTE)dwEndscene_hook, (DWORD)MyEndscene, 0x6);
}
上面这个图片是用什么工具，怎么找出来的？是否需要加载PDB符号表d3d9.dll的？求大神们指点。
已经通过调试自己分析出来了。通过此方法应该可以找出不同系统下dx8、dx9、dx10 等的d3d的虚函数表特征码。获得虚函数表指针后d3d的所有函数地址就出来了。
// create a device class using this information and the info from the d3dpp stuct d3d->CreateDevice(D3DADAPTER_DEFAULT, 00A91F7B 8B F4 mov esi,esp 00A91F7D 68 44 A1 A9 00 push offset d3ddev (0A9A144h) 00A91F82 8D 45 C0 lea eax,[d3dpp] 00A91F85 50 push eax 00A91F86 6A 20 push 20h 00A91F88 8B 4D 08 mov ecx,dword ptr [hWnd] 00A91F8B 51 push ecx 00A91F8C 6A 01 push 1 00A91F8E 6A 00 push 0 00A91F90 8B 15 40 A1 A9 00 mov edx,dword ptr [d3d (0A9A140h)] 00A91F96 8B 02 mov eax,dword ptr [edx] 00A91F98 8B 0D 40 A1 A9 00 mov ecx,dword ptr [d3d (0A9A140h)] 00A91F9E 51 push ecx 00A91F9F 8B 50 40 mov edx,dword ptr [eax+40h] 00A91FA2 FF D2 call edx 00A91FA4 3B F4 cmp esi,esp 00A91FA6 E8 AE F1 FF FF call __RTC_CheckEsp (0A91159h) D3DDEVTYPE_HAL, hWnd, D3DCREATE_SOFTWARE_VERTEXPROCESSING, &d3dpp, &d3ddev);
通过上面的
00A91FA2 FF D2 call edx
进入下面的函数
CEnum::CreateDevice: 61F4CD90 8B FF mov edi,edi 61F4CD92 55 push ebp 61F4CD93 8B EC mov ebp,esp 61F4CD95 83 E4 F8 and esp,0FFFFFFF8h 61F4CD98 81 EC 6C 01 00 00 sub esp,16Ch 61F4CD9E A1 64 12 06 62 mov eax,dword ptr [___security_cookie (62061264h)] 61F4CDA3 33 C4 xor eax,esp 61F4CDA5 89 84 24 68 01 00 00 mov dword ptr [esp+168h],eax 61F4CDAC 8B 45 0C mov eax,dword ptr [ebp+0Ch] 61F4CDAF 53 push ebx 61F4CDB0 8B 5D 08 mov ebx,dword ptr [ebp+8] 61F4CDB3 8B CB mov ecx,ebx 61F4CDB5 56 push esi 61F4CDB6 8B 75 1C mov esi,dword ptr [ebp+1Ch] 61F4CDB9 F7 D9 neg ecx 61F4CDBB 89 44 24 10 mov dword ptr [esp+10h],eax 61F4CDBF 8B 45 14 mov eax,dword ptr [ebp+14h] 61F4CDC2 1B C9 sbb ecx,ecx 61F4CDC4 57 push edi 61F4CDC5 8B 7D 20 mov edi,dword ptr [ebp+20h] 61F4CDC8 89 44 24 18 mov dword ptr [esp+18h],eax 61F4CDCC 8D 43 04 lea eax,[ebx+4] 61F4CDCF 23 C8 and ecx,eax 61F4CDD1 89 5C 24 28 mov dword ptr [esp+28h],ebx 61F4CDD5 6A 00 push 0 61F4CDD7 51 push ecx 61F4CDD8 8D 4C 24 38 lea ecx,[esp+38h] 61F4CDDC 89 74 24 2C mov dword ptr [esp+2Ch],esi 61F4CDE0 89 7C 24 34 mov dword ptr [esp+34h],edi 61F4CDE4 E8 F5 F1 00 00 call CLockD3D::CLockD3D (61F5BFDEh) 61F4CDE9 8B 54 24 14 mov edx,dword ptr [esp+14h] 61F4CDED 33 C9 xor ecx,ecx 61F4CDEF 89 0F mov dword ptr [edi],ecx 61F4CDF1 3B 53 2C cmp edx,dword ptr [ebx+2Ch] 61F4CDF4 0F 83 A7 09 04 00 jae CD3DFPstate::~CD3DFPstate+55FFh (61F8D7A1h) 61F4CDFA 33 C0 xor eax,eax 61F4CDFC 89 4C 24 20 mov dword ptr [esp+20h],ecx 61F4CE00 40 inc eax 61F4CE01 F7 45 18 00 02 00 00 test dword ptr [ebp+18h],200h 61F4CE08 89 44 24 1C mov dword ptr [esp+1Ch],eax 61F4CE0C 0F 85 C7 09 04 00 jne CD3DFPstate::~CD3DFPstate+5637h (61F8D7D9h) 61F4CE12 39 4E 20 cmp dword ptr [esi+20h],ecx 61F4CE15 0F 84 D4 09 04 00 je CD3DFPstate::~CD3DFPstate+564Dh (61F8D7EFh) 61F4CE1B 69 F2 10 03 00 00 imul esi,edx,310h 61F4CE21 8D BB 28 03 00 00 lea edi,[ebx+328h] 61F4CE27 8D 44 24 14 lea eax,[esp+14h] 61F4CE2B 89 4C 24 14 mov dword ptr [esp+14h],ecx 61F4CE2F 8B CB mov ecx,ebx 61F4CE31 03 FE add edi,esi 61F4CE33 57 push edi 61F4CE34 50 push eax 61F4CE35 FF 74 24 28 push dword ptr [esp+28h] 61F4CE39 FF 74 24 30 push dword ptr [esp+30h] 61F4CE3D FF 75 18 push dword ptr [ebp+18h] 61F4CE40 FF 74 24 2C push dword ptr [esp+2Ch] 61F4CE44 FF 75 10 push dword ptr [ebp+10h] 61F4CE47 52 push edx 61F4CE48 E8 9D FB FF FF call CEnum::CreateDeviceImpl (61F4C9EAh) 61F4CE4D 8B 54 24 2C mov edx,dword ptr [esp+2Ch] 61F4CE51 8B C8 mov ecx,eax 61F4CE53 8B 44 24 14 mov eax,dword ptr [esp+14h] 61F4CE57 89 4C 24 18 mov dword ptr [esp+18h],ecx 61F4CE5B 89 02 mov dword ptr [edx],eax 61F4CE5D FF B4 1E 1C 03 00 00 push dword ptr [esi+ebx+31Ch] 61F4CE64 FF B4 1E 18 03 00 00 push dword ptr [esi+ebx+318h] 61F4CE6B 51 push ecx 61F4CE6C FF 37 push dword ptr [edi] 61F4CE6E FF 75 18 push dword ptr [ebp+18h] 61F4CE71 FF 75 10 push dword ptr [ebp+10h] 61F4CE74 6A 00 push 0 61F4CE76 FF B3 F4 4D 00 00 push dword ptr [ebx+4DF4h] 61F4CE7C 50 push eax 61F4CE7D E8 BC 71 00 00 call CD3D9TelemetryHelper::LogCreateDeviceEvent (61F5403Eh) 61F4CE82 8B 7C 24 18 mov edi,dword ptr [esp+18h] 61F4CE86 8B 74 24 30 mov esi,dword ptr [esp+30h] 61F4CE8A 83 7E 18 00 cmp dword ptr [esi+18h],0 61F4CE8E 74 07 je CEnum::CreateDevice+107h (61F4CE97h) 61F4CE90 56 push esi 61F4CE91 FF 15 2C 83 06 62 call dword ptr [__imp__LeaveCriticalSection@4 (6206832Ch)] 61F4CE97 83 7C 24 34 00 cmp dword ptr [esp+34h],0 61F4CE9C 0F 85 CC 09 04 00 jne CD3DFPstate::~CD3DFPstate+56CCh (61F8D86Eh) 61F4CEA2 8B 8C 24 74 01 00 00 mov ecx,dword ptr [esp+174h] 61F4CEA9 8B C7 mov eax,edi 61F4CEAB 5F pop edi 61F4CEAC 5E pop esi 61F4CEAD 5B pop ebx 61F4CEAE 33 CC xor ecx,esp 61F4CEB0 E8 DB 81 03 00 call @__security_check_cookie@4 (61F85090h) 61F4CEB5 8B E5 mov esp,ebp 61F4CEB7 5D pop ebp 61F4CEB8 C2 1C 00 ret 1Ch 61F4CEBB CC int 3 61F4CEBC CC int 3 61F4CEBD CC int 3 61F4CEBE CC int 3 61F4CEBF CC int 3
通过上面的
61F4CE48 E8 9D FB FF FF call CEnum::CreateDeviceImpl (61F4C9EAh)
调用进入下面函数
CEnum::CreateDeviceImpl: 61F4C9EA 68 EC 00 00 00 push 0ECh 61F4C9EF B8 D4 81 F8 61 mov eax,61F881D4h 61F4C9F4 E8 E4 A4 03 00 call __EH_prolog3_GS (61F86EDDh) 61F4C9F9 8B F9 mov edi,ecx 61F4C9FB 89 BD 48 FF FF FF mov dword ptr [ebp-0B8h],edi 61F4CA01 8B 45 10 mov eax,dword ptr [ebp+10h] 61F4CA04 33 DB xor ebx,ebx 61F4CA06 83 7D 0C 04 cmp dword ptr [ebp+0Ch],4 61F4CA0A 8B 75 08 mov esi,dword ptr [ebp+8] 61F4CA0D 89 85 7C FF FF FF mov dword ptr [ebp-84h],eax 61F4CA13 8B 45 18 mov eax,dword ptr [ebp+18h] 61F4CA16 89 45 80 mov dword ptr [ebp-80h],eax 61F4CA19 8B 45 1C mov eax,dword ptr [ebp+1Ch] 61F4CA1C 89 85 50 FF FF FF mov dword ptr [ebp-0B0h],eax 61F4CA22 8B 45 20 mov eax,dword ptr [ebp+20h] 61F4CA25 89 B5 5C FF FF FF mov dword ptr [ebp-0A4h],esi 61F4CA2B 89 85 40 FF FF FF mov dword ptr [ebp-0C0h],eax 61F4CA31 89 9D 54 FF FF FF mov dword ptr [ebp-0ACh],ebx 61F4CA37 89 5D 88 mov dword ptr [ebp-78h],ebx 61F4CA3A 89 9D 4C FF FF FF mov dword ptr [ebp-0B4h],ebx 61F4CA40 0F 84 26 08 04 00 je CD3DFPstate::~CD3DFPstate+50CAh (61F8D26Ch) 61F4CA46 6A 30 push 30h 61F4CA48 8D 45 C0 lea eax,[ebp-40h] 61F4CA4B 53 push ebx 61F4CA4C 50 push eax 61F4CA4D E8 ED A6 03 00 call _memset (61F8713Fh) 61F4CA52 8B 0D 98 3D 06 62 mov ecx,dword ptr [_g_hAppSpecificD3DRegKey (62063D98h)] 61F4CA58 83 C4 0C add esp,0Ch 61F4CA5B 89 9D 74 FF FF FF mov dword ptr [ebp-8Ch],ebx 61F4CA61 85 C9 test ecx,ecx 61F4CA63 75 06 jne CEnum::CreateDeviceImpl+81h (61F4CA6Bh) 61F4CA65 8B 0D 88 3D 06 62 mov ecx,dword ptr [_g_hD3DRegKey (62063D88h)] 61F4CA6B 6A 04 push 4 61F4CA6D 8D 85 58 FF FF FF lea eax,[ebp-0A8h] 61F4CA73 50 push eax 61F4CA74 68 50 6A F1 61 push offset string "UseVSConverter" (61F16A50h) 61F4CA79 6A 04 push 4 61F4CA7B 5A pop edx 61F4CA7C E8 D4 36 00 00 call GetRegValue (61F50155h) 61F4CA81 83 C4 0C add esp,0Ch 61F4CA84 85 C0 test eax,eax 61F4CA86 0F 85 72 08 04 00 jne CD3DFPstate::~CD3DFPstate+515Ch (61F8D2FEh) 61F4CA8C 8B 0D 98 3D 06 62 mov ecx,dword ptr [_g_hAppSpecificD3DRegKey (62063D98h)] 61F4CA92 85 C9 test ecx,ecx 61F4CA94 75 06 jne CEnum::CreateDeviceImpl+0B2h (61F4CA9Ch) 61F4CA96 8B 0D 88 3D 06 62 mov ecx,dword ptr [_g_hD3DRegKey (62063D88h)] 61F4CA9C 6A 04 push 4 61F4CA9E 8D 85 58 FF FF FF lea eax,[ebp-0A8h] 61F4CAA4 50 push eax 61F4CAA5 68 60 6A F1 61 push offset string "UsePSConverter" (61F16A60h) 61F4CAAA 6A 04 push 4 61F4CAAC 5A pop edx 61F4CAAD E8 A3 36 00 00 call GetRegValue (61F50155h) 61F4CAB2 83 C4 0C add esp,0Ch 61F4CAB5 85 C0 test eax,eax 61F4CAB7 0F 85 5C 08 04 00 jne CD3DFPstate::~CD3DFPstate+5177h (61F8D319h) 61F4CABD 8B 55 14 mov edx,dword ptr [ebp+14h] 61F4CAC0 8B C2 mov eax,edx 61F4CAC2 FF 75 80 push dword ptr [ebp-80h] 61F4CAC5 8B 8D 7C FF FF FF mov ecx,dword ptr [ebp-84h] 61F4CACB C1 E8 02 shr eax,2 61F4CACE 25 00 01 00 00 and eax,100h 61F4CAD3 0B D0 or edx,eax 61F4CAD5 89 55 14 mov dword ptr [ebp+14h],edx 61F4CAD8 E8 59 F1 FF FF call IsDriverMultithreadingAllowed (61F4BC36h) 61F4CADD 83 C4 04 add esp,4 61F4CAE0 89 85 6C FF FF FF mov dword ptr [ebp-94h],eax 61F4CAE6 8B CF mov ecx,edi 61F4CAE8 FF B5 50 FF FF FF push dword ptr [ebp-0B0h] 61F4CAEE FF 75 80 push dword ptr [ebp-80h] 61F4CAF1 50 push eax 61F4CAF2 52 push edx 61F4CAF3 FF 75 0C push dword ptr [ebp+0Ch] 61F4CAF6 56 push esi 61F4CAF7 E8 5F 11 00 00 call CEnum::ValidateCreateDevice (61F4DC5Bh) 61F4CAFC 85 C0 test eax,eax 61F4CAFE 0F 88 57 02 00 00 js CEnum::CreateDeviceImpl+371h (61F4CD5Bh) 61F4CB04 8B 85 7C FF FF FF mov eax,dword ptr [ebp-84h] 61F4CB0A 85 C0 test eax,eax 61F4CB0C 74 0F je CEnum::CreateDeviceImpl+133h (61F4CB1Dh) 61F4CB0E 50 push eax 61F4CB0F FF 15 C0 84 06 62 call dword ptr [__imp__IsWindow@4 (620684C0h)] 61F4CB15 85 C0 test eax,eax 61F4CB17 0F 84 17 08 04 00 je CD3DFPstate::~CD3DFPstate+5192h (61F8D334h) 61F4CB1D 8B 4D 14 mov ecx,dword ptr [ebp+14h] 61F4CB20 F7 C1 00 02 00 00 test ecx,200h 61F4CB26 0F 85 17 08 04 00 jne CD3DFPstate::~CD3DFPstate+51A1h (61F8D343h) 61F4CB2C 33 C0 xor eax,eax 61F4CB2E 40 inc eax 61F4CB2F 89 85 78 FF FF FF mov dword ptr [ebp-88h],eax 61F4CB35 8B D3 mov edx,ebx 61F4CB37 89 95 70 FF FF FF mov dword ptr [ebp-90h],edx 61F4CB3D 85 C0 test eax,eax 61F4CB3F 74 46 je CEnum::CreateDeviceImpl+19Dh (61F4CB87h) 61F4CB41 8B 4D 80 mov ecx,dword ptr [ebp-80h] 61F4CB44 83 C1 1C add ecx,1Ch 61F4CB47 89 4D 84 mov dword ptr [ebp-7Ch],ecx 61F4CB4A 8B F1 mov esi,ecx 61F4CB4C 39 1E cmp dword ptr [esi],ebx 61F4CB4E 0F 85 0F 02 00 00 jne CEnum::CreateDeviceImpl+379h (61F4CD63h) 61F4CB54 39 9F F4 4D 00 00 cmp dword ptr [edi+4DF4h],ebx 61F4CB5A 0F 84 0D 08 04 00 je CD3DFPstate::~CD3DFPstate+51CBh (61F8D36Dh) 61F4CB60 39 9D 7C FF FF FF cmp dword ptr [ebp-84h],ebx 61F4CB66 74 08 je CEnum::CreateDeviceImpl+186h (61F4CB70h) 61F4CB68 85 D2 test edx,edx 61F4CB6A 0F 85 21 08 04 00 jne CD3DFPstate::~CD3DFPstate+51EFh (61F8D391h) 61F4CB70 42 inc edx 61F4CB71 83 C6 38 add esi,38h 61F4CB74 89 95 70 FF FF FF mov dword ptr [ebp-90h],edx 61F4CB7A 3B D0 cmp edx,eax 61F4CB7C 72 CE jb CEnum::CreateDeviceImpl+162h (61F4CB4Ch) 61F4CB7E 8B 4D 14 mov ecx,dword ptr [ebp+14h] 61F4CB81 8B B5 5C FF FF FF mov esi,dword ptr [ebp-0A4h] 61F4CB87 83 7D 0C 03 cmp dword ptr [ebp+0Ch],3 61F4CB8B 0F 84 3F 08 04 00 je CD3DFPstate::~CD3DFPstate+522Eh (61F8D3D0h) 61F4CB91 FF B5 50 FF FF FF push dword ptr [ebp-0B0h] 61F4CB97 8B D1 mov edx,ecx 61F4CB99 C1 EA 0E shr edx,0Eh 61F4CB9C 83 E2 01 and edx,1 61F4CB9F 89 95 68 FF FF FF mov dword ptr [ebp-98h],edx 61F4CBA5 8B 55 80 mov edx,dword ptr [ebp-80h] 61F4CBA8 FF 72 18 push dword ptr [edx+18h] 61F4CBAB 51 push ecx 61F4CBAC FF 75 0C push dword ptr [ebp+0Ch] 61F4CBAF 8B CF mov ecx,edi 61F4CBB1 53 push ebx 61F4CBB2 50 push eax 61F4CBB3 56 push esi 61F4CBB4 E8 DA 03 00 00 call CEnum::IsMaximizedWindowedModeEnabled (61F4CF93h) 61F4CBB9 88 85 70 FF FF FF mov byte ptr [ebp-90h],al 61F4CBBF 84 C0 test al,al 61F4CBC1 0F 85 1A 08 04 00 jne CD3DFPstate::~CD3DFPstate+523Fh (61F8D3E1h) 61F4CBC7 88 5D 8F mov byte ptr [ebp-71h],bl 61F4CBCA 8B 45 0C mov eax,dword ptr [ebp+0Ch] 61F4CBCD 83 F8 01 cmp eax,1 61F4CBD0 0F 85 9E 08 04 00 jne CD3DFPstate::~CD3DFPstate+52D2h (61F8D474h) 61F4CBD6 39 1D A4 30 06 62 cmp dword ptr [_g_bIsLHDriver (620630A4h)],ebx 61F4CBDC 0F 84 31 08 04 00 je CD3DFPstate::~CD3DFPstate+5271h (61F8D413h) 61F4CBE2 FF 75 24 push dword ptr [ebp+24h] 61F4CBE5 0F B6 85 70 FF FF FF movzx eax,byte ptr [ebp-90h] 61F4CBEC 8D 57 30 lea edx,[edi+30h] 61F4CBEF 50 push eax 61F4CBF0 0F B6 45 8F movzx eax,byte ptr [ebp-71h] 61F4CBF4 69 CE 10 03 00 00 imul ecx,esi,310h 61F4CBFA 50 push eax 61F4CBFB 33 C0 xor eax,eax 61F4CBFD 39 87 F4 4D 00 00 cmp dword ptr [edi+4DF4h],eax 61F4CC03 0F 94 C0 sete al 61F4CC06 03 D1 add edx,ecx 61F4CC08 FF B4 39 CC 02 00 00 push dword ptr [ecx+edi+2CCh] 61F4CC0F FF B4 39 D0 02 00 00 push dword ptr [ecx+edi+2D0h] 61F4CC16 FF B4 39 68 01 00 00 push dword ptr [ecx+edi+168h] 61F4CC1D 8D 4D C0 lea ecx,[ebp-40h] 61F4CC20 FF B5 54 FF FF FF push dword ptr [ebp-0ACh] 61F4CC26 FF 75 0C push dword ptr [ebp+0Ch] 61F4CC29 53 push ebx 61F4CC2A FF B5 6C FF FF FF push dword ptr [ebp-94h] 61F4CC30 FF B5 68 FF FF FF push dword ptr [ebp-98h] 61F4CC36 50 push eax 61F4CC37 E8 11 F4 FF FF call InternalDirectDrawCreate (61F4C04Dh) 61F4CC3C 8B 4D 88 mov ecx,dword ptr [ebp-78h] 61F4CC3F 83 C4 30 add esp,30h 61F4CC42 89 45 84 mov dword ptr [ebp-7Ch],eax 61F4CC45 85 C9 test ecx,ecx 61F4CC47 0F 85 50 08 04 00 jne CD3DFPstate::~CD3DFPstate+52FBh (61F8D49Dh) 61F4CC4D 85 C0 test eax,eax 61F4CC4F 0F 88 57 08 04 00 js CD3DFPstate::~CD3DFPstate+530Ah (61F8D4ACh) 61F4CC55 33 D2 xor edx,edx 61F4CC57 42 inc edx 61F4CC58 39 95 78 FF FF FF cmp dword ptr [ebp-88h],edx 61F4CC5E 0F 87 6B 08 04 00 ja CD3DFPstate::~CD3DFPstate+532Dh (61F8D4CFh) 61F4CC64 8B 45 0C mov eax,dword ptr [ebp+0Ch] 61F4CC67 48 dec eax 61F4CC68 83 F8 03 cmp eax,3 61F4CC6B 0F 87 ED 0A 04 00 ja CD3DFPstate::~CD3DFPstate+55BCh (61F8D75Eh) 61F4CC71 39 1D A4 30 06 62 cmp dword ptr [_g_bIsLHDriver (620630A4h)],ebx 61F4CC77 0F 84 BF 09 04 00 je CD3DFPstate::~CD3DFPstate+549Ah (61F8D63Ch) 61F4CC7D 8B 45 14 mov eax,dword ptr [ebp+14h] 61F4CC80 A8 10 test al,10h 61F4CC82 0F 85 C5 09 04 00 jne CD3DFPstate::~CD3DFPstate+54ABh (61F8D64Dh) 61F4CC88 89 95 74 FF FF FF mov dword ptr [ebp-8Ch],edx 61F4CC8E 8D 4D 88 lea ecx,[ebp-78h] 61F4CC91 52 push edx 61F4CC92 BA 40 41 00 00 mov edx,4140h 61F4CC97 E8 90 EC 02 00 call MallocAligned (61F7B92Ch) 61F4CC9C 59 pop ecx 61F4CC9D 8B 4D 88 mov ecx,dword ptr [ebp-78h] 61F4CCA0 89 4D 88 mov dword ptr [ebp-78h],ecx 61F4CCA3 C7 45 FC 01 00 00 00 mov dword ptr [ebp-4],1 61F4CCAA 85 C9 test ecx,ecx 61F4CCAC 0F 84 FB 09 04 00 je CD3DFPstate::~CD3DFPstate+550Bh (61F8D6ADh) 61F4CCB2 E8 25 16 01 00 call CD3DHal::CD3DHal (61F5E2DCh) 61F4CCB7 8B F8 mov edi,eax 61F4CCB9 83 4D FC FF or dword ptr [ebp-4],0FFFFFFFFh 61F4CCBD 85 FF test edi,edi 61F4CCBF 0F 84 EF 09 04 00 je CD3DFPstate::~CD3DFPstate+5512h (61F8D6B4h) 61F4CCC5 FF B5 70 FF FF FF push dword ptr [ebp-90h] 61F4CCCB 8D 45 C0 lea eax,[ebp-40h] 61F4CCCE FF B5 74 FF FF FF push dword ptr [ebp-8Ch] 61F4CCD4 FF B5 4C FF FF FF push dword ptr [ebp-0B4h] 61F4CCDA FF B5 48 FF FF FF push dword ptr [ebp-0B8h] 61F4CCE0 56 push esi 61F4CCE1 FF B5 50 FF FF FF push dword ptr [ebp-0B0h] 61F4CCE7 FF 75 80 push dword ptr [ebp-80h] 61F4CCEA FF 75 14 push dword ptr [ebp+14h] 61F4CCED FF B5 7C FF FF FF push dword ptr [ebp-84h] 61F4CCF3 FF 75 0C push dword ptr [ebp+0Ch] 61F4CCF6 50 push eax 61F4CCF7 51 push ecx 61F4CCF8 FF B5 78 FF FF FF push dword ptr [ebp-88h] 61F4CCFE 8B CF mov ecx,edi 61F4CD00 E8 AB C2 01 00 call CBaseDevice::Init (61F68FB0h) 61F4CD05 8B D8 mov ebx,eax 61F4CD07 85 DB test ebx,ebx 61F4CD09 0F 88 C8 09 04 00 js CD3DFPstate::~CD3DFPstate+5535h (61F8D6D7h) 61F4CD0F 8B 0D 98 3D 06 62 mov ecx,dword ptr [_g_hAppSpecificD3DRegKey (62063D98h)] 61F4CD15 85 C9 test ecx,ecx 61F4CD17 75 06 jne CEnum::CreateDeviceImpl+335h (61F4CD1Fh) 61F4CD19 8B 0D 88 3D 06 62 mov ecx,dword ptr [_g_hD3DRegKey (62063D88h)] 61F4CD1F 6A 04 push 4 61F4CD21 8D 85 44 FF FF FF lea eax,[ebp-0BCh] 61F4CD27 50 push eax 61F4CD28 68 70 6A F1 61 push offset string "DisableVidMemVBs" (61F16A70h) 61F4CD2D 6A 04 push 4 61F4CD2F 5A pop edx 61F4CD30 E8 20 34 00 00 call GetRegValue (61F50155h) 61F4CD35 83 C4 0C add esp,0Ch 61F4CD38 85 C0 test eax,eax 61F4CD3A 0F 85 02 0A 04 00 jne CD3DFPstate::~CD3DFPstate+55A0h (61F8D742h) 61F4CD40 8B CF mov ecx,edi 61F4CD42 E8 8D B3 01 00 call CD3DBase::Init (61F680D4h) 61F4CD47 8B D8 mov ebx,eax 61F4CD49 85 DB test ebx,ebx 61F4CD4B 0F 85 B9 09 04 00 jne CD3DFPstate::~CD3DFPstate+5568h (61F8D70Ah) 61F4CD51 8B 85 40 FF FF FF mov eax,dword ptr [ebp-0C0h] 61F4CD57 89 38 mov dword ptr [eax],edi 61F4CD59 33 C0 xor eax,eax 61F4CD5B E8 2C A1 03 00 call __EH_epilog3_GS (61F86E8Ch) 61F4CD60 C2 20 00 ret 20h 61F4CD63 FF 36 push dword ptr [esi] 61F4CD65 FF 15 C0 84 06 62 call dword ptr [__imp__IsWindow@4 (620684C0h)] 61F4CD6B 85 C0 test eax,eax 61F4CD6D 0F 84 3F 06 04 00 je CD3DFPstate::~CD3DFPstate+5210h (61F8D3B2h) 61F4CD73 8B 95 70 FF FF FF mov edx,dword ptr [ebp-90h] 61F4CD79 8B 85 78 FF FF FF mov eax,dword ptr [ebp-88h] 61F4CD7F 8B 4D 84 mov ecx,dword ptr [ebp-7Ch] 61F4CD82 E9 CD FD FF FF jmp CEnum::CreateDeviceImpl+16Ah (61F4CB54h) 61F4CD87 CC int 3 61F4CD88 CC int 3 61F4CD89 CC int 3 61F4CD8A CC int 3 61F4CD8B CC int 3 61F4CD8C CC int 3 61F4CD8D CC int 3 61F4CD8E CC int 3 61F4CD8F CC int 3
通过上面的函数
61F4CCB2 E8 25 16 01 00 call CD3DHal::CD3DHal (61F5E2DCh)
进入此函数，函数里面就是就是特征码的位置，及对应的d3d9的虚函数地址指针了。
CD3DHal::CD3DHal: 61F5E2DC 8B FF mov edi,edi 61F5E2DE 56 push esi 61F5E2DF 8B F1 mov esi,ecx 61F5E2E1 E8 0C 72 00 00 call CD3DBase::CD3DBase (61F654F2h) 61F5E2E6 33 C0 xor eax,eax 61F5E2E8 C7 06 80 1F F1 61 mov dword ptr [esi],offset CD3DHal::`vftable' (61F11F80h) 61F5E2EE 89 86 50 32 00 00 mov dword ptr [esi+3250h],eax 61F5E2F4 89 86 48 32 00 00 mov dword ptr [esi+3248h],eax 61F5E2FA 89 86 4C 32 00 00 mov dword ptr [esi+324Ch],eax 61F5E300 89 86 14 33 00 00 mov dword ptr [esi+3314h],eax 61F5E306 89 86 20 33 00 00 mov dword ptr [esi+3320h],eax 61F5E30C 89 86 38 33 00 00 mov dword ptr [esi+3338h],eax 61F5E312 89 86 3C 33 00 00 mov dword ptr [esi+333Ch],eax 61F5E318 89 86 40 33 00 00 mov dword ptr [esi+3340h],eax 61F5E31E 89 86 44 33 00 00 mov dword ptr [esi+3344h],eax 61F5E324 89 86 E0 3F 00 00 mov dword ptr [esi+3FE0h],eax 61F5E32A 89 86 EC 3F 00 00 mov dword ptr [esi+3FECh],eax 61F5E330 89 86 F8 3F 00 00 mov dword ptr [esi+3FF8h],eax 61F5E336 89 86 04 40 00 00 mov dword ptr [esi+4004h],eax 61F5E33C 89 86 10 40 00 00 mov dword ptr [esi+4010h],eax 61F5E342 88 86 14 40 00 00 mov byte ptr [esi+4014h],al 61F5E348 89 86 2C 33 00 00 mov dword ptr [esi+332Ch],eax 61F5E34E 8B C6 mov eax,esi 61F5E350 5E pop esi 61F5E351 C3 ret
顺便说明一下上面的FindPattern返回的地址指向 C7 06 80 1F F1 61
61F5E2E8 C7 06 80 1F F1 61 mov dword ptr [esi],offset CD3DHal::`vftable' (61F11F80h)
显然前两个字节不是我们需要的，因为那些只是mov指令。重要的部分是遵循mov指令后面的地址。此代码memcpy(＆vTable,(VOID *)(pDevice + 2)，4);复制那4个字节（在示例中为 CD3DHal::`vftable' (61F11F80h)
）。它是指向用于创建设备的“原始”v表的指针。这个原始的v-table可以用来获取你想要的所有函数指针。
在这种情况下，原始表位于CD3DHal::`vftable' (61F11F80h) 。
在这种情况下，原始表位于CD3DHal::`vftable' (61F11F80h) 。
这意味着指向EndScene的指针存储在
CD3DHal::`vftable' (61F11F80h)
+ 42 * 4： 即VTable[42] 代表d3d的EndScene()函数地址。
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
最后于 2018-8-14 23:01
被小光前辈编辑
，原因： 分类
|
|
|---|---|
|
|
建议你先看雪原理，比如pDevice->present() ，里面就会用到设备对象把，然后你只需要自己创建个设备对象，然后找到虚表函数，然后进去下断，找到游戏的设备对象，ok，完事。
 ，后面就自己揣摩吧，别问我了。
|
|
|
|
|
|
|
