如题,前一段时间跟朋友一起玩完美国际版,最近不大玩了,不过每次更新都帮朋友做双开补丁,但前几天更新后按老方法做完后发现还是不能双开,具体如下:
0043C170 /$ 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]
0043C174 |. 83EC 10 SUB ESP,10
0043C177 |. A3 745D8E00 MOV DWORD PTR DS:[8E5D74],EAX
0043C17C |. 8A4424 1C MOV AL,BYTE PTR SS:[ESP+1C]
0043C180 |. 53 PUSH EBX
0043C181 |. 55 PUSH EBP
0043C182 |. 8B2D 9E5B8E00 MOV EBP,DWORD PTR DS:[8E5B9E]
0043C188 |. 56 PUSH ESI
0043C189 |. 57 PUSH EDI
0043C18A |. 8B3D 9A5B8E00 MOV EDI,DWORD PTR DS:[8E5B9A]
0043C190 |. 84C0 TEST AL,AL
0043C192 |. BE 00000080 MOV ESI,80000000
0043C197 |. 75 05 JNZ SHORT elementc.0043C19E
0043C199 |. BE 0000CE80 MOV ESI,80CE0000
0043C19E |> 33DB XOR EBX,EBX
0043C1A0 |. 84C0 TEST AL,AL
0043C1A2 |. 74 05 JE SHORT elementc.0043C1A9
0043C1A4 |. BB 08000000 MOV EBX,8
0043C1A9 |> 68 80E28900 PUSH elementc.0089E280 ; e
0043C1AE |. 68 34D58900 PUSH elementc.0089D534 ; e
0043C1B3 |. FF15 B8448E00 CALL DWORD PTR DS:[8E44B8] ; USER32.FindWindowW
0043C1B9 |. 85C0 TEST EAX,EAX
0043C1BB 74 1E JE SHORT elementc.0043C1DB
这里以前JE改为JNB就可以了0043C1BD |. 6A 10 PUSH 10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
0043C1BF |. 68 10C08900 PUSH elementc.0089C010 ; |error
0043C1C4 |. 68 44E28900 PUSH elementc.0089E244 ; |game is currently running. you can't start another process!
0043C1C9 |. 6A 00 PUSH 0 ; |hOwner = NULL
0043C1CB |. FF15 50C68200 CALL DWORD PTR DS:[<&USER32.MessageBoxA>] ; \MessageBoxA
0043C1D1 |. 5F POP EDI ; elementc.00400000
0043C1D2 |. 5E POP ESI
0043C1D3 |. 5D POP EBP
0043C1D4 |. 32C0 XOR AL,AL
0043C1D6 |. 5B POP EBX
0043C1D7 |. 83C4 10 ADD ESP,10
0043C1DA |. C3 RETN
0043C1DB |> 8B4C24 24 MOV ECX,DWORD PTR SS:[ESP+24]
0043C1DF |. 6A 00 PUSH 0
0043C1E1 |. 8B15 28D58900 MOV EDX,DWORD PTR DS:[89D528] ; elementc.0089D534
0043C1E7 |. 51 PUSH ECX
0043C1E8 |. 6A 00 PUSH 0
0043C1EA |. 6A 00 PUSH 0
0043C1EC |. 55 PUSH EBP
0043C1ED |. 57 PUSH EDI
0043C1EE |. 6A 00 PUSH 0
0043C1F0 |. 6A 00 PUSH 0
0043C1F2 |. 56 PUSH ESI
0043C1F3 |. 68 80E28900 PUSH elementc.0089E280 ; e
0043C1F8 |. 52 PUSH EDX
0043C1F9 |. 53 PUSH EBX
0043C1FA |. FF15 A4448E00 CALL DWORD PTR DS:[8E44A4] ; elementc.006B0F97
0043C200 |. 33DB XOR EBX,EBX
0043C202 |. 3BC3 CMP EAX,EBX
0043C204 |. 75 0A JNZ SHORT elementc.0043C210
0043C206 |. 5F POP EDI
0043C207 |. 5E POP ESI
0043C208 |. 5D POP EBP
0043C209 |. 32C0 XOR AL,AL
0043C20B |. 5B POP EBX
0043C20C |. 83C4 10 ADD ESP,10
0043C20F |. C3 RETN
0043C210 |> A3 785D8E00 MOV DWORD PTR DS:[8E5D78],EAX
0043C215 |. 8A4424 2C MOV AL,BYTE PTR SS:[ESP+2C]
0043C219 |. 84C0 TEST AL,AL
0043C21B |. 75 61 JNZ SHORT elementc.0043C27E
0043C21D |. 53 PUSH EBX ; /HasMenu
0043C21E |. 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14] ; |
0043C222 |. 56 PUSH ESI ; |Style
0043C223 |. 50 PUSH EAX ; |pRect
0043C224 |. 895C24 1C MOV DWORD PTR SS:[ESP+1C],EBX ; |
0043C228 |. 895C24 20 MOV DWORD PTR SS:[ESP+20],EBX ; |
0043C22C |. 897C24 24 MOV DWORD PTR SS:[ESP+24],EDI ; |
0043C230 |. 896C24 28 MOV DWORD PTR SS:[ESP+28],EBP ; |
0043C234 |. FF15 7CC68200 CALL DWORD PTR DS:[<&USER32.AdjustWindowRect>] ; \AdjustWindowRect
0043C23A |. 8B7424 18 MOV ESI,DWORD PTR SS:[ESP+18]
0043C23E |. 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10]
0043C242 |. 8B7C24 1C MOV EDI,DWORD PTR SS:[ESP+1C]
0043C246 |. 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14]
0043C24A |. 53 PUSH EBX ; /Index
0043C24B |. 8B1D 78C68200 MOV EBX,DWORD PTR DS:[<&USER32.GetSystemMetrics>] ; |USER32.GetSystemMetrics
0043C251 |. 2BF1 SUB ESI,ECX ; |
0043C253 |. 2BF8 SUB EDI,EAX ; |
0043C255 |. FFD3 CALL EBX ; \GetSystemMetrics
0043C257 |. 2BC6 SUB EAX,ESI
0043C259 |. 6A 01 PUSH 1 ; /Index = SM_CYSCREEN
0043C25B |. 99 CDQ ; |
0043C25C |. 2BC2 SUB EAX,EDX ; |
0043C25E |. 8BE8 MOV EBP,EAX ; |
0043C260 |. D1FD SAR EBP,1 ; |
0043C262 |. FFD3 CALL EBX ; \GetSystemMetrics
0043C264 |. 2BC7 SUB EAX,EDI
0043C266 |. 8B0D 785D8E00 MOV ECX,DWORD PTR DS:[8E5D78]
0043C26C |. 99 CDQ
0043C26D |. 2BC2 SUB EAX,EDX
0043C26F |. 6A 00 PUSH 0 ; /Repaint = FALSE
0043C271 |. D1F8 SAR EAX,1 ; |
0043C273 |. 57 PUSH EDI ; |Height
0043C274 |. 56 PUSH ESI ; |Width
0043C275 |. 50 PUSH EAX ; |Y
0043C276 |. 55 PUSH EBP ; |X
0043C277 |. 51 PUSH ECX ; |hWnd => NULL
0043C278 |. FF15 74C68200 CALL DWORD PTR DS:[<&USER32.MoveWindow>] ; \MoveWindow
0043C27E |> 8B5424 28 MOV EDX,DWORD PTR SS:[ESP+28]
0043C282 |. A1 785D8E00 MOV EAX,DWORD PTR DS:[8E5D78]
0043C287 |. 52 PUSH EDX ; /ShowState
0043C288 |. 50 PUSH EAX ; |hWnd => NULL
0043C289 |. FF15 60C68200 CALL DWORD PTR DS:[<&USER32.ShowWindow>] ; \ShowWindow
0043C28F |. 8B0D 785D8E00 MOV ECX,DWORD PTR DS:[8E5D78]
0043C295 |. 51 PUSH ECX ; /hWnd => NULL
0043C296 |. FF15 70C68200 CALL DWORD PTR DS:[<&USER32.UpdateWindow>] ; \UpdateWindow
0043C29C |. 8B15 785D8E00 MOV EDX,DWORD PTR DS:[8E5D78]
0043C2A2 |. 52 PUSH EDX ; /hWnd => NULL
0043C2A3 |. FF15 6CC68200 CALL DWORD PTR DS:[<&USER32.SetForegroundWindow>] ; \SetForegroundWindow
0043C2A9 |. 5F POP EDI
0043C2AA |. 5E POP ESI
0043C2AB |. 5D POP EBP
0043C2AC |. B0 01 MOV AL,1
0043C2AE |. 5B POP EBX
0043C2AF |. 83C4 10 ADD ESP,10
0043C2B2 \. C3 RETN
现在修改后不起作用,一样会弹出那个 error:game is currently running. you can't start another process!的对话框,在命令行下下消息断点然后F9运行(先另外开一个游戏窗口,因为是不让双开的嘛)到了这里被拦住了:
77D504F2 8BFF MOV EDI,EDI
77D504F4 55 PUSH EBP
77D504F5 8BEC MOV EBP,ESP
77D504F7 833D BC04D777 0>CMP DWORD PTR DS:[77D704BC],0
77D504FE 74 24 JE SHORT USER32.77D50524
77D50500 64:A1 18000000 MOV EAX,DWORD PTR FS:[18]
77D50506 6A 00 PUSH 0
77D50508 FF70 24 PUSH DWORD PTR DS:[EAX+24]
77D5050B 68 240BD777 PUSH USER32.77D70B24
77D50510 FF15 C812D177 CALL DWORD PTR DS:[<&KERNEL32.InterlockedCompareExchange>] ; kernel32.InterlockedCompareExchange
77D50516 85C0 TEST EAX,EAX
77D50518 75 0A JNZ SHORT USER32.77D50524
77D5051A C705 200BD777 0>MOV DWORD PTR DS:[77D70B20],1
77D50524 6A 00 PUSH 0
77D50526 FF75 14 PUSH DWORD PTR SS:[EBP+14]
77D50529 FF75 10 PUSH DWORD PTR SS:[EBP+10]
77D5052C FF75 0C PUSH DWORD PTR SS:[EBP+C]
77D5052F FF75 08 PUSH DWORD PTR SS:[EBP+8]
77D50532 E8 2D000000 CALL USER32.MessageBoxExA
77D50537 5D POP EBP
77D50538 C2 1000 RETN 10
77D5053B 90 NOP
77D5053C 90 NOP
红色为断点,文件成了C:\Windows\system32\USER32.DLL,到了这一步说实话我就不明白要怎么弄了,后来在网上找些资料,不太理解,试着ALT+F9,这次那个对话框弹出来了,对话框点确定,到了这里:
0043C1D1 |. 5F POP EDI ; elementc.00400000
0043C1D2 |. 5E POP ESI
0043C1D3 |. 5D POP EBP
0043C1D4 |. 32C0 XOR AL,AL
0043C1D6 |. 5B POP EBX
0043C1D7 |. 83C4 10 ADD ESP,10
0043C1DA |. C3 RETN
再看它上面,也就是原来JE修改成JNB后就能实现双开的跳转,居然又变成JE了(在这之前我已经将JE改成JNB并保存了),于是我再次将这里的JE改成JNB,然后保存,但提示是否将未修改的文件保存,居然没有修改,我还是硬着头皮点是,重新运行,结果相同,还是无法双开。
0043C1BB /74 1E JE SHORT elementc.0043C1DB
0043C1BD |. |6A 10 PUSH 10 ; /Style = MB_OK|MB_ICONHAND|MB_APPLMODAL
0043C1BF |. |68 10C08900 PUSH elementc.0089C010 ; |error
0043C1C4 |. |68 44E28900 PUSH elementc.0089E244 ; |game is currently running. you can't start another process!
0043C1C9 |. |6A 00 PUSH 0 ; |hOwner = NULL
0043C1CB |. |FF15 50C68200 CALL DWORD PTR DS:[<&USER32.MessageBoxA>] ; \MessageBoxA
后面的可以看我上面贴的第一段,我其实刚刚开始OD,不太明白,希望能够回复的详细,谢谢。
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!