使用de4dot-cex反编译原版的hearthbuddy得到的

链接: https://pan.baidu.com/s/1hT79LpIjbyvODsjnkSe_5A 提取码: iemx

class276里面的指针是通过class247得到的

internal Class276(ExternalProcessMemory memory)
{
this.externalProcessMemory_0 = memory;
this.intptr_0 = this.method_18("mono.dll");
this.intptr_31 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_9;
this.intptr_28 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_17;
this.intptr_13 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_22;
this.intptr_16 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_16;
this.intptr_6 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_7;
this.intptr_1 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_15;
this.intptr_15 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_24;
this.intptr_14 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_21;
this.intptr_7 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_5;
this.intptr_19 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_10;
this.intptr_29 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_35;
this.intptr_17 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_1;
this.intptr_25 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_30;
this.intptr_24 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_25;
this.intptr_32 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_31;
this.intptr_34 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_28;
this.intptr_36 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_0;
this.intptr_35 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_29;
this.intptr_23 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_34;
this.intptr_33 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_33;
this.intptr_27 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_32;
this.intptr_12 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_4;
this.intptr_10 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_3;
this.intptr_4 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_6;
this.intptr_8 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_11;
this.intptr_21 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_23;
this.intptr_18 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_8;
this.intptr_5 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_2;
this.intptr_30 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_19;
this.intptr_2 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_12;
this.intptr_9 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_18;
this.intptr_3 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_14;
this.intptr_26 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_27;
this.intptr_22 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_26;
this.intptr_20 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_13;
this.intptr_11 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_20;
this.method_15<bool>("boolean");
this.method_15<object>("object");
this.method_15<sbyte>("sbyte");
this.method_15<byte>("byte");
this.method_15<short>("int16");
this.method_15<ushort>("uint16");
this.method_15<int>("int32");
this.method_15<uint>("uint32");
this.method_15<long>("int64");
this.method_15<ulong>("uint64");
this.method_15<float>("single");
this.method_15<double>("double");
this.method_15<char>("char");
this.method_15<string>("string");
this.method_15<Enum>("enum");
}

赋值处理

try
{
TritonHs.class247_0 = new Class247();
TritonHs.class247_0.method_1(array, TritonHs.Memory.ImageBase);
}
catch (Exception)
{
string_0 = string.Format("The data required to run the bot is corrupted. Please make sure your key is still valid at the Buddy Auth Portal: http://buddyauth.com/User/Keys {0}{0}For any further assistance, please contact support: https://bosslandgmbh.zendesk.com/home", Environment.NewLine);
return false;
}
TritonHs.class276_0 = new Class276(TritonHs.externalProcessMemory_0);
using (TritonHs.AcquireFrame())
{
TritonHs.intptr_1 = TritonHs.Class276_0.method_2();
}

直接new一个class247的实例对象,然后调用method_1。传递的参数是array和TritonHs.Memory.ImageBase

public static ExternalProcessMemory Memory
        {
            get
            {
                return TritonHs.externalProcessMemory_0;
            }
        }

array参数的获取,delegate6_0貌似是从服务器获取地址数据

byte[] array = delegate6_0(TritonHs.String_0, out string_0);
if (array == null)
{
if (string.IsNullOrEmpty(string_0))
{
string_0 = string.Format("The data required to run the bot was not successfully obtained. Please make sure your key is still valid at the Buddy Auth Portal: http://buddyauth.com/User/Keys {0}{0}For any further assistance, please contact support: https://bosslandgmbh.zendesk.com/home", Environment.NewLine);
}
return false;
}

class247里面的method1方法

// ns25.Class247
// Token: 0x06001990 RID: 6544 RVA: 0x000DAF40 File Offset: 0x000D9140
internal unsafe void method_1(byte[] byte_0, IntPtr intptr_1)
{
this.intptr_0 = new IntPtr[byte_0.Length / ];
byte b = ;
byte* ptr;
if (byte_0 != null && byte_0.Length != )
{
fixed (byte* ptr = &byte_0[])
{
}
}
else
{
ptr = null;
}
uint* ptr2 = (uint*)ptr;
for (int i = ; i < this.intptr_0.Length; i++)
{
uint uint_ = ptr2[i];
IntPtr intPtr = new IntPtr((long)((ulong)Class247.smethod_0(uint_, b)));
this.intptr_0[i] = intPtr;
b = ((b + ) ?? );
}
ptr = null;
this.method_0(intptr_1);
}

method0方法在对struct106_0 进行赋值

if (ptr4 != null)
{
this.struct106_0 = *(Struct106*)ptr4;
}
// ns25.Class247
// Token: 0x0600198F RID: 6543 RVA: 0x000DAE44 File Offset: 0x000D9044
internal unsafe void method_0(IntPtr intptr_1)
{
IntPtr[] array = new IntPtr[this.intptr_0.Length];
this.intptr_0.CopyTo(array, );
ArraySegment<IntPtr> arraySegment_;
ArraySegment<IntPtr> arraySegment_2;
this.method_4(array, out arraySegment_, out arraySegment_2);
for (int i = arraySegment_.Offset; i < arraySegment_.Count; i++)
{
if (arraySegment_.Array[i].ToInt32() > )
{
array[i] = array[i] - + intptr_1.ToInt32();
}
}
IntPtr[] array2;
IntPtr* ptr;
if ((array2 = this.method_2<IntPtr>(arraySegment_)) != null && array2.Length != )
{
fixed (IntPtr* ptr = &array2[])
{
}
}
else
{
ptr = null;
}
byte* ptr2 = (byte*)ptr;
if (ptr2 != null)
{
this.struct105_0 = *(Struct105*)ptr2;
}
ptr = null;
IntPtr* ptr3;
if ((array2 = this.method_2<IntPtr>(arraySegment_2)) != null && array2.Length != )
{
fixed (IntPtr* ptr3 = &array2[])
{
}
}
else
{
ptr3 = null;
}
byte* ptr4 = (byte*)ptr3;
if (ptr4 != null)
{
this.struct106_0 = *(Struct106*)ptr4;
}
ptr3 = null;
}

所以之前的工作原理,是从服务器获取mono的偏移地址,然后进行后续操作的。

HearthBuddy的class276以及class247的更多相关文章

  1. hearthbuddy中的Class276

    构造函数 需要注意的是this.intptr_0 = this.method_18("mono.dll"); 所以,这个类里面的操作,最后是和mono.dll相关的 interna ...

  2. HearthBuddy中的class276中的地址对应

    2019年09月的 intptr_0 = method_18("mono.dll"); intptr_31 = intptr_0 + 522030; intptr_28 = int ...

  3. HearthBuddy的plugin加载

    // Hearthbuddy.Windows.MainWindow // Token: 0x060001FF RID: 511 RVA: 0x0008951C File Offset: 0x00087 ...

  4. HearthBuddy炉石兄弟 Method 'CollectionDeckBoxVisual.IsValid' not found.

    [CollectionManagerScene_COLLECTION] An exception occurred when calling CacheCustomDecks: System.Miss ...

  5. HearthBuddy 第一次调试

    HearthBuddy https://www.jiligame.com/70639.html 解压缩包,打开hearthbuddy.exe直接运行就可以:不用替换mono.dll直接可用:不需要校验 ...

  6. HearthBuddy修改系统时间

    将以下代码保存在.bat文件,然后用管理员权限运行 pushd "%~dp0" #下面修改时间,根据操作系统的语言不同,会有不同的格式,比如2019-10-26date 10/26 ...

  7. HearthBuddy Ai调试实战1-->出牌的时候,少召唤了图腾就结束回合

    期望通过ai的调试,来搞明白出牌的逻辑. 55是投火无面者63是恐狼前锋34是风怒36是自动漩涡打击装置13是空灵召唤者, "LocStringZhCn": "<b ...

  8. HearthBuddy 日志模块

    // Triton.Common.LogUtilities.CustomLogger // Token: 0x04000BD8 RID: 3032 private Level level_0 = Le ...

  9. HearthBuddy炉石兄弟 如何调试ai

    Sepefeets's update to botmaker's Silverfish AI This AI is a Custom Class for Hearthranger and Hearth ...

随机推荐

  1. 阿里云服务器远程连接错误:由于一个协议错误(代码:0x112f),远程会话将被中断。

    2019年10月,阿里云服务器远程连接忽然无法登录.当时正在清理c盘空间,C盘只剩下30+M,忽然远程桌面掉线,以为断网了,再次远程桌面连接时,就出现一下错误. 解决方案:万能的重启!!!具体错误原因 ...

  2. Mybatis中传递多个参数的方法总结

    一.单个参数: public List<XXBean> getXXBeanList(String xxCode); <select id="getXXXBeanList&q ...

  3. c# ArrayList 类

  4. 编译制作Linux 3.18内核rpm包(升级centos6.x虚拟机内核)

    介绍 openstack平台需要使用各种Linux发行版模板镜像,其制作方法主要有两种,要么是基于各大Linux发行版ISO光盘手动制作,要么是使用官方提供的模板镜像再做修改 之前制作的opensta ...

  5. 安装配置KVM虚拟化

    安装KVM虚拟化 KVM需要硬件⽀持, 所以需要开启虚拟化⽀持 硬件设备直接在BIOS设置开启CPU虚拟化 个⼈电脑同样进⼊BIOS开启虚拟化⽀持 VM需要找到对应虚拟机开启对应的VT-EPT虚拟化技 ...

  6. java 懒汉式、饿汉式单例模式 不含多线程的情况

    //饿汉式 提前生成了单例对象 class Singleton{ private static final Singleton instance=new Singleton(); private Si ...

  7. 小程序~获取手机号getPhoneNumber提示该appid没有权限

    处理思路 (1)小程序是不是企业主体 (2)有没有进行认证 (3)如果没有 是不可以获取用户手机号码的 .

  8. 【Low版】HAUT - OJ - Contest1035 - 2017届新生周赛(六)题解

    问题 A: 比赛 时间限制: 2 秒 内存限制: 256 MB | 提交: 393 解决: 98提交 状态 题目描述 学校要派6名同学组成两个队(一个队3个人)去参加比赛,每个同学有一个分数,学校希望 ...

  9. 大数据之路week07--day06 (Sqoop 的使用)

    Sqoop的使用一(将数据库中的表数据上传到HDFS) 首先我们先准备数据 1.没有主键的数据(下面介绍有主键和没有主键的使用区别) -- MySQL dump 10.13 Distrib 5.1.7 ...

  10. discuz论坛门户资讯入库接口【原创】

    最近想打造一个社区门户站点,所以写了这个入库接口,可以对接数据入库. <?php /* * Discuz x3.2 门户免登陆发布接口 * 2018-08-10 * Copyright 68xi ...