005B7A6D - 7C 11 - jnge client.ocx+1B7A80
005B7A6F - 8B 51 0C - mov edx,[ecx+0C]
005B7A72 - 8B 04 82 - mov eax,[edx+eax*4] << ce入手点
005B7A75 - 89 44 24 04 - mov [esp+04],eax
005B7A79 - 8B 09 - mov ecx,[ecx]
005B7A60 8B4424 04 mov eax,ss:[esp+0x4] ---------头部下断返回
005B7A64 3D FC000000 cmp eax,0xFC
005B7A69 7D 15 jge X005B7A80
005B7A6B 85C0 test eax,eax
005B7A6D 7C 11 jl X005B7A80
005B7A6F 8B51 0C mov edx,ds:[ecx+0xC] ; dd [ecx+0xC]+1*4 ---背包对象
005B7A72 8B0482 mov eax,ds:[edx+eax*4] ; 这
005B7A75 894424 04 mov ss:[esp+0x4],eax
005B7A79 8B09 mov ecx,ds:[ecx]
005B7A7B E9 60B70500 jmp 006131E0
005B7A80 33C0 xor eax,eax
005B7A82 894424 04 mov ss:[esp+0x4],eax
005B7A86 8B09 mov ecx,ds:[ecx]
005B7A88 E9 53B70500 jmp 006131E0
0047716D 8BB9 60010000 mov edi,ds:[ecx+0x160]
00477173 52 push edx
00477174 E8 719C1F00 call 00670DEA
00477179 6BFF 2A imul edi,edi,0x2A
0047717C 8D7C38 FF lea edi,ds:[eax+edi-0x1]
00477180 A1 74577500 mov eax,ds:[0x755774] ; dd [[[[0x755774]+0x1E8]+0x20]+0xC]+0*4
00477185 8B88 E8010000 mov ecx,ds:[eax+0x1E8] ; dd [[[eax+0x1E8]+0x20]+0xC]+1*4
0047718B 8B49 20 mov ecx,ds:[ecx+0x20] ; dd [[ecx+0x20]+0xC]+1*4
0047718E 83C4 04 add esp,0x4
00477191 57 push edi
00477192 897C24 34 mov ss:[esp+0x34],edi
00477196 E8 C5081400 call 005B7A60
0047719B 8B56 34 mov edx,ds:[esi+0x34]
[[[[0x755774]+0x1E8]+0x20]+0xC]+0*4 好了我们找到背包对象了
接着找背包物品数量 开ce搜
0047720C - EB 02 - jmp client.ocx+77210
0047720E - 33 C9 - xor ecx,ecx
00477210 - 8B 43 1C - mov eax,[ebx+1C] <<这访问背包物品数量
00477213 - 8B 53 38 - mov edx,[ebx+38]
00477216 - 2B C1 - sub eax,ecx
004771F3 E8 68071400 call 005B7960 ; 进这call看
004771F8 8BD8 mov ebx,eax ; 发现ebx来源於eax 所以进上面那call看
004771FA 85DB test ebx,ebx
004771FC 0F84 59040000 je 0047765B
00477202 8A43 20 mov al,ds:[ebx+0x20]
00477205 84C0 test al,al
00477207 76 05 jbe X0047720E
00477209 0FB6C8 movzx ecx,al
0047720C EB 02 jmp X00477210
0047720E 33C9 xor ecx,ecx
00477210 8B43 1C mov eax,ds:[ebx+0x1C] ; dd ebx+0x1C
00477213 8B53 38 mov edx,ds:[ebx+0x38]
00477216 2BC1 sub eax,ecx
00477218 8A4A 51 mov cl,ds:[edx+0x51]
005B7960 85C9 test ecx,ecx
005B7962 74 17 je X005B797B
005B7964 8B01 mov eax,ds:[ecx]
005B7966 8B4C24 04 mov ecx,ss:[esp+0x4]
005B796A 3B08 cmp ecx,ds:[eax]
005B796C 7D 0D jge X005B797B
005B796E 85C9 test ecx,ecx
005B7970 7C 09 jl X005B797B
005B7972 8B40 04 mov eax,ds:[eax+0x4]
005B7975 8B0488 mov eax,ds:[eax+ecx*4] ; 这里再跟就是跟背包对象一样了 直接套我们找到的背
包对象
005B7978 C2 0400 retn 0x4
005B797B 33C0 xor eax,eax
005B797D C2 0400 retn 0x4
[[[[[0x755774]+0x1E8]+0x20]+0xC]+0*4]+1c 背包数量
数量确认了 来跟名字
0059FF71 - 8A 0F - mov cl,[edi]
0059FF82 - 8D 78 08 - lea edi,[eax+08] ----ce入手点
0059FF85 - F3 A5 - repe movsd
0059FF8C - F3 A4 - repe movsb
0059FF60 8B5424 04 mov edx,ss:[esp+0x4] ----头部下段返回 堆栈 ss:[0018FB8C]=0E7AAC98
0059FF64 53 push ebx
0059FF65 55 push ebp
0059FF66 56 push esi
0059FF67 8B32 mov esi,ds:[edx] ; 发现esi里面是物品列表
0059FF69 57 push edi
0059FF6A 8BFE mov edi,esi
0059FF6C 8BC1 mov eax,ecx
0059FF6E 8D5F 01 lea ebx,ds:[edi+0x1]
0059FF71 8A0F mov cl,ds:[edi]
0059FF73 47 inc edi
0059FF74 84C9 test cl,cl
0059FF76 ^ 75 F9 jnz X0059FF71
0059FF78 2BFB sub edi,ebx
0059FF7A 8D4F 01 lea ecx,ds:[edi+0x1]
0059FF7D 8BD9 mov ebx,ecx
0059FF7F C1E9 02 shr ecx,0x2
0059FF82 8D78 08 lea edi,ds:[eax+0x8]
0E785FC8 33 30 BE F8 CA C0 CE E4 C6 F7 B0 FC 00 00 00 00 30绝世武器包....
0E785FD8 6A A2 B9 74 00 00 00 8B 34 30 BE F8 CA C0 CE E4 j⒐t...?0绝世武
0E785FE8 C6 F7 B0 FC 00 00 00 00 6F A2 B9 74 00 00 00 8B 器包....o⒐t...?
0E785FF8 34 30 BE F8 CA C0 CA CE C6 B7 B0 FC 00 00 00 00 40绝世饰品包....
0E786008 90 A5 B9 74 00 00 00 8D BE C5 D7 AA BB B9 BB EA 惀箃...嵕抛够?
0E786018 B5 A4 00 00 00 00 00 00 95 A5 B9 74 00 00 00 8C 丹......暐箃...?
0E786028 44 52 4F 50 30 30 39 2E 73 70 72 00 00 00 00 00 DROP009.spr.....
0E786038 96 A5 B9 74 00 00 00 8D D2 D7 BE AD CF B4 CB E8 枼箃...嵰拙此?
0E786048 B5 A4 00 00 00 00 00 00 9B A5 B9 74 00 00 00 8C 丹......洢箃...?
0E786058 44 52 4F 50 30 30 39 2E 73 70 72 00 00 00 00 00 DROP009.spr.....
0E786068 9C A5 B9 74 00 00 00 8F B0 AE B5 C4 C3 D8 D2 A9 湧箃...彴拿匾?
0E786078 00 00 00 00 00 00 00 00 81 A5 B9 74 00 00 00 8C ........仴箃...?
0E786088 44 52 4F 50 30 30 39 2E 73 70 72 00 00 00 00 00 DROP009.spr.....
0E786098 82 A5 B9 74 00 00 00 8F 50 4B B1 A3 BB A4 D2 A9 偉箃...廝K保护药
005A345F 85C0 test eax,eax
005A3461 74 16 je X005A3479
005A3463 8BC8 mov ecx,eax
005A3465 E8 E6CBFFFF call 005A0050
005A346A 53 push ebx
005A346B 8BC8 mov ecx,eax
005A346D 8BE8 mov ebp,eax
005A346F E8 ECCAFFFF call 0059FF60 ; 这call返回EAX物品名字与说明
0E23BA30 6C 4C 6C 00 00 B0 4A 03 33 30 BE F8 CA C0 CE E4 lLl..癑30绝世武
0E23BA40 C6 F7 B0 FC 00 00 00 00 00 00 00 00 00 00 00 00 器包............
0E23BA50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0E23BA60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0E23BA70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0E23BA80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0E23BA90 00 00 00 00 00 00 00 00 00 00 00 00 CA B9 D3 C3 ............使用
0E23BAA0 BA F3 BB E1 BB F1 B5 C3 D2 BB B0 D1 33 30 BC B6 后会获得一把30级
0E23BAB0 BE F8 CA C0 CE E4 C6 F7 A1 A3 00 00 00 00 00 00 绝世武器。......
0E23BAC0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
我们再回到59ff60这 发现堆栈有个可疑的值0E7AAC98
0059FF60 8B5424 04 mov edx,ss:[esp+0x4] ----头部下段返回 堆栈 ss:[0018FB8C]=0E7AAC98
0059FF64 53 push ebx
0059FF65 55 push ebp
0059FF66 56 push esi
0059FF67 8B32 mov esi,ds:[edx] ; 发现esi里面是物品列表
0059FF69 57 push edi
立马 dd [[[[0x755774]+0x1E8]+0x20]+0xC]+0*4
034ABC90 105997F8 -----物品1对象 数据窗口跟随
034ABC94 0E804090 -----物品2对象
034ABC98 0EB8C960
034ABC9C 0E803FD0
034ABCA0 0E8042D0
034ABCA4 0EB8C8A0
034ABCA8 10599678
034ABCAC 0EB8C7E0
034ABCB0 10599A38
034ABCB4 10857B98
034ABCB8 10599BB8
034ABCBC 105998B8
立马 dd [[[[[0x755774]+0x1E8]+0x20]+0xC]+0*4]进去看看 果然+38偏移处
10599800 00000000
10599804 00000049
10599808 000000F5
1059980C 00000000
10599810 00000000
10599814 00000000
10599818 00000000
1059981C 00009879
10599820 00000000
10599824 00000000
10599828 00000000
1059982C 00000000
10599830 0E7AAC98
dd [[[[[0x755774]+0x1E8]+0x20]+0xC]+0*4]+0x38= [esp+0x4]
0059FF60 8B5424 04 mov edx,ss:[esp+0x4] ----头部下段返回 堆栈 ss:[0018FB8C]=0E7AAC98
------------------------------------------------------------------------
我们再回到这,既然这call返回物品名 看看他的参数
005A3465 E8 E6CBFFFF call 005A0050
005A346A 53 push ebx ; ebx=0E7AAC98
005A346B 8BC8 mov ecx,eax ; eax=0E23BA30, (ASCII "lLl")
005A346D 8BE8 mov ebp,eax ; eax=0E23BA30, (ASCII "lLl")
005A346F E8 ECCAFFFF call 0059FF60 ; 这call返回物品名字与说明
我们就得找eax的来源 以後才好调用这call取得名字跟说明
005A3437 53 push ebx
005A3438 8BCD mov ecx,ebp
005A343A E8 01E3FFFF call 005A1740
005A343F 66:8B95 D202000>mov dx,ss:[ebp+0x2D2]
005A3446 66:8995 DA02000>mov ss:[ebp+0x2DA],dx
005A344D E9 31020000 jmp 005A3683
005A3452 68 D0020000 push 0x2D0 ; 这里是eax=0
005A3457 E8 E80D0A00 call 00644244 ; 经过这call eax0E23BA30 找到真凶
005A345C 83C4 04 add esp,0x4
005A345F 85C0 test eax,eax
005A3461 74 16 je X005A3479
005A3463 8BC8 mov ecx,eax ; eax没变
005A3465 E8 E6CBFFFF call 005A0050 ; 過這call eax没变依然是0E23BA30
005A346A 53 push ebx ; ebx=0E7AAC98
005A346B 8BC8 mov ecx,eax ; eax=0E23BA30, (ASCII "lLl")
005A346D 8BE8 mov ebp,eax ; eax=0E23BA30, (ASCII "lLl")
005A346F E8 ECCAFFFF call 0059FF60 ; 这call返回物品名字与说明
005A3474 E9 0A020000 jmp 005A3683
005A3479 33C0 xor eax,eax
----------------------------------------------------------------------------------------------------------
00644244 56 push esi ; 从头部下断我们发现好几个地方都在调用这call
00644245 8B7424 08 mov esi,ss:[esp+0x8] ; [esp+0x8]估计是关键
00644249 EB 10 jmp X0064425B ; 强跳
0064424B 56 push esi
0064424C E8 5A270300 call 006769AB ; 这不会进
00644251 85C0 test eax,eax
00644253 59 pop ecx
00644254 75 05 jnz X0064425B
00644256 E8 EA000000 call 00644345
0064425B 56 push esi
0064425C E8 98D80200 call 00671AF9 进去看看
00644261 85C0 test eax,eax
00644263 59 pop ecx
00644264 ^ 74 E5 je X0064424B
00644266 5E pop esi
00644267 C3 retn ; 没返回 那就是上面三个其中一个返回了 挨个看
00671AF9 FF35 681A7600 push dword ptr ds:[0x761A68]
00671AFF FF7424 08 push dword ptr ss:[esp+0x8]
00671B03 E8 C5FFFFFF call 00671ACD eax从这蹦出的
00671B08 59 pop ecx
00671B09 59 pop ecx
00671B0A C3 retn
--------------------------------------------------------------------------------------------------------------------
005A3452 68 D0020000 push 0x2D0 这里有个2d0 下面还有啥310 3DC 2D 这些破值
call 00644244 这call就是物品名称密钥
005A3452 68 D0020000 push 0x2D0 ; 这里是eax=0
005A3457 E8 E80D0A00 call 00644244 ; 经过这call eax=0E23BA30 找到真凶 进去瞧瞧
005A345C 83C4 04 add esp,0x4
005A345F 85C0 test eax,eax
005A3461 74 16 je X005A3479
005A3463 8BC8 mov ecx,eax ; eax没变
005A3465 E8 E6CBFFFF call 005A0050 ; 過這call eax没变依然是0E23BA30
005A346A 53 push ebx ; ebx=0E7AAC98
005A346B 8BC8 mov ecx,eax ; eax=0E23BA30, (ASCII "lLl")
005A346D 8BE8 mov ebp,eax ; eax=0E23BA30, (ASCII "lLl")
005A346F E8 ECCAFFFF call 0059FF60 ; 这call返回物品名字与说明
005A3474 E9 0A020000 jmp 005A3683
005A3479 33C0 xor eax,eax
005A347B 53 push ebx
005A347C 8BC8 mov ecx,eax
005A347E 8BE8 mov ebp,eax
005A3480 E8 DBCAFFFF call 0059FF60
005A3485 E9 F9010000 jmp 005A3683
005A348A 68 10030000 push 0x310
005A348F E8 B00D0A00 call 00644244
005A3494 83C4 04 add esp,0x4
005A3497 85C0 test eax,eax
005A3499 74 16 je X005A34B1
005A349B 8BC8 mov ecx,eax
005A349D E8 0EF1FFFF call 005A25B0
005A34A2 53 push ebx
005A34A3 8BC8 mov ecx,eax
005A34A5 8BE8 mov ebp,eax
005A34A7 E8 A4D9FFFF call 005A0E50
005A34AC E9 D2010000 jmp 005A3683
005A34B1 33C0 xor eax,eax
005A34B3 53 push ebx
005A34B4 8BC8 mov ecx,eax
005A34B6 8BE8 mov ebp,eax
005A34B8 E8 93D9FFFF call 005A0E50
005A34BD E9 C1010000 jmp 005A3683
005A34C2 68 D0020000 push 0x2D0
005A34C7 E8 780D0A00 call 00644244
005A34CC 83C4 04 add esp,0x4
005A34CF 85C0 test eax,eax
005A34D1 74 16 je X005A34E9
005A34D3 8BC8 mov ecx,eax
005A34D5 E8 B6F0FFFF call 005A2590
005A34DA 53 push ebx
005A34DB 8BC8 mov ecx,eax
005A34DD 8BE8 mov ebp,eax
005A34DF E8 BCD5FFFF call 005A0AA0
005A34E4 E9 9A010000 jmp 005A3683
005A34E9 33C0 xor eax,eax
005A34EB 53 push ebx
005A34EC 8BC8 mov ecx,eax
005A34EE 8BE8 mov ebp,eax
005A34F0 E8 ABD5FFFF call 005A0AA0
005A34F5 E9 89010000 jmp 005A3683
005A34FA 68 DC030000 push 0x3DC
005A34FF E8 400D0A00 call 00644244
005A3504 83C4 04 add esp,0x4
005A3507 85C0 test eax,eax
005A3509 74 0B je X005A3516
005A350B 8BC8 mov ecx,eax
005A350D E8 2ED4FFFF call 005A0940
005A3512 8BE8 mov ebp,eax
005A3514 EB 02 jmp X005A3518
005A3516 33ED xor ebp,ebp
005A3518 53 push ebx
005A3519 8BCD mov ecx,ebp
005A351B E8 30D2FFFF call 005A0750
005A3520 85F6 test esi,esi
005A3522 8B4424 44 mov eax,ss:[esp+0x44]
005A3526 8985 D8030000 mov ss:[ebp+0x3D8],eax
005A352C 74 30 je X005A355E
005A352E 6A 2D push 0x2D
005A3530 E8 0F0D0A00 call 00644244
005A3535 8BD0 mov edx,eax
005A3537 83C4 04 add esp,0x4
005A353A 85D2 test edx,edx
005A353C 74 10 je X005A354E
005A353E B9 0B000000 mov ecx,0xB
005A3543 33C0 xor eax,eax
005A3545 8BFA mov edi,edx
005A3547 F3:AB rep stos dword ptr es:[edi]
005A3549 AA stos byte ptr es:[edi]
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
