[ENABLE]
alloc(newmem,500)
registersymbol(Createadoll) // 初始化 人造指针
registersymbol(C0begiA) // 初始化 人造指针
registersymbol(memcpyStub) // 初始化 人造指针
registersymbol(memcryint) // 初始化 人造指针
registersymbol(prompt) // 初始化 人造指针
registersymbol(gjntcode) // 初始化 人造指针
label(C0begiA)
label(Createadoll)
label(ChEh_BEnd)
label(gjntcode)
label(next)
label(C0begin)
label(zhenyin)
label(fujia)
label(renou)
label(TenRpcs)
label(memcpyStub)
label(memcryint)
label(Executioncode1113end)
label(prompt)
label(gavcgogo)
label(code8)
label(code18)
label(code20)
define(CHAR,4D8EEA8)//人物基址
define(Invincible,319ADE0)//无敌Call
define(ZHCS,4CBF144)//召唤参数
define(RenOuCall,205FA10)//人偶call
define(Dolls,400900)//人偶数组
define(cheh,3110)//武器偏移
define(type,0B94)//属性偏移
define(BlAp,828)//阵营偏移
define(buii,400550)//type17
define(SD,4C9855C)//商店基址
define(LB,245FBB0)//喇叭公告
define(score,4C96A34)//评分基址
define(Objectaddress,400a0c)
newmem:
push TenRpcs
call GetModuleHandleA
mov ebx,eax
//Hook_Call
add eax,2A6C0
mov [0400A00],eax
//Hook_Ret
mov eax,ebx
add eax,1FE052
mov [0400A04],eax
mov [Objectaddress],0
ret
Createadoll:
mov ebx,[CHAR]
mov ebx,[ebx+BC]
cmp ebx,0
je Executioncode1113end
cmp [Objectaddress],0
jne Executioncode1113end
mov eax,[score]
add eax,c0c
push 4
push 113456
push eax
call memcryint
mov ecx,[CHAR]
mov esi,ecx
push -1
push 1
push 1
push 1
mov edx,Invincible //透明CALL
call edx
mov edx,Dolls
mov [edx],#56300//56300 //人偶参数
mov [edx+4],#90
mov [edx+8],#60
mov [edx+0c],0
mov [edx+10],1
push Dolls
push [CHAR]
mov ecx,ZHCS
call RenOuCall
mov [Objectaddress],3
gjntcode:
mov eax,buii
mov [eax],(float)17
mov [eax+4],(float)2
mov edx,[400a30]
cmp edx,0
jne code8
mov [eax+8],(float)62134//23012//23033//63123
jmp code8+3
code8:
mov [eax+8],edx
mov [eax+0c],(float)0
mov [eax+10],(float)0
mov [eax+14],(float)0
mov edx,[400a34]
cmp edx,0
jne code18
mov [eax+18],(float)3905352
jmp code18+3
code18:
mov [eax+18],edx
mov [eax+1c],(float)0
mov edx,[400a38]
cmp edx,0
jne code20
mov [eax+24],(float)26179
jmp code20+3
code20:
mov [eax+24],edx
mov [eax+20],(float)0
mov [eax+28],(float)0
mov [eax+2c],(float)0
mov [eax+30],(float)99
mov [eax+3c],(float)1
ret
C0begiA:
mov ebx,[CHAR]
mov ebx,[ebx+BC]
cmp ebx,0
je Executioncode1113end
cmp [Objectaddress],3
jne Executioncode1113end
mov ebx,[ebx+c0]
C0begin:
mov edx,[ebx]
mov edx,[edx+98]
cmp edx,#273
je zhenyin
jmp next
zhenyin:
mov edx,[ebx]
mov edx,[edx+BlAp]
cmp edx,0
je fujia
jmp next
fujia:
mov edx,[ebx]
cmp edx,[CHAR]
jne renou
jmp next
renou:
mov [Objectaddress],edx
jmp ChEh_BEnd
next:
add ebx,4
mov edx,[CHAR]
mov edx,[edx+BC]
mov edx,[edx+c4]
cmp ebx,edx//地址是否已到结尾
jl C0begin
ChEh_BEnd:
cmp [Objectaddress],3
je Executioncode1113end
cmp [Objectaddress],0
je Executioncode1113end
//[[[[[char]+cheh]+type]+4]+4]+4://触发间隔
//mov [edx+0x2ec],(float)3//变大
mov eax,[edx+cheh]
mov eax,[eax+type]
mov eax,[eax+4]
mov eax,[eax+4]
mov [eax+4],#300
//[[[[[char]+cheh]+type]+4]+18]+0://触发方式
mov eax,[edx+cheh]
mov eax,[eax+type]
mov eax,[eax+4]
mov eax,[eax+18]
mov [eax],#31
//[[[[[[char]+cheh]+type]+18]+4]+4]+4://攻击对象
mov eax,[edx+cheh]
mov eax,[eax+type]
mov eax,[eax+18]
mov eax,[eax+4]
mov eax,[eax+4]
mov [eax+4],(float)4
//[[[[[[char]+cheh]+type]+18]+4]+18]+4://触发几率
mov eax,[edx+cheh]
mov eax,[eax+type]
mov eax,[eax+18]
mov eax,[eax+4]
mov eax,[eax+18]
mov [eax+4],(float)100
//[[[[[char]+cheh]+type]+18]+4]+2c://触发开始
mov eax,[edx+cheh]
mov eax,[eax+type]
mov eax,[eax+18]
mov eax,[eax+4]
mov [eax+2c],buii
//[[[[[char]+cheh]+type]+18]+4]+30://触发结束
mov eax,[edx+cheh]
mov eax,[eax+type]
mov eax,[eax+18]
mov eax,[eax+4]
mov ebx,buii
add ebx,40
mov [eax+30],ebx
push FF0000FF
push 23
push gavcgogo
call prompt
mov edx,Dolls
mov [edx],0//人偶参数
mov [edx+4],0
mov [edx+8],0
mov [edx+0c],0
mov [edx+10],0
Executioncode1113end:
ret
memcryint:
mov eax,[esp+08]
mov ecx,[esp+0C]
push ecx
lea edx,[esp+0C]
mov [esp+0C],eax
mov eax,[esp+08]
push edx
push eax
call memcpyStub
ret c
memcpyStub:
push ecx
push ebx
mov ebx,[esp+14]
push ebp
mov ebp,[esp+10]
push esi
push edi
lea eax,[esp+10]
push eax
push 40
push ebx
push ebp
mov [esp+20],00000000
call VirtualProtect
cld
mov ecx,[esp+20]
mov esi,[esp+1C]
mov edi,[esp+18]
//repe movsb
db F3 A4
mov ecx,[esp+10]
push 00
push ecx
push ebx
push ebp
call VirtualProtect
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret c
prompt:
mov eax,[esp+4]
mov ebx,[esp+8]
mov edx,[esp+0c]
mov ecx,[SD]
mov ecx,[ecx+50]
push 0
push 0
push 0
push 0
push ebx
push edx //0FF0000FF
push eax
call LB
ret 0c
TenRpcs:
db 54 65 6E 52 70 63 73 00
gavcgogo:
db 00 5F CB 59 68 51 4F 5C 00 00
createthread(newmem)
[DISABLE]
unregistersymbol(Createadoll) // 撤销 人造指针
unregistersymbol(C0begiA) // 撤销 人造指针
unregistersymbol(memcpyStub) // 撤销 人造指针
unregistersymbol(memcryint) // 撤销 人造指针
unregistersymbol(prompt) // 撤销 人造指针
unregistersymbol(gjntcode) // 撤销 人造指针
dealloc(newmem)