[原创] 2025騰訊遊戲安全大賽(安卓初賽)-Android安全-看雪安全社区

## 前言

第一次聽說這比賽是上年偶然和舍友聊天時他告訴我的，沒想到還有以遊戲安全為主的比賽，當時看到有安卓的賽道就報名了，然後比賽時就被那門卡了2天，然後就沒有然後了。

今年沒意外的話是我大學生涯的最後一年，也許也是最後一年打這個比賽了吧，下年也不知道有沒有空看看題。

以下是我的解題記錄，一部份是比賽時寫的，一部份是賽後補充的，有寫錯的還請指正。

## 前置準備

版本：4.27

![](upload/attach/202504/946537_737SG8KAZUZHF3G.webp)

GName：`0xADF07C0`

![](upload/attach/202504/946537_4M4SWDWQTMEARPY.webp)

GObject：`0xAE34A98`

![](upload/attach/202504/946537_ZXMY9Q75KX4Q5JG.webp)

dump sdk by GObject，記為`SDKO.txt`

```cpp
./ue4dumper64 --sdku --newue+ --gname 0xADF07C0 --guobj 0xAE34A98 --package com.ACE2025.Game
```

dump all objects，記為`Objects.txt`

```cpp

./ue4dumper64 --objs --newue+ --gname 0xADF07C0 --guobj 0xAE34A98 --package com.ACE2025.Game
```

## 異常點分析與修復

題目說明如下，純粹的UE4逆向，無任何反調試。

![](upload/attach/202504/946537_MN5YNQWV3R8TB5F.webp)

### 速度異常

hook `pthread_create`，patch掉`libGame.so`創建唯一一個線程後，速度不再異常。

```cpp
function hook_pthread() {

var pthread_create_addr = Module.findExportByName(null, 'pthread_create');
    console.log("pthread_create_addr,", pthread_create_addr);

var pthread_create = new NativeFunction(pthread_create_addr, "int", ["pointer", "pointer", "pointer", "pointer"]);

Interceptor.replace(pthread_create_addr, new NativeCallback(function (parg0, parg1, parg2, parg3) {
        var so_name = Process.findModuleByAddress(parg2).name;
        var so_path = Process.findModuleByAddress(parg2).path;
        var so_base = Module.getBaseAddress(so_name);
        var offset = parg2 - so_base;
        // console.log("so_name", so_name, "offset", offset, "path", so_path, "parg2", parg2);
        var PC = 0;
        if ((so_name.indexOf("libGame.so") > -1)) {
            console.log("find thread func offset", so_name, offset);
            if ((7068 === offset)) {
                console.log("anti bypass");
            }  else {
                PC = pthread_create(parg0, parg1, parg2, parg3);
                console.log("ordinary sequence", PC)
            }
        } else {
            PC = pthread_create(parg0, parg1, parg2, parg3);
            // console.log("ordinary sequence", PC)
        }
        return PC;
    }, "int", ["pointer", "pointer", "pointer", "pointer"]))

}

```

由此可知相關邏輯就在`libGame.so`創建的線程中。接下來分析它的實現原理。

用IDA動調線程回調函數`sub_1B9C`。

![](upload/attach/202504/946537_664Z2QVA2UKQH3N.webp)

進入後會看到明顯的控制流平坦化，先不管。

打斷點進入`case 12623`，分析後發現就是通過`/proc/self/maps`獲取`libUE4.so`的基址。

![](upload/attach/202504/946537_D4DXDUXZMTVJB5T.webp)

之後本想手動還原下控制流，但突然想起IDA有個D-810插件貌似能解控制流混淆，嘗試下，發現效果很好。

獲取了`libUE4_base`後會賦給`infos[19]`。

![](upload/attach/202504/946537_CWBQCG8WUFT3WFW.webp)

然後`*(_QWORD *)(libUE4_base_1 + 0xAFAC398)`獲取了`libUE4.so`的一個全局變量，猜測是`GWorld`。

![](upload/attach/202504/946537_4ZF8V6JNNXP3UCZ.webp)

用ue4dumper來驗證，發現能順利dump出SDK，由此可知`0xAFAC398`的確是`GWorld`。

記dump出來的文件為`SDKW.txt`。

```bash
./ue4dumper64 --sdkw --newue+ --gname 0xADF07C0 --gworld 0xAFAC398 --package com.ACE2025.Game
```

獲取`GWorld`後，就能通過遍歷其中的屬性定位到`FirstPersonCharacter_C`，具體原理如下，這是用frida實現的。

其中用了`vtabs`( `UObject`的第`0`個成員屬性，虛表 )的函數偏移是否等於`0xA63BE28`來確定是否`FirstPersonCharacter_C`對象，`0xA63BE28`大概是`FirstPersonCharacter_C`的一個特徵？

最終通過修改`CharacterMovementComponent`的`MaxAcceleration`和`MaxWalkSpeed`來改變人物速度。

```cpp
let GWorld = base.add(0xAFAC398).readPointer(); // FirstPersonExampleMap (GWorld)
let PersistentLevel = GWorld.add(0x30).readPointer()       // PersistentLevel
let StreamingLevels = PersistentLevel.add(0x98).readPointer();    // StreamingLevelsToConsider.StreamingLevels
let StreamingLevelsNum = PersistentLevel.add(0xA0).readU32();

let FirstPersonCharacter_C = null;
for(let i = 0; i < StreamingLevelsNum; i++) {
    let StreamingLevel = StreamingLevels.add(i * 8).readPointer();
    let vtabs = StreamingLevel.readPointer();

if (vtabs.sub(base) == 0xA63BE28) {
        // console.log(i, vtabs.readPointer());
        FirstPersonCharacter_C = StreamingLevel;
    }
}

let CharacterMovementComponent = FirstPersonCharacter_C.add(0x288).readPointer()
CharacterMovementComponent.add(0x1a0).writeFloat(1000000000)
CharacterMovementComponent.add(0x18c).writeFloat(1000000000)
```

### 自瞄異常

在`SDKO.txt`裡可以看到我的角色類裡有個`ProjectileClass`成員，而它有個`OnHit`成員函數

```cpp
Class: MyProjectCharacter.Character.Pawn.Actor.Object
	SkeletalMeshComponent* Mesh1P;//[Offset: 0x4b8, Size: 0x8]
	SkeletalMeshComponent* FP_Gun;//[Offset: 0x4c0, Size: 0x8]
	SceneComponent* FP_MuzzleLocation;//[Offset: 0x4c8, Size: 0x8]  // 槍口位置
	SkeletalMeshComponent* VR_Gun;//[Offset: 0x4d0, Size: 0x8]
	SceneComponent* VR_MuzzleLocation;//[Offset: 0x4d8, Size: 0x8]
	CameraComponent* FirstPersonCameraComponent;//[Offset: 0x4e0, Size: 0x8]
	MotionControllerComponent* R_MotionController;//[Offset: 0x4e8, Size: 0x8]	// for VR
	MotionControllerComponent* L_MotionController;//[Offset: 0x4f0, Size: 0x8]	// for VR
	float BaseTurnRate;//[Offset: 0x4f8, Size: 0x4]			// 左右轉向速率
	float BaseLookUpRate;//[Offset: 0x4fc, Size: 0x4]		// 上下轉向速率
	Vector GunOffset;//[Offset: 0x500, Size: 0xc]
	class MyProjectProjectile* ProjectileClass;//[Offset: 0x510, Size: 0x8]
	SoundBase* FireSound;//[Offset: 0x518, Size: 0x8]
	AnimMontage* FireAnimation;//[Offset: 0x520, Size: 0x8]
	bool bUsingMotionControllers;//(ByteOffset: 0, ByteMask: 1, FieldMask: 1)[Offset: 0x528, Size: 0x1]
	float RecoilPitch;//[Offset: 0x52c, Size: 0x4]				// 後座力
	float RecoilYaw;//[Offset: 0x530, Size: 0x4]				// 後座偏航
	float RecoilRecoverySpeed;//[Offset: 0x534, Size: 0x4]  	// 後座力恢復速度
	float RecoilAccumulationRate;//[Offset: 0x538, Size: 0x4]	// 後座力累積率

Class: MyProjectProjectile.Actor.Object
	SphereComponent* CollisionComp;//[Offset: 0x220, Size: 0x8]
	ProjectileMovementComponent* ProjectileMovement;//[Offset: 0x228, Size: 0x8]
	void OnHit(PrimitiveComponent* HitComp, Actor* OtherActor, PrimitiveComponent* OtherComp, Vector NormalImpulse, out const HitResult Hit);// 0x67138e8

```

嘗試hook `OnHit`，分別在enter和leave時打印`CameraRotation`，發現兩者相等，即在enter前就已經完成自瞄，代表相關的自瞄邏輯不在這裡。

```cpp
function hook_onHit() {
    // void OnHit(PrimitiveComponent* HitComp, Actor* OtherActor, PrimitiveComponent* OtherComp, Vector NormalImpulse, out const HitResult Hit);// 0x67138e8
    Interceptor.attach(base.add(0x6711D34), {
        onEnter: function(args) {
            console.log("[onHit] enter: ", JSON.stringify(getCameraRotation()))
        },
        onLeave: function() {
            // setCameraRotation([100, 200, 0])
            console.log("[onHit] leave: ", JSON.stringify(getCameraRotation()))

}
    })
}

```

對`CameraRotation`下硬斷( 寫 )，命中信息如下：

命中PC：`0x799F6637C0`

libUE4 base：`0x7996b2b000`

計算得Offset為`0x8B387C0`

![](upload/attach/202504/946537_EFFZPSFCNTM3AD5.webp)

IDA跳到`0x8B387C0`，如下：

![](upload/attach/202504/946537_ZWCYTT6SSFBYA4S.webp)

記`0x8B387C0`所在函數為`mb_aimbot`，嘗試直接patch掉`mb_aimbot`，發現patch後人物無法轉動視角。

```cpp
function patch_mb_aimbot() {
    Interceptor.replace(base.add(0x8B3861C), new NativeCallback(() => {
        console.log("patch mb_aimbot")
    }, "void", []))
}
```

hook `mb_aimbot`，打印調用棧，未點擊時，調用棧如下

```cpp
[hook_aimbot] 
799fa8e604 is in libUE4.so offset: 0x8f9b604
799fa92444 is in libUE4.so offset: 0x8f9f444
799fa9a358 is in libUE4.so offset: 0x8fa7358
799fcf0b8c is in libUE4.so offset: 0x91fdb8c
799d2c1bb0 is in libUE4.so offset: 0x67cebb0
799d2c1730 is in libUE4.so offset: 0x67ce730
799d2c0e24 is in libUE4.so offset: 0x67cde24
799fcecc04 is in libUE4.so offset: 0x91f9c04
799fcea3bc is in libUE4.so offset: 0x91f73bc
799f82e760 is in libUE4.so offset: 0x8d3b760
799f6f98f0 is in libUE4.so offset: 0x8c068f0
799d93f614 is in libUE4.so offset: 0x6e4c614
799c5ee728 is in libUE4.so offset: 0x5afb728
799c5e83bc is in libUE4.so offset: 0x5af53bc
799c5e6514 is in libUE4.so offset: 0x5af3514
[hook_aimbot] 
79a03df660 is in libUE4.so offset: 0x98ec660
799fcf0b8c is in libUE4.so offset: 0x91fdb8c
799d2c1bb0 is in libUE4.so offset: 0x67cebb0
799d2c1730 is in libUE4.so offset: 0x67ce730
799d2c0e24 is in libUE4.so offset: 0x67cde24
799fcecc04 is in libUE4.so offset: 0x91f9c04
799fcea3bc is in libUE4.so offset: 0x91f73bc
799f82e760 is in libUE4.so offset: 0x8d3b760
799f6f98f0 is in libUE4.so offset: 0x8c068f0
799d93f614 is in libUE4.so offset: 0x6e4c614
799c5ee728 is in libUE4.so offset: 0x5afb728
799c5e83bc is in libUE4.so offset: 0x5af53bc
799c5e6514 is in libUE4.so offset: 0x5af3514
```

點擊後，多了一個不同的調用棧`0x670f3fc`。

```cpp
[hook_aimbot]
799d2f83fc is in libUE4.so offset: 0x670f3fc
7a136f0c94 is in libart.so offset: 0x2e6c94
799d2f8eb0 is in libUE4.so offset: 0x670feb0
799fe51e38 is in libUE4.so offset: 0x9268e38
799fe4fe04 is in libUE4.so offset: 0x9266e04
799fb8958c is in libUE4.so offset: 0x8fa058c
799fb886f4 is in libUE4.so offset: 0x8f9f6f4
799d3b9420 is in libUE4.so offset: 0x67d0420
799fb88374 is in libUE4.so offset: 0x8f9f374
799f49b7bc is in libUE4.so offset: 0x88b27bc
799fb90358 is in libUE4.so offset: 0x8fa7358
799fde6b8c is in libUE4.so offset: 0x91fdb8c
799d3b7bb0 is in libUE4.so offset: 0x67cebb0
799d3b7730 is in libUE4.so offset: 0x67ce730
799d3b6e24 is in libUE4.so offset: 0x67cde24
799fde2c04 is in libUE4.so offset: 0x91f9c04
```

嘗試patch掉`0x670f3fc`所在函數`0x670F110`，雖然點擊後不會再自動瞄到某處，但子彈射不出。

由此猜測`0x670F110`是射擊的回調函數，自瞄邏輯應該就在裡面。

記`0x670F110`為`process_before_shoot`。

```cpp
Interceptor.replace(base.add(0x670F110), new NativeCallback(() => {
    return 1;
}, "int", []))
```

在`0x670F110`中從調用`mb_aimbot`處向上分析，發現是否調用`mb_aimbot`邏輯是由`sub_680B790(v32, "E")`決定的。

![](upload/attach/202504/946537_9M57XT599ZVRHCZ.webp)

hook `sub_680B790`，打印參數和返回值。

注：`hexdump`後可知是unicode編碼的字符串，因此要用`readUtf16String`。

```cpp
function hook_680B790() {
    Interceptor.attach(base.add(0x680B790), {
        onEnter: function(args) {
            this.a1 = args[1];
            console.log("a0: ", args[0].readUtf16String());
            console.log("a1: ", args[1].readUtf16String());
        },
        onLeave: function(retval) {
            console.log("res: ", retval);

}
    })
}
```

輸出如下，可以看出是字符串對比函數，`res`是`a0`、`a1`第1個不相等字符的差值，若相等則為`0`( 不區分大小寫 )。記`sub_680B790`為`utf16_cmp`。

可以看到前面一直在和`EditorCube8`對比，明顯它就是自瞄的目標，

```cpp
a0:  BigWall
a1:  EditorCube8 
res:  0xfffffffd 
a0:  BigWall2    
a1:  EditorCube8 
res:  0xfffffffd 
a0:  EditorCube10
a1:  EditorCube8 
res:  0xfffffff9 
a0:  EditorCube11
a1:  EditorCube8 
res:  0xfffffff9 
a0:  EditorCube12
a1:  EditorCube8
res:  0xfffffff9
a0:  EditorCube13
a1:  EditorCube8
res:  0xfffffff9
a0:  EditorCube14
a1:  EditorCube8
res:  0xfffffff9
a0:  EditorCube15
a1:  EditorCube8
res:  0xfffffff9
a0:  EditorCube16
a1:  EditorCube8
res:  0xfffffff9
a0:  EditorCube17
a1:  EditorCube8
res:  0xfffffff9
a0:  EditorCube18
a1:  EditorCube8
res:  0xfffffff9
a0:  EditorCube19
a1:  EditorCube8
res:  0xfffffff9
a0:  EditorCube20
a1:  EditorCube8
res:  0xfffffffa
a0:  EditorCube21
a1:  EditorCube8
res:  0xfffffffa
a0:  EditorCube8
a1:  EditorCube8
res:  0x0
a0:  EditorCube9
a1:  EditorCube8
res:  0x1
a0:  Floor_12
a1:  EditorCube8
res:  0x1
a0:  Wall1
a1:  EditorCube8
res:  0x12
a0:  Wall2_11
a1:  EditorCube8
res:  0x12
a0:  Wall3
a1:  EditorCube8
res:  0x12
a0:  Wall4
a1:  EditorCube8
res:  0x12
a0:  ../../../MyProject/Saved/Config/Android/Engine.ini
a1:  ../../../MyProject/Saved/Config/Android/Engine.ini
res:  0x0
a0:  true
a1:  True
res:  0x0
a0:  Android
a1:  Android
res:  0x0
a0:  Android
a1:  Android
res:  0x0
a0:  Android
a1:  Android
res:  0x0
```

嘗試在`a1`為`EditorCube8`時將返回值固定replace為一個大於`0`的值。

```cpp
Interceptor.attach(base.add(0x680B790), {
    onEnter: function(args) {
        this.a1 = args[1];
    },
    onLeave: function(retval) {
        if (this.a1.readUtf16String() == "EditorCube8") {
            retval.replace(5);
        }
    }
})
```

結果是射擊時不再自動瞄到指定目標，但手槍在射完後會向上抬一下，類似後座力？不知是否屬於異常點。

下面簡單看看它的自瞄實現原理：

從`process_before_shoot`開始看，一開始先遍歷自瞄目標。

![](upload/attach/202504/946537_QAVUDNUBFJ8VMUJ.webp)

然後調用`calcTargetOffset`計算自瞄值，然後根據這個值來設置`CameraRotation`( 人物相機的轉向，使它朝向目標以實現自瞄的效果 )。

![](upload/attach/202504/946537_U8ZX6EGPP59J28Y.webp)

`calcTargetOffset`實現大概像這樣：利用目標location與人物的location向量來計算。

```cpp
function calcTargetOffset(targetLoc, cameraLoc) {
    let x = targetLoc.x - cameraLoc.x;
    let y = targetLoc.y - cameraLoc.y;
    let z = targetLoc.z - cameraLoc.z;

let angleX = 0;
    let angleY = 0;

if (x > 0 && y == 0) angleX = 0;
    if (x > 0 && y > 0) angleX = Math.abs(Math.atan(y / x)) / Math.PI * 180;

if (x == 0 && y > 0) angleX = 90;
    if (x < 0 && y > 0) angleX = 90 + Math.abs(Math.atan(x / y)) / Math.PI * 180;

if (x < 0 && y == 0) angleX = 180;
    if (x < 0 && y < 0) angleX = 180 + Math.abs(Math.atan(y / x)) / Math.PI * 180;

if (x == 0 && y < 0) angleX = 270;
    if (x > 0 && y < 0) angleX = 270 + Math.abs(Math.atan(x / y)) / Math.PI * 180;

if (angleX < 0) {
        angleX += 360;
    }
    
    if (angleX > 360) {
        angleX -= 360;
    }

angleY = Math.atan(z / Math.sqrt(x * x + y * y)) / Math.PI * 180;

if (angleY < 0) {
        angleY += 360;
    }

return [angleY, angleX, 0]

}
```

### 子彈發射位置異常

可以明顯看出子彈發射的起始位置是隨機的。

猜測可能與`MyProjectCharacter`的`GunOffset`有關。

```cpp
Class: MyProjectCharacter.Character.Pawn.Actor.Object
		// ...
		Vector GunOffset;//[Offset: 0x500, Size: 0xc]
```

對`GunOffset`下硬斷( 讀 )。

![](upload/attach/202504/946537_3FNGB58QUVYFXKT.webp)

命中如下兩處地址：

```cpp
// libUE4 base: 6f6c74e000
1. PC: 0x6F7307EA6C (0x6930A6C)   LR: 0x6F7307EA68
2. PC: 0x6F7307EA7C (0x6930A7C)   LR: 0x6F7307EA68
```

`0x6930A6C`所在函數是`sub_6930A3C`。

![](upload/attach/202504/946537_QKC46Y96TJTK4UD.webp)

hook `sub_6930A3C`打印調用棧。

其中`0x670f658`位於`0x670F110`函數( 即`process_before_shoot` )。

```cpp
6f72e75e24 is in libUE4.so offset: 0x670fe24
6f72e75658 is in libUE4.so offset: 0x670f658 (位於0x670F110)
6f72e75eb0 is in libUE4.so offset: 0x670feb0
6f72e75eb0 is in libUE4.so offset: 0x670feb0
6f759cee38 is in libUE4.so offset: 0x9268e38
6f759cce04 is in libUE4.so offset: 0x9266e04
6fe951f09c is in libart.so offset: 0x59b09c
```

`process_before_shoot`中有調用`rand()`生成隨機值，猜測這與槍口的隨機有關。

![](upload/attach/202504/946537_TZKB8A2X4CM8G4U.webp)

嘗試hook `rand`固定其返回值。

```cpp
function hook_rand() {
    Interceptor.attach(Module.findExportByName(null, "rand"), {
        onLeave: function(retval) {
            retval.replace(100);
            console.log("[rand] res: ", retval);
        }
    })
}
```

結果是子彈發射位置固定了，但是固定在了人物的頭上偏左的位置。

繼續嘗試其他修復思路。

讓`process_before_shoot`中的`a1[0x14A] & 1`不為`0`，目的是讓執行流無法走到上述的`0x6930A6C`位置。

![](upload/attach/202504/946537_DEAD7SDSRNAVGUK.webp)

```cpp
function hook_process_before_shoot() {
    Interceptor.attach(base.add(0x670F110), {
        onEnter: function(args) {
            let val = args[0].add(0x528).readU8();
            args[0].add(0x528).writeU8(val | 1);
            console.log("[process_before_shoot] a1[0x14A] & 1: ", args[0].add(0x528).readU8() & 1)
        },
        onLeave: function(retval) {
            
            
        }
    })
}
```

結果同樣可以固定子彈發射的位置，但這次是在人物的下方固定向正前方發射，上下抬頭時不會改變發射方向。

以下部份是賽後的分析。

若`a1[0x14A] & 1`為`0`，會調用`about_bullt_loc1`生成一些隨機值，調用`about_bullt_loc2`生成一個基於`GunOffset`等參數而來的值，最終傳入`mb_process_bullet_shoot_loc`做最後的處理。

![](upload/attach/202504/946537_A4TWHPSPWXHAJEZ.webp)

而當`a1[0x14A] & 1`為`1`時，則會從`VR_MuzzleLocation`裡獲取一些參數，最終同樣傳入`mb_process_bullet_shoot_loc`。

注：通過hook所在函數，將`*((QWORD*)a1 + 155)`當成`UObject`來打印它的名字，從而確定它是`VR_MuzzleLocation`對象。

![](upload/attach/202504/946537_V6S6T8Z3PY9U7U6.webp)

![](upload/attach/202504/946537_59CA8XKVUNQ2VZY.webp)

但`VR_MuzzleLocation`看名字來說是給VR設備使用的，安卓設備感覺是使用`FP_MuzzleLocation`才對。

因此合理懷疑這也是一個異常點。

hook `process_before_shoot`，從IDA裡可知`args[0].add(0x4D8)`保存著`VR_MuzzleLocation`對象的地址，嘗試將它改為`FP_MuzzleLocation`的地址。

```cpp
function hook_test() {

Interceptor.attach(base.add(0x670F110), {
        onEnter: function(args) {
            console.log("[process_before_shoot]");
            let VR_MuzzleLocation = args[0].add(0x4D8)
            VR_MuzzleLocation.writePointer(All_Objects["MuzzleLocation"])
            printName(VR_MuzzleLocation.readPointer());
            
        },
        onLeave: function(retval) {

}
    })
}
```

結果是子彈終於會隨著槍口的變化而變化，但卻是從槍口往左發射的，正常應該是往前才對。

接下來嘗試修改`FP_MuzzleLocation`裡的一些參數，看看能否改變發射方向。

`FP_MuzzleLocation`屬於`USceneComponent`類，其中有以下這兩個屬性：

```cpp
Class: SceneComponent.ActorComponent.Object
	//...
	Vector RelativeLocation;//[Offset: 0x11c, Size: 0xc]
	Rotator RelativeRotation;//[Offset: 0x128, Size: 0xc]
```

利用`K2_SetRelativeLocation`和`K2_SetRelativeRotation`函數來修改。通過不斷嘗試，發現只需要將Rotation設置為`[0, 90, 0]`即可，相當於旋轉了90度。完整修複代碼如下：

注：不能直接通過內存來修改，要用API來修改。

```cpp
function fix_MuzzleLocation() {
    Interceptor.attach(base.add(0x670F110), {
        onEnter: function(args) {
            console.log("[process_before_shoot]");
            /* API */
            let K2_SetRelativeLocation = new NativeFunction(base.add(0x8AE6D70), "void", ["pointer", "float", "float", "float", "bool", "pointer", "bool"]); 
            let K2_SetRelativeRotation = new NativeFunction(base.add(0x8AE6F00), "void", ["pointer", "float", "float", "float", "bool", "pointer", "bool"]);

// K2_SetRelativeLocation(All_Objects["MuzzleLocation"], 0, 0, 0, 0, ptr(0), 0);
            K2_SetRelativeRotation(All_Objects["MuzzleLocation"], 0, 90, 0, 0, ptr(0), 0);
            
            /* Prop */
            let RelativeLocation = All_Objects["MuzzleLocation"].add(0x11c);
            let RelativeRotation = All_Objects["MuzzleLocation"].add(0x128);

console.log("location: ", JSON.stringify(readVector(RelativeLocation)))
            console.log("rotation: ", JSON.stringify(readVector(RelativeRotation)))

// Replace
            let MuzzleLocation = args[0].add(0x4D8)
            MuzzleLocation.writePointer(All_Objects["MuzzleLocation"])
            
        },
        onLeave: function(retval) {
        }
    })
}
```

### 透視分析

在`Objects.txt`裡可以看到`FirstPersonCharacter_C`和`ThirdPersonCharacter_C`，它們分別是我控制的人物和假人。

```cpp
[0x3c05]:
Name: FirstPersonCharacter_C
Class: FirstPersonCharacter_C
ObjectPtr: 0x71694840c0
ClassPtr: 0x7169582700

[0x3c53]:
Name: ThirdPersonCharacter
Class: ThirdPersonCharacter_C
ObjectPtr: 0x7168662630
ClassPtr: 0x716958c100
```

嘗試一：替換Material。( 沒效果 )

```cpp
let ThirdPersonCharacter_Mesh = ThirdPersonCharacter_obj.add(Offset.ACharacterToUSkeletalMeshComponent).readPointer();

let SetMaterial = new NativeFunction(ThirdPersonCharacter_Mesh.readPointer().add(0x598).readPointer(), "void", ["pointer", "int", "pointer"]);

SetMaterial(ThirdPersonCharacter_Mesh, 0, All_Objects["BaseMaterial"]);
// SetMaterial(ThirdPersonCharacter_Mesh, 0, All_Objects["DefaultTextMaterialOpaque"]);
// SetMaterial(ThirdPersonCharacter_Mesh, 0, All_Objects["m_SimpleVolumetricCloud"]);
// SetMaterial(ThirdPersonCharacter_Mesh, 0, All_Objects["DefaultSpriteMaterial"]);
// SetMaterial(ThirdPersonCharacter_Mesh, 0, All_Objects["PokeAHoleMaterial"]);
// SetMaterial(ThirdPersonCharacter_Mesh, 0, All_Objects["OculusMR_ChromaKey"]);
// SetMaterial(ThirdPersonCharacter_Mesh, 0, All_Objects["DebugMeshMaterial"]);
// SetMaterial(ThirdPersonCharacter_Mesh, 0, All_Objects["EmissiveMeshMaterial"]);
```

嘗試二：設置`bDisableDepthTest`為`0`。( 沒效果 )

```cpp
let ThirdPersonCharacter_Mesh = ThirdPersonCharacter_obj.add(Offset.ACharacterToUSkeletalMeshComponent).readPointer();

let GetNumMaterials = new NativeFunction(ThirdPersonCharacter_Mesh.readPointer().add(0x6e8).readPointer(), "int", ["pointer"]);
let GetMaterial = new NativeFunction(ThirdPersonCharacter_Mesh.readPointer().add(0x590).readPointer(), "pointer", ["pointer", "int"]);

let NumMaterials = GetNumMaterials(ThirdPersonCharacter_Mesh)
console.log("NumMaterials: ", NumMaterials);
for(let i = 0; i < NumMaterials; i++) {
    let material = GetMaterial(ThirdPersonCharacter_Mesh, i)
    console.log(`material[${i}]: `, material, getName64(material.add(Offset.UObjectToFNameIndex).readU32()))
    let bDisableDepthTest = material.add(0x1f8);
    bDisableDepthTest.writeU8(bDisableDepthTest.readU8() & (~1));
    console.log("bDisableDepthTest: ", bDisableDepthTest.readU8() & 1)
}
```

嘗試三：利用`SetTexture`隨便設置一個Texture。( 沒效果 )

```cpp
let ThirdPersonCharacter_Mesh = ThirdPersonCharacter_obj.add(Offset.ACharacterToUSkeletalMeshComponent).readPointer();

/* API */
// void SetTexture(Texture* InTexture);// 0x95efb5c
let SetTexture = new NativeFunction(base.add(0x8B2C4CC), "void", ["pointer", "pointer"]);
// Texture* GetTexture();// 0x95efa98
let GetTexture = new NativeFunction(ThirdPersonCharacter_Mesh.readPointer().add(0x1F8).readPointer(), "pointer", ["pointer"]);

/* Prop */
let ThirdPersonCharacter_Mesh = ThirdPersonCharacter_Mesh.add(Offset.USkeletalMeshComponentToSkeletalMesh).readPointer();

SetTexture(ThirdPersonCharacter_Mesh, All_Objects["T_ML_Rubber_Blue_01_N"]);

```

以下部份是賽後的分析。

找資料時發現類似這遊戲的人物透視效果基本上有以下兩種實現思路：

1. 通過Disable Depth Test ( <a href="elink@dbdK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2T1K9h3I4A6j5X3W2D9K9g2)9J5k6h3y4G2L8g2)9J5c8Y4k6A6k6r3g2G2i4K6u0r3b7W2j5I4f1i4V1@1P5e0q4W2y4$3N6e0i4K6u0r3i4K6y4r3N6X3c8Q4y4h3k6K6L8%4g2J5j5$3g2Q4x3@1b7&6z5e0W2S2x3K6M7#2y4e0g2X3y4K6N6U0y4e0V1&6y4h3c8X3y4U0p5^5y4e0t1$3x3X3x3&6z5h3u0W2x3H3`.`.">參考</a> )。
2. 通過Custom Depth ( <a href="elink@32fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4f1H3x3e0x3H3x3o6M7K6x3o6g2Q4x3V1k6S2M7Y4c8A6j5$3I4W2i4K6u0r3k6r3g2@1j5h3W2D9M7#2)9J5c8U0p5J5y4U0l9I4x3e0V1^5y4b7`.`.">參考</a> )。

但嘗試後發現遊戲似乎不是用上述方法實現透視效果的( 不太確定，也有可能是我修改的地方不對 )？

找了很久都沒有什麼思路，最終只好退而求其次，用一種「掩耳盜鈴」的方式來修復，具體思路如下：

- 調用`KismetSystemLibrary`的靜態函數`LineTraceSingle`來獲取`FirstPersonCharacter_C`和`ThirdPersonCharacter_C`之間的`HitResult`。
- 分析`HitResult`，會發現`ThirdPersonCharacter_C`沒有被遮擋時`HitResult.Distance`為`0`，否則為二者之間的距離。
- 因此可以根據`HitResult.Distance`是否為`0`來設置`ThirdPersonCharacter_C`是否渲染到MainPass。

具體調用`LineTraceSingle`、獲取`HitResult.Distance`的代碼如下：

```cpp
function getFirstPersonThirdPersonDistance() {
    // static bool LineTraceSingle(const Object* WorldContextObject, const Vector Start, const Vector End, byte TraceChannel, bool bTraceComplex, out const Actor*[] ActorsToIgnore, byte DrawDebugType, out HitResult OutHit, bool bIgnoreSelf, LinearColor TraceColor, LinearColor TraceHitColor, float DrawTime);// 0x9471770
    let LineTraceSingle = new NativeFunction(base.add(0x8D1AA78), "bool", ["pointer", "float", "float", "float", "float", "float", "float", "uint8", "bool", "pointer", "uint8", "pointer", "bool", "float", "float", "float", "float", "float", "float", "float", "float", "float"]);
    
    let buf1 = Memory.alloc(0x1000);
    let HitResult = Memory.alloc(0x1000);

let start_loc = getActorLocation(FirstPersonCharacter_C_obj);
    let end_loc = getActorLocation(ThirdPersonCharacter_obj);

let r = LineTraceSingle(FirstPersonCharacter_C_obj, start_loc[0], start_loc[1], start_loc[2], end_loc[0], end_loc[1], end_loc[2], 0, 0, buf1, 1, HitResult, 0, 255, 0, 0, 0, 0, 255, 0, 0, 10000);

let HitResult_Distance = HitResult.add(0x8).readFloat();

return HitResult_Distance;
}
```

時機選擇在`Actor`類的`ReceiveTick`函數，在其中判斷是否渲染：

```cpp
function bypassWallhack() {
    let SetRenderInMainPass = new NativeFunction(base.add(0x8AB9E58), "void", ["pointer", "bool"]);
    let ThirdPersonCharacter_Mesh = ThirdPersonCharacter_obj.add(Offset.ACharacterToUSkeletalMeshComponent).readPointer();
		
		// void ReceiveTick(float DeltaSeconds);// 0x6c50500
    Interceptor.attach(base.add(0x6c50500), {
        onEnter: function(args) {
            if (getFirstPersonThirdPersonDistance() == 0) {
                console.log("can see ThirdPerson")
                SetRenderInMainPass(ThirdPersonCharacter_Mesh, 1); 
                
            } else {
                console.log("can not see ThirdPerson")
                SetRenderInMainPass(ThirdPersonCharacter_Mesh, 0);

}
        }
    })
}
```

當然這肯定不是正解，而且效果也非常一般，之後看看有沒有其他大佬分析下正解吧。

### 白色的Cube碰撞異常

子彈射在白色的Cube上不會反彈。

白色的Cube應是就是`EditorCubeN`。

```cpp
[0x3c3e]:
Name: EditorCube8
Class: StaticMeshActor
ObjectPtr: 0x7170c09f40
ClassPtr: 0x717e7c0100

[0x3c26]:
Name: EditorCube10
Class: StaticMeshActor
ObjectPtr: 0x7170c0ba40
ClassPtr: 0x717e7c0100

```

子彈射在`EditorCubeN`上會瞬間消失，但`EditorCubeN`是有被擊退的效果，而子彈射在黑色的Cube上能正常被反彈。

嘗試一：看看是否因為物理模擬未啟用。( 沒效果 )

```cpp
let StaticMeshComponent = All_Objects["EditorCube8"].add(0x220).readPointer();

let SetSimulatePhysics = new NativeFunction(StaticMeshComponent.readPointer().add(0x5D0).readPointer(), "void", ["pointer", "bool"]);
let SetNotifyRigidBodyCollision = new NativeFunction(StaticMeshComponent.readPointer().add(0x658).readPointer(), "void", ["pointer", "bool"]);

SetSimulatePhysics(StaticMeshComponent, 1);
SetNotifyRigidBodyCollision(StaticMeshComponent, 1)
```

嘗試二：設置物理材質的反彈系數為1。( 沒效果 )

```cpp
let StaticMeshComponent = All_Objects["EditorCube8"].add(0x220).readPointer();

/* API */
let GetPhysicalMaterial = new NativeFunction(StaticMeshComponent.readPointer().add(0x2D0).readPointer(), "pointer", ["pointer"]);
let GetNumMaterials = new NativeFunction(StaticMeshComponent.readPointer().add(0x6e8).readPointer(), "int", ["pointer"]);
let GetMaterial = new NativeFunction(StaticMeshComponent.readPointer().add(0x590).readPointer(), "pointer", ["pointer", "int"]);

/* Prop */
let NumMaterials = GetNumMaterials(StaticMeshComponent)
console.log("NumMaterials: ", NumMaterials);
for(let i = 0; i < NumMaterials; i++) {
    let material = GetMaterial(StaticMeshComponent, i)
    let PhysicalMaterial = GetPhysicalMaterial(material);
    let Restitution = PhysicalMaterial.add(0x34);
    Restitution.writeFloat(1)

}
```

嘗試三：設置與所有物體的碰撞響應都為Block( 具體值是2 )。( 沒效果 )

```cpp
let StaticMeshComponent = All_Objects["EditorCube8"].add(0x220).readPointer();

let SetCollisionResponseToAllChannels = new NativeFunction(StaticMeshComponent.readPointer().add(0x850).readPointer(), "void", ["pointer", "uint8"]);

SetCollisionResponseToAllChannels(StaticMeshComponent, 2); // 設置為0,1,3後, Cube會掉到地底
```

經過上述嘗試，可知子彈消失大概率與Collision無關。

猜測子彈是在擊中`EditorCubeN`時執行了一段Destroy邏輯。

hook `MyProjectProjectile`的`OnHit`，打印調用棧：

```cpp
[onHit] enter:
6f70d20aac is in libUE4.so offset: 0x6713aac
6f71110b7c is in libUE4.so offset: 0x6b03b7c
6f7125e9ac is in libUE4.so offset: 0x6c519ac
6f7125e7d0 is in libUE4.so offset: 0x6c517d0
6f70139f24 is in libUE4.so offset: 0x5b2cf24  // 1
6f72eb6a8c is in libUE4.so offset: 0x88a9a8c  // 1
6f7356ff04 is in libUE4.so offset: 0x8f62f04  // 0
6f72eb6bc4 is in libUE4.so offset: 0x88a9bc4
6f730c087c is in libUE4.so offset: 0x8ab387c
6f738ee130 is in libUE4.so offset: 0x92e1130
6f71110b7c is in libUE4.so offset: 0x6b03b7c
6f73907350 is in libUE4.so offset: 0x92fa350
6f71110b7c is in libUE4.so offset: 0x6b03b7c
6f71262774 is in libUE4.so offset: 0x6c55774
6f712629f0 is in libUE4.so offset: 0x6c559f0
6f7125d7ec is in libUE4.so offset: 0x6c507ec
[onHit] leave: this.HitComp 0x6f74e76428
```

Destroy邏輯可能就在其中，但沒時間看了。。

以下部份是賽後的分析。

`OnHit`最後調會`return sub_88A8D2C((__int64)v4, 0, 1)`，而`sub_88A8D2C`函數如下。

`about_ActorDestroying`中有`"ActorDestroying"`字符串，猜測會不會就是那段Destroy邏輯。

![](upload/attach/202504/946537_QCYUM3BQ24HZGYT.webp)

嘗試直接patch掉該函數，使其固定返回`1`。

```cpp
Interceptor.replace(base.add(0x88A8D2C), new NativeCallback(() => {
    console.log("call 88A8D2C");
    return 1;
}, "int", []));
```

結果是射到`EditorCubeN`時也會正常反彈，成功修復該異常點。

### 其他異常

在測試過程中還發現以下一些不確定算不算異常點的：

- 子彈要射到角色的腳底才會與角色發生碰撞，射在其他位置會直接穿過。
- 有時候射著射著人物就飛高高了。

## 完整代碼

`frida -U -f com.ACE2025.Game -l final.js`

```cpp

let GWorld = null;
let GName = null;
let GObject = null;

let Offset = {
    //Class: UWorld
    UWorldToPersistentLevel: 0x58,

// Class: ULevel
    ULevelToActors: 0xa0,

// Class: FNamePool
    GNamesToFNamePool: 0x38,
    FNamePoolToCurrentBlock: 0x0,

//Class: UObject
    UObjectToClassPrivate: 0x10,
    UObjectToFNameIndex: 0x18,
    UObjectToOuterPrivate: 0x20,

//Class: FUObjectArray
    FUObjectArrayToTUObjectArray: 0x10,

//Class: TUObjectArray
    TUObjectArrayToNumElements: 0x14,

// Global
    FUObjectItemPadd: 0x0,
    FUObjectItemSize: 0x18,

// Class: AActor
    AActorToRootComponent: 0x130,

// Class: USceneComponent
    USceneComponentToRelativeLocation: 0x11c,

// Class: ACharacter
    ACharacterToUSkeletalMeshComponent: 0x280,

// Class: USkeletalMeshComponent
    USkeletalMeshComponentToSkeletalMesh: 0x478,
    USkeletalMeshComponentToUMaterialInterface: 0x448,

// class: USkeletalMesh
    USkeletalMeshToFSkeletalMaterial: 0xd8
}

function startUE4(base) {
    console.log("UE4.base: ", base);

/* Utils area */
    // 設置三件套
    function setupUE4() {
        GWorld = base.add(0xAFAC398).readPointer();
        GName = base.add(0xADF07C0);
        GObject = base.add(0xAE34A98);
    }

function getName64(idx) {
        var ComparisonIndex = idx;

var FNameEntryAllocator = GName.add(0x38);   // 64位的FNameEntryAllocator偏移為0x38
    
        var FNameBlockOffsetBits = 16
        var FNameBlockOffsets = 65536
    
        var Block = ComparisonIndex >> FNameBlockOffsetBits
        var Offset = ComparisonIndex & (FNameBlockOffsets - 1)
    
        var Blocks_Offset = 0x8
        var Blocks = FNameEntryAllocator.add(Blocks_Offset)
    
        var FNameEntry = Blocks.add(Block * Process.pointerSize).readPointer().add(Offset * 2)
    
        var FNameEntryHeader = FNameEntry.readU16()
    
        // console.log("FNameEntry: ", hexdump(FNameEntry));
    
        var isWide = FNameEntryHeader & 1
        var Len = FNameEntryHeader >> 6
    
        // if (0 == isWide) {
        //     console.log(`\x1b[32m[+] ${FNameEntry.add(2).readCString(Len)}\x1b[0m`)
        // }
        return FNameEntry.add(2).readCString(Len);
    }

let ThirdPersonCharacter_obj = null;
    let FirstPersonCharacter_C_obj = null;

let All_Objects = {}

// 遍歷UObjectArray
    function travUObjectArray() {
        let TUObjectArray = GObject.add(Offset.FUObjectArrayToTUObjectArray);
        let Objects = TUObjectArray.readPointer().readPointer();

for(let i = 0;; i++) {
            try {
                let objectItem = Objects.add(i * Offset.FUObjectItemSize).add(Offset.FUObjectItemPadd);
                let obj = objectItem.readPointer();
                let objNameIdx = obj.add(Offset.UObjectToFNameIndex).readU32();
                let objName = getName64(objNameIdx);

All_Objects[objName] = obj;
                if (objName == "ThirdPersonCharacter") {
                    ThirdPersonCharacter_obj = obj;
                    // console.log("ThirdPersonCharacter_obj: ", ptr(obj));
                }

if (objName == "FirstPersonCharacter_C") {
                    FirstPersonCharacter_C_obj = obj;
                    // console.log("FirstPersonCharacter_C_obj: ", ptr(obj));
                }

} catch (error) {
                console.log(error);
                break
            }
        }

}

function getActorLocation(actor) {
        let RootComponent = ptr(actor).add(Offset.AActorToRootComponent).readPointer();
        let RelativeLocation = RootComponent.add(Offset.USceneComponentToRelativeLocation);
        let x = RelativeLocation.add(0 * 4).readFloat()
        let y = RelativeLocation.add(1 * 4).readFloat()
        let z = RelativeLocation.add(2 * 4).readFloat()
     
        return [x, y, z]
    }

function getFirstPersonThirdPersonDistance() {
        // static bool LineTraceSingle(const Object* WorldContextObject, const Vector Start, const Vector End, byte TraceChannel, bool bTraceComplex, out const Actor*[] ActorsToIgnore, byte DrawDebugType, out HitResult OutHit, bool bIgnoreSelf, LinearColor TraceColor, LinearColor TraceHitColor, float DrawTime);// 0x9471770
        let LineTraceSingle = new NativeFunction(base.add(0x8D1AA78), "bool", ["pointer", "float", "float", "float", "float", "float", "float", "uint8", "bool", "pointer", "uint8", "pointer", "bool", "float", "float", "float", "float", "float", "float", "float", "float", "float"]);
    
        let buf1 = Memory.alloc(0x1000);
        let HitResult = Memory.alloc(0x1000);

let start_loc = getActorLocation(FirstPersonCharacter_C_obj);
        let end_loc = getActorLocation(ThirdPersonCharacter_obj);

let r = LineTraceSingle(FirstPersonCharacter_C_obj, start_loc[0], start_loc[1], start_loc[2], end_loc[0], end_loc[1], end_loc[2], 0, 0, buf1, 1, HitResult, 0, 255, 0, 0, 0, 0, 255, 0, 0, 10000);
        let HitResult_Distance = HitResult.add(0x8).readFloat();

return HitResult_Distance;
    }

function hook_utf16_cmp() {
        Interceptor.attach(base.add(0x680B790), {
            onEnter: function(args) {
                this.a1 = args[1];
                // console.log("a0: ", args[0].readUtf16String());
                // console.log("a1: ", args[1].readUtf16String());
            },
            onLeave: function(retval) {
                if (this.a1.readUtf16String() == "EditorCube8") {
                    retval.replace(5);
                }
                // console.log("res: ", retval);

}
        })
    }
    
    function hook_process_before_shoot() {
        Interceptor.attach(base.add(0x670F110), {
            onEnter: function(args) {
                let val = args[0].add(0x528).readU8();
                args[0].add(0x528).writeU8(val | 1);
                console.log("[process_before_shoot] a1[0x14A] & 1: ", args[0].add(0x528).readU8() & 1)
            },
            onLeave: function(retval) {
                
                
            }
        })
    }

function fix_MuzzleLocation() {

Interceptor.attach(base.add(0x670F110), {
            onEnter: function(args) {
                console.log("[process_before_shoot]");

/* API */
                // void K2_SetRelativeRotation(Rotator NewRotation, bool bSweep, out HitResult SweepHitResult, bool bTeleport);// 0x9597380
                let K2_SetRelativeRotation = new NativeFunction(base.add(0x8AE6F00), "void", ["pointer", "float", "float", "float", "bool", "pointer", "bool"]);

K2_SetRelativeRotation(All_Objects["MuzzleLocation"], 0, 90, 0, 0, ptr(0), 0);

/* Prop */
                let RelativeLocation = All_Objects["MuzzleLocation"].add(0x11c);
                let RelativeRotation = All_Objects["MuzzleLocation"].add(0x128);

// console.log("location: ", JSON.stringify(readVector(RelativeLocation)))
                // console.log("rotation: ", JSON.stringify(readVector(RelativeRotation)))

// Replace
                let MuzzleLocation = args[0].add(0x4D8)
                MuzzleLocation.writePointer(All_Objects["MuzzleLocation"])
                
            },
            onLeave: function(retval) {

}
        })
    }

function fix_EditorCubeN_bullet_problem() {
        Interceptor.replace(base.add(0x88A8D2C), new NativeCallback(() => {
            return 1;
        }, "int", []));
    }

function bypassWallhack() {
        let SetRenderInMainPass = new NativeFunction(base.add(0x8AB9E58), "void", ["pointer", "bool"]);
        let ThirdPersonCharacter_Mesh = ThirdPersonCharacter_obj.add(Offset.ACharacterToUSkeletalMeshComponent).readPointer();

Interceptor.attach(base.add(0x6c50500), {
            onEnter: function(args) {
                if (getFirstPersonThirdPersonDistance() == 0) {
                    console.log("can see ThirdPerson")
                    SetRenderInMainPass(ThirdPersonCharacter_Mesh, 1); 
                    
                } else {
                    console.log("can not see ThirdPerson")
                    SetRenderInMainPass(ThirdPersonCharacter_Mesh, 0);

}
            }
        })
    }

/* call area */
    setupUE4();
    travUObjectArray();
    
    hook_utf16_cmp();                   // bypass: aimbot
    hook_process_before_shoot();        // bypass: rand bullet shoot location (fixed )
    fix_EditorCubeN_bullet_problem();   // bypass: EditorCubeN problem
    fix_MuzzleLocation();               // bypass: fix and replace the right MuzzleLocation
    bypassWallhack();                   // bypass: fix wallhack in a different way

}
function hook_pthread() {
    var pthread_create_addr = Module.findExportByName(null, 'pthread_create');
    console.log("pthread_create_addr,", pthread_create_addr);

var pthread_create = new NativeFunction(pthread_create_addr, "int", ["pointer", "pointer", "pointer", "pointer"]);

}
function main() {
    
    hook_pthread();
    setTimeout(() => {
        startUE4(Module.findBaseAddress("libUE4.so"));
    }, 3500);
}
setImmediate(main)
```

## 結語

今年跟上年一樣是UE4的題型，猜到了會出UE4，賽前本想找些遊戲來練練手，但一直沒找到合適的，只能說可惜了。這也導致了比賽前2天基本都在熟悉UE4，直到最後也沒有完整地修復幾個異常點。

本以為決賽無望的，沒想到運氣挺好居然進了，算是圓了上一年的遺憾吧。

登录后可查看完整内容

传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！！

#基础理论 #逆向分析

最新回复 (17)
.KK 雪币： 4488 活跃值： (10810) 能力值： ( LV3，RANK：20 ) 在线值：发帖 6 回帖 63 粉丝 62 关注私信	.KK 2 楼 tql~ 2025-4-14 10:10 0
ngiokweng 雪币： 4026 活跃值： (7881) 能力值： ( LV12，RANK：280 ) 在线值：发帖 19 回帖 172 粉丝 297 关注私信	ngiokweng 5 3 楼 .KK tql~ 2025-4-14 10:15 0
陈可牛雪币： 6559 活跃值： (6677) 能力值： ( LV5，RANK：76 ) 在线值：发帖 3 回帖 111 粉丝 37 关注私信	陈可牛 1 4 楼后续方向应该还是游戏吧 2025-4-14 10:22 0
ngiokweng 雪币： 4026 活跃值： (7881) 能力值： ( LV12，RANK：280 ) 在线值：发帖 19 回帖 172 粉丝 297 关注私信	ngiokweng 5 5 楼陈可牛后续方向应该还是游戏吧[em_065] 希望是吧 2025-4-14 10:30 0
安卓逆向test 雪币： 499 能力值： ( LV1，RANK：0 ) 在线值：发帖 10 回帖 47 粉丝 65 关注私信	安卓逆向test 6 楼好家伙，原来这个比赛已经开始了吗，不过是ue游戏我也不会搞 2025-4-14 10:30 0
ngiokweng 雪币： 4026 活跃值： (7881) 能力值： ( LV12，RANK：280 ) 在线值：发帖 19 回帖 172 粉丝 297 关注私信	ngiokweng 5 7 楼安卓逆向test 好家伙，原来这个比赛已经开始了吗，不过是ue游戏我也不会搞昨天剛比完決賽 2025-4-14 10:39 0
Kevin· 雪币： 245 活跃值： (115) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 11 粉丝 4 关注私信	Kevin· 8 楼太强了大佬 2025-4-14 14:55 0
wx_Dispa1r 雪币： 1953 活跃值： (4292) 能力值： ( LV4，RANK：55 ) 在线值：发帖 5 回帖 136 粉丝 4 关注私信	wx_Dispa1r 9 楼太强了老哥，能分享下初赛和决赛的附件吗 2025-4-15 10:51 0
ngiokweng 雪币： 4026 活跃值： (7881) 能力值： ( LV12，RANK：280 ) 在线值：发帖 19 回帖 172 粉丝 297 关注私信	ngiokweng 5 10 楼 wx_Dispa1r 太强了老哥，能分享下初赛和决赛的附件吗文件有點大, 我放網盤了: 初賽: 84bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6H3j5h3&6Q4x3X3g2T1j5h3W2V1N6g2)9J5k6h3y4G2L8g2)9J5c8Y4y4Q4x3V1j5I4K9p5#2r3j5g2m8n7k6q4)9J5k6r3#2F1K9e0k6j5f1o6y4m8e0s2W2z5N6p5y4m8i4K6y4r3M7s2N6V1i4K6y4p5y4e0c8C8P5l9`.`. 決賽: bb4K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6H3j5h3&6Q4x3X3g2T1j5h3W2V1N6g2)9J5k6h3y4G2L8g2)9J5c8Y4y4Q4x3V1j5I4y4#2p5J5K9Y4c8Y4h3i4Z5@1k6X3g2B7d9i4k6t1k6$3V1$3x3V1q4z5k6#2)9K6c8Y4m8%4k6q4)9K6c8r3A6Y4z5r3V1`. 2025-4-15 10:58 1
wx_Dispa1r 雪币： 1953 活跃值： (4292) 能力值： ( LV4，RANK：55 ) 在线值：发帖 5 回帖 136 粉丝 4 关注私信	wx_Dispa1r 11 楼 ngiokweng 文件有點大, 我放網盤了: 初賽: fa8K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6H3j5h3&6Q4x3X3g2T1j5h3W2V1N6g2)9J5k6h3y4G2L8g2)9J5c8Y4y4Q4x3V1j5I4K9p5#2r3j5g2m8n7k6q4)9J5k6r3#2F1K9e0k6j5f1o6y4m8e0s2W2z5N6p5y4m8i4K6y4r3M7s2N6V1i4K6y4p5y4e0c8C8P5l9`.`. 決賽: 00eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6H3j5h3&6Q4x3X3g2T1j5h3W2V1N6g2)9J5k6h3x3`. ... 谢谢~ 2025-4-15 11:06 0
灬哈密瓜雪币： 3645 活跃值： (4006) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 57 粉丝 4 关注私信	灬哈密瓜 12 楼 ngiokweng 文件有點大, 我放網盤了: 初賽: 決賽: ... 感谢最后于 2025-4-15 15:53 被灬哈密瓜编辑，原因： 2025-4-15 15:51 0
嘎嘎真的很棒雪币： 716 活跃值： (3797) 能力值： ( LV3，RANK：30 ) 在线值：发帖 8 回帖 161 粉丝 6 关注私信	嘎嘎真的很棒 13 楼师傅，运行 ./ue4dumper64 --sdku --newue --gname 0xADF07C0 --guobj 0xAE34A98 --package com.ACE2025.Game 输出 Process name: com.ACE2025.Game, Pid: 2940 Base Address of libUE4.so Found At 73cdeb3000 Dumping SDK List Objects Counts: 15612 就一直卡着不动了，没啥反应，设备问题吗还是。 2025-4-16 16:10 0
ngiokweng 雪币： 4026 活跃值： (7881) 能力值： ( LV12，RANK：280 ) 在线值：发帖 19 回帖 172 粉丝 297 关注私信	ngiokweng 5 14 楼嘎嘎真的很棒师傅，运行 ./ue4dumper64 --sdku --newue --gname 0xADF07C0 --guobj 0xAE34A98 --package com.ACE2025.Game ... 我也遇過這問題, 重試幾次或者重開機看看吧, 不行的話用frida版本的ue4dumper: b57K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6Z5j5h3y4C8j5$3q4@1L8h3I4Q4x3V1k6X3M7X3W2V1j5g2)9J5k6s2g2W2y4r3c8#2L8i4m8Q4x3U0k6F1j5Y4y4H3i4K6y4n7i4K6t1^5i4@1f1&6i4K6R3H3i4K6V1&6i4@1f1#2i4K6R3H3i4K6S2n7i4@1f1^5i4K6R3J5i4@1q4r3i4@1f1#2i4@1q4q4i4K6W2m8i4@1f1#2i4K6S2r3i4@1q4r3i4@1f1@1i4@1u0n7i4@1p5#2i4K6t1&6 2025-4-16 16:16 0
嘎嘎真的很棒雪币： 716 活跃值： (3797) 能力值： ( LV3，RANK：30 ) 在线值：发帖 8 回帖 161 粉丝 6 关注私信	嘎嘎真的很棒 15 楼 ngiokweng 我也遇過這問題, 重試幾次或者重開機看看吧, 不行的話用frida版本的ue4dumper: bb2K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6Z5j5h3y4C8j5$3q4@1L8h3I4Q4x3V1k6X3M7X3W2V1j5g2)9J5k6s2g2W2y4r3c8#2L8i4l9`. (這個肯定可以) 可以了师傅，感谢 2025-4-16 21:24 0
xxxxxxxxxoo 雪币： 2043 活跃值： (365) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 27 粉丝 0 关注私信	xxxxxxxxxoo 16 楼我觉得游戏安全这个事情真的很难做好，因为写挂的只需要攻破某一些点就可以取得不对称的优势。而防御的，是要防范全部。而且防御方，需要游戏的玩家配合才能做到完善的防御，但是玩家往往是希望开挂的那一方，别人根本不会配合游戏厂商防御。 2025-4-17 04:40 0
MsScotch 雪币： 4189 活跃值： (4946) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 394 粉丝 5 关注私信	MsScotch 17 楼有lanzou 盘么，BD是真的龟速啊 2025-4-18 08:31 0
x1aob1n 雪币： 3 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 6 粉丝 1 关注私信	x1aob1n 18 楼嘎嘎真的很棒师傅，运行 ./ue4dumper64 --sdku --newue --gname 0xADF07C0 --guobj 0xAE34A98 --package com.ACE2025.Game ... 要用v0.21的newue+参数，v0.20的newue就是会卡住 2026-1-11 15:32 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复