老刀M2 [封加速攻击]分析结果!
========================
0fsVbC
004CB827 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0fsVbC
004CB82A 2B82 08060000 SUB EAX,DWORD PTR DS:[EDX+608]
0fsVbC
004CB830 50 PUSH EAX
0fsVbC
004CB831 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0fsVbC
004CB834 0FBE80 6E020000 MOVSX EAX,BYTE PTR DS:[EAX+26E]
0fsVbC
004CB83B 6BC0 40 IMUL EAX,EAX,40
0fsVbC
004CB83E 50 PUSH EAX
0fsVbC
004CB83F B8 29030000 MOV EAX,329
0fsVbC
004CB844 5A POP EDX
0fsVbC
004CB845 2BC2 SUB EAX,EDX
0fsVbC
004CB847 813C24 30020000 CMP DWORD PTR SS:[ESP],210
0fsVbC
004CB853 5A POP EDX
0fsVbC
004CB84E 7C 60 JL SHORT 祈祷M2Se.004CB8B0 小于即双倍
0fsVbC
004CB850 3B0424 CMP EAX,edx
0fsVbC
004CB854 76 11 JLE SHORT 祈祷M2Se.004CB867 <= 低于或等于
0fsVbC
004CB856 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0fsVbC
004CB859 05 10060000 ADD EAX,610
0fsVbC
CMP BYTE PTR DS:[EAX+4],0
0fsVbC
JLE SHORT 祈祷M2Se.004CB85E
0fsVbC
DEC BYTE PTR DS:[EAX+4]
0fsVbC
JMP SHORT 祈祷M2Se.004CB8B0
0fsVbC
004CB85E 8A10 MOV DL,BYTE PTR DS:[EAX]
0fsVbC
004CB860 80C2 04 ADD DL,4
0fsVbC
004CB863 8810 MOV BYTE PTR DS:[EAX],DL
0fsVbC
jmp 004CB886
0fsVbC
004CB867 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0fsVbC
004CB86A 05 10060000 ADD EAX,610
0fsVbC
004CB86F 8A10 MOV DL,BYTE PTR DS:[EAX]
0fsVbC
004CB871 80FA 01 CMP DL,1
0fsVbC
004CB874 7E 05 JLE SHORT 祈祷M2Se.004CB87B
0fsVbC
004CB876 80EA 01 SUB DL,1
0fsVbC
004CB879 8810 MOV BYTE PTR DS:[EAX],DL
0fsVbC
004CB886 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0fsVbC
004CB889 8B40 5C MOV EAX,DWORD PTR DS:[EAX+5C]
0fsVbC
004CB88C A9 00000004 TEST EAX,4000000
0fsVbC
004CB891 75 1D JNZ SHORT 祈祷M2Se.004CB8B0
0fsVbC
004CB893 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0fsVbC
004CB896 83B8 10060000 09 CMP DWORD PTR DS:[EAX+610],9
0fsVbC
004CB89D 7E 16 JLE SHORT 祈祷M2Se.004CB8B5
0fsVbC
004CB89F B2 06 MOV DL,6
0fsVbC
004CB8A1 90 NOP
0fsVbC
004CB8A2 8890 10060000 MOV BYTE PTR DS:[EAX+610],DL
0fsVbC
004CB8A8 B2 02 MOV DL,2
0fsVbC
004CB8AA 8890 14060000 MOV BYTE PTR DS:[EAX+614],DL
0fsVbC
004CB8B0 E9 C2020000 JMP 祈祷M2Se.004CBC19
0fsVbC
004CB8B5 80B8 04030000 00 CMP BYTE PTR DS:[EAX+304],0
0fsVbC
004CB8BC 0F85 57030000 JNZ 祈祷M2Se.004CBC19
390~~3a0
加速度 0~~1 330 ~~ 340 33c~~33e (严格) 3a1 ~~~~ 340
0fsVbC
加速度 0~~2 29c ~~ 305
0fsVbC
加速度 0~~4 298 ~~ 29c
0fsVbC
2 卡 5
004CB830 3D 3C 03 00 00 76 27 EB 30 90 90 =<..v'???
0fsVbC
(m-n)*x=y+n
0fsVbC
标题: 老刀M2 [封加速跑]分析结果!
0fsVbC
:004CB146 E861C1F3FF Call 004072AC
0fsVbC
:004CB14B 8B55FC mov edx, dword ptr [ebp-04]
0fsVbC
:004CB14E 2B820C060000 sub eax, dword ptr [edx+0000060C]
0fsVbC
:004CB154 3D58020000 cmp eax, 00000258 间隔~~ 656
0fsVbC
:004CB159 7314 jnb 004CB16F ---高于或等于
0fsVbC
:004CB15B 8B45FC mov eax, dword ptr [ebp-04]
0fsVbC
:004CB15E FF801C060000 inc dword ptr [eax+0000061C]
0fsVbC
:004CB164 8B45FC mov eax, dword ptr [ebp-04]
0fsVbC
:004CB167 FF8020060000 inc dword ptr [eax+00000620]
0fsVbC
:004CB16D EB20 jmp 004CB18F
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
0fsVbC
|:004CB159(C)
0fsVbC
|
0fsVbC
:004CB16F 8B45FC mov eax, dword ptr [ebp-04]
0fsVbC
:004CB172 33D2 xor edx, edx
0fsVbC
:004CB174 89901C060000 mov dword ptr [eax+0000061C], edx
0fsVbC
:004CB17A 8B45FC mov eax, dword ptr [ebp-04]
0fsVbC
:004CB17D 83B82006000000 cmp dword ptr [eax+00000620], 00000000
0fsVbC
:004CB184 7E09 jle 004CB18F
0fsVbC
:004CB186 8B45FC mov eax, dword ptr [ebp-04]
0fsVbC
:004CB189 FF8820060000 dec dword ptr [eax+00000620]
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
0fsVbC
|:004CB16D(U), :004CB184(C)
0fsVbC
|
* Reference T kernel32.GetTickCount, Ord:0000h
0fsVbC
|
0fsVbC
:004CB18F E818C1F3FF Call 004072AC
0fsVbC
:004CB194 8B55FC mov edx, dword ptr [ebp-04]
0fsVbC
:004CB197 89820C060000 mov dword ptr [edx+0000060C], eax
0fsVbC
:004CB19D 8B45FC mov eax, dword ptr [ebp-04]
0fsVbC
:004CB1A0 83B81C06000004 cmp dword ptr [eax+0000061C], 00000004 ----跑02
0fsVbC
:004CB1A7 0F8DF0000000 jnl 004CB29D
0fsVbC
:004CB1AD 8B45FC mov eax, dword ptr [ebp-04]
0fsVbC
:004CB1B0 83B82006000006 cmp dword ptr [eax+00000620], 00000006 ----02
0fsVbC
:004CB1B7 0F8DE0000000 jnl 004CB29D
0fsVbC
:004CB1BD 8B45FC mov eax, dword ptr [ebp-04]
0fsVbC
:004CB1C0 C6801603000000 mov byte ptr [eax+00000316], 00
0fsVbC
:004CB1C7 8B45F4 mov eax, dword ptr [ebp-0C]
0fsVbC
:004CB1CA 50 push eax
0fsVbC
=====================================
0fsVbC
004CB142 C645 F3 00 MOV BYTE PTR SS:[EBP-D],0
0fsVbC
004CB146 E8 61C1F3FF CALL
0fsVbC
004CB14B 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0fsVbC
004CB14E 2B82 0C060000 SUB EAX,DWORD PTR DS:[EDX+60C]
0fsVbC
004CB154 8D8A 1C060000 LEA ECX,DWORD PTR DS:[EDX+61C]
0fsVbC
004CB15A 3D 40010000 CMP EAX,140
0fsVbC
004CB15F 72 10 JB SHORT 祈祷M2Se.004CB171 < 低于
0fsVbC
004CB161 3D 10020000 CMP EAX,210
0fsVbC
004CB166 73 19 JNB SHORT 祈祷M2Se.004CB181 >= 高于或等于
0fsVbC
004CB168 8079 04 00 CMP BYTE PTR DS:[ECX+4],0
0fsVbC
004CB16C 7E 08 JLE SHORT 祈祷M2Se.004CB176
0fsVbC
004CB16E FE49 04 DEC BYTE PTR DS:[ECX+4]
0fsVbC
004CB171 E9 BB010000 JMP 祈祷M2Se.004CB331
0fsVbC
004CB176 8A11 MOV DL,BYTE PTR DS:[ECX]
0fsVbC
004CB178 80C2 04 ADD DL,4
0fsVbC
004CB17B 8811 MOV BYTE PTR DS:[ECX],DL
0fsVbC
004CB17D EB 0E JMP SHORT 祈祷M2Se.004CB18D
0fsVbC
004CB17F 90 NOP
0fsVbC
004CB180 90 NOP
0fsVbC
004CB181 8A11 MOV DL,BYTE PTR DS:[ECX]
0fsVbC
004CB183 80FA 00 CMP DL,0
0fsVbC
004CB186 7E 05 JLE SHORT 祈祷M2Se.004CB18D
0fsVbC
004CB188 80EA 01 SUB DL,1
0fsVbC
004CB18B 8811 MOV BYTE PTR DS:[ECX],DL
0fsVbC
004CB18D E8 1AC1F3FF CALL
0fsVbC
004CB192 8941 F0 MOV DWORD PTR DS:[ECX-10],EAX
0fsVbC
004CB195 8339 0D CMP DWORD PTR DS:[ECX],0D
0fsVbC
004CB198 7E 0F JLE SHORT 祈祷M2Se.004CB1A9
0fsVbC
004CB19A C701 04000000 MOV DWORD PTR DS:[ECX],4
0fsVbC
004CB1A0 C640 04 01 MOV BYTE PTR DS:[EAX+4],1
0fsVbC
004CB1A4 E9 88010000 JMP 祈祷M2Se.004CB331
0fsVbC
004CB1A9 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0fsVbC
004CB1AC C680 16030000 00 MOV BYTE PTR DS:[EAX+316],0
0fsVbC
004CB1B3 8B40 5C MOV EAX,DWORD PTR DS:[EAX+5C]
0fsVbC
004CB1B6 A9 00000004 TEST EAX,4000000
0fsVbC
004CB1BB 0F85 70010000 JNZ 祈祷M2Se.004CB331
0fsVbC
004CB1C1 90 NOP
0fsVbC
004CB1C2 90 NOP
0fsVbC
004CB1C3 90 NOP
0fsVbC
004CB1C4 90 NOP
0fsVbC
004CB1C5 90 NOP
0fsVbC
004CB1C6 90 NOP
0fsVbC
004CB1C7 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
0fsVbC
004CB1CA 50 PUSH EAX
0fsVbC
004CB1CB 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
290~~~300 时间 2c0 ~~~~ 2c6 推荐2c3 2 ~~~ 1
0fsVbC
3~~1
004CB154 02 00 00 73 0B 8B 45 FC FF 80 ..s ???.
----------------------------------------------
老刀M2 [封反反麻痹外挂]分析结果!
0fsVbC
:004CB892 8B45FC mov eax, dword ptr [ebp-04]
0fsVbC
push eax
0fsVbC
:004CB895 83B81006000002 cmp dword ptr [eax+00000610], 00000002
0fsVbC
:004CB89C 0F8D jl ss
0fsVbC
aaaaaaaaaa jmp 004CBB77
0fsVbC
:004CAFA9 8B405C mov eax, dword ptr [eax+5C]
0fsVbC
:004CAFAC A900000004 test eax, 04000000
0fsVbC
:004CAFB1 75E1 jne dd
0fsVbC
pop eax
0fsVbC
:004CB8B5 80B80403000000 cmp byte ptr [eax+00000304], 00
0fsVbC
:004CB8BC 0F8557030000 jne 004CBC19
-----------------
0fsVbC
:004CB85E 8B45FC mov eax, dword ptr [ebp-04]
0fsVbC
:004CB861 FF8010060000 inc dword ptr [eax+00000610] --- +1
0fsVbC
:004CB86A FF8014060000 inc dword ptr [eax+00000614] --- +1
0fsVbC
:004CB870 EB20 jmp 004CB892
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
0fsVbC
|:004CB856(C), :004CB85C(C)
0fsVbC
|
0fsVbC
:004CB872 8B45FC mov eax, dword ptr [ebp-04]
0fsVbC
:004CB875 33D2 xor edx, edx
0fsVbC
:004CB877 899010060000 mov dword ptr [eax+00000610], edx
0fsVbC
:004CB880 83B81406000000 cmp dword ptr [eax+00000614], 00000000
0fsVbC
:004CB887 7E09 jle 004CB892
0fsVbC
:004CB88C FF8814060000 dec dword ptr [eax+00000614] --- -1
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
0fsVbC
|:004CB870(U), :004CB887(C)
0fsVbC
004CB889 8B40 5C MOV EAX,DWORD PTR DS:[EAX+5C]
?!8M
I,c/
004CB88C A9 00000004 TEST EAX,4000000
?!8M
I,c/
004CB891 75 0C JNZ SHORT m2server.004CB89F --- 麻痹
?!8M
I,c/
004CB893 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
?!8M
I,c/
004CB896 83B8 10060000 02 CMP DWORD PTR DS:[EAX+610],2
?!8M
I,c/
004CB89D 7C 05 JL SHORT m2server.004CB8A4 ----继续
?!8M
I,c/
004CB89F E9 D3020000 JMP m2server.004CBB77
?!8M
I,c/
004CB8A4 83B8 14060000 02 CMP DWORD PTR DS:[EAX+614],2
?!8M
I,c/
004CB8AB ^7D F2 JGE SHORT m2server.004CB89f
?!8M
I,c/
004CB8AD 80B8 04030000 00 CMP BYTE PTR DS:[EAX+304],0
?!8M
I,c/
004CB8B4 0F85 5F030000 JNZ m2server.004CBC19
?!8M
I,c/
8B45FCFF8010060000FF8014060000EB208B45FC33D289901006000083B814060000007E09FF8814060000508B405CA900000004752883B810060000047c05e9d502000083B814060000067df25880B804030000000F8557030000909090909090909090
?!8M
I,c/
8B45FCFF80100600008B45FCFF8014060000EB208B45FC33D28990100600008B45FC83B814060000007E098B45FCFF88140600008B45FC83B810060000040F8DD50200008B45FC83B814060000060F8DC50200008B45FC80B804030000000F8557030000
83B810060000047c05e9d502000083B814060000067df258
5883B810060000047c05e9d402000083B814060000067df2
老刀M2 [检查沙城老大功能]分析结果!
========================
:004D2610 A180A04E00 mov eax, dword ptr [004EA080]
?!8M
I,c/
:004D2615 8B00 mov eax, dword ptr [eax]
?!8M
I,c/
:004D2617 8B4020 mov eax, dword ptr [eax+20] ----应该是读取沙行会
?!8M
I,c/
:004D261A 8B55FC mov edx, dword ptr [ebp-04] ----确定操作人
?!8M
I,c/
:004D261D 3B8220030000 cmp eax, dword ptr [edx+00000320] --操作人行会和沙比较
?!8M
I,c/
:004D2623 752D jne 004D2652 ----不等(不是沙的)就跳
==================================================
:004CE9F0 55 push ebp
?!8M
I,c/
:004CE9F1 8BEC mov ebp, esp
?!8M
I,c/
:004CE9F3 83C4E8 add esp, FFFFFFE8
?!8M
I,c/
:004CE9F6 33C9 xor ecx, ecx
?!8M
I,c/
:004CE9F8 894DE8 mov dword ptr [ebp-18], ecx
?!8M
I,c/
:004CE9FB 8955F8 mov dword ptr [ebp-08], edx
?!8M
I,c/
:004CE9FE 8945FC mov dword ptr [ebp-04], eax
?!8M
I,c/
:004CEA01 8B45F8 mov eax, dword ptr [ebp-08]
?!8M
I,c/
:004CEA04 E87756F3FF call 00404080
?!8M
I,c/
:004CEA09 33C0 xor eax, eax
?!8M
I,c/
:004CEA0B 55 push ebp
?!8M
I,c/
:004CEA0C 6839EB4C00 push 004CEB39
?!8M
I,c/
:004CEA11 64FF30 push dword ptr fs:[eax]
?!8M
I,c/
:004CEA14 648920 mov dword ptr fs:[eax], esp
?!8M
I,c/
:004CEA17 8B45FC mov eax, dword ptr [ebp-04] -----恢复操作人标记
?!8M
I,c/
:004CEA1A E8810AFFFF call 004BF4A0
?!8M
I,c/
:004CEA1F 84C0 test al, al
?!8M
I,c/
:004CEA21 0F84E5000000 je 004CEB0C -----不是老大就跳
?!8M
I,c/
------------------------
?!8M
I,c/
8B4508 mov eax, dword ptr [ebp+08]
?!8M
I,c/
8B40FC mov eax, dword ptr [eax-04]
==============++++++++++++++++++开始
?!8M
I,c/
0F8490909090 je 004D1BBE
58 pop eax
?!8M
I,c/
“位置”
?!8M
I,c/
BA1E1D4D00 mov edx, 004D1D1E
?!8M
I,c/
E8C071F3FF call 00408D40
?!8M
I,c/
85C0 test eax, eax
?!8M
I,c/
7512 jne 004D1B9C
?!8M
I,c/
8B4508 mov eax, dword ptr [ebp+08]
?!8M
I,c/
8B40FC mov eax, dword ptr [eax-04] ---操作人
?!8M
I,c/
E8F4D0FEFF call 004BF4A0
?!8M
I,c/
84C0 test al, al
?!8M
I,c/
7434 je ---- #act 不是老大
?!8M
I,c/
C645FB00 mov [ebp-05], 00 ----#ELSEACT 是老大
?!8M
I,c/
E9AAAAFCFF jmp 0049C78F
?!8M
I,c/
----------------------------------------------
?!8M
I,c/
7426c645fb0058BA04574d00e8aae4f7ff85C075868B45088B40FCE8fb4b030084C07504c645fb00E9dd1e010090
74c0c645fb00ebc758BA04574d00e8aae4f7ff85C075868B45088B40FCE8fb4b030084C07504c645fb00eb969090
8B55D0 mov edx, dword ptr [ebp-30]
?!8M
I,c/
8B4204 mov eax, dword ptr [edx+04]
?!8M
I,c/
50 push eax
?!8M
I,c/
“关闭”
?!8M
I,c/
BAD0034D00 mov edx, 004D03D0
?!8M
I,c/
E8C071F3FF call 00408D40
?!8M
I,c/
85C0 test eax, eax
?!8M
I,c/
7512 jne 0048a820 ------位置确定咯~!
?!8M
I,c/
58 pop eax --------
?!8M
I,c/
8B4508 mov eax, dword ptr [ebp+08]
?!8M
I,c/
8B50FC mov edx, dword ptr [eax-04] ----确定操作人
?!8M
I,c/
A180A04E00 mov eax, dword ptr [004EA080]
?!8M
I,c/
8B00 mov eax, dword ptr [eax]
?!8M
I,c/
8B4020 mov eax, dword ptr [eax+20] ----应该是读取沙行会
3B8220030000 cmp eax, dword ptr [edx+00000320] --操作人行会和沙比较
?!8M
I,c/
7504 jne 004D2652 -----#ACT (不是沙的)
?!8M
I,c/
C645FB00 mov [ebp-05], 00 ----#ELSEACT 是老大
---------------------
?!8M
I,c/
909090909090
?!8M
I,c/
909090FCFF84C0750533C08945E08B45E8E8D997FCFF84C0750533C08945E08D55A48B45F0E8F5E3F7FF8B45A4BAF8AE4800E84C97F7FF7521C745E0090000008D45EC508D45A050B9B0AE4800BABCAE48008B45ECE83D98FCFF
?!8M
I,c/
-------
?!8M
I,c/
0F85698b04008B55D08B42048B55D08B4204BAD0034D00E8C071F3FF7512A180A04E008B008B40208B55FC3B82200300007504C645FB00BA1E1D4D00E8C071F3FF85C075128B45FCE8F4D0FEFF84C07434C645FB00E9AAAAFCFF909090909090
?!8M
I,c/
----
?!8M
I,c/
0F84657304008B55D08B420450BAD0034D00E8C071F3FF85C07512588B45088B50FCA180A04E008B008B40203B82200300007504C645FB0058BA1E1D4D00E8C071F3FF85C075128B45088B40FCE8F4D0FEFF84C07434C645FB00E9AAAAFCFF90
?!8M
I,c/