-
-
[原创]英雄联盟客户端hack
-
发表于: 2013-8-22 09:57
-
《英雄联盟》（League of Legends，简称LoL），是由Riot Games开发及发行的一款Windows和MAC OS X平台下的多人在线对战竞技游戏，该游戏有个功能，就是能够观战好友的游戏，下面我就通过逆向这个游戏客户端实现能够观看任何人的游戏，
英雄联盟的客户端是个Adobe AIR 程序， AIR 程序跟java一样都是通过一个虚拟机（AVM）来执行它的bytecode的。（AVM指令介绍5b0K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3q4V1L8$3u0W2i4K6u0W2j5$3!0E0i4K6u0r3j5$3!0F1N6r3g2F1N6q4)9J5c8X3c8S2L8g2)9J5c8V1q4V1L8$3u0W2i4K6u0r3k6h3&6Q4x3V1k6V1k6i4k6F1k6i4c8Q4x3V1k6S2j5%4c8A6L8$3&6K6j5%4u0A6M7s2c8Q4x3V1k6S2M7Y4c8A6j5$3I4W2M7#2)9J5c8X3q4$3L8e0u0G2N6X3g2J5N6X3W2W2N6#2)9J5k6i4m8V1k6W2!0q4c8W2!0n7b7#2)9^5z5g2!0q4x3#2)9^5x3q4)9^5x3R3`.`.
分析英雄联盟客户端我主要用到这几个软件：
1.硕思闪客精灵破解版
2.JPEXS Free Flash Decompiler
9f6K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3k6J5k6h3g2Q4x3X3c8V1k6h3y4G2L8i4m8A6L8r3g2J5i4K6u0W2j5$3!0E0i4K6u0r3k6X3I4S2M7$3S2Q4x3V1k6V1L8%4N6F1L8r3!0S2k6q4)9J5k6h3S2@1L8h3H3`.
3.Flash Builder
Adobe官网有的下，可以免费用60天
我主要硕思闪客精灵用来反编译出英雄联盟客户端的代码然后用Flash Builder来分析代码，最后用JPEXS 来修改和写入bytecode。
英雄联盟客户端LolClient.exe其实是一个改了图标的Adobe AIR Launcher而已，通过查看进程查看其命令行就可以看得出，真正的代码在其AIR目录下mod和lib两个目录下，格式是*.dat，而关于观看好友比赛的代码就在\Air\mod\man\mod_man.dat，其实这是我通过把所有的.dat都通过硕思反编译出代码到同一个文件夹。然后Flash Buuilder建立工程来分析得出的，因为FB能够自动分析出跳转，能够很方便研究反汇编出来的代码，介于篇幅，怎么找到的就不写了。
用JPEXS 打来mod_man.dat，如图
在左边的列表里找到scripts\com\riotgames\platform\gameclient\chat\renderer\BuddyListTreeRenderer 然后选中，之后中间的ActionScript source窗口就能看到反编译出来的代码，右边的窗口能够看到相对应的bytecode，我们最后修改代码也就是通过修改bytecode实现的。
我修改的思路是实现可以添加任意的玩家到离线列表（离线列表放的是离线的好友以及己方添加对面未确定的玩家），然后使离线列表的玩家的右键菜单中的“观战”选项开启（只有上线的好友列表中才开启这个菜单项）
在BuddyListTreeRenderer中有几个重要的地方
1
private function onContextMenuShow(param1:FlexNativeMenuEvent) : void {
var _loc2_:PresenceStatusData = null;
var _loc3_:* = false;
var _loc4_:NativeMenuItem = null;
var _loc5_:String = null;
if(!(data is RosterGroup))
{
_loc2_ = PresenceController.getPresenceData(data.status);
_loc3_ = data.online;
_loc3_ = (_loc3_) && !this.chatController.inGame || !this.masterGameController.currentState == GameViewState.TEAM_SELECTION || !this.masterGameController.currentState == GameViewState.JOIN_QUEUE;
_loc3_ = (_loc3_) && (this.spectatorController.canDropInSpectate(_loc2_)) && !this.applicationController.shutdownLawActive;
_loc3_ = (_loc3_) && !GameVersionConfig.instance.isWorking;
for each (_loc4_ in param1.nativeMenu.items)
{
_loc5_ = _loc4_.data.data;
switch(_loc5_)
{
case "inviteToGame":
_loc4_.enabled = (this.inviteController.allowedToInvite || this.inviteController.isInviteActive) && (data.online) && !(data.show == Presence.SHOW_DND);
if(this.inviteController.gameQueueManager.selectedGameQueueConfig)
{
_loc4_.enabled = (_loc4_.enabled) && !this.inviteController.gameQueueManager.selectedGameQueueConfig.teamOnly;
}
continue;
case "spectateGame":
_loc4_.enabled = _loc3_;
continue;
case "sendMessage":
_loc4_.enabled = data.online;
continue;
case "viewProfile":
_loc4_.enabled = LobbyConfig.instance.isSummonerSearchEnabled;
continue;
default:
continue;
}
}
}
else
{
param1.nativeMenu.getItemAt(0).enabled = this.chatController.isCustomRosterGroup(data as RosterGroup);
}
}getlocal 4 getlocal_3 setproperty m[4178]"enabled"
private function spectateGame() : void {
var _loc2_:PresenceStatusData = null;
var _loc3_:String = null;
var _loc4_:Object = null;
var _loc1_:RosterItemVO = data as RosterItemVO;
if((_loc1_) && (_loc1_.online))
{
this.masterGameController.cancelGameFlow();
_loc2_ = PresenceController.getPresenceData(_loc1_.status);
_loc3_ = _loc2_.dropInSpectateId;
if(_loc2_.gameType == PresenceStatusXML.GAME_STATUS_IN_SPECTATING && (_loc3_))
{
if(_loc3_.search(new RegExp("^featured_game_")) == 0)
{
_loc4_ = jsonDecode(_loc2_.featuredGameData);
this.spectatorController.spectateFeaturedGame(_loc4_.gameId,_loc4_.platformId,_loc4_.encryptionKey,_loc4_.mapId,_loc4_.gameType);
}
else
{
this.spectatorController.spectateSummoner(_loc3_);
}
}
else
{
this.spectatorController.spectateSummoner(_loc1_.displayName);
}
}
}getlocal_1 convert_b dup iffalse ofs0027 pop getlocal_1 getproperty m[14053]"online" convert_b ofs0027:iffalse ofs00bf
getlocal_1 convert_b iffalse ofs00bf
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 全图··
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
如果能够花精力去研究lol客户端也是能够实现fbeK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4q4#2K9h3y4C8k6X3W2F1k6q4)9J5k6h3E0S2M7%4y4S2k6q4)9J5k6h3W2F1i4K6u0r3i4@1f1%4i4K6W2m8i4K6R3@1i4@1f1#2i4K6S2m8i4K6W2r3i4@1f1^5i4K6R3K6i4@1u0p5i4@1f1%4i4K6W2m8i4K6R3@1i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1$3i4K6W2o6i4@1q4o6i4@1f1$3i4K6W2p5i4@1p5#2i4@1f1$3i4K6R3^5i4K6V1I4i4@1f1@1i4@1t1&6i4K6S2n7i4@1f1#2i4K6R3&6i4K6S2p5i4@1f1$3i4K6R3K6i4@1t1K6i4@1f1$3i4@1p5^5i4@1p5I4i4@1f1$3i4K6S2n7i4K6W2r3i4@1f1#2i4K6W2n7i4@1u0p5i4@1f1$3i4K6W2o6i4K6S2p5i4@1f1#2i4@1q4q4i4@1p5J5i4@1f1$3i4K6R3^5i4@1t1%4i4@1f1%4i4@1q4n7i4@1q4r3i4@1f1^5i4@1u0r3i4K6R3%4i4@1f1%4i4@1p5^5i4K6S2n7i4@1f1#2i4K6S2q4i4@1u0n7i4@1f1#2i4@1q4q4i4K6W2q4i4@1f1%4i4K6S2q4i4@1t1H3i4@1f1%4i4K6V1&6i4@1u0n7i4@1f1#2i4@1u0p5i4K6V1#2i4K6u0V1i4@1f1^5i4@1q4r3i4@1t1%4i4@1f1$3i4@1t1I4i4K6R3J5i4@1f1@1i4@1u0r3i4@1p5I4i4@1f1$3i4K6R3I4i4@1q4r3i4@1f1$3i4K6W2p5i4@1p5#2i4@1f1^5i4K6S2q4i4@1t1%4i4@1f1#2i4K6S2r3i4K6V1$3i4@1f1^5i4@1p5%4i4K6R3J5i4@1f1$3i4K6R3^5i4K6V1^5i4@1f1@1i4@1u0r3i4@1p5I4i4@1f1$3i4K6R3I4i4@1q4r3i4@1f1%4i4K6W2m8i4K6R3@1i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1@1i4@1t1^5i4K6S2p5i4@1f1^5i4@1u0r3i4K6R3%4i4@1f1#2i4K6W2n7i4@1u0p5i4@1f1$3i4K6W2o6i4K6S2p5i4@1f1%4i4K6W2m8i4K6R3@1i4@1f1^5i4@1p5$3i4K6R3I4i4@1f1$3i4@1q4r3i4K6V1@1i4@1f1#2i4@1p5@1i4K6V1$3i4@1f1$3i4K6W2o6i4K6S2p5i4@1f1&6i4K6W2m8i4@1u0q4i4@1f1#2i4@1u0o6i4K6R3@1i4@1g2r3i4@1u0o6i4K6S2o6e0p5!0x3i4@1f1#2i4K6W2n7i4@1u0p5i4@1f1$3i4K6W2o6i4K6S2p5i4@1f1%4i4K6W2m8i4K6R3@1i4@1f1%4i4K6V1&6i4@1u0n7i4@1f1#2i4@1u0p5i4K6V1#2i4@1f1^5i4@1p5$3i4K6R3I4i4@1f1#2i4K6R3#2i4K6R3^5i4@1f1&6i4K6R3H3i4K6W2m8i4@1f1^5i4@1u0r3i4K6R3%4i4@1f1#2i4K6S2r3i4@1p5$3i4@1f1@1i4@1t1^5i4K6R3H3i4@1f1@1i4@1t1^5i4@1q4m8i4@1f1%4i4@1p5^5i4K6S2n7i4@1f1#2i4@1u0m8i4K6S2r3i4@1g2r3i4@1u0o6i4K6R3^5i4K6g2o6g2p5y4x3f1#2)9#2b7@1y4D9K9h3g2F1N6q4)9J5k6h3g2^5k6g2!0q4c8W2!0n7b7#2)9^5z5g2!0q4y4#2)9&6z5g2!0n7b7W2!0q4y4g2!0n7c8q4)9&6y4i4q4I4i4@1f1^5i4K6S2q4i4@1t1%4i4@1f1#2i4K6S2r3i4K6V1$3N6r3!0C8k6h3&6Q4c8e0g2Q4z5o6k6Q4z5p5c8Q4c8e0W2Q4z5o6m8Q4z5f1q4Q4c8e0S2Q4b7V1k6Q4z5o6N6Q4c8e0S2Q4b7V1k6Q4z5e0W2Q4c8e0c8Q4b7U0S2Q4b7f1q4S2K9i4u0Q4c8e0g2Q4b7f1g2Q4b7e0u0Q4c8e0k6Q4z5o6S2Q4b7U0N6Q4c8e0N6Q4b7f1u0Q4b7f1k6Q4c8e0N6Q4z5e0W2Q4b7V1u0Q4c8e0g2Q4b7V1c8Q4z5e0g2Q4c8e0k6Q4b7U0S2Q4b7U0S2Q4c8e0k6Q4z5o6S2Q4z5p5k6Q4c8f1k6Q4b7V1y4Q4z5p5y4Q4c8e0S2Q4b7e0k6Q4z5o6q4Q4c8e0W2Q4z5o6m8Q4z5o6k6Q4c8e0g2Q4z5e0m8Q4z5e0q4Q4c8e0N6Q4z5e0W2Q4b7V1u0Q4c8e0g2Q4b7V1c8Q4z5e0g2Q4c8e0S2Q4b7V1k6Q4z5o6N6Q4c8e0N6Q4b7e0S2Q4z5p5u0Q4c8e0g2Q4b7e0c8Q4b7f1q4Q4c8e0W2Q4b7V1q4Q4b7V1u0Q4c8e0N6Q4z5o6y4Q4b7e0k6Q4c8e0c8Q4b7V1q4Q4z5o6k6Q4c8f1k6Q4b7V1y4Q4z5p5y4Q4c8e0k6Q4z5o6S2Q4z5e0q4Q4c8e0S2Q4b7U0m8Q4z5o6y4Q4c8e0S2Q4b7f1k6Q4z5e0g2Q4c8e0S2Q4b7U0m8Q4z5o6y4Q4c8e0S2Q4b7f1k6Q4z5e0g2Q4c8e0N6Q4z5f1c8Q4z5o6m8Q4c8e0g2Q4b7U0m8Q4b7U0q4Q4c8e0k6Q4z5e0c8Q4b7V1g2Q4c8e0g2Q4b7V1y4Q4z5o6y4Q4c8e0c8Q4b7V1q4Q4z5o6j5`.
 ，不如这种直接修改游戏的方式来得轻松点
|
|
|
 牛叉。。。
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
