刺激战场
  • 1627阅读
  • 0回复

逆袭!回合制网游下send封包断点无法断下解决方案。 [复制链接]

上一主题 下一主题
离线啊冲
 

只看楼主 倒序阅读 使用道具 楼主  发表于: 2016-08-28
----------------
魔鬼作坊
游戏“禁技巧”分析技术揭秘中……
http://www.moguizuofang.com/bbs/
----------------
屏幕 1024*768  系统:XP3
逆袭!回合制网游下send封包断点无法断下解决方案。
魔恩QQ:8643245
各位亲爱的朋友:
我们又在VIP课程相会了,那么,这节课,我将与你分享回合制网游下send封包断点无法断下解决方案。

本课思路:这游戏下send就能获取到大部分的CALL,导致游戏公司HOOK了send函数过滤了send,让游戏封包数据走他的程序里发送数据,所以下了断点断不下来。解决很简单请看教程。

具体操作技巧:

问道 这游戏 与第一款课程的游戏:武林外传一样下send断点能找到大部分的CALL。



0caf3c27


游戏的自己构建send函数


0CAF3C27    8BFF            MOV EDI,EDI
0CAF3C29    55              PUSH EBP
0CAF3C2A    8BEC            MOV EBP,ESP
0CAF3C2C    83EC 10         SUB ESP,10
0CAF3C2F    56              PUSH ESI
0CAF3C30    57              PUSH EDI
0CAF3C31    33FF            XOR EDI,EDI
0CAF3C33    813D 5040A371 2>CMP DWORD PTR DS:[71A34050],71A22C29
0CAF3C3D    0F84 256A0000   JE 0CAFA668
0CAF3C43    8D45 F8         LEA EAX,DWORD PTR SS:[EBP-8]
0CAF3C46    50              PUSH EAX
0CAF3C47    E8 67F0FFFF     CALL 0CAF2CB3
0CAF3C4C    3BC7            CMP EAX,EDI
0CAF3C4E    8945 FC         MOV DWORD PTR SS:[EBP-4],EAX
0CAF3C51    0F85 516A0000   JNZ 0CAFA6A8
0CAF3C57    FF75 08         PUSH DWORD PTR SS:[EBP+8]
0CAF3C5A    E8 CFE1FFFF     CALL 0CAF1E2E
0CAF3C5F    8BF0            MOV ESI,EAX
0CAF3C61    3BF7            CMP ESI,EDI
0CAF3C63    0F84 386A0000   JE 0CAFA6A1
0CAF3C69    8B45 10         MOV EAX,DWORD PTR SS:[EBP+10]
0CAF3C6C    53              PUSH EBX
0CAF3C6D    8D4D FC         LEA ECX,DWORD PTR SS:[EBP-4]
0CAF3C70    51              PUSH ECX
0CAF3C71    FF75 F8         PUSH DWORD PTR SS:[EBP-8]
0CAF3C74    8D4D 08         LEA ECX,DWORD PTR SS:[EBP+8]
0CAF3C77    57              PUSH EDI
0CAF3C78    57              PUSH EDI
0CAF3C79    FF75 14         PUSH DWORD PTR SS:[EBP+14]
0CAF3C7C    8945 F0         MOV DWORD PTR SS:[EBP-10],EAX
0CAF3C7F    8B45 0C         MOV EAX,DWORD PTR SS:[EBP+C]
0CAF3C82    51              PUSH ECX
0CAF3C83    6A 01           PUSH 1
0CAF3C85    8D4D F0         LEA ECX,DWORD PTR SS:[EBP-10]
0CAF3C88    51              PUSH ECX
0CAF3C89    FF75 08         PUSH DWORD PTR SS:[EBP+8]
0CAF3C8C    8945 F4         MOV DWORD PTR SS:[EBP-C],EAX
0CAF3C8F    8B46 0C         MOV EAX,DWORD PTR DS:[ESI+C]
0CAF3C92    FF50 64         CALL DWORD PTR DS:[EAX+64]
0CAF3C95    8BCE            MOV ECX,ESI
0CAF3C97    8BD8            MOV EBX,EAX
0CAF3C99    E8 75E1FFFF     CALL 0CAF1E13
0CAF3C9E    3BDF            CMP EBX,EDI
0CAF3CA0    5B              POP EBX
0CAF3CA1    0F85 EC690000   JNZ 0CAFA693
0CAF3CA7    8B45 08         MOV EAX,DWORD PTR SS:[EBP+8]
0CAF3CAA    5F              POP EDI
0CAF3CAB    5E              POP ESI
0CAF3CAC    C9              LEAVE
0CAF3CAD    C2 1000         RETN 10


8B FF 55 8B EC 83 EC 10 56 57 33 FF 81 3D 50 40 A3 71 29 2C A2 71 0F 84 25 6A 00 00 8D 45 F8 50
E8 67 F0 FF FF 3B C7 89 45 FC 0F 85 51 6A 00 00 FF 75 08 E8 CF E1 FF FF 8B F0 3B F7 0F 84 38 6A
00 00 8B 45 10 53 8D 4D FC 51 FF 75 F8 8D 4D 08 57 57 FF 75 14 89 45 F0 8B 45 0C 51 6A 01 8D 4D
F0 51 FF 75 08 89 45 F4 8B 46 0C FF 50 64 8B CE 8B D8 E8 75 E1 FF FF 3B DF 5B 0F 85 EC 69 00 00
8B 45 08 5F 5E C9 C2 10 00


00CC06F0    56              PUSH ESI
00CC06F1    8BF1            MOV ESI,ECX
00CC06F3    8B86 6C070000   MOV EAX,DWORD PTR DS:[ESI+76C]
00CC06F9    8B4E 04         MOV ECX,DWORD PTR DS:[ESI+4]
00CC06FC    57              PUSH EDI
00CC06FD    50              PUSH EAX
00CC06FE    51              PUSH ECX
00CC06FF    68 DC85CD00     PUSH Communic.00CD85DC                   ; ASCII "<%d> Data in send buffer length = %d.\n"
00CC0704    6A 02           PUSH 2
00CC0706    E8 45DA0000     CALL Communic.00CCE150
00CC070B    8B96 6C070000   MOV EDX,DWORD PTR DS:[ESI+76C]
00CC0711    8B86 68070000   MOV EAX,DWORD PTR DS:[ESI+768]
00CC0717    8B0E            MOV ECX,DWORD PTR DS:[ESI]
00CC0719    83C4 10         ADD ESP,10
00CC071C    6A 00           PUSH 0
00CC071E    52              PUSH EDX
00CC071F    50              PUSH EAX
00CC0720    51              PUSH ECX
00CC0721    FF15 9C41CD00   CALL DWORD PTR DS:[<&WS2_32.#19>]
00CC0727    8BF8            MOV EDI,EAX
00CC0729    85FF            TEST EDI,EDI
00CC072B    7F 31           JG SHORT Communic.00CC075E
00CC072D    8B56 04         MOV EDX,DWORD PTR DS:[ESI+4]
00CC0730    52              PUSH EDX
00CC0731    68 C485CD00     PUSH Communic.00CD85C4                   ; ASCII "<%d> Send data failed.\n"
00CC0736    6A 02           PUSH 2
00CC0738    E8 13DA0000     CALL Communic.00CCE150
00CC073D    83C4 0C         ADD ESP,0C
00CC0740    83BE 6C070000 0>CMP DWORD PTR DS:[ESI+76C],0
00CC0747    77 4E           JA SHORT Communic.00CC0797
00CC0749    8B86 5C070000   MOV EAX,DWORD PTR DS:[ESI+75C]
00CC074F    8B0E            MOV ECX,DWORD PTR DS:[ESI]
00CC0751    6A 31           PUSH 31
00CC0753    50              PUSH EAX
00CC0754    51              PUSH ECX
00CC0755    FF15 9841CD00   CALL DWORD PTR DS:[<&WS2_32.WSAEventSele>; WS2_32.WSAEventSelect
00CC075B    5F              POP EDI
00CC075C    5E              POP ESI
00CC075D    C3              RETN


56 8B F1 8B 86 6C 07 00 00 8B 4E 04 57 50 51 68 DC 85 CD 00 6A 02 E8 45 DA 00 00 8B 96 6C 07 00
00 8B 86 68 07 00 00 8B 0E 83 C4 10 6A 00 52 50 51 FF 15 9C 41 CD 00 8B F8 85 FF 7F 31 8B 56 04
52 68 C4 85 CD 00 6A 02 E8 13 DA 00 00 83 C4 0C 83 BE 6C 07 00 00 00 77 4E 8B 86 5C 07 00 00 8B
0E 6A 31 50 51 FF 15 98 41 CD 00 5F 5E C3




打开NPC


调用堆栈:     主线程
地址       堆栈       函数过程                              调用来自                      结构
0012F67C   00CC0D1B   Communic.00CC06F0                     Communic.00CC0D16
0012F68C   00CC0F15   Communic.00CC0C80                     Communic.00CC0F10
0012F6A0   00C62E26   Communic.00CC0EF0                     Communic.00C62E21
0012F6DC   00CC8CED   Communic.00C62D70                     Communic.00CC8CE8
0012F6F0   00C85BD0   Communic.00CC8860                     Communic.00C85BCB
0012F700   004F05F1   <JMP.&Communicate.#10>                asktao.004F05EC
0012F714   0062D440   asktao.004F05E0                       asktao.0062D43B
//ok
0012F75C   0061C7F5   asktao.0062D340                       asktao.0061C7F0
0012F76C   0061CE24   包含asktao.0061C7F5                     asktao.0061CE22
0012F788   00625EE1   asktao.0061CC70                       asktao.00625EDC
0012F7EC   0059AC22   包含asktao.00625EE1                     asktao.0059AC20
0012F808   0041B8F9   包含asktao.0059AC22                     asktao.0041B8F7
0012F81C   0041BF4C   包含asktao.0041B8F9                     asktao.0041BF4A
0012F83C   005A5556   包含asktao.0041BF4C                     asktao.005A5554
0012F84C   0064D21E   asktao.005A5530                       asktao.0064D219
0012F86C   0064E548   asktao.0064D140                       asktao.0064E543
0012F95C   0064ED38   asktao.0064D770                       asktao.0064ED33
0012F97C   77D18734   包含asktao.0064ED38                     USER32.77D18731
0012F9A8   77D18816   ? USER32.77D1870C                     USER32.77D18811
0012FA10   77D189CD   ? USER32.77D1875F                     USER32.77D189C8               0012FA0C
0012FA70   77D196C7   ? USER32.77D188F1                     USER32.77D196C2               0012FA6C



0062D435    68 14B1B100     PUSH asktao.00B1B114
0062D43A    56              PUSH ESI                                 ; ESI=00001036
0062D43B    E8 A031ECFF     CALL asktao.004F05E0
0062D440    8B0D BC93B100   MOV ECX,DWORD PTR DS:[B193BC]
0062D446    83C4 08         ADD ESP,8



push 00b1b114
push 1036
call 004f05e0
mov ecx,[0b193bc]
add esp,8






调用堆栈:     主线程
地址       堆栈       函数过程                              调用来自                      结构
0012F660   00CC0727   WS2_32.send                           Communic.00CC0721
0012F67C   00CC0D1B   Communic.00CC06F0                     Communic.00CC0D16
0012F68C   00CC0F15   Communic.00CC0C80                     Communic.00CC0F10
0012F6A0   00C62E26   Communic.00CC0EF0                     Communic.00C62E21
0012F6DC   00CC8CED   Communic.00C62D70                     Communic.00CC8CE8
0012F6F0   00C85BD0   Communic.00CC8860                     Communic.00C85BCB
0012F700   004F05F1   <JMP.&Communicate.#10>                asktao.004F05EC
0012F714   0062D440   asktao.004F05E0                       asktao.0062D43B
//ok
0012F75C   0061C7F5   asktao.0062D340                       asktao.0061C7F0
0012F76C   0061CE24   包含asktao.0061C7F5                     asktao.0061CE22
0012F788   00625EE1   asktao.0061CC70                       asktao.00625EDC
0012F7EC   0059AC22   包含asktao.00625EE1                     asktao.0059AC20
0012F808   0041B8F9   包含asktao.0059AC22                     asktao.0041B8F7
0012F81C   0041BF4C   包含asktao.0041B8F9                     asktao.0041BF4A
0012F83C   005A5556   包含asktao.0041BF4C                     asktao.005A5554
0012F84C   0064D21E   asktao.005A5530                       asktao.0064D219
0012F86C   0064E548   asktao.0064D140                       asktao.0064E543
0012F95C   0064ED38   asktao.0064D770                       asktao.0064ED33
0012F97C   77D18734   包含asktao.0064ED38                     USER32.77D18731
0012F9A8   77D18816   ? USER32.77D1870C                     USER32.77D18811
0012FA10   77D189CD   ? USER32.77D1875F                     USER32.77D189C8               0012FA0C
0012FA70   77D196C7   ? USER32.77D188F1                     USER32.77D196C2               0012FA6C









善者 慈悲心常在 无怨无恨 以苦为乐
默认压缩密码www.hifyl.com
文件分享密码问题:http://www.hifyl.com/read-htm-tid-4444.html
快速回复
限100 字节
批量上传需要先选择文件,再选择上传
 
上一个 下一个