TwMs AllVer 取得ics數據之esp+xx

yutsaihsieh

GET ESP.CT (1.51 KB, 下載次數: 92)

2018-11-2 21:01 上傳

點擊文件名下載附件
閱讀權限: 10

CT中以人物損血不後退為示範
舉例:
完全無敵ICS
00474861 - FF 15 C42F7003        - call dword ptr [03702FC4] { ->0163B260 }
call dword ptr [Addr1] { ->Addr2}
Addr3=020DC99A

//TwMs 211.2 取得ics數據之esp+xx
//Author:yutsaihsieh
[ENABLE]
alloc(hook,256)
alloc(offset,8)
alloc(find,4)
alloc(count,4)
alloc(found,128)
alloc(reset,128)
alloc(return,128)
registersymbol(offset)
registersymbol(find)
Addr1:
DD hook

hook:
cmp [find],1
je return
push eax
push [offset]
pop eax
cmp [esp+eax],Addr3
pop eax
je found
inc [count]
add [offset],4
cmp [count],100 //跳掉可以把這邊改低一點
jl hook
jmp reset
found:
mov [find],1
sub [offset],4
jmp return
reset:
mov [offset],0
mov [count],0
jmp return
return:
jmp Addr2


[DISABLE]
Addr1:
DD Addr2