2014年2月5日 星期三

TwMS v1.52.2_ICS_定點生怪

[ENABLE]
RegisterSymbol(ReLifeVac)
Alloc(ReLifeVac, 256)
RegisterSymbol(RelifeXY)
Alloc(RelifeXY,8)
RegisterSymbol(RelifeSwitch)
Alloc(RelifeSwitch, 4)

Label(ReLifeVacXY)
Label(DoRelife)
Label(Return)

RelifeSwitch:
DD 0

ReLifeVac:
Cmp [RelifeSwitch],1
Je  ReLifeVacXY
Cmp [RelifeSwitch],2
Je  DoRelife
Jmp Return

ReLifeVacXY:
Push Eax
Mov  Eax,[00f75bac]
Push [Eax+Fa0]
Pop  [RelifeXY]
Push [Eax+Fa4]
Pop  [RelifeXY+4]
Pop  Eax
Mov  [RelifeSwitch],2
Jmp  Return

DoRelife:
Cmp [Esp], 00648022 //8b 07 8b cf ff 90 94 00 00 00 50 8b cb
Jne Return
Cmp dword ptr [Esp+18],02
Jne Return
Push Ecx
Mov  Eax,[RelifeXY]
Mov  [Esp+0c], eax
Mov  Eax,[RelifeXY+4]
Mov  [Esp+10], eax
Push Eax
mov ecx,[00f70f00]
//8b 0d ?? ?? ?? 00 89 7d ?? e8 ?? ?? ?? 00 3b c7
Call 00435171 //ok
//[1/2] 6A 14 B8 ?? ?? ?? 00 E8 ?? ?? ?? 00 33 F6 89 75 F0 89 75 EC 89 75 FC 39 75 08
Mov  Ecx, eax
Mov  [Esp+20], ecx
Pop  Ecx
Jmp  Return

Return:
jmp 00a1540e

00dc05fc:
dd ReLifeVac

[DISABLE]
00dc05fc:
dd 00a1540e //55 8B EC 53 56 57 FF 75 20
 
UnRegisterSymbol(ReLifeVac)
DeAlloc(ReLifeVac)
UnRegisterSymbol(RelifeXY)
DeAlloc(RelifeXY)
UnRegisterSymbol(RelifeSwitch)
DeAlloc(RelifeSwitch)

沒有留言:

張貼留言