龙之谷单机版（6月17日即将内测）【血量基址+偏移】

//HP
EAX=000004BF
EBX=00153188
ECX=0090A8F8
EDX=000013E4
ESI=0B07E30C
EDI=00000000
EBP=00153170
ESP=0012E274
EIP=00658C47

指针基址可能是 =0B07E30C

00658C3E - fxch st(1)
00658C40 - call 008941F0
00658C45 - mov [esi],eax
00658C47 - pop esi
00658C48 - ret 0008


//不停写入
EAX=00000435
EBX=168A62C8
ECX=00000001
EDX=11C5E0B0
ESI=C337EC7E
EDI=00000000
EBP=18DA8E48
ESP=0012E624
EIP=0066AA36

Probable base pointer =18DA8E48

0066AA2D - fstp dword ptr [ebp+64]
0066AA30 - fld dword ptr [ebp+64]
0066AA33 - mov [ebp+68],eax
0066AA36 - fld dword ptr [esp+000001BC]
0066AA3D - fld st(0)


EAX=00000001
EBX=00000001
ECX=187DF868
EDX=0092B064
ESI=1687CDC0
EDI=1687DA38
EBP=00000001
ESP=0012E31C
EIP=006B5F89

Probable base pointer =1687CDC0

006B5F77 - lea ecx,[esi+000015AC]
006B5F7D - call 006A0750
006B5F82 - cmp dword ptr [esi+00001954],00
006B5F89 - je 006B6006
006B5F8B - mov ebx,[esp+28]

EAX=0012DE2C
EBX=19977664
ECX=18DA8E48
EDX=19976368
ESI=1687CDC0
EDI=0012E330
EBP=00000001
ESP=0012E308
EIP=006B6001

Probable base pointer =1687CDC0

006B5FF5 - mov [ecx+08],edx
006B5FF8 - mov [ecx+0C],eax
006B5FFB - mov ecx,[esi+00001954]
006B6001 - call 0066B9A0
006B6006 - pop edi

009c5d40]+1954]+68
EDX=[[[[[0X9DE1D0]+ESI*0X04]+0X0D8]+0X8]+[[0X9DE1D0]+ESI*0X04]+0X638] 当前血量
DD [[[[0X9DE1D0]+0X1e*0X04]+0X0D8]+0X8]+[[0X9DE1D0]+0X1e*0X04]+0X638


不断写入血量
006B7547    8B70 04         mov esi,dword ptr ds:[eax+0x4]
006B754A    8B40 08         mov eax,dword ptr ds:[eax+0x8]
006B754D    8972 04         mov dword ptr ds:[edx+0x4],esi
006B7550    8942 08         mov dword ptr ds:[edx+0x8],eax
006B7553    8B97 38060000   mov edx,dword ptr ds:[edi+0x638]         ; 血量


//下断，查看ESI的值，
006B7190    83EC 34         sub esp,0x34
//确定ESI的值
0050F05A  |.  8B0D D0E19D00 |mov ecx,dword ptr ds:[0x9DE1D0]         ;  ECX=[0X9DE1D0]
0050F060  |>  8B0CB1        |mov ecx,dword ptr ds:[ecx+esi*4]        ;  ECX=[[0X9DE1D0]+ESI*0X4]
0050F063  |.  D94424 14     |fld dword ptr ss:[esp+0x14]
0050F067  |.  8B11          |mov edx,dword ptr ds:[ecx]              ;  EDX=[[[0X9DE1D0]+ESI*0X4]]
0050F069  |.  8B42 04       |mov eax,dword ptr ds:[edx+0x4]          ;  EAX=[[[[0X9DE1D0]+ESI*0X4]]+0X4]
0050F06C  |.  51            |push ecx
0050F06D  |.  D91C24        |fstp dword ptr ss:[esp]
0050F070  |.  FFD0          |call eax
EAX=[[[[0X9DE1D0]+ESI*0X4]]+0X4] == 0X006B7190 时，就可以得到ESI的值了。