技能遍历
突破口[冷却时间]
操作步骤:
1.回城1小时 = 60X60X1000毫秒,扫描4字节数据 尝试大于60*000
2.搜索减少的数值
3.重复步骤2N次,能定位到技能冷却倒计时
4.定位冷却时间36D73164
5.OD中硬件访问断点36D73164
6.断与如下代码片段
004E7A30 /$ 8A41 14 mov al, byte ptr [ecx+14]
004E7A33 |. 84C0 test al, al
004E7A35 |. 74 22 je short 004E7A59
004E7A37 |. A1 1CDFD000 mov eax, dword ptr [D0DF1C]
004E7A3C |. 8B90 94070000 mov edx, dword ptr [eax+794]
004E7A42 |. 8B41 0C mov eax, dword ptr [ecx+C];//倒计时[1]
004E7A45 |. 2BC2 sub eax, edx
004E7A47 |. 85C0 test eax, eax
004E7A49 |. 8941 0C mov dword ptr [ecx+C], eax
004E7A4C |. 7F 0B jg short 004E7A59
004E7A4E |. C741 0C 00000>mov dword ptr [ecx+C], 0
Ctrl+F9 返回到
00497DF0 /$ A1 1CDFD000 mov eax, dword ptr [D0DF1C]
00497DF5 |. 53 push ebx
00497DF6 |. 55 push ebp
00497DF7 |. 56 push esi
00497DF8 |. 8BF1 mov esi, ecx
00497DFA |. 57 push edi
00497DFB |. 8BB8 94070000 mov edi, dword ptr [eax+794]
00497E01 |. 33ED xor ebp, ebp
00497E03 |. 8B86 980B0000 mov eax, dword ptr [esi+B98]
00497E09 |. 33DB xor ebx, ebx
00497E0B |. 3BC5 cmp eax, ebp
00497E0D |. 7E 19 jle short 00497E28
00497E0F |> 8B8E 940B0000 /mov ecx, dword ptr [esi+B94] ; 24CBF970
00497E15 |. 8B0C99 |mov ecx, dword ptr [ecx+ebx*4]
00497E18 |. E8 13FC0400 |call 004E7A30 ; 技能冷却[ecx+C]倒计时[2]
00497E1D |. 8B86 980B0000 |mov eax, dword ptr [esi+B98]
00497E23 |. 43 |inc ebx
00497E24 |. 3BD8 |cmp ebx, eax
00497E26 |.^ 7C E7 \jl short 00497E0F
00497E28 |> 8B86 B00B0000 mov eax, dword ptr [esi+BB0]
ecx, dword ptr [esi+B94] ; 24CBF970
esi 27FE0540+B94 = 24CBF970
ecx=esi==>27FE0540
00493119 . /72 19 jb short 00493134
0049311B . |C785 B0080000>mov dword ptr [ebp+8B0], 0
00493125 . |8B85 700B0000 mov eax, dword ptr [ebp+B70]
0049312B . |50 push eax
0049312C . |E8 AF573200 call 007B88E0
00493131 . |83C4 04 add esp, 4
00493134 > \57 push edi
00493135 . 8BCD mov ecx, ebp
00493137 . E8 B44C0000 call 00497DF0
====>>>>27FE0540
0045A855 |. 8B6C24 5C mov ebp, dword ptr [esp+5C]
0045A859 |. 898E 30010000 mov dword ptr [esi+130], ecx
0045A85F |. 8B50 04 mov edx, dword ptr [eax+4]
0045A862 |. 8996 34010000 mov dword ptr [esi+134], edx
0045A868 |. 8B40 08 mov eax, dword ptr [eax+8]
0045A86B |. 8986 38010000 mov dword ptr [esi+138], eax
0045A871 |. 8B4F 28 mov ecx, dword ptr [edi+28];//<<<<======================
0045A874 |. 85C9 test ecx, ecx
0045A876 |. 0F84 A2010000 je 0045AA1E
0045A87C |. 8A81 8C080000 mov al, byte ptr [ecx+88C]
0045A882 |. 84C0 test al, al
0045A884 |. 0F84 94010000 je 0045AA1E
0045A88A |. 8B11 mov edx, dword ptr [ecx] ; 44
0045A88C |. 55 push ebp
0045A88D |. C64424 64 01 mov byte ptr [esp+64], 1
0045A892 |. FF52 44 call dword ptr [edx+44]
====>>>>27FE0540 = 03E525A8+28
edi = 03E525A8
00449515 |> \8B8D 90070000 mov ecx, dword ptr [ebp+790]
0044951B |. 51 push ecx
0044951C |. 8B4D 1C mov ecx, dword ptr [ebp+1C] ; //<<<<======================ecx=03E525A8
0044951F |. E8 CCFE0000 call 004593F0 ; 5
edi = 03E525A8
edi = 00D11A50+1C
7.最终结果是数组,暂不确定是什么技能
8.公式: [[[[[00D0DF1C]+1C]+28]+B94]+0*4]+C = 技能冷却时间
[[[[[00D0DF1C]+1C]+28]+B94]+3*4]+C // 回城术冷却时间
9.数组长度13(16进制)=19个 不知道是啥