游戏狂人
 
- 贡献度
- 172
- 金元
- 11373
- 积分
- 1825
- 精华
- 0
- 注册时间
- 2020-3-14

|
我看别人发的ct表里面跳跃是这个
[ENABLE]
aobscanmodule(jumpvelo,b1-Win64-Shipping.exe,F3 0F 10 83 80 01 00 00 45) // should be unique
alloc(newmem,$1000,jumpvelo)
label(code jumpv)
label(return)
newmem:
code:
movss xmm0,[rbx+00000180]
push r13
mov r13,[rbx+00000020]
cmp byte ptr [r13+6c0],1
pop r13
je @f
mulss xmm0,[jumpv]
jmp return
jumpv:
dd (float)1
jumpvelo:
jmp newmem
nop 3
return:
registersymbol(jumpvelo jumpv)
[DISABLE]
jumpvelo:
db F3 0F 10 83 80 01 00 00
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: b1-Win64-Shipping.exe+E591FF0
b1-Win64-Shipping.exe+E591FC3: 74 61 - je b1-Win64-Shipping.exe+E592026
b1-Win64-Shipping.exe+E591FC5: E8 A6 17 FB FF - call b1-Win64-Shipping.exe+E543770
b1-Win64-Shipping.exe+E591FCA: 84 C0 - test al,al
b1-Win64-Shipping.exe+E591FCC: 74 58 - je b1-Win64-Shipping.exe+E592026
b1-Win64-Shipping.exe+E591FCE: F6 83 10 01 00 00 10 - test byte ptr [rbx+00000110],10
b1-Win64-Shipping.exe+E591FD5: 74 19 - je b1-Win64-Shipping.exe+E591FF0
b1-Win64-Shipping.exe+E591FD7: F2 0F 10 83 F0 00 00 00 - movsd xmm0,[rbx+000000F0]
b1-Win64-Shipping.exe+E591FDF: 0F 54 05 2A E5 3F 02 - andps xmm0,[b1-Win64-Shipping.exe+10990510]
b1-Win64-Shipping.exe+E591FE6: 66 0F 2E 05 BA E4 3F 02 - ucomisd xmm0,[b1-Win64-Shipping.exe+109904A8]
b1-Win64-Shipping.exe+E591FEE: 74 36 - je b1-Win64-Shipping.exe+E592026
// ---------- INJECTING HERE ----------
b1-Win64-Shipping.exe+E591FF0: F3 0F 10 83 80 01 00 00 - movss xmm0,[rbx+00000180]
// ---------- DONE INJECTING ----------
b1-Win64-Shipping.exe+E591FF8: 45 33 C0 - xor r8d,r8d
b1-Win64-Shipping.exe+E591FFB: 48 8B 03 - mov rax,[rbx]
b1-Win64-Shipping.exe+E591FFE: 48 8B CB - mov rcx,rbx
b1-Win64-Shipping.exe+E592001: 0F 5A C0 - cvtps2pd xmm0,xmm0
b1-Win64-Shipping.exe+E592004: 41 8D 50 03 - lea edx,[r8+03]
b1-Win64-Shipping.exe+E592008: F2 0F 5F 83 D8 00 00 00 - maxsd xmm0,[rbx+000000D8]
b1-Win64-Shipping.exe+E592010: F2 0F 11 83 D8 00 00 00 - movsd [rbx+000000D8],xmm0
b1-Win64-Shipping.exe+E592018: FF 90 F0 05 00 00 - call qword ptr [rax+000005F0]
b1-Win64-Shipping.exe+E59201E: B0 01 - mov al,01
b1-Win64-Shipping.exe+E592020: 48 83 C4 20 - add rsp,20
}
然后速度是这个
[ENABLE]
aobscanmodule(walkspeed,b1-Win64-Shipping.exe,F3 0F 10 83 F8 01 00 00 48 83) // should be unique
alloc(newmem,$1000,walkspeed)
label(code wspd)
label(return)
newmem:
movss xmm0,[rbx+000001F8]
push r9
mov r9,[rbx+00000020]
cmp byte ptr [r9+6c0],1
pop r9
je @f
mulss xmm0,[wspd]
code:
jmp return
wspd:
dd (float)1
walkspeed:
jmp newmem
nop 3
return:
registersymbol(walkspeed wspd)
[DISABLE]
walkspeed:
db F3 0F 10 83 F8 01 00 00
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: b1-Win64-Shipping.exe+E597A36
b1-Win64-Shipping.exe+E597A16: FF E2 - jmp rdx
b1-Win64-Shipping.exe+E597A18: 48 8B 03 - mov rax,[rbx]
b1-Win64-Shipping.exe+E597A1B: 48 8B CB - mov rcx,rbx
b1-Win64-Shipping.exe+E597A1E: FF 90 98 05 00 00 - call qword ptr [rax+00000598]
b1-Win64-Shipping.exe+E597A24: 84 C0 - test al,al
b1-Win64-Shipping.exe+E597A26: 74 0E - je b1-Win64-Shipping.exe+E597A36
b1-Win64-Shipping.exe+E597A28: F3 0F 10 83 FC 01 00 00 - movss xmm0,[rbx+000001FC]
b1-Win64-Shipping.exe+E597A30: 48 83 C4 20 - add rsp,20
b1-Win64-Shipping.exe+E597A34: 5B - pop rbx
b1-Win64-Shipping.exe+E597A35: C3 - ret
// ---------- INJECTING HERE ----------
b1-Win64-Shipping.exe+E597A36: F3 0F 10 83 F8 01 00 00 - movss xmm0,[rbx+000001F8]
// ---------- DONE INJECTING ----------
b1-Win64-Shipping.exe+E597A3E: 48 83 C4 20 - add rsp,20
b1-Win64-Shipping.exe+E597A42: 5B - pop rbx
b1-Win64-Shipping.exe+E597A43: C3 - ret
b1-Win64-Shipping.exe+E597A44: F3 0F 10 83 00 02 00 00 - movss xmm0,[rbx+00000200]
b1-Win64-Shipping.exe+E597A4C: 48 83 C4 20 - add rsp,20
b1-Win64-Shipping.exe+E597A50: 5B - pop rbx
b1-Win64-Shipping.exe+E597A51: C3 - ret
b1-Win64-Shipping.exe+E597A52: F3 0F 10 83 04 02 00 00 - movss xmm0,[rbx+00000204]
b1-Win64-Shipping.exe+E597A5A: 48 83 C4 20 - add rsp,20
b1-Win64-Shipping.exe+E597A5E: 5B - pop rbx
}
但我看不懂,不知道那个才是
|
|