[原创]分享以前的資料 絲路原動力內外掛破解
內掛部分
=================
SROBOT.EXE Patch
=================
搜尋字串 silk.dll
找到
00404C10 . 81EC 04010000 sub esp, 104
00404C16 . A1 BCFB4000 mov eax, dword ptr [40FBBC]
00404C1B . 53 push ebx
00404C1C . 8B9C24 100100>mov ebx, dword ptr [esp+110]
00404C23 . 55 push ebp
00404C24 . 8BAC24 100100>mov ebp, dword ptr [esp+110]
00404C2B . 56 push esi
00404C2C . 57 push edi
00404C2D . 50 push eax
00404C2E . 53 push ebx
00404C2F . 55 push ebp
00404C30 . E8 9BFFFFFF call 00404BD0
00404C35 . 8B15 DCFF4000 mov edx, dword ptr [40FFDC]
00404C3B . 8D4C24 14 lea ecx, dword ptr [esp+14]
00404C3F . 68 04010000 push 104 ; /BufSize = 104 (260.)
00404C44 . 51 push ecx ; |PathBuffer
00404C45 . 52 push edx ; |hModule => NULL
00404C46 . FF15 48C04000 call dword ptr [<&KERNEL32.GetModuleF>; \GetModuleFileNameA
00404C4C . 8D4424 14 lea eax, dword ptr [esp+14]
00404C50 . 6A 5C push 5C ; /c = 5C ('\')
00404C52 . 50 push eax ; |s
00404C53 . FF15 ACC34000 call dword ptr [<&MSVCRT.strrchr>] ; \strrchr
00404C59 . 8BD0 mov edx, eax
00404C5B . BF F8FE4000 mov edi, 0040FEF8
00404C60 . 83C9 FF or ecx, FFFFFFFF
00404C63 . 33C0 xor eax, eax
00404C65 . 83C4 08 add esp, 8
00404C68 . F2:AE repne scas byte ptr es:[edi]
00404C6A . F7D1 not ecx
00404C6C . 2BF9 sub edi, ecx
00404C6E . 8BC1 mov eax, ecx
00404C70 . 8BF7 mov esi, edi
00404C72 . 8BFA mov edi, edx
00404C74 . C1E9 02 shr ecx, 2
00404C77 . F3:A5 rep movs dword ptr es:[edi], dword p>
00404C79 . 8BC8 mov ecx, eax
00404C7B . 33C0 xor eax, eax
00404C7D . 83E1 03 and ecx, 3
00404C80 . F3:A4 rep movs byte ptr es:[edi], byte ptr>
00404C82 . BF 44FC4000 mov edi, 0040FC44 ; ASCII "\silk.dll"
往回找 Call 的來源
找到
00404BA8 |. 51 push ecx 00404BA9 |. 52 push edx 00404BAA |. 8BCD mov ecx, ebp 00404BAC |. E8 5F000000 call 00404C10 ; 這裡進入解壓縮 Silk.dll 00404BB1 |. 56 push esi ; /block 00404BB2 |. 8BF8 mov edi, eax ; | 00404BB4 |. E8 475D0000 call <jmp.&MFC42.#operator delete_825>; \free
把 00404BAC call 00404C10 改為 call 00404D05 <retn 8>
防止修改好的 silk.dll 被覆寫
SILK.DLL Patch
=========================================
一 認證帳號替換 Patch
=========================================
搜尋 %sconf\%s.cfg 第一個 Call
找到
100258AB |. 50 push eax ; 遊戲帳號指標 100258AC |. 51 push ecx 100258AD |. E8 5E8F0100 call 1003E810 ; 這裡 Call Patch <Patch> 1007EBD8 . 50 push eax 1007EBD9 . 52 push edx 1007EBDA . 51 push ecx 1007EBDB . B9 60EC0710 mov ecx, 1007EC60 ; 要寫入的帳號指標(有註冊動力的帳號) 1007EBE0 > 8A11 mov dl, byte ptr [ecx] ; 字串移動處理 1007EBE2 . 84D2 test dl, dl 1007EBE4 . 74 0A je short 1007EBF0 1007EBE6 . 8810 mov byte ptr [eax], dl 1007EBE8 . 83C0 01 add eax, 1 1007EBEB . 83C1 01 add ecx, 1 1007EBEE .^ EB F0 jmp short 1007EBE0 1007EBF0 > C600 00 mov byte ptr [eax], 0 1007EBF3 . 59 pop ecx 1007EBF4 . 5A pop edx 1007EBF5 . 58 pop eax 1007EBF6 .^ E9 15FCFBFF jmp 1003E810
50 52 51 B9 60 EC 07 10 8A 11 84 D2 74 0A 88 10 83 C0 01 83 C1 01 EB F0 C6 00 00 59 5A 58 E9 15 FC FB FF
=========================================
二 追加 Send Patch
=========================================
搜尋 (ws2_32.send) 函數 找到如下 Code
1001F7F0 /$ 8B4424 08 mov eax, dword ptr [esp+8] 1001F7F4 |. 8B5424 04 mov edx, dword ptr [esp+4] 1001F7F8 |. 6A 00 push 0 ; /以下 NOP 改為 JMP Patch 1001F7FA |. 50 push eax ; |DataSize 1001F7FB |. 8B81 14200000 mov eax, dword ptr [ecx+2014] ; | 1001F801 |. 52 push edx ; |Data 1001F802 |. 50 push eax ; |Socket 1001F803 |. FF15 28F70710 call dword ptr [<&WS2_32.#19>] ; \send 1001F809 \. C2 0800 retn 8
改為
1001F7F0 $ 8B4424 08 mov eax, dword ptr [esp+8] 1001F7F4 . 8B5424 04 mov edx, dword ptr [esp+4] 1001F7F8 . E9 00F30500 jmp 1007EAFD ; JMP <Patch> 1001F7FD 90 nop 1001F7FE 90 nop
<Patch> 1007EBFD > \66:813A 0101 cmp word ptr [edx], 101 ; 比較封包開頭是否0101 1007EC02 . 75 05 jnz short 1007EC09 1007EC04 . E8 14000000 call 1007EC1D ; 字串替換處理 1007EC09 > 6A 00 push 0 ; /原來的代碼移到此處 1007EC0B . 50 push eax ; |DataSize 1007EC0C . 8B81 14200000 mov eax, dword ptr [ecx+2014] ; | 1007EC12 . 52 push edx ; |Data 1007EC13 . 50 push eax ; |Socket 1007EC14 . FF15 28F70710 call dword ptr [<&WS2_32.#19>] ; \send 1007EC1A . C2 0800 retn 8 1007EC1D /$ 52 push edx 1007EC1E |. 51 push ecx 1007EC1F |. 53 push ebx 1007EC20 |. B9 60EC0710 mov ecx, 1007EC60 ; 要寫入的帳號指標(有註冊動力的帳號) 1007EC25 |. 83C2 08 add edx, 8 ; edx+8 為帳號字串開始處 1007EC28 |. BB 00000000 mov ebx, 0 1007EC2D |> 8A01 /mov al, byte ptr [ecx] 1007EC2F |. 84C0 |test al, al 1007EC31 |. 74 0D |je short 1007EC40 1007EC33 |. 8802 |mov byte ptr [edx], al 1007EC35 |. 83C2 01 |add edx, 1 1007EC38 |. 83C1 01 |add ecx, 1 1007EC3B |. 83C3 01 |add ebx, 1 ; 計算字串長度 1007EC3E |.^ EB ED \jmp short 1007EC2D 1007EC40 |> C602 00 mov byte ptr [edx], 0 1007EC43 |. 83C3 09 add ebx, 9 ; 字串長度+9=封包大小 1007EC46 |. 8BC3 mov eax, ebx ; 封包大小數值移到EAX 1007EC48 |. 5B pop ebx 1007EC49 |. 59 pop ecx 1007EC4A |. 5A pop edx 1007EC4B |. 8842 02 mov byte ptr [edx+2], al ; 封包大小寫入封包指標+2位置 1007EC4E \. C3 retn
66 81 3A 01 01 75 05 E8 14 00 00 00 6A 00 50 8B 81 14 20 00 00 52 50 FF 15 28 F7 07 10 C2 08 00 52 51 53 B9 60 EC 07 10 83 C2 08 BB 00 00 00 00 8A 01 84 C0 74 0D 88 02 83 C2 01 83 C1 01 83 C3 01 EB ED C6 02 00 83 C3 09 8B C3 5B 59 5A 88 42 02 C3
=========================================
三 開始掛機按鈕 Patch
=========================================
搜尋字串 cmp eax, 2D
找到
1004BEDE |> \83F8 2D cmp eax, 2D
1004BEE1 |. 75 57 jnz short 1004BF3A
1004BEE3 |. 8B86 54040000 mov eax, dword ptr [esi+454] ; 開始掛機按鈕; Case 2D ('-') of switch 1004BEB5
1004BEE9 |. 85C0 test eax, eax
1004BEEB |. 74 11 je short 1004BEFE
1004BEED |. 8B46 14 mov eax, dword ptr [esi+14]
1004BEF0 |. 5E pop esi
1004BEF1 |. C780 24B70000>mov dword ptr [eax+B724], 1 ; 啟動外掛紀錄位置
1004BEFB |. C2 0400 retn 4
登入認證代碼為 [e??+454] HEX 54 04 00 00
=========================================
防開始掛機按鈕反白
=========================================
搜尋 push 0C30
找到
100631D0 > \6A 00 push 0 100631D2 . 68 300C0000 push 0C30 100631D7 . E8 C8750100 call <jmp.&MFC42.#CWnd::GetDlgItem_30> 100631DC . 8BC8 mov ecx, eax 100631DE . E8 15760100 call <jmp.&MFC42.#CWnd::EnableWindow_> 100631E3 . C3 retn
找來源的 Call
找到
10057C10 /$ 56 push esi 10057C11 |. 8BF1 mov esi, ecx 10057C13 |. 8B86 0C4A0500 mov eax, dword ptr [esi+54A0C] 10057C19 |. 85C0 test eax, eax 10057C1B |. 0F84 E2000000 je 10057D03 10057C21 |. 8B8E 18040000 mov ecx, dword ptr [esi+418] 10057C27 |. C786 54040000>mov dword ptr [esi+454], 0 ; 驗證"開始掛機"按鈕 10057C31 |. 85C9 test ecx, ecx 10057C33 |. 74 05 je short 10057C3A ; 改為 JMP 10057C35 |. E8 D67CFBFF call 1000F910 ; 進入則開始掛機反白
改為
10057C27 C786 54040000>mov dword ptr [esi+454], 1 ; 驗證"開始掛機"按鈕 10057C31 |. 85C9 test ecx, ecx 10057C33 EB 05 jmp short 10057C3A ; 改為 JMP 10057C35 |. E8 D67CFBFF call 1000F910 ; 進入則開始掛機反白
=========================================
驗證登入
=========================================
搜尋 mov dword ptr [ecx+454], 0
找到
1001F910 . 56 push esi 1001F911 . 8BF1 mov esi, ecx 1001F913 . 57 push edi 1001F914 . 8B46 08 mov eax, dword ptr [esi+8] 1001F917 . 8B88 54040000 mov ecx, dword ptr [eax+454] 1001F91D . 85C9 test ecx, ecx 1001F91F . 74 65 je short 1001F986 1001F921 . 53 push ebx 1001F922 . 8B1D 64F00710 mov ebx, dword ptr [<&KERNEL32.GetTi>; kernel32.GetTickCount 1001F928 . FFD3 call ebx ; [GetTickCount 1001F92A . 8B15 8043C210 mov edx, dword ptr [10C24380] 1001F930 . 8BF8 mov edi, eax 1001F932 . 8BCF mov ecx, edi 1001F934 . 2BCA sub ecx, edx 1001F936 . 81F9 88130000 cmp ecx, 1388 1001F93C . 76 29 jbe short 1001F967 1001F93E . 8B56 08 mov edx, dword ptr [esi+8] 1001F941 . 8B42 14 mov eax, dword ptr [edx+14] 1001F944 . 8B88 A4390000 mov ecx, dword ptr [eax+39A4] 1001F94A . 85C9 test ecx, ecx 1001F94C . 74 19 je short 1001F967 1001F94E . 8BCE mov ecx, esi 1001F950 . E8 0B060000 call 1001FF60 1001F955 . 893D 8043C210 mov dword ptr [10C24380], edi 1001F95B . 8B46 14 mov eax, dword ptr [esi+14] 1001F95E . 85C0 test eax, eax 1001F960 . 75 05 jnz short 1001F967 1001F962 . FFD3 call ebx 1001F964 . 8946 14 mov dword ptr [esi+14], eax 1001F967 > 8B46 14 mov eax, dword ptr [esi+14] 1001F96A . 5B pop ebx 1001F96B . 85C0 test eax, eax 1001F96D . 74 17 je short 1001F986 1001F96F . 2BF8 sub edi, eax 1001F971 . 81FF E0930400 cmp edi, 493E0 1001F977 . 76 0D jbe short 1001F986 1001F979 . 8B4E 08 mov ecx, dword ptr [esi+8] 1001F97C C781 54040000>mov dword ptr [ecx+454], 0 ; 這裡改為 mov dword ptr [ecx+454], 1 1001F986 > 5F pop edi 1001F987 . 5E pop esi 1001F988 . C3 retn
=========================================
接收封包認證
=========================================
搜尋 cmp eax, 202
找到
1001FD53 > \8A41 04 mov al, byte ptr [ecx+4] ; Case 101 of switch 1001FD0A 1001FD56 3C 01 cmp al, 1 ; 改為 mov al, 1 1001FD58 75 0B jnz short 1001FD65 ; NOP 1001FD5A . 8BCE mov ecx, esi 1001FD5C . E8 9FFBFFFF call 1001F900 ; 進入 Login OK 1001FD61 . 5E pop esi 1001FD62 . C2 0800 retn 8
=========================================
