1.口袋西游技能遍历跟踪(01)

突破口[冷却时间]

操作步骤:
1.回城1小时 = 60X60X1000毫秒,扫描4字节数据 尝试大于60*000
2.搜索减少的数值
3.重复步骤2N次,能定位到技能冷却倒计时

4.定位冷却时间36D73164
5.OD中硬件访问断点36D73164
6.断与如下代码片段

004E7A30  /$  8A41 14       mov     al, byte ptr [ecx+14]
004E7A33  |.  84C0          test    al, al
004E7A35  |.  74 22         je      short 004E7A59
004E7A37  |.  A1 1CDFD000   mov     eax, dword ptr [D0DF1C]
004E7A3C  |.  8B90 94070000 mov     edx, dword ptr [eax+794]
004E7A42  |.  8B41 0C       mov     eax, dword ptr [ecx+C];//倒计时[1]
004E7A45  |.  2BC2          sub     eax, edx
004E7A47  |.  85C0          test    eax, eax
004E7A49  |.  8941 0C       mov     dword ptr [ecx+C], eax
004E7A4C  |.  7F 0B         jg      short 004E7A59
004E7A4E  |.  C741 0C 00000>mov     dword ptr [ecx+C], 0

Ctrl+F9 返回到
00497DF0  /$  A1 1CDFD000   mov     eax, dword ptr [D0DF1C]
00497DF5  |.  53            push    ebx
00497DF6  |.  55            push    ebp
00497DF7  |.  56            push    esi
00497DF8  |.  8BF1          mov     esi, ecx
00497DFA  |.  57            push    edi
00497DFB  |.  8BB8 94070000 mov     edi, dword ptr [eax+794]
00497E01  |.  33ED          xor     ebp, ebp
00497E03  |.  8B86 980B0000 mov     eax, dword ptr [esi+B98]
00497E09  |.  33DB          xor     ebx, ebx
00497E0B  |.  3BC5          cmp     eax, ebp
00497E0D  |.  7E 19         jle     short 00497E28
00497E0F  |>  8B8E 940B0000 /mov     ecx, dword ptr [esi+B94]        ;  24CBF970
00497E15  |.  8B0C99        |mov     ecx, dword ptr [ecx+ebx*4]
00497E18  |.  E8 13FC0400   |call    004E7A30                        ;  技能冷却[ecx+C]倒计时[2]
00497E1D  |.  8B86 980B0000 |mov     eax, dword ptr [esi+B98]
00497E23  |.  43            |inc     ebx
00497E24  |.  3BD8          |cmp     ebx, eax
00497E26  |.^ 7C E7         \jl      short 00497E0F
00497E28  |>  8B86 B00B0000 mov     eax, dword ptr [esi+BB0]


ecx, dword ptr [esi+B94]        ;  24CBF970
esi 27FE0540+B94 = 24CBF970


ecx=esi==>27FE0540
00493119   . /72 19         jb      short 00493134
0049311B   . |C785 B0080000>mov     dword ptr [ebp+8B0], 0
00493125   . |8B85 700B0000 mov     eax, dword ptr [ebp+B70]
0049312B   . |50            push    eax
0049312C   . |E8 AF573200   call    007B88E0
00493131   . |83C4 04       add     esp, 4
00493134   > \57            push    edi
00493135   .  8BCD          mov     ecx, ebp
00493137   .  E8 B44C0000   call    00497DF0

====>>>>27FE0540
0045A855  |.  8B6C24 5C     mov     ebp, dword ptr [esp+5C]
0045A859  |.  898E 30010000 mov     dword ptr [esi+130], ecx
0045A85F  |.  8B50 04       mov     edx, dword ptr [eax+4]
0045A862  |.  8996 34010000 mov     dword ptr [esi+134], edx
0045A868  |.  8B40 08       mov     eax, dword ptr [eax+8]
0045A86B  |.  8986 38010000 mov     dword ptr [esi+138], eax
0045A871  |.  8B4F 28       mov     ecx, dword ptr [edi+28];//<<<<======================
0045A874  |.  85C9          test    ecx, ecx
0045A876  |.  0F84 A2010000 je      0045AA1E
0045A87C  |.  8A81 8C080000 mov     al, byte ptr [ecx+88C]
0045A882  |.  84C0          test    al, al
0045A884  |.  0F84 94010000 je      0045AA1E
0045A88A  |.  8B11          mov     edx, dword ptr [ecx]             ;  44
0045A88C  |.  55            push    ebp
0045A88D  |.  C64424 64 01  mov     byte ptr [esp+64], 1
0045A892  |.  FF52 44       call    dword ptr [edx+44]
====>>>>27FE0540 = 03E525A8+28
edi = 03E525A8

00449515  |> \8B8D 90070000 mov     ecx, dword ptr [ebp+790]
0044951B  |.  51            push    ecx
0044951C  |.  8B4D 1C       mov     ecx, dword ptr [ebp+1C]          ;  //<<<<======================ecx=03E525A8
0044951F  |.  E8 CCFE0000   call    004593F0                         ;  5
edi = 03E525A8
edi = 00D11A50+1C

7.最终结果是数组,暂不确定是什么技能

8.公式: [[[[[00D0DF1C]+1C]+28]+B94]+0*4]+C = 技能冷却时间

[[[[[00D0DF1C]+1C]+28]+B94]+3*4]+C // 回城术冷却时间

9.数组长度13(16进制)=19个 不知道是啥