4.口袋西游怪物周围遍历(01)操作步骤

63 阅读 0 评论 42 点赞

我是靠谱客的博主威武樱桃，最近开发中收集的这篇文章主要介绍4.口袋西游怪物周围遍历(01)操作步骤，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

怪物周围遍历

操作步骤
- 突破口[怪物名称]
- 总结如下

操作步骤

突破口[怪物名称]

在这里插入图片描述
1. 扫描团团兔,扫出来10个3个符合预期,坑爹呢,游戏里肉眼看到都大于3个,很明显游戏字符串应该是UNICODE编码,我说人物名字我怎么找不到呢,回头把人物名称补上.
2. 切换UNICODE编码,扫描看看,1000多个,选几个符合预期的od试试水
在这里插入图片描述
3. 看看字符串是否正确[验证通过]

4. 下访问断点试试

访问断点,写入断点都尝试后,无反应,此路不通,换一个,重复步骤 3

由此可知,团团兔占用6个字节,换个方式扫描

目标字节[E2 56 E2 56 54 51 00 00 00 00 00 00]
这个下断不断,还有脏数据,舍弃[E2 56 E2 56 54 51 00 00 4A 1B CD BD]
在这里插入图片描述
10多个一个一个排除吧,暂时没有好办法

33CD6824 [E2 56 E2 56 54 51 00 00 4A 1B CD BD] 下断不断
02E7CA3C [E2 56 E2 56 54 51 00 00 00 00 00 00] 下断不断
05B0A704 [E2 56 E2 56 54 51 00 00 00 00 00 00] 下断不断
05B13554
05B1377C
0EBB0E10
0EBB0E44 [E2 56 E2 56 54 51 00 00 00 00 00 00] 下断不断
0EBE4A58
0EBE4A8C
0EC20C8C
0EC4DB52
0EC4DE72
0EC4E192
10FFADCC [E2 56 E2 56 54 51 00 00 00 00 00 00] 下断不断
12429BB8 [E2 56 E2 56 54 51 00 00 00 00 00 00] 下断不断
1242DF60
15202A32
15218A02
18F6B4E2
我草 都不行啊

扫出来的都不断,退出游戏重新登陆,再次扫描,看看谁访问了代码
在这里插入图片描述

突破口1
008D0429 - D9 5C 24 28  - fstp dword ptr [esp+28]
008D042D - FF 15 F862BE00  - call dword ptr [ELEMENTCLIENT.EXE+7E62F8]
008D0433 - 66 83 7D 00 00 - cmp word ptr [ebp+00],00 <<
008D0438 - 0F84 B9020000 - je ELEMENTCLIENT.EXE+4D06F7
008D043E - 8B BC 24 D8000000  - mov edi,[esp+000000D8]
突破口2
008D0452 - 85 C0  - test eax,eax
008D0454 - 0F84 98020000 - je ELEMENTCLIENT.EXE+4D06F2
008D045A - 66 8B 4D 00  - mov cx,[ebp+00] <<
008D045E - 8D 44 24 13  - lea eax,[esp+13]
008D0462 - 50 - push eax
突破口3
008D06DC - 8B 88 8C000000  - mov ecx,[eax+0000008C]
008D06E2 - E8 F9430C00 - call ELEMENTCLIENT.EXE+594AE0
008D06E7 - 66 83 7D 00 00 - cmp word ptr [ebp+00],00 <<
008D06EC - 0F85 59FDFFFF - jne ELEMENTCLIENT.EXE+4D044B
008D06F2 - 8B 7C 24 44  - mov edi,[esp+44]

5. 目标 33A3C22C 追踪 ebp寄存器
在这里插入图片描述
6. 如图所示,查看堆栈怪物走到这里人物也走到这里,追人物名称异曲同工

008D03E0  /$  81EC BC000000 sub     esp, 0BC 这里下断点

在这里插入图片描述

7. 如图所示,追eax

8. 公式 [[ecx+C]+0*4] 看起来像数组,Ctrl+F9 追ecx

00417B20  /$  83EC 14       sub     esp, 14
00417B23  |.  A1 1CDFD000   mov     eax, dword ptr [D0DF1C]
00417B28  |.  53            push    ebx
00417B29  |.  57            push    edi
00417B2A  |.  8BF9          mov     edi, ecx                         ;  [[ecx+C]+0*4]
00417B2C  |.  8B48 1C       mov     ecx, dword ptr [eax+1C]
00417B2F  |.  8B51 04       mov     edx, dword ptr [ecx+4]
00417B32  |.  8B4A 08       mov     ecx, dword ptr [edx+8]
00417B35  |.  8B41 1C       mov     eax, dword ptr [ecx+1C]
00417B38  |.  8B11          mov     edx, dword ptr [ecx]
00417B3A  |.  894424 08     mov     dword ptr [esp+8], eax
00417B3E  |.  FF52 4C       call    dword ptr [edx+4C]
00417B41  |.  8B4F 3C       mov     ecx, dword ptr [edi+3C]
00417B44  |.  8B5C24 24     mov     ebx, dword ptr [esp+24]
00417B48  |.  894424 18     mov     dword ptr [esp+18], eax
00417B4C  |.  8B4424 28     mov     eax, dword ptr [esp+28]
00417B50  |.  894424 28     mov     dword ptr [esp+28], eax
00417B54  |.  33C0          xor     eax, eax
00417B56  |.  3BC8          cmp     ecx, eax
00417B58  |.  894424 10     mov     dword ptr [esp+10], eax
00417B5C  |.  894424 14     mov     dword ptr [esp+14], eax
00417B60  |.  0F8E F1000000 jle     00417C57
00417B66  |.  55            push    ebp
00417B67  |.  56            push    esi
00417B68  |.  894424 14     mov     dword ptr [esp+14], eax
00417B6C  |>  8B77 38       /mov     esi, dword ptr [edi+38]
00417B6F  |.  8B4C24 14     |mov     ecx, dword ptr [esp+14]
00417B73  |.  8B4424 18     |mov     eax, dword ptr [esp+18]
00417B77  |.  03F1          |add     esi, ecx
00417B79  |.  8B6E 10       |mov     ebp, dword ptr [esi+10]
00417B7C  |.  3BE8          |cmp     ebp, eax
00417B7E  |.  74 21         |je      short 00417BA1
00417B80  |.  DB87 84040000 |fild    dword ptr [edi+484]
00417B86  |.  8B5C24 2C     |mov     ebx, dword ptr [esp+2C]
00417B8A  |.  D84C24 10     |fmul    dword ptr [esp+10]
00417B8E  |.  E8 FDDC7500   |call    <jmp.&MSVCRT._ftol>
00417B93  |.  8B4C24 30     |mov     ecx, dword ptr [esp+30]
00417B97  |.  896C24 18     |mov     dword ptr [esp+18], ebp
00417B9B  |.  03C8          |add     ecx, eax
00417B9D  |.  894C24 30     |mov     dword ptr [esp+30], ecx
00417BA1  |>  833E 00       |cmp     dword ptr [esi], 0
00417BA4  |.  75 48         |jnz     short 00417BEE
00417BA6  |.  8B4E 04       |mov     ecx, dword ptr [esi+4]
00417BA9  |.  8B57 0C       |mov     edx, dword ptr [edi+C]          ;  ecx=0 [[edx+0*4]] [[edi+C]+0*4]
00417BAC  |.  8B46 14       |mov     eax, dword ptr [esi+14]
00417BAF  |.  8B0C8A        |mov     ecx, dword ptr [edx+ecx*4]      ;  ecx=0 [[edx+0*4]]
00417BB2  |.  85C0          |test    eax, eax
00417BB4  |.  75 04         |jnz     short 00417BBA
00417BB6  |.  8B4424 34     |mov     eax, dword ptr [esp+34]
00417BBA  |>  8B5424 38     |mov     edx, dword ptr [esp+38]
00417BBE  |.  68 0AD7A33D   |push    3DA3D70A
00417BC3  |.  68 000000FF   |push    FF000000
00417BC8  |.  6A 00         |push    0
00417BCA  |.  68 0000803F   |push    3F800000
00417BCF  |.  6A FF         |push    -1
00417BD1  |.  52            |push    edx
00417BD2  |.  68 000000FF   |push    FF000000
00417BD7  |.  6A 01         |push    1
00417BD9  |.  50            |push    eax
00417BDA  |.  8B01          |mov     eax, dword ptr [ecx]            ;  [ecx]
00417BDC  |.  8B4C24 54     |mov     ecx, dword ptr [esp+54]
00417BE0  |.  50            |push    eax
00417BE1  |.  51            |push    ecx
00417BE2  |.  8B4C24 4C     |mov     ecx, dword ptr [esp+4C]
00417BE6  |.  53            |push    ebx
00417BE7  |.  E8 F4874B00   |call    008D03E0

9. 公式 [[ecx+C]+0*4] 看起来像数组,看edi的值[206A9C10] 因为 edi = ecx [00417B20 ]处下断点Ctrl+F9 追ecx 看看ecx是不是等于这个
在这里插入图片描述

0064F6E0  /$  56            push    esi
0064F6E1  |.  57            push    edi
0064F6E2  |.  8BF9          mov     edi, ecx
0064F6E4  |.  33F6          xor     esi, esi
0064F6E6  |.  8B47 54       mov     eax, dword ptr [edi+54]
0064F6E9  |.  85C0          test    eax, eax
0064F6EB  |.  7E 36         jle     short 0064F723
0064F6ED  |.  53            push    ebx
0064F6EE  |.  8B5C24 10     mov     ebx, dword ptr [esp+10]
0064F6F2  |>  8B47 50       /mov     eax, dword ptr [edi+50]         ;  [[[[edi+50]+0*4]+C]+0*4] 051F3638 [[[[051F3638 +50]+0*4]+C]+0*4]
0064F6F5  |.  8B0CB0        |mov     ecx, dword ptr [eax+esi*4]      ;  [[[eax+0*4]+C]+0*4]
0064F6F8  |.  8B91 A4040000 |mov     edx, dword ptr [ecx+4A4]
0064F6FE  |.  8B81 A0040000 |mov     eax, dword ptr [ecx+4A0]
0064F704  |.  52            |push    edx
0064F705  |.  8B91 9C040000 |mov     edx, dword ptr [ecx+49C]
0064F70B  |.  50            |push    eax
0064F70C  |.  8B81 98040000 |mov     eax, dword ptr [ecx+498]
0064F712  |.  52            |push    edx
0064F713  |.  50            |push    eax
0064F714  |.  53            |push    ebx
0064F715  |.  E8 0684DCFF   |call    00417B20                        ;  [[ecx+C]+0*4] 256FF490 [[256FF490+C]+0*4]
0064F71A  |.  8B47 54       |mov     eax, dword ptr [edi+54]
0064F71D  |.  46            |inc     esi
0064F71E  |.  3BF0          |cmp     esi, eax
0064F720  |.^ 7C D0         jl      short 0064F6F2
0064F722  |.  5B            pop     ebx
0064F723  |>  C747 54 00000>mov     dword ptr [edi+54], 0
0064F72A  |.  8B0D 1CDFD000 mov     ecx, dword ptr [D0DF1C]          ;  ELEMENTC.00D11A50
0064F730  |.  6A 00         push    0
0064F732  |.  E8 C992DFFF   call    00448A00
0064F737  |.  8BC8          mov     ecx, eax
0064F739  |.  E8 D2D93500   call    009AD110
0064F73E  |.  5F            pop     edi
0064F73F  |.  B0 01         mov     al, 1
0064F741  |.  5E            pop     esi
0064F742  .  C2 0400       retn    4

得出公式[[[[edi+50]+04]+C]+04]

10. 公式[[[[edi+50]+04]+C]+04] ,如下所示公式转变为[[[[ecx +50]+04]+C]+04] 追edi就是追ecx Ctrl+F9 返回上一层

0064F6E0  /$  56            push    esi
0064F6E1  |.  57            push    edi
0064F6E2  |.  8BF9          mov     edi, ecx >>>>> 
0064F6E4  |.  33F6          xor     esi, esi
0064F6E6  |.  8B47 54       mov     eax, dword ptr [edi+54]
0064F6E9  |.  85C0          test    eax, eax
0064F6EB  |.  7E 36         jle     short 0064F723
0064F6ED  |.  53            push    ebx
0064F6EE  |.  8B5C24 10     mov     ebx, dword ptr [esp+10]
0064F6F2  |>  8B47 50       /mov     eax, dword ptr [edi+50]         ;  [[[[edi+50]+0*4]+C]+0*4] 051F3638 [[[[051F3638 +50]+0*4]+C]+0*4]
0064F6F5  |.  8B0CB0        |mov     ecx, dword ptr [eax+esi*4]      ;  [[[eax+0*4]+C]+0*4]
0064F6F8  |.  8B91 A4040000 |mov     edx, dword ptr [ecx+4A4]

11. 返回到如图所示公式变为 dd [[[[[[ebp+8]+30]+50]+04]+C]+04]
在这里插入图片描述

0045ADEB  |.  8B4D 08       mov     ecx, dword ptr [ebp+8]
0045ADEE  |.  53            push    ebx
0045ADEF  |.  8B49 30       mov     ecx, dword ptr [ecx+30]          ;  dd [[[[[[ebp+8]+30]+50]+0*4]+C]+0*4]
0045ADF2  |.  E8 E9481F00   call    0064F6E0                         ;  怪物数组遍历

esp和ebp相差很大,这里ebp非栈底乃普通寄存器这里需要追ebp
在这里插入图片描述
如下所示,公式替换为dd [[[[[[ecx+8]+30]+50]+04]+C]+04] 追ecx即可

0045AA30  /$  83EC 44       sub     esp, 44
0045AA33  |.  53            push    ebx
0045AA34  |.  55            push    ebp
0045AA35  |.  8BE9          mov     ebp, ecx>>>>> dd [[[[[[ecx+8]+30]+50]+0*4]+C]+0*4]
0045AA37  |.  56            push    esi
0045AA38  |.  57            push    edi
0045AA39  |.  8B4D 08       mov     ecx, dword ptr [ebp+8]
0045AA3C  |.  85C9          test    ecx, ecx
0045AA3E  |.  0F84 80060000 je      0045B0C4
0045AA44  |.  E8 0786FEFF   call    00443050
0045AA49  |.  8A0D AC19D100 mov     cl, byte ptr [D119AC]
0045AA4F  |.  8BD0          mov     edx, eax
0045AA51  |.  A1 1CDFD000   mov     eax, dword ptr [D0DF1C]
0045AA56  |.  895424 18     mov     dword ptr [esp+18], edx
0045AA5A  |.  84C9          test    cl, cl
0045AA5C  |.  8B78 04       mov     edi, dword ptr [eax+4]
0045AA5F  |.  8B70 08       mov     esi, dword ptr [eax+8]
0045AA62  |.  8B58 14       mov     ebx, dword ptr [eax+14]
0045AA65  |.  897C24 14     mov     dword ptr [esp+14], edi
0045AA69  |.  897424 10     mov     dword ptr [esp+10], esi
0045AA6D  |.  0F85 A9050000 jnz     0045B01C
0045AA73  |.  8B8D C0000000 mov     ecx, dword ptr [ebp+C0]
0045AA79  |.  83F9 02       cmp     ecx, 2
0045AA7C  |.  75 11         jnz     short 0045AA8F
0045AA7E  |.  85D2          test    edx, edx
0045AA80  |.  74 0D         je      short 0045AA8F
0045AA82  |.  80BA 8C080000>cmp     byte ptr [edx+88C], 0
0045AA89  |.  0F84 8D050000 je      0045B01C
0045AA8F  |>  8B40 18       mov     eax, dword ptr [eax+18]
0045AA92  |.  8A90 94000000 mov     dl, byte ptr [eax+94]
0045AA98  |.  84D2          test    dl, dl
0045AA9A  |.  74 40         je      short 0045AADC
0045AA9C  |.  83F9 02       cmp     ecx, 2
0045AA9F  |.  75 3B         jnz     short 0045AADC
0045AAA1  |.  8B0D 94DFD000 mov     ecx, dword ptr [D0DF94]
0045AAA7  |.  85C9          test    ecx, ecx
0045AAA9  |.  74 31         je      short 0045AADC
0045AAAB  |.  A1 88DFD000   mov     eax, dword ptr [D0DF88]
0045AAB0  |.  83F8 0A       cmp     eax, 0A
0045AAB3  |.  7D 1B         jge     short 0045AAD0
0045AAB5  |.  8B15 90DFD000 mov     edx, dword ptr [D0DF90]
0045AABB  |.  8D0440        lea     eax, dword ptr [eax+eax*2]
0045AABE  |.  03D1          add     edx, ecx
0045AAC0  |.  8D0480        lea     eax, dword ptr [eax+eax*4]
0045AAC3  |.  8D0480        lea     eax, dword ptr [eax+eax*4]
0045AAC6  |.  D1E0          shl     eax, 1
0045AAC8  |.  3BD0          cmp     edx, eax
0045AACA  |.  0F8F F4050000 jg      0045B0C4
0045AAD0  |>  33C0          xor     eax, eax
0045AAD2  |.  A3 90DFD000   mov     dword ptr [D0DF90], eax
0045AAD7  |.  A3 88DFD000   mov     dword ptr [D0DF88], eax
0045AADC  |>  E8 1F3F5100   call    0096EA00
0045AAE1  |.  8BCD          mov     ecx, ebp
0045AAE3  |.  894424 1C     mov     dword ptr [esp+1C], eax
0045AAE7  |.  E8 E4050000   call    0045B0D0
0045AAEC  |.  84C0          test    al, al
0045AAEE  |.  75 1B         jnz     short 0045AB0B
0045AAF0  |>  68 CC0ACA00   push    00CA0ACC                         ;  ASCII "CECGameRun::Render(), Failed to begin render!"
0045AAF5  |.  6A 01         push    1
0045AAF7  |.  E8 343F5100   call    0096EA30
0045AAFC  |.  83C4 08       add     esp, 8
0045AAFF  |.  32C0          xor     al, al
0045AB01  |.  5F            pop     edi
0045AB02  |.  5E            pop     esi
0045AB03  |.  5D            pop     ebp
0045AB04  |.  5B            pop     ebx
0045AB05  |.  83C4 44       add     esp, 44
0045AB08  |.  C2 0400       retn    4
0045AB0B  |>  A1 1CDFD000   mov     eax, dword ptr [D0DF1C]
0045AB10  |.  8B48 18       mov     ecx, dword ptr [eax+18]
0045AB13  |.  8A91 C4000000 mov     dl, byte ptr [ecx+C4]
0045AB19  |.  84D2          test    dl, dl
0045AB1B  |.  0F84 99000000 je      0045ABBA
0045AB21  |.  8B50 14       mov     edx, dword ptr [eax+14]
0045AB24  |.  83C6 10       add     esi, 10
0045AB27  |.  B9 07000000   mov     ecx, 7
0045AB2C  |.  8D7C24 38     lea     edi, dword ptr [esp+38]
0045AB30  |.  F3:A5         rep     movs dword ptr es:[edi], dword p>
0045AB32  |.  8B7A 04       mov     edi, dword ptr [edx+4]
0045AB35  |.  83C7 14       add     edi, 14
0045AB38  |.  8B47 04       mov     eax, dword ptr [edi+4]
0045AB3B  |.  85C0          test    eax, eax
0045AB3D  |.  76 77         jbe     short 0045ABB6
0045AB3F  |.  8B7424 10     mov     esi, dword ptr [esp+10]
0045AB43  |.  33C9          xor     ecx, ecx
0045AB45  |.  894C24 20     mov     dword ptr [esp+20], ecx
0045AB49  |.  894C24 24     mov     dword ptr [esp+24], ecx
0045AB4D  |.  8B4C24 3C     mov     ecx, dword ptr [esp+3C]
0045AB51  |.  8D5424 20     lea     edx, dword ptr [esp+20]
0045AB55  |.  894C24 28     mov     dword ptr [esp+28], ecx
0045AB59  |.  52            push    edx
0045AB5A  |.  8BCE          mov     ecx, esi
0045AB5C  |.  894424 30     mov     dword ptr [esp+30], eax
0045AB60  |.  C74424 34 000>mov     dword ptr [esp+34], 0
0045AB68  |.  C74424 38 000>mov     dword ptr [esp+38], 3F800000
0045AB70  |.  E8 5BBA5300   call    009965D0
0045AB75  |.  6A 00         push    0
0045AB77  |.  68 0000803F   push    3F800000
0045AB7C  |.  6A 00         push    0
0045AB7E  |.  6A 01         push    1
0045AB80  |.  8BCE          mov     ecx, esi
0045AB82  |.  E8 39B45300   call    00995FC0
0045AB87  |.  8B7F 04       mov     edi, dword ptr [edi+4]
0045AB8A  |.  8B4424 40     mov     eax, dword ptr [esp+40]
0045AB8E  |.  8D4C24 20     lea     ecx, dword ptr [esp+20]
0045AB92  |.  2BC7          sub     eax, edi
0045AB94  |.  51            push    ecx
0045AB95  |.  8BCE          mov     ecx, esi
0045AB97  |.  894424 28     mov     dword ptr [esp+28], eax
0045AB9B  |.  897C24 30     mov     dword ptr [esp+30], edi
0045AB9F  |.  E8 2CBA5300   call    009965D0
0045ABA4  |.  6A 00         push    0
0045ABA6  |.  68 0000803F   push    3F800000
0045ABAB  |.  6A 00         push    0
0045ABAD  |.  6A 01         push    1
0045ABAF  |.  8BCE          mov     ecx, esi
0045ABB1  |.  E8 0AB45300   call    00995FC0
0045ABB6  |>  8B7C24 14     mov     edi, dword ptr [esp+14]
0045ABBA  |>  8B45 20       mov     eax, dword ptr [ebp+20]
0045ABBD  |.  85C0          test    eax, eax
0045ABBF  |.  74 4E         je      short 0045AC0F
0045ABC1  |.  8B4B 08       mov     ecx, dword ptr [ebx+8]
0045ABC4  |.  8B70 10       mov     esi, dword ptr [eax+10]
0045ABC7  |.  E8 040E5300   call    0098B9D0
0045ABCC  |.  8B10          mov     edx, dword ptr [eax]
0045ABCE  |.  8956 14       mov     dword ptr [esi+14], edx
0045ABD1  |.  8B48 04       mov     ecx, dword ptr [eax+4]
0045ABD4  |.  894E 18       mov     dword ptr [esi+18], ecx
0045ABD7  |.  8B50 08       mov     edx, dword ptr [eax+8]
0045ABDA  |.  8BCE          mov     ecx, esi
0045ABDC  |.  8956 1C       mov     dword ptr [esi+1C], edx
0045ABDF  |.  E8 AC095300   call    0098B590
0045ABE4  |.  8B43 08       mov     eax, dword ptr [ebx+8]
0045ABE7  |.  8B55 20       mov     edx, dword ptr [ebp+20]
0045ABEA  |.  8D48 2C       lea     ecx, dword ptr [eax+2C]
0045ABED  |.  83C0 20       add     eax, 20
0045ABF0  |.  51            push    ecx
0045ABF1  |.  8B4A 10       mov     ecx, dword ptr [edx+10]
0045ABF4  |.  50            push    eax
0045ABF5  |.  E8 C6035300   call    0098AFC0
0045ABFA  |.  8B45 08       mov     eax, dword ptr [ebp+8]
0045ABFD  |.  8B4B 04       mov     ecx, dword ptr [ebx+4]
0045AC00  |.  50            push    eax
0045AC01  |.  68 A03E4400   push    00443EA0
0045AC06  |.  51            push    ecx
0045AC07  |.  8B4D 20       mov     ecx, dword ptr [ebp+20]
0045AC0A  |.  E8 8105FCFF   call    0041B190
0045AC0F  |>  8B4D 18       mov     ecx, dword ptr [ebp+18]
0045AC12  |.  85C9          test    ecx, ecx
0045AC14  |.  74 1A         je      short 0045AC30
0045AC16  |.  E8 C561FBFF   call    00410DE0
0045AC1B  |.  8B15 1CDFD000 mov     edx, dword ptr [D0DF1C]          ;  ELEMENTC.00D11A50
0045AC21  |.  8B4D 18       mov     ecx, dword ptr [ebp+18]
0045AC24  |.  8B82 90070000 mov     eax, dword ptr [edx+790]
0045AC2A  |.  50            push    eax
0045AC2B  |.  E8 A062FBFF   call    00410ED0
0045AC30  |>  8B4D 1C       mov     ecx, dword ptr [ebp+1C]
0045AC33  |.  85C9          test    ecx, ecx
0045AC35  |.  74 12         je      short 0045AC49
0045AC37  |.  8B15 1CDFD000 mov     edx, dword ptr [D0DF1C]          ;  ELEMENTC.00D11A50
0045AC3D  |.  8B82 90070000 mov     eax, dword ptr [edx+790]
0045AC43  |.  50            push    eax
0045AC44  |.  E8 2731FCFF   call    0041DD70
0045AC49  |>  8B4D 20       mov     ecx, dword ptr [ebp+20]
0045AC4C  |.  85C9          test    ecx, ecx
0045AC4E  |.  74 12         je      short 0045AC62
0045AC50  |.  8B15 1CDFD000 mov     edx, dword ptr [D0DF1C]          ;  ELEMENTC.00D11A50
0045AC56  |.  8B82 90070000 mov     eax, dword ptr [edx+790]
0045AC5C  |.  50            push    eax
0045AC5D  |.  E8 1E05FCFF   call    0041B180
0045AC62  |>  8B4424 18     mov     eax, dword ptr [esp+18]
0045AC66  |.  85C0          test    eax, eax
0045AC68  |.  74 34         je      short 0045AC9E
0045AC6A  |.  8A88 14050000 mov     cl, byte ptr [eax+514]
0045AC70  |.  84C9          test    cl, cl
0045AC72  |.  74 2A         je      short 0045AC9E
0045AC74  |.  6A 00         push    0
0045AC76  |.  8BCB          mov     ecx, ebx
0045AC78  |.  E8 A3C40000   call    00467120
0045AC7D  |.  8B0D 1CDFD000 mov     ecx, dword ptr [D0DF1C]          ;  ELEMENTC.00D11A50
0045AC83  |.  6A 00         push    0
0045AC85  |.  68 0000803F   push    3F800000
0045AC8A  |.  68 000000FF   push    FF000000
0045AC8F  |.  8B49 08       mov     ecx, dword ptr [ecx+8]
0045AC92  |.  6A 03         push    3
0045AC94  |.  E8 27B35300   call    00995FC0
0045AC99  |.  E9 7C010000   jmp     0045AE1A
0045AC9E  |>  6A 00         push    0
0045ACA0  |.  8BCB          mov     ecx, ebx
0045ACA2  |.  E8 79C40000   call    00467120
0045ACA7  |.  8B15 1CDFD000 mov     edx, dword ptr [D0DF1C]          ;  ELEMENTC.00D11A50
0045ACAD  |.  6A 00         push    0
0045ACAF  |.  68 0000803F   push    3F800000
0045ACB4  |.  68 000000FF   push    FF000000
0045ACB9  |.  8B4A 08       mov     ecx, dword ptr [edx+8]
0045ACBC  |.  6A 02         push    2
0045ACBE  |.  E8 FDB25300   call    00995FC0
0045ACC3  |.  8B4D 08       mov     ecx, dword ptr [ebp+8]
0045ACC6  |.  85C9          test    ecx, ecx
0045ACC8  |.  74 22         je      short 0045ACEC
0045ACCA  |.  53            push    ebx
0045ACCB  |.  E8 507AFEFF   call    00442720
0045ACD0  |.  83BD C0000000>cmp     dword ptr [ebp+C0], 1
0045ACD7  |.  75 13         jnz     short 0045ACEC
0045ACD9  |.  8B4D 04       mov     ecx, dword ptr [ebp+4]
0045ACDC  |.  E8 0F391F00   call    0064E5F0
0045ACE1  |.  85C0          test    eax, eax
0045ACE3  |.  74 07         je      short 0045ACEC
0045ACE5  |.  8BC8          mov     ecx, eax
0045ACE7  |.  E8 84F71E00   call    0064A470
0045ACEC  |>  53            push    ebx
0045ACED  |.  B9 C8DED000   mov     ecx, 00D0DEC8
0045ACF2  |.  E8 C9B1FEFF   call    00445EC0
0045ACF7  |.  A1 1CDFD000   mov     eax, dword ptr [D0DF1C]
0045ACFC  |.  53            push    ebx
0045ACFD  |.  8B48 3C       mov     ecx, dword ptr [eax+3C]
0045AD00  |.  E8 4B91FBFF   call    00413E50
0045AD05  |.  8B4B 04       mov     ecx, dword ptr [ebx+4]
0045AD08  |.  6A FF         push    -1
0045AD0A  |.  51            push    ecx
0045AD0B  |.  8BCF          mov     ecx, edi
0045AD0D  |.  E8 5E4F5400   call    0099FC70
0045AD12  |.  8B15 8428D400 mov     edx, dword ptr [D42884]
0045AD18  |.  8A42 18       mov     al, byte ptr [edx+18]
0045AD1B  |.  84C0          test    al, al
0045AD1D  |.  74 0D         je      short 0045AD2C
0045AD1F  |.  A1 1CDFD000   mov     eax, dword ptr [D0DF1C]
0045AD24  |.  8B48 28       mov     ecx, dword ptr [eax+28]
0045AD27  |.  E8 A41E3F00   call    0084CBD0
0045AD2C  |>  8B0D 1CDFD000 mov     ecx, dword ptr [D0DF1C]          ;  ELEMENTC.00D11A50
0045AD32  |.  8B53 04       mov     edx, dword ptr [ebx+4]
0045AD35  |.  6A 00         push    0
0045AD37  |.  52            push    edx
0045AD38  |.  8BB1 B4020000 mov     esi, dword ptr [ecx+2B4]
0045AD3E  |.  8BCE          mov     ecx, esi
0045AD40  |.  E8 9BC05600   call    009C6DE0
0045AD45  |.  6A 00         push    0
0045AD47  |.  8BCE          mov     ecx, esi
0045AD49  |.  E8 62AC5600   call    009C59B0
0045AD4E  |.  8B43 04       mov     eax, dword ptr [ebx+4]
0045AD51  |.  8BCE          mov     ecx, esi
0045AD53  |.  50            push    eax
0045AD54  |.  E8 47C45600   call    009C71A0
0045AD59  |.  6A 01         push    1
0045AD5B  |.  8BCE          mov     ecx, esi
0045AD5D  |.  E8 4EAC5600   call    009C59B0
0045AD62  |.  8B4B 04       mov     ecx, dword ptr [ebx+4]
0045AD65  |.  8B15 1CDFD000 mov     edx, dword ptr [D0DF1C]          ;  ELEMENTC.00D11A50
0045AD6B  |.  6A 00         push    0
0045AD6D  |.  51            push    ecx
0045AD6E  |.  8B4A 28       mov     ecx, dword ptr [edx+28]
0045AD71  |.  E8 DA1C3F00   call    0084CA50
0045AD76  |.  8BB7 90000000 mov     esi, dword ptr [edi+90]
0045AD7C  |.  8BCE          mov     ecx, esi
0045AD7E  |.  E8 FD655700   call    009D1380
0045AD83  |.  8BCE          mov     ecx, esi
0045AD85  |.  E8 B6665700   call    009D1440
0045AD8A  |.  8BB7 8C000000 mov     esi, dword ptr [edi+8C]
0045AD90  |.  8BCE          mov     ecx, esi
0045AD92  |.  E8 B99E5300   call    00994C50
0045AD97  |.  8BCE          mov     ecx, esi
0045AD99  |.  E8 729F5300   call    00994D10
0045AD9E  |.  8B4D 18       mov     ecx, dword ptr [ebp+18]
0045ADA1  |.  85C9          test    ecx, ecx
0045ADA3  |.  74 09         je      short 0045ADAE
0045ADA5  |.  8B43 04       mov     eax, dword ptr [ebx+4]
0045ADA8  |.  50            push    eax
0045ADA9  |.  E8 4261FBFF   call    00410EF0
0045ADAE  |>  8B4D 1C       mov     ecx, dword ptr [ebp+1C]
0045ADB1  |.  85C9          test    ecx, ecx
0045ADB3  |.  74 12         je      short 0045ADC7
0045ADB5  |.  8B55 08       mov     edx, dword ptr [ebp+8]
0045ADB8  |.  8B43 04       mov     eax, dword ptr [ebx+4]
0045ADBB  |.  52            push    edx
0045ADBC  |.  68 903E4400   push    00443E90
0045ADC1  |.  50            push    eax
0045ADC2  |.  E8 B92FFCFF   call    0041DD80
0045ADC7  |>  8B45 08       mov     eax, dword ptr [ebp+8]
0045ADCA  |.  85C0          test    eax, eax
0045ADCC  |.  74 3B         je      short 0045AE09
0045ADCE  |.  8B48 30       mov     ecx, dword ptr [eax+30]
0045ADD1  |.  85C9          test    ecx, ecx
0045ADD3  |.  74 34         je      short 0045AE09
0045ADD5  |.  8B7424 10     mov     esi, dword ptr [esp+10]
0045ADD9  |.  6A 00         push    0
0045ADDB  |.  8BCE          mov     ecx, esi
0045ADDD  |.  E8 5EB55300   call    00996340
0045ADE2  |.  6A 01         push    1
0045ADE4  |.  8BCE          mov     ecx, esi
0045ADE6  |.  E8 E5B55300   call    009963D0
0045ADEB  |.  8B4D 08       mov     ecx, dword ptr [ebp+8]
0045ADEE  |.  53            push    ebx
0045ADEF  |.  8B49 30       mov     ecx, dword ptr [ecx+30]          ;  dd [[[[[[ebp+8]+30]+50]+0*4]+C]+0*4]
0045ADF2  |.  E8 E9481F00   call    0064F6E0                         ;  怪物数组遍历

12. 公式替换为 dd [[[[[[[ebp+1C]+8]+30]+50]+04]+C]+04] ebp=ecx

在这里插入图片描述
13. 追ecx

14. 追ecx…

追到这里Ctrl+F9 不好使了,可能被VM 无法返回,跟丢了记录目标edi寄存器的值[00D11A50] 借助CE看看

004492E0  /$  53            push    ebx
004492E1  |.  8B1D 0462BE00 mov     ebx, dword ptr [<&KERNEL32.Resum>;  kernel32.ResumeThread
004492E7  |.  55            push    ebp
004492E8  |.  56            push    esi
004492E9  |.  8B35 CC62BE00 mov     esi, dword ptr [<&KERNEL32.WaitF>;  kernel32.WaitForSingleObject
004492EF  |.  57            push    edi
004492F0  |.  8BF9          mov     edi, ecx>>>>>>>>>>>>>不执行
004492F2  |.  83CD FF       or      ebp, FFFFFFFF
004492F5  |>  A0 6CDBD000   /mov     al, byte ptr [D0DB6C]
004492FA  |.  84C0          |test    al, al
004492FC  |.  75 38         |jnz     short 00449336
004492FE  |.  A1 8825D100   |mov     eax, dword ptr [D12588]
00449303  |.  6A 00         |push    0
00449305  |.  50            |push    eax
00449306  |.  FFD6          |call    esi
00449308  |.  85C0          |test    eax, eax
0044930A  |.  74 2A         |je      short 00449336
0044930C  |.  A0 9825D100   |mov     al, byte ptr [D12598]
00449311  |.  84C0          |test    al, al
00449313  |.  74 09         |je      short 0044931E
00449315  |.  8B0D 7C25D100 |mov     ecx, dword ptr [D1257C]
0044931B  |.  51            |push    ecx
0044931C  |.  FFD3          |call    ebx
0044931E  |>  8B15 8C25D100 |mov     edx, dword ptr [D1258C]
00449324  |.  6A 14         |push    14
00449326  |.  52            |push    edx
00449327  |.  FFD6          |call    esi
00449329  |.  8BCF          |mov     ecx, edi>>>>>>>>追edi
0044932B  |.  E8 E0000000   |call    00449410                        ;  6
00449330  |.  84C0          |test    al, al
00449332  |.  74 09         |je      short 0044933D
00449334  |.^ EB BF         jmp     short 004492F5
00449336  |>  5F            pop     edi
00449337  |.  5E            pop     esi
00449338  |.  5D            pop     ebp
00449339  |.  33C0          xor     eax, eax
0044933B  |.  5B            pop     ebx
0044933C  |.  C3            retn
0044933D  |>  5F            pop     edi
0044933E  |.  8BC5          mov     eax, ebp
00449340  |.  5E            pop     esi
00449341  |.  5D            pop     ebp
00449342  |.  5B            pop     ebx
00449343  .  C3            retn

15. 原来是基址啊那公式替换成dd [[[[[[[00D11A50+1C]+8]+30]+50]+04]+C]+04]
在这里插入图片描述
16. 数据不对回去看看,少套了一层dd [[[[[[[[[00D11A50+1C]+8]+30]+50]+04]+C]+04]]

验证如下:
dd [[[[[[[[00D11A50+1C]+8]+30]+50]+0*4]+C]+0*4]]
dd [[[[[[[[[00D0DF1C]+1C]+8]+30]+50]+0*4]+C]+0*4]] // 人物名称
dd [[[[[[[[[00D0DF1C]+1C]+8]+30]+50]+1*4]+C]+0*4]] 33A3BB0C  56E256E2 OD显示不太友好 用ce验证
dd [[[[[[[[[00D0DF1C]+1C]+8]+30]+50]+2*4]+C]+0*4]] 33A3BB0C  56E256E2
dd [[[[[[[[[00D0DF1C]+1C]+8]+30]+50]+3*4]+C]+0*4]] 33A3BB0C  56E256E2

在这里插入图片描述

总结如下

口袋西游周围遍历属于数组结构这里用代码遍历的时候数组长度大概率为0,可以说追的这个表达式可以舍弃

dd [[[[[[[[00D11A50+1C]+8]+30]+50]+0*4]+C]+0*4]]
dd [[[[[[[[[00D0DF1C]+1C]+8]+30]+50]+0*4]+C]+0*4]] // 人物名称
dd [[[[[[[[[00D0DF1C]+1C]+8]+30]+50]+1*4]+C]+0*4]] 33A3BB0C  56E256E2 OD显示不太友好 用ce验证
dd [[[[[[[[[00D0DF1C]+1C]+8]+30]+50]+2*4]+C]+0*4]] 33A3BB0C  56E256E2
dd [[[[[[[[[00D0DF1C]+1C]+8]+30]+50]+3*4]+C]+0*4]] 33A3BB0C  56E256E2