冰楓論壇

標題: TwMS v270.1 定點生怪 [打印本頁]

作者: prt    時間: 2025-5-19 05:57
標題: TwMS v270.1 定點生怪
  1. // TwMS v270.1 定點生怪
  2. //太長了
  3. [ENABLE]
  4. Alloc(shengguaiics, 5200,145796967)
  5. label(shengguaihook)

  6. shengguaiics:
  7. push rax
  8. mov rax,145796967
  9. cmp [rsp+68],rax
  10. jne return
  11. mov rax,shengguaihook
  12. mov [rsp+68],rax
  13. jmp return
  14. return:
  15. pop rax
  16. jmp GetLastError

  17. shengguaihook:
  18. mov [r12+00001054],405 //X-Point
  19. mov [r12+00001058],9b //Y-Point
  20. lea ecx,[r12-00003760]
  21. add ecx,eax
  22. mov [r12+000008A8],ecx
  23. mov rcx,[r12+000008A0]
  24. movzx eax,byte ptr [r12+0000089C]
  25. mov [rcx+05],al
  26. mov rcx,[r12+000008A0]
  27. movzx eax,byte ptr [r12+000008A8]
  28. mov [rcx+06],al
  29. mov [rbp+50],r13d
  30. mov ecx,[r12+00000898]
  31. inc ecx
  32. mov [r12+00000898],ecx
  33. mov eax,939A85C5
  34. imul ecx
  35. add edx,ecx
  36. sar edx,06
  37. mov eax,edx
  38. shr eax,1F
  39. add edx,eax
  40. imul eax,edx,6F
  41. cmp ecx,eax
  42. //jne 145796A0B
  43. call 146F40978
  44. mov rcx,[r12+000008A0]
  45. mov [rcx+04],al
  46. mov rcx,[r12+000008A0]
  47. movzx r9d,byte ptr [rcx+04]
  48. mov eax,00009A65
  49. mov [rcx+08],ax
  50. mov esi,r13d
  51. lea rbx,[rcx+02]
  52. lea r14,[rbp+50]
  53. sub r14,rcx
  54. lea r11,[rbp+51]
  55. sub r11,rcx
  56. lea rdi,[rbp+50]
  57. sub rdi,rcx
  58. mov r15d,0000002A
  59. nop dword ptr [rax+00]
  60. nop word ptr [rax+rax+00000000]
  61. movzx r10d,r9l
  62. test r9l,r9l
  63. cmove r10d,r15d
  64. movzx eax,r10l
  65. xor al,[r14+rbx-02]
  66. mov [rbx-02],al
  67. add al,r15l
  68. add r10l,al
  69. movzx r9d,r10l
  70. mov r8,[r12+000008A0]
  71. movzx ecx,word ptr [r8+08]
  72. movzx edx,cx
  73. shr dx,0D
  74. movzx eax,r10l
  75. add dx,ax
  76. shl cx,03
  77. or dx,cx
  78. mov [r8+08],dx
  79. mov ecx,r15d
  80. test r10l,r10l
  81. cmovne ecx,r9d
  82. movzx eax,cl
  83. xor al,[r11+rbx-02]
  84. mov [rbx-01],al
  85. add cl,r15l
  86. add al,cl
  87. movzx r9d,al
  88. mov r8,[r12+000008A0]

  89. movzx ecx,word ptr [r8+08]
  90. movzx edx,cx
  91. shr dx,0D
  92. add dx,r9w
  93. shl cx,03
  94. or dx,cx
  95. mov [r8+08],dx
  96. mov ecx,r15d
  97. test al,al
  98. cmovne ecx,r9d
  99. movzx eax,cl
  100. xor al,[rdi+rbx]
  101. mov [rbx],al
  102. add cl,r15l
  103. add al,cl
  104. movzx r9d,al
  105. mov r8,[r12+000008A0]
  106. movzx ecx,word ptr [r8+08]
  107. movzx edx,cx
  108. shr dx,0D
  109. add dx,r9w
  110. shl cx,03
  111. or dx,cx
  112. mov [r8+08],dx
  113. mov eax,r15d
  114. test r9l,r9l
  115. cmovne eax,r9d
  116. movzx r9d,al
  117. xor r9l,[r11+rbx]
  118. mov [rbx+01],r9l
  119. add al,r15l
  120. add r9l,al
  121. mov r8,[r12+000008A0]
  122. movzx ecx,word ptr [r8+08]
  123. movzx edx,cx
  124. shr dx,0D
  125. movzx eax,r9l
  126. add dx,ax
  127. shl cx,03
  128. or dx,cx
  129. mov [r8+08],dx
  130. add esi,04
  131. lea rbx,[rbx+04]
  132. cmp esi,04
  133. jb 145796A60
  134. mov [r12+000008B0],r13d
  135. mov edx,0000000C
  136. lea rcx,[148E9BA20]
  137. call 14029FEF0
  138. mov [r12+000008B8],rax
  139. call 146F40978
  140. lea ecx,[r12-00003748]
  141. add ecx,eax
  142. mov [r12+000008B4],ecx
  143. call 146F40978
  144. lea ecx,[r12-00003748]
  145. add ecx,eax
  146. mov [r12+000008C0],ecx
  147. mov rcx,[r12+000008B8]
  148. movzx eax,byte ptr [r12+000008B4]
  149. mov [rcx+05],al
  150. mov rcx,[r12+000008B8]
  151. movzx eax,byte ptr [r12+000008C0]
  152. mov [rcx+06],al
  153. mov [rbp+58],r13d
  154. mov ecx,[r12+000008B0]
  155. inc ecx
  156. mov [r12+000008B0],ecx
  157. mov eax,939A85C5
  158. imul ecx
  159. add edx,ecx
  160. sar edx,06
  161. mov eax,edx
  162. shr eax,1F
  163. add edx,eax
  164. imul eax,edx,6F
  165. cmp ecx,eax

  166. call 146F40978
  167. mov rcx,[r12+000008B8]
  168. mov [rcx+04],al
  169. mov rcx,[r12+000008B8]
  170. movzx r9d,byte ptr [rcx+04]
  171. mov eax,00009A65
  172. mov [rcx+08],ax
  173. mov esi,r13d
  174. lea rbx,[rcx+02]
  175. lea r14,[rbp+58]
  176. sub r14,rcx
  177. lea r11,[rbp+59]
  178. sub r11,rcx
  179. lea rdi,[rbp+58]
  180. sub rdi,rcx
  181. movzx r10d,r9l
  182. test r9l,r9l
  183. cmove r10d,r15d
  184. movzx eax,r10l
  185. xor al,[r14+rbx-02]
  186. mov [rbx-02],al
  187. add al,2A
  188. add r10l,al
  189. movzx r9d,r10l
  190. mov r8,[r12+000008B8]
  191. movzx ecx,word ptr [r8+08]
  192. movzx edx,cx
  193. shr dx,0D
  194. movzx eax,r10l
  195. add dx,ax
  196. shl cx,03
  197. or dx,cx
  198. mov [r8+08],dx
  199. mov ecx,r15d
  200. test r10l,r10l
  201. cmovne ecx,r9d
  202. movzx eax,cl
  203. xor al,[r11+rbx-02]
  204. mov [rbx-01],al
  205. add cl,2A
  206. add al,cl
  207. movzx r9d,al
  208. mov r8,[r12+000008B8]

  209. movzx ecx,word ptr [r8+08]
  210. movzx edx,cx
  211. shr dx,0D
  212. add dx,r9w
  213. shl cx,03
  214. or dx,cx
  215. mov [r8+08],dx
  216. mov ecx,r15d
  217. test al,al
  218. cmovne ecx,r9d
  219. movzx eax,cl
  220. xor al,[rdi+rbx]
  221. mov [rbx],al
  222. add cl,2A
  223. add al,cl
  224. movzx r9d,al
  225. mov r8,[r12+000008B8]
  226. movzx ecx,word ptr [r8+08]
  227. movzx edx,cx
  228. shr dx,0D
  229. add dx,r9w
  230. shl cx,03
  231. or dx,cx
  232. mov [r8+08],dx
  233. mov eax,r15d
  234. test r9l,r9l
  235. cmovne eax,r9d
  236. movzx r9d,al
  237. xor r9l,[r11+rbx]
  238. mov [rbx+01],r9l
  239. add al,2A
  240. add r9l,al
  241. mov r8,[r12+000008B8]
  242. movzx ecx,word ptr [r8+08]
  243. movzx edx,cx
  244. shr dx,0D
  245. movzx eax,r9l
  246. add dx,ax
  247. shl cx,03
  248. or dx,cx
  249. mov [r8+08],dx
  250. add esi,04
  251. lea rbx,[rbx+04]
  252. cmp esi,04
  253. jb 145796CA0
  254. mov [r12+000008C8],r13d
  255. mov edx,0000000C
  256. lea rcx,[148E9BA20]
  257. call 14029FEF0
  258. mov [r12+000008D0],rax
  259. call 146F40978
  260. lea ecx,[r12-00003730]
  261. add ecx,eax
  262. mov [r12+000008CC],ecx
  263. call 146F40978
  264. lea ecx,[r12-00003730]
  265. add ecx,eax
  266. mov [r12+000008D8],ecx
  267. mov rcx,[r12+000008D0]
  268. movzx eax,byte ptr [r12+000008CC]
  269. mov [rcx+05],al
  270. mov rcx,[r12+000008D0]
  271. movzx eax,byte ptr [r12+000008D8]
  272. mov [rcx+06],al
  273. mov [rbp+60],r13d
  274. mov ecx,[r12+000008C8]
  275. inc ecx
  276. mov [r12+000008C8],ecx
  277. mov eax,939A85C5
  278. imul ecx
  279. add edx,ecx
  280. sar edx,06
  281. mov eax,edx
  282. shr eax,1F
  283. add edx,eax
  284. imul eax,edx,6F
  285. cmp ecx,eax

  286. call 146F40978
  287. mov rcx,[r12+000008D0]
  288. mov [rcx+04],al
  289. mov rcx,[r12+000008D0]
  290. movzx r9d,byte ptr [rcx+04]
  291. mov eax,00009A65
  292. mov [rcx+08],ax
  293. mov esi,r13d
  294. lea rbx,[rcx+02]
  295. lea r14,[rbp+60]
  296. sub r14,rcx
  297. lea r11,[rbp+61]
  298. sub r11,rcx
  299. lea rdi,[rbp+60]
  300. sub rdi,rcx
  301. nop 2
  302. movzx r10d,r9l
  303. test r9l,r9l
  304. cmove r10d,r15d
  305. movzx eax,r10l
  306. xor al,[r14+rbx-02]
  307. mov [rbx-02],al
  308. add al,2A
  309. add r10l,al
  310. movzx r9d,r10l
  311. mov r8,[r12+000008D0]

  312. movzx ecx,word ptr [r8+08]
  313. movzx edx,cx
  314. shr dx,0D
  315. movzx eax,r10l
  316. add dx,ax
  317. shl cx,03
  318. or dx,cx
  319. mov [r8+08],dx
  320. mov ecx,r15d
  321. test r10l,r10l
  322. cmovne ecx,r9d
  323. movzx eax,cl
  324. xor al,[r11+rbx-02]
  325. mov [rbx-01],al
  326. add cl,2A
  327. add al,cl
  328. movzx r9d,al
  329. mov r8,[r12+000008D0]
  330. movzx ecx,word ptr [r8+08]
  331. movzx edx,cx
  332. shr dx,0D
  333. add dx,r9w
  334. shl cx,03
  335. or dx,cx
  336. mov [r8+08],dx
  337. mov ecx,r15d
  338. test al,al
  339. cmovne ecx,r9d
  340. movzx eax,cl
  341. xor al,[rdi+rbx]
  342. mov [rbx],al
  343. add cl,2A
  344. add al,cl
  345. movzx r9d,al
  346. mov r8,[r12+000008D0]
  347. movzx ecx,word ptr [r8+08]
  348. movzx edx,cx
  349. shr dx,0D
  350. add dx,r9w
  351. shl cx,03
  352. or dx,cx
  353. mov [r8+08],dx
  354. mov eax,r15d
  355. test r9l,r9l
  356. cmovne eax,r9d
  357. movzx r9d,al
  358. xor r9l,[r11+rbx]
  359. mov [rbx+01],r9l
  360. add al,2A
  361. add r9l,al
  362. mov r8,[r12+000008D0]
  363. movzx ecx,word ptr [r8+08]
  364. movzx edx,cx
  365. shr dx,0D
  366. movzx eax,r9l
  367. add dx,ax
  368. shl cx,03
  369. or dx,cx
  370. mov [r8+08],dx
  371. add esi,04
  372. lea rbx,[rbx+04]
  373. cmp esi,04
  374. jb 145796EE0
  375. mov [r12+000008E0],r13d
  376. mov edx,0000000C
  377. lea rcx,[148E9BA20]
  378. call 14029FEF0
  379. mov [r12+000008E8],rax
  380. call 146F40978
  381. lea ecx,[r12-00003718]
  382. add ecx,eax
  383. mov [r12+000008E4],ecx
  384. call 146F40978
  385. lea ecx,[r12-00003718]
  386. add ecx,eax
  387. mov [r12+000008F0],ecx
  388. mov rcx,[r12+000008E8]
  389. movzx eax,byte ptr [r12+000008E4]
  390. mov [rcx+05],al
  391. mov rcx,[r12+000008E8]
  392. movzx eax,byte ptr [r12+000008F0]
  393. mov [rcx+06],al
  394. mov [rbp-58],r13d
  395. mov ecx,[r12+000008E0]
  396. inc ecx
  397. mov [r12+000008E0],ecx
  398. mov eax,939A85C5
  399. imul ecx
  400. add edx,ecx
  401. sar edx,06
  402. mov eax,edx
  403. shr eax,1F
  404. add edx,eax
  405. imul eax,edx,6F
  406. cmp ecx,eax

  407. call 146F40978
  408. mov rcx,[r12+000008E8]
  409. mov [rcx+04],al
  410. mov rcx,[r12+000008E8]
  411. movzx r9d,byte ptr [rcx+04]
  412. mov eax,00009A65
  413. mov [rcx+08],ax
  414. mov esi,r13d
  415. lea rbx,[rcx+02]
  416. lea r14,[rbp-58]
  417. sub r14,rcx
  418. lea r11,[rbp-57]
  419. sub r11,rcx
  420. lea rdi,[rbp-58]
  421. sub rdi,rcx
  422. nop 2
  423. movzx r10d,r9l
  424. test r9l,r9l
  425. cmove r10d,r15d
  426. movzx eax,r10l
  427. xor al,[r14+rbx-02]
  428. mov [rbx-02],al
  429. add al,2A
  430. add r10l,al
  431. movzx r9d,r10l
  432. mov r8,[r12+000008E8]
  433. movzx ecx,word ptr [r8+08]
  434. movzx edx,cx
  435. shr dx,0D
  436. movzx eax,r10l
  437. add dx,ax
  438. shl cx,03
  439. or dx,cx
  440. mov [r8+08],dx
  441. mov ecx,r15d
  442. test r10l,r10l
  443. cmovne ecx,r9d
  444. movzx eax,cl
  445. xor al,[r11+rbx-02]
  446. mov [rbx-01],al
  447. add cl,2A
  448. add al,cl
  449. movzx r9d,al
  450. mov r8,[r12+000008E8]
  451. movzx ecx,word ptr [r8+08]
  452. movzx edx,cx
  453. shr dx,0D
  454. add dx,r9w
  455. shl cx,03
  456. or dx,cx
  457. mov [r8+08],dx
  458. mov ecx,r15d
  459. test al,al
  460. cmovne ecx,r9d
  461. movzx eax,cl
  462. xor al,[rdi+rbx]
  463. mov [rbx],al
  464. add cl,2A
  465. add al,cl
  466. movzx r9d,al
  467. mov r8,[r12+000008E8]
  468. movzx ecx,word ptr [r8+08]
  469. movzx edx,cx
  470. shr dx,0D
  471. add dx,r9w
  472. shl cx,03
  473. or dx,cx
  474. mov [r8+08],dx
  475. mov eax,r15d
  476. test r9l,r9l
  477. cmovne eax,r9d
  478. movzx r9d,al
  479. xor r9l,[r11+rbx]
  480. mov [rbx+01],r9l
  481. add al,2A
  482. add r9l,al
  483. mov r8,[r12+000008E8]
  484. movzx ecx,word ptr [r8+08]
  485. movzx edx,cx
  486. shr dx,0D
  487. movzx eax,r9l
  488. add dx,ax
  489. shl cx,03
  490. or dx,cx
  491. mov [r8+08],dx
  492. add esi,04
  493. lea rbx,[rbx+04]
  494. cmp esi,04
  495. jb 145797120
  496. lea rcx,[r12+00000900]
  497. call 145863810
  498. lea rcx,[r12+00000948]
  499. call 145863810
  500. lea rcx,[r12+00000988]
  501. call 145863810
  502. lea rcx,[r12+000009D0]
  503. call 145863810
  504. lea rcx,[r12+00000A10]
  505. call 145863810
  506. lea rcx,[r12+00000A50]
  507. call 14056B8E0
  508. nop
  509. lea rcx,[r12+00000A68]
  510. call 14056B8E0
  511. nop
  512. lea rcx,[r12+00000A80]
  513. call 14056B8E0
  514. nop
  515. lea rcx,[r12+00000A98]
  516. call 14056B8E0
  517. nop
  518. lea rcx,[r12+00000AB0]
  519. call 145863810
  520. lea rcx,[r12+00000AF0]
  521. call 145863810
  522. lea rcx,[r12+00000B30]
  523. call 145863810
  524. lea rcx,[r12+00000B78]
  525. call 14056B8E0
  526. nop
  527. lea rcx,[r12+00000B90]
  528. call 14056B8E0
  529. nop
  530. lea rcx,[r12+00000BB0]
  531. call 1412C2B60
  532. nop
  533. lea rcx,[r12+00000BE0]
  534. call 1411E7060
  535. nop
  536. lea rcx,[r12+00000C40]
  537. call 1412C2B60
  538. nop
  539. lea rcx,[r12+00000C70]
  540. call 1417A5DF0
  541. nop
  542. lea rcx,[r12+00000C88]
  543. call 14056B8E0
  544. nop
  545. lea rcx,[r12+00000CA0]
  546. call 14056B8E0
  547. nop
  548. mov [r12+00000CB8],r13d
  549. mov edx,0000000C
  550. lea rcx,[148E9BA20]
  551. call 14029FEF0
  552. mov [r12+00000CC0],rax
  553. call 146F40978
  554. lea ecx,[r12-00003340]
  555. add ecx,eax
  556. mov [r12+00000CBC],ecx
  557. call 146F40978
  558. lea ecx,[r12-00003340]
  559. add ecx,eax
  560. mov [r12+00000CC8],ecx
  561. mov rcx,[r12+00000CC0]
  562. movzx eax,byte ptr [r12+00000CBC]
  563. mov [rcx+05],al
  564. mov rcx,[r12+00000CC0]
  565. movzx eax,byte ptr [r12+00000CC8]
  566. mov [rcx+06],al
  567. mov [rbp-50],r13d
  568. mov ecx,[r12+00000CB8]
  569. inc ecx
  570. mov [r12+00000CB8],ecx
  571. mov eax,939A85C5
  572. imul ecx
  573. add edx,ecx
  574. sar edx,06
  575. mov eax,edx
  576. shr eax,1F
  577. add edx,eax
  578. imul eax,edx,6F
  579. cmp ecx,eax

  580. call 146F40978
  581. mov rcx,[r12+00000CC0]
  582. mov [rcx+04],al
  583. mov rcx,[r12+00000CC0]
  584. movzx r9d,byte ptr [rcx+04]
  585. mov eax,00009A65
  586. mov [rcx+08],ax
  587. mov esi,r13d
  588. lea rbx,[rcx+02]
  589. lea r14,[rbp-50]
  590. sub r14,rcx
  591. lea r11,[rbp-4F]
  592. sub r11,rcx
  593. lea rdi,[rbp-50]
  594. sub rdi,rcx
  595. nop 2
  596. movzx r10d,r9l
  597. test r9l,r9l
  598. cmove r10d,r15d
  599. movzx eax,r10l
  600. xor al,[r14+rbx-02]
  601. mov [rbx-02],al
  602. add al,2A
  603. add r10l,al
  604. movzx r9d,r10l
  605. mov r8,[r12+00000CC0]
  606. movzx ecx,word ptr [r8+08]
  607. movzx edx,cx
  608. shr dx,0D
  609. movzx eax,r10l
  610. add dx,ax
  611. shl cx,03
  612. or dx,cx
  613. mov [r8+08],dx
  614. mov ecx,r15d
  615. test r10l,r10l
  616. cmovne ecx,r9d
  617. movzx eax,cl
  618. xor al,[r11+rbx-02]
  619. mov [rbx-01],al
  620. add cl,2A
  621. add al,cl
  622. movzx r9d,al
  623. mov r8,[r12+00000CC0]
  624. movzx ecx,word ptr [r8+08]
  625. movzx edx,cx
  626. shr dx,0D
  627. add dx,r9w
  628. shl cx,03
  629. or dx,cx
  630. mov [r8+08],dx
  631. mov ecx,r15d
  632. test al,al
  633. cmovne ecx,r9d
  634. movzx eax,cl
  635. xor al,[rdi+rbx]
  636. mov [rbx],al
  637. add cl,2A
  638. add al,cl
  639. movzx r9d,al
  640. mov r8,[r12+00000CC0]
  641. movzx ecx,word ptr [r8+08]
  642. movzx edx,cx
  643. shr dx,0D
  644. add dx,r9w
  645. shl cx,03
  646. or dx,cx
  647. mov [r8+08],dx
  648. mov eax,r15d
  649. test r9l,r9l
  650. cmovne eax,r9d
  651. movzx r9d,al
  652. xor r9l,[r11+rbx]
  653. mov [rbx+01],r9l
  654. add al,2A
  655. add r9l,al
  656. mov r8,[r12+00000CC0]
  657. movzx ecx,word ptr [r8+08]
  658. movzx edx,cx
  659. shr dx,0D
  660. movzx eax,r9l
  661. add dx,ax
  662. shl cx,03
  663. or dx,cx
  664. mov [r8+08],dx
  665. add esi,04
  666. lea rbx,[rbx+04]
  667. cmp esi,04
  668. jb 145797470
  669. mov [r12+00000CD0],r13d
  670. mov edx,0000000C
  671. lea rcx,[148E9BA20]
  672. call 14029FEF0
  673. mov [r12+00000CD8],rax
  674. call 146F40978
  675. lea ecx,[r12-00003328]
  676. add ecx,eax
  677. mov [r12+00000CD4],ecx
  678. call 146F40978
  679. lea ecx,[r12-00003328]
  680. add ecx,eax
  681. mov [r12+00000CE0],ecx
  682. mov rcx,[r12+00000CD8]
  683. movzx eax,byte ptr [r12+00000CD4]
  684. mov [rcx+05],al
  685. mov rcx,[r12+00000CD8]
  686. movzx eax,byte ptr [r12+00000CE0]
  687. mov [rcx+06],al
  688. mov [rbp-48],r13d
  689. mov ecx,[r12+00000CD0]
  690. inc ecx
  691. mov [r12+00000CD0],ecx
  692. mov eax,939A85C5
  693. imul ecx
  694. add edx,ecx
  695. sar edx,06
  696. mov eax,edx
  697. shr eax,1F
  698. add edx,eax
  699. imul eax,edx,6F
  700. cmp ecx,eax

  701. call 146F40978
  702. mov rcx,[r12+00000CD8]
  703. mov [rcx+04],al
  704. mov rcx,[r12+00000CD8]
  705. movzx r9d,byte ptr [rcx+04]
  706. mov eax,00009A65
  707. mov [rcx+08],ax
  708. mov esi,r13d
  709. lea rbx,[rcx+02]
  710. lea r14,[rbp-48]
  711. sub r14,rcx
  712. lea r11,[rbp-47]
  713. sub r11,rcx
  714. lea rdi,[rbp-48]
  715. sub rdi,rcx
  716. nop 2
  717. movzx r10d,r9l
  718. test r9l,r9l
  719. cmove r10d,r15d
  720. movzx eax,r10l
  721. xor al,[r14+rbx-02]
  722. mov [rbx-02],al
  723. add al,2A
  724. add r10l,al
  725. movzx r9d,r10l
  726. mov r8,[r12+00000CD8]
  727. movzx ecx,word ptr [r8+08]
  728. movzx edx,cx
  729. shr dx,0D
  730. movzx eax,r10l
  731. add dx,ax
  732. shl cx,03
  733. or dx,cx
  734. mov [r8+08],dx
  735. mov ecx,r15d
  736. test r10l,r10l
  737. cmovne ecx,r9d
  738. movzx eax,cl
  739. xor al,[r11+rbx-02]
  740. mov [rbx-01],al
  741. add cl,2A
  742. add al,cl
  743. movzx r9d,al
  744. mov r8,[r12+00000CD8]
  745. movzx ecx,word ptr [r8+08]
  746. movzx edx,cx
  747. shr dx,0D
  748. add dx,r9w
  749. shl cx,03
  750. or dx,cx
  751. mov [r8+08],dx
  752. mov ecx,r15d
  753. test al,al
  754. cmovne ecx,r9d
  755. movzx eax,cl
  756. xor al,[rdi+rbx]
  757. mov [rbx],al
  758. add cl,2A
  759. add al,cl
  760. movzx r9d,al
  761. mov r8,[r12+00000CD8]
  762. movzx ecx,word ptr [r8+08]
  763. movzx edx,cx
  764. shr dx,0D
  765. add dx,r9w
  766. shl cx,03
  767. or dx,cx
  768. mov [r8+08],dx
  769. mov eax,r15d
  770. test r9l,r9l
  771. cmovne eax,r9d
  772. movzx r9d,al
  773. xor r9l,[r11+rbx]
  774. mov [rbx+01],r9l
  775. add al,2A
  776. add r9l,al
  777. mov r8,[r12+00000CD8]
  778. movzx ecx,word ptr [r8+08]
  779. movzx edx,cx
  780. shr dx,0D
  781. movzx eax,r9l
  782. add dx,ax
  783. shl cx,03
  784. or dx,cx
  785. mov [r8+08],dx
  786. add esi,04
  787. lea rbx,[rbx+04]
  788. cmp esi,04
  789. jb 1457976B0
  790. mov [r12+00000CE8],r13d
  791. mov edx,0000000C
  792. lea rcx,[148E9BA20]
  793. call 14029FEF0
  794. mov [r12+00000CF0],rax
  795. call 146F40978
  796. lea ecx,[r12-00003310]
  797. add ecx,eax
  798. mov [r12+00000CEC],ecx
  799. call 146F40978
  800. lea ecx,[r12-00003310]
  801. add ecx,eax
  802. mov [r12+00000CF8],ecx
  803. mov rcx,[r12+00000CF0]
  804. movzx eax,byte ptr [r12+00000CEC]
  805. mov [rcx+05],al
  806. mov rcx,[r12+00000CF0]
  807. movzx eax,byte ptr [r12+00000CF8]
  808. mov [rcx+06],al
  809. mov [rbp-40],00000001
  810. mov ecx,[r12+00000CE8]
  811. inc ecx
  812. mov [r12+00000CE8],ecx
  813. mov eax,939A85C5
  814. imul ecx
  815. add edx,ecx
  816. sar edx,06
  817. mov eax,edx
  818. shr eax,1F
  819. add edx,eax
  820. imul eax,edx,6F
  821. cmp ecx,eax

  822. call 146F40978
  823. mov rcx,[r12+00000CF0]
  824. mov [rcx+04],al
  825. mov rcx,[r12+00000CF0]
  826. movzx r9d,byte ptr [rcx+04]
  827. mov eax,00009A65
  828. mov [rcx+08],ax
  829. mov esi,r13d
  830. lea rbx,[rcx+02]
  831. lea r14,[rbp-40]
  832. sub r14,rcx
  833. lea r11,[rbp-3F]
  834. sub r11,rcx
  835. lea rdi,[rbp-40]
  836. sub rdi,rcx
  837. movzx r10d,r9l
  838. test r9l,r9l
  839. cmove r10d,r15d
  840. movzx eax,r10l
  841. xor al,[r14+rbx-02]
  842. mov [rbx-02],al
  843. add al,2A
  844. add r10l,al
  845. movzx r9d,r10l
  846. mov r8,[r12+00000CF0]
  847. movzx ecx,word ptr [r8+08]
  848. movzx edx,cx
  849. shr dx,0D
  850. movzx eax,r10l
  851. add dx,ax
  852. shl cx,03
  853. or dx,cx
  854. mov [r8+08],dx
  855. mov ecx,r15d
  856. test r10l,r10l
  857. cmovne ecx,r9d
  858. movzx eax,cl
  859. xor al,[r11+rbx-02]
  860. mov [rbx-01],al
  861. add cl,2A
  862. add al,cl
  863. movzx r9d,al
  864. mov r8,[r12+00000CF0]
  865. movzx ecx,word ptr [r8+08]
  866. movzx edx,cx
  867. shr dx,0D
  868. add dx,r9w
  869. shl cx,03
  870. or dx,cx
  871. mov [r8+08],dx
  872. mov ecx,r15d
  873. test al,al
  874. cmovne ecx,r9d
  875. movzx eax,cl
  876. xor al,[rdi+rbx]
  877. mov [rbx],al
  878. add cl,2A
  879. add al,cl
  880. movzx r9d,al
  881. mov r8,[r12+00000CF0]
  882. movzx ecx,word ptr [r8+08]
  883. movzx edx,cx
  884. shr dx,0D
  885. add dx,r9w
  886. shl cx,03
  887. or dx,cx
  888. mov [r8+08],dx
  889. mov eax,r15d
  890. test r9l,r9l
  891. cmovne eax,r9d
  892. movzx r9d,al
  893. xor r9l,[r11+rbx]
  894. mov [rbx+01],r9l
  895. add al,2A
  896. add r9l,al
  897. mov r8,[r12+00000CF0]
  898. movzx ecx,word ptr [r8+08]
  899. movzx edx,cx
  900. shr dx,0D
  901. movzx eax,r9l
  902. add dx,ax
  903. shl cx,03
  904. or dx,cx
  905. mov [r8+08],dx
  906. add esi,04
  907. lea rbx,[rbx+04]
  908. cmp esi,04
  909. jb 1457978F1
  910. mov [r12+00000D00],r13d
  911. mov edx,0000000C
  912. lea rcx,[148E9BA20]
  913. call 14029FEF0
  914. mov [r12+00000D08],rax
  915. call 146F40978
  916. lea ecx,[r12-000032F8]
  917. add ecx,eax
  918. mov [r12+00000D04],ecx
  919. call 146F40978
  920. lea ecx,[r12-000032F8]
  921. add ecx,eax
  922. mov [r12+00000D10],ecx
  923. mov rcx,[r12+00000D08]
  924. movzx eax,byte ptr [r12+00000D04]
  925. mov [rcx+05],al
  926. mov rcx,[r12+00000D08]
  927. movzx eax,byte ptr [r12+00000D10]
  928. mov [rcx+06],al
  929. mov [rbp-38],r13d
  930. mov ecx,[r12+00000D00]
  931. inc ecx
  932. mov [r12+00000D00],ecx
  933. mov eax,939A85C5
  934. imul ecx
  935. add edx,ecx
  936. sar edx,06
  937. mov eax,edx
  938. shr eax,1F
  939. add edx,eax
  940. imul eax,edx,6F
  941. cmp ecx,eax

  942. call 146F40978
  943. mov rcx,[r12+00000D08]
  944. mov [rcx+04],al
  945. mov rcx,[r12+00000D08]
  946. movzx r9d,byte ptr [rcx+04]
  947. mov eax,00009A65
  948. mov [rcx+08],ax
  949. mov esi,r13d
  950. lea rbx,[rcx+02]
  951. lea r14,[rbp-38]
  952. sub r14,rcx
  953. lea r11,[rbp-37]
  954. sub r11,rcx
  955. lea rdi,[rbp-38]
  956. sub rdi,rcx
  957. nop
  958. movzx r10d,r9l
  959. test r9l,r9l
  960. cmove r10d,r15d
  961. movzx eax,r10l
  962. xor al,[r14+rbx-02]
  963. mov [rbx-02],al
  964. add al,2A
  965. add r10l,al
  966. movzx r9d,r10l
  967. mov r8,[r12+00000D08]
  968. movzx ecx,word ptr [r8+08]
  969. movzx edx,cx
  970. shr dx,0D
  971. movzx eax,r10l
  972. add dx,ax
  973. shl cx,03
  974. or dx,cx
  975. mov [r8+08],dx
  976. mov ecx,r15d
  977. test r10l,r10l
  978. cmovne ecx,r9d
  979. movzx eax,cl
  980. xor al,[r11+rbx-02]
  981. mov [rbx-01],al
  982. add cl,2A
  983. add al,cl
  984. movzx r9d,al
  985. mov r8,[r12+00000D08]
  986. movzx ecx,word ptr [r8+08]
  987. movzx edx,cx
  988. shr dx,0D
  989. add dx,r9w
  990. shl cx,03
  991. or dx,cx
  992. mov [r8+08],dx
  993. mov ecx,r15d
  994. test al,al
  995. cmovne ecx,r9d
  996. movzx eax,cl
  997. xor al,[rdi+rbx]
  998. mov [rbx],al
  999. add cl,2A
  1000. add al,cl
  1001. movzx r9d,al
  1002. mov r8,[r12+00000D08]
  1003. movzx ecx,word ptr [r8+08]
  1004. movzx edx,cx
  1005. shr dx,0D
  1006. add dx,r9w
  1007. shl cx,03
  1008. or dx,cx
  1009. mov [r8+08],dx
  1010. mov eax,r15d
  1011. test r9l,r9l
  1012. cmovne eax,r9d
  1013. movzx r9d,al
  1014. xor r9l,[r11+rbx]
  1015. mov [rbx+01],r9l
  1016. add al,2A
  1017. add r9l,al
  1018. mov r8,[r12+00000D08]
  1019. movzx ecx,word ptr [r8+08]
  1020. movzx edx,cx
  1021. shr dx,0D
  1022. movzx eax,r9l
  1023. add dx,ax
  1024. shl cx,03
  1025. or dx,cx
  1026. mov [r8+08],dx
  1027. add esi,04
  1028. lea rbx,[rbx+04]
  1029. cmp esi,04
  1030. jb 145797B30

  1031. lea rcx,[r12+00000D18]
  1032. call 14056B8E0
  1033. nop
  1034. lea rcx,[r12+00000D30]
  1035. call 14056B8E0
  1036. nop
  1037. lea rcx,[r12+00000D48]
  1038. call 14056B8E0
  1039. nop
  1040. lea rcx,[r12+00000D60]
  1041. call 14056B8E0
  1042. nop
  1043. lea rcx,[r12+00000D78]
  1044. call 14056B8E0
  1045. nop
  1046. lea rcx,[r12+00000D90]
  1047. call 14056B8E0
  1048. nop
  1049. lea rcx,[r12+00000DA8]
  1050. call 1417A5DF0
  1051. nop
  1052. mov [r12+00000DD4],r13d
  1053. lea rcx,[r12+00000DD8]
  1054. call 14056B8E0
  1055. nop
  1056. lea rcx,[r12+00000DF0]
  1057. call 14056B8E0
  1058. nop
  1059. lea rcx,[r12+00000E10]
  1060. call 14056B8E0
  1061. nop
  1062. lea rcx,[r12+00000E28]
  1063. call 14056B8E0
  1064. nop
  1065. mov [r12+00000E40],r13d
  1066. lea rcx,[r12+00000E48]
  1067. call 1412C1B90
  1068. nop
  1069. lea rcx,[r12+00000E60]
  1070. call 1412C1B90
  1071. nop
  1072. lea rcx,[r12+00000E78]
  1073. call 14056B8E0
  1074. nop
  1075. mov word ptr [r12+00000E90],0000
  1076. mov [r12+00000E94],r13
  1077. mov [r12+00000E9C],r13d
  1078. lea r15,[r12+00000EA0]
  1079. mov [rbp-18],r15
  1080. mov rcx,r15
  1081. call 14056B8E0
  1082. nop
  1083. lea rsi,[r15+18]
  1084. mov rcx,rsi
  1085. call 14056B8E0
  1086. nop
  1087. lea r14,[r15+30]
  1088. mov rcx,r14
  1089. call 14056B8E0
  1090. nop
  1091. lea rdi,[r15+48]
  1092. mov rcx,rdi
  1093. call 1417A5DF0
  1094. nop
  1095. lea rbx,[r15+60]
  1096. mov rcx,rbx
  1097. call 1412C2B60
  1098. mov [r15+00000090],r15
  1099. mov [r15+00000098],rsi
  1100. mov [r15+000000A0],r14
  1101. mov [r15+000000A8],r15
  1102. mov [r15+000000B0],r15
  1103. mov [r15+000000B8],rsi
  1104. mov [r15+000000C0],rdi
  1105. mov [r15+000000C8],r14
  1106. mov [r15+000000D0],rbx
  1107. mov [r15+000000D8],rdi
  1108. mov [r15+000000E0],r15
  1109. mov [r15+000000E8],r14
  1110. lea rcx,[r12+00000F90]
  1111. call 140396830
  1112. nop
  1113. mov [r12+00000FA8],r13d
  1114. mov edx,0000000C
  1115. lea rcx,[148E9BA20]
  1116. call 14029FEF0
  1117. mov [r12+00000FB0],rax
  1118. call 146F40978
  1119. lea ecx,[r12-00003050]
  1120. add ecx,eax
  1121. mov [r12+00000FAC],ecx
  1122. call 146F40978
  1123. lea ecx,[r12-00003050]
  1124. add ecx,eax
  1125. mov [r12+00000FB8],ecx
  1126. mov rcx,[r12+00000FB0]
  1127. movzx eax,byte ptr [r12+00000FAC]
  1128. mov [rcx+05],al
  1129. mov rcx,[r12+00000FB0]
  1130. movzx eax,byte ptr [r12+00000FB8]
  1131. mov [rcx+06],al
  1132. mov [rbp-30],r13d
  1133. mov ecx,[r12+00000FA8]
  1134. inc ecx
  1135. mov [r12+00000FA8],ecx
  1136. mov eax,939A85C5
  1137. imul ecx
  1138. add edx,ecx
  1139. sar edx,06
  1140. mov eax,edx
  1141. shr eax,1F
  1142. add edx,eax
  1143. imul eax,edx,6F
  1144. cmp ecx,eax

  1145. call 146F40978
  1146. mov rcx,[r12+00000FB0]
  1147. mov [rcx+04],al
  1148. mov rcx,[r12+00000FB0]
  1149. movzx r9d,byte ptr [rcx+04]
  1150. mov eax,00009A65
  1151. mov [rcx+08],ax
  1152. mov esi,r13d
  1153. lea rbx,[rcx+02]
  1154. lea r14,[rbp-30]
  1155. sub r14,rcx
  1156. lea r11,[rbp-2F]
  1157. sub r11,rcx
  1158. lea rdi,[rbp-30]
  1159. sub rdi,rcx
  1160. mov r15d,0000002A
  1161. nop dword ptr [rax]
  1162. movzx r10d,r9l
  1163. test r9l,r9l
  1164. cmove r10d,r15d
  1165. movzx eax,r10l
  1166. xor al,[r14+rbx-02]
  1167. mov [rbx-02],al
  1168. add al,r15l
  1169. add r10l,al
  1170. movzx r9d,r10l
  1171. mov r8,[r12+00000FB0]
  1172. movzx ecx,word ptr [r8+08]
  1173. movzx edx,cx
  1174. shr dx,0D
  1175. movzx eax,r10l
  1176. add dx,ax
  1177. shl cx,03
  1178. or dx,cx
  1179. mov [r8+08],dx
  1180. mov ecx,r15d
  1181. test r10l,r10l
  1182. cmovne ecx,r9d
  1183. movzx eax,cl
  1184. xor al,[r11+rbx-02]
  1185. mov [rbx-01],al
  1186. add cl,r15l
  1187. add al,cl
  1188. movzx r9d,al
  1189. mov r8,[r12+00000FB0]
  1190. movzx ecx,word ptr [r8+08]
  1191. movzx edx,cx
  1192. shr dx,0D
  1193. add dx,r9w
  1194. shl cx,03
  1195. or dx,cx
  1196. mov [r8+08],dx
  1197. mov ecx,r15d
  1198. test al,al
  1199. cmovne ecx,r9d
  1200. movzx eax,cl
  1201. xor al,[rdi+rbx]
  1202. mov [rbx],al
  1203. add cl,r15l
  1204. add al,cl
  1205. movzx r9d,al
  1206. mov r8,[r12+00000FB0]
  1207. movzx ecx,word ptr [r8+08]
  1208. movzx edx,cx
  1209. shr dx,0D
  1210. add dx,r9w
  1211. shl cx,03
  1212. or dx,cx
  1213. mov [r8+08],dx
  1214. mov eax,r15d
  1215. test r9l,r9l
  1216. cmovne eax,r9d
  1217. movzx r9d,al
  1218. xor r9l,[r11+rbx]
  1219. mov [rbx+01],r9l
  1220. add al,r15l
  1221. add r9l,al
  1222. mov r8,[r12+00000FB0]
  1223. movzx ecx,word ptr [r8+08]
  1224. movzx edx,cx
  1225. shr dx,0D
  1226. movzx eax,r9l
  1227. add dx,ax
  1228. shl cx,03
  1229. or dx,cx
  1230. mov [r8+08],dx
  1231. add esi,04
  1232. lea rbx,[rbx+04]
  1233. cmp esi,04
  1234. jb 145797F10
  1235. mov [r12+00000FC0],r13d
  1236. mov edx,0000000C
  1237. lea rcx,[148E9BA20]
  1238. call 14029FEF0
  1239. mov [r12+00000FC8],rax
  1240. call 146F40978
  1241. lea ecx,[r12-00003038]
  1242. add ecx,eax
  1243. mov [r12+00000FC4],ecx
  1244. call 146F40978
  1245. lea ecx,[r12-00003038]
  1246. add ecx,eax
  1247. mov [r12+00000FD0],ecx
  1248. mov rdx,[r12+00000FC8]
  1249. movzx ecx,byte ptr [r12+00000FC4]
  1250. mov [rdx+05],cl
  1251. mov rdx,[r12+00000FC8]
  1252. movzx ecx,byte ptr [r12+00000FD0]
  1253. mov [rdx+06],cl
  1254. mov [rbp-28],r13d
  1255. mov ecx,[r12+00000FC0]
  1256. inc ecx
  1257. mov [r12+00000FC0],ecx
  1258. mov eax,939A85C5
  1259. imul ecx
  1260. add edx,ecx
  1261. sar edx,06
  1262. mov eax,edx
  1263. shr eax,1F
  1264. add edx,eax
  1265. imul eax,edx,6F
  1266. cmp ecx,eax

  1267. call 146F40978
  1268. mov rcx,[r12+00000FC8]
  1269. mov [rcx+04],al
  1270. mov rcx,[r12+00000FC8]
  1271. movzx r9d,byte ptr [rcx+04]
  1272. mov eax,00009A65
  1273. mov [rcx+08],ax
  1274. mov esi,r13d
  1275. lea r11,[rcx+02]
  1276. lea r14,[rbp-28]
  1277. sub r14,rcx
  1278. lea rbx,[rbp-27]
  1279. sub rbx,rcx
  1280. lea rdi,[rbp-28]
  1281. sub rdi,rcx
  1282. nop dword ptr [rax+00]
  1283. nop word ptr [rax+rax+00000000]
  1284. movzx r10d,r9l
  1285. test r9l,r9l
  1286. cmove r10d,r15d
  1287. movzx eax,r10l
  1288. xor al,[r14+r11-02]
  1289. mov [r11-02],al
  1290. add al,2A
  1291. add r10l,al
  1292. movzx r9d,r10l
  1293. mov r8,[r12+00000FC8]
  1294. movzx ecx,word ptr [r8+08]
  1295. movzx edx,cx
  1296. shr dx,0D
  1297. movzx eax,r10l
  1298. add dx,ax
  1299. shl cx,03
  1300. or dx,cx
  1301. mov [r8+08],dx
  1302. mov ecx,r15d
  1303. test r10l,r10l
  1304. cmovne ecx,r9d
  1305. movzx eax,cl
  1306. xor al,[rbx+r11-02]
  1307. mov [r11-01],al
  1308. add cl,2A
  1309. add al,cl
  1310. movzx r9d,al
  1311. mov r8,[r12+00000FC8]
  1312. movzx ecx,word ptr [r8+08]
  1313. movzx edx,cx
  1314. shr dx,0D
  1315. add dx,r9w
  1316. shl cx,03
  1317. or dx,cx
  1318. mov [r8+08],dx
  1319. mov ecx,r15d
  1320. test al,al
  1321. cmovne ecx,r9d
  1322. movzx eax,cl
  1323. xor al,[rdi+r11]
  1324. mov [r11],al
  1325. add cl,2A
  1326. add al,cl
  1327. movzx r9d,al
  1328. mov r8,[r12+00000FC8]
  1329. movzx ecx,word ptr [r8+08]
  1330. movzx edx,cx
  1331. shr dx,0D
  1332. add dx,r9w
  1333. shl cx,03
  1334. or dx,cx
  1335. mov [r8+08],dx
  1336. mov eax,r15d
  1337. test r9l,r9l
  1338. cmovne eax,r9d
  1339. movzx r9d,al
  1340. xor r9l,[rbx+r11]
  1341. mov [r11+01],r9l
  1342. add al,2A
  1343. add r9l,al
  1344. mov r8,[r12+00000FC8]
  1345. movzx ecx,word ptr [r8+08]
  1346. movzx edx,cx
  1347. shr dx,0D
  1348. movzx eax,r9l
  1349. add dx,ax
  1350. shl cx,03
  1351. or dx,cx
  1352. mov [r8+08],dx
  1353. add esi,04
  1354. lea r11,[r11+04]
  1355. cmp esi,04
  1356. jb 145798160

  1357. mov [r12+00000FD8],r13d
  1358. mov qword ptr [r12+00000FE4],00000001
  1359. mov [r12+00000FEC],r13d
  1360. mov [r12+00000FF8],r13
  1361. mov [r12+00001000],r13
  1362. mov [r12+00001010],r13
  1363. mov [r12+00001008],r13
  1364. mov [r12+00001018],r13
  1365. mov [r12+00001020],r13
  1366. mov [r12+00001028],r13
  1367. mov [r12+00001030],r13
  1368. mov [r12+00001038],r13
  1369. mov [r12+00001040],r13
  1370. mov [r12+00001050],1
  1371. jmp 1457982F1

  1372. 1476F8710:
  1373. DQ shengguaiics

  1374. [DISABLE]

  1375. 1476F8710:
  1376. DQ GetLastError
複製代碼

作者: ql139278    時間: 2025-5-19 12:35
太感謝了,這個代碼這麽多,感謝版主
作者: rhg59321    時間: 2025-5-19 23:50
這樣就可以了吧? 沒必要寫那麼長, 至少我在土龍測試過有用

// TwMs v270.1 定點生怪
[Enable]
Alloc(Check_Esp,512,MapleStory.exe)
Label(Hook)
Label(Exit)

Check_Esp:
push rax
mov rax,14381F3E8
cmp [rsp+1F8],rax
jne Exit
mov rax,Hook
mov [rsp+1F8],rax
jmp Exit

Exit:
pop rax
jmp GetLastError

Hook:
mov rsi,rax
mov [rsi+00001050],1
mov [rsi+00001054],FFFFFDD9 //X-Point
mov [rsi+00001058],000000A5 //Y-Point
jmp 14381F3E8

1476F8710:
DQ Check_Esp

[Disable]
1476F8710:
DQ GetLastError

DeAlloc(Check_Esp)
作者: lafeng666    時間: 2025-5-20 21:34
rhg59321 發表於 2025-5-19 23:50
這樣就可以了吧? 沒必要寫那麼長, 至少我在土龍測試過有用

// TwMs v270.1 定點生怪

是可以很短, 这份代码我之前故意这样写的,没想到还有人更新出来




歡迎光臨 冰楓論壇 (https://bingfong.com/) Powered by 冰楓