绝地求生-通过Actor名字查询ActorId

      基于之前外面流传的源码了解到，UE4开发的游戏，游戏内对象都是基于Actor对象的继承，然而所有的Actor都会有一个名字，会保存在一个Name的表里，通过Actor的Id去查询，在游戏未加密的时候，可以直接获取Name表然后自己封装查询即可，但是游戏加密了Name表的指针后获取数据就没有那么便捷了。所以找到了游戏内部自己使用的查询接口。

1、接口原型分析

通过大地图队友头部图标绘制的调试可以找到以下代码

00007FF626305A04                           41 3B C9                              cmp  ecx,r9d                                              
00007FF626305A07                           7D 0D                                 jnl  TslGame.00007FF626305A16                             
00007FF626305A09                           48 63 C1                              movsxd  rax,rcx                                           
00007FF626305A0C                           48 8D 0C 40                           lea  rcx,qword ptr ds:[rax+rax*2]                         
00007FF626305A10                           49 8D 04 C8                           lea  rax,qword ptr ds:[r8+rcx*8]                          
00007FF626305A14                           EB 02                                 jmp  TslGame.00007FF626305A18                             
00007FF626305A16                           33 C0                                 xor  eax,eax                                              
00007FF626305A18                           8B 40 08                              mov  eax,dword ptr ds:[rax+0x08]                          
00007FF626305A1B                           C1 E8 1D                              shr  eax,0x1D                                             
00007FF626305A1E                           A8 01                                 test  al,0x01                                             
00007FF626305A20                           75 56                                 jne  TslGame.00007FF626305A78                             
00007FF626305A22                           C6 87 41 0C 00 00 01                  mov  byte ptr ds:[rdi+0x00000C41],0x01                    
00007FF626305A29                           48 8D 15 98 6C C3 02                  lea  rdx,qword ptr ds:[TslGame.00007FF628F3C6C8]          ;Name
00007FF626305A30                           48 8B 1E                              mov  rbx,qword ptr ds:[rsi]                               
00007FF626305A33                           48 8D 8C 24 98 00 00 00               lea  rcx,qword ptr ss:[rsp+0x00000098]                    ;输出ActorId
00007FF626305A3B                           41 B8 01 00 00 00                     mov  r8d,0x00000001                                       ;Arg3 = 1
00007FF626305A41                           E8 8A 7F 94 01                        call  TslGame.00007FF627C4D9D0                            查询call
00007FF626305A46                           48 8D 54 24 20                        lea  rdx,qword ptr ss:[rsp+0x20]                          
00007FF626305A4B                           48 8B CE                              mov  rcx,rsi                                              
00007FF626305A4E                           4C 8B 00                              mov  r8,qword ptr ds:[rax]                                
00007FF626305A51                           FF 93 E0 03 00 00                     call  qword ptr ds:[rbx+0x000003E0]                       
00007FF626305A57                           F2 0F 10 00                           repne movs  rdi,qword ptr ds:[rsi]                        
00007FF626305A5B                           F2 0F 11 87 34 0C 00 00               repne movs  qword ptr ds:[rdi],rsi                        
00007FF626305A63                           8B 40 08                              mov  eax,dword ptr ds:[rax+0x08]                          
00007FF626305A66                           89 87 3C 0C 00 00                     mov  dword ptr ds:[rdi+0x00000C3C],eax                    
00007FF626305A6C                           C7 87 30 0C 00 00 00 00 80 3F         mov  dword ptr ds:[rdi+0x00000C30],0x3F800000             
00007FF626305A76                           EB 11                                 jmp  TslGame.00007FF626305A89                             
00007FF626305A78                           C6 87 41 0C 00 00 00                  mov  byte ptr ds:[rdi+0x00000C41],0x00                    
00007FF626305A7F                           C7 87 30 0C 00 00 00 00 00 00         mov  dword ptr ds:[rdi+0x00000C30],0x00000000             
00007FF626305A89                           48 8B B4 24 90 00 00 00               mov  rsi,qword ptr ss:[rsp+0x00000090]                    
00007FF626305A91                           0F 28 7C 24 60                        movaps  xmm7,dqword ptr ss:[rsp+0x60]          

2、函数申明

typedef PVOID(WINAPI *FQueryIdByName)(PVOID pOutBuffer,WCHAR *szName,UINT32 uFlag);

00007FF626305A04                           41 3B C9                              cmp  ecx,r9d                                              
00007FF626305A07                           7D 0D                                 jnl  TslGame.00007FF626305A16                             
00007FF626305A09                           48 63 C1                              movsxd  rax,rcx                                           
00007FF626305A0C                           48 8D 0C 40                           lea  rcx,qword ptr ds:[rax+rax*2]                         
00007FF626305A10                           49 8D 04 C8                           lea  rax,qword ptr ds:[r8+rcx*8]                          
00007FF626305A14                           EB 02                                 jmp  TslGame.00007FF626305A18                             
00007FF626305A16                           33 C0                                 xor  eax,eax                                              
00007FF626305A18                           8B 40 08                              mov  eax,dword ptr ds:[rax+0x08]                          
00007FF626305A1B                           C1 E8 1D                              shr  eax,0x1D                                             
00007FF626305A1E                           A8 01                                 test  al,0x01                                             
00007FF626305A20                           75 56                                 jne  TslGame.00007FF626305A78                             
00007FF626305A22                           C6 87 41 0C 00 00 01                  mov  byte ptr ds:[rdi+0x00000C41],0x01                    
00007FF626305A29                           48 8D 15 98 6C C3 02                  lea  rdx,qword ptr ds:[TslGame.00007FF628F3C6C8]          ;Name
00007FF626305A30                           48 8B 1E                              mov  rbx,qword ptr ds:[rsi]                               
00007FF626305A33                           48 8D 8C 24 98 00 00 00               lea  rcx,qword ptr ss:[rsp+0x00000098]                    ;输出ActorId
00007FF626305A3B                           41 B8 01 00 00 00                     mov  r8d,0x00000001                                       ;Arg3 = 1
00007FF626305A41                           E8 8A 7F 94 01                        call  TslGame.00007FF627C4D9D0                            查询call
00007FF626305A46                           48 8D 54 24 20                        lea  rdx,qword ptr ss:[rsp+0x20]                          
00007FF626305A4B                           48 8B CE                              mov  rcx,rsi                                              
00007FF626305A4E                           4C 8B 00                              mov  r8,qword ptr ds:[rax]                                
00007FF626305A51                           FF 93 E0 03 00 00                     call  qword ptr ds:[rbx+0x000003E0]                       
00007FF626305A57                           F2 0F 10 00                           repne movs  rdi,qword ptr ds:[rsi]                        
00007FF626305A5B                           F2 0F 11 87 34 0C 00 00               repne movs  qword ptr ds:[rdi],rsi                        
00007FF626305A63                           8B 40 08                              mov  eax,dword ptr ds:[rax+0x08]                          
00007FF626305A66                           89 87 3C 0C 00 00                     mov  dword ptr ds:[rdi+0x00000C3C],eax                    
00007FF626305A6C                           C7 87 30 0C 00 00 00 00 80 3F         mov  dword ptr ds:[rdi+0x00000C30],0x3F800000             
00007FF626305A76                           EB 11                                 jmp  TslGame.00007FF626305A89                             
00007FF626305A78                           C6 87 41 0C 00 00 00                  mov  byte ptr ds:[rdi+0x00000C41],0x00                    
00007FF626305A7F                           C7 87 30 0C 00 00 00 00 00 00         mov  dword ptr ds:[rdi+0x00000C30],0x00000000             
00007FF626305A89                           48 8B B4 24 90 00 00 00               mov  rsi,qword ptr ss:[rsp+0x00000090]                    
00007FF626305A91                           0F 28 7C 24 60                        movaps  xmm7,dqword ptr ss:[rsp+0x60]