TwMS v228.1 ICS Set Spawn-Point

麗麗

1. // TwMs v228.1 ICS Set Spawn-Point
   
2. 
   
3. [ENABLE]
   
4. Alloc(SetSpawnPointICS,1024)
   
5. RegisterSymbol(CharX)
   
6. Alloc(CharX,04)
   
7. RegisterSymbol(CharY)
   
8. Alloc(CharY,04)
   
9. RegisterSymbol(MapID)
   
10. Alloc(MapID,04)
    
11. Label(SetSpawnPoint)
    
12. Label(L1)
    
13. Label(L2)
    
14. Label(hook)
    
15. 
    
16. CharX:
    
17. ReadMem([[[0425217C]+CC4C]+34]+58,04)
    
18. 
    
19. CharY:
    
20. ReadMem([[[0425217C]+CC4C]+34]+5C,04)
    
21. 
    
22. MapID:
    
23. ReadMem([0425212C]+187C,04)
    
24. 
    
25. SetSpawnPointICS:
    
26. cmp [esp+58],0298856D
    
27. jne GetProcessHeap
    
28. mov [esp+58],SetSpawnPoint
    
29. jmp GetProcessHeap
    
30. 
    
31. SetSpawnPoint:
    
32. mov [ebp-00000290],eax
    
33. test eax,eax
    
34. je 029885E0
    
35. mov edx,[eax+10]
    
36. lea ecx,[eax+10]
    
37. lea eax,[ebp-0000028C]
    
38. mov [ebp-0000028C],00000000
    
39. push eax
    
40. push 03A034D4
    
41. push ecx
    
42. call dword ptr [edx]
    
43. xor ecx,ecx
    
44. mov [ebp-00000294],eax
    
45. test eax,eax
    
46. cmovns ecx,[ebp-0000028C]
    
47. mov [ebp-000002B4],ecx
    
48. mov ecx,[ebx+00012F9C]
    
49. test ecx,ecx
    
50. je L1
    
51. mov eax,[ecx]
    
52. push ecx
    
53. call dword ptr [eax+08]
    
54. mov eax,[ebp-00000294]
    
55. 
    
56. L1:
    
57. mov ecx,[ebp-000002B4]
    
58. mov [ebx+00012F9C],ecx
    
59. test eax,eax
    
60. jns L2
    
61. cmp eax,80004002
    
62. je L2
    
63. push eax
    
64. call 0344E430
    
65. mov ecx,[ebx+00012F9C]
    
66. test ecx,ecx
    
67. je L2
    
68. mov [ebx+00012F9C],00000000
    
69. mov eax,[ecx]
    
70. push ecx
    
71. call dword ptr [eax+08]
    
72. 
    
73. L2:
    
74. mov ecx,ebx
    
75. lea eax,[ebx+04]
    
76. neg ecx
    
77. sbb ecx,ecx
    
78. and ecx,eax
    
79. push ecx
    
80. mov ecx,[ebp-00000290]
    
81. call 00AE2B30
    
82. mov ecx,[ebp-00000290]
    
83. mov eax,[ebp-00000264]
    
84. push 00
    
85. push [ebx+000007B0]
    
86. mov edx,[ecx]
    
87. add eax,-0A
    
88. push 00
    
89. push 00
    
90. push eax
    
91. push esi
    
92. push 01
    
93. push 02988638
    
94. cmp [edx+00000088],00B43500
    
95. je hook
    
96. jmp 00B43500
    
97. 
    
98. hook:
    
99. mov eax,[0425212C]
    
100. mov eax,[eax+187C]
     
101. cmp [MapID],eax
     
102. jne 00B43500
     
103. mov eax,[CharX]
     
104. mov [esp+08],eax
     
105. mov eax,[CharY]
     
106. mov [esp+0C],eax
     
107. jmp 00B43500
     
108. 
     
109. 044FDA04:
     
110. DD SetSpawnPointICS
     
111. 
     
112. [DISABLE]
     
113. 044FDA04:
     
114. DD GetProcessHeap
     
115. 
     
116. DeAlloc(SetSpawnPointICS)
     
117. UnRegisterSymbol(CharX)
     
118. DeAlloc(CharX)
     
119. UnRegisterSymbol(CharY)
     
120. DeAlloc(CharY)
     
121. UnRegisterSymbol(MapID)
     
122. DeAlloc(MapID)

複製代碼

ke90927

麗麗 發表於 2020-10-4 09:49
嗯。我去試試這個瞬移call多次調用會不會斷綫。

02CA08FE - FF 75 20              - push [ebp+20]

GMS有文本可以参考，这个和GMS那个貌似是一样的

麗麗

ke90927 發表於 2020-10-4 07:49
00B43500瞬移CALL

嗯。我去試試這個瞬移call多次調用會不會斷綫。

02CA08FE - FF 75 20              - push [ebp+20]
02CA0901 - 8B 7D 10              - mov edi,[ebp+10]
02CA0904 - FF 75 1C              - push [ebp+1C]
02CA0907 - FF 75 18              - push [ebp+18]
02CA090A - FF 75 14              - push [ebp+14]
02CA090D - 57                    - push edi        //y
02CA090E - 56                    - push esi        //x
02CA090F - FF 75 08              - push [ebp+08]
02CA0912 - E8 E92BEAFD           - call 00B43500

ke90927

00B43500瞬移CALL

蹦蹦

這是神ㄇ功能?

WhiteWhiteDer

我試試，感謝您

WhiteWhiteDer

有完整教學嗎？完全不會改的新人