好友
阅读权限10
听众
最后登录1970-1-1
|
奋斗的心
发表于 2021-3-22 01:54
$-29 5DCFD587 E8 9452F1FF call WeChatWi.5DC12820
$-24 5DCFD58C 68 30D6CE5E push WeChatWi.5ECED630
$-1F 5DCFD591 E8 BEC3AD00 call WeChatWi.5E7D9954
$-1A 5DCFD596 83C4 04 add esp,0x4
$-17 5DCFD599 C745 FC FFFFFFF>mov dword ptr ss:[ebp-0x4],-0x1
$-10 5DCFD5A0 A1 503C1D5F mov eax,dword ptr ds:[0x5F1D3C50]
$-B 5DCFD5A5 B9 503C1D5F mov ecx,WeChatWi.5F1D3C50
$-6 5DCFD5AA 57 push edi ; WeChatWi.5F322798
$-5 5DCFD5AB FF50 08 call dword ptr ds:[eax+0x8] ; 找到的地址
$-2 5DCFD5AE 57 push edi ; WeChatWi.5F322798
$-1 5DCFD5AF 51 push ecx
$ ==> 5DCFD5B0 E8 EB6ECDFF call WeChatWi.5D9D44A0 ; HOOK的地址
$+5 5DCFD5B5 83C4 04 add esp,0x4
$+8 5DCFD5B8 8BC8 mov ecx,eax
$+A 5DCFD5BA E8 B19D4500 call WeChatWi.5E157370
$+F 5DCFD5BF 8BCF mov ecx,edi ; WeChatWi.5F322798
$+11 5DCFD5C1 E8 2A84CBFF call WeChatWi.5D9B59F0
$+16 5DCFD5C6 8B1D 40601D5F mov ebx,dword ptr ds:[0x5F1D6040]
$+1C 5DCFD5CC F6C3 01 test bl,0x1
$+1F 5DCFD5CF 75 2F jnz short WeChatWi.5DCFD600
$+21 5DCFD5D1 83CB 01 or ebx,0x1
模块地址：5D930000
HOOK地址：5DCFD5B0-5D930000=3CD5B0 偏移
$-329110 5D9D44A0 55 push ebp CALL内部 偏移A44A0
044A7B80 556E99D8
044A7BC0 0CA1AFF0 UNICODE "24042484069@chatroom"
044A7BE8 00D2B448 UNICODE "<msg><emoji fromusername="wxid_6rlooww0azum22" tou"
044A7CE4 0E4C72A0 UNICODE "wxid_8eihyk56euqv22"
$ ==> >557E0328
$+4 >00000178
$+8 >00000000
$+C >00000000
$+10 >26E725FA
$+14 >00000000
$+18 >00000000
$+1C >00000000
$+20 >00000000
$+24 >00000000
$+28 >5CA7646C qbcore.5CA7646C
$+2C >5CD684DD qbcore.5CD684DD
$+30 >0000002F
$+34 >00000000
$+38 >00000002
$+3C >60576C09
$+40 >0EEDEA58 UNICODE "22123712078@chatroom"
$+44 >00000014
$+48 >00000014
$+4C >00000000
$+50 >00000000
$+54 >00000000
$+58 >00000000
$+5C >00000000
$+60 >00000000
$+64 >00000000
$+68 >11D5D8A0 UNICODE "<msg><emoji fromusername = "wxid_fl0yta44p5yk22" t"
$+6C >0000039B
$+70 >0000039B
$+74 >00000000
$+78 >00000000
$+7C >00000000
$+80 >00000000
$+84 >0D86C980
$+88 >000000C0
$+8C >00000000
$+90 >00000000
$+94 >00000000
$+98 >00000000
$+9C >00000000
$+A0 >00000000
$+A4 >00000000
$+A8 >00000000
$+AC >00000000
$+B0 >00000000
$+B4 >00000000
$+B8 >00000000
$+BC >00000000
$+C0 >00000000
$+C4 >00000000
$+C8 >00000000
$+CC >00000000
$+D0 >00000001
$+D4 >00000000
$+D8 >00000000
$+DC >00000000
$+E0 >00000000
$+E4 >00000000
$+E8 >00000000
$+EC >00000000
$+F0 >00000000
$+F4 >00000000
$+F8 >00000000
$+FC >00000000
$+100 >00000000
$+104 >00000000
$+108 >00000000
$+10C >00000000
$+110 >00000000
$+114 >00000000
$+118 >00000000
$+11C >00000000
$+120 >00000000
$+124 >00000000
$+128 >5EF380DC WeChatWi.5EF380DC
$+12C >0D66E278
$+130 >00000000
$+134 >00000000
$+138 >00000000
$+13C >00000000
$+140 >00000000
$+144 >00000000
$+148 >00000000
$+14C >00000000
$+150 >00000000
$+154 >00000000
$+158 >00000000
$+15C >00000000
$+160 >00000000
$+164 >0D86A1C0 UNICODE "wxid_fl0yta44p5yk22"
|
免费评分
-
查看全部评分
|
发帖前要善用【论坛搜索】功能，那里可能会有你要找的答案或者已经有人发布过相同内容了，请勿重复发帖。 |
|
|
|
|
|
|
[复制链接]
