|
验证码窗口,选第四项,
mov edx,dword ptr ss:[ebp-0x78] /地址值为3(第四项=3)
mov dword ptr ss:[ebp-0x88],edx /地址值为3(第四项=3)
怎么找到这2句的动态地址
汇编EBP-78是动态地址,每次重启游戏都会变,问题在于怎么找到这个动态地址的来源基址?
mov edx,dword ptr ss:[ebp-0x78]
0057B400 /. 55 push ebp
0057B401 |. 8BEC mov ebp,esp
.................................................................
......................................................................
................................................................
0057B61C |. 8B55 88 mov edx,[local.30] ; 堆栈 ss:[0018F018]=00000003 选中4写入3 地址值为3(第四项=3)
0057B61F |. 8B0D A4033501 mov ecx,dword ptr ds:[0x13503A4]
0057B625 |. 8B45 84 mov eax,[local.31] ; 堆栈 ss:[0018F044]=00000000
0057B628 |. 8995 78FFFFFF mov [local.34],edx ; edx=00000002 18F050 地址值为3(第四项=3)
0057B62E |. 8B15 F8E89900 mov edx,dword ptr ds:[0x99E8F8] ; ds:[0099E8F8]=00000001
0057B634 |. 8985 7CFFFFFF mov [local.33],eax ; eax=00000000
0057B63A |. 897D 80 mov [local.32],edi
0057B63D |. 8991 58697E00 mov dword ptr ds:[ecx+0x7E6958],edx ; edx=00000001 000
0057B643 |. A1 E0F03501 mov eax,dword ptr ds:[0x135F0E0]
0057B648 |. 8B0D A4033501 mov ecx,dword ptr ds:[0x13503A4]
0057B64E |. 8B40 30 mov eax,dword ptr ds:[eax+0x30]
0057B651 |. 83C4 44 add esp,0x44 ; esp=0018EFD8
0057B654 |. 8D95 68FFFFFF lea edx,[local.38] ; 堆栈地址=0018F028 EDX=1
0057B65A |. 8981 54697E00 mov dword ptr ds:[ecx+0x7E6954],eax ; 0
0057B660 |. 8B0D 54D93501 mov ecx,dword ptr ds:[0x135D954]
0057B666 |. 52 push edx ; edx=0018F040
0057B667 |. E8 14AA0F00 call Game.00676080
|
|