> >
更多精彩技术文章>
游戏：天龙八部，版本：0.16.0108，系统windows xp，工具：CE5.2+OD1.10+C#2005
目标：查找到内存中怪数据的数组格式和位置
首先更正笔记1中的人物基址的查找方法，具体查找方法以下简单说明：
1.CE中根据人物经验或血找到某唯一地址（实际中我是根据经验的）
2.OD中对经验地址下内存写断点
0044BC28 8B46 0C MOV EAX,DWORD PTR DS:[ESI + C] 此处为写经验地址，得到第二个偏移值C和地址ESI的值
0044BC2B 89B8 C0060000 MOV DWORD PTR DS:[EAX + 6C0],EDI 此处为写经验，得到第一个偏移值6C0和地址EAX的值
0044BC31 8B0D C4B75B00 MOV ECX,DWORD PTR DS:[5BB7C4]
0044BC37 8B11 MOV EDX,DWORD PTR DS:[ECX]
0044BC39 68 04755700 PUSH Game. 00577504 ; ASCII " player "
0044BC3E 6A 1D PUSH 1D
0044BC40 FF52 4C CALL DWORD PTR DS:[EDX + 4C]
3.OD中逆向分析
004D82D0 55 PUSH EBP
……………………省略……………………………………………………………………………………
004D82F6 FF52 44 CALL DWORD PTR DS:[EDX+44]
004D82F9 8BD8 MOV EBX,EAX ; ebx=eax
004D82FB 85DB TEST EBX,EBX
004D82FD 0F84 8F080000 JE Game.004D8B92
004D8303 33C0 XOR EAX,EAX
004D8305 8A46 0C MOV AL,BYTE PTR DS:[ESI+C]
004D8308 57 PUSH EDI
004D8309 8BBB 2C020000 MOV EDI,DWORD PTR DS:[EBX+22C] ; edi=ebx+22c,此处的ebx得到第三个偏移值22C和地址ebx值
004D830F 83E0 01 AND EAX,1
……………………省略……………………………………………………………………………………
004D838A E8 4137F7FF CALL Game.0044BAD0 ; 调用经验获取函数
4.发现此处ebx的值切换地图时不变，始终偏移三次后能取到经验（笔记一中认为这时的ebx已经是基地址，此处更正），对ebx的地址下内存写访问断点，得到下面代码片段
00501957 8945 F0 MOV DWORD PTR SS:[EBP - 10 ],EAX
0050195A A1 88895B00 MOV EAX,DWORD PTR DS:[5B8988] ;基地址5b5888
0050195F 57 PUSH EDI
00501960 8BF9 MOV EDI,ECX
00501962 8B48 44 MOV ECX,DWORD PTR DS:[EAX + 44 ] ;第四个偏移值44
00501965 894F 08 MOV DWORD PTR DS:[EDI + 8 ],ECX ; 写地址
00501968 8B11 MOV EDX,DWORD PTR DS:[ECX]
0050196A FF52 3C CALL DWORD PTR DS:[EDX + 3C]
总结，人物数据地址=[[[5B8988]+44]+22C]+C，经验值=[人物数据地址+6C0]
好了，接下来开始寻找怪数组了
找内存地址这几天学下来已经比较熟练了，所以后面的步骤简写，只写方法和关键步骤
第一步：CE中查找当前地图某个怪的名称（text）格式的，找出一堆地址来。切换怪区域，发现哪些地址有变化，结果有几个地址有变化，这几个地址特征是比较接近，猜测可能是数组中某几项，查看该内存区域，截取片段如下：
02816660 02 00 00 00 41 F1 0F 43 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>A ? C
02816668 00 00 00 00 3F 57 5B 42 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>. ? W[B
02816670 00 00 00 00 00 00 00 00 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>..
02816678 B5 C1 C4 B9 D0 A1 D4 F4 盗墓小贼
02816680 00 00 00 00 00 00 00 00 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>..
02816688 08 00 00 00 0F 00 00 00 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0> ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>
02816690 F5 00 00 00 00 00 00 00 ? ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>
02816698 00 00 00 00 2D 23 10 43 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>. - # C
028166A0 00 00 00 00 8C 9B 83 42 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>.寷傿
028166A8 00 00 00 00 00 00 00 00 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>..
028166B0 B5 C1 C4 B9 D0 A1 D4 F4 盗墓小贼
028166B8 00 B4 B6 FE B2 E3 00 00 .炊??/font> ? .
028166C0 08 00 00 00 0F 00 00 00 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0> ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>
028166C8 EC 00 00 00 00 00 00 00 ? ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>
028166D0 00 00 00 00 6B 8F 18 43 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>.k ? C
028166D8 00 00 00 00 4F 40 26 42 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>.O@ & B
028166E0 00 00 00 00 00 00 00 00 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>..
028166E8 B5 C1 C4 B9 D0 A1 D4 F4 盗墓小贼
028166F0 00 B4 B6 FE B2 E3 00 00 .炊??/font> ? .
028166F8 08 00 00 00 0F 00 00 00 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0> ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>
02816700 E9 00 00 00 00 00 00 00 ? ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>
02816708 00 00 00 00 2F DB 1B 43 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>. /? C
02816710 00 00 00 00 1E BA 52 42 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>. 篟B
02816718 00 00 00 00 00 00 00 00 ![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>![]() screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.style.cursor='hand'; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" οnclick="if(!this.resized) {return true;} else {window.open('http://www.cnblogs.com/Images/dot.gif');}" alt="" src="http://www.cnblogs.com/Images/dot.gif" οnlοad="if(this.width>screen.width*0.7) {this.resized=true; this.width=screen.width*0.7; this.alt='Click here to open new window/nCTRL+Mouse wheel to zoom in/out';}" border=0>..
经分析发现其中存了怪坐标，名称，编号，类型等数据
第二步：OD中对自己认为最有把握的地址下内存写访问断点，得到代码如下：
7C364344 89448F E4 MOV DWORD PTR DS:[EDI + ECX * 4 - 1C],EAX
7C364348 8B448E E8 MOV EAX,DWORD PTR DS:[ESI + ECX * 4 - 18 ]
7C36434C 89448F E8 MOV DWORD PTR DS:[EDI + ECX * 4 - 18 ],EAX
7C364350 8B448E EC MOV EAX,DWORD PTR DS:[ESI + ECX * 4 - 14 ]
7C364354 89448F EC MOV DWORD PTR DS:[EDI + ECX * 4 - 14 ],EAX
7C364358 8B448E F0 MOV EAX,DWORD PTR DS:[ESI + ECX * 4 - 10 ]
7C36435C 89448F F0 MOV DWORD PTR DS:[EDI + ECX * 4 - 10 ],EAX
7C364360 8B448E F4 MOV EAX,DWORD PTR DS:[ESI + ECX * 4 - C]
7C364364 89448F F4 MOV DWORD PTR DS:[EDI + ECX * 4 - C],EAX
7C364368 8B448E F8 MOV EAX,DWORD PTR DS:[ESI + ECX * 4 - 8 ]
7C36436C 89448F F8 MOV DWORD PTR DS:[EDI + ECX * 4 - 8 ],EAX
7C364370 8B448E FC MOV EAX,DWORD PTR DS:[ESI + ECX * 4 - 4 ]
7C364374 89448F FC MOV DWORD PTR DS:[EDI + ECX * 4 - 4 ],EAX
7C364378 8D048D 00000000 LEA EAX,DWORD PTR DS:[ECX * 4 ]
第三步：中断后逆向分析代码退后几步代码如下：
0050143E 8B0D 50895B00 MOV ECX,DWORD PTR DS:[5B8950] ;基地址
00501444 8B11 MOV EDX,DWORD PTR DS:[ECX]
00501446 FF52 54 CALL DWORD PTR DS:[EDX + 54 ]
如上红色部分为基地址，怪物数组的起始地址为[5B8950]+7C
笔记2中的演示程序添加上怪物列表功能，程序运行界面如下：
> >
更多精彩技术文章>
|
扫一扫
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
