012-分析快捷栏数组与快捷栏使用call【瑞客论坛 www.ruike1.com】.txt

012-分析快捷栏数组与快捷栏使用call 2021在线班 郁金香灬老师 QQ 150330575 交流群:158280115 学习目标: 分析快捷栏数组 81E358+4*下标 分析快捷栏功能CALL和参数 写代码测试 0,1,2 // 1,2,3 sub esp,0x100 lea eax,[esp+0] mov dword ptr[eax+0x00],0 mov dword ptr[eax+0x04],0 push 19FCA234 push eax push 4 call 0x005ABBC0 add esp,0x100 wow.exe+1ABC3B: 005ABC39 - C3 - ret 005ABC3A - 53 - push ebx 005ABC3B - 8B 1C B5 58E3C100 - mov ebx,[esi*4+wow.exe+81E358] << 005ABC42 - 3B DF - cmp ebx,edi 005ABC44 - 0F84 12020000 - je wow.exe+1ABE5C wow.exe+1A7896: 005A7891 - 8B EC - mov ebp,esp 005A7893 - 8B 45 08 - mov eax,[ebp+08] 005A7896 - 8B 04 85 58E3C100 - mov eax,[eax*4+wow.exe+81E358] << 005A789D - 85 C0 - test eax,eax 005A789F - 74 13 - je wow.exe+1A78B4 wow.exe+1A78F6: 005A78F1 - 8B EC - mov ebp,esp 005A78F3 - 8B 45 08 - mov eax,[ebp+08] 005A78F6 - 8B 04 85 58E3C100 - mov eax,[eax*4+wow.exe+81E358] << 005A78FD - 85 C0 - test eax,eax 005A78FF - 74 13 - je wow.exe+1A7914 005AC04F | 6A 00 | push 0 | 005AC051 | 6A 03 | push 3 | 005AC053 | 57 | push edi | 005AC054 | E8 87202A00 | call wow.84E0E0 | 005AC059 | 50 | push eax | add esp,0C eax=取地址"LeftButton" 005AC05A | 8D4D F8 | lea ecx,dword ptr ss:[ebp-8] | ecx[]=<0,0> 8字节 005AC05D | 51 | push ecx | 005AC05E | 56 | push esi | 格子下标 从0开始 005AC05F | E8 5CFBFFFF | call wow.5ABBC0 | 3,6个参数 三个参数 快捷栏功能(下标) 0...格子数量 005AC064 | 83C4 18 | add esp,18 | 18/4=6个参数 0C+0C=18 005AC067 | 5E | pop esi | 005AC068 | 33C0 | xor eax,eax | eax:"LeftButton" 005AC06A | 5F | pop edi | 005AC06B | 8BE5 | mov esp,ebp | 005AC06D | 5D | pop ebp | 005AC06E | C3 | ret | /* 005AC048 | 83C4 0C | add esp,C | 005AC04B | 84C0 | test al,al | 005AC04D | 74 18 | je wow.5AC067 | 005AC04F | 6A 00 | push 0 | 005AC051 | 6A 03 | push 3 | 005AC053 | 57 | push edi | 005AC054 | E8 87202A00 | call wow.84E0E0 | 005AC059 | 50 | push eax | 005AC05A | 8D4D F8 | lea ecx,dword ptr ss:[ebp-8] 未知 是传入 还是返回呢? 005AC05D | 51 | push ecx 无ecx参数 005AC05E | 56 | push esi 下标 005AC05F | E8 5CFBFFFF | call wow.5ABBC0 | 005AC064 | 83C4 18 | add esp,18 6个参数 记得平栈 或者3个参数 005AC067 | 5E | pop esi | 005AC068 | 33C0 | xor eax,eax | 005AC06A | 5F | pop edi | 005AC06B | 8BE5 | mov esp,ebp | 005AC06D | 5D | pop ebp | 005AC06E | C3 | ret | 005AC06F | 68 B866A100 | push wow.A166B8 | A166B8:"Usage: UseAction(slot, [, target] [, button])" 005AC074 | 57 | push edi | 005AC075 | E8 06322A00 | call wow.84F280 | 005AC07A | 83C4 08 | add esp,8 | 039DFAF0 00000001 参数1 快捷数组下标 039DFAF4 039DFB10 参数2 &目标对象ID1 ID2 039DFAF8 1A08AF7C "LeftButton" 参数3 039DFAFC 1243BFE0 参数4 039DFB00 00000003 039DFB04 00000000 039DFAEC 005AC064 返回到 wow.005AC064 自 wow.005ABBC0 039DFAF0 00000003 参数1 快捷数组下标 039DFAF4 039DFB10 参数2 &buf<0,0> 039DFAF8 1A08AF7C "LeftButton" 039DFAFC 1243BFE0 // [wow.exe+93F78C]=可能是L指针 039DFB00 00000003 039DFB04 00000000 */ void 使用快捷栏(UINT 下标) { UINT_PTR pcall = 0x05ABBC0; UINT_PTR L = 0x400000 + 0x93F78C; int arg2[3] = { 0 }; char arg3[] = "LeftButton"; __asm { /* push 0 push 3 push L */ lea eax, arg3 push eax lea eax, arg2 push eax push 3 call pcall add esp,0x0C //add esp,0x18 } }