1.04j汉化MAIN.已经修改思路
破解韩国1.04版本以上的main 支持中文已经跳NP的方法
1:修改协议。物理攻击 说话 走路 战盟乱码等处理方式……
2:跳过MU.exe检测程序。直接运行main即可进入游戏
3:跳过ResourceGuard函数检测。否则上线中断!
4:见以下代码。处理几处函数代码。以免造成输入中文造成乱码
5:修改中文处理字符
6:修改IP和字符串即可
完成处理main ! BY MYGSFUN
=======:比较复杂的跳转修改 属于第四步骤
006F4126 |. /74 12 je short 006F413A //修改为JMP
006F4128 |. |8B45 FC mov eax, dword ptr [ebp-4]
006F412B |. |50 push eax ; /Arg2
006F412C |. |6A 00 push 0 ; |Arg1 = 00000000
006F412E |. |E8 9A000000 call 006F41CD ; \韩国版.006F41CD
006F4133 |. |83C4 08 add esp, 8
006F4136 |. |32C0 xor al, al
006F4138 |. |EB 0F jmp short 006F4149
006F413A |> \68 28486F00 push 006F4828 ; 入口地址
006F4186 |. /75 11 jnz short 006F4199 //修改为JMP
006F4188 |. |6A 01 push 1 ; /Arg2 = 00000001
006F418A |. |8B0D BCEDAF07 mov ecx, dword ptr [7AFEDBC] ; |
006F4190 |. |51 push ecx ; |Arg1 => 00000000
006F4191 |. |E8 DC0AF5FF call 00644C72 ; \韩国版.00644C72
006F4196 |. |83C4 08 add esp, 8
006F4199 |> \5D pop ebp
006F41B9 |. /74 10 je short 006F41CB //修改为JMP
006F41BB |. |6A 01 push 1 ; /Arg2 = 00000001
006F41BD |. |A1 BCEDAF07 mov eax, dword ptr [7AFEDBC] ; |
006F41C2 |. |50 push eax ; |Arg1 => 00000000
006F41C3 |. |E8 AA0AF5FF call 00644C72 ; \韩国版.00644C72
006F41C8 |. |83C4 08 add esp, 8
006F41CB |> \5D pop ebp
==============================属于第5步骤===========================
0071F295 |. 8D5424 20 lea edx, dword ptr [esp+20] //使用JMP覆盖或者NOP掉
0071F299 |. 8D4424 50 lea eax, dword ptr [esp+50]
0071F29D |. 8D8C24 C40C00>lea ecx, dword ptr [esp+CC4]
0071F2A4 |. 52 push edx ; /pProcessInfo
0071F2A5 |. 50 push eax ; |pStartupInfo
0071F2A6 |. 6A 00 push 0 ; |CurrentDir = NULL
0071F2A8 |. 6A 00 push 0 ; |pEnvironment = NULL
0071F2AA |. 6A 00 push 0 ; |CreationFlags = 0
0071F2AC |. 6A 01 push 1 ; |InheritHandles = TRUE
0071F2AE |. 6A 00 push 0 ; |pThreadSecurity = NULL
0071F2B0 |. 6A 00 push 0 ; |pProcessSecurity = NULL
0071F2B2 |. 8D9424 D40000>lea edx, dword ptr [esp+D4] ; |
0071F2B9 |. 51 push ecx ; |CommandLine
0071F2BA |. 52 push edx ; |ModuleFileName
0071F2BB |. FF15 48627500 call dword ptr [<&KERNEL32.CreateProc>; \CreateProcessA
0071F2C1 |. 85C0 test eax, eax
==============================使用UE修改一下IP 然后
原版为81---->修改为86
0076E2B0 86 00 00 00 01 00 00 00 88 00 00 00 86 00 00 00 ?.....?..?..
0076E2C0 80 00 00 00 DE 00 00 00 01 00 00 00 00 00 00 00
本文出自 7j45 > 奇迹一条龙
1:修改协议。物理攻击 说话 走路 战盟乱码等处理方式……
2:跳过MU.exe检测程序。直接运行main即可进入游戏
3:跳过ResourceGuard函数检测。否则上线中断!
4:见以下代码。处理几处函数代码。以免造成输入中文造成乱码
5:修改中文处理字符
6:修改IP和字符串即可
完成处理main ! BY MYGSFUN
=======:比较复杂的跳转修改 属于第四步骤
006F4126 |. /74 12 je short 006F413A //修改为JMP
006F4128 |. |8B45 FC mov eax, dword ptr [ebp-4]
006F412B |. |50 push eax ; /Arg2
006F412C |. |6A 00 push 0 ; |Arg1 = 00000000
006F412E |. |E8 9A000000 call 006F41CD ; \韩国版.006F41CD
006F4133 |. |83C4 08 add esp, 8
006F4136 |. |32C0 xor al, al
006F4138 |. |EB 0F jmp short 006F4149
006F413A |> \68 28486F00 push 006F4828 ; 入口地址
006F4186 |. /75 11 jnz short 006F4199 //修改为JMP
006F4188 |. |6A 01 push 1 ; /Arg2 = 00000001
006F418A |. |8B0D BCEDAF07 mov ecx, dword ptr [7AFEDBC] ; |
006F4190 |. |51 push ecx ; |Arg1 => 00000000
006F4191 |. |E8 DC0AF5FF call 00644C72 ; \韩国版.00644C72
006F4196 |. |83C4 08 add esp, 8
006F4199 |> \5D pop ebp
006F41B9 |. /74 10 je short 006F41CB //修改为JMP
006F41BB |. |6A 01 push 1 ; /Arg2 = 00000001
006F41BD |. |A1 BCEDAF07 mov eax, dword ptr [7AFEDBC] ; |
006F41C2 |. |50 push eax ; |Arg1 => 00000000
006F41C3 |. |E8 AA0AF5FF call 00644C72 ; \韩国版.00644C72
006F41C8 |. |83C4 08 add esp, 8
006F41CB |> \5D pop ebp
==============================属于第5步骤===========================
0071F295 |. 8D5424 20 lea edx, dword ptr [esp+20] //使用JMP覆盖或者NOP掉
0071F299 |. 8D4424 50 lea eax, dword ptr [esp+50]
0071F29D |. 8D8C24 C40C00>lea ecx, dword ptr [esp+CC4]
0071F2A4 |. 52 push edx ; /pProcessInfo
0071F2A5 |. 50 push eax ; |pStartupInfo
0071F2A6 |. 6A 00 push 0 ; |CurrentDir = NULL
0071F2A8 |. 6A 00 push 0 ; |pEnvironment = NULL
0071F2AA |. 6A 00 push 0 ; |CreationFlags = 0
0071F2AC |. 6A 01 push 1 ; |InheritHandles = TRUE
0071F2AE |. 6A 00 push 0 ; |pThreadSecurity = NULL
0071F2B0 |. 6A 00 push 0 ; |pProcessSecurity = NULL
0071F2B2 |. 8D9424 D40000>lea edx, dword ptr [esp+D4] ; |
0071F2B9 |. 51 push ecx ; |CommandLine
0071F2BA |. 52 push edx ; |ModuleFileName
0071F2BB |. FF15 48627500 call dword ptr [<&KERNEL32.CreateProc>; \CreateProcessA
0071F2C1 |. 85C0 test eax, eax
==============================使用UE修改一下IP 然后
原版为81---->修改为86
0076E2B0 86 00 00 00 01 00 00 00 88 00 00 00 86 00 00 00 ?.....?..?..
0076E2C0 80 00 00 00 DE 00 00 00 01 00 00 00 00 00 00 00