冰楓論壇

標題: TWMS094~103（一些舊數據，僅供參考＆研究） [打印本頁]

---

作者: 冰楓    時間: 2014-2-5 19:30
標題: TWMS094~103（一些舊數據，僅供參考＆研究）
動態數據就不放上來了，有一些數據遺失了...所以也歡迎好心人補上(?)
本來打算放到165的..但太多了..我好懶...所以就先放到103

//版本:TWMS094
//數據名稱:攻擊不停
//更新:梟x夜..180天度假中
//日期:2009/5/21
// 代碼 :008CE356
// EIP : CSX
[Enable]
registersymbol(CSX)
alloc(CSX,128)
label(CSXReturn)
CSX://CSEAX X  
push eax
mov eax,[00AA8944]
mov eax,[eax+2500]
cmp eax,2   
pop eax
jg CSXReturn

push eax
mov eax,[00AA8944]
mov eax,[eax+0D08]
cmp esi,eax
pop eax
jne CSXReturn
add eax,0a
jmp CSXReturn

CSXReturn:
mov [ebx], eax
jmp 008CE358

[Disable]
unregistersymbol(CSX)
dealloc(CSX)

//=================================================
[enable]
//疾風N合一 for TWMS094
//原作：jajaja, 感謝99,A,D,L,N,W,W(縮寫)
//原出處：疾風之莊
//感謝:s032356469跳怪掉落LR
//功能：停止呼吸、 走,跳怪方向【左趴往左,右趴往右,坐下停止控制】、笨怪、10秒損血一次、超檢
//紅點暫停、跳怪不跳、致命的吸引力【定點及跟隨角色二種模式，啟動方式提示：5秒】
//Address：004145ab
//EIP：MyLR
//LR:掉怪方向 1停3左2右  可以加到清單上了比較方便
//=================================================
alloc(MyLR,1024)
registersymbol(MyLR)
alloc(MyDir,4)
alloc(MyCt,4)
alloc(MyPt1,4)
label(MyLR1)
label(GoLR)
label(GoLR1)
label(GoLR2)
label(GoLR3)
label(GoLR4)
label(GoLR5)
label(GoLRback)
label(JmpLR)
label(JmpLR1)
label(JmpLR2)
label(JmpLRback)
label(MyStupid)
label(MyNoBack)
label(MyState)
label(MyCharX)
label(MyNoJmp)
label(LRDir1)
label(LRDir2)
label(LRDir3)
label(LRDir4)
label(LRDir5)
label(LRDir6)

label(LRDir7)         //跳怪掉落
registersymbol(LR)//跳怪掉落
alloc(LR,4)            //跳怪掉落

registersymbol(RunSW)//熱鍵紅點模組化
alloc(RunSW, 4)           //熱鍵紅點模組化
alloc(Runtemp, 4)        //熱鍵紅點模組化

registersymbol(ATTACKOF)     //攻擊加速
alloc(ATTACKOF,4)                 //攻擊加速
label(CALLATTACK)                //攻擊加速
label(CALLATTACK01)            //攻擊加速
label(CALLATTACK02)           //攻擊加速
registersymbol(ATTACKTIME)//攻擊加速
alloc(ATTACKTIME,4)            //攻擊加速

registersymbol(VarMaxBloom)//PG無敵
registersymbol(VarMinBloom)//PG無敵
alloc(VarMaxBloom, 4)           //PG無敵
alloc(VarMinBloom, 4)            //PG無敵
label(CBR100)                        //PG無敵

RunSW:                //熱鍵紅點模組化
dd      0                //熱鍵紅點模組化
Runtemp:             //熱鍵紅點模組化
dd      1                //熱鍵紅點模組化

//--------↓PG無敵↓--------------
  VarMaxBloom:               //
  dd 2                       //最高損血量: 初始值: 2滴, 採用16進次
  VarMinBloom:               //
  dd 1                       //最低損血量: 初始值: 1滴, 採用16進次 (設0=miss)
//--------↑PG無敵↑--------------


//-------↓攻擊加速↓-------------
  ATTACKOF:
  DD 7d0   //加速時間:目前設定2秒   3秒=3000毫秒=BB8.不穩定的增加數值.穩定的可以試著減少數值
  ATTACKTIME:
  DD 0
//-------↑攻擊加速↑-------------

LR:         //跳怪掉落
DD 3      //跳怪掉落  1停3左2右.可是要搭配疾風右走才行

MyDir:
DD 1

MyLR:
push eax
cmp [00AA8944],00000000   //停止呼吸        
je MyLR1                               //停止呼吸
mov eax,[00AA8944]             //停止呼吸
mov [eax+374],0                   //停止呼吸

cmp [00AA8954],00000000   //超級檢物
je MyLR1                               //超級檢物
mov eax,[00AA8954]             //超級檢物
mov [eax+206C], 0                //超級檢物

cmp [00AA8958],00000000   //地圖紅點
je MyLR1

//----------↓熱鍵紅點模組化↓-------------
    push eax
    mov eax,[RunSW]
    xor [Runtemp],eax
    mov [RunSW],0
    cmp [Runtemp],1
    pop eax
    jne MyLR1   
    push eax
    mov eax,[00AA8958] //紅點
    mov eax,[eax+18]   //  
    add [Runtemp],eax
    cmp [Runtemp],100  // 這裏修改 1是自己 加1個人改2
    mov [Runtemp],1
    pop eax
    ja MyLR1   
//---------↑熱鍵紅點模組化↑------------------

pop eax
cmp dword ptr [esp], 008D1711
je GoLR
cmp dword ptr [esp], 008D1B2B
je JmpLR
cmp dword ptr [esp], 008D078C
je MyStupid
cmp dword ptr [esp], 00879EF9
jz MyNoBack
cmp dword ptr [esp], 008D1AE3
jz MyNoJmp
ret
MyLR1:
pop eax
ret

//---------------↓攻擊加速↓-----------------------------------------------
CALLATTACK:   
push eax
mov eax,[00aa8ae4]
mov eax,[eax+18]
cmp eax,[ATTACKTIME]
pop eax
jg CALLATTACK01
ret
CALLATTACK01:
push eax
mov eax,[00aa8944]
mov eax,[eax+37C]
cmp eax,ffffffff
pop eax
jne CALLATTACK02
ret
CALLATTACK02:
push eax
mov eax,[00aa8944]
mov [eax+37C],ffffffff
mov eax,[00aa8ae4]
mov eax,[eax+18]
add eax,[ATTACKOF]
mov [ATTACKTIME],eax
pop eax
ret
//-----------------↑攻擊加速↑-----------------------------------

GoLR:
add esp,4
call MyState
push 03
pop ecx
mov [edi+20],eax
xor edx,edx
div ecx
cmp [MyDir], 1
je GoLRback
cmp [MyDir], 3
je GoLR1
cmp [MyDir], 4
je GoLR3
cmp edx, [MyDir]
je GoLRback
mov [esi+000004a4],0
jmp GoLRback
GoLR1:
push eax
call MyCharX
jmp GoLR4
GoLR3:
push eax
mov eax,[MyPt1]
GoLR4:
cmp edx, 1
je GoLR5
jg GoLR2
cmp eax,[esi+1c4]
pop eax
mov [esi+000004a4],5
jl GoLRback
mov [esi+000004a4],0
jmp GoLRback
GoLR2:
cmp eax,[esi+1c4]
pop eax
mov [esi+000004a4],5
jg GoLRback
mov [esi+000004a4],0
jmp GoLRback
GoLR5:
pop eax
mov [esi+000004a4],0
GoLRback:
jmp 008D171B
//================================
JmpLR:
add esp,4
call MyState
cmp [MyDir], 1
je JmpLRback
cmp [MyDir], 2
mov eax,2
je JmpLRback
cmp [MyDir], 0
mov eax,3
je JmpLRback
cmp [MyDir], 4
je JmpLR1
call MyCharX
jmp JmpLR2
JmpLR1:
mov eax,[MyPt1]
JmpLR2:
cmp eax,[esi+1c4]
mov eax,2
mov [esi+000004a4],5
jg JmpLRback
mov eax,3
JmpLRback:

//------↓跳怪掉落↓------------
cmp [esi+00000230],1 //<----------避免改到走怪
je LRDir7
cmp eax,[LR]
jne LRDir7
sub [esi+00000230],2 //<-----這裡不要亂動 改錯了怪亂飄會鎖
LRDir7: //<------------
//------↑跳怪掉落↑------------

push 03
jmp 008D1B2D
//================================
MyCharX:
mov eax [00AA8944]
mov eax, [eax+0cc8]
ret
//================================
MyState:
push eax
mov eax, [00AA8944]
mov eax, [eax+0378]
cmp eax, a
je LRDir1
cmp eax, b
je LRDir2
cmp eax, 14
je LRDir3
cmp eax, 15
je LRDir3
mov [MyCt], 0
jmp LRDir4
LRDir1:
mov [MyDir],2
cmp [MyCt], 32
ja LRDir5
inc [MyCt]
jmp LRDir4
LRDir2:
mov [MyDir],0
cmp [MyCt], 32
ja LRDir6
inc [MyCt]
jmp LRDir4
LRDir3:
mov [MyDir],1
jmp LRDir4
LRDir5:
mov [MyDir],3
jmp LRDir4
LRDir6:
mov [MyDir],4
call MyCharX
mov [MyPt1],eax
LRDir4:
pop eax
ret
//============================
MyStupid:

call CALLATTACK  //攻擊加速

add esp, 4
xor edx,edx
mov ecx,0000ea60
div ecx
lea eax,[esi+00000238]
add edx,0002bf20
mov [esi+00000240],edx
mov edx,[esp+10]
cmp [eax],edx
je 008D07D7
cmp [esi+0000023c],edi
lea ecx,[esi+0000023c]
je 008D07D7
jmp 008D07BD
//============================
MyNoBack:
add esp,4

//--------↓PG無敵↓--------------
push eax
push ebx
push ecx
push edx
xor edx, edx
mov eax,[00AA8944]     
mov eax,[eax+18]      
mov ecx, [VarMaxBloom]
mov ebx, [VarMinBloom]
sub ecx, ebx
jz CBR100
div ecx // edx:eax 除 ecx, 餘數放edx   簡單說 就是 除以差值 取餘數
CBR100:
add edx, ebx          //餘數+上最小值
mov [ebp+8], edx    //把結果丟進去扣寫
pop edx
pop ecx
pop ebx
pop eax
//--------↑PG無敵↑--------------

lea ecx, [edi+000017f4]
push FFFFD8F0     //=10 秒 //原始值=FFFFFA24，修改此處可更改無敵秒數
jmp 0087A532
//============================
MyNoJmp:
add esp,4
jmp 008D1AF7
[disable]
dealloc(MyLR)
unregistersymbol(MyLR)
dealloc(MyDir)
dealloc(MyCt)
dealloc(MyPt1)

dealloc(ATTACKOF)                  //攻擊加速
unregistersymbol(ATTACKOF)  //攻擊加速
dealloc(ATTACKTIME)               //攻擊加速
unregistersymbol(ATTACKTIME)//攻擊加速

unregistersymbol(LR)//跳怪掉落
dealloc(LR)               //跳怪掉落

unregistersymbol(RunSW)//熱鍵紅點模組化
dealloc(RunSW)               //熱鍵紅點模組化
dealloc(Runtemp)             //熱鍵紅點模組化

[enable]
// 寵物吸物 For TWMS094
// 代碼=004EBB13
// EIP=PetGetItem
//更新時間 2009/5/20
registersymbol(PetGetItem)
alloc(PetGetItem,256)
registersymbol(PetGetItemSwitch)
alloc(PetGetItemSwitch,4)
label(NormalPet)

PetGetItemSwitch:
dd 1   // 開關   0 是關   1 是開

PetGetItem:
cmp [PetGetItemSwitch],0
je NormalPet
push ebx
mov ebx,[ebp+0c]
mov [ebx],edi
mov [ebx+04],eax
pop ebx
jmp 004EBB2A//+8//8B 45 DC 39 58 30 74 07 B8 FF FF FF 7F EB 03 8B 40 34 8B 4D E0 50 E8 87
NormalPet:
lea eax,[ebp-38]
push eax
call dword ptr [00aabf4c]//第2ㄍ代碼那行
jmp 004EBB1D//+3

[disable]
unregistersymbol(PetGetItem)
dealloc(PetGetItem)
unregistersymbol(PetGetItemSwitch)
dealloc(PetGetItemSwitch)

//==================================================
//  TWMS_V094 快速恢復HP/MP 合併版
//
//  004256F6 EIP=HookFR
//
//  代碼原創：qqazedctgb
//
//  修改：龍
//  
//  日期：98/05/20
//
//  說明：每次恢復10倍HP，8倍MP
//==================================================

[Enable]
  alloc(HookFR,1024)
  registersymbol(HookFR)
  label(HookRet)
  label(HPHandler)
  label(MPHandler)

  label(FastRecoverHP)
  label(DoNormalHP)
  label(HPCheck)
  alloc(HPCounter,4)
  alloc(SetHPCounter,4)
  alloc(RecoverTime,4)
  registersymbol(SetHPCounter)

  label(FastRecoverMP)
  label(DoNormalMP)
  label(MPCheck)
  alloc(MPCounter,4)
  alloc(SetMPCounter,4)
  registersymbol(SetMPCounter)

HookFR:
  cmp [esp],0090F7D7
  je HPHandler
  cmp [esp],0090F945
  je MPHandler
HookRet:
  push ebp
  jmp 004256F7

HPHandler:
  mov [esp],FastRecoverHP
  jmp HookRet
MPHandler:
  mov [esp],FastRecoverMP
  jmp HookRet

FastRecoverHP:
  push eax
  mov eax,[ebp-1c]
  mov [RecoverTime],eax
  pop eax

  cmp [HPCounter],0
  je HPCheck
  dec [HPCounter]
  cmp ebx,1
  jmp 0090F7DA

HPCheck:
  sub [RecoverTime],0A
  cmp ebx,[RecoverTime]
  jna DoNormalHP

  push eax
  mov eax,[SetHPCounter]
  dec eax
  mov [HPCounter],eax
  pop eax

DoNormalHP:
  cmp ebx,[ebp-1c]
  jmp 0090F7DA


FastRecoverMP:
  cmp [MPCounter],0
  je MPCheck
  dec [MPCounter]
  cmp ebx,1
  jmp 0090F94B

MPCheck:
  cmp ebx,00002708
  jna DoNormalMP
  push eax
  mov eax,[SetMPCounter]
  dec eax
  mov [MPCounter],eax
  pop eax

DoNormalMP:
  cmp ebx,00002710
  jmp 0090F94B

SetHPCounter:
  dd A          // 10倍HP，易斷線的請調低倍數
SetMPCounter:
  dd 8          // 8倍MP，易斷線的請調低倍數

[Disable]
  unregistersymbol(HookFR)
  dealloc(HookFR)

  dealloc(HPCounter)
  dealloc(SetHPCounter)
  dealloc(RecoverTime)
  unregistersymbol(SetHPCounter)

  dealloc(MPCounter)
  dealloc(SetMPCounter)
  unregistersymbol(SetMPCounter)

//V94跳怪and走怪 都能掉落
//原作:zgenden
//Address: 008D23B2
//EIP: ALLDOWN
[ENABLE]
registersymbol(ALLDOWN)
alloc(ALLDOWN,128)

ALLDOWN:
add [ebx+00000228],1
mov eax,[ebx+00000228]
cmp eax,01
jmp 008D23BB

[DISABLE]
dealloc(ALLDOWN)
unregistersymbol(ALLDOWN)

//V94 招喚獸無延遲 Z版
//原作:zgenden
//更版:asdasd911
//Address:006FE997
//EIP:TEN
//注意:不能搭配順移.不能搭配全圖.不能搭配物品落腳下
//-----------------------------------------------
[ENABLE]
registersymbol(TEN)
alloc(TEN,1024)
registersymbol(TENKEY)
alloc(TENKEY,4)
registersymbol(TENTIMESTOP)
alloc(TENTIMESTOP,4)
registersymbol(TENTIMESTOP01)
alloc(TENTIMESTOP01,4)
registersymbol(TENTIMESTOPOF)
alloc(TENTIMESTOPOF,4)
registersymbol(TENTIMESTOPEDI)
alloc(TENTIMESTOPEDI,4)
registersymbol(TENTIMESTOP100)
alloc(TENTIMESTOP100,4)
label(TEN00)
label(TEN02)
label(TENKB)
label(TENKB00)
registersymbol(TENKEYTIME)
alloc(TENKEYTIME,4)
//-----------------------------------------------
TENKEY:
dd 1 //熱鍵: 0.關 1.開
TENTIMESTOP:
DD 0
TENTIMESTOP01:
DD 0
TENTIMESTOPOF:
DD 0
TENTIMESTOPEDI:
DD 0
TENTIMESTOP100:
DD 0
TENKEYTIME:
DD 0

TEN:
cmp [TENKEY],0
je TEN00
cmp [TENTIMESTOPEDI],edi
je TEN02
mov [TENTIMESTOPEDI],edi
mov [TENTIMESTOP],0
mov [TENTIMESTOP01],0
mov [TENTIMESTOPOF],0
TEN02:
call TENKB
mov ecx,[00aa8ae4]
mov ecx,[ecx+18]
sub ecx,3E8 //每次進行攻擊秒數目前1秒無延遲
cmp ecx,[TENKEYTIME]
jg TEN00
mov ecx,[00aa8ae4]
mov ecx,[ecx+18]
sub ecx,0 //每一次攻擊延遲時間.目前0(無延遲)
cmp ecx,[TENTIMESTOP]
jle TEN00
cmp [TENTIMESTOP01],1E //偵測攻擊次數.目前30下
jge TEN00
push [ebx+000000a4]
call 006cdbed
pop ecx
mov ecx,esi
sub ecx,[ebx+00000100]
push esi
mov ecx,ebx
call 006ff652
push eax
mov eax,[ebx+00000100]
cmp [TENTIMESTOP100],eax
pop eax
je 006fea08
push eax
mov eax,[ebx+00000100]
mov [TENTIMESTOP100],eax
mov eax,[00aa8ae4]
mov eax,[eax+18]
mov [TENTIMESTOP],eax
pop eax
add [TENTIMESTOP01],1
jmp 006fea08

TEN00:
jg 006fea08
cmp dword ptr [ebx+000000b4],01
jne 006fe9c4
push [ebx+000000a4]
call 006cdbed
pop ecx
mov ecx,esi
sub ecx,[ebx+00000100]
jmp 006fea08

TENKB:
cmp [TENTIMESTOP01],1
jle TENKB00
ret

TENKB00:
mov ecx,[00aa8ae4]
mov ecx,[ecx+18]
mov [TENKEYTIME],ecx
ret
//-----------------------------------------------
[DISABLE]
dealloc(TEN)
unregistersymbol(TEN)
dealloc(TENKEY)
unregistersymbol(TENKEY)
dealloc(TENTIMESTOP)
unregistersymbol(TENTIMESTOP)
dealloc(TENTIMESTOP01)
unregistersymbol(TENTIMESTOP01)
dealloc(TENTIMESTOPOF)
unregistersymbol(TENTIMESTOPOF)
dealloc(TENTIMESTOPEDI)
unregistersymbol(TENTIMESTOPEDI)
dealloc(TENTIMESTOP100)
unregistersymbol(TENTIMESTOP100)
dealloc(TENKEYTIME)
unregistersymbol(TENKEYTIME)

//TWMS094
//時間：2009/5/23
//更新：moyamoya
//原作：zgenden
//代碼：0051DA5C
//EIP：MAXONE
//功能：跳怪掉落1.跳怪掉落2
//-----------------------------------------------
[ENABLE]
registersymbol(MAXONE)
alloc(MAXONE,2048)
label(MAXONE00)
label(ONE)
registersymbol(ONEKEY)
alloc(ONEKEY,4)
registersymbol(ONEKEY00)
alloc(ONEKEY00,4)
registersymbol(JUPKEY)
alloc(JUPKEY, 4)
label(JUP)
label(JUP2)
label(TWO)
label(TWO00)
registersymbol(JUPKEY2)
alloc(JUPKEY2, 4)
//-----------------------------------------------
ONEKEY00:
DD 1   //總開關:   0.關 1.開

JUPKEY:
DD 1   //跳怪掉落1: 0.關 1.開

JUPKEY2:
DD 1   //跳怪掉落2: 0.關 1.開

//-----------------------------------------------
MAXONE:
cmp [ONEKEY00],0
je MAXONE00


cmp dword ptr [esp], 008D239A
je ONE
cmp dword ptr [esp], 008D2896
je TWO
ret


MAXONE00:
ret
//-----------------------------------------------
ONE:
add esp,4
cmp [JUPKEY],1
je JUP
fsubr qword ptr [ebp-18]
jmp 008D239D
//-----------------------------------------------
JUP:
cmp [ebx+0230],2
jne JUP2
mov [ebx+02D0],0
fsubr qword ptr [ebp-18]
add esp,10
fst qword ptr [ebp-18]
fcomp qword ptr [009E2B98]
jmp 008D2729
//-----------------------------------------------
JUP2:
fsubr qword ptr [ebp-18]
jmp 008D239D
//-----------------------------------------------
TWO:
add esp,4
cmp [JUPKEY2],1
jne TWO00
fcomp qword ptr [ebp-08]
pop ecx
pop ecx
jmp 008D2900
TWO00:
fcomp qword ptr [ebp-08]
jmp 008D2899
//-----------------------------------------------

[DISABLE]
dealloc(MAXONE)
unregistersymbol(MAXONE)
dealloc(ONEKEY)
unregistersymbol(ONEKEY)
dealloc(ONEKEY00)
unregistersymbol(ONEKEY00)
dealloc(JUPKEY)
unregistersymbol(JUPKEY)
dealloc(JUPKEY2)
unregistersymbol(JUPKEY2)

//V94範圍打
//原作:歷史太久了~好像有人發過功能一樣的
//改編:zgenden
//Address: 0061EAAF
//EIP=IwallEXP  
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 1024)
registersymbol(IwallEXPX)
alloc(IwallEXPX, 4)
registersymbol(IwallEXPY)
alloc(IwallEXPY, 4)
label(IwallEXP00)

IwallEXPX:
dd C8     //以人物為中心X軸(16進位).數值越大範圍越大.目前設定200=C8(16進位) 目前[1000]
IwallEXPY:
dd C8     //以人物為中心Y軸(16進位).數值越大範圍越大.目前設定200=C8(16進位) 目前[1000]

IwallEXP:
mov edx,[00AA8944]
mov edx,[edx+000CC8]
add edx,[IwallEXPX]
cmp ecx,edx
jg IwallEXP00
mov edx,[00AA8944]
mov edx,[edx+000CC8]
sub edx,[IwallEXPX]
cmp ecx,edx
jl IwallEXP00

mov edx,[00AA8944]
mov edx,[edx+000CCC]               
add edx,[IwallEXPY]
cmp eax,edx
jg IwallEXP00
mov edx,[00AA8944]
mov edx,[edx+000CCC]               
sub edx,[IwallEXPY]
cmp eax,edx
jl IwallEXP00

mov ecx,[00AA8944]
mov ecx,[ecx+000CC8]
mov eax,[00AA8944]
mov eax,[eax+000CCC]               
mov [ebx+00000444],ecx
jmp  0061EAB5

//-----------------------------

IwallEXP00:
mov [ebx+0000046C],ecx
jmp 0061EAB5

[DISABLE]
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
dealloc(IwallEXPX)
unregistersymbol(IwallEXPX)
dealloc(IwallEXPY)
unregistersymbol(IwallEXPY)
//----------------------------------------

//TWMS094 物品過濾
//代碼：004ECB07
//EIP：ItemFilter
//物品ID：ItemCounter

[ENABLE]
alloc(ItemFilter,124)
alloc(IFTable,16024)
alloc(ItemCounter,4)
label(ifreject)
label(end)
label(skip)
registersymbol(ItemFilter)
registersymbol(ItemCounter)

ItemFilter:
        mov [ItemCounter],eax
        push ebx
        push esi
        xor ebx, ebx
        mov esi,IFTable
ifreject:
        cmp eax,[esi]
        je skip
        cmp [esi],ebx
        je end
        add esi,4
        jmp ifreject
skip:
        mov eax,00
end:
        pop esi
        pop ebx
        mov [edi+34],eax
        jmp  004ECB0D   

IFTable:

dd 00

[DISABLE]
dealloc(ItemFilter)
unregistersymbol(ItemFilter)
dealloc(IFTable)
dealloc(ItemCounter)
unregistersymbol(ItemCounter)

---

作者: 冰楓    時間: 2014-2-5 19:34
標題: TWMS096 （一些舊數據，僅供參考＆研究）

//=======================================
//TWMS096 物品過濾
//代碼：004ECF1D   
//EIP：ItemFilter
//物品ID：ItemCounter
//=======================================
[ENABLE]
alloc(ItemFilter,124)
alloc(IFTable,16024)
alloc(ItemCounter,4)
label(ifreject)
label(end)
label(skip)
registersymbol(ItemFilter)
registersymbol(ItemCounter)

ItemFilter:
        mov [ItemCounter],eax
        push ebx
        push esi
        xor ebx, ebx
        mov esi,IFTable
ifreject:
        cmp eax,[esi]
        je skip
        cmp [esi],ebx
        je end
        add esi,4
        jmp ifreject
skip:
        mov eax,00
end:
        pop esi
        pop ebx
        mov [edi+34],eax
        jmp 004ECF23

IFTable:

dd 00

[DISABLE]
dealloc(ItemFilter)
unregistersymbol(ItemFilter)
dealloc(IFTable)
dealloc(ItemCounter)
unregistersymbol(ItemCounter)

//  TWM0.96 快速恢復HP/MP 縮短版
//  代碼：004256F6
//  EIP=HookFR
//  說明：恢復時間10秒縮短為9秒，每9秒恢復HP/MP時增加回補的次數
//====================
[Enable]
  alloc(HookFR,512)
  registersymbol(HookFR)
  label(HookRet)
  label(HPHandler)
  label(MPHandler)
  label(FastRecoverHP)
  label(DoNormalHP)
  label(HPCheck)
  alloc(HPCounter,4)
  alloc(SetHPCounter,4)
  registersymbol(SetHPCounter)
  label(FastRecoverMP)
  label(DoNormalMP)
  label(MPCheck)
  alloc(MPCounter,4)
  alloc(SetMPCounter,4)
  registersymbol(SetMPCounter)
//====================
HookFR:
  cmp [esp],0091335D
  je HPHandler
  cmp [esp],009134CB
  je MPHandler
HookRet:
  push ebp
  jmp 004256F7  
HPHandler:
  mov [esp],FastRecoverHP
  jmp HookRet
MPHandler:
  mov [esp],FastRecoverMP
  jmp HookRet
//====================
FastRecoverHP:
  cmp [HPCounter],0
  je HPCheck
  dec [HPCounter]
  cmp ebx,1
  jmp DoNormalHP
HPCheck:
  cmp ebx,2185
  jna DoNormalHP
  push eax
  mov eax,[SetHPCounter]
  dec eax
  mov [HPCounter],eax
  pop eax
DoNormalHP:
  jmp 00913360
//====================
FastRecoverMP:
  cmp [MPCounter],0
  je MPCheck
  dec [MPCounter]
  cmp ebx,1
  jmp DoNormalMP
MPCheck:
  cmp ebx,2185
  jna DoNormalMP
  push eax
  mov eax,[SetMPCounter]
  dec eax
  mov [MPCounter],eax
  pop eax
DoNormalMP:
  jmp 009134D1
//====================
SetHPCounter:
  dd A          // 回10次 HP，易斷線的請調低次數
SetMPCounter:
  dd 8          // 回8次 MP，易斷線的請調低次數
//====================
[Disable]
  unregistersymbol(HookFR)
  dealloc(HookFR)
  dealloc(HPCounter)
  dealloc(SetHPCounter)
  unregistersymbol(SetHPCounter)
  dealloc(MPCounter)
  dealloc(SetMPCounter)
  unregistersymbol(SetMPCounter)

TWms 0.96
//代碼=004EBF29   EIP=PetGetItem
[enable]
registersymbol(PetGetItem)
alloc(PetGetItem,256)
registersymbol(PetGetItemSwitch)
alloc(PetGetItemSwitch,4)
label(NormalPet)

PetGetItemSwitch:
dd 1   // 開關   0 是關   1 是開

PetGetItem:
cmp [PetGetItemSwitch],0
je NormalPet
push ebx
mov ebx,[ebp+0c]
mov [ebx],edi
mov [ebx+04],eax
pop ebx
jmp 004EBF40
NormalPet:
lea eax,[ebp-38]
push eax
call dword ptr [00ab12bc]
jmp 004EBF33

[disable]
unregistersymbol(PetGetItem)
dealloc(PetGetItem)
unregistersymbol(PetGetItemSwitch)
dealloc(PetGetItemSwitch)

//=================================================
[enable]
//疾風N合一 for TWMS096
//原作：jajaja, 感謝99,A,D,L,N,W,W(縮寫)
//原出處：疾風之莊
//功能：走,跳怪方向【左趴往左,右趴往右,坐下停止控制】、笨怪、10秒損血一次、
//紅點暫停、跳怪不跳、致命的吸引力【定點及跟隨角色二種模式，啟動方式提示：5秒】
//Address：004145AB
//EIP：MyLR
//=================================================
alloc(MyLR,1024)
registersymbol(MyLR)
alloc(MyDir,4)
alloc(MyCt,4)
alloc(MyPt1,4)
label(MyLR1)
label(GoLR)
label(GoLR1)
label(GoLR2)
label(GoLR3)
label(GoLR4)
label(GoLR5)
label(GoLRback)
label(JmpLR)
label(JmpLR1)
label(JmpLR2)
label(JmpLRback)
label(MyStupid)
label(MyNoBack)
label(MyState)
label(MyCharX)
label(MyNoJmp)
label(LRDir1)
label(LRDir2)
label(LRDir3)
label(LRDir4)
label(LRDir5)
label(LRDir6)

label(LRDir7)         //跳怪掉落
registersymbol(LR)//跳怪掉落
alloc(LR,4)             //跳怪掉落

registersymbol(RunSW)//熱鍵紅點模組化
alloc(RunSW, 4)            //熱鍵紅點模組化
alloc(Runtemp, 4)          //熱鍵紅點模組化

registersymbol(ATTACKOF)    //攻擊加速
alloc(ATTACKOF,4)                //攻擊加速
label(CALLATTACK)               //攻擊加速
label(CALLATTACK01)           //攻擊加速
label(CALLATTACK02)           //攻擊加速
registersymbol(ATTACKTIME)//攻擊加速
alloc(ATTACKTIME,4)            //攻擊加速

registersymbol(VarMaxBloom)//PG無敵
registersymbol(VarMinBloom)//PG無敵
alloc(VarMaxBloom, 4)          //PG無敵
alloc(VarMinBloom, 4)           //PG無敵
label(CBR100)                      //PG無敵

RunSW:               //熱鍵紅點模組化
dd      0                //熱鍵紅點模組化
Runtemp:             //熱鍵紅點模組化
dd      1                //熱鍵紅點模組化

//--------↓PG無敵↓--------------
  VarMaxBloom:               //
  dd 2                       //最高損血量: 初始值: 2滴, 採用16進次
  VarMinBloom:               //
  dd 1                       //最低損血量: 初始值: 1滴, 採用16進次 (設0=miss)
//--------↑PG無敵↑--------------

//-------↓攻擊加速↓-------------
  ATTACKOF:
  DD 7d0   //加速時間:目前設定2秒   3秒=3000毫秒=BB8.不穩定的增加數值.穩定的可以試著減少數值
  ATTACKTIME:
  DD 0
//-------↑攻擊加速↑-------------

LR:   //跳怪掉落
DD 1  //跳怪掉落  1停3左2右.可是要搭配疾風右走才行

MyDir:
DD 1

MyLR:
push eax

cmp [00AADCB4],00000000   //停止呼吸        
je MyLR1                                 //停止呼吸
mov eax,[00AADCB4]              //停止呼吸
mov [eax+374],0                      //停止呼吸

cmp [00AADCC4],00000000   //超級檢物
je MyLR1                                //超級檢物
mov eax,[00AADCC4]             //超級檢物
mov [eax+206C], 0                 //超級檢物

cmp [00AADCC8],00000000                  
je MyLR1
//----------↓熱鍵紅點模組化↓-------------
    push eax
    mov eax,[RunSW]
    xor [Runtemp],eax
    mov [RunSW],0
    cmp [Runtemp],1
    pop eax
    jne MyLR1   
    push eax
    mov eax,[00AADCC8] //紅點
    mov eax,[eax+18]   //  
    add [Runtemp],eax
    cmp [Runtemp],150  // 這裏修改 1是自己 加1個人改2  以此累推
    mov [Runtemp],1
    pop eax
    ja MyLR1   
//---------↑熱鍵紅點模組化↑------------------

pop eax
cmp dword ptr [esp], 008D50A2
je GoLR
cmp dword ptr [esp], 008D54BC
je JmpLR
cmp dword ptr [esp], 008D411D
je MyStupid
cmp dword ptr [esp], 0087D3E1
jz MyNoBack
cmp dword ptr [esp], 008D5474
jz MyNoJmp
ret

MyLR1:
pop eax
ret

//---------------↓攻擊加速↓-----------------------------------------------
CALLATTACK:   
push eax
mov eax,[00AADE54]
mov eax,[eax+18]
cmp eax,[ATTACKTIME]
pop eax
jg CALLATTACK01
ret

CALLATTACK01:
push eax
mov eax,[00AADCB4]
mov eax,[eax+37C]
cmp eax,ffffffff
pop eax
jne CALLATTACK02
ret

CALLATTACK02:
push eax
mov eax,[00AADCB4]
mov [eax+37C],ffffffff
mov eax,[00AADE54]
mov eax,[eax+18]
add eax,[ATTACKOF]
mov [ATTACKTIME],eax
pop eax
ret
//-----------------↑攻擊加速↑-----------------------------------


GoLR:
add esp,4
call MyState
push 03
pop ecx
mov [edi+20],eax
xor edx,edx
div ecx
cmp [MyDir], 1
je GoLRback
cmp [MyDir], 3
je GoLR1
cmp [MyDir], 4
je GoLR3
cmp edx, [MyDir]
je GoLRback
mov [esi+000004A4],0
jmp GoLRback
GoLR1:
push eax
call MyCharX
jmp GoLR4
GoLR3:
push eax
mov eax,[MyPt1]
GoLR4:
cmp edx, 1
je GoLR5         
jg GoLR2
cmp eax,[esi+1c4]
pop eax
mov [esi+000004A4],5
jl GoLRback
mov [esi+000004A4],0
jmp GoLRback
GoLR2:
cmp eax,[esi+1c4]
pop eax
mov [esi+000004A4],5
jg GoLRback
mov [esi+000004A4],0
jmp GoLRback
GoLR5:
pop eax
mov [esi+000004A4],0
GoLRback:
jmp 008D50AC
//================================
JmpLR:
add esp,4
call MyState
cmp [MyDir], 1
je JmpLRback
cmp [MyDir], 2
mov eax,2
je JmpLRback
cmp [MyDir], 0
mov eax,3
je JmpLRback
cmp [MyDir], 4
je JmpLR1
call MyCharX
jmp JmpLR2
JmpLR1:
mov eax,[MyPt1]
JmpLR2:
cmp eax,[esi+1c4]
mov eax,2
mov [esi+000004A4],5
jg JmpLRback
mov eax,3
JmpLRback:

//------↓跳怪掉落↓------------
cmp [esi+00000230],1 //<----------避免改到走怪
je LRDir7
cmp eax,[LR]
jne LRDir7
sub [esi+00000230],2 //<-----這裡不要亂動 改錯了怪亂飄會鎖
LRDir7: //<------------
//------↑跳怪掉落↑------------

push 03
jmp  008D54BE
//================================
MyCharX:
mov eax [00AADCB4]
mov eax, [eax+0CC8]
ret
//================================
MyState:
push eax
mov eax, [00AADCB4]
mov eax, [eax+0378]
cmp eax, a
je LRDir1
cmp eax, b
je LRDir2
cmp eax, 14
je LRDir3
cmp eax, 15
je LRDir3
mov [MyCt], 0
jmp LRDir4
LRDir1:
mov [MyDir],2
cmp [MyCt], 32
ja LRDir5
inc [MyCt]
jmp LRDir4
LRDir2:
mov [MyDir],0
cmp [MyCt], 32
ja LRDir6
inc [MyCt]
jmp LRDir4
LRDir3:
mov [MyDir],1
jmp LRDir4
LRDir5:
mov [MyDir],3
jmp LRDir4
LRDir6:
mov [MyDir],4
call MyCharX
mov [MyPt1],eax
LRDir4:
pop eax
ret
//============================
MyStupid:

call CALLATTACK  //攻擊加速

add esp, 4
xor edx,edx
mov ecx,0000ea60
div ecx
lea eax,[esi+00000238]
add edx,0002bf20
mov [esi+00000240],edx
mov edx,[esp+10]
cmp [eax],edx
je 008D4168
cmp [esi+0000023c],edi   
lea ecx,[esi+0000023c]
je 008D4168
jmp 008D414E
//============================
MyNoBack:
add esp,4

//--------↓PG無敵↓--------------
push eax
push ebx
push ecx
push edx
xor edx, edx
mov eax,[00AADCB4]     
mov eax,[eax+18]      
mov ecx, [VarMaxBloom]
mov ebx, [VarMinBloom]
sub ecx, ebx
jz CBR100
div ecx // edx:eax 除 ecx, 餘數放edx   簡單說 就是 除以差值 取餘數
CBR100:
add edx, ebx          //餘數+上最小值
mov [ebp+8], edx    //把結果丟進去扣寫
pop edx
pop ecx
pop ebx
pop eax
//--------↑PG無敵↑--------------

lea    ecx, [edi+000017F4]
push FFFFD8F0 //原始值=FFFFFA24，修改此處可更改無敵秒數
jmp 0087DA1A
//============================
MyNoJmp:
add esp,4
jmp 008D5488
[disable]
dealloc(MyLR)
unregistersymbol(MyLR)
dealloc(MyDir)
dealloc(MyCt)
dealloc(MyPt1)

dealloc(ATTACKOF)                  //攻擊加速
unregistersymbol(ATTACKOF)  //攻擊加速
dealloc(ATTACKTIME)               //攻擊加速
unregistersymbol(ATTACKTIME)//攻擊加速

unregistersymbol(LR)//跳怪掉落
dealloc(LR)               //跳怪掉落

unregistersymbol(RunSW) //熱鍵紅點模組化
dealloc(RunSW)                //熱鍵紅點模組化
dealloc(Runtemp)              //熱鍵紅點模組化

//版本:TWMS096
//數據名稱:攻擊不停
// 代碼 :008D1CE7
// EIP : CSX
[Enable]
registersymbol(CSX)
alloc(CSX,128)
label(CSXReturn)
CSX://CSEAX X  
push eax
mov eax,[00AADCB4]  
mov eax,[eax+2500]
cmp eax,2   
pop eax
jg CSXReturn

push eax
mov eax,[00AADCB4]
mov eax,[eax+0D08]
cmp esi,eax
pop eax
jne CSXReturn
add eax,0a
jmp CSXReturn

CSXReturn:
mov [ebx], eax
jmp 008D1CE9

[Disable]
unregistersymbol(CSX)
dealloc(CSX)

//TWMS096 滑鼠移動(右趴左趴板)
//EIP=CSX
//address:008D1CE7
//熱鍵控制:    右趴下＝開   左趴下＝關
[Enable]
alloc(MouserX,512)
alloc(MouserY,512)
alloc(CSX,128)
registersymbol(CSX)
alloc(OnOff,128)
registersymbol(OnOff)
label(normal)
label(normalx)
label(normaly)
label(back)
label(return)
label(On)
label(Off)

OnOff:
dd 0

CSX:
push eax
mov eax,[00AADCB4]   
cmp [eax+0378],a
je On
cmp [eax+0378],b
je Off
pop eax
jmp MouserX

normal:
pop eax
mov [ebx], eax
mov edi,[ebp+10]
jmp back

back:
jmp   008D1CEC

return:
jmp   008D1D51

On:
pop eax
mov [OnOff],1
jmp MouserX

Off:
pop eax
mov [OnOff],0
jmp MouserX

MouserX:
    cmp [OnOff],0
    je normalx
    push eax
    mov eax,[00AADCB4]
    mov eax,[eax+0D08]
    cmp esi,eax
    pop eax
    jne normalx
   
    mov eax, [00AADE50]
    mov eax, [eax+0978]
    mov eax, [eax+84]
    mov [ebx], eax
    mov edi,[ebp+10]
    test    edi, edi
    jne     MouserY
    jmp    008D1D4E
   
   normalx:
     mov [ebx], eax
     mov edi,[ebp+10]
     jmp back
   
MouserY:
    push eax
    mov eax,[00AADCB4]
    mov eax,[eax+0D08]
    cmp esi,eax
    pop eax
    jne normaly
   
    mov eax, [00AADE50]
    mov eax, [eax+0978]
    mov eax, [eax+88]
    mov [edi], eax
    mov ebx,[ebp+14]
    jmp return
   
   normaly:
     mov [edi], eax
     mov ebx,[ebp+14]
     jmp return

[Disable]
dealloc(MouserX)
dealloc(MouserY)
dealloc(CSX)
unregistersymbol(CSX)
dealloc(OnOff)
unregistersymbol(OnOff)

//TWMS096
//時間：2009/6/24
//更新：moyamoya
//原作：zgenden
//代碼：0051DE2A
//EIP：MAXONE
//功能：跳怪掉落1.跳怪掉落2
//-----------------------------------------------
[ENABLE]
registersymbol(MAXONE)
alloc(MAXONE,2048)
label(MAXONE00)
label(ONE)
registersymbol(ONEKEY)
alloc(ONEKEY,4)
registersymbol(ONEKEY00)
alloc(ONEKEY00,4)
registersymbol(JUPKEY)
alloc(JUPKEY, 4)
label(JUP)
label(JUP2)
label(TWO)
label(TWO00)
registersymbol(JUPKEY2)
alloc(JUPKEY2, 4)
//-----------------------------------------------
ONEKEY00:
DD 1   //總開關:   0.關 1.開

JUPKEY:
DD 1   //跳怪掉落1: 0.關 1.開

JUPKEY2:
DD 1   //跳怪掉落2: 0.關 1.開

//-----------------------------------------------
MAXONE:
cmp [ONEKEY00],0
je MAXONE00


cmp dword ptr [esp], 008D5D2B
je ONE
cmp dword ptr [esp], 008D6227
je TWO
ret


MAXONE00:
ret
//-----------------------------------------------
ONE:
add esp,4
cmp [JUPKEY],1
je JUP
fsubr qword ptr [ebp-18]
jmp 008D5D2E
//-----------------------------------------------
JUP:
cmp [ebx+0230],2
jne JUP2
mov [ebx+02D0],0
fsubr qword ptr [ebp-18]
add esp,10
fst qword ptr [ebp-18]
fcomp qword ptr [009E7B98]
jmp 008D60BA
//-----------------------------------------------
JUP2:
fsubr qword ptr [ebp-18]
jmp 008D5D2E
//-----------------------------------------------
TWO:
add esp,4
cmp [JUPKEY2],1
jne TWO00
fcomp qword ptr [ebp-08]
pop ecx
pop ecx
jmp 008D6291
TWO00:
fcomp qword ptr [ebp-08]
jmp 008D622A
//-----------------------------------------------

[DISABLE]
dealloc(MAXONE)
unregistersymbol(MAXONE)
dealloc(ONEKEY)
unregistersymbol(ONEKEY)
dealloc(ONEKEY00)
unregistersymbol(ONEKEY00)
dealloc(JUPKEY)
unregistersymbol(JUPKEY)
dealloc(JUPKEY2)
unregistersymbol(JUPKEY2)

//原作:歷史太久了~好像有人發過功能一樣的
//全圖打(可調範圍)TWMS096
//Address:0061EE58
//EIP=IwallEXP
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 1024)
registersymbol(IwallEXPX)
alloc(IwallEXPX, 4)
registersymbol(IwallEXPY)
alloc(IwallEXPY, 4)
label(IwallEXP00)

IwallEXPX:
dd C8     //以人物為中心X軸(16進位).數值越大範圍越大.目前設定200=C8(16進位)
IwallEXPY:
dd C8     //以人物為中心Y軸(16進位).數值越大範圍越大.目前設定200=C8(16進位)

IwallEXP:
mov edx,[00AADCB4]
mov edx,[edx+0CC8]
add edx,[IwallEXPX]
cmp ecx,edx
jg IwallEXP00
mov edx,[00AADCB4]
mov edx,[edx+0CC8]
sub edx,[IwallEXPX]
cmp ecx,edx
jl IwallEXP00

mov edx,[00AADCB4]
mov edx,[edx+0CCC]
add edx,[IwallEXPY]
cmp eax,edx
jg IwallEXP00
mov edx,[00AADCB4]
mov edx,[edx+0CCC]
sub edx,[IwallEXPY]
cmp eax,edx
jl IwallEXP00

mov ecx,[00AADCB4]
mov ecx,[ecx+0CC8]
mov eax,[00AADCB4]
mov eax,[eax+0CCC]
mov [ebx+00000444],ecx
jmp 0061EE5E

//-----------------------------

IwallEXP00:
mov [ebx+00000444],ecx
jmp 0061EE5E

[DISABLE]
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
dealloc(IwallEXPX)
unregistersymbol(IwallEXPX)
dealloc(IwallEXPY)
unregistersymbol(IwallEXPY)

//V96 招喚獸無延遲 低功率安全版
//原作:zgenden
//更版:crazy51201
//Address:006FFD46
//EIP:TEN
//注意:不能搭配順移.不能搭配全圖.不能搭配物品落腳下
//注意:召喚獸出現，不能換頻，不能過地圖
//-----------------------------------------------
[ENABLE]
registersymbol(TEN)
alloc(TEN,1024)
registersymbol(TENKEY)
alloc(TENKEY,4)
registersymbol(TENTIMESTOP)
alloc(TENTIMESTOP,4)
registersymbol(TENTIMESTOP01)
alloc(TENTIMESTOP01,4)
registersymbol(TENTIMESTOPOF)
alloc(TENTIMESTOPOF,4)
registersymbol(TENTIMESTOPEDI)
alloc(TENTIMESTOPEDI,4)
registersymbol(TENTIMESTOP100)
alloc(TENTIMESTOP100,4)
label(TEN00)
label(TEN02)
label(TENKB)
label(TENKB00)
registersymbol(TENKEYTIME)
alloc(TENKEYTIME,4)
//-----------------------------------------------
TENKEY:
dd 1 //熱鍵: 0.關 1.開
TENTIMESTOP:
DD 0
TENTIMESTOP01:
DD 0
TENTIMESTOPOF:
DD 0
TENTIMESTOPEDI:
DD 0
TENTIMESTOP100:
DD 0
TENKEYTIME:
DD 0

TEN:
cmp [TENKEY],0
je TEN00
cmp [TENTIMESTOPEDI],edi
je TEN02
mov [TENTIMESTOPEDI],edi
mov [TENTIMESTOP],0
mov [TENTIMESTOP01],0
mov [TENTIMESTOPOF],0
TEN02:
call TENKB
mov ecx,[00aade54]     //
mov ecx,[ecx+18]
sub ecx,C8 //每次進行攻擊秒數目前1秒無延遲
cmp ecx,[TENKEYTIME]
jg TEN00
mov ecx,[00aade54]    //
mov ecx,[ecx+18]
sub ecx,1 //每一次攻擊延遲時間.目前0(無延遲)
cmp ecx,[TENTIMESTOP]
jle TEN00
cmp [TENTIMESTOP01],a //偵測攻擊次數.目前10下
jge TEN00
push [ebx+000000a4]
call 006cef91
pop ecx
mov ecx,esi
sub ecx,[ebx+00000100]
push esi
mov ecx,ebx
call 00700a01
push eax
mov eax,[ebx+00000100]
cmp [TENTIMESTOP100],eax
pop eax
je 006ffdb7
push eax
mov eax,[ebx+00000100]
mov [TENTIMESTOP100],eax
mov eax,[00aade54]    //
mov eax,[eax+18]
mov [TENTIMESTOP],eax
pop eax
add [TENTIMESTOP01],1
jmp 006ffdb7
  
TEN00:
jg 006ffdb7
cmp dword ptr [ebx+000000b4],01
jne 006ffd73
push [ebx+000000a4]
call 006cef91
pop ecx
mov ecx,esi
sub ecx,[ebx+00000100]
jmp 006ffdb7

TENKB:
cmp [TENTIMESTOP01],1
jle TENKB00
ret

TENKB00:
mov ecx,[00aade54]   //
mov ecx,[ecx+18]
mov [TENKEYTIME],ecx
ret
//-----------------------------------------------
[DISABLE]
dealloc(TEN)
unregistersymbol(TEN)
dealloc(TENKEY)
unregistersymbol(TENKEY)
dealloc(TENTIMESTOP)
unregistersymbol(TENTIMESTOP)
dealloc(TENTIMESTOP01)
unregistersymbol(TENTIMESTOP01)
dealloc(TENTIMESTOPOF)
unregistersymbol(TENTIMESTOPOF)
dealloc(TENTIMESTOPEDI)
unregistersymbol(TENTIMESTOPEDI)
dealloc(TENTIMESTOP100)
unregistersymbol(TENTIMESTOP100)
dealloc(TENKEYTIME)
unregistersymbol(TENKEYTIME)

---

作者: 冰楓    時間: 2014-2-5 19:38
標題: TWMS098 （一些舊數據，僅供參考＆研究）

[ENABLE]
//真。招喚獸攻擊無延遲ＣＲＣ　Ｖ９８　版本
//原作:zgenden
registersymbol(FixTime)
alloc(FixTime,1024)
registersymbol(FixTimeOF)
alloc(FixTimeOF,4)
registersymbol(Fix)
alloc(Fix,1024)
registersymbol(FixSSTime)
alloc(FixSSTime,4)
registersymbol(FixSSTime10C)
alloc(FixSSTime10C,4)
label(Fix00)
label(Fix01)
//-----------------------------------------------
Fix:
push eax
mov eax,[ebx+0000010c]
cmp [FixSSTime10C],eax
pop eax
je Fix01
push eax
mov eax,[FixTimeOF]
cmp eax,[FixSSTime]
pop eax
je Fix00
push eax
mov eax,[ebx+0000010c]
mov [FixSSTime10C],eax
mov eax,[FixTimeOF]
mov [FixSSTime],eax
pop eax


Fix01:
push [ebx+000000b0]
call 006eabc4
pop ecx
mov ecx,esi
sub ecx,[ebx+0000010c]
push esi
mov ecx,ebx
call 0071d630
jmp 0071c9e0


//-----------------------------------------------
Fix00:
jg 0071c9e0
cmp dword ptr [ebx+000000c0],01
jmp 0071C978
//-----------------------------------------------

FixTime:
add [FixTimeOF],2710
mov eax,[FixTimeOF]
ret

0071C96F:
jmp Fix
nop
nop
nop
nop

0071E051:
call FixTime
//-----------------------------------------------
[DISABLE]
0071C96F:
jg 0071c9e0
cmp dword ptr [ebx+000000c0],01

//-----------------------------------------------
dealloc(FixTime)
unregistersymbol(FixTime)
//-----------------------------------------------
dealloc(Fix)
unregistersymbol(Fix)

//寵物吸物
//004F0355   8D 45 C8 50 FF 15 64 59 A3 00 85 C0 75 09 83 4D FC FF 39 5D DC EB 27 8B
[enable]
registersymbol(PetGetItem)
alloc(PetGetItem,256)
registersymbol(PetGetItemSwitch)
alloc(PetGetItemSwitch,4)
label(NormalPet)

PetGetItemSwitch:
dd 1   // 開關   0 是關   1 是開

PetGetItem:
cmp [PetGetItemSwitch],0
je NormalPet
push ebx
mov ebx,[ebp+0c]
mov [ebx],edi
mov [ebx+04],eax
pop ebx
jmp 004F036C//+8//8B 45 DC 39 58 30 74 07 B8 FF FF FF 7F EB 03 8B 40 34 8B 4D E0 50 E8 87
NormalPet:
lea eax,[ebp-38]
push eax
call dword ptr [00abf824]//第2ㄍ代碼那行
jmp 004F035F//+3

004F0355:
JMP PetGetItem
[disable]
004F0355:

//==================================================
//  TWMS_V098 快速恢復HP/MP 合併版
//  代碼原創：qqazedctgb
  //修改：wewe7070
//  日期：98/07/29
//
//  說明：每次恢復10倍HP，8倍MP
//==================================================

[Enable]
  alloc(HookFR,1024)
  registersymbol(HookFR)
  label(HookRet)
  label(HPHandler)
  label(MPHandler)

  label(FastRecoverHP)
  label(DoNormalHP)
  label(HPCheck)
  alloc(HPCounter,4)
  alloc(SetHPCounter,4)
  alloc(RecoverTime,4)
  registersymbol(SetHPCounter)

  label(FastRecoverMP)
  label(DoNormalMP)
  label(MPCheck)
  alloc(MPCounter,4)
  alloc(SetMPCounter,4)
  registersymbol(SetMPCounter)

HookFR:
  cmp [esp],0093BE5C
  je HPHandler
  cmp [esp],0093BFCA
  je MPHandler
HookRet:
  push ebp
  mov ebp,esp
  sub esp,0c
  jmp 00425b33
HPHandler:
  mov [esp],FastRecoverHP
  jmp HookRet
MPHandler:
  mov [esp],FastRecoverMP
  jmp HookRet

FastRecoverHP:
  push eax
  mov eax,[ebp-1c]
  mov [RecoverTime],eax
  pop eax

  cmp [HPCounter],0
  je HPCheck
  dec [HPCounter]
  cmp ebx,1
  jmp 0093BE5F

HPCheck:
  sub [RecoverTime],0A
  cmp ebx,[RecoverTime]
  jna DoNormalHP

  push eax
  mov eax,[SetHPCounter]
  dec eax
  mov [HPCounter],eax
  pop eax

DoNormalHP:
  cmp ebx,[ebp-1c]
  jmp 0093BE5F


FastRecoverMP:
  cmp [MPCounter],0
  je MPCheck
  dec [MPCounter]
  cmp ebx,1
  jmp 0093BFD0

MPCheck:
  cmp ebx,00002708
  jna DoNormalMP
  push eax
  mov eax,[SetMPCounter]
  dec eax
  mov [MPCounter],eax
  pop eax

DoNormalMP:
  cmp ebx,00002710
  jmp 0093BFD0

SetHPCounter:
  dd A          // 10倍HP，易斷線的請調低倍數
SetMPCounter:
  dd 8          // 8倍MP，易斷線的請調低倍數
00425B2D:
jmp HookFR
[Disable]
00425B2D:
db 55 8b ec 83 ec 0c
  unregistersymbol(HookFR)
  dealloc(HookFR)

  dealloc(HPCounter)
  dealloc(SetHPCounter)
  dealloc(RecoverTime)
  unregistersymbol(SetHPCounter)

  dealloc(MPCounter)
  dealloc(SetMPCounter)
  unregistersymbol(SetMPCounter)

//原作:歷史太久了~好像有人發過功能一樣的
//全圖打(可調範圍)TWMS098
//Address:00635C25
//EIP=IwallEXP
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 1024)
registersymbol(IwallEXPX)
alloc(IwallEXPX, 4)
registersymbol(IwallEXPY)
alloc(IwallEXPY, 4)
label(IwallEXP00)

IwallEXPX:
dd C8     //以人物為中心X軸(16進位).數值越大範圍越大.目前設定200=C8(16進位)
IwallEXPY:
dd C8     //以人物為中心Y軸(16進位).數值越大範圍越大.目前設定200=C8(16進位)

IwallEXP:
mov edx,[00ADC0D4]
mov edx,[edx+0D2C]
add edx,[IwallEXPX]
cmp ecx,edx
jg IwallEXP00
mov edx,[00ADC0D4]
mov edx,[edx+0D2C]
sub edx,[IwallEXPX]
cmp ecx,edx
jl IwallEXP00

mov edx,[00ADC0D4]
mov edx,[edx+0D30]
add edx,[IwallEXPY]
cmp eax,edx
jg IwallEXP00
mov edx,[00ADC0D4]
mov edx,[edx+0D30]
sub edx,[IwallEXPY]
cmp eax,edx
jl IwallEXP00

mov ecx,[00ADC0D4]
mov ecx,[ecx+0D2C]
mov eax,[00ADC0D4]
mov eax,[eax+0D30]
mov [ebx+00000484],ecx
jmp 00635C2B

//-----------------------------

IwallEXP00:
mov [ebx+00000484],ecx
jmp 00635C2B

[DISABLE]
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
dealloc(IwallEXPX)
unregistersymbol(IwallEXPX)
dealloc(IwallEXPY)
unregistersymbol(IwallEXPY)

//================================================
// 名稱: 物品過濾
// 功能: 過濾不要的物品
// 版本: TWMS098
// 更新時間: 2009/7/30
// 更新作者: momomom
// ADD: 004F1349
// EIP: ItemFilter
// 物品位址EIP: ItemCounter
//================================================

    [ENABLE]
    //================================================
    // 名稱: 物品過濾
    // 功能: 過濾不要的物品
    // 版本: TWMS098
    // 更新時間: 2009/7/30
    // 更新作者: momomom
    // ADD: 004F1349
    // EIP: ItemFilter
    // 物品位址EIP: ItemCounter
    //================================================
    alloc(ItemFilter,124)
    alloc(IFTable,16024)
    alloc(ItemCounter,4)
    label(ifreject)
    label(end)
    label(skip)
    registersymbol(ItemFilter)
    registersymbol(ItemCounter)

    ItemFilter:
    mov [ItemCounter],eax
    push ebx
    push esi
    xor ebx, ebx
    mov esi,IFTable
    ifreject:
    cmp eax,[esi]
    je skip
    cmp [esi],ebx
    je end
    add esi,4
    jmp ifreject
    skip:
    mov eax,00
    end:
    pop esi
    pop ebx
    mov [edi+34],eax
    jmp 004F134C

    IFTable:

    dd 00

    [DISABLE]
    dealloc(ItemFilter)
    unregistersymbol(ItemFilter)
    dealloc(IFTable)
    dealloc(ItemCounter)

//V98召喚獸&人物攻擊範圍落腳下
//原作:zgenden
//Address:0062FED6
//EIP:ALLWD
//-----------------------------------------------
[ENABLE]
registersymbol(ALLWD)
alloc(ALLWD,1024)
label(ALLWD00)
label(ALLWD01)
label(ALLWD02)
//-----------------------------------------------
ALLWD:
    push    eax
    mov     eax,[00ADC0D4]
    mov     eax,[eax+00000D2C]
    cmp     [ecx+00000478],eax
    jg      ALLWD01
    jl      ALLWD02
    mov     eax,[00ADC0D4]
    mov     eax,[eax+00000D2C]
    mov     [ecx+00000478],eax
    jmp     ALLWD00
ALLWD00:
    mov     eax,[00ADC0D4]
    mov     eax,[eax+00000D30]
    mov     [ecx+0000047C],eax
    pop     eax
    lea     eax,[ecx+00000478]
    ret
ALLWD01:
    mov     eax,[00ADC0D4]
    mov     eax,[eax+00000D2C]
    add     eax,0               //距離人物右邊值.遠攻者自己調整
    mov     [ecx+00000478],eax
    jmp     ALLWD00
ALLWD02:
    mov     eax,[00ADC0D4]
    mov     eax,[eax+00000D2C]
    sub     eax,0               //距離人物左邊值.遠攻者自己調整
    mov     [ecx+00000478],eax
    jmp     ALLWD00
//-----------------------------------------------
[DISABLE]
dealloc(ALLWD)
unregistersymbol(ALLWD)

//V98招喚獸短擊
//原作:zgenden
//更新:緯洨寶
//Address:0071C88C
//EIP:FIR
//-----------------------------------------------
[ENABLE]
registersymbol(FIR)
alloc(FIR,1024)
registersymbol(FIRTIMESS)
alloc(FIRTIMESS,4)
registersymbol(FIRSKILL)
alloc(FIRSKILL,4)
registersymbol(FIREDI)
alloc(FIREDI,4)
label(FIR00)
label(FIR01)
//-----------------------------------------------
FIRTIMESS:
DD 0     //招喚獸攻擊時間
FIRSKILL:
DD 0     //招喚獸攻擊次數
FIREDI:
DD 0     //招喚獸EDI
//-----------------------------------------------
FIR:
cmp [FIREDI],edi
je FIR00
push eax
call FIR01
pop ecx
pop ecx
mov dword ptr [ebx+000000c0],01
push [ebx+000000dc]
lea eax,[ebx+000000d4]
push eax
call FIR01
pop ecx
pop ecx
mov dword ptr [ebx+000000b4],01
push [ebx+000000a4]
call 006EABC4
pop ecx
push esi
mov ecx,ebx
call 0071D630
push eax
mov eax,[ebx+00000100]
cmp [FIRTIMESS],eax
pop eax
je 0071C9E0
push eax
mov eax,[ebx+00000100]
mov [FIRTIMESS],eax
mov [FIREDI],edi
pop eax
jmp 0071C9E0
//-----------------------------------------------
FIR00:
push eax
jmp 0071C88D
//-----------------------------------------------
FIR01:
push ebp
mov ebp,esp
mov eax,[ebp+08]
push ebx
mov ebx,[eax+04]
push esi
mov esi,[eax]
push edi
push 05
push ebx
call 0099430B
mov edi,eax
xor edi,esi
push 05
xor esi,baadf00d
push esi
call 00993F54
add eax,ebx
add esp,10
mov eax,edi
pop edi
pop esi
pop ebx
pop ebp
ret
//-----------------------------------------------
[DISABLE]
dealloc(FIR)
unregistersymbol(FIR)
dealloc(FIRTIMESS)
unregistersymbol(FIRTIMESS)
dealloc(FIREDI)
unregistersymbol(FIREDI)
dealloc(FIRSKILL)
unregistersymbol(FIRSKILL)

//原作:歷史太久了~好像有人發過功能一樣的
//全圖打(可調範圍)TWMS098
//Address:00635C25
//EIP=IwallEXP
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 2048)
label(IwallEXP00)
label(IwallEXP01)
registersymbol(IwallTimes)
alloc(IwallTimes, 4)
registersymbol(x2)
alloc(x2, 4)
registersymbol(x1)
alloc(x1, 4)
registersymbol(y1)
alloc(y1, 4)
registersymbol(y2)
alloc(y2, 4)
registersymbol(Timer)
alloc(Timer, 4)

IwallTimes:
dd 0
Timer:
dd 1f4   // 500ms
x2:
dd 3e8  // 1000
y2:
dd 1f4  //500

IwallEXP:
mov edx,[00adc274]     //
mov edx,[edx+18]
sub edx,[Timer] //每 500 ms 換下一張圖
cmp edx,[IwallTimes]
jl IwallEXP01

mov edx,[00adc274]     //
mov edx,[edx+18]
mov [IwallTimes],edx

    mov edx,[x2]
    mov [x1],edx
    sub [x2],1f4

    mov edx,[y2]
    mov [y1],edx

    cmp   [x2], FFFFFC18
    jge IwallEXP01

    mov [x2],3e8
    sub [y2],1f4

    cmp   [y2], FFFFFE0C
    jge IwallEXP01

    mov [y2],1f4

IwallEXP01:
mov edx,[00ADC0D4]
mov edx,[edx+0d2c]
add edx,[x1]
cmp ecx,edx
jg IwallEXP00
sub edx,1f4   // 500
cmp ecx,edx
jl IwallEXP00

mov edx,[00ADC0D4]
mov edx,[edx+0d30]
add edx,[y1]
cmp eax,edx
jg IwallEXP00
sub edx,1f4
cmp eax,edx
jl IwallEXP00

mov ecx,[00ADC0D4]
mov ecx,[ecx+0d2c]
mov eax,[00ADC0D4]
mov eax,[eax+0d30]
mov [ebx+00000484],ecx
jmp 00635C2B

//-----------------------------

IwallEXP00:
mov [ebx+00000484],ecx
jmp 00635C2B

[DISABLE]
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
unregistersymbol(IwallTimes)
dealloc(IwallTimes)
unregistersymbol(x1)
dealloc(x1)
unregistersymbol(y1)
dealloc(y1)
unregistersymbol(x2)
dealloc(x2)
unregistersymbol(y2)
dealloc(y2)
unregistersymbol(Timer)
dealloc(Timer)

---

作者: 冰楓    時間: 2014-2-5 19:42
標題: TWMS100 （一些舊數據，僅供參考＆研究）

[ENABLE]
//================================================
// 名稱: 物品過濾
// 功能: 過濾不要的物品
// 版本: TWMS0100
// 更新時間: 2009/8/26
// ADD: 004F2329
// EIP: ItemFilter
// 物品位址EIP: ItemCounter
//================================================
alloc(ItemFilter,124)
alloc(IFTable,16024)
alloc(ItemCounter,4)
label(ifreject)
label(end)
label(skip)
registersymbol(ItemFilter)
registersymbol(ItemCounter)

ItemFilter:
mov [ItemCounter],eax
push ebx
push esi
xor ebx, ebx
mov esi,IFTable
ifreject:
cmp eax,[esi]
je skip
cmp [esi],ebx
je end
add esi,4
jmp ifreject
skip:
mov eax,00
end:
pop esi
pop ebx
mov [edi+34],eax
jmp 004F232C

IFTable:


dd 00

[DISABLE]
dealloc(ItemFilter)
unregistersymbol(ItemFilter)
dealloc(IFTable)
dealloc(ItemCounter)
unregistersymbol(ItemCounter)

//版本:TWMS100
//數據名稱:攻擊不停.放不停
//日期:2009/7/30
// 代碼 :00900642
// EIP : CSX
[Enable]
registersymbol(CSX)
alloc(CSX,128)
label(CSXReturn)
CSX://CSEAX X  
push eax
mov eax,[00AE62C4]
mov eax,[eax+2598]
cmp eax,2
pop eax
jg CSXReturn

push eax
mov eax,[00AE62C4]
mov eax,[eax+2588]
cmp eax,2  
pop eax
jg CSXReturn
push eax
mov eax,[00AE62C4]
mov eax,[eax+0D6C]
cmp esi,eax
pop eax
jne CSXReturn
add eax,0a
jmp CSXReturn
CSXReturn:
mov [ebx], eax
jmp 00900644
[Disable]
unregistersymbol(CSX)
dealloc(CSX)

//==================================================
//  TWMS_V100 快速恢復 HP/MP 合併版
//  代碼原創：qqazedctgb
//  Address：00425C20
//  EIP=HookFR
//  說明：每次恢復10倍HP，8倍MP
//==================================================

[Enable]
  alloc(HookFR,256)
  registersymbol(HookFR)
  label(HookRet)
  label(HPHandler)
  label(MPHandler)

  label(FastRecoverHP)
  label(DoNormalHP)
  label(HPCheck)
  alloc(HPCounter,4)
  alloc(SetHPCounter,4)
  alloc(RecoverTime,4)
  registersymbol(SetHPCounter)

  label(FastRecoverMP)
  label(DoNormalMP)
  label(MPCheck)
  alloc(MPCounter,4)
  alloc(SetMPCounter,4)
  registersymbol(SetMPCounter)

HookFR:
  cmp [esp],00944655
  je HPHandler
  cmp [esp],009447C3
  je MPHandler

HookRet:
  push ebp
  jmp 00425C21

HPHandler:
  mov [esp],FastRecoverHP
  jmp HookRet

MPHandler:
  mov [esp],FastRecoverMP
  jmp HookRet

FastRecoverHP:
  push eax
  mov eax,[ebp-1c]
  mov [RecoverTime],eax
  pop eax

  cmp [HPCounter],0
  je HPCheck
  dec [HPCounter]
  cmp ebx,1
  jmp 00944658

HPCheck:
  sub [RecoverTime],0A
  cmp ebx,[RecoverTime]
  jna DoNormalHP

  push eax
  mov eax,[SetHPCounter]
  dec eax
  mov [HPCounter],eax
  pop eax

DoNormalHP:
  cmp ebx,[ebp-1c]
  jmp 00944658


FastRecoverMP:
  cmp [MPCounter],0
  je MPCheck
  dec [MPCounter]
  cmp ebx,1
  jmp 009447C9

MPCheck:
  cmp ebx,00002708
  jna DoNormalMP
  push eax
  mov eax,[SetMPCounter]
  dec eax
  mov [MPCounter],eax
  pop eax

DoNormalMP:
  cmp ebx,00002710
  jmp 009447C9

SetHPCounter:
  dd A          // 10倍HP，易斷線的請調低倍數
SetMPCounter:
  dd 8          // 8倍MP，易斷線的請調低倍數

[Disable]
  unregistersymbol(HookFR)
  dealloc(HookFR)

  dealloc(HPCounter)
  dealloc(SetHPCounter)
  dealloc(RecoverTime)
  unregistersymbol(SetHPCounter)

  dealloc(MPCounter)
  dealloc(SetMPCounter)
  unregistersymbol(SetMPCounter)

[enable]
//滑鼠控制人物 for TWMS100
//原作者：maggie98
//Address：009006A7
//EIP：MouseRushStart
//熱鍵控制：RushSW【value值設定1，熱鍵自設】
registersymbol(MouseRushStart)
alloc(MouseRushStart, 1024)
registersymbol(RushSW)
alloc(RushSW, 4)
alloc(RushOn, 4)
label(RetMSRush)

RushSW:
        dd      0               // 初始是關閉mouse 趕路
RushOn:
        dd      0
                  
MouseRushStart:
        mov     ebx, [RushSW]
        xor     [RushOn], ebx
        mov     [RushSW], 0
        cmp     [RushOn], 1
        jne     RetMSRush
        mov     ebx, [00AE62C4]
        mov     ebx, [ebx+0D6C]
        cmp     esi, ebx
        jne     RetMSRush
        mov     eax, [00AE6460]
        mov     eax, [eax+978]
        mov     ebx, [eax+84]
        mov     eax, [eax+88]
        mov     [edi-4], ebx
RetMSRush:
        mov     [edi], eax
        jmp     009006A9

[disable]
unregistersymbol(MouseRushStart)
dealloc(MouseRushStart)
unregistersymbol(RushSW)
dealloc(RushSW)
dealloc(RushOn)

//V100招喚獸短擊
//原作:zgenden
//Address:007225F4
//EIP:FIR
//更新wugey
//-----------------------------------------------
[ENABLE]
registersymbol(FIR)
alloc(FIR,1024)
registersymbol(FIRTIMESS)
alloc(FIRTIMESS,4)
registersymbol(FIRSKILL)
alloc(FIRSKILL,4)
registersymbol(FIREDI)
alloc(FIREDI,4)
label(FIR00)
label(FIR01)
label(TEN02)
//-----------------------------------------------
FIRTIMESS:
DD 0     //招喚獸攻擊時間
FIRSKILL:
DD 0     //招喚獸攻擊次數
FIREDI:
DD 0     //招喚獸EDI
//-----------------------------------------------
FIR:
cmp [FIREDI],edi
je TEN02
mov [FIREDI],edi
mov [FIRTIMESS],0
mov [FIRSKILL],0
TEN02:
cmp [FIRSKILL],2   //偵測攻擊次數.目前2下
jge FIR00
call FIR01
pop ecx
pop ecx
mov dword ptr [ebx+000000cc],01
push [ebx+000000e8]
lea eax,[ebx+000000e0]
push eax
call FIR01
pop ecx
pop ecx
mov dword ptr [ebx+000000c0],01
push [ebx+000000b0]
call 006efb78
pop ecx
push esi
mov ecx,ebx
call 00723397
push eax
mov eax,[ebx+0000010c]
cmp [FIRTIMESS],eax
pop eax
je 00722747
push eax
mov eax,[ebx+0000010c]
mov [FIRTIMESS],eax
mov [FIREDI],edi
add [FIRSKILL],1
pop eax
jmp 00722747
//-----------------------------------------------
FIR00:
call 004146b2
jmp 007225F9
//-----------------------------------------------
FIR01:
push ebp
mov ebp,esp
mov eax,[ebp+08]
push ebx
mov ebx,[eax+04]
push esi
mov esi,[eax]
push edi
push 05
push ebx
call 0099d2fb
mov edi,eax
xor edi,esi
push 05
xor esi,baadf00d
push esi
call 0099cf44
add eax,ebx
add esp,10
mov eax,edi
pop edi
pop esi
pop ebx
pop ebp
ret
//-----------------------------------------------
[DISABLE]
dealloc(FIR)
unregistersymbol(FIR)
dealloc(FIRTIMESS)
unregistersymbol(FIRTIMESS)
dealloc(FIREDI)
unregistersymbol(FIREDI)
dealloc(FIRSKILL)
unregistersymbol(FIRSKILL)

//怪物順移全集
//原作:  a00764599
//順移原本代碼作者:  maxjojo
//更新:qwe8966351
//Address : 004146B2
//Eip : ALLFAST
//=================注意================注意===================

[ENABLE]
registersymbol(ALLFAST)
registersymbol(Moves1onoff)
registersymbol(Moves2onoff)
registersymbol(Moves3onoff)
registersymbol(Moves4onoff)

alloc(ALLFAST, 1024)
alloc(Moves1onoff, 4)
alloc(Moves2onoff, 4)
alloc(Moves3onoff, 4)
alloc(Moves4onoff, 4)

label(Stop)
label(Moves1)
label(Moves1Normal)
label(Moves2)
label(Moves2Normal)
label(Moves3)
label(Moves3Normal)
label(Moves4)
label(Moves4Normal)
//=======================================================
//怪瞬移1號開關       【0】關       【1】開
//=======================================================
Moves1onoff:
dd 0
//=======================================================
//怪瞬移2號開關       【0】關       【1】開
//=======================================================
Moves2onoff:
dd 0
//=======================================================
//怪瞬移3號開關       【0】關       【1】開
//=======================================================
Moves3onoff:
dd 0
//=======================================================
//怪瞬移4號開關       【0】關       【1】開
//=======================================================
Moves4onoff:
dd 1
//=======================================================
ALLFAST:
cmp    dword ptr [esp], 0065A07A //怪瞬移1號      
je     Moves1
cmp    dword ptr [esp], 0065A02F //怪瞬移2號   
je     Moves2
cmp    dword ptr [esp], 0065A021 //怪瞬移3號     
je     Moves3
cmp    dword ptr [esp], 0065A09A //怪瞬移4號
je     Moves4
//=======================================================
Stop:
push   ebp
jmp    004146B3
//===怪瞬移1號====================================
Moves1:
cmp    [Moves1onoff], 1
jne    Moves1Normal
ret
Moves1Normal:
jmp    Stop
//===怪瞬移2號====================================
Moves2:
cmp    [Moves2onoff], 1
jne    Moves2Normal
ret
Moves2Normal:
jmp    Stop
//===怪瞬移3號====================================
Moves3:
cmp    [Moves3onoff], 1
jne    Moves3Normal
ret
Moves3Normal:
jmp    Stop
//===怪瞬移4號====================================
Moves4:
cmp    [Moves4onoff], 1
jne    Moves4Normal
ret
Moves4Normal:
jmp    Stop

[disable]
unregistersymbol(ALLFAST)
unregistersymbol(Moves1onoff)
unregistersymbol(Moves2onoff)
unregistersymbol(Moves3onoff)
unregistersymbol(Moves4onoff)
dealloc(Monster along moves)
dealloc(Moves1onoff)
dealloc(Moves2onoff)
dealloc(Moves3onoff)
dealloc(Moves4onoff)

//疾風N合一 for TWMS V100
//原作：jajaja
//原出處：疾風之莊
//功能：控怪方向：左趴往左；右趴往右
//        致命吸引力：左趴定點；右趴跟隨(無法與疾風的跳怪掉落連用)
//        紅點控制：有紅點部分功能暫停(保留停止呼吸、血控、無敵)，紅點５個以上全功能暫停
//        碰撞攻不停、角色不被擊退、碰怪後無敵30秒、笨怪、跳怪不跳、
//        超級撿物、停止呼吸、跳怪掉落、攻擊加速、損血控制
//Address：004147C2
//EIP：MyLR
//=================================================
[enable]
registersymbol(MyLR)
alloc(MyLR,1280)
label(MyLR1)
label(MyLR0)

registersymbol(LR)
alloc(MyDir,4)
alloc(MyCt,4)
alloc(MyPt,4)
alloc(LR,4)
label(GoLR)
label(GoLR1)
label(GoLR2)
label(GoLR3)
label(GoLR4)
label(GoLR5)
label(GoLRback)
label(JmpLR)
label(JmpLR1)
label(JmpLR2)
label(JmpLRback)
label(MyState)
label(MyCharX)
label(LRDir1)
label(LRDir2)
label(LRDir3)
label(LRDir4)
label(LRDir5)
label(LRDir6)
label(LRDir7)

label(MyNoBack)
registersymbol(KBSwitch)
alloc(KBSwitch,4)
alloc(KBLR,4)
label(Untouchable)

registersymbol(VarMaxDamage)
registersymbol(VarMinDamage)
alloc(VarMaxDamage,4)
alloc(VarMinDamage,4)

registersymbol(StupidSwitch)
alloc(StupidSwitch,4)
label(MyStupid)
label(QuitS)

registersymbol(ASUSwitch)
registersymbol(ASUInterval)
alloc(ASUSwitch,4)
alloc(ASUInterval,4)
alloc(AttackTime,4)
label(AtkSpeedUp)
label(QuitASU)

label(MyNoJmp)



//---------↓ＫＢ攻不停↓---------
KBSwitch:                        //ＫＢ攻不停開關：
  DD 1                                //0 = 關；1 = 開
KBLR:
  DD 3
//---------↑ＫＢ攻不停↑---------

//----------↓笨　　怪↓----------
StupidSwitch:                        //笨怪開關：
  DD 1                                //0 = 關；1 = 開
//----------↑笨　　怪↑----------

//----------↓攻擊加速↓----------
ASUSwitch:                        //攻擊加速開關：
  DD 1                                //0 = 關；1 = 開
ASUInterval:                        //加速時間：(會斷線請增加數值，穩定的可以試著減少數值)
  DD 2BC                        //預設值：7D0 = 2秒 (1.5秒=5DC；3秒=BB8)
AttackTime:
  DD 0
//----------↑攻擊加速↑----------

//----------↓掉怪控怪↓----------
LR:                                //跳怪掉落開關：
  DD 1                                //1 = 停用；3 = 左掉落；2 = 右掉落
MyDir:
  DD 1
//----------↑掉怪控怪↑----------



MyLR:
  push eax

  cmp [00AE62C4],00000000
  je MyLR1
  mov eax,[00AE62C4]
  mov [eax+380],0

  cmp [00AE62D8],00000000
  je MyLR1
  mov eax,[00AE62D8]
  mov eax,[eax+18]
  cmp eax,4
  ja MyLR1
  cmp eax,0
  pop eax
  jne MyLR0

  push eax
  cmp [00AE1E60],00000000
  je MyLR1
  mov eax,[00AE1E60]
  mov [eax+2074],0


  pop eax
  cmp dword ptr [esp], 00902D26
  je MyStupid
  cmp dword ptr [esp], 00903D8F
  je GoLR
  cmp dword ptr [esp], 009041A9
  je JmpLR
  cmp dword ptr [esp], 00904161
  je MyNoJmp
MyLR0:
  cmp dword ptr [esp], 008AA275
  je MyNoBack
  ret

MyLR1:
  pop eax
  ret



//=====↓不被擊退、碰怪無敵↓=====
MyNoBack:
  add esp,4


//---------↓ＫＢ攻不停↓---------
  cmp [KBSwitch],0
  je Untouchable

  push eax
  mov eax,[00AE62C4]
  mov eax,[eax+2588]
  cmp eax,10
  pop eax
  jb Untouchable
  push eax
  mov eax,[KBLR]
  mov [ebp+20],eax
  mov [ebp-9C],eax
  neg eax
  mov [KBLR],eax
  pop eax

  push 64
  jmp 008AA277
//---------↑ＫＢ攻不停↑---------

Untouchable:
  mov eax,[ebp-10]
  lea ecx,[eax+0000187C]
  push FFFFD8F0
  jmp 008AA999
//=====↑不被擊退、碰怪無敵↑=====

//==========↓笨　　怪↓==========
MyStupid:
  add esp,4

  call AtkSpeedUp

  cmp [StupidSwitch],0
  je QuitS

  xor edx,edx
  mov ecx,0000ea60
  div ecx
  lea eax,[esi+00000238]
  add edx,0002bf20
  mov [esi+00000240],edx
  mov edx,[esp+10]
  cmp [eax],edx
  je 00902D71
  cmp [esi+0000023c],edi
  lea ecx,[esi+0000023c]
  je 00902D71

QuitS:
  xor edx,edx
  jmp 00902D28
//==========↑笨　　怪↑==========

//==========↓走怪方向↓==========
GoLR:
  add esp,4

  call MyState

  push 03
  pop ecx
  mov [edi+20],eax
  xor edx,edx
  div ecx

  cmp [MyDir],1
  je GoLRback
  cmp [MyDir],3
  je GoLR1
  cmp [MyDir],4
  je GoLR3
  cmp edx,[MyDir]
  je GoLRback
  mov [esi+000004D0],0
  jmp GoLRback

GoLR1:
  push eax
  call MyCharX
  jmp GoLR4

GoLR3:
  push eax
  mov eax,[MyPt]

GoLR4:
  cmp edx,1
  je GoLR5
  jg GoLR2
  cmp eax,[esi+1C4]
  pop eax
  mov [esi+000004D0],5
  jl GoLRback
  mov [esi+000004D0],0
  jmp GoLRback

GoLR2:
  cmp eax,[esi+1C4]
  pop eax
  mov [esi+000004D0],5
  jg GoLRback
  mov [esi+000004D0],0
  jmp GoLRback

GoLR5:
  pop eax
  mov [esi+000004D0],0

GoLRback:
  jmp 00903D99
//==========↑走怪方向↑==========

//==========↓跳怪方向↓==========
JmpLR:
  add esp,4

  call MyState

  cmp [MyDir],1
  je JmpLRback
  cmp [MyDir],2
  mov eax,2
  je JmpLRback
  cmp [MyDir],0
  mov eax,3
  je JmpLRback
  cmp [MyDir],4
  je JmpLR1
  call MyCharX
  jmp JmpLR2

JmpLR1:
  mov eax,[MyPt]

JmpLR2:
  cmp eax,[esi+1C4]
  mov eax,2
  mov [esi+000004D0],5
  jg JmpLRback
  mov eax,3

JmpLRback:
//----------↓跳怪掉落↓----------
  cmp [esi+00000230],1
  je LRDir7
  cmp eax,[LR]
  jne LRDir7
  sub [esi+00000230],2

LRDir7:
//----------↑跳怪掉落↑----------
  push 03
  jmp 009041AB
//==========↑跳怪方向↑==========

//----------↓Ｘ　座標↓----------
MyCharX:
  mov eax,[00AE62C4]
  mov eax,[eax+00000D2C]
  ret
//----------↑Ｘ　座標↑----------

//----------↓角色狀態↓----------
MyState:
  push eax
  mov eax,[00AE62C4]
  mov eax,[eax+00000384]
  cmp eax,a
  je LRDir1
  cmp eax,b
  je LRDir2
  cmp eax,14
  je LRDir3
  cmp eax,15
  je LRDir3
  mov [MyCt],0
  jmp LRDir4

LRDir1:
  mov [MyDir],2
  cmp [MyCt],32
  ja LRDir5
  inc [MyCt]
  jmp LRDir4

LRDir2:
  mov [MyDir],0
  cmp [MyCt],32
  ja LRDir6
  inc [MyCt]
  jmp LRDir4

LRDir3:
  mov [MyDir],1
  jmp LRDir4

LRDir5:
  mov [MyDir],3
  jmp LRDir4

LRDir6:
  mov [MyDir],4
  call MyCharX
  mov [MyPt],eax

LRDir4:
  pop eax
  ret
//----------↑角色狀態↑----------

//==========↓跳怪不跳↓==========
MyNoJmp:
  add esp,4
  jmp 00904175
//==========↑跳怪不跳↑==========



//----------↓攻擊加速↓----------
AtkSpeedUp:
  push eax

  cmp [ASUSwitch],0
  je QuitASU

  mov eax,[00AE6464]
  mov eax,[eax+18]
  cmp eax,[AttackTime]
  jl QuitASU
  mov eax,[00AE62C4]
  mov eax,[eax+388]
  cmp eax,ffffffff
  je QuitASU
  mov eax,[00AE62C4]
  mov [eax+388],ffffffff
  mov eax,[00AE6464]
  mov eax,[eax+18]
  add eax,[ASUInterval]
  mov [AttackTime],eax

QuitASU:
  pop eax
  ret
//----------↑攻擊加速↑----------




[disable]
dealloc(MyLR)
unregistersymbol(MyLR)
dealloc(MyDir)
dealloc(MyCt)
dealloc(MyPt)
dealloc(LR)
unregistersymbol(LR)
dealloc(KBSwitch)
unregistersymbol(KBSwitch)
dealloc(KBLR)
dealloc(VarMaxDamage)
unregistersymbol(VarMaxDamage)
dealloc(VarMinDamage)
unregistersymbol(VarMinDamage)
dealloc(StupidSwitch)
unregistersymbol(StupidSwitch)
dealloc(ASUInterval)
unregistersymbol(ASUInterval)
dealloc(AttackTime)

//V100召喚獸無延遲,不鎖EIP版
//00723DB8 eip = FixTime
//007226D6 eip = Fix
//以上兩個代碼要一起開，否則會被鎖..
[ENABLE]
registersymbol(Fix)
alloc(Fix,2048)
registersymbol(FixTime)
alloc(FixTime,64)
label(FixTimeOF)
label(FixSSTime)
label(FixSSTime10C)
label(Fix00)
label(Fix01)
Fix:
        push eax
        mov eax,[ebx+0000010c]
        cmp [FixSSTime10C],eax
        pop eax
        je Fix01
        push eax
        mov eax,[FixTimeOF]        
        cmp eax,[FixSSTime]        
        pop eax
        je Fix00
        push eax
        mov eax,[ebx+0000010c]
        mov [FixSSTime10C],eax
        mov eax,[FixTimeOF]        
        mov [FixSSTime],eax
        pop eax
Fix01:
        push [ebx+000000b0]
        call 006efb78
        pop ecx
        mov ecx,esi
        sub ecx,[ebx+0000010c]
        push esi
        mov ecx,ebx
        call 00723397
        jmp 00722747
Fix00:
        jg 00722747
        cmp dword ptr [ebx+000000c0],01
        jmp 007226df
FixTimeOF:
        dd 0
FixSSTime:
        dd 0
FixSSTime10C:
        dd 0
FixTime:
        add [FixTimeOF],2710
        mov eax,[FixTimeOF]
        jmp 00723DBD
[DISABLE]
dealloc(Fix)
unregistersymbol(Fix)
dealloc(FixTime)
unregistersymbol(FixTime)

//範圍加大(下)
//Address:0063a1d6//EIP=IwallEXP
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 2048)
label(IwallEXP00)
label(IwallEXP01)
registersymbol(IwallTimes)
alloc(IwallTimes, 4)
registersymbol(x2)
alloc(x2, 4)
registersymbol(x1)
alloc(x1, 4)
registersymbol(y1)
alloc(y1, 4)
registersymbol(y2)
alloc(y2, 4)
registersymbol(Timer)
alloc(Timer, 4)
IwallTimes:
dd 0
Timer:
dd f   // 500ms
x2:
dd 3e8  // 1000
y2:
dd 1f4  //500
IwallEXP:
mov edx,[00AE62C4]     //
mov edx,[edx+18]
sub edx,[Timer] //每 500 ms 換下一張圖
cmp edx,[IwallTimes]
jl IwallEXP01
mov edx,[00AE62C4]     //
mov edx,[edx+18]
mov [IwallTimes],edx
    mov edx,[x2]
    mov [x1],edx
    sub [x2],1f4
    mov edx,[y2]
    mov [y1],edx
    cmp   [x2], FFFFFC18
    jge IwallEXP01
    mov [x2],3e8
    sub [y2],1f4
    cmp   [y2], FFFFFE0C
    jge IwallEXP01
    mov [y2],1f4
IwallEXP01:
mov edx,[00AE62C4]
mov edx,[edx+0d2c]
add edx,[x1]
cmp ecx,edx
jg IwallEXP00
sub edx,1f4   // 500
cmp ecx,edx
jl IwallEXP00
mov edx,[00AE62C4]
mov edx,[edx+0d30]
add edx,[y1]
cmp eax,edx
jg IwallEXP00
sub edx,1f4
cmp eax,edx
jl IwallEXP00
mov ecx,[00AE62C4]
mov ecx,[ecx+0d2c]
mov eax,[00AE62C4]
mov eax,[eax+0d30]
mov [ebx+00000484],ecx
jmp 0063a1dc
IwallEXP00:
mov [ebx+00000484],ecx
jmp 0063A1DC
[DISABLE]
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
unregistersymbol(IwallTimes)
dealloc(IwallTimes)
unregistersymbol(x1)
dealloc(x1)
unregistersymbol(y1)
dealloc(y1)
unregistersymbol(x2)
dealloc(x2)
unregistersymbol(y2)
dealloc(y2)
unregistersymbol(Timer)
dealloc(Timer)

//全圖打怪KiKiVac EIP 版 for TwMs 1.00
//Address: 0063A1D6
//EIP: KiKiVac
//呆baby by:
[Enable]
registersymbol(KiKiVac)
alloc(KiKiVac,256)
label(KiKiReturn)
KiKiVac:    //
    mov edx,[AE62C4]    // char pid pointer
    lea edx,[edx+0000d2c]
    mov [ebx+00000484], eax
    mov ecx,[edx]
    mov edx,[AE62C4]    // char pid pointer
    lea eax,[eax+00000D30]
    mov [ebx+00000488], eax
    lea eax,[edx]
    mov eax,[eax]
    jmp KiKiReturn
KiKiReturn:
    jmp 0063A1DC
[Disable]
unregistersymbol(KiKiVac)
dealloc(KiKiVac)

//V100寵物吸物   
[enable]
// For MapleStory
// ADD:004f1335     
// EIPetGetItem
// 感謝 smallro,maxyoyo
// 更新 射鵰英雄
registersymbol(PetGetItem)
alloc(PetGetItem,256)
registersymbol(PetGetItemSwitch)
alloc(PetGetItemSwitch,4)
label(NormalPet)

PetGetItemSwitch:
       dd     1                    // 開關   0 是關   1 是開

PetGetItem:
       cmp    [PetGetItemSwitch], 0
       je     NormalPet
       push   ebx
       mov    ebx, [ebp+0c]
       mov    [ebx], edi
       mov    [ebx+04], eax
       pop    ebx
       jmp    004f134c  


NormalPet:
       lea    eax, [ebp-38]
       push   eax
       call   dword ptr [00ae9a1c]
       jmp    004f133f   

[disable]
unregistersymbol(PetGetItem)
dealloc(PetGetItem)
unregistersymbol(PetGetItemSwitch)
dealloc(PetGetItemSwitch)

//全圖打(可調範圍)TWMS1.00 (數據也有地方有錯)
//Address:0063A1D6
//EIP=IwallEXP
//更新  peter980421
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 1024)
registersymbol(IwallEXPX)
alloc(IwallEXPX, 4)
registersymbol(IwallEXPY)
alloc(IwallEXPY, 4)
label(IwallEXP00)

IwallEXPX:
dd 190     //以人物為中心X軸(16進位).數值越大範圍越大.目前設定200=C8(16進位)
IwallEXPY:
dd 15E     //以人物為中心Y軸(16進位).數值越大範圍越大.目前設定200=C8(16進位)

IwallEXP:
mov edx,[00AE62C4]
mov edx,[edx+0D2C]
add edx,[IwallEXPX]
cmp ecx,edx
jg IwallEXP00
mov edx,[00AE62C4]
mov edx,[edx+0D2C]
sub edx,[IwallEXPX]
cmp ecx,edx
jl IwallEXP00

mov edx,[00AE62C4]
mov edx,[edx+0D30]
add edx,[IwallEXPY]
cmp eax,edx
jg IwallEXP00
mov edx,[00AE62C4]
mov edx,[edx+0D30]
sub edx,[IwallEXPY]
cmp eax,edx
jl IwallEXP00

mov ecx,[00AE62C4]
mov ecx,[ecx+0D2C]
mov eax,[00AE62C4]
mov eax,[eax+0D30]
mov [ebx+00000484],ecx
jmp 0063A1DC

//-----------------------------

IwallEXP00:
mov [ebx+00000484],ecx
jmp 0063A1DC

[DISABLE]
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
dealloc(IwallEXPX)
unregistersymbol(IwallEXPX)
dealloc(IwallEXPY)
unregistersymbol(IwallEXPY)

//原作：zgenden
//代碼：005241DC
//EIP：Maxone
//功能：跳怪掉落1.跳怪掉落2
//-----------------------------------------------
[ENABLE]
registersymbol(Maxone)
alloc(Maxone,128)
label(QuitMaxone)

registersymbol(JDSwitch)
alloc(JDSwitch,4)
alloc(JDSwitch1, 4)
alloc(JDSwitch2, 4)
label(JumpDown1)
label(QuitJD1)
label(JumpDown2)
label(QuitJD2)

//-----------------------------------------------
JDSwitch:
  DD 1   //總開關:   0.關 1.開

JDSwitch1:
  DD 1   //跳怪掉落1: 0.關 1.開

JDSwitch2:
  DD 1   //跳怪掉落2: 0.關 1.開

//-----------------------------------------------
Maxone:
  cmp [JDSwitch],0
  je QuitMaxone


  cmp dword ptr [esp],00904A65
  je JumpDown1
  cmp dword ptr [esp],00904F61
  je JumpDown2
  ret


QuitMaxone:
  ret
//-----------------------------------------------
JumpDown1:
  add esp,4

  cmp [JDSwitch1],1
  jne QuitJD1

  cmp [ebx+0230],2
  jne QuitJD1
  fsubr qword ptr [ebp-18]
  add esp,10
  fst qword ptr [ebp-18]
  fcomp qword ptr [00A1DBB0]
  jmp 00904DF4

QuitJD1:
  fsubr qword ptr [ebp-18]
  jmp 00904A68
//-----------------------------------------------
JumpDown2:
  add esp,4

  cmp [JDSwitch2],1
  jne QuitJD2
  fcomp qword ptr [ebp-08]
  pop ecx
  pop ecx
  jmp 00904FCB

QuitJD2:
  fcomp qword ptr [ebp-08]
  jmp 00904F64
//-----------------------------------------------

[DISABLE]
dealloc(Maxone)
unregistersymbol(Maxone)
dealloc(JumpDown1KEY)
unregistersymbol(JumpDown1KEY)
dealloc(JDSwitch)
unregistersymbol(JDSwitch)
dealloc(JDSwitch1)
unregistersymbol(JDSwitch1)
dealloc(JDSwitch2)
unregistersymbol(JDSwitch2)

//TWMS 0100 招喚獸攻擊物落腳下 EIP 版
//原作:zgende
//Address: 00723E5B
//EIP:FIX_TTBOX_DOWN
//-----------------------------------------------
[ENABLE]
registersymbol(FIX_TTBOX_DOWN)
alloc(FIX_TTBOX_DOWN,1024)
registersymbol(FIX_TTBOX_DOWN_XX)
alloc(FIX_TTBOX_DOWN_XX,4)
registersymbol(FIX_TTBOX_DOWN_YY)
alloc(FIX_TTBOX_DOWN_YY,4)
label(FIX_TTBOX_DOWN_X)
label(FIX_TTBOX_DOWN_Y)
//-----------------------------------------------
FIX_TTBOX_DOWN_XX:
DD 0
FIX_TTBOX_DOWN_YY:
DD 0
//-----------------------------------------------
FIX_TTBOX_DOWN:
call FIX_TTBOX_DOWN_X
mov ax,[FIX_TTBOX_DOWN_XX]
lea ecx,[ebp-44]
push eax
call 0042524D
mov eax,[esi]
lea ecx,[eax+04]
mov eax,[ecx]
call FIX_TTBOX_DOWN_Y
mov ax,[FIX_TTBOX_DOWN_YY]
jmp 00723E78
//-----------------------------------------------
FIX_TTBOX_DOWN_X:
push eax
mov eax,[00AE62C4]
mov eax,[eax+D2C]
mov [FIX_TTBOX_DOWN_XX],eax
pop eax
ret
//-----------------------------------------------
FIX_TTBOX_DOWN_Y:
push eax
mov eax,[00AE62C4]
mov eax,[eax+D30]
mov [FIX_TTBOX_DOWN_YY],eax
pop eax
ret
//-----------------------------------------------
[DISABLE]
dealloc(FIX_TTBOX_DOWN)
unregistersymbol(FIX_TTBOX_DOWN)

---

作者: 冰楓    時間: 2014-2-5 19:49
標題: TWMS103 （一些舊數據，僅供參考＆研究）

//====================================================
//版本：TWMS0103 (CRC版)
//功能：不顯示攻擊傷害
//日期：2009/10/8
//====================================================
[Enable]
006476A8:
nop
nop
nop
nop
nop
[Disable]
006476A8:
call 006476AD

//原作:darkword
//TWMS103 召喚獸無延遲,不鎖CRC版
//部落格網址：http://www.22up.com/blog/darkword
//轉載請保留出處
//------------------------------------------------------------------
[ENABLE]
registersymbol(FixTime)
alloc(FixTime,1024)
registersymbol(FixTimeOF)
alloc(FixTimeOF,4)
registersymbol(Fix)
alloc(Fix,1024)
registersymbol(FixSSTime)
alloc(FixSSTime,4)
registersymbol(FixSSTime10C)
alloc(FixSSTime10C,4)
label(Fix00)
label(Fix01)
//-----------------------------------------------
Fix:
push eax
mov eax,[ebx+0000010c]
cmp [FixSSTime10C],eax
pop eax
je Fix01
push eax
mov eax,[FixTimeOF]
cmp eax,[FixSSTime]
pop eax
je Fix00
push eax
mov eax,[ebx+0000010c]
mov [FixSSTime10C],eax
mov eax,[FixTimeOF]
mov [FixSSTime],eax
pop eax

Fix01:
push [ebx+000000b0]
call 0070669d
pop ecx
mov ecx,esi
sub ecx,[ebx+0000010c]
push esi
mov ecx,ebx
call 0073b42a
jmp 0073a7da


//-----------------------------------------------
Fix00:
jg 0073a7da
mov eax,[ebx+000000c0]
jmp 0073A76E
//-----------------------------------------------

FixTime:
add [FixTimeOF],2710
mov eax,[FixTimeOF]
ret

73A766:
jmp Fix
db 90 90 90

73BE4B:
call FixTime
//-----------------------------------------------
[DISABLE]
73A766:  
jg 0073a7da
mov eax,[ebx+000000c0]

//-----------------------------------------------
dealloc(FixTime)
unregistersymbol(FixTime)
//-----------------------------------------------
dealloc(Fix)
unregistersymbol(Fix)
dealloc(Fix)
unregistersymbol(Fix)

// Twms v103 閃爍無敵-CRC版
//==================================================
[ENABLE]
registersymbol(god)
alloc(god,32)

god:
  mov  eax,64
  mov  esi,0
  jmp  008A2B88
008A2B7B:
  Jmp  god

[DISABLE]
008A2B7B:
  DB 85 c0 7e 28 8b CF
dealloc(god)
unregistersymbol(god)

//======================================
//TWMSv1.3 滑鼠移動(右趴左趴板) [CRC]
//
//熱鍵控制:    右趴下＝開   左趴下＝關
//======================================
[Enable]
alloc(MouserX,512)
alloc(MouserY,512)
alloc(CSX,128)
alloc(OnOff,128)
label(normal)
label(normalx)
label(normaly)
label(back)
label(return)
label(On)
label(Off)
registersymbol(CSX)
registersymbol(OnOff)

OnOff:
dd 0

CSX:
push eax
mov eax,[00B0B904]   
cmp [eax+0398],a
je On
cmp [eax+0398],b
je Off
pop eax
jmp MouserX

normal:
pop eax
mov [ebx], eax
mov edi,[ebp+10]
jmp back

back:
jmp 0091DCE7
return:
jmp 0091DD4C
On:
pop eax
mov [OnOff],1
jmp MouserX

Off:
pop eax
mov [OnOff],0
jmp MouserX

MouserX:
    cmp [OnOff],0
    je normalx
    push eax
    mov eax,[00B0B904]
    mov eax,[eax+0E90]
    cmp esi,eax
    pop eax
    jne normalx
   
    mov eax, [00B0BAA8]
    mov eax, [eax+0978]
    mov eax, [eax+84]
    mov [ebx], eax
    mov edi,[ebp+10]
    test    edi, edi
    jne     MouserY
    jmp    0091DD49
   
normalx:
    mov [ebx], eax
    mov edi,[ebp+10]
    jmp back
   
MouserY:
    push eax
    mov eax,[00B0B904]
    mov eax,[eax+0E90]
    cmp esi,eax
    pop eax
    jne normaly
   
    mov eax, [00B0BAA8]
    mov eax, [eax+0978]
    mov eax, [eax+88]
    mov [edi], eax
    mov ebx,[ebp+14]
    jmp return
   
normaly:
    mov [edi], eax
    mov ebx,[ebp+14]
    jmp return

0091DCE2:
    jmp CSX

[Disable]

0091DCE2:
db 89 03 8b 7d 10

dealloc(MouserX)
dealloc(MouserY)
dealloc(CSX)
dealloc(OnOff)
unregistersymbol(CSX)
unregistersymbol(OnOff)

// V102 寵物吸物   
// 感謝 smallro,maxyoyo
// 更新 射鵰英雄  98/10/08
[enable]
registersymbol(PetGetItem)
alloc(PetGetItem,256)
registersymbol(PetGetItemSwitch)
alloc(PetGetItemSwitch,4)
label(NormalPet)

PetGetItemSwitch:
       dd     1                    // 開關   0 是關   1 是開

PetGetItem:
       cmp    [PetGetItemSwitch], 0
       je     NormalPet
       push   ebx
       mov    ebx, [ebp+0c]
       mov    [ebx], edi
       mov    [ebx+04], eax
       pop    ebx
       jmp    004f2875  


NormalPet:
       lea    eax, [ebp-38]
       push   eax
       call   dword ptr [00b0f20c]
       jmp    004f2868  

004f285e:
jmp PetGetItem

[disable]
004f285e:
db 8D 45 c8 50 ff
unregistersymbol(PetGetItem)
dealloc(PetGetItem)
unregistersymbol(PetGetItemSwitch)
dealloc(PetGetItemSwitch)

//=================================================
[enable]
//疾風N合一 for TWMS0103
//原作：jajaja, 感謝99,A,D,L,N,W,W(縮寫)
//原出處：疾風之莊,頑皮鬼
//代碼修改：fight
//功能：走,跳怪方向【左趴往左,右趴往右,坐下停止控制】、笨怪、10秒損血一次、
//紅點不停、跳怪不跳、致命的吸引力【定點及跟隨角色二種模式，啟動方式提示：5秒】
//=================================================
alloc(MyLR,1024)
registersymbol(MyLR)
alloc(MyDir,4)
alloc(MyCt,4)
alloc(MyPt1,4)
label(MyLR1)
label(GoLR)
label(GoLR1)
label(GoLR2)
label(GoLR3)
label(GoLR4)
label(GoLR5)
label(GoLRback)
label(JmpLR)
label(JmpLR1)
label(JmpLR2)
label(JmpLRback)
label(MyStupid)
label(MyNoBack)
label(MyState)
label(MyCharX)
label(MyNoJmp)
label(LRDir1)
label(LRDir2)
label(LRDir3)
label(LRDir4)
label(LRDir5)
label(LRDir6)
registersymbol(LR)
alloc(LR,4)
MyDir:
DD 1
MyLR:
pop edi
pop esi
pop ebp
pop ebx
push eax
cmp [00B0B918],00000000                  
je MyLR1
pop eax
cmp dword ptr [esp], 0092147D
je GoLR
cmp dword ptr [esp], 00921897
je JmpLR
cmp dword ptr [esp], 00920414
je MyStupid
cmp dword ptr [esp], 008C6390
jz MyNoBack
cmp dword ptr [esp], 0092184F
jz MyNoJmp
ret
MyLR1:
pop eax
ret
//================================
GoLR:
add esp,4
call MyState
push 03
pop ecx
mov [edi+20],eax
xor edx,edx
div ecx
cmp [MyDir], 1
je GoLRback
cmp [MyDir], 3
je GoLR1
cmp [MyDir], 4
je GoLR3
cmp edx, [MyDir]
je GoLRback
mov [esi+000004D8],0
jmp GoLRback
GoLR1:
push eax
call MyCharX
jmp GoLR4
GoLR3:
push eax
mov eax,[MyPt1]
GoLR4:
cmp edx, 1
je GoLR5         
jg GoLR2
cmp eax,[esi+1c4]
pop eax
mov [esi+000004D8],5
jl GoLRback
mov [esi+000004D8],0
jmp GoLRback
GoLR2:
cmp eax,[esi+1c4]
pop eax
mov [esi+000004D8],5
jg GoLRback
mov [esi+000004D8],0
jmp GoLRback
GoLR5:
pop eax
mov [esi+000004D8],0
GoLRback:
jmp 00921487
//================================
JmpLR:
add esp,4
call MyState
cmp [MyDir], 1
je JmpLRback
cmp [MyDir], 2
mov eax,2
je JmpLRback
cmp [MyDir], 0
mov eax,3
je JmpLRback
cmp [MyDir], 4
je JmpLR1
call MyCharX
jmp JmpLR2
JmpLR1:
mov eax,[MyPt1]
JmpLR2:
cmp eax,[esi+1c4]
mov eax,2
mov [esi+000004D8],5
jg JmpLRback
mov eax,3
JmpLRback:
push 03
jmp  00921899
//================================
MyCharX:
mov eax [00B0B904]
mov eax, [eax+0E50]
ret
//================================
MyState:
push eax
mov eax, [00B0B904]
mov eax, [eax+0398]
cmp eax, a
je LRDir1
cmp eax, b
je LRDir2
cmp eax, 14
je LRDir3
cmp eax, 15
je LRDir3
mov [MyCt], 0
jmp LRDir4
LRDir1:
mov [MyDir],2
cmp [MyCt], 32
ja LRDir5
inc [MyCt]
jmp LRDir4
LRDir2:
mov [MyDir],0
cmp [MyCt], 32
ja LRDir6
inc [MyCt]
jmp LRDir4
LRDir3:
mov [MyDir],1
jmp LRDir4
LRDir5:
mov [MyDir],3
jmp LRDir4
LRDir6:
mov [MyDir],4
call MyCharX
mov [MyPt1],eax
LRDir4:
pop eax
ret
//============================
MyStupid:
add esp, 4
xor edx,edx
mov ecx,0000ea60
div ecx
lea eax,[esi+00000238]
add edx,0002bf20
mov [esi+00000240],edx
mov edx,[esp+10]
cmp [eax],edx
je 0092045F
cmp [esi+0000023c],edi   
lea ecx,[esi+0000023c]
je 0092045F
jmp 00920445
//====================================
MyNoBack:
add esp,4

mov eax,[ebp-10]
lea    ecx, [eax+00001A0C]
push FFFFD8F0 //原始值=FFFFFA24，修改此處可更改無敵秒數
jmp 008C6AB9
//============================
MyNoJmp:
add esp,4
jmp 00921863
00414952:  
jmp MyLR
[disable]
00414952:
db 5f 5e 5d 5b c3
dealloc(MyLR)
unregistersymbol(MyLR)
dealloc(MyDir)
dealloc(MyCt)
dealloc(MyPt1)

//v103
[enable]
00647ADE://快速生怪
jmp 00647AE0
[disable]
00647ADE://快速生怪
db 74 40

//=================================================
//版本：TWMS0103 (CRC版)
//功能：攻擊不停 CSX
//更新：豕者示申 (感謝小老百姓提供address和pointer)
//日期：2009/10/8
//=================================================

[Enable]
registersymbol(CSX)
alloc(CSX,128)
label(CSXReturn)

CSX: //CSEAX X  
push eax
mov eax,[00B0B904] //a1 ? ? ? ?
mov eax,[eax+271c] // 8b 80 ? ? ? ?
cmp eax,2          //3d 02 00 00 00
pop eax            //58
jg CSXReturn

push eax
mov eax,[00B0B904] //a1 ? ? ? ?
mov eax,[eax+272c] //8b 80 ? ? ? ? 57 33 ff
cmp eax,2  
pop eax
jg CSXReturn

push eax
mov eax,[00B0B904]
mov eax,[eax+0E90]
cmp esi,eax
pop eax
jne CSXReturn
add eax,0a
jmp CSXReturn

CSXReturn:
mov [ebx], eax
mov edi,[ebp+10]
jmp 0091DCE7

0091DCE2:
jmp CSX

[Disable]
0091DCE2:
DB 89 03 8B 7D 10

unregistersymbol(CSX)
dealloc(CSX)

//=================================================
//版本：TWMS0103 (CRC版)
//功能：怪物圖鑑全開
//更新：SHARK
//日期：2009/10/08
//=================================================
[Enable]
Alloc(Palerma,256)
Label(exit)
Palerma:
exit:
mov eax,5
jmp 008CD609
008CD604:
jmp Palerma
[Disable]
008CD604:
db e8 f8 24 e0 ff

//TWMS 0103[EIP]招喚獸攻擊(單純物品落腳下)
//原作:zgende
//Address: 0073BEEE
//EIP:FIX_TTBOX_DOWN
//-----------------------------------------------
[ENABLE]
registersymbol(FIX_TTBOX_DOWN)
alloc(FIX_TTBOX_DOWN,1024)
registersymbol(FIX_TTBOX_DOWN_XX)
alloc(FIX_TTBOX_DOWN_XX,4)
registersymbol(FIX_TTBOX_DOWN_YY)
alloc(FIX_TTBOX_DOWN_YY,4)
label(FIX_TTBOX_DOWN_X)
label(FIX_TTBOX_DOWN_Y)
//-----------------------------------------------
FIX_TTBOX_DOWN_XX:
DD 0
FIX_TTBOX_DOWN_YY:
DD 0
//-----------------------------------------------
FIX_TTBOX_DOWN:
call FIX_TTBOX_DOWN_X
mov ax,[FIX_TTBOX_DOWN_XX]
lea ecx,[ebp-44]
push eax
call 004254CA
mov eax,[esi]
lea ecx,[eax+04]
mov eax,[ecx]
call FIX_TTBOX_DOWN_Y
mov ax,[FIX_TTBOX_DOWN_YY]
jmp 0073BF0B
//-----------------------------------------------
FIX_TTBOX_DOWN_X:
push eax
mov eax,[00B0B904]
mov eax,[eax+0E50]
mov [FIX_TTBOX_DOWN_XX],eax
pop eax
ret
//-----------------------------------------------
FIX_TTBOX_DOWN_Y:
push eax
mov eax,[00B0B904]
mov eax,[eax+0E54]
mov [FIX_TTBOX_DOWN_YY],eax
pop eax
ret
//-----------------------------------------------
0073BEEE:
jmp FIX_TTBOX_DOWN
[DISABLE]
0073BEEE:
db ff 50 10
dealloc(FIX_TTBOX_DOWN)
unregistersymbol(FIX_TTBOX_DOWN)

//====================================================
//版本：TWMS0100 (CRC版)
//功能：怪物瞬移1號
//更新：呆baby
//日期：2009/10/09
//====================================================
[Enable]
00667A0A:
nop
nop
nop
nop
nop
[Disable]
00667A0A:
call 00414846

//====================================================
//版本：TWMS0100 (CRC版)
//功能：怪物瞬移2號
//更新：呆baby
//日期：2009/10/09
//====================================================
[Enable]
006679BF:
nop
nop
nop
nop
nop
[Disable]
006679BF:
call 00414846

//====================================================
//版本：TWMS0100 (CRC版)
//功能：怪物瞬移3號
//更新：呆baby
//日期：2009/10/09
//====================================================
[Enable]
006679B1:
nop
nop
nop
nop
nop
[Disable]
006679B1:
call 00414846

//====================================================
//版本：TWMS0100 (CRC版)
//功能：怪物瞬移4號
//更新：呆baby
//日期：2009/10/09
//====================================================
[Enable]
00667A2A:
nop
nop
nop
nop
nop
[Disable]
00667A2A:
call 00414846

//==================================================
//  TWMS_V1.3 快速恢復HP/MP 合併版
//
//  代碼原創：頑皮鬼
//  代碼修改：RUYANG
//  說明：每次恢復10倍HP，8倍MP
//==================================================

[Enable]
  alloc(HookFR,1024)
  registersymbol(HookFR)
  label(HookRet)
  label(HPHandler)
  label(MPHandler)

  label(FastRecoverHP)
  label(DoNormalHP)
  label(HPCheck)
  alloc(HPCounter,4)
  alloc(SetHPCounter,4)
  alloc(RecoverTime,4)
  registersymbol(SetHPCounter)

  label(FastRecoverMP)
  label(DoNormalMP)
  label(MPCheck)
  alloc(MPCounter,4)
  alloc(SetMPCounter,4)
  registersymbol(SetMPCounter)

HookFR:
  cmp [esp],009BEDB7
  je HPHandler
  cmp [esp],00962407
  je MPHandler
HookRet:
  push ebp
  mov ebp,esp
  sub esp,0c
  jmp 00425E68
HPHandler:
  mov [esp],FastRecoverHP
  jmp HookRet
MPHandler:
  mov [esp],FastRecoverMP
  jmp HookRet

FastRecoverHP:
  push eax
  mov eax,[ebp-1c]
  mov [RecoverTime],eax
  pop eax

  cmp [HPCounter],0
  je HPCheck
  dec [HPCounter]
  cmp ebx,1
  jmp 0096229C

HPCheck:
  sub [RecoverTime],0A
  cmp ebx,[RecoverTime]
  jna DoNormalHP

  push eax
  mov eax,[SetHPCounter]
  dec eax
  mov [HPCounter],eax
  pop eax

DoNormalHP:
  cmp ebx,[ebp-1c]
  jmp 0096229C


FastRecoverMP:
  cmp [MPCounter],0
  je MPCheck
  dec [MPCounter]
  cmp ebx,1
  jmp 0096240D

MPCheck:
  cmp ebx,00002708
  jna DoNormalMP
  push eax
  mov eax,[SetMPCounter]
  dec eax
  mov [MPCounter],eax
  pop eax

DoNormalMP:
  cmp ebx,00002710
  jmp 0096240D

SetHPCounter:
  dd A          // 10倍HP，易斷線的請調低倍數
SetMPCounter:
  dd 8          // 8倍MP，易斷線的請調低倍數
00425E62:
jmp HookFR
[Disable]
00425E62:
db 55 8b ec 83 ec 0c

  unregistersymbol(HookFR)
  dealloc(HookFR)

  dealloc(HPCounter)
  dealloc(SetHPCounter)
  dealloc(RecoverTime)
  unregistersymbol(SetHPCounter)

  dealloc(MPCounter)
  dealloc(SetMPCounter)
  unregistersymbol(SetMPCounter)

//逃出奇幻
[enable]
0051fe1c:
jmp 0051fe57
//db eb 39
[disable]
0051fe1c:
jna 0051fe57
//db 76 39

//丟道具不能丟錢
[enable]
009679cb:
jmp 00967a0d
//db eb 40
[disable]
009679cb:
jna 00967a0d
//db 76 40

//放技能
[enable]
008d4c70:
jmp 008d4ca1
//db eb 2f
[disable]
008d4c70:
jna 008d4ca1
//db 76 2f

//HKMS/TWMSv1.3 SuperTubi [超撿]

[Enable]
004E5E65:
db 90 90

[Disable]
004E5E65:
db 75 36

//原作:歷史太久了~好像有人發過功能一樣的
//全圖打(可調範圍)TWMS1.3
//更新: DrakeDog,WeiWey86
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 1024)
registersymbol(IwallEXPX)
alloc(IwallEXPX, 4)
registersymbol(IwallEXPY)
alloc(IwallEXPY, 4)
label(IwallEXP00)
IwallEXPX:
dd 12C   //16進位 橫向範圍 目前500
IwallEXPY:
dd 12C    //16進位 直向範圍  目前設定500   
IwallEXP:
mov edx,[00B0B904]
mov edx,[edx+0E50]
add edx,[IwallEXPX]
cmp ecx,edx
jg IwallEXP00
mov edx,[00B0B904]
mov edx,[edx+0E50]
sub edx,[IwallEXPX]
cmp ecx,edx
jl IwallEXP00

mov edx,[00B0B904]  
mov edx,[edx+0E54]
add edx,[IwallEXPY]
cmp eax,edx
jg IwallEXP00
mov edx,[00B0B904]   
mov edx,[edx+0E54]
sub edx,[IwallEXPY]
cmp eax,edx
jl IwallEXP00

mov ecx,[00B0B904]  
mov ecx,[ecx+0E50]
mov eax,[00B0B904]   
mov eax,[eax+0E54]
mov [ebx+00000484],ecx
jmp 00647A33
//-----------------------------
IwallEXP00:
mov [ebx+00000484],ecx
jmp 00647A33
00647A2D:
jmp  IwallEXP
[DISABLE]
00647A2D:
db 89 8B 84 04 00
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
dealloc(IwallEXPX)
unregistersymbol(IwallEXPX)
dealloc(IwallEXPY)
unregistersymbol(IwallEXPY)

//招喚獸全圖打crc(可調範圍)TWMS103
//更新:星光:卍走召目害卍
//目前切圖版的，已經確定更新好了(雖然很多高手早就更新好了)，
//但是似乎搶不贏已發佈的全圖打，因為切換地圖，有頻率，所以移
//除掉，這樣可以狂打，但有少(有時)，看個人喜好下去使用吧
//-----------------------------------------------
[ENABLE]
registersymbol(O76)
alloc(O76, 2048)
label(GOD02)
label(WIN01)
registersymbol(x2)
alloc(x2, 4)
registersymbol(x1)
alloc(x1, 4)
registersymbol(y1)
alloc(y1, 4)
registersymbol(y2)
alloc(y2, 4)

x2:
dd 3F8     //x軸範圍
y2:
dd 1F4     //y軸範圍

O76:

mov edx,[x2]
mov [x1],edx
sub [x2],1f4

mov edx,[y2]
mov [y1],edx

cmp [x2], FFFFFC18
jge WIN01

mov [x2],3e8
sub [y2],1f4

cmp [y2], FFFFFE0C
jge WIN01

mov [y2],1f4

WIN01:
mov edx,[00B0B904]
mov edx,[edx+0E50]
add edx,[x1]
cmp ecx,edx
jg GOD02
sub edx,1f4 // 500
cmp ecx,edx
jl GOD02

mov edx,[00B0B904]
mov edx,[edx+0E54]
add edx,[y1]
cmp eax,edx
jg GOD02
sub edx,1f4
cmp eax,edx
jl GOD02

mov ecx,[00B0B904]
mov ecx,[ecx+0E50]
mov eax,[00B0B904]
mov eax,[eax+0E54]
mov [ebx+00000484],ecx
jmp 00647A33

//-----------------------------

GOD02:
mov [ebx+00000484],ecx

jmp 00647A33

00647A2D:
jmp O76
[DISABLE]
00647A2D:
db 89 8B 84 04 00
dealloc(O76)
unregistersymbol(O76)
unregistersymbol(x1)
dealloc(x1)
unregistersymbol(y1)
dealloc(y1)
unregistersymbol(x2)
dealloc(x2)
unregistersymbol(y2)
dealloc(y2)

// 版本：TWMS v1.3召喚獸分身攻擊CRC
// 更新: DrakeDog, WeiWey86
[Enable]
0073A4DD:
jmp  0073A4EB

[Disable]
0073A4DD:
db 7E 0C FF 37 56

//按拍賣不跳出訊息
[enable]
00971029:
jmp 00971056

[disable]
00971029:
jna 00971056

//可用普攻
[enable]
008BCB7A:
jmp 008bcbaf
[disable]
008BCB7A:
jna 008bcbaf

//丟錢不跳出訊息
[enable]
00981791:
jmp 009817bf
[disable]
00981791:
jna 009817bf

//V103 招喚獸短擊 (法師 CRC 版)
//原作:zgenden
//-----------------------------------------------
[ENABLE]
registersymbol(FIR)
alloc(FIR,1024)
registersymbol(FIRTIMESS)
alloc(FIRTIMESS,4)
registersymbol(FIRSKILL)
alloc(FIRSKILL,4)
registersymbol(FIREDI)
alloc(FIREDI,4)
label(FIR00)
label(FIR01)
//-----------------------------------------------
FIRTIMESS:
DD 0     //招喚獸攻擊時間
FIRSKILL:
DD 0     //招喚獸攻擊次數
FIREDI:
DD 0     //招喚獸EDI
//-----------------------------------------------
FIR:
cmp [FIREDI],edi
je FIR00
//push eax
call FIR01
pop ecx
pop ecx
mov dword ptr [ebx+000000cc],01
push [ebx+000000e8]
lea eax,[ebx+000000e0]
push eax
call FIR01
pop ecx
pop ecx
mov dword ptr [ebx+000000c0],01
push [ebx+000000b0]
call 0070669d
pop ecx
push esi
mov ecx,ebx
call 0073b42a
push eax
mov eax,[ebx+0000010c]
cmp [FIRTIMESS],eax
pop eax
je 0073a7da
push eax
mov eax,[ebx+0000010c]
mov [FIRTIMESS],eax
mov [FIREDI],edi
pop eax
jmp 0073a7da
//-----------------------------------------------
FIR00:
call 00414846
jmp 0073A689
//-----------------------------------------------
FIR01:
push ebp
mov ebp,esp
mov eax,[ebp+08]
push ebx
mov ebx,[eax+04]
push esi
mov esi,[eax]
push edi
push 05
push ebx
call 009bc13b
mov edi,eax
xor edi,esi
push 05
xor esi,baadf00d
push esi
call 009bbd84
add eax,ebx
add esp,10
mov eax,edi
pop edi
pop esi
pop ebx
pop ebp
ret

0073A684:
jmp FIR

//-----------------------------------------------
[DISABLE]
0073A684:
call 00414846

dealloc(FIR)
unregistersymbol(FIR)
dealloc(FIRTIMESS)
unregistersymbol(FIRTIMESS)
dealloc(FIREDI)
unregistersymbol(FIREDI)
dealloc(FIRSKILL)
unregistersymbol(FIRSKILL)

//v1.3 Instant Drop
//妮可GG

[ENABLE]
004f43ec:

je 004f43f8

[DISABLE]

004f43ec:
db eb 4e

//=================================================
// 攻擊加速 for Twms103
// 原作：不知道 ><
// 更新：Yttuir
// ADR：0044D915
// EIP：FastAttack
// 加速次數：FastSpeed
//=================================================
[Enable]
Registersymbol(FastAttack)
Registersymbol(FastSpeed)
Alloc(FastAttack,128)
Alloc(FastSpeed,4)
//-----------------------------------------------
FastSpeed:
Dd 1    //攻擊次數，代表幾次攻擊中會有一次加速，請自行調整
//-----------------------------------------------
FastAttack:
Pushad
Mov Eax,[00B0B904]
Mov Edx,[Eax+271C]
Mov Ecx,[FastSpeed]
Mov Eax,Edx
Shr Edx,0F
Idiv Ecx
Dec Ecx
Cmp Edx,Ecx
Popad
Jne 0044D91A
Jmp 0044D93C
//-----------------------------------------------
[Disable]
Dealloc(FastSpeed)
Dealloc(FastAttack)
Unregistersymbol(FastSpeed)
Unregistersymbol(FastAttack)

//招喚獸全圖打(切小圖)TWMS103
//原作:不祥
//修改 : dkgffo
//這個全圖 打一擊秒殺 很好用
//但是打強怪 建議不使用
//會一下一下慢慢打...
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 2048)
label(IwallEXP00)
label(IwallEXP01)
registersymbol(IwallTimes)
alloc(IwallTimes, 4)
registersymbol(x2)
alloc(x2, 4)
registersymbol(x1)
alloc(x1, 4)
registersymbol(y1)
alloc(y1, 4)
registersymbol(y2)
alloc(y2, 4)
registersymbol(Timer)
alloc(Timer, 4)

IwallTimes:
dd 0
Timer:
dd 8// 8ms
x2:
dd 514 // 1300
y2:
dd 384 //900

IwallEXP:
mov edx,[00B0BAAC] //
mov edx,[edx+18]
sub edx,[Timer] //每 8 ms 換下一張圖
cmp edx,[IwallTimes]
jl IwallEXP01

mov edx,[00B0BAAC] //
mov edx,[edx+18]
mov [IwallTimes],edx

mov edx,[x2]
mov [x1],edx
sub [x2],1f4

mov edx,[y2]
mov [y1],edx

cmp [x2], FFFFFC18
jge IwallEXP01

mov [x2],3e8
sub [y2],1f4

cmp [y2], FFFFFE0C
jge IwallEXP01

mov [y2],1f4

IwallEXP01:
mov edx,[00B0B904]
mov edx,[edx+0e50]
add edx,[x1]
cmp ecx,edx
jg IwallEXP00
sub edx,1f4 // 500
cmp ecx,edx
jl IwallEXP00

mov edx,[00B0B904]
mov edx,[edx+0e54]
add edx,[y1]
cmp eax,edx
jg IwallEXP00
sub edx,1f4
cmp eax,edx
jl IwallEXP00

mov ecx,[00B0B904]
mov ecx,[ecx+0e50]
mov eax,[00B0B904]
mov eax,[eax+0e54]
mov [ebx+00000484],ecx
jmp 00647A33

//-----------------------------

IwallEXP00:
mov [ebx+00000484],ecx

jmp 00647A33

00647A2D:
jmp IwallEXP
[DISABLE]
00647A2D:
db 89 8B 84 04 00
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
unregistersymbol(IwallTimes)
dealloc(IwallTimes)
unregistersymbol(x1)
dealloc(x1)
unregistersymbol(y1)
dealloc(y1)
unregistersymbol(x2)
dealloc(x2)
unregistersymbol(y2)
dealloc(y2)
unregistersymbol(Timer)
dealloc(Timer)

---

作者: ko985389    時間: 2014-2-5 19:58
看到我眼睛都花了@@

---

歡迎光臨 冰楓論壇 (https://bingfong.com/)

Powered by 冰楓