一楼基址
00AFF2D7 51 push ecx
00AFF2D8 8BCE mov ecx,esi
00AFF2DA FFD2 call edx
00AFF2DC 84C0 test al,al
00AFF2DE 0F84 DC000000 je 00AFF3C0
00AFF2E4 8B4D 80 mov ecx,dword ptr ss:[e
bp
-0x80]
00AFF2E7 8B06 mov eax,dword ptr ds:[esi]
00AFF2E9 8B50 3C mov edx,dword ptr ds:[eax+0x3C]
00AFF2EC 6A 01 push 0x1
00AFF2EE 51 push ecx
00AFF2EF 8BCE mov ecx,esi
00AFF2F1 FFD2 call edx
00AFF2F3 E9 C8000000 jmp 00AFF3C0
00AFF2F8 8D45 9C lea eax,dword ptr ss:[ebp-0x64]
00AFF2FB 50 push eax
00AFF2FC 8D8D 18FFFFFF lea ecx,dword ptr ss:[ebp-0xE8]
00AFF302 895D 9C mov dword ptr ss:[ebp-0x64],ebx
00AFF305 E8 F4567101 call 022149FE
00AFF30A 68 68A3A502 push 0x2A5A368
00AFF30F 8D8D 18FFFFFF lea ecx,dword ptr ss:[ebp-0xE8]
00AFF315 51 push ecx
00AFF316 C785 18FFFFFF 1>mov dword ptr ss:[ebp-0xE8],0x24B2D10
00AFF320 E8 DF617101 call 02215504
00AFF325 8B85 70FFFFFF mov eax,dword ptr ss:[ebp-0x90]
00AFF32B 8B8D 74FFFFFF mov ecx,dword ptr ss:[ebp-0x8C]
00AFF331 0FB655 A2 movzx edx,byte ptr ss:[ebp-0x5E]
00AFF335 50 push eax
00AFF336 0FB785 48FFFFFF movzx eax,word ptr ss:[ebp-0xB8]
00AFF33D 51 push ecx
00AFF33E 0FB64D A5 movzx ecx,byte ptr ss:[ebp-0x5B]
00AFF342 52 push edx
00AFF343 0FB655 A4 movzx edx,byte ptr ss:[ebp-0x5C]
00AFF347 50 push eax
00AFF348 8B85 7CFFFFFF mov eax,dword ptr ss:[ebp-0x84]
00AFF34E 51 push ecx
00AFF34F 52 push edx
00AFF350 0FB795 64FFFFFF movzx edx,word ptr ss:[ebp-0x9C]
00AFF357 50 push eax
00AFF358 0FB645 A6 movzx eax,byte ptr ss:[ebp-0x5A]
00AFF35C 8D8D 34FFFFFF lea ecx,dword ptr ss:[ebp-0xCC]
00AFF362 51 push ecx
00AFF363 8B8D 78FFFFFF mov ecx,dword ptr ss:[ebp-0x88]
00AFF369 52 push edx
00AFF36A 8B95 68FFFFFF mov edx,dword ptr ss:[ebp-0x98]
00AFF370 50 push eax
00AFF371 8B45 80 mov eax,dword ptr ss:[ebp-0x80]
00AFF374 57 push edi
00AFF375 51 push ecx
00AFF376 52 push edx
00AFF377 50 push eax
00AFF378 8D8D C4FDFFFF lea ecx,dword ptr ss:[ebp-0x23C]
00AFF37E E8 5D833800 call 00E876E0
00AFF383 385D A3 cmp byte ptr ss:[ebp-0x5D],bl
00AFF386 C645 FC 10 mov byte ptr ss:[ebp-0x4],0x10
00AFF38A 0F95C1 setne cl
00AFF38D 0FB6D1 movzx edx,cl
00AFF390 52 push edx
00AFF391 50 push eax
00AFF392 8B45 98 mov eax,dword ptr ss:[ebp-0x68]
00AFF395 50 push eax
00AFF396 E8 554C7E00 call 012E3FF0
00AFF39B 83C4 0C add esp,0xC
00AFF39E 8D8D C4FDFFFF lea ecx,dword ptr ss:[ebp-0x23C]
00AFF3A4 8BF0 mov esi,eax
00AFF3A6 C645 FC 0B mov byte ptr ss:[ebp-0x4],0xB
00AFF3AA E8 61D59AFF call 004AC910
00AFF3AF 0FB74D 84 movzx ecx,word ptr ss:[ebp-0x7C]
00AFF3B3 53 push ebx
00AFF3B4 6A 01 push 0x1
00AFF3B6 56 push esi
00AFF3B7 51 push ecx
00AFF3B8 8B4D 9C mov ecx,dword ptr ss:[ebp-0x64]
00AFF3BB E8 E0A25000 call 010096A0
00AFF3C0 3BF3 cmp esi,ebx
00AFF3C2 0F84 B9000000 je 00AFF481
00AFF3C8 8B16 mov edx,dword ptr ds:[esi]
00AFF3CA 8B02 mov eax,dword ptr ds:[edx]
00AFF3CC 8BCE mov ecx,esi
00AFF3CE FFD0 call eax
00AFF3D0 83F8 02 cmp eax,0x2
00AFF3D3 75 0E jnz X00AFF3E3
00AFF3D5 53 push ebx
00AFF3D6 56 push esi
00AFF3D7 E8 E47A0C00 call 00BC6EC0

有人吗？？？？

这个是基址独一无二 但是不会修改用以前的方法老奔溃

这是个失传多年的玩具 谁会啊？？？

求教++++++++++++++

一个提示 00AFF376 在这HOOK

这么简单都不会 呵呵

一看就懂