1、043-用xdbg和CE分析寻路功能的ECX参数与角色对象2021在线班郁金香灬老师 QQ 150330575交流群:158280115学习目标: 分析寻路CALL的ECX参数来源参考 029-分析角色对象的属性参考 039-用CE和x32dbg分析寻路CALL,认识float类型参考 029-分析角色对象的属性00610EF3 | 6A 01 | push 1 |00610EF5 | 57 | push edi | 00610EF6 | E8 E5D12300 | call wow.84E0E0 | call 60C1F0+0D0+17400610EFB | 50 | push eax |
2、const char *eax=player00610EFC | E8 EFB2FFFF | call wow.60C1F0 | eax= call 60C1F000610F01 | 8BF0 | mov esi,eax | eax+0D0+17400610F03 | 83C4 10 | add esp,10 |参考 039-用CE和x32dbg分析寻路CALL,认识float类型0072B702 | 3950 30 | cmp dword ptr ds:eax+30,edx | 鼠标移动开关标志0072B705 | 74 1B | je wow.72B722 |0072B707 | D9EE
3、 | fldz | 寻路功能的开始0072B709 | 51 | push ecx | arg4=00072B70A | D91C24 | fstp dword ptr ss:esp,st(0) | arg40072B70D | 8955 F8 | mov dword ptr ss:ebp-8,edx |0072B710 | 8955 FC | mov dword ptr ss:ebp-4,edx | C4789E0B,C1F60AD7,41B3EF2C0072B713 | 8B55 08 | mov edx,dword ptr ss:ebp+8 | float arg36=0072B716
4、| 52 | push edx |0072B717 | 8D45 F8 | lea eax,dword ptr ss:ebp-8 | eax=ebp-80072B71A | 50 | push eax | int arg22=0072B71B | 6A 04 | push 4 | arg1=40072B71D | E8 DEBCFFFF | call wow.727400 | 移动CALL/mouse0072B722 | 8BE5 | mov esp,ebp | 跳过了寻路功能00527428 | A1 3C12CA00 | mov eax,dword ptr ds:CA123C id2005
5、2742D | 8B0D 3812CA00 | mov ecx,dword ptr ds:CA1238 id100527433 | 53 | push ebx |00527434 | 68 A32A0000 | push 2AA3 |00527439 | 68 9CF09F00 | push wow.9FF09C | 9FF09C:.GameUI.cpp0052743E | 6A 08 | push 8 |00527440 | 50 | push eax | 00527441 | 51 | push ecx | 00527442 | E8 69D9FAFF | call |00527447 |
6、 8BD8 | mov ebx,eax |00527449 | 83C4 14 | add esp,14 | 00527428 | A1 3C12CA00 | mov eax,dword ptr ds:CA123C |0052742D | 8B0D 3812CA00 | mov ecx,dword ptr ds:CA1238 |00527433 | 53 | push ebx | 这个不是参数00527434 | 68 A32A0000 | push 2AA3 |00527439 | 68 9CF09F00 | push wow.9FF09C | 9FF09C:.GameUI.cpp00527
7、43E | 6A 08 | push 8 |00527440 | 50 | push eax | id200527441 | 51 | push ecx | id100527442 | E8 69D9FAFF | call |00527447 | 8BD8 | mov ebx,eax | ebx=eax 可能是角色对象00527449 | 83C4 14 | add esp,14 | eax+D0+174 /护甲0x14=20 20/4=5个参数 00527360 | 55 | push ebp | 400527361 | 8BEC | mov ebp,esp |00527363 | 83EC
8、 58 | sub esp,58 |00527366 | 56 | push esi | 300527367 | 57 | push edi | 200527433 | 53 | push ebx | 1 005274DB | 5B | pop ebx |1 恢复ebx005274DC | 5F | pop edi |2005274DD | B8 01000000 | mov eax,1 |005274E2 | 5E | pop esi |3005274E3 | 8BE5 | mov esp,ebp |005274E5 | 5D | pop ebp |4005274E6 | C3 | ret |UINT_PTR 寻路的ECX参数()UINT_PTR 取ECX参数CALL=0x04D4DB0;_asmmov eax,dword ptr ds:0xCA123C mov ecx,dword ptr ds:0xCA1238 /push ebx 这个是多余的 push 0x2AA3 push 0x9FF09C push 8 push eax push ecx call 取ECX参数CALL mov 返回值,eax add esp,0x14 return 返回值 ;
