TwMs v265.4 MSCRC Bypass v1 + 修復進出商城Buff顯示

prt

1. //TwMs v265.4 MSCRC Bypass v1 + 修復進出商城Buff顯示
   
2. [ENABLE]
   
3. Alloc(MSCRC_Bypass_Hook,128,1451D1DE0)//(CALL里面头部)
   
4. Label(MSCRC_Bypass_Exit)
   
5. 
   
6. MSCRC_Bypass_Hook:
   
7. mov rax,[147AD3D00]
   
8. test rax,rax
   
9. je MSCRC_Bypass_Exit
   
10. mov rax,[rax+000023C8]
    
11. test rax,rax
    
12. je MSCRC_Bypass_Exit
    
13. mov byte ptr[rax+10],0
    
14. jmp MSCRC_Bypass_Exit
    
15. 
    
16. MSCRC_Bypass_Exit:
    
17. xor eax, eax
    
18. ret
    
19. 
    
20. 1451D1DE0:
    
21. jmp MSCRC_Bypass_Hook
    
22. 
    
23. [DISABLE]
    
24. 1451D1DE0:
    
25. mov [rsp+10],rdx
    
26. 
    
27. DeAlloc(MSCRC_Bypass_Hook)

複製代碼

guoxue332

請問這個mov rax,[rax+000023C8]裡面的23C8是哪裡來的那