光通传奇3 永恒传奇3（GSR版本） （三） 背包物品

查找背包第1个物品名称（火把），出现几个地址，find who access this address

Mir3Game.exe+8A780 - 55                    - push ebp
Mir3Game.exe+8A781 - 8B EC                 - mov ebp,esp
Mir3Game.exe+8A783 - 53                    - push ebx
Mir3Game.exe+8A784 - 8B 5D 08              - mov ebx,[ebp+08]
Mir3Game.exe+8A787 - 0FB7 43 05            - movzx eax,word ptr [ebx+05]  '<----- eax = [[ebp+08]+05] ,[ebp+08]为上一层函数第1个参数 = 物品地址， [+5] ==ID末2位（ptr word) }'
Mir3Game.exe+8A78B - 56                    - push esi
Mir3Game.exe+8A78C - 57                    - push edi
Mir3Game.exe+8A78D - 66 85 C0              - test ax,ax
Mir3Game.exe+8A790 - 0F84 A6000000         - je Mir3Game.exe+8A83C
Mir3Game.exe+8A796 - 8D 04 85 70D3EB00     - lea eax,[eax*4+Mir3Game.exe+ABD370] ' <------eax =   0x00EBD370+4*ID    背包物品名称地址'  
Mir3Game.exe+8A79D - 8B 00                 - mov eax,[eax]                        'eax = [eax]'
Mir3Game.exe+8A79F - 85 C0                 - test eax,eax
Mir3Game.exe+8A7A1 - 0F84 95000000         - je Mir3Game.exe+8A83C
Mir3Game.exe+8A7A7 - 0FB7 78 2F            - movzx edi,word ptr [eax+2F]
Mir3Game.exe+8A7AB - B9 10270000           - mov ecx,00002710 { 10000 }
Mir3Game.exe+8A7B0 - BE 18DF5C00           - mov esi,Mir3Game.exe+1CDF18 { (0) }
Mir3Game.exe+8A7B5 - 66 3B F9              - cmp di,cx
Mir3Game.exe+8A7B8 - 73 05                 - jae Mir3Game.exe+8A7BF
Mir3Game.exe+8A7BA - BE 24B35C00           - mov esi,Mir3Game.exe+1CB324 { (310C1F60) }
Mir3Game.exe+8A7BF - B9 20295600           - mov ecx,Mir3Game.exe+162920 { ("GOLD") }
Mir3Game.exe+8A7C4 - 83 C0 04              - add eax,04 { 4 }
Mir3Game.exe+8A7C7 - 8A 10                 - mov dl,[eax]           ' <-----断在这儿'
Mir3Game.exe+8A7C9 - 3A 11                 - cmp dl,[ecx]

---

返回上一层：

Mir3Game.exe+8A850 - 55                    - push ebp
Mir3Game.exe+8A851 - 8B EC                 - mov ebp,esp
Mir3Game.exe+8A853 - 8B 55 08              - mov edx,[ebp+08]          '  <----- edx=上一层的第1个参数'
Mir3Game.exe+8A856 - 0FB7 4A 2B            - movzx ecx,word ptr [edx+2B]
Mir3Game.exe+8A85A - 83 EC 2C              - sub esp,2C { 44 }
Mir3Game.exe+8A85D - 53                    - push ebx
Mir3Game.exe+8A85E - 56                    - push esi
Mir3Game.exe+8A85F - 57                    - push edi
...(略)
Mir3Game.exe+8A8E5 - 69 F6 84010000        - imul esi,esi,00000184 { 388 }
Mir3Game.exe+8A8EB - 89 45 E8              - mov [ebp-18],eax
Mir3Game.exe+8A8EE - 8A 45 10              - mov al,[ebp+10]
Mir3Game.exe+8A8F1 - 81 C6 58355C00        - add esi,Mir3Game.exe+1C3558 { ("`4j0") }
Mir3Game.exe+8A8F7 - 3C 03                 - cmp al,03 { 3 }
Mir3Game.exe+8A8F9 - 74 04                 - je Mir3Game.exe+8A8FF
Mir3Game.exe+8A8FB - 84 C0                 - test al,al
Mir3Game.exe+8A8FD - 75 06                 - jne Mir3Game.exe+8A905
Mir3Game.exe+8A8FF - 52                    - push edx                  '<---传入的第1个参数'
Mir3Game.exe+8A900 - E8 7BFEFFFF           - call Mir3Game.exe+8A780
Mir3Game.exe+8A905 - 8B 4D 14              - mov ecx,[ebp+14]          ' <----返回这儿
'

---

返回上一层：

Mir3Game.exe+84A65 - 84 C9                 - test cl,cl
Mir3Game.exe+84A67 - 74 08                 - je Mir3Game.exe+84A71
Mir3Game.exe+84A69 - 8B 83 58410000        - mov eax,[ebx+00004158]
Mir3Game.exe+84A6F - EB 02                 - jmp Mir3Game.exe+84A73
Mir3Game.exe+84A71 - 33 C0                 - xor eax,eax
Mir3Game.exe+84A73 - 0FB6 F1               - movzx esi,cl
Mir3Game.exe+84A76 - F7 DE                 - neg esi
Mir3Game.exe+84A78 - 1B F6                 - sbb esi,esi
Mir3Game.exe+84A7A - 81 E6 B8030000        - and esi,000003B8 { 952 }
Mir3Game.exe+84A80 - 83 C6 30              - add esi,30              ' esi = 3e8  (背包格子大小）'
Mir3Game.exe+84A83 - 89 83 C0410000        - mov [ebx+000041C0],eax
Mir3Game.exe+84A89 - 89 7C 24 14           - mov [esp+14],edi
Mir3Game.exe+84A8D - 3B F7                 - cmp esi,edi
Mir3Game.exe+84A8F - 0F8E 89000000         - jng Mir3Game.exe+84B1E
Mir3Game.exe+84A95 - 8B 4C 24 14           - mov ecx,[esp+14]         'e14 = 循环变量i'
Mir3Game.exe+84A99 - 8D 53 78              - lea edx,[ebx+78]
Mir3Game.exe+84A9C - 89 54 24 18           - mov [esp+18],edx
Mir3Game.exe+84AA0 - 8D BB 85490000        - lea edi,[ebx+00004985]   'edi = 背包物品首地址，ebx = 0x00b3c5c4 （背包基址） '
Mir3Game.exe+84AA6 - 0FB7 17               - movzx edx,word ptr [edi]    '<-----循环开始，到Mir3Game.exe+84B1C 跳回'
Mir3Game.exe+84AA9 - 66 85 D2              - test dx,dx
Mir3Game.exe+84AAC - 74 5C                 - je Mir3Game.exe+84B0A
Mir3Game.exe+84AAE - 0FB7 87 17010000      - movzx eax,word ptr [edi+00000117]   '物品在背包格子序号，第几个物品'
Mir3Game.exe+84AB5 - 3B C1                 - cmp eax,ecx
Mir3Game.exe+84AB7 - 74 1F                 - je Mir3Game.exe+84AD8
Mir3Game.exe+84AB9 - 69 C0 24010000        - imul eax,eax,00000124       ' 序号*124，每个物品数组结构大小为0x124 '
Mir3Game.exe+84ABF - 0FB7 84 18 85490000   - movzx eax,word ptr [eax+ebx+00004985]    '背包数组 '
Mir3Game.exe+84AC7 - 66 85 C0              - test ax,ax
Mir3Game.exe+84ACA - 74 05                 - je Mir3Game.exe+84AD1
Mir3Game.exe+84ACC - 66 3B C2              - cmp ax,dx
Mir3Game.exe+84ACF - 74 39                 - je Mir3Game.exe+84B0A
Mir3Game.exe+84AD1 - 33 C0                 - xor eax,eax
Mir3Game.exe+84AD3 - 66 89 07              - mov [edi],ax
Mir3Game.exe+84AD6 - EB 32                 - jmp Mir3Game.exe+84B0A
Mir3Game.exe+84AD8 - 80 BB 8C410000 00     - cmp byte ptr [ebx+0000418C],00 { 0 }
Mir3Game.exe+84ADF - 6A 00                 - push 00 { 0 }
Mir3Game.exe+84AE1 - 0F95 C1               - setne cl
Mir3Game.exe+84AE4 - FE C9                 - dec cl
Mir3Game.exe+84AE6 - 80 E1 02              - and cl,02 { 2 }
Mir3Game.exe+84AE9 - 0FB6 D1               - movzx edx,cl
Mir3Game.exe+84AEC - 8B 4C 24 1C           - mov ecx,[esp+1C]
Mir3Game.exe+84AF0 - 8B 41 04              - mov eax,[ecx+04]
Mir3Game.exe+84AF3 - 8B 09                 - mov ecx,[ecx]
Mir3Game.exe+84AF5 - 03 4B 10              - add ecx,[ebx+10]
Mir3Game.exe+84AF8 - 03 43 14              - add eax,[ebx+14]
Mir3Game.exe+84AFB - 52                    - push edx
Mir3Game.exe+84AFC - 51                    - push ecx
Mir3Game.exe+84AFD - 8D 57 FB              - lea edx,[edi-05]     'edx = [edi-05]'
Mir3Game.exe+84B00 - 52                    - push edx        ' <--------传入的第1个参数'
Mir3Game.exe+84B01 - E8 4A5D0000           - call Mir3Game.exe+8A850
Mir3Game.exe+84B06 - 8B 4C 24 14           - mov ecx,[esp+14]          ' <-------- 返回这儿    e14为循环变量'
Mir3Game.exe+84B0A - 83 44 24 18 10        - add dword ptr [esp+18],10 { 16 }
Mir3Game.exe+84B0F - 41                    - inc ecx                ' ecx++'
Mir3Game.exe+84B10 - 81 C7 24010000        - add edi,00000124      'edi为物品地址，每个物品数据大小为0x124'
Mir3Game.exe+84B16 - 89 4C 24 14           - mov [esp+14],ecx       ' e14++'
Mir3Game.exe+84B1A - 3B CE                 - cmp ecx,esi
Mir3Game.exe+84B1C - 7C 88                 - jl Mir3Game.exe+84AA6
Mir3Game.exe+84B1E - 80 3D E81ABA00 00     - cmp byte ptr [Mir3Game.exe+7A1AE8],00 { (01000100),0 }

---

得出：背包物品结构

addrBag：b3c5c4 + 4985 = B40F49
Id:  [addrBag+i*0x124]
Num: [addrBag+i*0x124 -05 +2d]
Name:  [[addrBag+i*0x124+5] &0000ffff)*4 + 0x00EBD370]+4] 

---

==========lua script function==================
function  getBag
  local addrNameBase = 0x00EBD370
  for i=0,0x3e8 do
    local bagId =readInteger(addrBag+i*0x124)
    local bagNum = readInteger(addrBag+i*0x124 + 0x28)
    if (bagId & 0x0000ffff) > 0 then
       local nameOff  = (bagId & 0x0000ffff) *4 +addrNameBase
       local namebase =readInteger(nameOff)
       log(string.format("%0x,%0x",nameOff,namebase))
       local name = readString(namebase+04)
       name = ansiToUTF8(name)
       log(string.format("No:%d, Id:%08x ,%s , Num:%d",i,bagId,name,bagNum))
       baggoodbytes = readBytes(addrBag+i*0x124,0x124,true)
       s= string.format("%s:",name)
       for i, v in ipairs(baggoodbytes) do
         s=s..string.format("%02x",v).." "
       end
      logF(s)
    end
  end
end