AOB的更新 的機碼編制(131313)

教學方面須要看再回吧
我打得這麼辛苦
回個文應該不會要人命吧

本帖隱藏的內容需要回復才可以瀏覽

一般的AOB為例 sdfdfgsdfgsdfgsdfgdsfgdsfgdfggsdfgdsfgsdfgsdfgdsfg浪漫 ID131313 85IDTWST901250 掛國ID同85sdfgdsfggtgegdsfgesrgdfgsdfgsdfgdfsgdfsg
V7.2
007d15ef - 74 28 - je 007d1619sdfgsdfgsdfgsdfgsdfgsdfgsdfgsdfgsdfgsdfgertertdfg
007d15f1 - 39 be 34 02 00 00 - cmp [esi+00000234],ediasdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d15f7 - 8d 8e 34 02 00 00 - lea ecx,[esi+00000234] //要找的東西如這asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferas
007d15fd - 75 1a - jne 007d1619asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d15ff - 6a 14 - push 14asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d1601 - 89 10 - mov [eax],edxasdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d1603 - 8b 44 24 18 - mov eax,[esp+18]asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d1607 - 57 - push ediasdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d1608 - 81 c6 64 04 00 00 - add esi,00000464asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d160e - 56 - push esiasdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d160f - 89 01 - mov [ecx],eaxasdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d1611 - e8 6a 37 07 00 - call 00844d80
007d1616 - 83 c4 0c - add esp,0c
8d 8e 34 02 00 00 75 1a 6a 14 89 10 8b 44 24 18 57asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
大致上我是取這一部分asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
下面是取我需要的地方做篩選 找出 真正需要的機碼 (大致上約取6~7個AＯＢ如上)asdfasdfasdfasdfwerwersdfsarerewfasdfasfff
１。
007d15f7 - 8d 8e 34 02 00 00 - lea ecx,[esi+00000234] asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrt
這是我們要找的位子所以放第一個asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
取的位子我想大家是否發現asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,　 　
前面的６對數字　有很相識asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
那就是浪漫ID13131334 02 00 00 - lea ecx,[esi+00000234]asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
將34 02 00 00 倒過來就是 00 00 02 34 這就一樣了asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
但是一般改版 00000234 這數字可能會改 所以就不要這位子asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
所以第一段就取 8d 8e ** ** ** **asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
２。
007d15fd - 75 1a85IDTWST901250 - jne 007d1619asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
這段就可以直接取asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
因為ＪＮＥ的ＡＯＢ比較少修改asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
所以第二段就取 75 1a　或是用　** ** (不要取用 因為只是比較少改到 但還是有可能)
asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
３。asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d15ff - 6a 14 - push 14asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
這段的話就有如1段asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
6a 14 - push 14asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
14是重複的所以不取用asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
所以第三段就取 6a **asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
fdgsdfgsdfgsdfgsdfgsdfgsdfgsdfgsdfgsdfg 浪漫ID131313 85IDTWST901250 掛國ID同85asdfsadfasdfsadfsadfdsfsdfdsaf
４。asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d1601 - 89 10 - mov [eax],edxasdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
這段我也還不是很清楚比較點asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
我的想法是asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
如果他改版再EAX 或是EDX的地方做更改就麻煩了asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
(再某一版大改有過 但如果要找準確點可加)asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
所以第四段就 ** ** (不要取用 因為只是比較少改到 但還是有可 能)
asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
５。asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d1603 - 8b 44 24 18 - mov eax,[esp+18]asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
這段的話asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
只有18的地方對到asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
所以第五段就取 8b 44 24 **asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
浪漫ID131313 85IDTWST901250 掛國ID同85
６。asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
007d1607 - 57 - push ediasdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
這段大致上是不會有變動的asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
比第二段還要不變動asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
所以第六段就直接取 57asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,
asdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,

浪漫ID131313 85IDTWasdfasdfasdfasdfwerwersdfsarerewfasdfasfffeferasdfrtjhcghjgfkuyknm,nm,io,T901250 掛國ID同85
大致上就會變成




1.8d 8e ** ** ** ** 75 1a 6a ** ** ** 8b 44 24 ** 57
2.8d 8e ** ** ** ** ** ** 6a ** ** ** 8b 44 24 ** 57