粥level解密开源
void SF_DEBUG() {
printf("==DEBUG==\n");
//解密函数地址sub_BD6CC50
uint64_t UWorld = GameMemory.Read<uint64_t>(GameMemory._base + 0x12650638);
uint64_t ULevel = GameMemory.Read<uint64_t>(UWorld + 0x110);
int EncLevel = GameMemory.Read<int>(UWorld + 0x110 + 8);
int func_index = GameMemory.Read<int>(GameMemory._base + 0x12F504C0);
long open_enc = GameMemory.Read<int>(GameMemory._base + 0x12F504C4);
int enc_param = GameMemory.Read<int>(GameMemory._base + 0x12F504C8);
if (EncLevel < 0x20 && _bittest(&open_enc, EncLevel)) {
func_index = func_index + EncLevel;
if (func_index > 0xC9) {
func_index = 200;
}
uint64_t func_addr = GameMemory._base + 0x1264EF60 + func_index * 8;
uint64_t func_ptr = GameMemory.Read<uint64_t>(func_addr);//解密call
//申请可执行内存
PVOID address = VirtualAlloc(0, 64, MEM_COMMIT, 64);
*(BYTE*)address = 0xC3;
typedef uint64_t(__fastcall* SFCALL)(int addr);
SFCALL pSFCALL = (SFCALL)address;
//读取具体内容
GameMemory.ReadMemory(func_ptr, address, 64);
uint64_t result = pSFCALL(enc_param);
ULevel = ULevel ^ result;
printf("ULevel %llx\n", ULevel);
printf("ULevelID %llx\n", GameMemory.Read<uint64_t>(ULevel + 0x01D8));
printf("Actor %llx\n", GameMemory.Read<uint64_t>(ULevel + 0x0B0));
printf("Count %llx\n", GameMemory.Read<int>(ULevel + 0x0B8));
}
printf("World %llx\n", UWorld);
printf("==DEBUG==\n");
}
页:
[1]