DS.rar_电流 测量

发信格式: a=区域 s=服务器 d=登录方式 u=账户 p=密码 pin=验证码 sp=仓库密码 r=角色名称 l=角色等级 m=角色金钱 华夏大号 九区千岛湖 帐号woaidongke 密码1982117 识别 198211 -h huaxia2comszdomain -h huaxia2comszdomain -q qq 用户名密码断点偏移: WndMgr.dll BaseAddress + 0x0CFD5 识别密码 Controller.dll BaseAddress + 0x0EBE7 仓库密码 TradeClient.dll BaseAddress + 0x02D8F6 角色名称,金钱断点 ThingClient.dll BaseAddress + 0x02AC5 角色等级断点 WndSys.dll BaseAddress + 0x0F909 截取数据: 登录方式:(完成) 区域:(完成) 服务器:(完成) 账户:(完成) 密码:(完成) 识别码:(完成) 仓库密码:(完成) 角色名称:(完成) 角色等级:(完成~有BUG...只能截取默认用户等级) 角色金钱:(完成) 服务器，QQ登录，华夏登录之类的都在Config.ini中 区域,服务器,登录方式从游戏目录中的Config.ini中读取 LOGIN=0 (0=QQ登录方式,1=常规方式) REGION=九区(华东) WORLD=钱塘江 //========================================================================================================== // 登录帐号,登录密码断点 0651CF95 55 push ebp 0651CF96 8BEC mov ebp, esp 0651CF98 51 push ecx 0651CF99 894D FC mov dword ptr [ebp-4], ecx 0651CF9C 8B45 FC mov eax, dword ptr [ebp-4] 0651CF9F 83B8 44010000 0>cmp dword ptr [eax+144], 0 0651CFA6 74 12 je short 0651CFBA 0651CFA8 6A FF push -1 0651CFAA 8B4D FC mov ecx, dword ptr [ebp-4] 0651CFAD 8B91 44010000 mov edx, dword ptr [ecx+144] 0651CFB3 52 push edx 0651CFB4 FF15 3C805906 call dword ptr [<&KERNEL32.WaitForSin>; kernel32.WaitForSingleObject 0651CFBA 8B45 08 mov eax, dword ptr [ebp+8] 0651CFBD 50 push eax 0651CFBE 8B4D FC mov ecx, dword ptr [ebp-4] 0651CFC1 8B89 48010000 mov ecx, dword ptr [ecx+148] 0651CFC7 8B55 FC mov edx, dword ptr [ebp-4] 0651CFCA 8B82 48010000 mov eax, dword ptr [edx+148] 0651CFD0 8B10 mov edx, dword ptr [eax] 0651CFD2 FF52 44 call dword ptr [edx+44] // 此处下断---ESP=密码,EAX=用户名 0651CFD5 50 push eax---------------------------特征码 0651CFD6 6A 00 push 0----------------------------- 0651CFD8 6A 32 push 32---------------------------- 0651CFDA A1 60795B06 mov eax, dword ptr [65B7960] 0651CFDF 8B88 8C020000 mov ecx, dword ptr [eax+28C] 0651CFE5 8B15 60795B06 mov edx, dword ptr [65B7960] ; HX2Game.0043BDC0 0651CFEB 8B82 8C020000 mov eax, dword ptr [edx+28C] 0651CFF1 8B10 mov edx, dword ptr [eax] 0651CFF3 FF52 30 call dword ptr [edx+30] 0651CFF6 8BE5 mov esp, ebp 0651CFF8 5D pop ebp 0651CFF9 C2 0400 retn 4 0651CFD5 50 push eax 0651CFD6 6A 00 push 0 0651CFD8 6A 32 push 32 0651CFDA A1 60795B06 mov eax, dword ptr [65B7960] 0651CFDF 8B88 8C020000 mov ecx, dword ptr [eax+28C] 0651CFE5 8B15 60795B06 mov edx, dword ptr [65B7960] ; HX2Game.0043BDC0 0651CFEB 8B82 8C020000 mov eax, dword ptr [edx+28C] 0651CFF1 8B10 mov edx, dword ptr [eax] 0651CFF3 FF52 30 call dword ptr [edx+30] ; WndMgr.065263E8 //用户名密码 0651CFF6 8BE5 mov esp, ebp 0651CFF8 5D pop ebp 0651CFF9 C2 0400 retn 4 //============================================================================================================= // 识别码断点 05F1EBD0 55 push ebp 05F1EBD1 8BEC mov ebp, esp 05F1EBD3 8B45 0C mov eax, dword ptr [ebp+C] 05F1EBD6 2B45 08 sub eax, dword ptr [ebp+8] 05F1EBD9 50 push eax 05F1EBDA 8B4D 08 mov ecx, dword ptr [ebp+8] 05F1EBDD 51 push ecx 05F1EBDE 8B55 10 mov edx, dword ptr [ebp+10] 05F1EBE1 52 push edx 05F1EBE2 > E8 99A60100 call 05F39280 //esp == 0012eb48 识别码,从17位开始 // 此处下断=判断esp后四位是否等于----0012eb48 后四位eb48---如果是读取...ESP中的字符串...从第17开始为识别码 05F1EBE7 83C4 0C add esp, 0C-----------------------特征码 05F1EBEA 8B45 0C mov eax, dword ptr [ebp+C]-------- 05F1EBED 2B45 08 sub eax, dword ptr [ebp+8]-------- 05F1EBF0 8B4D 10 mov ecx, dword ptr [ebp+10] 05F1EBF3 03C1 add eax, ecx 05F1EBF5 5D pop ebp 05F1EBF6 C3 retn //=============================================================================================================== // 仓库密码 07B5D8DC 83C4 0C add esp, 0C 07B5D8DF 6A 20 push 20 07B5D8E1 8D55 E0 lea edx, dword ptr [ebp-20] 07B5D8E4 52 push edx 07B5D8E5 8B45 DC mov eax, dword ptr [ebp-24] 07B5D8E8 8B88 34010000 mov ecx, dword ptr [eax+134] 07B5D8EE E8 12F0FFFF call 07B5C905 07B5D8F3 8D4D E0 lea ecx, dword ptr [ebp-20] 07B5D8F6 51 push ecx 07B5D8F7 8B55 DC mov edx, dword ptr [ebp-24] 07B5D8FA 8B8A 24010000 mov ecx, dword ptr [edx+124] 07B5D900 8B45 DC mov eax, dword ptr [ebp-24] 07B5D903 8B90 24010000 mov edx, dword ptr [eax+124] 07B5D909 8B02 mov eax, dword ptr [edx] 07B5D90B FF10 call dword ptr [eax] //仓库密码，在堆栈中 07B5D8BA 55 push ebp 07B5D8BB 8BEC mov ebp, esp 07B5D8BD 83EC 24 sub esp, 24 07B5D8C0 894D DC mov dword ptr [ebp-24], ecx 07B5D8C3 8B45 DC mov eax, dword ptr [ebp-24] 07B5D8C6 83B8 24010000 0>cmp dword ptr [eax+124], 0 07B5D8CD 74 3E je short 07B5D90D 07B5D8CF 6A 20 push 20 07B5D8D1 6A 00 push 0 07B5D8D3 8D4D E0 lea ecx, dword ptr [ebp-20] 07B5D8D6 51 push ecx 07B5D8D7 E8 F4D80000 call 07B6B1D0 07B5D8DC 83C4 0C add esp, 0C 07B5D8DF 6A 20 push 20 07B5D8E1 8D55 E0 lea edx, dword ptr [ebp-20] 07B5D8E4 52 push edx 07B5D8E5 8B45 DC mov eax, dword ptr [ebp-24] 07B5D8E8 8B88 34010000 mov ecx, dword ptr [eax+134] 07B5D8EE E8 12F0FFFF call 07B5C905 07B5D8F3 8D4D E0 lea ecx, dword ptr [ebp-20] // 此处下断.ECX=仓库密码 07B5D8F6 51 push ecx------------------------特征码 07B5D8F7 8B55 DC mov edx, dword ptr [ebp-24]---- 07B5D8FA 8B8A 24010000 mov ecx, dword ptr [edx+124]--- 07B5D900 8B45 DC mov eax, dword ptr [ebp-24] 07B5D903 8B90 24010000 mov edx, dword ptr [eax+124] 07B5D909 8B02 mov eax, dword ptr [edx] 07B5D90B FF10 call dword ptr [eax] 07B5D90D 6A 00 push 0 07B5D90F 8B4D DC mov ecx, dword ptr [ebp-24] 07B5D912 8B11 mov edx, dword ptr [ecx] 07B5D914 8B4D DC mov ecx, dword ptr [ebp-24] 07B5D917 FF52 0C call dword ptr [edx+C] 07B5D91A 8BE5 mov esp, ebp 07B5D91C 5D pop ebp 07B5D91D C3 retn //=========================================================================================== 金钱： 027F8F11 人名： 027F8E40 04A22AB0 68 3D010000 push 13D 04A22AB5 8B4D 08 mov ecx, dword ptr [ebp+8] 04A22AB8 51 push ecx 04A22AB9 8B55 FC mov edx, dword ptr [ebp-4] 04A22ABC 83C2 10 add edx, 10 04A22ABF 52 pu