光通传奇3 永恒传奇3（GSR版本） （二） 地面物品
地面物品搜索：
在地面丢1个金币，搜索“金币（1）
得地址 2B67E440，browse this memory region,可以观察到 2B67E440-10 为坐标X ，考虑到坐标地址比较好跟踪，2B67E440-10地址上 find who access this address 得
在第一行上 show assembler,函数比较复杂
Mir3Game.exe+116D0 - 55 - push ebp
Mir3Game.exe+116D1 - 8B EC - mov ebp,esp
Mir3Game.exe+116D3 - 83 E4 F8 - and esp,-08 { 248 }
Mir3Game.exe+116D6 - 81 EC 54010000 - sub esp,00000154 { 340 }
Mir3Game.exe+116DC - 33 C0 - xor eax,eax
Mir3Game.exe+116DE - 53 - push ebx
Mir3Game.exe+116DF - 8B 5D 08 - mov ebx,[ebp+08]
Mir3Game.exe+116E2 - 0FBF 8B 06FF8300 - movsx ecx,word ptr [ebx+Mir3Game.exe+43FF06]
Mir3Game.exe+116E9 - 56 - push esi
Mir3Game.exe+116EA - 8B B3 EC324D00 - mov esi,[ebx+Mir3Game.exe+D32EC]
Mir3Game.exe+116F0 - 89 83 94558400 - mov [ebx+Mir3Game.exe+445594],eax
Mir3Game.exe+116F6 - 89 83 88573600 - mov [ebx+00365788],eax
Mir3Game.exe+116FC - 89 83 84573600 - mov [ebx+00365784],eax
Mir3Game.exe+11702 - 88 44 24 0B - mov [esp+0B],al
Mir3Game.exe+11706 - 8B 83 E8324D00 - mov eax,[ebx+Mir3Game.exe+D32E8]
Mir3Game.exe+1170C - 57 - push edi
Mir3Game.exe+1170D - 0FBF BB 08FF8300 - movsx edi,word ptr [ebx+Mir3Game.exe+43FF08]
Mir3Game.exe+11714 - 8B D0 - mov edx,eax
Mir3Game.exe+11716 - 2B D1 - sub edx,ecx
Mir3Game.exe+11718 - 8B CE - mov ecx,esi
Mir3Game.exe+1171A - 2B CF - sub ecx,edi
Mir3Game.exe+1171C - 80 BB A9460000 00 - cmp byte ptr [ebx+000046A9],00 { 0 }
Mir3Game.exe+11723 - 89 54 24 28 - mov [esp+28],edx
Mir3Game.exe+11727 - 89 4C 24 2C - mov [esp+2C],ecx
Mir3Game.exe+1172B - 74 1E - je Mir3Game.exe+1174B
Mir3Game.exe+1172D - 0FBF 93 A4334D00 - movsx edx,word ptr [ebx+Mir3Game.exe+D33A4]
Mir3Game.exe+11734 - 2B C2 - sub eax,edx
Mir3Game.exe+11736 - 8B D0 - mov edx,eax
Mir3Game.exe+11738 - 0FBF 83 A6334D00 - movsx eax,word ptr [ebx+Mir3Game.exe+D33A6]
Mir3Game.exe+1173F - 2B F0 - sub esi,eax
Mir3Game.exe+11741 - 8B CE - mov ecx,esi
Mir3Game.exe+11743 - 89 54 24 28 - mov [esp+28],edx
Mir3Game.exe+11747 - 89 4C 24 2C - mov [esp+2C],ecx
Mir3Game.exe+1174B - 0FBF B3 E6324D00 - movsx esi,word ptr [ebx+Mir3Game.exe+D32E6]
Mir3Game.exe+11752 - 0FBF 83 E4324D00 - movsx eax,word ptr [ebx+Mir3Game.exe+D32E4]
Mir3Game.exe+11759 - 83 EE 04 - sub esi,04 { 4 }
Mir3Game.exe+1175C - 89 74 24 24 - mov [esp+24],esi ' <------ e24 = [ebx+Mir3Game.exe+D32E6] - 4'
Mir3Game.exe+11760 - 8B 35 C42D5700 - mov esi,[Mir3Game.exe+172DC4] { (800) }
Mir3Game.exe+11766 - 81 C6 90000000 - add esi,00000090 { 144 }
Mir3Game.exe+1176C - 0FB7 FE - movzx edi,si
Mir3Game.exe+1176F - 8B 35 C82D5700 - mov esi,[Mir3Game.exe+172DC8] { (600) }
Mir3Game.exe+11775 - 81 C6 80020000 - add esi,00000280 { 640 }
Mir3Game.exe+1177B - 0FB7 F6 - movzx esi,si
Mir3Game.exe+1177E - 0FBF F6 - movsx esi,si
Mir3Game.exe+11781 - 83 E8 04 - sub eax,04
Mir3Game.exe+11784 - 89 44 24 20 - mov [esp+20],eax ' <------ e20 = [ebx+Mir3Game.exe+D32E4] - 4 ebx = 0x00668330 (物品、怪物共同基址)'
Mir3Game.exe+11788 - 89 54 24 54 - mov [esp+54],edx
Mir3Game.exe+1178C - C6 83 C2324D00 00 - mov byte ptr [ebx+Mir3Game.exe+D32C2],00 { 0 }
Mir3Game.exe+11793 - C7 83 A04A8A00 00000000 - mov [ebx+Mir3Game.exe+4A4AA0],00000000 { 0 }
Mir3Game.exe+1179D - 89 74 24 50 - mov [esp+50],esi
Mir3Game.exe+117A1 - 3B CE - cmp ecx,esi
Mir3Game.exe+117A3 - 0F8D B3090000 - jnl Mir3Game.exe+1215C
Mir3Game.exe+117A9 - 0FBF F7 - movsx esi,di
Mir3Game.exe+117AC - 89 74 24 48 - mov [esp+48],esi
Mir3Game.exe+117B0 - 3B 54 24 48 - cmp edx,[esp+48] ' <-----第1层循环 Mir3Game.exe+12156 跳回此处'
Mir3Game.exe+117B4 - 0F8D 77090000 - jnl Mir3Game.exe+12131
Mir3Game.exe+117BA - EB 08 - jmp Mir3Game.exe+117C4
Mir3Game.exe+117BC - 8D 64 24 00 - lea esp,[esp+00]
Mir3Game.exe+117C0 - 8B 44 24 20 - mov eax,[esp+20] ' <------第2层循环 Mir3Game.exe+1212B 跳回此处'
Mir3Game.exe+117C4 - 83 7C 24 24 00 - cmp dword ptr [esp+24],00 { 0 }
Mir3Game.exe+117C9 - 0F8C 62090000 - jl Mir3Game.exe+12131
Mir3Game.exe+117CF - 8D 51 20 - lea edx,[ecx+20]
Mir3Game.exe+117D2 - 85 D2 - test edx,edx
Mir3Game.exe+117D4 - 0F88 57090000 - js Mir3Game.exe+12131
Mir3Game.exe+117DA - 85 C0 - test eax,eax
Mir3Game.exe+117DC - 0F88 32090000 - js Mir3Game.exe+12114
Mir3Game.exe+117E2 - 8B 44 24 28 - mov eax,[esp+28]
Mir3Game.exe+117E6 - 83 C0 30 - add eax,30 { 48 }
Mir3Game.exe+117E9 - 0F88 25090000 - js Mir3Game.exe+12114
Mir3Game.exe+117EF - 8B 4C 24 28 - mov ecx,[esp+28]
Mir3Game.exe+117F3 - 8B 74 24 20 - mov esi,[esp+20] ' <-- esi = e20'
Mir3Game.exe+117F7 - 3B 0D C42D5700 - cmp ecx,[Mir3Game.exe+172DC4] { (800) }
Mir3Game.exe+117FD - 7D 36 - jnl Mir3Game.exe+11835
Mir3Game.exe+117FF - 0FBF 93 D9324D00 - movsx edx,word ptr [ebx+Mir3Game.exe+D32D9]
Mir3Game.exe+11806 - 3B F2 - cmp esi,edx
Mir3Game.exe+11808 - 7D 2B - jnl Mir3Game.exe+11835
Mir3Game.exe+1180A - 0FBF 8B DB324D00 - movsx ecx,word ptr [ebx+Mir3Game.exe+D32DB]
Mir3Game.exe+11811 - 8B 44 24 24 - mov eax,[esp+24]
Mir3Game.exe+11815 - 3B C1 - cmp eax,ecx
Mir3Game.exe+11817 - 7D 1C - jnl Mir3Game.exe+11835
Mir3Game.exe+11819 - 8D 55 0C - lea edx,[ebp+0C]
Mir3Game.exe+1181C - 52 - push edx
Mir3Game.exe+1181D - 8D 4C 24 30 - lea ecx,[esp+30]
Mir3Game.exe+11821 - 51 - push ecx
Mir3Game.exe+11822 - 8D 54 24 30 - lea edx,[esp+30]
Mir3Game.exe+11826 - 52 - push edx
Mir3Game.exe+11827 - 8D 8B B4324D00 - lea ecx,[ebx+Mir3Game.exe+D32B4]
Mir3Game.exe+1182D - 51 - push ecx
Mir3Game.exe+1182E - 8B D6 - mov edx,esi
Mir3Game.exe+11830 - E8 7BD30800 - call Mir3Game.exe+9EBB0
Mir3Game.exe+11835 - 0FBF 93 E4324D00 - movsx edx,word ptr [ebx+Mir3Game.exe+D32E4] // edx =e0
Mir3Game.exe+1183C - 8B 4C 24 24 - mov ecx,[esp+24] ecx = e24
Mir3Game.exe+11840 - 8B C6 - mov eax,esi
Mir3Game.exe+11842 - 2B C2 - sub eax,edx e20 - e0
Mir3Game.exe+11844 - 0FBF 93 E6324D00 - movsx edx,word ptr [ebx+Mir3Game.exe+D32E6] edx = e2
Mir3Game.exe+1184B - 2B CA - sub ecx,edx e24-e2
Mir3Game.exe+1184D - 83 C0 03 - add eax,03 { 3 } e20 - e0 +3
Mir3Game.exe+11850 - 83 C1 03 - add ecx,03 { 3 } e24-e2 +3
Mir3Game.exe+11853 - 89 44 24 18 - mov [esp+18],eax e18 = e20 - e0 +3
Mir3Game.exe+11857 - 89 4C 24 14 - mov [esp+14],ecx e14 = e24-e2 +3
Mir3Game.exe+1185B - 85 C0 - test eax,eax
Mir3Game.exe+1185D - 0F88 B1080000 - js Mir3Game.exe+12114
Mir3Game.exe+11863 - 85 C9 - test ecx,ecx
Mir3Game.exe+11865 - 0F8C A9080000 - jl Mir3Game.exe+12114
Mir3Game.exe+1186B - 83 F8 5A - cmp eax,5A { 90 }
Mir3Game.exe+1186E - 0F8D A0080000 - jnl Mir3Game.exe+12114
Mir3Game.exe+11874 - 83 F9 50 - cmp ecx,50 { 80 }
Mir3Game.exe+11877 - 0F8D 97080000 - jnl Mir3Game.exe+12114
Mir3Game.exe+1187D - 33 F6 - xor esi,esi
Mir3Game.exe+1187F - 89 74 24 1C - mov [esp+1C],esi
Mir3Game.exe+11883 - 89 74 24 10 - mov [esp+10],esi
Mir3Game.exe+11887 - EB 0B - jmp Mir3Game.exe+11894
Mir3Game.exe+11889 - 8D A4 24 00000000 - lea esp,[esp+00000000]
Mir3Game.exe+11890 - 8B 74 24 10 - mov esi,[esp+10]
Mir3Game.exe+11894 - 8B 93 8C558400 - mov edx,[ebx+Mir3Game.exe+44558C] '<----地面物品标志'
Mir3Game.exe+1189A - 85 D2 - test edx,edx
Mir3Game.exe+1189C - 0F84 72030000 - je Mir3Game.exe+11C14
Mir3Game.exe+118A2 - 8B 44 24 14 - mov eax,[esp+14] -- '<------ e14 (一层循环变量）'
Mir3Game.exe+118A6 - 8B 4C 24 18 - mov ecx,[esp+18] '<------ e18 (二层循环变量) '
Mir3Game.exe+118AA - 6B C0 5A - imul eax,eax,5A
Mir3Game.exe+118AD - 03 C8 - add ecx,eax
Mir3Game.exe+118AF - 8B C1 - mov eax,ecx
Mir3Game.exe+118B1 - C1 E0 04 - shl eax,04 { 4 }
Mir3Game.exe+118B4 - 2B C1 - sub eax,ecx
Mir3Game.exe+118B6 - 03 C0 - add eax,eax
Mir3Game.exe+118B8 - 03 C0 - add eax,eax
Mir3Game.exe+118BA - 03 C0 - add eax,eax ' <-------- eax = ( e14*0x5a+e18)*0xf*8'
Mir3Game.exe+118BC - 89 4C 24 34 - mov [esp+34],ecx
Mir3Game.exe+118C0 - 8D 0C 30 - lea ecx,[eax+esi]
Mir3Game.exe+118C3 - 39 94 8B 944B0000 - cmp [ebx+ecx*4+00004B94],edx ' <---与地面物品标志一样，则为物品不跳转'
Mir3Game.exe+118CA - 0F85 44030000 - jne Mir3Game.exe+11C14
Mir3Game.exe+118D0 - 03 C6 - add eax,esi
Mir3Game.exe+118D2 - 8B BC 83 CC4A0000 - mov edi,[ebx+eax*4+00004ACC] ' <---------- 物品基址 = [ebx+eax*4+00004ACC] '
Mir3Game.exe+118D9 - 85 FF - test edi,edi
Mir3Game.exe+118DB - 0F84 21030000 - je Mir3Game.exe+11C02
Mir3Game.exe+118E1 - 0FBF 47 18 - movsx eax,word ptr [edi+18] ' <---------- 断在这儿，edi = 地面物品的地址'
Mir3Game.exe+118E5 - 0FBF 93 E4324D00 - movsx edx,word ptr [ebx+Mir3Game.exe+D32E4]
...（循环距离比较远，省略部分代码...）
Mir3Game.exe+120F3 - 8B 57 0C - mov edx,[edi+0C]
Mir3Game.exe+120F6 - 89 72 04 - mov [edx+04],esi
Mir3Game.exe+120F9 - 89 77 0C - mov [edi+0C],esi
Mir3Game.exe+120FC - 89 7E 08 - mov [esi+08],edi
Mir3Game.exe+120FF - FF 47 18 - inc [edi+18]
Mir3Game.exe+12102 - 8B 44 24 10 - mov eax,[esp+10]
Mir3Game.exe+12106 - 40 - inc eax
Mir3Game.exe+12107 - 89 44 24 10 - mov [esp+10],eax
Mir3Game.exe+1210B - 83 F8 0A - cmp eax,0A { 10 }
Mir3Game.exe+1210E - 0F8C 3CFEFFFF - jl Mir3Game.exe+11F50
Mir3Game.exe+12114 - 8B 44 24 28 - mov eax,[esp+28]
Mir3Game.exe+12118 - FF 44 24 20 - inc [esp+20] ' e20++'
Mir3Game.exe+1211C - 8B 4C 24 2C - mov ecx,[esp+2C]
Mir3Game.exe+12120 - 83 C0 30 - add eax,30 { 48 }
Mir3Game.exe+12123 - 89 44 24 28 - mov [esp+28],eax
Mir3Game.exe+12127 - 3B 44 24 48 - cmp eax,[esp+48]
Mir3Game.exe+1212B - 0F8C 8FF6FFFF - jl Mir3Game.exe+117C0 ' <----------跳回第二层循环'
Mir3Game.exe+12131 - 0FBF 83 E4324D00 - movsx eax,word ptr [ebx+Mir3Game.exe+D32E4] ' e0'
Mir3Game.exe+12138 - FF 44 24 24 - inc [esp+24] ' e24++'
Mir3Game.exe+1213C - 8B 54 24 54 - mov edx,[esp+54]
Mir3Game.exe+12140 - 83 C1 20 - add ecx,20 { 32 }
Mir3Game.exe+12143 - 83 E8 04 - sub eax,04 { 4 }
Mir3Game.exe+12146 - 89 4C 24 2C - mov [esp+2C],ecx
Mir3Game.exe+1214A - 89 54 24 28 - mov [esp+28],edx
Mir3Game.exe+1214E - 89 44 24 20 - mov [esp+20],eax '初始化 e20 = e0'
Mir3Game.exe+12152 - 3B 4C 24 50 - cmp ecx,[esp+50]
Mir3Game.exe+12156 - 0F8C 54F6FFFF - jl Mir3Game.exe+117B0 ' <--------跳回第一层循环'
Mir3Game.exe+1215C - 8B 83 CC460000 - mov eax,[ebx+000046CC]
Mir3Game.exe+12162 - 85 C0 - test eax,eax
周边地面物品的函数有点复杂，整理如下：
=====CE lua script 函数 ===========================================
function findGoods()
local gds={}
local goodsBase = addrGoodsMonsBase--0x00668330 此基址与周围边人物、NPC的基址一样
e2 =readSmallInteger(goodsBase+0x004D32E4) - 4
e24=e2
e0 = readSmallInteger (goodsBase+0x004D32E6) -4
e20=e0
goodsF =readInteger(goodsBase+0x0084558c)
for i=0,0x11 do
for j=0 ,0x16 do
e18 = e20- e0 +3
e14 =e24-e2+3
tmp2 = ( e14*0x5a+e18)*0xf*8
goodsHave =readInteger(goodsBase+tmp2*4+0x004b90)
if (goodsHave == goodsF) then
local base1 =readInteger(goodsBase+tmp2*4+0x004AC8)
if base1==0 then
return gds
end
goodbytes = readBytes(base1,0x78,true) --获取物品数据0x78个字节，用于分析物品属性
s= "tmp2:"..tmp2.." bytes:"
for i, v in ipairs(goodbytes) do
s=s..string.format("%02x",v).." "
end
--log(s)
local addr1 = readString(base1+0x25)
local x =readSmallInteger(base1+0x15)
local y =readSmallInteger(base1+0x17)
local id = readSmallInteger(base1+0x11)
local addr2 = ansiToUtf8(addr1)
local good={}
good["x"] =x
good["y"]=y
good["name"]=addr2
good["id"] = id
table.insert(gds,good)
s = string.format("%s[id:%d][%d,%d] - ",addr2,id,x,y)..s
logF(s)
end
e20 = e20+1
end
e20=e0
e24 = e24+1
end
return gds
end
浙公网安备 33010602011771号