冰楓論壇

標題: TwMS v237.1 CRC 列舉BuffID [打印本頁]

---

作者: rhg59321    時間: 2021-10-8 01:36
標題: TwMS v237.1 CRC 列舉BuffID


// TwMS v237.1 CRC 列舉BuffID
// 避免Buff時間到消失了還繼續留在清單內, 每2秒會重新列舉所有BuffID
[Enable]
Registersymbol(Buff_List)
Alloc(Buff_List_Hook,512)
Alloc(Buff_List,512)
Alloc(Buff_Count,04)
Alloc(Timer,04)
Label(Buff_List_Exit)
Label(Record_Buff)
Label(Reset_List1)
Label(Reset_List2)

Buff_Count:
DD 0

Buff_List:
DD 0

Timer:
DD 0

Buff_List_Hook:
mov byte ptr [ebp-04],21
mov esi,[eax+30]
pushad
test esi,esi
je Reset_List1
cmp [041F8D30],0
je Reset_List1
call 02E11170
mov edi,eax
sub edi,[Timer]
cmp edi,000007D0           // 刷新Buff清單的延遲
jl Record_Buff
mov [Timer],eax
jmp Reset_List1

Record_Buff:
mov edi,[Buff_Count]
mov eax,[041F8A3C]        // 00C5B350 - mov eax,[041F8A3C]
mov eax,[eax+00002300] // 030E65D5 - mov ecx,[edi+00002300]
cmp edi,[eax+2C]            // 020C70BA - cmp dword ptr [ebx+2C],00
jae Buff_List_Exit
mov eax,[esi+04]            // 020B4F84 - mov eax,[esi+04]
add eax,00000098
mov ebx,[eax]
mov eax,[esi+04]            // 020B4FE0 - mov eax,[esi+04]
cmp dword ptr [eax+00000094],03
je Buff_List_Exit
lea eax,[esi-10]               // 020B502F - lea eax,[esi-10]
test esi,esi
mov ecx,00000004
cmovne ecx,eax
mov esi,[ecx]
lea eax,[esi+14]
neg esi
sbb esi,esi
and esi,eax
mov [Buff_List+edi*4],ebx
add [Buff_Count],1
jne Record_Buff
jmp Buff_List_Exit

Reset_List1:
mov [Buff_Count],0

Reset_List2:
mov edi,[Buff_Count]
cmp [Buff_List+edi*4],0
je Buff_List_Exit
mov [Buff_List+edi*4],0
add [Buff_Count],1
jmp Reset_List2

Buff_List_Exit:
popad
jmp 020B4F75+7

020B4F75:
jmp Buff_List_Hook
nop
nop

[Disable]
020B4F75:
mov byte ptr [ebp-04],21
mov esi,[eax+30]

DeAlloc(Timer)
DeAlloc(Buff_List)
DeAlloc(Buff_Count)
DeAlloc(Buff_List_Hook)
UnRegistersymbol(Buff_List)

---

作者: ningmeng    時間: 2021-10-8 01:43
感謝大大，確實有心了，謝謝，技術大牛

---

作者: plusline    時間: 2021-10-8 02:11
我更新到一半就看到您發出來了^^
可以請教您要怎麼解讀這段程式碼? 我看了好久實在看不懂"je Buff_List_Exit"之後的部分

Record_Buff:

//看buff數量
mov edi,[Buff_Count]
mov eax,[041F8A3C]      
mov eax,[eax+00002300]
cmp edi,[eax+2C]           
jae Buff_List_Exit

//看第一個buffID對應到的是不是技能
mov eax,[esi+04]           
add eax,00000098
mov ebx,[eax]
mov eax,[esi+04]           
cmp dword ptr [eax+00000094],03
je Buff_List_Exit

//以下就看不懂了(求解釋)
lea eax,[esi-10]               
test esi,esi
mov ecx,00000004
cmovne ecx,eax
mov esi,[ecx]
lea eax,[esi+14]
neg esi
sbb esi,esi
and esi,eax
mov [Buff_List+edi*4],ebx
add [Buff_Count],1
jne Record_Buff
jmp Buff_List_Exit

---

作者: rhg59321    時間: 2021-10-8 02:39

plusline 發表於 2021-10-8 02:11
我更新到一半就看到您發出來了^^
可以請教您要怎麼解讀這段程式碼? 我看了好久實在看不懂"je Buff_List_Exi ...

直接看遊戲本身怎麼執行可能會清楚一點

020B4F84 - mov eax,[esi+04]
020B4F87 - add eax,00000098
[eax] = Buff ID

020B4FE0 - mov eax,[esi+04]
020B4FE3 - cmp dword ptr [eax+00000094],03
020B4FEA - jne 020B502F

020B502F - lea eax,[esi-10]
020B5032 - test esi,esi
020B5034 - mov ecx,00000004
020B5039 - cmovne ecx,eax
020B503C - mov esi,[ecx]
020B503E - lea eax,[esi+14]
020B5041 - neg esi
020B5043 - sbb esi,esi
020B5045 - and esi,eax
020B5047 - jne 020B4F84

---

歡迎光臨 冰楓論壇 (https://bingfong.com/)

Powered by 冰楓