研究WarCraft III 全图有一段时间了,在这里记录一下制作的过程。
首先 凭经验 假设每个单位都有一个标记 ,如果能被看见为1 不能被看见为0。用cheatengine来测试这个结论的正确性。
选择一个单位 当有该单位视野时 搜索 (byte类型) 1,走到不能看见该单位的地方 搜索0 通过多次的筛选
可以找到一个地址 标记着该单位是否可见
在ce中锁定这个值 回到游戏 能看见这个单位在闪烁
用ce找出是什么访问了这个地址
6F3A20A3 - 66 8B 0C 41 - mov cx,[ecx+eax*2]
6F00F5CD - 0FB7 04 41 - movzx eax,word ptr [ecx+eax*2]
6F4AC4F4 - 0FB7 31 - movzx esi,word ptr [ecx]
6F4076F4 - 8B 0C 10 - mov ecx,[eax+edx]
Game.dll+3A20AB - 66 81 C9 00F0 - or cx,F000 { 61440 }
Game.dll+F5D1 - 0D 00F00000 - or eax,F000 { 61440 }
这两个命令与全图显示单位有关的
我们把 F000 修改为 F001 然后地图已经打开了 我们可以看见视野外的单位
这就是绝大多数 辅助工具的原理了。通过修改Game.DLL的字节码来作弊。
其他的功能如显示隐身单位,显示敌方信号的功能都可以通过修改内存来实现。下面直接给出应该patch的地址
//Resource View
Patch(dwGameDll + 0x359AED, "\xEB\x02", 2);
Patch(dwGameDll + 0x35A1DF, "\xEB\x02", 2);
Patch(dwGameDll + 0x35A29F, "\xEB\x02", 2);
Patch(dwGameDll + 0x35A3D0, "\xEB\x02", 2);
Patch(dwGameDll + 0x28EAFA, "\xEB\x02", 2);
Patch(dwGameDll + 0x360584, "\xEB", 1);
//Make units clickable
Patch(dwGameDll + 0x285CBC, "\x90\x90", 2);
Patch(dwGameDll + 0x285CD2, "\xEB", 1);
//Reveal Illusions
Patch(dwGameDll + 0x28357C, "\x40\xC3", 2);
//Reveal Invisibles
Patch(dwGameDll + 0x362391, "\x3B", 1);
Patch(dwGameDll + 0x362394, "\x85", 1);
Patch(dwGameDll + 0x39A51B, "\x90\x90\x90\x90\x90\x90", 6);
Patch(dwGameDll + 0x39A52E, "\x90\x90\x90\x90\x90\x90\x90\x90\x33\xC0\x40", 11);
// Reveal Units on Main Map
Patch(dwGameDll + 0x39EBBC, "\x75", 1);
Patch(dwGameDll + 0x3A2030, "\x90\x90", 2);
Patch(dwGameDll + 0x3A20DB, "\x90\x90", 2);
// Reveal Units on Mini Map
Patch(dwGameDll + 0x361F7C, "\x00", 1);
// Show Enemies Ping Signals
Patch(dwGameDll + 0x43F9A6, "\x3B", 1);
Patch(dwGameDll + 0x43F9A9, "\x85", 1);
Patch(dwGameDll + 0x43F9B9, "\x3B", 1);
Patch(dwGameDll + 0x43F9BC, "\x85", 1);
Patch(dwGameDll + 0x3345E9, "\x39\xC0\x0F\x85", 4);
// Show Runes
Patch(dwGameDll + 0x3A201B, "\xEB", 1);
Patch(dwGameDll + 0x40A864, "\x90\x90", 2);
// Show Skills / Cooldowns
Patch(dwGameDll + 0x2031EC, "\x90\x90\x90\x90\x90\x90", 6);
Patch(dwGameDll + 0x34FDE8, "\x90\x90", 2);
Patch(dwGameDll + 0x28ECFE, "\xEB", 1);
Patch(dwGameDll + 0x34FE26, "\x90\x90\x90\x90", 4);