.text:0100367A __stdcall StartGame() proc near ; CODE XREF: FLocalButton(x)+CAp
.text:0100367A ; DoPref()+33j
.text:0100367A ; MainWndProc(x,x,x,x)+2CAp
.text:0100367A ; MainWndProc(x,x,x,x):loc_1001EC8p
.text:0100367A ; WinMain(x,x,x,x)+15Dp
.text:0100367A mov eax, dword_10056AC
.text:0100367F mov ecx, uValue
.text:01003685 push ebx
.text:01003686 push esi
.text:01003687 push edi
.text:01003688 xor edi, edi
.text:0100368A cmp eax, _xBoxMac
.text:01003690 mov _fTimer, edi
.text:01003696 jnz short loc_10036A4
.text:01003696
.text:01003698 cmp ecx, _yBoxMac
.text:0100369E jnz short loc_10036A4
.text:0100369E
.text:010036A0 push 4
.text:010036A2 jmp short loc_10036A6
.text:010036A2
.text:010036A4 ; ---------------------------------------------------------------------------
.text:010036A4
.text:010036A4 loc_10036A4: ; CODE XREF: StartGame()+1Cj
.text:010036A4 ; StartGame()+24j
.text:010036A4 push 6
.text:010036A4
.text:010036A6
.text:010036A6 loc_10036A6: ; CODE XREF: StartGame()+28j
.text:010036A6 pop ebx
.text:010036A7 mov _xBoxMac, eax
.text:010036AC mov _yBoxMac, ecx
.text:010036B2 call ClearField()
.text:010036B2
.text:010036B7 mov eax, dword_10056A4
.text:010036BC mov _iButtonCur, edi
.text:010036C2 mov _cBombStart, eax
.text:010036C2
.text:010036C7
.text:010036C7 loc_10036C7: ; CODE XREF: StartGame()+74j
.text:010036C7 ; StartGame()+89j
.text:010036C7 push _xBoxMac
.text:010036CD call Rnd(x)
.text:010036CD
.text:010036D2 push _yBoxMac
.text:010036D8 mov esi, eax
.text:010036DA inc esi
.text:010036DB call Rnd(x)
.text:010036DB
.text:010036E0 inc eax
.text:010036E1 mov ecx, eax
.text:010036E3 shl ecx, 5
.text:010036E6 test byte ptr _rgBlk[ecx+esi], 80h
.text:010036EE jnz short loc_10036C7
.text:010036EE
.text:010036F0 shl eax, 5
.text:010036F3 lea eax, _rgBlk[eax+esi]
.text:010036FA or byte ptr [eax], 80h
.text:010036FD dec _cBombStart
.text:01003703 jnz short loc_10036C7
.text:01003703
.text:01003705 mov ecx, _yBoxMac
.text:0100370B imul ecx, _xBoxMac
.text:01003712 mov eax, dword_10056A4
.text:01003717 sub ecx, eax ; int
.text:01003719 push edi
.text:0100371A mov _cSec, edi
.text:01003720 mov _cBombStart, eax
.text:01003725 mov _cBombLeft, eax
.text:0100372A mov _cBoxVisit, edi
.text:01003730 mov _cBoxVisitMac, ecx
.text:01003736 mov _fStatus, 1
.text:01003740 call UpdateBombCount(x)
.text:01003740
.text:01003745 push ebx ; int
.text:01003746 call AdjustWindow(x)
.text:01003746
.text:0100374B pop edi
.text:0100374C pop esi
.text:0100374D pop ebx
.text:0100374E retn
.text:0100374E
.text:0100374E __stdcall StartGame() endp
//检查当前扫雷进程是否运行
DWORD FindProcess(const char *szName)
{
DWORD pid = 0;
if(!szName)
goto QUIT;
PROCESSENTRY32 process = {.dwSize = sizeof(PROCESSENTRY32)};
HANDLE hss = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
Process32First(hss,&process);
do
{
if(!strcmp(process.szExeFile,szName))
{
pid = process.th32ProcessID;
break;
}
}while(Process32Next(hss,&process));
CloseHandle(hss);
QUIT:
return pid;
}
//检查将要fix的扫雷版本是否正确
bool IsSignWM(DWORD pid)
{
bool bSuccess = false;
HANDLE hp = NULL;
if(!pid)
goto QUIT;
byte bin[SINGSIZE];
hp = OpenProcess(PROCESS_ALL_ACCESS,false,pid);
if(!hp)
goto QUIT;
if(!ReadProcessMemory(hp,(LPCVOID)SIGNADDR,bin,sizeof(bin),\
NULL))
goto QUIT;
if(memcmp(bin,sign,SINGSIZE) == 0)
bSuccess = true;
QUIT:
if(hp)
CloseHandle(hp);
return bSuccess;
}
//将已过时间清零
void ZeroTime(DWORD pid)
{
HANDLE hp = OpenProcess(PROCESS_ALL_ACCESS,false,pid);
if(!hp)
goto QUIT;
int ZeroSec = 0;
if(!WriteProcessMemory(hp,(LPVOID)p_cSec,&ZeroSec,sizeof(int),\
NULL))
goto QUIT;
puts("Zero Time Success!");
QUIT:
if(hp)
CloseHandle(hp);
return;
}
//显示地雷的布局
void ShowBombs(DWORD pid)
{
HANDLE hp = OpenProcess(PROCESS_ALL_ACCESS,false,pid);
if(!hp)
goto QUIT;
int xMax,yMax,BombCount;
if(!ReadProcessMemory(hp,(LPCVOID)p_xBoxMac,&xMax,sizeof(int),\
NULL))
goto QUIT;
if(!ReadProcessMemory(hp,(LPCVOID)p_yBoxMac,&yMax,sizeof(int),\
NULL))
goto QUIT;
if(!ReadProcessMemory(hp,(LPCVOID)p_cBombStart,&BombCount,\
sizeof(int),NULL))
goto QUIT;
printf("Bomb Count is %d , xmax is %d , ymax is %d\n",\
BombCount,xMax,yMax);
//byte Bombs[xMax][yMax];
//byte Bombs[9][9];
byte *Bombs = (byte*)malloc((xMax<<5)+yMax+1);
if(!Bombs)
goto QUIT;
//DWORD tmp = (DWORD)p_rbBlk + 0x21;
if(!ReadProcessMemory(hp,(LPCVOID)p_rbBlk,Bombs,(xMax<<5)+yMax+1,\
NULL))
goto QUIT;
for(int x = 1;x <= yMax;++x)
{
for(int y = 1;y <= xMax;++y)
{
if(Bombs[(x<<5)+y]/*Bombs[x][y]*/ & 0x80)
putchar('*');
else
putchar('N');
}
puts("");
}
QUIT:
if(hp)
CloseHandle(hp);
if(Bombs)
free(Bombs);
return;
}
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
