2025 腾讯游戏安全大赛 mobile 初赛 wp
dump sdk
先在字符串表里勾选 Unicode C-style(16bits)方便后面搜字符串
查看 ue4版本
直接搜UE4，即可出现UE4版本: UE4-4.27
找GWORLD
字符串直接搜索 SeamlessTravel FlushLevelStreaming
交叉引用定位到函数:
往上翻可以找到GWROLD
Gworld地址: 0x00000000AFAC398
找GName
字符串直接搜 ByteProperty
其传入的第一个参数其实就是GName,对此函数进行交叉引用，即可看到第一个参数
GNAME地址： 0x00000000ADF07C0
找 GUObjectArray
字符串直接搜 CloseDisregardForGC,交叉引用到关键函数，下面就是 GUObjectArray
GUObjectArray地址： 000000000AE34A98
dump sdk
使用这个工具dump: https://github.com/revercc/UE4Dumper
或者这个也行: https://github.com/hackcatml/frida-ue4dump 不过需要改一下源码，推荐第一个
dump出sdk、objs、actor即可
# GNAME: 0x00000000ADF07C0
# GUObjectArray: 0x00000000AE34A98
# Gworld: 0x00000000AFAC398
# dump sdk:
# ./ue4dumper64 --package com.ACE2025.Game --newue+ --sdkw --gworld 0x00000000AFAC398 --gname 0x00000000ADF07C0 --output /data/local/tmp/111
# dump objs: # 获取类地址、对象地址
# ./ue4dumper64 --package com.ACE2025.Game --newue+ --objs --gname 0x00000000ADF07C0 --guobj 0x00000000AE34A98 --output /data/local/tmp/111
# dump actors
# ./ue4dumper64 --package com.ACE2025.Game --newue+ --actors --gworld 0x00000000AFAC398 --gname 0x00000000ADF07C0 --output /data/local/tmp/111
修复人物移动速度异常
在移动第一人称角色的时候，移动速度非常快，像是在瞬移一样，显然是移动速度异常，其中这个类中记录的最大的移动速度，那我们只需要修改第一人称角色的MaxWalkSpeed属性即可。
frida hook 代码如下我们这里打印原speed后改写speed值，这里选择修改移速为 1000.0
function hook_find_actor( find_actor_name,cnt=0){
try{
var libUE4_module = Module.findBaseAddress("libUE4.so")
// console.log("libUE4_module is :", libUE4_module)
var GName = libUE4_module.add(GName_Offset);
var GWorld = libUE4_module.add(GWorld_Offset).readPointer()
var Level_Offset = 0x30
var Level = GWorld.add(Level_Offset).readPointer()
// console.log("Level :", Level)
var Actors_Offset = 0x98
var Actors = Level.add(Actors_Offset).readPointer()
// console.log("Actors Array :", Actors)
var Actors_Num = Level.add(Actors_Offset).add(8).readU32()
// console.log("Actors_num :", Actors_Num)
var ct = 0
for(var index = 0; index < Actors_Num; index++){
var actor = Actors.add(index * 8).readPointer()
//通过角色actor获取其成员变量FName
var FName_Offset = 0x18
var FName = actor.add(FName_Offset);
var FNameEntryAllocator = GName
var FNamePool = FNameEntryAllocator.add(0x38) // FNamePool
//手动解析FNamePool
var ComparisonIndex = FName.add(0).readU32()
var FNameBlockOffsetBits = 16
var FNameBlockOffsets = 65536
var Block = ComparisonIndex >> FNameBlockOffsetBits
var Offset = ComparisonIndex & (FNameBlockOffsets - 1)
var NamePoolChunk = FNamePool.add(0x8 + Block * 8).readPointer()
var FNameEntry = NamePoolChunk.add(Offset * 2)
var FNameEntryHeader = FNameEntry.readU16()
var isWide = FNameEntryHeader & 1
var Len = FNameEntryHeader >> 6
// console.log("actor : ", actor, " ", FNameEntry.add(2).readCString(Len))
if(0 == isWide){
var Name = FNameEntry.add(2).readCString(Len)
var actor_addr = actor;
if (Name === find_actor_name){
if(ct == cnt){
// console.log("actor : ", actor, " ", FNameEntry.add(2).readCString(Len))
return actor_addr
}else{
ct++
}
}
}
}
}catch(e){
console.log("hook_find_actor error :", e)
}
}
function check_move_speed(){
try{
var FirstPersonCharacter_C = hook_find_actor("FirstPersonCharacter_C")
var CharacterMovementComponent = FirstPersonCharacter_C.add(0x288).readPointer()
var MaxWalkSpeed = CharacterMovementComponent.add(0x18c).readFloat()
console.log("MaxWalkSpeed is :", MaxWalkSpeed)
}catch(e){
console.log("check_move_speed error :", e)
}
}
function check_move_speed(){
try{
var FirstPersonCharacter_C = hook_find_actor("FirstPersonCharacter_C")
var CharacterMovementComponent = FirstPersonCharacter_C.add(0x288).readPointer()
var MaxWalkSpeed = CharacterMovementComponent.add(0x18c).readFloat()
console.log("MaxWalkSpeed is :", MaxWalkSpeed)
}catch(e){
console.log("check_move_speed error :", e)
}
}
function one_move_speed(){
check_move_speed()
modify_move_speed()
}
one_move_speed()
可以看到，原来的移速是 1000000000.0，我们修改为了 1000.0
修改成功后，人物移动正常。
修复射击后第一人称角色的朝向异常
点击开火后，我们发现，无论射击前第一人称角色朝向哪里，射击后第一人称角色都会立马朝向一个立方体。
获取立方体名称
操纵第一人称角色走到这个立方体附近，或者说挨着这个立方体，之后打印第一人称角色与所有立方体的世界坐标，看看哪个立方体的世界坐标与我们最接近。
代码实现如下:
function get_actor_location(Actor_name){
try{
var so_base = get_so_base()
var Actor = hook_find_actor(Actor_name)
var K2_GetActorLocation_addr = so_base.add(0x92e16b4)
var buf = Memory.alloc(0x100);
var K2_GetActorLocation = new NativeFunction(K2_GetActorLocation_addr, 'void', ['pointer','pointer','pointer']);
K2_GetActorLocation(Actor,ptr(buf),ptr(buf));
var s0 = Memory.readFloat(buf)
var s1 = Memory.readFloat(buf.add(4))
var s2 = Memory.readFloat(buf.add(8))
console.log(`${Actor_name} Loc: (${s0},${s1},${s2})`)
}catch(e){
console.log("get_actor_location error :", e)
}
}
function get_cube_and_first_perseon_location(){
var Actor_list = ["EditorCube8","EditorCube9","EditorCube10","EditorCube11","EditorCube12","EditorCube13","EditorCube14","EditorCube15","EditorCube16","EditorCube17","EditorCube18","EditorCube19","EditorCube20","EditorCube21","FirstPersonCharacter_C"]
for(var i in Actor_list){
get_actor_location(Actor_list[i])
}
}
get_cube_and_first_perseon_location()
显然 "EditorCube8" 与第一人称角色的世界坐标最接近，那么第一人称角色开枪后面朝的敌方就是 EditorCube8的位置了。
寻找异常转向的关键逻辑点
思路
我的思路是既然每次开枪后，第一人称角色都会转向 EditorCube8的位置，那么可以猜测，每次开枪后，EditorCube8的世界坐标将会被读取一次，用作处理第一人称的转向方向，那我们只要获取了EditorCube8的世界坐标的地址，再对其下硬件访问断点 + 栈回溯，就能找到异常转向的关键逻辑点。
获取 EditorCube8 的世界坐标的内存地址
EditorCube8
function hook_and_get_location_addr(){
var so_base = get_so_base()
const offset = 0x0000000092E16F4
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
var x9 = this.context.x9;
var x10 = this.context.x10;
var x8 = this.context.x8;
console.log(x9,x10,x8)
}
});
}
function get_EditorCube8_location_addr(){
try{
hook_and_get_location_addr()
var Actor_name = "EditorCube8"
var so_base = get_so_base()
var Actor = hook_find_actor(Actor_name)
var K2_GetActorLocation_addr = so_base.add(0x92e16b4)
var buf = Memory.alloc(0x100);
var K2_GetActorLocation = new NativeFunction(K2_GetActorLocation_addr, 'void', ['pointer','pointer','pointer']);
K2_GetActorLocation(Actor,ptr(buf),ptr(buf));
var s0 = Memory.readFloat(buf)
var s1 = Memory.readFloat(buf.add(4))
var s2 = Memory.readFloat(buf.add(8))
// console.log(`${Actor_name} Loc: (${s0},${s1},${s2})`)
}catch(e){
console.log("get_actor_location error :", e)
}
}
get_EditorCube8_location_addr()
我们直接对 0x6ecb511810 这一个地址下硬件访问断点即可
下硬件访问断点栈回溯找到关键地址
./stackplz --pid `pidof com.ACE2025.Game` --brk 0x6ecb511810:r --stack
之后点击射击七次，得到如下log:
oriole:/data/local/tmp/111 # ./stackplz --pid `pidof com.ACE2025.Game` --brk 0x6ecb511810:r --stack
[*] save maps to maps_4612.txt
set breakpoint at kernel:false, addr:0x6ecb511810, type:1
start 1 modules
[4612|4654] event_addr:0x6ecb511810 hit_count:1, Backtrace:
#00 pc 000000000670f4c0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 000000000670feac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000009268e34 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000009266e00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 0000000008fa0588 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 0000000008f9f6f0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 0000000008f9f370 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 0000000008fa7354 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091fdb88 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#13 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#14 pc 0000000008d3b75c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#15 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#16 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#17 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:2, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:3, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:4, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:5, Backtrace:
#00 pc 000000000670f4c0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 000000000670feac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000009268e34 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000009266e00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 0000000008fa0588 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 0000000008f9f6f0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 0000000008f9f370 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 0000000008fa7354 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091fdb88 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#13 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#14 pc 0000000008d3b75c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#15 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#16 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#17 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:6, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:7, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:8, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:9, Backtrace:
#00 pc 000000000670f4c0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 000000000670feac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000009268e34 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000009266e00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 0000000008fa0588 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 0000000008f9f6f0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 0000000008f9f370 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 0000000008fa7354 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091fdb88 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#13 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#14 pc 0000000008d3b75c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#15 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#16 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#17 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:10, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:11, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:12, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:13, Backtrace:
#00 pc 000000000670f4c0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 000000000670feac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000009268e34 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000009266e00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 0000000008fa0588 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 0000000008f9f6f0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 0000000008f9f370 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 0000000008fa7354 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091fdb88 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#13 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#14 pc 0000000008d3b75c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#15 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#16 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#17 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:14, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:15, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:16, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:17, Backtrace:
#00 pc 000000000670f4c0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 000000000670feac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000009268e34 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000009266e00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 0000000008fa0588 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 0000000008f9f6f0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 0000000008f9f370 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 0000000008fa7354 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091fdb88 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#13 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#14 pc 0000000008d3b75c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#15 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#16 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#17 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:18, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:19, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:20, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:21, Backtrace:
#00 pc 000000000670f4c0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 000000000670feac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000009268e34 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000009266e00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 0000000008fa0588 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 0000000008f9f6f0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 0000000008f9f370 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 0000000008fa7354 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091fdb88 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#13 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#14 pc 0000000008d3b75c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#15 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#16 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#17 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:22, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:23, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:24, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:25, Backtrace:
#00 pc 000000000670f4c0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 000000000670feac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000009268e34 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000009266e00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 0000000008fa0588 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 0000000008f9f6f0 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 0000000008f9f370 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 0000000008fa7354 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091fdb88 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#13 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#14 pc 0000000008d3b75c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#15 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#16 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#17 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:26, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:27, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
[4612|4654] event_addr:0x6ecb511810 hit_count:28, Backtrace:
#00 pc 0000000008f71e9c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#01 pc 0000000008f71b38 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#02 pc 0000000008f92718 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#03 pc 0000000008c99dbc /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#04 pc 00000000067cebac /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#05 pc 00000000067ce72c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#06 pc 00000000067cde20 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#07 pc 00000000091f9c00 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#08 pc 00000000091f73b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#09 pc 0000000008d3b82c /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#10 pc 0000000008c068ec /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#11 pc 0000000005af53b8 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
#12 pc 0000000005af3510 /data/app/~~nP9y_mRYawq_JHQSTAHA5Q==/com.ACE2025.Game-1mBJqxTlD47aW15Aj2_e_A==/lib/arm64/libUE4.so
对这个地址 000000000670f4c0进行计数，发现正好是7次，显然这个地址就是我们要找的地址。
分析关键逻辑发现异常原因
定位到地址处，发现果然有问题
图中的 tvec对应的坐标就是 EditorCube8 的世界坐标，myvec1对应的坐标正是第一人称角色的世界坐标。
上图的程序正在进行求 第一人称角色到EditorCube8的单位向量。如果你尝试hook一下vec的值，可以发现射击后的朝向位置会发生改变。
修复异常
我这里给出的修复方案是hook归一化后的单位向量，把归一化后的单位向量修改成准星的朝向向量，或者说摄像机的朝向向量。
实现步骤如下:
-
首先获取准星的rot朝向坐标(rot1,rot2,0)，这里我使用的
GetActorEyesViewPointapi进行的获取。 -
随后将朝向坐标转化为方向向量。 (rot1,rot2,0) => (x,y,z)
-
复写记录归一化单位向量的浮点寄存器。
frida 代码如下:
function get_actor_eyes_view_point(Actor_name){
try{
var Actor = hook_find_actor(Actor_name)
var no_exec_GetActorEyesViewPoint = Actor.readPointer().add(0x610).readPointer()
var GetActorEyesViewPoint = new NativeFunction(no_exec_GetActorEyesViewPoint, 'void', ['pointer','pointer','pointer']);
var buf1 = Memory.alloc(0x100);
var buf2 = Memory.alloc(0x100);
GetActorEyesViewPoint(Actor,buf1,buf2)
// console.log(`${Actor_name } eyes Location: (${buf1.readFloat()},${buf1.add(4).readFloat()},${buf1.add(8).readFloat()})`)
// console.log(`get_actor_eyes_view_point： Rotation: (${buf2.readFloat()},${buf2.add(4).readFloat()},${buf2.add(8).readFloat()})`)
var rot1 = buf2.readFloat()
var rot2 = buf2.add(4).readFloat()
var rot3 = buf2.add(8).readFloat()
return [rot1,rot2,rot3]
}catch(e){
console.log(e)
}
}
function two_shooted(){ // 对立方体坐标下内存访问断点。
// hook_fake_location()
var so_base = get_so_base()
const offset = 0x00000000670F3D0
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
try{
// 1、获取准星方向
var rots = get_actor_eyes_view_point("FirstPersonCharacter_C") // success!!!，重点就是要进行朝向坐标(x,y,0)到方向向量的转化！！！
// var rots = get_Crosshair_vec()
// var rots = test_GetControlRotation("FirstPersonCharacter_C")
// var rots = test_K2_GetActorRotation()
// 2、准星转单位向量
var pitch = rots[0]
var yaw = rots[1]
var viewDirection = {
x: Math.cos(yaw * Math.PI / 180) * Math.cos(pitch * Math.PI / 180),
y: Math.sin(yaw * Math.PI / 180) * Math.cos(pitch * Math.PI / 180),
z: Math.sin(pitch * Math.PI / 180)
};
// 3、替换回去
var s1 = this.context.s1;
var s0 = this.context.s0;
var s2 = this.context.s2;
// console.log(`old vec: (${s1},${s0},${s2})`)
this.context.s1 = viewDirection.x
this.context.s0 = viewDirection.y
this.context.s2 = viewDirection.z
}catch(e){
console.log(e)
}
}
});
}
two_shooted()
修复之后，再次开枪，第一人称角色将的转向将不再异常。
ps: 事实上，直接搜Fire字符串也能定位到关键函数:
修复子弹发射位置异常
在发射子弹的时候很明显可以发现子弹不是又枪口打出的。不过仔细观察可以发现，子弹的发射位置虽然不在枪口上，但距离枪口并不远，猜测是读取了枪口的世界坐标之后进行了小修改。
那我们的大致思路如下:
对枪口的世界坐标下硬件访问断点，栈回溯跟踪到关键函数。再更正发射坐标为枪口坐标。
栈回溯定位关键逻辑
首先获取枪口的世界坐标的内存地址，通过 FP_MuzzleLocation 类可以进行读取，我这里直接读的结构体信息，当然也可以用改射击后人物朝向问题中的方法来进行获取。
function get_shoot_location_addr(){
try{
var so_base = get_so_base()
var FirstPersonCharacter_C = hook_find_actor("FirstPersonCharacter_C")
var FP_MuzzleLocation = FirstPersonCharacter_C.add(0x4c8).readPointer() // 炮口的定位
var loc1 = FP_MuzzleLocation.add(0x1D0).readFloat()
var loc2 = FP_MuzzleLocation.add(0x1D4).readFloat()
var loc3 = FP_MuzzleLocation.add(0x1D8).readFloat()
console.log(`gunLocation: (${loc1},${loc2},${loc3})`)
return FP_MuzzleLocation.add(0x1D0)
}catch(e){
console.log("check_shoot_location error :", e)
}
}
var loc1_addr = get_shoot_location_addr() // 获取枪口的世界坐标
console.log(loc1_addr)
得到:
0x7b1a2aedd0
./stackplz --pid `pidof com.ACE2025.Game` --brk 0x7b1a2aedd0:r --stack
栈回溯并射击6次，之后找出出现6次的回溯地址，即可定位到关键函数： 0x00670fe10
分析关键逻辑并修复异常
查看0x00670fe10地址，可以发现，原本的枪口世界坐标被加上了额外的值。
我们这里hook验证一下：
function check_fire_point(){
var so_base = get_so_base()
const offset = 0x00000000670FE34
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
var s0 = this.context.s0;
var s1 = this.context.s1;
var s2 = this.context.s2;
console.log(`abnormal: s0: ${s0}, s1: ${s1}, s2: ${s2}`)
var s10 = this.context.s10;
var s8 = this.context.s8;
var s9 = this.context.s9;
console.log(`firepoint: s10: ${s10}, s8: ${s8}, s9: ${s9}`)
}
})
}
check_fire_point()
可以发现，加的值并不是固定的值，第一人称转向、移动都会影响这个值。
abnormal: s0: -59.438690185546875, s1: -16.764766693115234, s2: 79.2842025756836
firepoint: s10: -301.29876708984375, s8: -87.74143981933594, s9: 302.5216064453125
abnormal: s0: -59.438690185546875, s1: -16.764766693115234, s2: 79.2842025756836
firepoint: s10: -301.4654541015625, s8: -88.9248046875, s9: 302.9551086425781
abnormal: s0: -59.438690185546875, s1: -16.764766693115234, s2: 79.2842025756836
firepoint: s10: -301.46051025390625, s8: -88.63323974609375, s9: 302.9544372558594
abnormal: s0: -59.438690185546875, s1: -16.764766693115234, s2: 79.2842025756836
firepoint: s10: -301.45947265625, s8: -88.62262725830078, s9: 302.9522399902344
abnormal: s0: -59.438690185546875, s1: -16.764766693115234, s2: 79.2842025756836
firepoint: s10: -301.44573974609375, s8: -88.47727966308594, s9: 302.9073181152344
abnormal: s0: -59.438690185546875, s1: -16.764766693115234, s2: 79.2842025756836
firepoint: s10: -301.4380187988281, s8: -88.41704559326172, s9: 302.88482666015625
abnormal: s0: -59.438690185546875, s1: -16.764766693115234, s2: 79.2842025756836
firepoint: s10: -301.42230224609375, s8: -88.40211486816406, s9: 302.982177734375
abnormal: s0: -59.438690185546875, s1: -16.764766693115234, s2: 79.2842025756836
firepoint: s10: -301.4681091308594, s8: -88.91127014160156, s9: 302.96490478515625
abnormal: s0: -59.438690185546875, s1: -16.764766693115234, s2: 79.2842025756836
firepoint: s10: -301.45489501953125, s8: -88.57484436035156, s9: 302.9414978027344
abnormal: s0: -59.438690185546875, s1: -16.764766693115234, s2: 79.2842025756836
firepoint: s10: -301.4615173339844, s8: -88.64331817626953, s9: 302.95635986328125
abnormal: s0: -59.438690185546875, s1: -16.764766693115234, s2: 79.2842025756836
firepoint: s10: -303.1545715332031, s8: -86.83795928955078, s9: 306.3929443359375
abnormal: s0: -59.438690185546875, s1: -16.764766693115234, s2: 79.2842025756836
firepoint: s10: -304.9639892578125, s8: -85.28128051757813, s9: 305.6708068847656
abnormal: s0: 11.320207595825195, s1: 15.38095474243164, s2: 98.6675033569336
firepoint: s10: -324.6070251464844, s8: -64.57211303710937, s9: 379.7553405761719
abnormal: s0: 11.320207595825195, s1: 15.38095474243164, s2: 98.6675033569336
firepoint: s10: -324.7317810058594, s8: -65.70530700683594, s9: 380.142578125
abnormal: s0: 11.320207595825195, s1: 15.38095474243164, s2: 98.6675033569336
firepoint: s10: -324.8832702636719, s8: -65.43800354003906, s9: 380.1285400390625
abnormal: s0: 11.320207595825195, s1: 15.38095474243164, s2: 98.6675033569336
firepoint: s10: -327.78277587890625, s8: -66.71699523925781, s9: 381.9648742675781
abnormal: s0: 11.320207595825195, s1: 15.38095474243164, s2: 98.6675033569336
firepoint: s10: -325.3687438964844, s8: -65.65100860595703, s9: 380.7190856933594
abnormal: s0: 11.320207595825195, s1: 15.38095474243164, s2: 98.6675033569336
firepoint: s10: -324.55804443359375, s8: -65.42581176757812, s9: 379.9935607910156
abnormal: s0: -26.82939338684082, s1: -12.064498901367187, s2: 96.09698486328125
firepoint: s10: -1343.3326416015625, s8: 1267.1907958984375, s9: 380.8399353027344
abnormal: s0: -26.82939338684082, s1: -12.064498901367187, s2: 96.09698486328125
firepoint: s10: -1342.82373046875, s8: 1267.7081298828125, s9: 380.1015930175781
abnormal: s0: -26.82939338684082, s1: -12.064498901367187, s2: 96.09698486328125
firepoint: s10: -1342.3763427734375, s8: 1267.47265625, s9: 380.11419677734375
abnormal: s0: -26.82939338684082, s1: -12.064498901367187, s2: 96.09698486328125
firepoint: s10: -1342.3963623046875, s8: 1267.669189453125, s9: 380.03082275390625
abnormal: s0: -28.94965934753418, s1: -16.421926498413086, s2: 94.82740783691406
firepoint: s10: -2016.4945068359375, s8: 1560.826171875, s9: 380.11834716796875
abnormal: s0: -28.94965934753418, s1: -16.421926498413086, s2: 94.82740783691406
firepoint: s10: -2016.5916748046875, s8: 1560.822509765625, s9: 380.1373291015625
abnormal: s0: -28.94965934753418, s1: -16.421926498413086, s2: 94.82740783691406
firepoint: s10: -2020.0706787109375, s8: 1558.0648193359375, s9: 381.183349609375
abnormal: s0: -28.94965934753418, s1: -16.421926498413086, s2: 94.82740783691406
firepoint: s10: -2020.18115234375, s8: 1557.998779296875, s9: 381.1535339355469
abnormal: s0: -28.94965934753418, s1: -16.421926498413086, s2: 94.82740783691406
firepoint: s10: -2016.543701171875, s8: 1560.8126220703125, s9: 380.13153076171875
abnormal: s0: 0.7390117645263672, s1: 100.39048767089844, s2: -4.605022430419922
firepoint: s10: -1534.670654296875, s8: -65.89259338378906, s9: 265.26934814453125
abnormal: s0: 0.7390117645263672, s1: 100.39048767089844, s2: -4.605022430419922
firepoint: s10: -1533.805419921875, s8: -65.6893310546875, s9: 264.3363952636719
abnormal: s0: -23.652671813964844, s1: 97.37969207763672, s2: -7.599071502685547
firepoint: s10: -1846.0318603515625, s8: -258.6576232910156, s9: 263.96258544921875
abnormal: s0: -39.815643310546875, s1: 91.96302795410156, s2: -7.583924293518066
firepoint: s10: -1777.1134033203125, s8: -569.8597412109375, s9: 264.600341796875
abnormal: s0: -39.815643310546875, s1: 91.96302795410156, s2: -7.583924293518066
firepoint: s10: -1776.739990234375, s8: -569.74560546875, s9: 264.28875732421875
abnormal: s0: -39.815643310546875, s1: 91.96302795410156, s2: -7.583924293518066
firepoint: s10: -1776.6981201171875, s8: -569.7369995117188, s9: 264.2738952636719
abnormal: s0: -39.815643310546875, s1: 91.96302795410156, s2: -7.583924293518066
firepoint: s10: -1776.1925048828125, s8: -570.8599853515625, s9: 266.969970703125
abnormal: s0: -55.80156707763672, s1: 83.1710205078125, s2: -8.292570114135742
firepoint: s10: -1841.102783203125, s8: -678.2743530273438, s9: 265.0874938964844
既然如此，那么我们的思路就是把这些额外的值hook为0
只需要改 0x00000000670FE34处的 s0、s1、s2等浮点寄存器即可实现。
function modify_fire_point(){
var so_base = get_so_base()
const offset = 0x00000000670FE34
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
this.context.s0 = 0.0;
this.context.s1 = 0.0;
this.context.s2 = 0.0;
// var s10 = this.context.s10;
// var s8 = this.context.s8;
// var s9 = this.context.s9;
// console.log(`s10: ${s10}, s8: ${s8}, s9: ${s9}`)
}
})
}
modify_fire_point()
修复完之后，再次点击射击，子弹成功从枪口飞出，不过射击方向异常。
修复子弹射击方向异常
子弹的发射方向存在问题，发射方向本应该沿着准星发射，但游戏里子弹发射出现乱射的情况，猜测异常原因:
发射的时候，app获取了准星的朝向坐标，但之后对朝向坐标进行了随机修改，这就导致了射击方向的异常。
找关键逻辑
按照之前的思路，我们可以尝试对准星的朝向坐标的内存下硬件访问断点，找到关键函数后进行分析。
实际上，这次，我们有了新的方法，在修复子弹发射位置异常异常解决中，我们得到了0x00670fe10地址，实际上对0x00670fe10地址交叉引用，就又回到了这里:
0x00670fe10所在函数上面有一个000000000670FBAC偏移大小的函数，点进去查看：
结合随机数，可以大胆猜出，这里就是获取 准星的朝向坐标 的函数！包括像这个函数:
(*(void (__fastcall **)(_QWORD))(**(_QWORD **)(Actor + 0x258) + 0x690LL))(*(_QWORD *)(Actor + 0x258));
实际上就是在获取 ControlRotation
分析逻辑修复异常
这里我们hook一下函数返回的 s0、s1、s2坐标
function modify_emmo_direction(){
var so_base = get_so_base()
const offset = 0x00000000670F64C
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
var s0 = this.context.s0;
var s1 = this.context.s1;
var s2 = this.context.s2;
console.log(`old_dir: s0: ${s0}, s1: ${s1}, s2: ${s2}`)
}
});
}
modify_emmo_direction()
我朝一个固定的位置连续发射子弹，可以发现hook的返回结果是在不断变化的，很显然我们的猜测结果是正确的。
就是 准星的ControlRotation被加了随机数导致的！
我的修复方案是，hook s0、s1、s2浮点寄存器，把原来的rot值添回去:
function modify_emmo_direction(){
var so_base = get_so_base()
const offset = 0x00000000670F64C
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
var s0 = this.context.s0;
var s1 = this.context.s1;
var s2 = this.context.s2;
console.log(`old_dir: s0: ${s0}, s1: ${s1}, s2: ${s2}`)
var rots = get_actor_eyes_view_point("FirstPersonCharacter_C")
var pitch = rots[0]
var yaw = rots[1]
this.context.s0 = pitch
this.context.s1 = yaw
this.context.s2 =0.0
}
});
}
modify_emmo_direction()
修复完这个后，我们再次开火，可以发现子弹顺利朝着准星的方向发射，至此，子弹相关的修复工作完成。
异常透视 (未成功修复)
当第三人称角色被障碍物(如墙、立方体)的时候，依然能清晰的看见第三人称角色。
在ue4的开发过程中，如果想要实现透视效果，往往需要自定义渲染通道(custom depth)。
但我在分析的时候发现第三人称角色就没有使用 自定义渲染通道:
function test_actor_call_rander_level(Actor_Name){
var Actor = hook_find_actor(Actor_Name)
var SceneComponent = Actor.add(0x130).readPointer()
var bRenderCustomDepth = SceneComponent.add(0x216).readU8() & 0x40
console.log(`${Actor_Name} => bRenderCustomDepth: ${bRenderCustomDepth}`)
var CustomDepthStencilValue = SceneComponent.add(0x220).readU32()
console.log(`${Actor_Name} => CustomDepthStencilValue: ${CustomDepthStencilValue}`)
}
test_actor_call_rander_level("ThirdPersonCharacter")
猜测这里的透视是用非常规的手法实现的。
最终并未找到修复该异常的方法
总脚本
未删减，里面有很多测试用的代码片段。
const GWorld_Offset = 0x00000000AFAC398
const GName_Offset = 0x00000000ADF07C0
function get_so_base(module_name = "libUE4.so") {
return Module.getBaseAddress(module_name);
}
function pt(p){
console.log(p)
}
function hook_dlopen(){
var dlopen_addr = Module.findExportByName(null, "android_dlopen_ext");
Interceptor.attach(dlopen_addr, {
onEnter: function(args) {
var so_name = Memory.readCString(args[0]);
console.log("dlopen called with: " + so_name);
if(so_name.includes("libUE4.so")){
this.hook = true
}
},
onLeave: function(retval) {
if(this.hook == true){
}
}
});
}
function hook_find_actor( find_actor_name,cnt=0){
try{
var libUE4_module = Module.findBaseAddress("libUE4.so")
// console.log("libUE4_module is :", libUE4_module)
var GName = libUE4_module.add(GName_Offset);
var GWorld = libUE4_module.add(GWorld_Offset).readPointer()
var Level_Offset = 0x30
var Level = GWorld.add(Level_Offset).readPointer()
// console.log("Level :", Level)
var Actors_Offset = 0x98
var Actors = Level.add(Actors_Offset).readPointer()
// console.log("Actors Array :", Actors)
var Actors_Num = Level.add(Actors_Offset).add(8).readU32()
// console.log("Actors_num :", Actors_Num)
var ct = 0
for(var index = 0; index < Actors_Num; index++){
var actor = Actors.add(index * 8).readPointer()
//通过角色actor获取其成员变量FName
var FName_Offset = 0x18
var FName = actor.add(FName_Offset);
var FNameEntryAllocator = GName
var FNamePool = FNameEntryAllocator.add(0x38) // FNamePool
//手动解析FNamePool
var ComparisonIndex = FName.add(0).readU32()
var FNameBlockOffsetBits = 16
var FNameBlockOffsets = 65536
var Block = ComparisonIndex >> FNameBlockOffsetBits
var Offset = ComparisonIndex & (FNameBlockOffsets - 1)
var NamePoolChunk = FNamePool.add(0x8 + Block * 8).readPointer()
var FNameEntry = NamePoolChunk.add(Offset * 2)
var FNameEntryHeader = FNameEntry.readU16()
var isWide = FNameEntryHeader & 1
var Len = FNameEntryHeader >> 6
// console.log("actor : ", actor, " ", FNameEntry.add(2).readCString(Len))
if(0 == isWide){
var Name = FNameEntry.add(2).readCString(Len)
var actor_addr = actor;
if (Name === find_actor_name){
if(ct == cnt){
// console.log("actor : ", actor, " ", FNameEntry.add(2).readCString(Len))
return actor_addr
}else{
ct++
}
}
}
}
}catch(e){
console.log("hook_find_actor error :", e)
}
}
function pt_all_actor(){
var libUE4_module = Module.findBaseAddress("libUE4.so")
// console.log("libUE4_module is :", libUE4_module)
var GName = libUE4_module.add(GName_Offset);
var GWorld = libUE4_module.add(GWorld_Offset).readPointer()
var Level_Offset = 0x30
var Level = GWorld.add(Level_Offset).readPointer()
// console.log("Level :", Level)
var Actors_Offset = 0x98
var Actors = Level.add(Actors_Offset).readPointer()
// console.log("Actors Array :", Actors)
var Actors_Num = Level.add(Actors_Offset).add(8).readU32()
// console.log("Actors_num :", Actors_Num)
var ct = 0
for(var index = 0; index < Actors_Num; index++){
var actor = Actors.add(index * 8).readPointer()
//通过角色actor获取其成员变量FName
var FName_Offset = 0x18
var FName = actor.add(FName_Offset);
var FNameEntryAllocator = GName
var FNamePool = FNameEntryAllocator.add(0x38) // FNamePool
//手动解析FNamePool
var ComparisonIndex = FName.add(0).readU32()
var FNameBlockOffsetBits = 16
var FNameBlockOffsets = 65536
var Block = ComparisonIndex >> FNameBlockOffsetBits
var Offset = ComparisonIndex & (FNameBlockOffsets - 1)
var NamePoolChunk = FNamePool.add(0x8 + Block * 8).readPointer()
var FNameEntry = NamePoolChunk.add(Offset * 2)
var FNameEntryHeader = FNameEntry.readU16()
var isWide = FNameEntryHeader & 1
var Len = FNameEntryHeader >> 6
// console.log("actor : ", actor, " ", FNameEntry.add(2).readCString(Len))
if(0 == isWide){
var Name = FNameEntry.add(2).readCString(Len)
var actor_addr = actor;
console.log("actor : ", actor, " ", FNameEntry.add(2).readCString(Len))
}
}
}
function check_move_speed(){
try{
var FirstPersonCharacter_C = hook_find_actor("FirstPersonCharacter_C")
var CharacterMovementComponent = FirstPersonCharacter_C.add(0x288).readPointer()
var MaxWalkSpeed = CharacterMovementComponent.add(0x18c).readFloat()
console.log("MaxWalkSpeed is :", MaxWalkSpeed)
}catch(e){
console.log("check_move_speed error :", e)
}
}
function modify_move_speed(){
try{
var new_speed = 1000.0
var FirstPersonCharacter_C = hook_find_actor("FirstPersonCharacter_C")
var CharacterMovementComponent = FirstPersonCharacter_C.add(0x288).readPointer()
CharacterMovementComponent.add(0x18c).writeFloat(new_speed)
console.log("new speed is :", new_speed)
}catch(e){
console.log("modify_move_speed error :", e)
}
}
function check_is_vr(){ // false,不在vr状态
try{
var FirstPersonCharacter_C = hook_find_actor("FirstPersonCharacter_C")
var bIsVR = FirstPersonCharacter_C.add(0x528).readU8()
console.log("bIsVR is :", bIsVR)
}catch(e){
console.log("check_is_vr error :", e)
}
}
function one_move_speed(){
check_move_speed()
modify_move_speed()
}
function check_Recoil(){
try{
var FirstPersonCharacter_C = hook_find_actor("FirstPersonCharacter_C")
var RecoilPitch = FirstPersonCharacter_C.add(0x52c).readFloat()
var RecoilYaw = FirstPersonCharacter_C.add(0x530).readFloat()
var RecoilRecoverySpeed = FirstPersonCharacter_C.add(0x534).readFloat()
var RecoilAccumulationRate = FirstPersonCharacter_C.add(0x538).readFloat()
// console.log("RecoilPitch is :", RecoilPitch)
// console.log("RecoilYaw is :", RecoilYaw)
// console.log("RecoilRecoverySpeed is :", RecoilRecoverySpeed)
// console.log("RecoilAccumulationRate is :", RecoilAccumulationRate)
// 5.0
// FirstPersonCharacter_C.add(0x534).writeFloat(5.0)
FirstPersonCharacter_C.add(0x52c).writeFloat(0.0)
FirstPersonCharacter_C.add(0x530).writeFloat(0.0)
FirstPersonCharacter_C.add(0x534).writeFloat(0.0)
FirstPersonCharacter_C.add(0x538).writeFloat(0.0)
}catch(e){
console.log("check_Recoil error :", e)
}
}
function two_Recoil(){
check_Recoil() // 先把后坐力之类的全部改为0以防万一
}
function get_shoot_location_Rotation(){
try{
var so_base = get_so_base()
var FirstPersonCharacter_C = hook_find_actor("FirstPersonCharacter_C")
var FP_MuzzleLocation = FirstPersonCharacter_C.add(0x4c8).readPointer() // 炮口的定位
var no_exec_K2_GetComponentLocation = so_base.add(0x000000009595A48)
const K2_GetComponentLocation = new NativeFunction(no_exec_K2_GetComponentLocation,"void",['pointer','pointer','pointer'])
var buf = Memory.alloc(0x100);
K2_GetComponentLocation(FP_MuzzleLocation,buf,buf)
// console.log(`gunLocation: (${Memory.readFloat(buf)},${Memory.readFloat(buf.add(4))},${Memory.readFloat(buf.add(8))})`)
var no_exec_K2_GetComponentRotation = so_base.add(0x000000009595A10)
const K2_GetComponentRotation = new NativeFunction(no_exec_K2_GetComponentRotation,"void",['pointer','pointer','pointer'])
var buf2 = Memory.alloc(0x100);
K2_GetComponentRotation(FP_MuzzleLocation,buf2,buf2)
console.log(`gunRotation: (${Memory.readFloat(buf2)},${Memory.readFloat(buf2.add(4))},${Memory.readFloat(buf2.add(8))})`)
}catch(e){
console.log("check_shoot_location error :", e)
}
}
function hook_onHit(){
var so_base = get_so_base()
const offset = 0x67138e8
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
// get_all_location()
console.log("")
}
});
}
function get_actor_location(Actor_name){
try{
var so_base = get_so_base()
var Actor = hook_find_actor(Actor_name)
var K2_GetActorLocation_addr = so_base.add(0x92e16b4)
var buf = Memory.alloc(0x100);
var K2_GetActorLocation = new NativeFunction(K2_GetActorLocation_addr, 'void', ['pointer','pointer','pointer']);
K2_GetActorLocation(Actor,ptr(buf),ptr(buf));
var s0 = Memory.readFloat(buf)
var s1 = Memory.readFloat(buf.add(4))
var s2 = Memory.readFloat(buf.add(8))
console.log(`${Actor_name} Loc: (${s0},${s1},${s2})`)
}catch(e){
console.log("get_actor_location error :", e)
}
}
function get_actor_rotation(Actor_name){
try{
var so_base = get_so_base()
var Actor = hook_find_actor(Actor_name)
var K2_GetActorRotation_addr = so_base.add(0x92e1400)
var buf = Memory.alloc(0x100);
var K2_GetActorRotionn = new NativeFunction(K2_GetActorRotation_addr, 'void', ['pointer','pointer','pointer']);
K2_GetActorRotionn(Actor,ptr(buf),ptr(buf));
var s0 = Memory.readFloat(buf)
var s1 = Memory.readFloat(buf.add(4))
var s2 = Memory.readFloat(buf.add(8))
console.log(`${Actor_name} Rot: (${s0},${s1},${s2})`)
}catch(e){
console.log("get_actor_location error :", e)
}
}
// 这个好
function get_actor_eyes_view_point(Actor_name){
try{
var Actor = hook_find_actor(Actor_name)
var no_exec_GetActorEyesViewPoint = Actor.readPointer().add(0x610).readPointer()
var GetActorEyesViewPoint = new NativeFunction(no_exec_GetActorEyesViewPoint, 'void', ['pointer','pointer','pointer']);
var buf1 = Memory.alloc(0x100);
var buf2 = Memory.alloc(0x100);
GetActorEyesViewPoint(Actor,buf1,buf2)
// console.log(`${Actor_name } eyes Location: (${buf1.readFloat()},${buf1.add(4).readFloat()},${buf1.add(8).readFloat()})`)
// console.log(`get_actor_eyes_view_point： Rotation: (${buf2.readFloat()},${buf2.add(4).readFloat()},${buf2.add(8).readFloat()})`)
var rot1 = buf2.readFloat()
var rot2 = buf2.add(4).readFloat()
var rot3 = buf2.add(8).readFloat()
return [rot1,rot2,rot3]
}catch(e){
console.log(e)
}
}
// Class: SceneComponent.ActorComponent.Object
function get_CameraForward(){
try{
var Actor = hook_find_actor("CameraActor")
var SceneComponent = Actor.add(0x230).readPointer()
var so_addr = get_so_base()
var GetForwardVector_pointer = so_addr.add(0x9595934)
var buf = Memory.alloc(0x100);
var GetForwardVector = new NativeFunction(GetForwardVector_pointer, 'void', ['pointer','pointer','pointer']);
GetForwardVector(SceneComponent,buf,buf)
console.log(`forward: (${buf.readFloat()},${buf.add(4).readFloat()},${buf.add(8).readFloat()})`)
return [buf.readFloat(),buf.add(4).readFloat(),buf.add(8).readFloat()]
}catch(e){
console.log(e)
}
}
function get_Crosshair_vec(){
var so_addr = get_so_base()
var Actor = hook_find_actor("MyProjectHUD")
var PlayerController = Actor.add(0x220).readPointer()
var DeprojectScreenPositionToWorld_pointer = so_addr.add(0x000000008F9EE60)
var DeprojectScreenPositionToWorld = new NativeFunction(DeprojectScreenPositionToWorld_pointer, 'bool', ['pointer','float','float','pointer','pointer']);
var WorldLocation = Memory.alloc(0x100);
var WorldDirection = Memory.alloc(0x100);
var ret = DeprojectScreenPositionToWorld(PlayerController,0.5,0.5,WorldLocation,WorldDirection)
// console.log(`get_Crosshair_vec： WorldLocation: (${Memory.readFloat(WorldLocation)},${Memory.readFloat(WorldLocation.add(4))},${Memory.readFloat(WorldLocation.add(8))})`)
console.log(`get_Crosshair_vec: (${Memory.readFloat(WorldDirection)},${Memory.readFloat(WorldDirection.add(4))},${Memory.readFloat(WorldDirection.add(8))})`)
console.log(`ret: ${ret}`)
return [Memory.readFloat(WorldDirection),Memory.readFloat(WorldDirection.add(4)),Memory.readFloat(WorldDirection.add(8))]
}
function test_GetPlayerViewPoint(){
}
function test_GetControlRotation(Actor_name){
try{
var Actor = hook_find_actor(Actor_name)
var so_base = get_so_base()
var GetControlRotation_addr = so_base.add(0x937bb14)
var buf = Memory.alloc(0x100);
var GetControlRotation = new NativeFunction(GetControlRotation_addr, 'void', ['pointer','pointer','pointer']);
GetControlRotation(Actor,ptr(buf),ptr(buf));
console.log(`test_GetControlRotation: (${buf.readFloat()},${buf.add(4).readFloat()},${buf.add(8).readFloat()})`)
return [buf.readFloat(),buf.add(4).readFloat(),buf.add(8).readFloat()]
}catch(e){
console.log(e)
}
}
function test_K2_GetActorRotation(){
try{
var so_base = get_so_base()
var Actor = hook_find_actor("FirstPersonCharacter_C")
var K2_GetActorRotation_addr = so_base.add(0x92e1400)
var buf = Memory.alloc(0x100);
var K2_GetActorRotionn = new NativeFunction(K2_GetActorRotation_addr, 'void', ['pointer','pointer','pointer']);
K2_GetActorRotionn(Actor,ptr(buf),ptr(buf));
var s0 = Memory.readFloat(buf)
var s1 = Memory.readFloat(buf.add(4))
var s2 = Memory.readFloat(buf.add(8))
console.log(`test_K2_GetActorRotation Rot: (${s0},${s1},${s2})`)
return [s0,s1,s2]
}catch(e){
console.log("get_actor_location error :", e)
}
}
function test_GetCameraRotation(){
try{
var so_base = get_so_base()
var Actor = hook_find_actor("FirstPersonCharacter_C")
var GetController = so_base.add(0x953b82c)
var buf = Memory.alloc(0x100);
var GetController = new NativeFunction(GetController, 'pointer', ['pointer','pointer','pointer']);
var control = GetController(Actor,ptr(buf),ptr(buf));
// var PlayerCameraManager = control.add(0x2b8).readPointer()
var PlayerCameraManager = buf.readPointer()
var GetCameraRotation_addr = so_base.add(0x9550538)
var buf2 = Memory.alloc(0x100);
var GetCameraRotation = new NativeFunction(GetCameraRotation_addr, 'void', ['pointer','pointer','pointer']);
console.log(`Actor: ${Actor}`)
console.log(`PlayerCameraManager: ${PlayerCameraManager}`)
GetCameraRotation(PlayerCameraManager,ptr(buf2),ptr(buf2));
console.log(`test_GetCameraRotation Rot: (${buf2.readFloat()},${buf2.add(4).readFloat()},${buf2.add(8).readFloat()})`)
return [buf2.readFloat(),buf2.add(4).readFloat(),buf2.add(8).readFloat()]
}catch(e){
console.log(e)
}
}
function get_GunOffset(){
var Actor = hook_find_actor("FirstPersonCharacter_C")
var GunOffset = Actor.add(0x500)
var s0 = GunOffset.readFloat()
var s1 = GunOffset.add(4).readFloat()
var s2 = GunOffset.add(8).readFloat()
console.log(`GunOffset: (${s0},${s1},${s2})`)
}
function get_all_location(){
// get_actor_location("FirstPersonCharacter_C") // 获取第一人称的定位
// get_actor_rotation("FirstPersonCharacter_C") // 获取第一人称的定位
// get_shoot_location_Rotation() // 获取枪械的定位
// get_actor_location("ThirdPersonCharacter")
// get_actor_rotation("ThirdPersonCharacter")
// get_actor_eyes_view_point("FirstPersonCharacter_C") // 获取角色眼睛位置和旋转，返回角色眼睛的 位置 和 旋转，通常这个旋转与摄像机的旋转一致。
// get_GunOffset()
var Actor_list = ["EditorCube8","EditorCube9","EditorCube10","EditorCube11","EditorCube12","EditorCube13","EditorCube14","EditorCube15","EditorCube16","EditorCube17","EditorCube18","EditorCube19","EditorCube20","EditorCube21","TemplateLabel","SkySphereBlueprint","AtmosphericFog","SphereReflectionCapture","Floor","Wall1","Wall2","Wall3","Wall4","BigWall","BigWall2","NetworkPlayerStart","LightSource","PostProcessVolume","SkyLight","DefaultPhysicsVolume","MyProjectGameMode","GameSession","ParticleEventManager","GameNetworkManager","AIController","FirstPersonExampleMap_C","FirstPersonCharacter_C","ThirdPersonCharacter","GameStateBase","PlayerController","PlayerState","PlayerCameraManager","CameraActor","MyProjectHUD",]
for(var i in Actor_list){
get_actor_location(Actor_list[i])
}
}
function hook_and_get_location_addr(){
var so_base = get_so_base()
const offset = 0x0000000092E16F4
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
var x9 = this.context.x9;
var x10 = this.context.x10;
var x8 = this.context.x8;
console.log(x9,x10,x8)
}
});
}
function get_EditorCube8_location_addr(){
try{
hook_and_get_location_addr()
var Actor_name = "EditorCube8"
var so_base = get_so_base()
var Actor = hook_find_actor(Actor_name)
var K2_GetActorLocation_addr = so_base.add(0x92e16b4)
var buf = Memory.alloc(0x100);
var K2_GetActorLocation = new NativeFunction(K2_GetActorLocation_addr, 'void', ['pointer','pointer','pointer']);
K2_GetActorLocation(Actor,ptr(buf),ptr(buf));
var s0 = Memory.readFloat(buf)
var s1 = Memory.readFloat(buf.add(4))
var s2 = Memory.readFloat(buf.add(8))
// console.log(`${Actor_name} Loc: (${s0},${s1},${s2})`)
}catch(e){
console.log("get_actor_location error :", e)
}
}
function hook_fake_location(){
try{
var so_base = get_so_base()
var hook_list = [0x00000000670F4CC]
for(var i in hook_list){
const offset = hook_list[i]
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
if(offset == 0x00000000670F4CC){
var s1 = this.context.s1;
var s4 = this.context.s4;
var s5 = this.context.s5;
console.log(`cube location: (${s1},${s4},${s5})`)
var s0 = this.context.s0;
var s2 = this.context.s2;
var s3 = this.context.s3;
console.log(`my location: (${s0},${s2},${s3})`)
}
}
});
}
}catch(e){
console.log(e)
}
}
function hook_0x670F3DC(){
try{
var so_base = get_so_base()
const offset = 0x00000000670F3D8
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
try{
var sp = this.context.sp.add(0x70);
console.log(sp.readByteArray(0x40))
var s1 = this.context.s1;
var s0 = this.context.s0;
var s2 = this.context.s2;
console.log(`awesome!!!: (${s1},${s0},${s2})`)
}catch(e){
console.log(e)
}
}
});
}catch(e){
console.log(e)
}
}
function two_shooted(){ // 对立方体坐标下内存访问断点。
// hook_fake_location()
var so_base = get_so_base()
const offset = 0x00000000670F3D0
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
try{
// 1、获取准星方向
var rots = get_actor_eyes_view_point("FirstPersonCharacter_C") // success!!!，重点就是要进行朝向坐标(x,y,0)到方向向量的转化！！！
// var rots = get_Crosshair_vec()
// var rots = test_GetControlRotation("FirstPersonCharacter_C")
// var rots = test_K2_GetActorRotation()
// 2、准星转单位向量
var pitch = rots[0]
var yaw = rots[1]
var viewDirection = {
x: Math.cos(yaw * Math.PI / 180) * Math.cos(pitch * Math.PI / 180),
y: Math.sin(yaw * Math.PI / 180) * Math.cos(pitch * Math.PI / 180),
z: Math.sin(pitch * Math.PI / 180)
};
// 3、替换回去
var s1 = this.context.s1;
var s0 = this.context.s0;
var s2 = this.context.s2;
// console.log(`old vec: (${s1},${s0},${s2})`)
this.context.s1 = viewDirection.x
this.context.s0 = viewDirection.y
this.context.s2 = viewDirection.z
// console.log(`new vec: (${viewDirection.x},${viewDirection.y},${viewDirection.z})`)
// get_actor_location("FirstPersonCharacter_C")
}catch(e){
console.log(e)
}
}
});
}
function get_shoot_location_addr(){
try{
var so_base = get_so_base()
var FirstPersonCharacter_C = hook_find_actor("FirstPersonCharacter_C")
var FP_MuzzleLocation = FirstPersonCharacter_C.add(0x4c8).readPointer() // 炮口的定位
var loc1 = FP_MuzzleLocation.add(0x1D0).readFloat()
var loc2 = FP_MuzzleLocation.add(0x1D4).readFloat()
var loc3 = FP_MuzzleLocation.add(0x1D8).readFloat()
console.log(`gunLocation: (${loc1},${loc2},${loc3})`)
return FP_MuzzleLocation.add(0x1D0)
}catch(e){
console.log("check_shoot_location error :", e)
}
}
function modify_fire_point(){
var so_base = get_so_base()
const offset = 0x00000000670FE34
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
this.context.s0 = 0.0;
this.context.s1 = 0.0;
this.context.s2 = 0.0;
// var s10 = this.context.s10;
// var s8 = this.context.s8;
// var s9 = this.context.s9;
// console.log(`s10: ${s10}, s8: ${s8}, s9: ${s9}`)
}
})
}
function get_eyes_point_rot_addr(Actor_name){
try{
// var so_base = get_so_base()
// var Actor = hook_find_actor(Actor_name)
// var no_exec_GetActorEyesViewPoint = Actor.readPointer().add(0x610).readPointer()
// console.log(no_exec_GetActorEyesViewPoint.sub(so_base))
// var get_location_addr = Actor.add(0).readPointer().add(0x708).readPointer()
// var get_rot_Addr = Actor.add(0).readPointer().add(0x700).readPointer()
// console.log(`get_location_addr: ${get_location_addr.sub(so_base)}`)
// console.log(`get_rot_Addr: ${get_rot_Addr.sub(so_base)}`)
var Actor = hook_find_actor(Actor_name)
var Controller = Actor.add(0x258).readPointer()
var s0 = Controller.add(0x288).readFloat()
var s1 = Controller.add(0x28c).readFloat()
var s2 = Controller.add(0x290).readFloat()
console.log(`Controller: (${s0},${s1},${s2})`)
return Controller.add(0x288)
}catch(e){
console.log(e)
}
}
function hook_fuzz(){ // 得到: 0x8f04dc4
var hook_list =[0x000000008F04DA0,0x000000008F04DC4,0x000000008F04EF8,0x000000008F04F14,]
var so_base = get_so_base()
for(var i in hook_list){
const offset = hook_list[i]
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
if(offset == 0x000000008F04DA0){
var x8 = this.context.x8;
console.log(x8.sub(so_base))
}
console.log(`hook_list: ${"0x" + offset.toString(16)}`)
}
});
}
// get_actor_eyes_view_point("FirstPersonCharacter_C")
}
function modify_emmo_direction(){
var so_base = get_so_base()
const offset = 0x00000000670F64C
Interceptor.attach(so_base.add(offset), {
onEnter: function(args) {
var s0 = this.context.s0;
var s1 = this.context.s1;
var s2 = this.context.s2;
// console.log(`old_dir: s0: ${s0}, s1: ${s1}, s2: ${s2}`)
var rots = get_actor_eyes_view_point("FirstPersonCharacter_C")
var pitch = rots[0]
var yaw = rots[1]
this.context.s0 = pitch
this.context.s1 = yaw
this.context.s2 =0.0
}
});
}
function get_first_person_location(){
try{
var Actor = hook_find_actor("FirstPersonCharacter_C")
var SceneComponent = Actor.add(0x130).readPointer()
var loc1 = SceneComponent.add(0x1d0).readFloat()
var loc2 = SceneComponent.add(0x1d4).readFloat()
var loc3 = SceneComponent.add(0x1d8).readFloat()
console.log(`FirstPersonCharacter_C Location: (${loc1},${loc2},${loc3})`)
return SceneComponent.add(0x1d0)
}catch(e){
console.log("get_actor_location error :", e)
}
}
function three_ball(){
var loc1_addr = get_shoot_location_addr() // 对枪的世界坐标下硬件访问断点
// console.log(loc1_addr)
modify_fire_point() // 修复子弹发射位置异常
// 修复完上边那个，现在子弹有了一个固定的发射位置，但是子弹的发射方向还是很乱。像哪的都有
// var rot1_addr = get_eyes_point_rot_addr("FirstPersonCharacter_C")
// console.log(rot1_addr) // 0x7b1e4cf5c8,没啥用
modify_emmo_direction() // 网上一翻就能翻到，修复子弹大方向
}
function check_color(){
try{
var base_addr = get_so_base()
var Actor_addr = hook_find_actor(Actor_Name)
var TextRenderComponent = Actor_addr.add(0x220).readPointer()
// 需要注意的是，如果直接修改颜色字段而不调用相关函数，则需要刷新一下才能实现，刷新方法可以通过下面这种方法实现，我的评价是不如直接调用SetTextRenderColor()函数
// => set_Color()
// => call_SetActorHiddenInGame("TextRenderActor",1,0)
// => Thread.sleep(1); // 暂停 3 秒
// => call_SetActorHiddenInGame("TextRenderActor",0,0)
// var old_color = TextRenderComponent.add(0x474).readU32(color)
// console.log(hex(old_color))
// TextRenderComponent.add(0x474).writeU32(color)
var no_exec_SetTextRenderColor = base_addr.add(0x000000008EAC0F0)
const SetTextRenderColor = new NativeFunction(no_exec_SetTextRenderColor, 'void', ['pointer','uint']);
SetTextRenderColor(TextRenderComponent,color)
}catch(e){
console.log(e)
}
}
function four_renderer(){
check_color()
}
// 这这有问题下一步修复他
function construct_Fname(arg1,arg2){
var buf = Memory.alloc(0x20)
buf.add(0).writeU32(arg1)
buf.add(4).writeU32(arg2)
return buf
}
// Class: Character.Pawn.Actor.Object
// SkeletalMeshComponent* Mesh;//[Offset: 0x280, Size: 0x8]
// Class: SkeletalMeshComponent.SkinnedMeshComponent.MeshComponent.PrimitiveComponent.SceneComponent.ActorComponent.Object
// GetMaterial or MaterialInterface* MaterialInterface;//[Offset: 0x0, Size: 0x8]
// Class: MaterialInstanceDynamic.MaterialInstance.MaterialInterface.Object
// function test_rander_level(){ // 计划暂停，我无法构造Fname的字符串！！
// // try{
// // var so_base = get_so_base()
// // // console.log(so_base)
// // var Actor = hook_find_actor("ThirdPersonCharacter")
// // var SkeletalMeshComponent = Actor.add(0x280).readPointer() // SkeletalMeshComponent.SkinnedMeshComponent.MeshComponent.PrimitiveComponent.SceneComponent.ActorComponent.Object
// // // var real_addr = SkeletalMeshComponent.add(0x0).readPointer().add(0x5A8).readPointer()
// // // console.log(`real_addr: ${real_addr.sub(so_base)}`)
// // var CreateAndSetMaterialInstanceDynamic_addr =so_base.add(0x000000008AB1BA0)
// // var CreateAndSetMaterialInstanceDynamic = new NativeFunction(CreateAndSetMaterialInstanceDynamic_addr, 'pointer', ['pointer','int']);
// // var MaterialInstanceDynamic = CreateAndSetMaterialInstanceDynamic(SkeletalMeshComponent,0)
// // var FName = construct_Fname(41328,20)
// // // 先查询吧
// // var K2_GetScalarParameterValue_addr = so_base.add(0x000000008D9E88C)
// // var K2_GetScalarParameterValue = new NativeFunction(K2_GetScalarParameterValue_addr, 'float', ['pointer','pointer']);
// // var ret = K2_GetScalarParameterValue(MaterialInstanceDynamic,FName)
// // console.log(ret)
// // // var SetScalarParameterValue_addr = so_base.add(0x000000008D9E590)
// // // var SetScalarParameterValue = new NativeFunction(SetScalarParameterValue_addr, 'bool', ['pointer','pointer','float']);
// // // SetScalarParameterValue(MaterialInstanceDynamic,FName,1.0)
// // }catch(e){
// // console.log(e)
// // }
// try{
// var so_base = get_so_base()
// // console.log(so_base)
// var Actor = hook_find_actor("ThirdPersonCharacter")
// var SkeletalMeshComponent = Actor.add(0x280).readPointer() // SkeletalMeshComponent.SkinnedMeshComponent.MeshComponent.PrimitiveComponent.SceneComponent.ActorComponent.Object
// var bRenderCustomDepth = SkeletalMeshComponent.add(0x216).readU8() & 0x40
// console.log(`bRenderCustomDepth: ${bRenderCustomDepth}`)
// var CustomDepthStencilValue = SkeletalMeshComponent.add(0x220).readU32()
// console.log(`CustomDepthStencilValue: ${CustomDepthStencilValue}`)
// // CreateAndSetMaterialInstanceDynamic
// }catch(e){
// console.log(e)
// }
// }
function test_actor_call_rander_level(Actor_Name){
var Actor = hook_find_actor(Actor_Name)
var SceneComponent = Actor.add(0x130).readPointer()
var bRenderCustomDepth = SceneComponent.add(0x216).readU8() & 0x40
console.log(`${Actor_Name} => bRenderCustomDepth: ${bRenderCustomDepth}`)
var CustomDepthStencilValue = SceneComponent.add(0x220).readU32()
console.log(`${Actor_Name} => CustomDepthStencilValue: ${CustomDepthStencilValue}`)
}
function check_bDoCollisionTest(){
try{
var Actor = hook_find_actor("ThirdPersonCharacter")
var SpringArmComponent = Actor.add(0x4b8).readPointer()
var bDoCollisionTest = SpringArmComponent.add(0x215).readU8() & 0x1
console.log(`bDoCollisionTest: ${bDoCollisionTest}`)
var ProbeSize = SpringArmComponent.add(0x210).readFloat()
console.log(`ProbeSize: ${ProbeSize}`)
var bEnableCameraLag = SpringArmComponent.add(0x215).readU8() & 0x20
console.log(`bEnableCameraLag: ${bEnableCameraLag}`)
var CameraLagSpeed = SpringArmComponent.add(0x218).readFloat()
console.log(`CameraLagSpeed: ${CameraLagSpeed}`)
var x1= SpringArmComponent.add(0x215).readU8()
SpringArmComponent.add(0x215).writeU8(x1 | 0x20)
SpringArmComponent.add(0x218).writeFloat(1000.0)
}catch(e){
console.log(e)
}
}
// function get_cube_and_first_perseon_location(){
// var Actor_list = ["EditorCube8","EditorCube9","EditorCube10","EditorCube11","EditorCube12","EditorCube13","EditorCube14","EditorCube15","EditorCube16","EditorCube17","EditorCube18","EditorCube19","EditorCube20","EditorCube21","FirstPersonCharacter_C"]
// for(var i in Actor_list){
// get_actor_location(Actor_list[i])
// }
// }
function get_third_person_location(){
try{
var Actor = hook_find_actor("ThirdPersonCharacter")
var SceneComponent = Actor.add(0x130).readPointer()
var loc1 = SceneComponent.add(0x1d0).readFloat()
var loc2 = SceneComponent.add(0x1d4).readFloat()
var loc3 = SceneComponent.add(0x1d8).readFloat()
console.log(`ThirdPersonCharacter Location: (${loc1},${loc2},${loc3})`)
return SceneComponent.add(0x1d0)
}catch(e){
console.log("get_actor_location error :", e)
}
}
function test_perspective(){
// 1、获取第三人称坐标地址
try{
var third_loc1_addr = get_third_person_location()
console.log(third_loc1_addr)
}catch(e){
console.log("get_actor_location error :", e)
}
}
function four_supermode(){
// 可能的情况
//1、渲染的优先级
//2、透视挂
// test_rander_level()
test_perspective()
// check_bDoCollisionTest()
}
one_move_speed()
two_shooted()
three_ball()
// four_supermode()
// hook_test()
// ./eDBG -p com.ACE2025.Game -l libUE4.so -b 0x00000000670F3D8
// ./stackplz --pid `pidof com.ACE2025.Game` --brk 0x7b1a2aedd0:r --stack
// 射击朝向为 EditorCube8
浙公网安备 33010602011771号