冰楓論壇»論壇 › 楓之谷 (MapleStory) › 遊戲代碼分享區 › 舊代碼存放區(TWMS) › TWMS094~103（一些舊數據，僅供參考＆研究） ...

查看: 1861|回覆: 5

[其餘數據] TWMS094~103（一些舊數據，僅供參考＆研究）

2516 主題	1 好友	1萬積分

管理員

Rank: 15

UID: 41
帖子: 11996
主題: 2516
精華: 80
積分: 12581
楓幣: 58267
威望: 7704
存款: 1000000
贊助金額: 0
推廣: 1
ＧＰ: 5087
閱讀權限: 255
在線時間: 65535 小時
註冊時間: 2011-3-31
最後登入: 2024-5-6

發消息

電梯直達

1樓

發表於 2014-2-5 19:30:47 |只看該作者 |倒序瀏覽

動態數據就不放上來了，有一些數據遺失了...所以也歡迎好心人補上(?)
本來打算放到165的..但太多了..我好懶...所以就先放到103

//版本:TwMs094
//數據名稱:攻擊不停
//更新:梟x夜..180天度假中
//日期:2009/5/21
// 代碼 :008CE356
// EIP : CSX
[Enable]
registersymbol(CSX)
alloc(CSX,128)
label(CSXReturn)
CSX://CSEAX X
push eax
mov eax,[00AA8944]
mov eax,[eax+2500]
cmp eax,2
pop eax
jg CSXReturn

push eax
mov eax,[00AA8944]
mov eax,[eax+0D08]
cmp esi,eax
pop eax
jne CSXReturn
add eax,0a
jmp CSXReturn

CSXReturn:
mov [ebx], eax
jmp 008CE358

[Disable]
unregistersymbol(CSX)
dealloc(CSX)

//=================================================
[enable]
//疾風N合一 for TWMS094
//原作：jajaja, 感謝99,A,D,L,N,W,W(縮寫)
//原出處：疾風之莊
//感謝:s032356469跳怪掉落LR
//功能：停止呼吸、走,跳怪方向【左趴往左,右趴往右,坐下停止控制】、笨怪、10秒損血一次、超檢
//紅點暫停、跳怪不跳、致命的吸引力【定點及跟隨角色二種模式，啟動方式提示：5秒】
//Address：004145ab
//EIP：MyLR
//LR:掉怪方向 1停3左2右  可以加到清單上了比較方便
//=================================================
alloc(MyLR,1024)
registersymbol(MyLR)
alloc(MyDir,4)
alloc(MyCt,4)
alloc(MyPt1,4)
label(MyLR1)
label(GoLR)
label(GoLR1)
label(GoLR2)
label(GoLR3)
label(GoLR4)
label(GoLR5)
label(GoLRback)
label(JmpLR)
label(JmpLR1)
label(JmpLR2)
label(JmpLRback)
label(MyStupid)
label(MyNoBack)
label(MyState)
label(MyCharX)
label(MyNoJmp)
label(LRDir1)
label(LRDir2)
label(LRDir3)
label(LRDir4)
label(LRDir5)
label(LRDir6)

label(LRDir7)       //跳怪掉落
registersymbol(LR)//跳怪掉落
alloc(LR,4)          //跳怪掉落

registersymbol(RunSW)//熱鍵紅點模組化
alloc(RunSW, 4)          //熱鍵紅點模組化
alloc(Runtemp, 4)       //熱鍵紅點模組化

registersymbol(ATTACKOF)    //攻擊加速
alloc(ATTACKOF,4)                //攻擊加速
label(CALLATTACK)             //攻擊加速
label(CALLATTACK01)          //攻擊加速
label(CALLATTACK02)          //攻擊加速
registersymbol(ATTACKTIME)//攻擊加速
alloc(ATTACKTIME,4)          //攻擊加速

registersymbol(VarMaxBloom)//PG無敵
registersymbol(VarMinBloom)//PG無敵
alloc(VarMaxBloom, 4)          //PG無敵
alloc(VarMinBloom, 4)          //PG無敵
label(CBR100)                      //PG無敵

RunSW:             //熱鍵紅點模組化
dd    0             //熱鍵紅點模組化
Runtemp:          //熱鍵紅點模組化
dd    1             //熱鍵紅點模組化

//--------↓PG無敵↓--------------
  VarMaxBloom:             //
  dd 2                      //最高損血量: 初始值: 2滴, 採用16進次
  VarMinBloom:             //
  dd 1                      //最低損血量: 初始值: 1滴, 採用16進次 (設0=miss)
//--------↑PG無敵↑--------------

//-------↓攻擊加速↓-------------
  ATTACKOF:
  DD 7d0 //加速時間:目前設定2秒 3秒=3000毫秒=BB8.不穩定的增加數值.穩定的可以試著減少數值
  ATTACKTIME:
  DD 0
//-------↑攻擊加速↑-------------

LR:       //跳怪掉落
DD 3    //跳怪掉落  1停3左2右.可是要搭配疾風右走才行

MyDir:
DD 1

MyLR:
push eax
cmp [00AA8944],00000000 //停止呼吸
je MyLR1                            //停止呼吸
mov eax,[00AA8944]          //停止呼吸
mov [eax+374],0                //停止呼吸

cmp [00AA8954],00000000 //超級檢物
je MyLR1                            //超級檢物
mov eax,[00AA8954]          //超級檢物
mov [eax+206C], 0             //超級檢物

cmp [00AA8958],00000000 //地圖紅點
je MyLR1

//----------↓熱鍵紅點模組化↓-------------
push eax
mov eax,[RunSW]
xor [Runtemp],eax
mov [RunSW],0
cmp [Runtemp],1
pop eax
jne MyLR1
push eax
mov eax,[00AA8958] //紅點
mov eax,[eax+18] //
add [Runtemp],eax
cmp [Runtemp],100  // 這裏修改 1是自己加1個人改2
mov [Runtemp],1
pop eax
ja MyLR1
//---------↑熱鍵紅點模組化↑------------------

pop eax
cmp dword ptr [esp], 008D1711
je GoLR
cmp dword ptr [esp], 008D1B2B
je JmpLR
cmp dword ptr [esp], 008D078C
je MyStupid
cmp dword ptr [esp], 00879EF9
jz MyNoBack
cmp dword ptr [esp], 008D1AE3
jz MyNoJmp
ret
MyLR1:
pop eax
ret

//---------------↓攻擊加速↓-----------------------------------------------
CALLATTACK:
push eax
mov eax,[00aa8ae4]
mov eax,[eax+18]
cmp eax,[ATTACKTIME]
pop eax
jg CALLATTACK01
ret
CALLATTACK01:
push eax
mov eax,[00aa8944]
mov eax,[eax+37C]
cmp eax,ffffffff
pop eax
jne CALLATTACK02
ret
CALLATTACK02:
push eax
mov eax,[00aa8944]
mov [eax+37C],ffffffff
mov eax,[00aa8ae4]
mov eax,[eax+18]
add eax,[ATTACKOF]
mov [ATTACKTIME],eax
pop eax
ret
//-----------------↑攻擊加速↑-----------------------------------

GoLR:
add esp,4
call MyState
push 03
pop ecx
mov [edi+20],eax
xor edx,edx
div ecx
cmp [MyDir], 1
je GoLRback
cmp [MyDir], 3
je GoLR1
cmp [MyDir], 4
je GoLR3
cmp edx, [MyDir]
je GoLRback
mov [esi+000004a4],0
jmp GoLRback
GoLR1:
push eax
call MyCharX
jmp GoLR4
GoLR3:
push eax
mov eax,[MyPt1]
GoLR4:
cmp edx, 1
je GoLR5
jg GoLR2
cmp eax,[esi+1c4]
pop eax
mov [esi+000004a4],5
jl GoLRback
mov [esi+000004a4],0
jmp GoLRback
GoLR2:
cmp eax,[esi+1c4]
pop eax
mov [esi+000004a4],5
jg GoLRback
mov [esi+000004a4],0
jmp GoLRback
GoLR5:
pop eax
mov [esi+000004a4],0
GoLRback:
jmp 008D171B
//================================
JmpLR:
add esp,4
call MyState
cmp [MyDir], 1
je JmpLRback
cmp [MyDir], 2
mov eax,2
je JmpLRback
cmp [MyDir], 0
mov eax,3
je JmpLRback
cmp [MyDir], 4
je JmpLR1
call MyCharX
jmp JmpLR2
JmpLR1:
mov eax,[MyPt1]
JmpLR2:
cmp eax,[esi+1c4]
mov eax,2
mov [esi+000004a4],5
jg JmpLRback
mov eax,3
JmpLRback:

//------↓跳怪掉落↓------------
cmp [esi+00000230],1 //<----------避免改到走怪
je LRDir7
cmp eax,[LR]
jne LRDir7
sub [esi+00000230],2 //<-----這裡不要亂動改錯了怪亂飄會鎖
LRDir7: //<------------
//------↑跳怪掉落↑------------

push 03
jmp 008D1B2D
//================================
MyCharX:
mov eax [00AA8944]
mov eax, [eax+0cc8]
ret
//================================
MyState:
push eax
mov eax, [00AA8944]
mov eax, [eax+0378]
cmp eax, a
je LRDir1
cmp eax, b
je LRDir2
cmp eax, 14
je LRDir3
cmp eax, 15
je LRDir3
mov [MyCt], 0
jmp LRDir4
LRDir1:
mov [MyDir],2
cmp [MyCt], 32
ja LRDir5
inc [MyCt]
jmp LRDir4
LRDir2:
mov [MyDir],0
cmp [MyCt], 32
ja LRDir6
inc [MyCt]
jmp LRDir4
LRDir3:
mov [MyDir],1
jmp LRDir4
LRDir5:
mov [MyDir],3
jmp LRDir4
LRDir6:
mov [MyDir],4
call MyCharX
mov [MyPt1],eax
LRDir4:
pop eax
ret
//============================
MyStupid:

call CALLATTACK  //攻擊加速

add esp, 4
xor edx,edx
mov ecx,0000ea60
div ecx
lea eax,[esi+00000238]
add edx,0002bf20
mov [esi+00000240],edx
mov edx,[esp+10]
cmp [eax],edx
je 008D07D7
cmp [esi+0000023c],edi
lea ecx,[esi+0000023c]
je 008D07D7
jmp 008D07BD
//============================
MyNoBack:
add esp,4

//--------↓PG無敵↓--------------
push eax
push ebx
push ecx
push edx
xor edx, edx
mov eax,[00AA8944]
mov eax,[eax+18]
mov ecx, [VarMaxBloom]
mov ebx, [VarMinBloom]
sub ecx, ebx
jz CBR100
div ecx // edx:eax 除 ecx, 餘數放edx 簡單說就是除以差值取餘數
CBR100:
add edx, ebx       //餘數+上最小值
mov [ebp+8], edx //把結果丟進去扣寫
pop edx
pop ecx
pop ebx
pop eax
//--------↑PG無敵↑--------------

lea ecx, [edi+000017f4]
push FFFFD8F0    //=10 秒 //原始值=FFFFFA24，修改此處可更改無敵秒數
jmp 0087A532
//============================
MyNoJmp:
add esp,4
jmp 008D1AF7
[disable]
dealloc(MyLR)
unregistersymbol(MyLR)
dealloc(MyDir)
dealloc(MyCt)
dealloc(MyPt1)

dealloc(ATTACKOF)                //攻擊加速
unregistersymbol(ATTACKOF)  //攻擊加速
dealloc(ATTACKTIME)             //攻擊加速
unregistersymbol(ATTACKTIME)//攻擊加速

unregistersymbol(LR)//跳怪掉落
dealloc(LR)             //跳怪掉落

unregistersymbol(RunSW)//熱鍵紅點模組化
dealloc(RunSW)             //熱鍵紅點模組化
dealloc(Runtemp)          //熱鍵紅點模組化

[enable]
// 寵物吸物 For TWMS094
// 代碼=004EBB13
// EIP=PetGetItem
//更新時間 2009/5/20
registersymbol(PetGetItem)
alloc(PetGetItem,256)
registersymbol(PetGetItemSwitch)
alloc(PetGetItemSwitch,4)
label(NormalPet)

PetGetItemSwitch:
dd 1 // 開關 0 是關 1 是開

PetGetItem:
cmp [PetGetItemSwitch],0
je NormalPet
push ebx
mov ebx,[ebp+0c]
mov [ebx],edi
mov [ebx+04],eax
pop ebx
jmp 004EBB2A//+8//8B 45 DC 39 58 30 74 07 B8 FF FF FF 7F EB 03 8B 40 34 8B 4D E0 50 E8 87
NormalPet:
lea eax,[ebp-38]
push eax
call dword ptr [00aabf4c]//第2ㄍ代碼那行
jmp 004EBB1D//+3

[disable]
unregistersymbol(PetGetItem)
dealloc(PetGetItem)
unregistersymbol(PetGetItemSwitch)
dealloc(PetGetItemSwitch)

//==================================================
//  TWMS_V094 快速恢復HP/MP 合併版
//
//  004256F6 EIP=HookFR
//
//  代碼原創：qqazedctgb
//
//  修改：龍
//
//  日期：98/05/20
//
//  說明：每次恢復10倍HP，8倍MP
//==================================================

[Enable]
  alloc(HookFR,1024)
  registersymbol(HookFR)
  label(HookRet)
  label(HPHandler)
  label(MPHandler)

  label(FastRecoverHP)
  label(DoNormalHP)
  label(HPCheck)
  alloc(HPCounter,4)
  alloc(SetHPCounter,4)
  alloc(RecoverTime,4)
  registersymbol(SetHPCounter)

  label(FastRecoverMP)
  label(DoNormalMP)
  label(MPCheck)
  alloc(MPCounter,4)
  alloc(SetMPCounter,4)
  registersymbol(SetMPCounter)

HookFR:
  cmp [esp],0090F7D7
  je HPHandler
  cmp [esp],0090F945
  je MPHandler
HookRet:
  push ebp
  jmp 004256F7

HPHandler:
  mov [esp],FastRecoverHP
  jmp HookRet
MPHandler:
  mov [esp],FastRecoverMP
  jmp HookRet

FastRecoverHP:
  push eax
  mov eax,[ebp-1c]
  mov [RecoverTime],eax
  pop eax

  cmp [HPCounter],0
  je HPCheck
  dec [HPCounter]
  cmp ebx,1
  jmp 0090F7DA

HPCheck:
  sub [RecoverTime],0A
  cmp ebx,[RecoverTime]
  jna DoNormalHP

  push eax
  mov eax,[SetHPCounter]
  dec eax
  mov [HPCounter],eax
  pop eax

DoNormalHP:
  cmp ebx,[ebp-1c]
  jmp 0090F7DA

FastRecoverMP:
  cmp [MPCounter],0
  je MPCheck
  dec [MPCounter]
  cmp ebx,1
  jmp 0090F94B

MPCheck:
  cmp ebx,00002708
  jna DoNormalMP
  push eax
  mov eax,[SetMPCounter]
  dec eax
  mov [MPCounter],eax
  pop eax

DoNormalMP:
  cmp ebx,00002710
  jmp 0090F94B

SetHPCounter:
  dd A       // 10倍HP，易斷線的請調低倍數
SetMPCounter:
  dd 8       // 8倍MP，易斷線的請調低倍數

[Disable]
  unregistersymbol(HookFR)
  dealloc(HookFR)

  dealloc(HPCounter)
  dealloc(SetHPCounter)
  dealloc(RecoverTime)
  unregistersymbol(SetHPCounter)

  dealloc(MPCounter)
  dealloc(SetMPCounter)
  unregistersymbol(SetMPCounter)

//V94跳怪and走怪都能掉落
//原作:zgenden
//Address: 008D23B2
//EIP: ALLDOWN
[ENABLE]
registersymbol(ALLDOWN)
alloc(ALLDOWN,128)

ALLDOWN:
add [ebx+00000228],1
mov eax,[ebx+00000228]
cmp eax,01
jmp 008D23BB

[DISABLE]
dealloc(ALLDOWN)
unregistersymbol(ALLDOWN)

//V94 招喚獸無延遲 Z版
//原作:zgenden
//更版:asdasd911
//Address:006FE997
//EIP:TEN
//注意:不能搭配順移.不能搭配全圖.不能搭配物品落腳下
//-----------------------------------------------
[ENABLE]
registersymbol(TEN)
alloc(TEN,1024)
registersymbol(TENKEY)
alloc(TENKEY,4)
registersymbol(TENTIMESTOP)
alloc(TENTIMESTOP,4)
registersymbol(TENTIMESTOP01)
alloc(TENTIMESTOP01,4)
registersymbol(TENTIMESTOPOF)
alloc(TENTIMESTOPOF,4)
registersymbol(TENTIMESTOPEDI)
alloc(TENTIMESTOPEDI,4)
registersymbol(TENTIMESTOP100)
alloc(TENTIMESTOP100,4)
label(TEN00)
label(TEN02)
label(TENKB)
label(TENKB00)
registersymbol(TENKEYTIME)
alloc(TENKEYTIME,4)
//-----------------------------------------------
TENKEY:
dd 1 //熱鍵: 0.關 1.開
TENTIMESTOP:
DD 0
TENTIMESTOP01:
DD 0
TENTIMESTOPOF:
DD 0
TENTIMESTOPEDI:
DD 0
TENTIMESTOP100:
DD 0
TENKEYTIME:
DD 0

TEN:
cmp [TENKEY],0
je TEN00
cmp [TENTIMESTOPEDI],edi
je TEN02
mov [TENTIMESTOPEDI],edi
mov [TENTIMESTOP],0
mov [TENTIMESTOP01],0
mov [TENTIMESTOPOF],0
TEN02:
call TENKB
mov ecx,[00aa8ae4]
mov ecx,[ecx+18]
sub ecx,3E8 //每次進行攻擊秒數目前1秒無延遲
cmp ecx,[TENKEYTIME]
jg TEN00
mov ecx,[00aa8ae4]
mov ecx,[ecx+18]
sub ecx,0 //每一次攻擊延遲時間.目前0(無延遲)
cmp ecx,[TENTIMESTOP]
jle TEN00
cmp [TENTIMESTOP01],1E //偵測攻擊次數.目前30下
jge TEN00
push [ebx+000000a4]
call 006cdbed
pop ecx
mov ecx,esi
sub ecx,[ebx+00000100]
push esi
mov ecx,ebx
call 006ff652
push eax
mov eax,[ebx+00000100]
cmp [TENTIMESTOP100],eax
pop eax
je 006fea08
push eax
mov eax,[ebx+00000100]
mov [TENTIMESTOP100],eax
mov eax,[00aa8ae4]
mov eax,[eax+18]
mov [TENTIMESTOP],eax
pop eax
add [TENTIMESTOP01],1
jmp 006fea08

TEN00:
jg 006fea08
cmp dword ptr [ebx+000000b4],01
jne 006fe9c4
push [ebx+000000a4]
call 006cdbed
pop ecx
mov ecx,esi
sub ecx,[ebx+00000100]
jmp 006fea08

TENKB:
cmp [TENTIMESTOP01],1
jle TENKB00
ret

TENKB00:
mov ecx,[00aa8ae4]
mov ecx,[ecx+18]
mov [TENKEYTIME],ecx
ret
//-----------------------------------------------
[DISABLE]
dealloc(TEN)
unregistersymbol(TEN)
dealloc(TENKEY)
unregistersymbol(TENKEY)
dealloc(TENTIMESTOP)
unregistersymbol(TENTIMESTOP)
dealloc(TENTIMESTOP01)
unregistersymbol(TENTIMESTOP01)
dealloc(TENTIMESTOPOF)
unregistersymbol(TENTIMESTOPOF)
dealloc(TENTIMESTOPEDI)
unregistersymbol(TENTIMESTOPEDI)
dealloc(TENTIMESTOP100)
unregistersymbol(TENTIMESTOP100)
dealloc(TENKEYTIME)
unregistersymbol(TENKEYTIME)

//TWMS094
//時間：2009/5/23
//更新：moyamoya
//原作：zgenden
//代碼：0051DA5C
//EIP：MAXONE
//功能：跳怪掉落1.跳怪掉落2
//-----------------------------------------------
[ENABLE]
registersymbol(MAXONE)
alloc(MAXONE,2048)
label(MAXONE00)
label(ONE)
registersymbol(ONEKEY)
alloc(ONEKEY,4)
registersymbol(ONEKEY00)
alloc(ONEKEY00,4)
registersymbol(JUPKEY)
alloc(JUPKEY, 4)
label(JUP)
label(JUP2)
label(TWO)
label(TWO00)
registersymbol(JUPKEY2)
alloc(JUPKEY2, 4)
//-----------------------------------------------
ONEKEY00:
DD 1 //總開關: 0.關 1.開

JUPKEY:
DD 1 //跳怪掉落1: 0.關 1.開

JUPKEY2:
DD 1 //跳怪掉落2: 0.關 1.開

//-----------------------------------------------
MAXONE:
cmp [ONEKEY00],0
je MAXONE00

cmp dword ptr [esp], 008D239A
je ONE
cmp dword ptr [esp], 008D2896
je TWO
ret

MAXONE00:
ret
//-----------------------------------------------
ONE:
add esp,4
cmp [JUPKEY],1
je JUP
fsubr qword ptr [ebp-18]
jmp 008D239D
//-----------------------------------------------
JUP:
cmp [ebx+0230],2
jne JUP2
mov [ebx+02D0],0
fsubr qword ptr [ebp-18]
add esp,10
fst qword ptr [ebp-18]
fcomp qword ptr [009E2B98]
jmp 008D2729
//-----------------------------------------------
JUP2:
fsubr qword ptr [ebp-18]
jmp 008D239D
//-----------------------------------------------
TWO:
add esp,4
cmp [JUPKEY2],1
jne TWO00
fcomp qword ptr [ebp-08]
pop ecx
pop ecx
jmp 008D2900
TWO00:
fcomp qword ptr [ebp-08]
jmp 008D2899
//-----------------------------------------------

[DISABLE]
dealloc(MAXONE)
unregistersymbol(MAXONE)
dealloc(ONEKEY)
unregistersymbol(ONEKEY)
dealloc(ONEKEY00)
unregistersymbol(ONEKEY00)
dealloc(JUPKEY)
unregistersymbol(JUPKEY)
dealloc(JUPKEY2)
unregistersymbol(JUPKEY2)

//V94範圍打
//原作:歷史太久了~好像有人發過功能一樣的
//改編:zgenden
//Address: 0061EAAF
//EIP=IwallEXP
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 1024)
registersymbol(IwallEXPX)
alloc(IwallEXPX, 4)
registersymbol(IwallEXPY)
alloc(IwallEXPY, 4)
label(IwallEXP00)

IwallEXPX:
dd C8    //以人物為中心X軸(16進位).數值越大範圍越大.目前設定200=C8(16進位) 目前[1000]
IwallEXPY:
dd C8    //以人物為中心Y軸(16進位).數值越大範圍越大.目前設定200=C8(16進位) 目前[1000]

IwallEXP:
mov edx,[00AA8944]
mov edx,[edx+000CC8]
add edx,[IwallEXPX]
cmp ecx,edx
jg IwallEXP00
mov edx,[00AA8944]
mov edx,[edx+000CC8]
sub edx,[IwallEXPX]
cmp ecx,edx
jl IwallEXP00

mov edx,[00AA8944]
mov edx,[edx+000CCC]
add edx,[IwallEXPY]
cmp eax,edx
jg IwallEXP00
mov edx,[00AA8944]
mov edx,[edx+000CCC]
sub edx,[IwallEXPY]
cmp eax,edx
jl IwallEXP00

mov ecx,[00AA8944]
mov ecx,[ecx+000CC8]
mov eax,[00AA8944]
mov eax,[eax+000CCC]
mov [ebx+00000444],ecx
jmp  0061EAB5

//-----------------------------

IwallEXP00:
mov [ebx+0000046C],ecx
jmp 0061EAB5

[DISABLE]
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
dealloc(IwallEXPX)
unregistersymbol(IwallEXPX)
dealloc(IwallEXPY)
unregistersymbol(IwallEXPY)
//----------------------------------------

//TWMS094 物品過濾
//代碼：004ECB07
//EIP：ItemFilter
//物品ID：ItemCounter

[ENABLE]
alloc(ItemFilter,124)
alloc(IFTable,16024)
alloc(ItemCounter,4)
label(ifreject)
label(end)
label(skip)
registersymbol(ItemFilter)
registersymbol(ItemCounter)

ItemFilter:
      mov [ItemCounter],eax
      push ebx
      push esi
      xor ebx, ebx
      mov esi,IFTable
ifreject:
      cmp eax,[esi]
      je skip
      cmp [esi],ebx
      je end
      add esi,4
      jmp ifreject
skip:
      mov eax,00
end:
      pop esi
      pop ebx
      mov [edi+34],eax
      jmp  004ECB0D

IFTable:

dd 00

[DISABLE]
dealloc(ItemFilter)
unregistersymbol(ItemFilter)
dealloc(IFTable)
dealloc(ItemCounter)
unregistersymbol(ItemCounter)

收藏0 推0 噓0

把本文推薦給朋友或其他網站上,每次被點擊增加您在本站積分: 1骰子

站內諮詢：https://bingfong.com/home.php?mod=spacecp&amp;amp;amp;ac=pm&amp;amp;amp;op=showmsg&amp;amp;amp;touid=41
ＦＢ專頁：https://www.facebook.com/BingFengBF/
Instagram：https://instagram.com/bing.feng/
客服信箱：services@bingfong.com
合作洽談：contact@bingfong.com
※所有信件／訊息皆會於２４小時內回覆。
※若超過２４小時未收到回覆可能是您的訊息被系統過濾，請改用其它方式聯繫我們，謝謝

回覆

使用道具舉報

複製連結並發給好友，以賺取推廣點數

簡單兩步驟，註冊、分享網址，即可獲得獎勵！一起推廣文章換商品、賺$$

冰楓

2516 主題	1 好友	1萬積分

管理員

Rank: 15

UID: 41
帖子: 11996
主題: 2516
精華: 80
積分: 12581
楓幣: 58267
威望: 7704
存款: 1000000
贊助金額: 0
推廣: 1
ＧＰ: 5087
閱讀權限: 255
在線時間: 65535 小時
註冊時間: 2011-3-31
最後登入: 2024-5-6

發消息

2樓

發表於 2014-2-5 19:34:28 |只看該作者

TWMS096 （一些舊數據，僅供參考＆研究）

//=======================================
//TWMS096 物品過濾
//代碼：004ECF1D
//EIP：ItemFilter
//物品ID：ItemCounter
//=======================================
[ENABLE]
alloc(ItemFilter,124)
alloc(IFTable,16024)
alloc(ItemCounter,4)
label(ifreject)
label(end)
label(skip)
registersymbol(ItemFilter)
registersymbol(ItemCounter)

ItemFilter:
      mov [ItemCounter],eax
      push ebx
      push esi
      xor ebx, ebx
      mov esi,IFTable
ifreject:
      cmp eax,[esi]
      je skip
      cmp [esi],ebx
      je end
      add esi,4
      jmp ifreject
skip:
      mov eax,00
end:
      pop esi
      pop ebx
      mov [edi+34],eax
      jmp 004ECF23

IFTable:

dd 00

[DISABLE]
dealloc(ItemFilter)
unregistersymbol(ItemFilter)
dealloc(IFTable)
dealloc(ItemCounter)
unregistersymbol(ItemCounter)

//  TWM0.96 快速恢復HP/MP 縮短版
//  代碼：004256F6
//  EIP=HookFR
//  說明：恢復時間10秒縮短為9秒，每9秒恢復HP/MP時增加回補的次數
//====================
[Enable]
  alloc(HookFR,512)
  registersymbol(HookFR)
  label(HookRet)
  label(HPHandler)
  label(MPHandler)
  label(FastRecoverHP)
  label(DoNormalHP)
  label(HPCheck)
  alloc(HPCounter,4)
  alloc(SetHPCounter,4)
  registersymbol(SetHPCounter)
  label(FastRecoverMP)
  label(DoNormalMP)
  label(MPCheck)
  alloc(MPCounter,4)
  alloc(SetMPCounter,4)
  registersymbol(SetMPCounter)
//====================
HookFR:
  cmp [esp],0091335D
  je HPHandler
  cmp [esp],009134CB
  je MPHandler
HookRet:
  push ebp
  jmp 004256F7
HPHandler:
  mov [esp],FastRecoverHP
  jmp HookRet
MPHandler:
  mov [esp],FastRecoverMP
  jmp HookRet
//====================
FastRecoverHP:
  cmp [HPCounter],0
  je HPCheck
  dec [HPCounter]
  cmp ebx,1
  jmp DoNormalHP
HPCheck:
  cmp ebx,2185
  jna DoNormalHP
  push eax
  mov eax,[SetHPCounter]
  dec eax
  mov [HPCounter],eax
  pop eax
DoNormalHP:
  jmp 00913360
//====================
FastRecoverMP:
  cmp [MPCounter],0
  je MPCheck
  dec [MPCounter]
  cmp ebx,1
  jmp DoNormalMP
MPCheck:
  cmp ebx,2185
  jna DoNormalMP
  push eax
  mov eax,[SetMPCounter]
  dec eax
  mov [MPCounter],eax
  pop eax
DoNormalMP:
  jmp 009134D1
//====================
SetHPCounter:
  dd A       // 回10次 HP，易斷線的請調低次數
SetMPCounter:
  dd 8       // 回8次 MP，易斷線的請調低次數
//====================
[Disable]
  unregistersymbol(HookFR)
  dealloc(HookFR)
  dealloc(HPCounter)
  dealloc(SetHPCounter)
  unregistersymbol(SetHPCounter)
  dealloc(MPCounter)
  dealloc(SetMPCounter)
  unregistersymbol(SetMPCounter)

TWms 0.96
//代碼=004EBF29 EIP=PetGetItem
[enable]
registersymbol(PetGetItem)
alloc(PetGetItem,256)
registersymbol(PetGetItemSwitch)
alloc(PetGetItemSwitch,4)
label(NormalPet)

PetGetItemSwitch:
dd 1 // 開關 0 是關 1 是開

PetGetItem:
cmp [PetGetItemSwitch],0
je NormalPet
push ebx
mov ebx,[ebp+0c]
mov [ebx],edi
mov [ebx+04],eax
pop ebx
jmp 004EBF40
NormalPet:
lea eax,[ebp-38]
push eax
call dword ptr [00ab12bc]
jmp 004EBF33

[disable]
unregistersymbol(PetGetItem)
dealloc(PetGetItem)
unregistersymbol(PetGetItemSwitch)
dealloc(PetGetItemSwitch)

//=================================================
[enable]
//疾風N合一 for TWMS096
//原作：jajaja, 感謝99,A,D,L,N,W,W(縮寫)
//原出處：疾風之莊
//功能：走,跳怪方向【左趴往左,右趴往右,坐下停止控制】、笨怪、10秒損血一次、
//紅點暫停、跳怪不跳、致命的吸引力【定點及跟隨角色二種模式，啟動方式提示：5秒】
//Address：004145AB
//EIP：MyLR
//=================================================
alloc(MyLR,1024)
registersymbol(MyLR)
alloc(MyDir,4)
alloc(MyCt,4)
alloc(MyPt1,4)
label(MyLR1)
label(GoLR)
label(GoLR1)
label(GoLR2)
label(GoLR3)
label(GoLR4)
label(GoLR5)
label(GoLRback)
label(JmpLR)
label(JmpLR1)
label(JmpLR2)
label(JmpLRback)
label(MyStupid)
label(MyNoBack)
label(MyState)
label(MyCharX)
label(MyNoJmp)
label(LRDir1)
label(LRDir2)
label(LRDir3)
label(LRDir4)
label(LRDir5)
label(LRDir6)

label(LRDir7)       //跳怪掉落
registersymbol(LR)//跳怪掉落
alloc(LR,4)          //跳怪掉落

registersymbol(RunSW)//熱鍵紅點模組化
alloc(RunSW, 4)          //熱鍵紅點模組化
alloc(Runtemp, 4)       //熱鍵紅點模組化

registersymbol(ATTACKOF) //攻擊加速
alloc(ATTACKOF,4)             //攻擊加速
label(CALLATTACK)             //攻擊加速
label(CALLATTACK01)          //攻擊加速
label(CALLATTACK02)          //攻擊加速
registersymbol(ATTACKTIME)//攻擊加速
alloc(ATTACKTIME,4)          //攻擊加速

registersymbol(VarMaxBloom)//PG無敵
registersymbol(VarMinBloom)//PG無敵
alloc(VarMaxBloom, 4)       //PG無敵
alloc(VarMinBloom, 4)          //PG無敵
label(CBR100)                   //PG無敵

RunSW:             //熱鍵紅點模組化
dd    0             //熱鍵紅點模組化
Runtemp:          //熱鍵紅點模組化
dd    1             //熱鍵紅點模組化

//--------↓PG無敵↓--------------
  VarMaxBloom:             //
  dd 2                      //最高損血量: 初始值: 2滴, 採用16進次
  VarMinBloom:             //
  dd 1                      //最低損血量: 初始值: 1滴, 採用16進次 (設0=miss)
//--------↑PG無敵↑--------------

//-------↓攻擊加速↓-------------
  ATTACKOF:
  DD 7d0 //加速時間:目前設定2秒 3秒=3000毫秒=BB8.不穩定的增加數值.穩定的可以試著減少數值
  ATTACKTIME:
  DD 0
//-------↑攻擊加速↑-------------

LR: //跳怪掉落
DD 1  //跳怪掉落  1停3左2右.可是要搭配疾風右走才行

MyDir:
DD 1

MyLR:
push eax

cmp [00AADCB4],00000000 //停止呼吸
je MyLR1                               //停止呼吸
mov eax,[00AADCB4]             //停止呼吸
mov [eax+374],0                   //停止呼吸

cmp [00AADCC4],00000000 //超級檢物
je MyLR1                               //超級檢物
mov eax,[00AADCC4]          //超級檢物
mov [eax+206C], 0                //超級檢物

cmp [00AADCC8],00000000
je MyLR1
//----------↓熱鍵紅點模組化↓-------------
push eax
mov eax,[RunSW]
xor [Runtemp],eax
mov [RunSW],0
cmp [Runtemp],1
pop eax
jne MyLR1
push eax
mov eax,[00AADCC8] //紅點
mov eax,[eax+18] //
add [Runtemp],eax
cmp [Runtemp],150  // 這裏修改 1是自己加1個人改2  以此累推
mov [Runtemp],1
pop eax
ja MyLR1
//---------↑熱鍵紅點模組化↑------------------

pop eax
cmp dword ptr [esp], 008D50A2
je GoLR
cmp dword ptr [esp], 008D54BC
je JmpLR
cmp dword ptr [esp], 008D411D
je MyStupid
cmp dword ptr [esp], 0087D3E1
jz MyNoBack
cmp dword ptr [esp], 008D5474
jz MyNoJmp
ret

MyLR1:
pop eax
ret

//---------------↓攻擊加速↓-----------------------------------------------
CALLATTACK:
push eax
mov eax,[00AADE54]
mov eax,[eax+18]
cmp eax,[ATTACKTIME]
pop eax
jg CALLATTACK01
ret

CALLATTACK01:
push eax
mov eax,[00AADCB4]
mov eax,[eax+37C]
cmp eax,ffffffff
pop eax
jne CALLATTACK02
ret

CALLATTACK02:
push eax
mov eax,[00AADCB4]
mov [eax+37C],ffffffff
mov eax,[00AADE54]
mov eax,[eax+18]
add eax,[ATTACKOF]
mov [ATTACKTIME],eax
pop eax
ret
//-----------------↑攻擊加速↑-----------------------------------

GoLR:
add esp,4
call MyState
push 03
pop ecx
mov [edi+20],eax
xor edx,edx
div ecx
cmp [MyDir], 1
je GoLRback
cmp [MyDir], 3
je GoLR1
cmp [MyDir], 4
je GoLR3
cmp edx, [MyDir]
je GoLRback
mov [esi+000004A4],0
jmp GoLRback
GoLR1:
push eax
call MyCharX
jmp GoLR4
GoLR3:
push eax
mov eax,[MyPt1]
GoLR4:
cmp edx, 1
je GoLR5
jg GoLR2
cmp eax,[esi+1c4]
pop eax
mov [esi+000004A4],5
jl GoLRback
mov [esi+000004A4],0
jmp GoLRback
GoLR2:
cmp eax,[esi+1c4]
pop eax
mov [esi+000004A4],5
jg GoLRback
mov [esi+000004A4],0
jmp GoLRback
GoLR5:
pop eax
mov [esi+000004A4],0
GoLRback:
jmp 008D50AC
//================================
JmpLR:
add esp,4
call MyState
cmp [MyDir], 1
je JmpLRback
cmp [MyDir], 2
mov eax,2
je JmpLRback
cmp [MyDir], 0
mov eax,3
je JmpLRback
cmp [MyDir], 4
je JmpLR1
call MyCharX
jmp JmpLR2
JmpLR1:
mov eax,[MyPt1]
JmpLR2:
cmp eax,[esi+1c4]
mov eax,2
mov [esi+000004A4],5
jg JmpLRback
mov eax,3
JmpLRback:

//------↓跳怪掉落↓------------
cmp [esi+00000230],1 //<----------避免改到走怪
je LRDir7
cmp eax,[LR]
jne LRDir7
sub [esi+00000230],2 //<-----這裡不要亂動改錯了怪亂飄會鎖
LRDir7: //<------------
//------↑跳怪掉落↑------------

push 03
jmp  008D54BE
//================================
MyCharX:
mov eax [00AADCB4]
mov eax, [eax+0CC8]
ret
//================================
MyState:
push eax
mov eax, [00AADCB4]
mov eax, [eax+0378]
cmp eax, a
je LRDir1
cmp eax, b
je LRDir2
cmp eax, 14
je LRDir3
cmp eax, 15
je LRDir3
mov [MyCt], 0
jmp LRDir4
LRDir1:
mov [MyDir],2
cmp [MyCt], 32
ja LRDir5
inc [MyCt]
jmp LRDir4
LRDir2:
mov [MyDir],0
cmp [MyCt], 32
ja LRDir6
inc [MyCt]
jmp LRDir4
LRDir3:
mov [MyDir],1
jmp LRDir4
LRDir5:
mov [MyDir],3
jmp LRDir4
LRDir6:
mov [MyDir],4
call MyCharX
mov [MyPt1],eax
LRDir4:
pop eax
ret
//============================
MyStupid:

call CALLATTACK  //攻擊加速

add esp, 4
xor edx,edx
mov ecx,0000ea60
div ecx
lea eax,[esi+00000238]
add edx,0002bf20
mov [esi+00000240],edx
mov edx,[esp+10]
cmp [eax],edx
je 008D4168
cmp [esi+0000023c],edi
lea ecx,[esi+0000023c]
je 008D4168
jmp 008D414E
//============================
MyNoBack:
add esp,4

//--------↓PG無敵↓--------------
push eax
push ebx
push ecx
push edx
xor edx, edx
mov eax,[00AADCB4]
mov eax,[eax+18]
mov ecx, [VarMaxBloom]
mov ebx, [VarMinBloom]
sub ecx, ebx
jz CBR100
div ecx // edx:eax 除 ecx, 餘數放edx 簡單說就是除以差值取餘數
CBR100:
add edx, ebx       //餘數+上最小值
mov [ebp+8], edx //把結果丟進去扣寫
pop edx
pop ecx
pop ebx
pop eax
//--------↑PG無敵↑--------------

lea ecx, [edi+000017F4]
push FFFFD8F0 //原始值=FFFFFA24，修改此處可更改無敵秒數
jmp 0087DA1A
//============================
MyNoJmp:
add esp,4
jmp 008D5488
[disable]
dealloc(MyLR)
unregistersymbol(MyLR)
dealloc(MyDir)
dealloc(MyCt)
dealloc(MyPt1)

dealloc(ATTACKOF)                //攻擊加速
unregistersymbol(ATTACKOF)  //攻擊加速
dealloc(ATTACKTIME)             //攻擊加速
unregistersymbol(ATTACKTIME)//攻擊加速

unregistersymbol(LR)//跳怪掉落
dealloc(LR)             //跳怪掉落

unregistersymbol(RunSW) //熱鍵紅點模組化
dealloc(RunSW)             //熱鍵紅點模組化
dealloc(Runtemp)             //熱鍵紅點模組化

//版本:TWMS096
//數據名稱:攻擊不停
// 代碼 :008D1CE7
// EIP : CSX
[Enable]
registersymbol(CSX)
alloc(CSX,128)
label(CSXReturn)
CSX://CSEAX X
push eax
mov eax,[00AADCB4]
mov eax,[eax+2500]
cmp eax,2
pop eax
jg CSXReturn

push eax
mov eax,[00AADCB4]
mov eax,[eax+0D08]
cmp esi,eax
pop eax
jne CSXReturn
add eax,0a
jmp CSXReturn

CSXReturn:
mov [ebx], eax
jmp 008D1CE9

[Disable]
unregistersymbol(CSX)
dealloc(CSX)

//TWMS096 滑鼠移動(右趴左趴板)
//EIP=CSX
//address:008D1CE7
//熱鍵控制: 右趴下＝開左趴下＝關
[Enable]
alloc(MouserX,512)
alloc(MouserY,512)
alloc(CSX,128)
registersymbol(CSX)
alloc(OnOff,128)
registersymbol(OnOff)
label(normal)
label(normalx)
label(normaly)
label(back)
label(return)
label(On)
label(Off)

OnOff:
dd 0

CSX:
push eax
mov eax,[00AADCB4]
cmp [eax+0378],a
je On
cmp [eax+0378],b
je Off
pop eax
jmp MouserX

normal:
pop eax
mov [ebx], eax
mov edi,[ebp+10]
jmp back

back:
jmp 008D1CEC

return:
jmp 008D1D51

On:
pop eax
mov [OnOff],1
jmp MouserX

Off:
pop eax
mov [OnOff],0
jmp MouserX

MouserX:
cmp [OnOff],0
je normalx
push eax
mov eax,[00AADCB4]
mov eax,[eax+0D08]
cmp esi,eax
pop eax
jne normalx

mov eax, [00AADE50]
mov eax, [eax+0978]
mov eax, [eax+84]
mov [ebx], eax
mov edi,[ebp+10]
test edi, edi
jne    MouserY
jmp 008D1D4E

normalx:
   mov [ebx], eax
   mov edi,[ebp+10]
   jmp back

MouserY:
push eax
mov eax,[00AADCB4]
mov eax,[eax+0D08]
cmp esi,eax
pop eax
jne normaly

mov eax, [00AADE50]
mov eax, [eax+0978]
mov eax, [eax+88]
mov [edi], eax
mov ebx,[ebp+14]
jmp return

normaly:
   mov [edi], eax
   mov ebx,[ebp+14]
   jmp return

[Disable]
dealloc(MouserX)
dealloc(MouserY)
dealloc(CSX)
unregistersymbol(CSX)
dealloc(OnOff)
unregistersymbol(OnOff)

//TWMS096
//時間：2009/6/24
//更新：moyamoya
//原作：zgenden
//代碼：0051DE2A
//EIP：MAXONE
//功能：跳怪掉落1.跳怪掉落2
//-----------------------------------------------
[ENABLE]
registersymbol(MAXONE)
alloc(MAXONE,2048)
label(MAXONE00)
label(ONE)
registersymbol(ONEKEY)
alloc(ONEKEY,4)
registersymbol(ONEKEY00)
alloc(ONEKEY00,4)
registersymbol(JUPKEY)
alloc(JUPKEY, 4)
label(JUP)
label(JUP2)
label(TWO)
label(TWO00)
registersymbol(JUPKEY2)
alloc(JUPKEY2, 4)
//-----------------------------------------------
ONEKEY00:
DD 1 //總開關: 0.關 1.開

JUPKEY:
DD 1 //跳怪掉落1: 0.關 1.開

JUPKEY2:
DD 1 //跳怪掉落2: 0.關 1.開

//-----------------------------------------------
MAXONE:
cmp [ONEKEY00],0
je MAXONE00

cmp dword ptr [esp], 008D5D2B
je ONE
cmp dword ptr [esp], 008D6227
je TWO
ret

MAXONE00:
ret
//-----------------------------------------------
ONE:
add esp,4
cmp [JUPKEY],1
je JUP
fsubr qword ptr [ebp-18]
jmp 008D5D2E
//-----------------------------------------------
JUP:
cmp [ebx+0230],2
jne JUP2
mov [ebx+02D0],0
fsubr qword ptr [ebp-18]
add esp,10
fst qword ptr [ebp-18]
fcomp qword ptr [009E7B98]
jmp 008D60BA
//-----------------------------------------------
JUP2:
fsubr qword ptr [ebp-18]
jmp 008D5D2E
//-----------------------------------------------
TWO:
add esp,4
cmp [JUPKEY2],1
jne TWO00
fcomp qword ptr [ebp-08]
pop ecx
pop ecx
jmp 008D6291
TWO00:
fcomp qword ptr [ebp-08]
jmp 008D622A
//-----------------------------------------------

[DISABLE]
dealloc(MAXONE)
unregistersymbol(MAXONE)
dealloc(ONEKEY)
unregistersymbol(ONEKEY)
dealloc(ONEKEY00)
unregistersymbol(ONEKEY00)
dealloc(JUPKEY)
unregistersymbol(JUPKEY)
dealloc(JUPKEY2)
unregistersymbol(JUPKEY2)

//原作:歷史太久了~好像有人發過功能一樣的
//全圖打(可調範圍)TWMS096
//Address:0061EE58
//EIP=IwallEXP
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 1024)
registersymbol(IwallEXPX)
alloc(IwallEXPX, 4)
registersymbol(IwallEXPY)
alloc(IwallEXPY, 4)
label(IwallEXP00)

IwallEXPX:
dd C8 //以人物為中心X軸(16進位).數值越大範圍越大.目前設定200=C8(16進位)
IwallEXPY:
dd C8 //以人物為中心Y軸(16進位).數值越大範圍越大.目前設定200=C8(16進位)

IwallEXP:
mov edx,[00AADCB4]
mov edx,[edx+0CC8]
add edx,[IwallEXPX]
cmp ecx,edx
jg IwallEXP00
mov edx,[00AADCB4]
mov edx,[edx+0CC8]
sub edx,[IwallEXPX]
cmp ecx,edx
jl IwallEXP00

mov edx,[00AADCB4]
mov edx,[edx+0CCC]
add edx,[IwallEXPY]
cmp eax,edx
jg IwallEXP00
mov edx,[00AADCB4]
mov edx,[edx+0CCC]
sub edx,[IwallEXPY]
cmp eax,edx
jl IwallEXP00

mov ecx,[00AADCB4]
mov ecx,[ecx+0CC8]
mov eax,[00AADCB4]
mov eax,[eax+0CCC]
mov [ebx+00000444],ecx
jmp 0061EE5E

//-----------------------------

IwallEXP00:
mov [ebx+00000444],ecx
jmp 0061EE5E

[DISABLE]
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
dealloc(IwallEXPX)
unregistersymbol(IwallEXPX)
dealloc(IwallEXPY)
unregistersymbol(IwallEXPY)

//V96 招喚獸無延遲低功率安全版
//原作:zgenden
//更版:crazy51201
//Address:006FFD46
//EIP:TEN
//注意:不能搭配順移.不能搭配全圖.不能搭配物品落腳下
//注意:召喚獸出現，不能換頻，不能過地圖
//-----------------------------------------------
[ENABLE]
registersymbol(TEN)
alloc(TEN,1024)
registersymbol(TENKEY)
alloc(TENKEY,4)
registersymbol(TENTIMESTOP)
alloc(TENTIMESTOP,4)
registersymbol(TENTIMESTOP01)
alloc(TENTIMESTOP01,4)
registersymbol(TENTIMESTOPOF)
alloc(TENTIMESTOPOF,4)
registersymbol(TENTIMESTOPEDI)
alloc(TENTIMESTOPEDI,4)
registersymbol(TENTIMESTOP100)
alloc(TENTIMESTOP100,4)
label(TEN00)
label(TEN02)
label(TENKB)
label(TENKB00)
registersymbol(TENKEYTIME)
alloc(TENKEYTIME,4)
//-----------------------------------------------
TENKEY:
dd 1 //熱鍵: 0.關 1.開
TENTIMESTOP:
DD 0
TENTIMESTOP01:
DD 0
TENTIMESTOPOF:
DD 0
TENTIMESTOPEDI:
DD 0
TENTIMESTOP100:
DD 0
TENKEYTIME:
DD 0

TEN:
cmp [TENKEY],0
je TEN00
cmp [TENTIMESTOPEDI],edi
je TEN02
mov [TENTIMESTOPEDI],edi
mov [TENTIMESTOP],0
mov [TENTIMESTOP01],0
mov [TENTIMESTOPOF],0
TEN02:
call TENKB
mov ecx,[00aade54] //
mov ecx,[ecx+18]
sub ecx,C8 //每次進行攻擊秒數目前1秒無延遲
cmp ecx,[TENKEYTIME]
jg TEN00
mov ecx,[00aade54] //
mov ecx,[ecx+18]
sub ecx,1 //每一次攻擊延遲時間.目前0(無延遲)
cmp ecx,[TENTIMESTOP]
jle TEN00
cmp [TENTIMESTOP01],a //偵測攻擊次數.目前10下
jge TEN00
push [ebx+000000a4]
call 006cef91
pop ecx
mov ecx,esi
sub ecx,[ebx+00000100]
push esi
mov ecx,ebx
call 00700a01
push eax
mov eax,[ebx+00000100]
cmp [TENTIMESTOP100],eax
pop eax
je 006ffdb7
push eax
mov eax,[ebx+00000100]
mov [TENTIMESTOP100],eax
mov eax,[00aade54] //
mov eax,[eax+18]
mov [TENTIMESTOP],eax
pop eax
add [TENTIMESTOP01],1
jmp 006ffdb7

TEN00:
jg 006ffdb7
cmp dword ptr [ebx+000000b4],01
jne 006ffd73
push [ebx+000000a4]
call 006cef91
pop ecx
mov ecx,esi
sub ecx,[ebx+00000100]
jmp 006ffdb7

TENKB:
cmp [TENTIMESTOP01],1
jle TENKB00
ret

TENKB00:
mov ecx,[00aade54] //
mov ecx,[ecx+18]
mov [TENKEYTIME],ecx
ret
//-----------------------------------------------
[DISABLE]
dealloc(TEN)
unregistersymbol(TEN)
dealloc(TENKEY)
unregistersymbol(TENKEY)
dealloc(TENTIMESTOP)
unregistersymbol(TENTIMESTOP)
dealloc(TENTIMESTOP01)
unregistersymbol(TENTIMESTOP01)
dealloc(TENTIMESTOPOF)
unregistersymbol(TENTIMESTOPOF)
dealloc(TENTIMESTOPEDI)
unregistersymbol(TENTIMESTOPEDI)
dealloc(TENTIMESTOP100)
unregistersymbol(TENTIMESTOP100)
dealloc(TENKEYTIME)
unregistersymbol(TENKEYTIME)

回覆

使用道具舉報

冰楓

2516 主題	1 好友	1萬積分

管理員

Rank: 15

UID: 41
帖子: 11996
主題: 2516
精華: 80
積分: 12581
楓幣: 58267
威望: 7704
存款: 1000000
贊助金額: 0
推廣: 1
ＧＰ: 5087
閱讀權限: 255
在線時間: 65535 小時
註冊時間: 2011-3-31
最後登入: 2024-5-6

發消息

3樓

發表於 2014-2-5 19:38:29 |只看該作者

TWMS098 （一些舊數據，僅供參考＆研究）

[ENABLE]
//真。招喚獸攻擊無延遲ＣＲＣ　Ｖ９８　版本
//原作:zgenden
registersymbol(FixTime)
alloc(FixTime,1024)
registersymbol(FixTimeOF)
alloc(FixTimeOF,4)
registersymbol(Fix)
alloc(Fix,1024)
registersymbol(FixSSTime)
alloc(FixSSTime,4)
registersymbol(FixSSTime10C)
alloc(FixSSTime10C,4)
label(Fix00)
label(Fix01)
//-----------------------------------------------
Fix:
push eax
mov eax,[ebx+0000010c]
cmp [FixSSTime10C],eax
pop eax
je Fix01
push eax
mov eax,[FixTimeOF]
cmp eax,[FixSSTime]
pop eax
je Fix00
push eax
mov eax,[ebx+0000010c]
mov [FixSSTime10C],eax
mov eax,[FixTimeOF]
mov [FixSSTime],eax
pop eax

Fix01:
push [ebx+000000b0]
call 006eabc4
pop ecx
mov ecx,esi
sub ecx,[ebx+0000010c]
push esi
mov ecx,ebx
call 0071d630
jmp 0071c9e0

//-----------------------------------------------
Fix00:
jg 0071c9e0
cmp dword ptr [ebx+000000c0],01
jmp 0071C978
//-----------------------------------------------

FixTime:
add [FixTimeOF],2710
mov eax,[FixTimeOF]
ret

0071C96F:
jmp Fix
nop
nop
nop
nop

0071E051:
call FixTime
//-----------------------------------------------
[DISABLE]
0071C96F:
jg 0071c9e0
cmp dword ptr [ebx+000000c0],01

//-----------------------------------------------
dealloc(FixTime)
unregistersymbol(FixTime)
//-----------------------------------------------
dealloc(Fix)
unregistersymbol(Fix)

//寵物吸物
//004F0355 8D 45 C8 50 FF 15 64 59 A3 00 85 C0 75 09 83 4D FC FF 39 5D DC EB 27 8B
[enable]
registersymbol(PetGetItem)
alloc(PetGetItem,256)
registersymbol(PetGetItemSwitch)
alloc(PetGetItemSwitch,4)
label(NormalPet)

PetGetItemSwitch:
dd 1 // 開關 0 是關 1 是開

PetGetItem:
cmp [PetGetItemSwitch],0
je NormalPet
push ebx
mov ebx,[ebp+0c]
mov [ebx],edi
mov [ebx+04],eax
pop ebx
jmp 004F036C//+8//8B 45 DC 39 58 30 74 07 B8 FF FF FF 7F EB 03 8B 40 34 8B 4D E0 50 E8 87
NormalPet:
lea eax,[ebp-38]
push eax
call dword ptr [00abf824]//第2ㄍ代碼那行
jmp 004F035F//+3

004F0355:
JMP PetGetItem
[disable]
004F0355:

//==================================================
//  TWMS_V098 快速恢復HP/MP 合併版
//  代碼原創：qqazedctgb
  //修改：wewe7070
//  日期：98/07/29
//
//  說明：每次恢復10倍HP，8倍MP
//==================================================

[Enable]
  alloc(HookFR,1024)
  registersymbol(HookFR)
  label(HookRet)
  label(HPHandler)
  label(MPHandler)

  label(FastRecoverHP)
  label(DoNormalHP)
  label(HPCheck)
  alloc(HPCounter,4)
  alloc(SetHPCounter,4)
  alloc(RecoverTime,4)
  registersymbol(SetHPCounter)

  label(FastRecoverMP)
  label(DoNormalMP)
  label(MPCheck)
  alloc(MPCounter,4)
  alloc(SetMPCounter,4)
  registersymbol(SetMPCounter)

HookFR:
  cmp [esp],0093BE5C
  je HPHandler
  cmp [esp],0093BFCA
  je MPHandler
HookRet:
  push ebp
  mov ebp,esp
  sub esp,0c
  jmp 00425b33
HPHandler:
  mov [esp],FastRecoverHP
  jmp HookRet
MPHandler:
  mov [esp],FastRecoverMP
  jmp HookRet

FastRecoverHP:
  push eax
  mov eax,[ebp-1c]
  mov [RecoverTime],eax
  pop eax

  cmp [HPCounter],0
  je HPCheck
  dec [HPCounter]
  cmp ebx,1
  jmp 0093BE5F

HPCheck:
  sub [RecoverTime],0A
  cmp ebx,[RecoverTime]
  jna DoNormalHP

  push eax
  mov eax,[SetHPCounter]
  dec eax
  mov [HPCounter],eax
  pop eax

DoNormalHP:
  cmp ebx,[ebp-1c]
  jmp 0093BE5F

FastRecoverMP:
  cmp [MPCounter],0
  je MPCheck
  dec [MPCounter]
  cmp ebx,1
  jmp 0093BFD0

MPCheck:
  cmp ebx,00002708
  jna DoNormalMP
  push eax
  mov eax,[SetMPCounter]
  dec eax
  mov [MPCounter],eax
  pop eax

DoNormalMP:
  cmp ebx,00002710
  jmp 0093BFD0

SetHPCounter:
  dd A       // 10倍HP，易斷線的請調低倍數
SetMPCounter:
  dd 8       // 8倍MP，易斷線的請調低倍數
00425B2D:
jmp HookFR
[Disable]
00425B2D:
db 55 8b ec 83 ec 0c
  unregistersymbol(HookFR)
  dealloc(HookFR)

  dealloc(HPCounter)
  dealloc(SetHPCounter)
  dealloc(RecoverTime)
  unregistersymbol(SetHPCounter)

  dealloc(MPCounter)
  dealloc(SetMPCounter)
  unregistersymbol(SetMPCounter)

//原作:歷史太久了~好像有人發過功能一樣的
//全圖打(可調範圍)TWMS098
//Address:00635C25
//EIP=IwallEXP
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 1024)
registersymbol(IwallEXPX)
alloc(IwallEXPX, 4)
registersymbol(IwallEXPY)
alloc(IwallEXPY, 4)
label(IwallEXP00)

IwallEXPX:
dd C8 //以人物為中心X軸(16進位).數值越大範圍越大.目前設定200=C8(16進位)
IwallEXPY:
dd C8 //以人物為中心Y軸(16進位).數值越大範圍越大.目前設定200=C8(16進位)

IwallEXP:
mov edx,[00ADC0D4]
mov edx,[edx+0D2C]
add edx,[IwallEXPX]
cmp ecx,edx
jg IwallEXP00
mov edx,[00ADC0D4]
mov edx,[edx+0D2C]
sub edx,[IwallEXPX]
cmp ecx,edx
jl IwallEXP00

mov edx,[00ADC0D4]
mov edx,[edx+0D30]
add edx,[IwallEXPY]
cmp eax,edx
jg IwallEXP00
mov edx,[00ADC0D4]
mov edx,[edx+0D30]
sub edx,[IwallEXPY]
cmp eax,edx
jl IwallEXP00

mov ecx,[00ADC0D4]
mov ecx,[ecx+0D2C]
mov eax,[00ADC0D4]
mov eax,[eax+0D30]
mov [ebx+00000484],ecx
jmp 00635C2B

//-----------------------------

IwallEXP00:
mov [ebx+00000484],ecx
jmp 00635C2B

[DISABLE]
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
dealloc(IwallEXPX)
unregistersymbol(IwallEXPX)
dealloc(IwallEXPY)
unregistersymbol(IwallEXPY)

//================================================
// 名稱: 物品過濾
// 功能: 過濾不要的物品
// 版本: TWMS098
// 更新時間: 2009/7/30
// 更新作者: momomom
// ADD: 004F1349
// EIP: ItemFilter
// 物品位址EIP: ItemCounter
//================================================

[ENABLE]
//================================================
// 名稱: 物品過濾
// 功能: 過濾不要的物品
// 版本: TWMS098
// 更新時間: 2009/7/30
// 更新作者: momomom
// ADD: 004F1349
// EIP: ItemFilter
// 物品位址EIP: ItemCounter
//================================================
alloc(ItemFilter,124)
alloc(IFTable,16024)
alloc(ItemCounter,4)
label(ifreject)
label(end)
label(skip)
registersymbol(ItemFilter)
registersymbol(ItemCounter)

ItemFilter:
mov [ItemCounter],eax
push ebx
push esi
xor ebx, ebx
mov esi,IFTable
ifreject:
cmp eax,[esi]
je skip
cmp [esi],ebx
je end
add esi,4
jmp ifreject
skip:
mov eax,00
end:
pop esi
pop ebx
mov [edi+34],eax
jmp 004F134C

IFTable:

dd 00

[DISABLE]
dealloc(ItemFilter)
unregistersymbol(ItemFilter)
dealloc(IFTable)
dealloc(ItemCounter)

//V98召喚獸&人物攻擊範圍落腳下
//原作:zgenden
//Address:0062FED6
//EIP:ALLWD
//-----------------------------------------------
[ENABLE]
registersymbol(ALLWD)
alloc(ALLWD,1024)
label(ALLWD00)
label(ALLWD01)
label(ALLWD02)
//-----------------------------------------------
ALLWD:
push eax
mov    eax,[00ADC0D4]
mov    eax,[eax+00000D2C]
cmp    [ecx+00000478],eax
jg    ALLWD01
jl    ALLWD02
mov    eax,[00ADC0D4]
mov    eax,[eax+00000D2C]
mov    [ecx+00000478],eax
jmp    ALLWD00
ALLWD00:
mov    eax,[00ADC0D4]
mov    eax,[eax+00000D30]
mov    [ecx+0000047C],eax
pop    eax
lea    eax,[ecx+00000478]
ret
ALLWD01:
mov    eax,[00ADC0D4]
mov    eax,[eax+00000D2C]
add    eax,0             //距離人物右邊值.遠攻者自己調整
mov    [ecx+00000478],eax
jmp    ALLWD00
ALLWD02:
mov    eax,[00ADC0D4]
mov    eax,[eax+00000D2C]
sub    eax,0             //距離人物左邊值.遠攻者自己調整
mov    [ecx+00000478],eax
jmp    ALLWD00
//-----------------------------------------------
[DISABLE]
dealloc(ALLWD)
unregistersymbol(ALLWD)

//V98招喚獸短擊
//原作:zgenden
//更新:緯洨寶
//Address:0071C88C
//EIP:FIR
//-----------------------------------------------
[ENABLE]
registersymbol(FIR)
alloc(FIR,1024)
registersymbol(FIRTIMESS)
alloc(FIRTIMESS,4)
registersymbol(FIRSKILL)
alloc(FIRSKILL,4)
registersymbol(FIREDI)
alloc(FIREDI,4)
label(FIR00)
label(FIR01)
//-----------------------------------------------
FIRTIMESS:
DD 0    //招喚獸攻擊時間
FIRSKILL:
DD 0    //招喚獸攻擊次數
FIREDI:
DD 0    //招喚獸EDI
//-----------------------------------------------
FIR:
cmp [FIREDI],edi
je FIR00
push eax
call FIR01
pop ecx
pop ecx
mov dword ptr [ebx+000000c0],01
push [ebx+000000dc]
lea eax,[ebx+000000d4]
push eax
call FIR01
pop ecx
pop ecx
mov dword ptr [ebx+000000b4],01
push [ebx+000000a4]
call 006EABC4
pop ecx
push esi
mov ecx,ebx
call 0071D630
push eax
mov eax,[ebx+00000100]
cmp [FIRTIMESS],eax
pop eax
je 0071C9E0
push eax
mov eax,[ebx+00000100]
mov [FIRTIMESS],eax
mov [FIREDI],edi
pop eax
jmp 0071C9E0
//-----------------------------------------------
FIR00:
push eax
jmp 0071C88D
//-----------------------------------------------
FIR01:
push ebp
mov ebp,esp
mov eax,[ebp+08]
push ebx
mov ebx,[eax+04]
push esi
mov esi,[eax]
push edi
push 05
push ebx
call 0099430B
mov edi,eax
xor edi,esi
push 05
xor esi,baadf00d
push esi
call 00993F54
add eax,ebx
add esp,10
mov eax,edi
pop edi
pop esi
pop ebx
pop ebp
ret
//-----------------------------------------------
[DISABLE]
dealloc(FIR)
unregistersymbol(FIR)
dealloc(FIRTIMESS)
unregistersymbol(FIRTIMESS)
dealloc(FIREDI)
unregistersymbol(FIREDI)
dealloc(FIRSKILL)
unregistersymbol(FIRSKILL)

//原作:歷史太久了~好像有人發過功能一樣的
//全圖打(可調範圍)TWMS098
//Address:00635C25
//EIP=IwallEXP
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 2048)
label(IwallEXP00)
label(IwallEXP01)
registersymbol(IwallTimes)
alloc(IwallTimes, 4)
registersymbol(x2)
alloc(x2, 4)
registersymbol(x1)
alloc(x1, 4)
registersymbol(y1)
alloc(y1, 4)
registersymbol(y2)
alloc(y2, 4)
registersymbol(Timer)
alloc(Timer, 4)

IwallTimes:
dd 0
Timer:
dd 1f4 // 500ms
x2:
dd 3e8  // 1000
y2:
dd 1f4  //500

IwallEXP:
mov edx,[00adc274]    //
mov edx,[edx+18]
sub edx,[Timer] //每 500 ms 換下一張圖
cmp edx,[IwallTimes]
jl IwallEXP01

mov edx,[00adc274]    //
mov edx,[edx+18]
mov [IwallTimes],edx

mov edx,[x2]
mov [x1],edx
sub [x2],1f4

mov edx,[y2]
mov [y1],edx

cmp [x2], FFFFFC18
jge IwallEXP01

mov [x2],3e8
sub [y2],1f4

cmp [y2], FFFFFE0C
jge IwallEXP01

mov [y2],1f4

IwallEXP01:
mov edx,[00ADC0D4]
mov edx,[edx+0d2c]
add edx,[x1]
cmp ecx,edx
jg IwallEXP00
sub edx,1f4 // 500
cmp ecx,edx
jl IwallEXP00

mov edx,[00ADC0D4]
mov edx,[edx+0d30]
add edx,[y1]
cmp eax,edx
jg IwallEXP00
sub edx,1f4
cmp eax,edx
jl IwallEXP00

mov ecx,[00ADC0D4]
mov ecx,[ecx+0d2c]
mov eax,[00ADC0D4]
mov eax,[eax+0d30]
mov [ebx+00000484],ecx
jmp 00635C2B

//-----------------------------

IwallEXP00:
mov [ebx+00000484],ecx
jmp 00635C2B

[DISABLE]
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
unregistersymbol(IwallTimes)
dealloc(IwallTimes)
unregistersymbol(x1)
dealloc(x1)
unregistersymbol(y1)
dealloc(y1)
unregistersymbol(x2)
dealloc(x2)
unregistersymbol(y2)
dealloc(y2)
unregistersymbol(Timer)
dealloc(Timer)

回覆

使用道具舉報

冰楓

2516 主題	1 好友	1萬積分

管理員

Rank: 15

UID: 41
帖子: 11996
主題: 2516
精華: 80
積分: 12581
楓幣: 58267
威望: 7704
存款: 1000000
贊助金額: 0
推廣: 1
ＧＰ: 5087
閱讀權限: 255
在線時間: 65535 小時
註冊時間: 2011-3-31
最後登入: 2024-5-6

發消息

4樓

發表於 2014-2-5 19:42:41 |只看該作者

TWMS100 （一些舊數據，僅供參考＆研究）

[ENABLE]
//================================================
// 名稱: 物品過濾
// 功能: 過濾不要的物品
// 版本: TWMS0100
// 更新時間: 2009/8/26
// ADD: 004F2329
// EIP: ItemFilter
// 物品位址EIP: ItemCounter
//================================================
alloc(ItemFilter,124)
alloc(IFTable,16024)
alloc(ItemCounter,4)
label(ifreject)
label(end)
label(skip)
registersymbol(ItemFilter)
registersymbol(ItemCounter)

ItemFilter:
mov [ItemCounter],eax
push ebx
push esi
xor ebx, ebx
mov esi,IFTable
ifreject:
cmp eax,[esi]
je skip
cmp [esi],ebx
je end
add esi,4
jmp ifreject
skip:
mov eax,00
end:
pop esi
pop ebx
mov [edi+34],eax
jmp 004F232C

IFTable:

dd 00

[DISABLE]
dealloc(ItemFilter)
unregistersymbol(ItemFilter)
dealloc(IFTable)
dealloc(ItemCounter)
unregistersymbol(ItemCounter)

//版本:TWMS100
//數據名稱:攻擊不停.放不停
//日期:2009/7/30
// 代碼 :00900642
// EIP : CSX
[Enable]
registersymbol(CSX)
alloc(CSX,128)
label(CSXReturn)
CSX://CSEAX X
push eax
mov eax,[00AE62C4]
mov eax,[eax+2598]
cmp eax,2
pop eax
jg CSXReturn

push eax
mov eax,[00AE62C4]
mov eax,[eax+2588]
cmp eax,2
pop eax
jg CSXReturn
push eax
mov eax,[00AE62C4]
mov eax,[eax+0D6C]
cmp esi,eax
pop eax
jne CSXReturn
add eax,0a
jmp CSXReturn
CSXReturn:
mov [ebx], eax
jmp 00900644
[Disable]
unregistersymbol(CSX)
dealloc(CSX)

//==================================================
//  TWMS_V100 快速恢復 HP/MP 合併版
//  代碼原創：qqazedctgb
//  Address：00425C20
//  EIP=HookFR
//  說明：每次恢復10倍HP，8倍MP
//==================================================

[Enable]
  alloc(HookFR,256)
  registersymbol(HookFR)
  label(HookRet)
  label(HPHandler)
  label(MPHandler)

  label(FastRecoverHP)
  label(DoNormalHP)
  label(HPCheck)
  alloc(HPCounter,4)
  alloc(SetHPCounter,4)
  alloc(RecoverTime,4)
  registersymbol(SetHPCounter)

  label(FastRecoverMP)
  label(DoNormalMP)
  label(MPCheck)
  alloc(MPCounter,4)
  alloc(SetMPCounter,4)
  registersymbol(SetMPCounter)

HookFR:
  cmp [esp],00944655
  je HPHandler
  cmp [esp],009447C3
  je MPHandler

HookRet:
  push ebp
  jmp 00425C21

HPHandler:
  mov [esp],FastRecoverHP
  jmp HookRet

MPHandler:
  mov [esp],FastRecoverMP
  jmp HookRet

FastRecoverHP:
  push eax
  mov eax,[ebp-1c]
  mov [RecoverTime],eax
  pop eax

  cmp [HPCounter],0
  je HPCheck
  dec [HPCounter]
  cmp ebx,1
  jmp 00944658

HPCheck:
  sub [RecoverTime],0A
  cmp ebx,[RecoverTime]
  jna DoNormalHP

  push eax
  mov eax,[SetHPCounter]
  dec eax
  mov [HPCounter],eax
  pop eax

DoNormalHP:
  cmp ebx,[ebp-1c]
  jmp 00944658

FastRecoverMP:
  cmp [MPCounter],0
  je MPCheck
  dec [MPCounter]
  cmp ebx,1
  jmp 009447C9

MPCheck:
  cmp ebx,00002708
  jna DoNormalMP
  push eax
  mov eax,[SetMPCounter]
  dec eax
  mov [MPCounter],eax
  pop eax

DoNormalMP:
  cmp ebx,00002710
  jmp 009447C9

SetHPCounter:
  dd A       // 10倍HP，易斷線的請調低倍數
SetMPCounter:
  dd 8       // 8倍MP，易斷線的請調低倍數

[Disable]
  unregistersymbol(HookFR)
  dealloc(HookFR)

  dealloc(HPCounter)
  dealloc(SetHPCounter)
  dealloc(RecoverTime)
  unregistersymbol(SetHPCounter)

  dealloc(MPCounter)
  dealloc(SetMPCounter)
  unregistersymbol(SetMPCounter)

[enable]
//滑鼠控制人物 for TWMS100
//原作者：maggie98
//Address：009006A7
//EIP：MouseRushStart
//熱鍵控制：RushSW【value值設定1，熱鍵自設】
registersymbol(MouseRushStart)
alloc(MouseRushStart, 1024)
registersymbol(RushSW)
alloc(RushSW, 4)
alloc(RushOn, 4)
label(RetMSRush)

RushSW:
      dd    0             // 初始是關閉mouse 趕路
RushOn:
      dd    0

MouseRushStart:
      mov    ebx, [RushSW]
      xor    [RushOn], ebx
      mov    [RushSW], 0
      cmp    [RushOn], 1
      jne    RetMSRush
      mov    ebx, [00AE62C4]
      mov    ebx, [ebx+0D6C]
      cmp    esi, ebx
      jne    RetMSRush
      mov    eax, [00AE6460]
      mov    eax, [eax+978]
      mov    ebx, [eax+84]
      mov    eax, [eax+88]
      mov    [edi-4], ebx
RetMSRush:
      mov    [edi], eax
      jmp    009006A9

[disable]
unregistersymbol(MouseRushStart)
dealloc(MouseRushStart)
unregistersymbol(RushSW)
dealloc(RushSW)
dealloc(RushOn)

//V100招喚獸短擊
//原作:zgenden
//Address:007225F4
//EIP:FIR
//更新wugey
//-----------------------------------------------
[ENABLE]
registersymbol(FIR)
alloc(FIR,1024)
registersymbol(FIRTIMESS)
alloc(FIRTIMESS,4)
registersymbol(FIRSKILL)
alloc(FIRSKILL,4)
registersymbol(FIREDI)
alloc(FIREDI,4)
label(FIR00)
label(FIR01)
label(TEN02)
//-----------------------------------------------
FIRTIMESS:
DD 0    //招喚獸攻擊時間
FIRSKILL:
DD 0    //招喚獸攻擊次數
FIREDI:
DD 0    //招喚獸EDI
//-----------------------------------------------
FIR:
cmp [FIREDI],edi
je TEN02
mov [FIREDI],edi
mov [FIRTIMESS],0
mov [FIRSKILL],0
TEN02:
cmp [FIRSKILL],2 //偵測攻擊次數.目前2下
jge FIR00
call FIR01
pop ecx
pop ecx
mov dword ptr [ebx+000000cc],01
push [ebx+000000e8]
lea eax,[ebx+000000e0]
push eax
call FIR01
pop ecx
pop ecx
mov dword ptr [ebx+000000c0],01
push [ebx+000000b0]
call 006efb78
pop ecx
push esi
mov ecx,ebx
call 00723397
push eax
mov eax,[ebx+0000010c]
cmp [FIRTIMESS],eax
pop eax
je 00722747
push eax
mov eax,[ebx+0000010c]
mov [FIRTIMESS],eax
mov [FIREDI],edi
add [FIRSKILL],1
pop eax
jmp 00722747
//-----------------------------------------------
FIR00:
call 004146b2
jmp 007225F9
//-----------------------------------------------
FIR01:
push ebp
mov ebp,esp
mov eax,[ebp+08]
push ebx
mov ebx,[eax+04]
push esi
mov esi,[eax]
push edi
push 05
push ebx
call 0099d2fb
mov edi,eax
xor edi,esi
push 05
xor esi,baadf00d
push esi
call 0099cf44
add eax,ebx
add esp,10
mov eax,edi
pop edi
pop esi
pop ebx
pop ebp
ret
//-----------------------------------------------
[DISABLE]
dealloc(FIR)
unregistersymbol(FIR)
dealloc(FIRTIMESS)
unregistersymbol(FIRTIMESS)
dealloc(FIREDI)
unregistersymbol(FIREDI)
dealloc(FIRSKILL)
unregistersymbol(FIRSKILL)

//怪物順移全集
//原作:  a00764599
//順移原本代碼作者:  maxjojo
//更新:qwe8966351
//Address : 004146B2
//Eip : ALLFAST
//=================注意================注意===================

[ENABLE]
registersymbol(ALLFAST)
registersymbol(Moves1onoff)
registersymbol(Moves2onoff)
registersymbol(Moves3onoff)
registersymbol(Moves4onoff)

alloc(ALLFAST, 1024)
alloc(Moves1onoff, 4)
alloc(Moves2onoff, 4)
alloc(Moves3onoff, 4)
alloc(Moves4onoff, 4)

label(Stop)
label(Moves1)
label(Moves1Normal)
label(Moves2)
label(Moves2Normal)
label(Moves3)
label(Moves3Normal)
label(Moves4)
label(Moves4Normal)
//=======================================================
//怪瞬移1號開關    【0】關    【1】開
//=======================================================
Moves1onoff:
dd 0
//=======================================================
//怪瞬移2號開關    【0】關    【1】開
//=======================================================
Moves2onoff:
dd 0
//=======================================================
//怪瞬移3號開關    【0】關    【1】開
//=======================================================
Moves3onoff:
dd 0
//=======================================================
//怪瞬移4號開關    【0】關    【1】開
//=======================================================
Moves4onoff:
dd 1
//=======================================================
ALLFAST:
cmp dword ptr [esp], 0065A07A //怪瞬移1號
je    Moves1
cmp dword ptr [esp], 0065A02F //怪瞬移2號
je    Moves2
cmp dword ptr [esp], 0065A021 //怪瞬移3號
je    Moves3
cmp dword ptr [esp], 0065A09A //怪瞬移4號
je    Moves4
//=======================================================
Stop:
push ebp
jmp 004146B3
//===怪瞬移1號====================================
Moves1:
cmp [Moves1onoff], 1
jne Moves1Normal
ret
Moves1Normal:
jmp Stop
//===怪瞬移2號====================================
Moves2:
cmp [Moves2onoff], 1
jne Moves2Normal
ret
Moves2Normal:
jmp Stop
//===怪瞬移3號====================================
Moves3:
cmp [Moves3onoff], 1
jne Moves3Normal
ret
Moves3Normal:
jmp Stop
//===怪瞬移4號====================================
Moves4:
cmp [Moves4onoff], 1
jne Moves4Normal
ret
Moves4Normal:
jmp Stop

[disable]
unregistersymbol(ALLFAST)
unregistersymbol(Moves1onoff)
unregistersymbol(Moves2onoff)
unregistersymbol(Moves3onoff)
unregistersymbol(Moves4onoff)
dealloc(Monster along moves)
dealloc(Moves1onoff)
dealloc(Moves2onoff)
dealloc(Moves3onoff)
dealloc(Moves4onoff)

//疾風N合一 for TWMS V100
//原作：jajaja
//原出處：疾風之莊
//功能：控怪方向：左趴往左；右趴往右
//       致命吸引力：左趴定點；右趴跟隨(無法與疾風的跳怪掉落連用)
//       紅點控制：有紅點部分功能暫停(保留停止呼吸、血控、無敵)，紅點５個以上全功能暫停
//       碰撞攻不停、角色不被擊退、碰怪後無敵30秒、笨怪、跳怪不跳、
//       超級撿物、停止呼吸、跳怪掉落、攻擊加速、損血控制
//Address：004147C2
//EIP：MyLR
//=================================================
[enable]
registersymbol(MyLR)
alloc(MyLR,1280)
label(MyLR1)
label(MyLR0)

registersymbol(LR)
alloc(MyDir,4)
alloc(MyCt,4)
alloc(MyPt,4)
alloc(LR,4)
label(GoLR)
label(GoLR1)
label(GoLR2)
label(GoLR3)
label(GoLR4)
label(GoLR5)
label(GoLRback)
label(JmpLR)
label(JmpLR1)
label(JmpLR2)
label(JmpLRback)
label(MyState)
label(MyCharX)
label(LRDir1)
label(LRDir2)
label(LRDir3)
label(LRDir4)
label(LRDir5)
label(LRDir6)
label(LRDir7)

label(MyNoBack)
registersymbol(KBSwitch)
alloc(KBSwitch,4)
alloc(KBLR,4)
label(Untouchable)

registersymbol(VarMaxDamage)
registersymbol(VarMinDamage)
alloc(VarMaxDamage,4)
alloc(VarMinDamage,4)

registersymbol(StupidSwitch)
alloc(StupidSwitch,4)
label(MyStupid)
label(QuitS)

registersymbol(ASUSwitch)
registersymbol(ASUInterval)
alloc(ASUSwitch,4)
alloc(ASUInterval,4)
alloc(AttackTime,4)
label(AtkSpeedUp)
label(QuitASU)

label(MyNoJmp)

//---------↓ＫＢ攻不停↓---------
KBSwitch:                      //ＫＢ攻不停開關：
  DD 1                               //0 = 關；1 = 開
KBLR:
  DD 3
//---------↑ＫＢ攻不停↑---------

//----------↓笨　　怪↓----------
StupidSwitch:                      //笨怪開關：
  DD 1                               //0 = 關；1 = 開
//----------↑笨　　怪↑----------

//----------↓攻擊加速↓----------
ASUSwitch:                      //攻擊加速開關：
  DD 1                               //0 = 關；1 = 開
ASUInterval:                      //加速時間：(會斷線請增加數值，穩定的可以試著減少數值)
  DD 2BC                      //預設值：7D0 = 2秒 (1.5秒=5DC；3秒=BB8)
AttackTime:
  DD 0
//----------↑攻擊加速↑----------

//----------↓掉怪控怪↓----------
LR:                               //跳怪掉落開關：
  DD 1                               //1 = 停用；3 = 左掉落；2 = 右掉落
MyDir:
  DD 1
//----------↑掉怪控怪↑----------

MyLR:
  push eax

  cmp [00AE62C4],00000000
  je MyLR1
  mov eax,[00AE62C4]
  mov [eax+380],0

  cmp [00AE62D8],00000000
  je MyLR1
  mov eax,[00AE62D8]
  mov eax,[eax+18]
  cmp eax,4
  ja MyLR1
  cmp eax,0
  pop eax
  jne MyLR0

  push eax
  cmp [00AE1E60],00000000
  je MyLR1
  mov eax,[00AE1E60]
  mov [eax+2074],0

  pop eax
  cmp dword ptr [esp], 00902D26
  je MyStupid
  cmp dword ptr [esp], 00903D8F
  je GoLR
  cmp dword ptr [esp], 009041A9
  je JmpLR
  cmp dword ptr [esp], 00904161
  je MyNoJmp
MyLR0:
  cmp dword ptr [esp], 008AA275
  je MyNoBack
  ret

MyLR1:
  pop eax
  ret

//=====↓不被擊退、碰怪無敵↓=====
MyNoBack:
  add esp,4

//---------↓ＫＢ攻不停↓---------
  cmp [KBSwitch],0
  je Untouchable

  push eax
  mov eax,[00AE62C4]
  mov eax,[eax+2588]
  cmp eax,10
  pop eax
  jb Untouchable
  push eax
  mov eax,[KBLR]
  mov [ebp+20],eax
  mov [ebp-9C],eax
  neg eax
  mov [KBLR],eax
  pop eax

  push 64
  jmp 008AA277
//---------↑ＫＢ攻不停↑---------

Untouchable:
  mov eax,[ebp-10]
  lea ecx,[eax+0000187C]
  push FFFFD8F0
  jmp 008AA999
//=====↑不被擊退、碰怪無敵↑=====

//==========↓笨　　怪↓==========
MyStupid:
  add esp,4

  call AtkSpeedUp

  cmp [StupidSwitch],0
  je QuitS

  xor edx,edx
  mov ecx,0000ea60
  div ecx
  lea eax,[esi+00000238]
  add edx,0002bf20
  mov [esi+00000240],edx
  mov edx,[esp+10]
  cmp [eax],edx
  je 00902D71
  cmp [esi+0000023c],edi
  lea ecx,[esi+0000023c]
  je 00902D71

QuitS:
  xor edx,edx
  jmp 00902D28
//==========↑笨　　怪↑==========

//==========↓走怪方向↓==========
GoLR:
  add esp,4

  call MyState

  push 03
  pop ecx
  mov [edi+20],eax
  xor edx,edx
  div ecx

  cmp [MyDir],1
  je GoLRback
  cmp [MyDir],3
  je GoLR1
  cmp [MyDir],4
  je GoLR3
  cmp edx,[MyDir]
  je GoLRback
  mov [esi+000004D0],0
  jmp GoLRback

GoLR1:
  push eax
  call MyCharX
  jmp GoLR4

GoLR3:
  push eax
  mov eax,[MyPt]

GoLR4:
  cmp edx,1
  je GoLR5
  jg GoLR2
  cmp eax,[esi+1C4]
  pop eax
  mov [esi+000004D0],5
  jl GoLRback
  mov [esi+000004D0],0
  jmp GoLRback

GoLR2:
  cmp eax,[esi+1C4]
  pop eax
  mov [esi+000004D0],5
  jg GoLRback
  mov [esi+000004D0],0
  jmp GoLRback

GoLR5:
  pop eax
  mov [esi+000004D0],0

GoLRback:
  jmp 00903D99
//==========↑走怪方向↑==========

//==========↓跳怪方向↓==========
JmpLR:
  add esp,4

  call MyState

  cmp [MyDir],1
  je JmpLRback
  cmp [MyDir],2
  mov eax,2
  je JmpLRback
  cmp [MyDir],0
  mov eax,3
  je JmpLRback
  cmp [MyDir],4
  je JmpLR1
  call MyCharX
  jmp JmpLR2

JmpLR1:
  mov eax,[MyPt]

JmpLR2:
  cmp eax,[esi+1C4]
  mov eax,2
  mov [esi+000004D0],5
  jg JmpLRback
  mov eax,3

JmpLRback:
//----------↓跳怪掉落↓----------
  cmp [esi+00000230],1
  je LRDir7
  cmp eax,[LR]
  jne LRDir7
  sub [esi+00000230],2

LRDir7:
//----------↑跳怪掉落↑----------
  push 03
  jmp 009041AB
//==========↑跳怪方向↑==========

//----------↓Ｘ　座標↓----------
MyCharX:
  mov eax,[00AE62C4]
  mov eax,[eax+00000D2C]
  ret
//----------↑Ｘ　座標↑----------

//----------↓角色狀態↓----------
MyState:
  push eax
  mov eax,[00AE62C4]
  mov eax,[eax+00000384]
  cmp eax,a
  je LRDir1
  cmp eax,b
  je LRDir2
  cmp eax,14
  je LRDir3
  cmp eax,15
  je LRDir3
  mov [MyCt],0
  jmp LRDir4

LRDir1:
  mov [MyDir],2
  cmp [MyCt],32
  ja LRDir5
  inc [MyCt]
  jmp LRDir4

LRDir2:
  mov [MyDir],0
  cmp [MyCt],32
  ja LRDir6
  inc [MyCt]
  jmp LRDir4

LRDir3:
  mov [MyDir],1
  jmp LRDir4

LRDir5:
  mov [MyDir],3
  jmp LRDir4

LRDir6:
  mov [MyDir],4
  call MyCharX
  mov [MyPt],eax

LRDir4:
  pop eax
  ret
//----------↑角色狀態↑----------

//==========↓跳怪不跳↓==========
MyNoJmp:
  add esp,4
  jmp 00904175
//==========↑跳怪不跳↑==========

//----------↓攻擊加速↓----------
AtkSpeedUp:
  push eax

  cmp [ASUSwitch],0
  je QuitASU

  mov eax,[00AE6464]
  mov eax,[eax+18]
  cmp eax,[AttackTime]
  jl QuitASU
  mov eax,[00AE62C4]
  mov eax,[eax+388]
  cmp eax,ffffffff
  je QuitASU
  mov eax,[00AE62C4]
  mov [eax+388],ffffffff
  mov eax,[00AE6464]
  mov eax,[eax+18]
  add eax,[ASUInterval]
  mov [AttackTime],eax

QuitASU:
  pop eax
  ret
//----------↑攻擊加速↑----------

[disable]
dealloc(MyLR)
unregistersymbol(MyLR)
dealloc(MyDir)
dealloc(MyCt)
dealloc(MyPt)
dealloc(LR)
unregistersymbol(LR)
dealloc(KBSwitch)
unregistersymbol(KBSwitch)
dealloc(KBLR)
dealloc(VarMaxDamage)
unregistersymbol(VarMaxDamage)
dealloc(VarMinDamage)
unregistersymbol(VarMinDamage)
dealloc(StupidSwitch)
unregistersymbol(StupidSwitch)
dealloc(ASUInterval)
unregistersymbol(ASUInterval)
dealloc(AttackTime)

//V100召喚獸無延遲,不鎖EIP版
//00723DB8 eip = FixTime
//007226D6 eip = Fix
//以上兩個代碼要一起開，否則會被鎖..
[ENABLE]
registersymbol(Fix)
alloc(Fix,2048)
registersymbol(FixTime)
alloc(FixTime,64)
label(FixTimeOF)
label(FixSSTime)
label(FixSSTime10C)
label(Fix00)
label(Fix01)
Fix:
      push eax
      mov eax,[ebx+0000010c]
      cmp [FixSSTime10C],eax
      pop eax
      je Fix01
      push eax
      mov eax,[FixTimeOF]
      cmp eax,[FixSSTime]
      pop eax
      je Fix00
      push eax
      mov eax,[ebx+0000010c]
      mov [FixSSTime10C],eax
      mov eax,[FixTimeOF]
      mov [FixSSTime],eax
      pop eax
Fix01:
      push [ebx+000000b0]
      call 006efb78
      pop ecx
      mov ecx,esi
      sub ecx,[ebx+0000010c]
      push esi
      mov ecx,ebx
      call 00723397
      jmp 00722747
Fix00:
      jg 00722747
      cmp dword ptr [ebx+000000c0],01
      jmp 007226df
FixTimeOF:
      dd 0
FixSSTime:
      dd 0
FixSSTime10C:
      dd 0
FixTime:
      add [FixTimeOF],2710
      mov eax,[FixTimeOF]
      jmp 00723DBD
[DISABLE]
dealloc(Fix)
unregistersymbol(Fix)
dealloc(FixTime)
unregistersymbol(FixTime)

//範圍加大(下)
//Address:0063a1d6//EIP=IwallEXP
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 2048)
label(IwallEXP00)
label(IwallEXP01)
registersymbol(IwallTimes)
alloc(IwallTimes, 4)
registersymbol(x2)
alloc(x2, 4)
registersymbol(x1)
alloc(x1, 4)
registersymbol(y1)
alloc(y1, 4)
registersymbol(y2)
alloc(y2, 4)
registersymbol(Timer)
alloc(Timer, 4)
IwallTimes:
dd 0
Timer:
dd f // 500ms
x2:
dd 3e8  // 1000
y2:
dd 1f4  //500
IwallEXP:
mov edx,[00AE62C4]    //
mov edx,[edx+18]
sub edx,[Timer] //每 500 ms 換下一張圖
cmp edx,[IwallTimes]
jl IwallEXP01
mov edx,[00AE62C4]    //
mov edx,[edx+18]
mov [IwallTimes],edx
mov edx,[x2]
mov [x1],edx
sub [x2],1f4
mov edx,[y2]
mov [y1],edx
cmp [x2], FFFFFC18
jge IwallEXP01
mov [x2],3e8
sub [y2],1f4
cmp [y2], FFFFFE0C
jge IwallEXP01
mov [y2],1f4
IwallEXP01:
mov edx,[00AE62C4]
mov edx,[edx+0d2c]
add edx,[x1]
cmp ecx,edx
jg IwallEXP00
sub edx,1f4 // 500
cmp ecx,edx
jl IwallEXP00
mov edx,[00AE62C4]
mov edx,[edx+0d30]
add edx,[y1]
cmp eax,edx
jg IwallEXP00
sub edx,1f4
cmp eax,edx
jl IwallEXP00
mov ecx,[00AE62C4]
mov ecx,[ecx+0d2c]
mov eax,[00AE62C4]
mov eax,[eax+0d30]
mov [ebx+00000484],ecx
jmp 0063a1dc
IwallEXP00:
mov [ebx+00000484],ecx
jmp 0063A1DC
[DISABLE]
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
unregistersymbol(IwallTimes)
dealloc(IwallTimes)
unregistersymbol(x1)
dealloc(x1)
unregistersymbol(y1)
dealloc(y1)
unregistersymbol(x2)
dealloc(x2)
unregistersymbol(y2)
dealloc(y2)
unregistersymbol(Timer)
dealloc(Timer)

//全圖打怪KiKiVac EIP 版 for TwMs 1.00
//Address: 0063A1D6
//EIP: KiKiVac
//呆baby by:
[Enable]
registersymbol(KiKiVac)
alloc(KiKiVac,256)
label(KiKiReturn)
KiKiVac: //
mov edx,[AE62C4] // char pid pointer
lea edx,[edx+0000d2c]
mov [ebx+00000484], eax
mov ecx,[edx]
mov edx,[AE62C4] // char pid pointer
lea eax,[eax+00000D30]
mov [ebx+00000488], eax
lea eax,[edx]
mov eax,[eax]
jmp KiKiReturn
KiKiReturn:
jmp 0063A1DC
[Disable]
unregistersymbol(KiKiVac)
dealloc(KiKiVac)

//V100寵物吸物
[enable]
// For MapleStory
// ADD:004f1335
// EIPetGetItem
// 感謝 smallro,maxyoyo
// 更新射鵰英雄
registersymbol(PetGetItem)
alloc(PetGetItem,256)
registersymbol(PetGetItemSwitch)
alloc(PetGetItemSwitch,4)
label(NormalPet)

PetGetItemSwitch:
   dd    1                   // 開關 0 是關 1 是開

PetGetItem:
   cmp [PetGetItemSwitch], 0
   je    NormalPet
   push ebx
   mov ebx, [ebp+0c]
   mov [ebx], edi
   mov [ebx+04], eax
   pop ebx
   jmp 004f134c

NormalPet:
   lea eax, [ebp-38]
   push eax
   call dword ptr [00ae9a1c]
   jmp 004f133f

[disable]
unregistersymbol(PetGetItem)
dealloc(PetGetItem)
unregistersymbol(PetGetItemSwitch)
dealloc(PetGetItemSwitch)

//全圖打(可調範圍)TWMS1.00 (數據也有地方有錯)
//Address:0063A1D6
//EIP=IwallEXP
//更新  peter980421
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 1024)
registersymbol(IwallEXPX)
alloc(IwallEXPX, 4)
registersymbol(IwallEXPY)
alloc(IwallEXPY, 4)
label(IwallEXP00)

IwallEXPX:
dd 190    //以人物為中心X軸(16進位).數值越大範圍越大.目前設定200=C8(16進位)
IwallEXPY:
dd 15E    //以人物為中心Y軸(16進位).數值越大範圍越大.目前設定200=C8(16進位)

IwallEXP:
mov edx,[00AE62C4]
mov edx,[edx+0D2C]
add edx,[IwallEXPX]
cmp ecx,edx
jg IwallEXP00
mov edx,[00AE62C4]
mov edx,[edx+0D2C]
sub edx,[IwallEXPX]
cmp ecx,edx
jl IwallEXP00

mov edx,[00AE62C4]
mov edx,[edx+0D30]
add edx,[IwallEXPY]
cmp eax,edx
jg IwallEXP00
mov edx,[00AE62C4]
mov edx,[edx+0D30]
sub edx,[IwallEXPY]
cmp eax,edx
jl IwallEXP00

mov ecx,[00AE62C4]
mov ecx,[ecx+0D2C]
mov eax,[00AE62C4]
mov eax,[eax+0D30]
mov [ebx+00000484],ecx
jmp 0063A1DC

//-----------------------------

IwallEXP00:
mov [ebx+00000484],ecx
jmp 0063A1DC

[DISABLE]
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
dealloc(IwallEXPX)
unregistersymbol(IwallEXPX)
dealloc(IwallEXPY)
unregistersymbol(IwallEXPY)

//原作：zgenden
//代碼：005241DC
//EIP：Maxone
//功能：跳怪掉落1.跳怪掉落2
//-----------------------------------------------
[ENABLE]
registersymbol(Maxone)
alloc(Maxone,128)
label(QuitMaxone)

registersymbol(JDSwitch)
alloc(JDSwitch,4)
alloc(JDSwitch1, 4)
alloc(JDSwitch2, 4)
label(JumpDown1)
label(QuitJD1)
label(JumpDown2)
label(QuitJD2)

//-----------------------------------------------
JDSwitch:
  DD 1 //總開關: 0.關 1.開

JDSwitch1:
  DD 1 //跳怪掉落1: 0.關 1.開

JDSwitch2:
  DD 1 //跳怪掉落2: 0.關 1.開

//-----------------------------------------------
Maxone:
  cmp [JDSwitch],0
  je QuitMaxone

  cmp dword ptr [esp],00904A65
  je JumpDown1
  cmp dword ptr [esp],00904F61
  je JumpDown2
  ret

QuitMaxone:
  ret
//-----------------------------------------------
JumpDown1:
  add esp,4

  cmp [JDSwitch1],1
  jne QuitJD1

  cmp [ebx+0230],2
  jne QuitJD1
  fsubr qword ptr [ebp-18]
  add esp,10
  fst qword ptr [ebp-18]
  fcomp qword ptr [00A1DBB0]
  jmp 00904DF4

QuitJD1:
  fsubr qword ptr [ebp-18]
  jmp 00904A68
//-----------------------------------------------
JumpDown2:
  add esp,4

  cmp [JDSwitch2],1
  jne QuitJD2
  fcomp qword ptr [ebp-08]
  pop ecx
  pop ecx
  jmp 00904FCB

QuitJD2:
  fcomp qword ptr [ebp-08]
  jmp 00904F64
//-----------------------------------------------

[DISABLE]
dealloc(Maxone)
unregistersymbol(Maxone)
dealloc(JumpDown1KEY)
unregistersymbol(JumpDown1KEY)
dealloc(JDSwitch)
unregistersymbol(JDSwitch)
dealloc(JDSwitch1)
unregistersymbol(JDSwitch1)
dealloc(JDSwitch2)
unregistersymbol(JDSwitch2)

//TWMS 0100 招喚獸攻擊物落腳下 EIP 版
//原作:zgende
//Address: 00723E5B
//EIP:FIX_TTBOX_DOWN
//-----------------------------------------------
[ENABLE]
registersymbol(FIX_TTBOX_DOWN)
alloc(FIX_TTBOX_DOWN,1024)
registersymbol(FIX_TTBOX_DOWN_XX)
alloc(FIX_TTBOX_DOWN_XX,4)
registersymbol(FIX_TTBOX_DOWN_YY)
alloc(FIX_TTBOX_DOWN_YY,4)
label(FIX_TTBOX_DOWN_X)
label(FIX_TTBOX_DOWN_Y)
//-----------------------------------------------
FIX_TTBOX_DOWN_XX:
DD 0
FIX_TTBOX_DOWN_YY:
DD 0
//-----------------------------------------------
FIX_TTBOX_DOWN:
call FIX_TTBOX_DOWN_X
mov ax,[FIX_TTBOX_DOWN_XX]
lea ecx,[ebp-44]
push eax
call 0042524D
mov eax,[esi]
lea ecx,[eax+04]
mov eax,[ecx]
call FIX_TTBOX_DOWN_Y
mov ax,[FIX_TTBOX_DOWN_YY]
jmp 00723E78
//-----------------------------------------------
FIX_TTBOX_DOWN_X:
push eax
mov eax,[00AE62C4]
mov eax,[eax+D2C]
mov [FIX_TTBOX_DOWN_XX],eax
pop eax
ret
//-----------------------------------------------
FIX_TTBOX_DOWN_Y:
push eax
mov eax,[00AE62C4]
mov eax,[eax+D30]
mov [FIX_TTBOX_DOWN_YY],eax
pop eax
ret
//-----------------------------------------------
[DISABLE]
dealloc(FIX_TTBOX_DOWN)
unregistersymbol(FIX_TTBOX_DOWN)

回覆

使用道具舉報

冰楓

2516 主題	1 好友	1萬積分

管理員

Rank: 15

UID: 41
帖子: 11996
主題: 2516
精華: 80
積分: 12581
楓幣: 58267
威望: 7704
存款: 1000000
贊助金額: 0
推廣: 1
ＧＰ: 5087
閱讀權限: 255
在線時間: 65535 小時
註冊時間: 2011-3-31
最後登入: 2024-5-6

發消息

5樓

發表於 2014-2-5 19:49:51 |只看該作者

TWMS103 （一些舊數據，僅供參考＆研究）

//====================================================
//版本：TWMS0103 (CRC版)
//功能：不顯示攻擊傷害
//日期：2009/10/8
//====================================================
[Enable]
006476A8:
nop
nop
nop
nop
nop
[Disable]
006476A8:
call 006476AD

//原作:darkword
//TWMS103 召喚獸無延遲,不鎖CRC版
//部落格網址：http://www.22up.com/blog/darkword
//轉載請保留出處
//------------------------------------------------------------------
[ENABLE]
registersymbol(FixTime)
alloc(FixTime,1024)
registersymbol(FixTimeOF)
alloc(FixTimeOF,4)
registersymbol(Fix)
alloc(Fix,1024)
registersymbol(FixSSTime)
alloc(FixSSTime,4)
registersymbol(FixSSTime10C)
alloc(FixSSTime10C,4)
label(Fix00)
label(Fix01)
//-----------------------------------------------
Fix:
push eax
mov eax,[ebx+0000010c]
cmp [FixSSTime10C],eax
pop eax
je Fix01
push eax
mov eax,[FixTimeOF]
cmp eax,[FixSSTime]
pop eax
je Fix00
push eax
mov eax,[ebx+0000010c]
mov [FixSSTime10C],eax
mov eax,[FixTimeOF]
mov [FixSSTime],eax
pop eax

Fix01:
push [ebx+000000b0]
call 0070669d
pop ecx
mov ecx,esi
sub ecx,[ebx+0000010c]
push esi
mov ecx,ebx
call 0073b42a
jmp 0073a7da

//-----------------------------------------------
Fix00:
jg 0073a7da
mov eax,[ebx+000000c0]
jmp 0073A76E
//-----------------------------------------------

FixTime:
add [FixTimeOF],2710
mov eax,[FixTimeOF]
ret

73A766:
jmp Fix
db 90 90 90

73BE4B:
call FixTime
//-----------------------------------------------
[DISABLE]
73A766:
jg 0073a7da
mov eax,[ebx+000000c0]

//-----------------------------------------------
dealloc(FixTime)
unregistersymbol(FixTime)
//-----------------------------------------------
dealloc(Fix)
unregistersymbol(Fix)
dealloc(Fix)
unregistersymbol(Fix)

// Twms v103 閃爍無敵-CRC版
//==================================================
[ENABLE]
registersymbol(god)
alloc(god,32)

god:
  mov  eax,64
  mov  esi,0
  jmp  008A2B88
008A2B7B:
  Jmp  god

[DISABLE]
008A2B7B:
  DB 85 c0 7e 28 8b CF
dealloc(god)
unregistersymbol(god)

//======================================
//TWMSv1.3 滑鼠移動(右趴左趴板) [CRC]
//
//熱鍵控制: 右趴下＝開左趴下＝關
//======================================
[Enable]
alloc(MouserX,512)
alloc(MouserY,512)
alloc(CSX,128)
alloc(OnOff,128)
label(normal)
label(normalx)
label(normaly)
label(back)
label(return)
label(On)
label(Off)
registersymbol(CSX)
registersymbol(OnOff)

OnOff:
dd 0

CSX:
push eax
mov eax,[00B0B904]
cmp [eax+0398],a
je On
cmp [eax+0398],b
je Off
pop eax
jmp MouserX

normal:
pop eax
mov [ebx], eax
mov edi,[ebp+10]
jmp back

back:
jmp 0091DCE7
return:
jmp 0091DD4C
On:
pop eax
mov [OnOff],1
jmp MouserX

Off:
pop eax
mov [OnOff],0
jmp MouserX

MouserX:
cmp [OnOff],0
je normalx
push eax
mov eax,[00B0B904]
mov eax,[eax+0E90]
cmp esi,eax
pop eax
jne normalx

mov eax, [00B0BAA8]
mov eax, [eax+0978]
mov eax, [eax+84]
mov [ebx], eax
mov edi,[ebp+10]
test edi, edi
jne MouserY
jmp 0091DD49

normalx:
mov [ebx], eax
mov edi,[ebp+10]
jmp back

MouserY:
push eax
mov eax,[00B0B904]
mov eax,[eax+0E90]
cmp esi,eax
pop eax
jne normaly

mov eax, [00B0BAA8]
mov eax, [eax+0978]
mov eax, [eax+88]
mov [edi], eax
mov ebx,[ebp+14]
jmp return

normaly:
mov [edi], eax
mov ebx,[ebp+14]
jmp return

0091DCE2:
jmp CSX

[Disable]

0091DCE2:
db 89 03 8b 7d 10

dealloc(MouserX)
dealloc(MouserY)
dealloc(CSX)
dealloc(OnOff)
unregistersymbol(CSX)
unregistersymbol(OnOff)

// V102 寵物吸物
// 感謝 smallro,maxyoyo
// 更新射鵰英雄  98/10/08
[enable]
registersymbol(PetGetItem)
alloc(PetGetItem,256)
registersymbol(PetGetItemSwitch)
alloc(PetGetItemSwitch,4)
label(NormalPet)

PetGetItemSwitch:
   dd    1                   // 開關 0 是關 1 是開

PetGetItem:
   cmp [PetGetItemSwitch], 0
   je    NormalPet
   push ebx
   mov ebx, [ebp+0c]
   mov [ebx], edi
   mov [ebx+04], eax
   pop ebx
   jmp 004f2875

NormalPet:
   lea eax, [ebp-38]
   push eax
   call dword ptr [00b0f20c]
   jmp 004f2868

004f285e:
jmp PetGetItem

[disable]
004f285e:
db 8D 45 c8 50 ff
unregistersymbol(PetGetItem)
dealloc(PetGetItem)
unregistersymbol(PetGetItemSwitch)
dealloc(PetGetItemSwitch)

//=================================================
[enable]
//疾風N合一 for TWMS0103
//原作：jajaja, 感謝99,A,D,L,N,W,W(縮寫)
//原出處：疾風之莊,頑皮鬼
//代碼修改：fight
//功能：走,跳怪方向【左趴往左,右趴往右,坐下停止控制】、笨怪、10秒損血一次、
//紅點不停、跳怪不跳、致命的吸引力【定點及跟隨角色二種模式，啟動方式提示：5秒】
//=================================================
alloc(MyLR,1024)
registersymbol(MyLR)
alloc(MyDir,4)
alloc(MyCt,4)
alloc(MyPt1,4)
label(MyLR1)
label(GoLR)
label(GoLR1)
label(GoLR2)
label(GoLR3)
label(GoLR4)
label(GoLR5)
label(GoLRback)
label(JmpLR)
label(JmpLR1)
label(JmpLR2)
label(JmpLRback)
label(MyStupid)
label(MyNoBack)
label(MyState)
label(MyCharX)
label(MyNoJmp)
label(LRDir1)
label(LRDir2)
label(LRDir3)
label(LRDir4)
label(LRDir5)
label(LRDir6)
registersymbol(LR)
alloc(LR,4)
MyDir:
DD 1
MyLR:
pop edi
pop esi
pop ebp
pop ebx
push eax
cmp [00B0B918],00000000
je MyLR1
pop eax
cmp dword ptr [esp], 0092147D
je GoLR
cmp dword ptr [esp], 00921897
je JmpLR
cmp dword ptr [esp], 00920414
je MyStupid
cmp dword ptr [esp], 008C6390
jz MyNoBack
cmp dword ptr [esp], 0092184F
jz MyNoJmp
ret
MyLR1:
pop eax
ret
//================================
GoLR:
add esp,4
call MyState
push 03
pop ecx
mov [edi+20],eax
xor edx,edx
div ecx
cmp [MyDir], 1
je GoLRback
cmp [MyDir], 3
je GoLR1
cmp [MyDir], 4
je GoLR3
cmp edx, [MyDir]
je GoLRback
mov [esi+000004D8],0
jmp GoLRback
GoLR1:
push eax
call MyCharX
jmp GoLR4
GoLR3:
push eax
mov eax,[MyPt1]
GoLR4:
cmp edx, 1
je GoLR5
jg GoLR2
cmp eax,[esi+1c4]
pop eax
mov [esi+000004D8],5
jl GoLRback
mov [esi+000004D8],0
jmp GoLRback
GoLR2:
cmp eax,[esi+1c4]
pop eax
mov [esi+000004D8],5
jg GoLRback
mov [esi+000004D8],0
jmp GoLRback
GoLR5:
pop eax
mov [esi+000004D8],0
GoLRback:
jmp 00921487
//================================
JmpLR:
add esp,4
call MyState
cmp [MyDir], 1
je JmpLRback
cmp [MyDir], 2
mov eax,2
je JmpLRback
cmp [MyDir], 0
mov eax,3
je JmpLRback
cmp [MyDir], 4
je JmpLR1
call MyCharX
jmp JmpLR2
JmpLR1:
mov eax,[MyPt1]
JmpLR2:
cmp eax,[esi+1c4]
mov eax,2
mov [esi+000004D8],5
jg JmpLRback
mov eax,3
JmpLRback:
push 03
jmp  00921899
//================================
MyCharX:
mov eax [00B0B904]
mov eax, [eax+0E50]
ret
//================================
MyState:
push eax
mov eax, [00B0B904]
mov eax, [eax+0398]
cmp eax, a
je LRDir1
cmp eax, b
je LRDir2
cmp eax, 14
je LRDir3
cmp eax, 15
je LRDir3
mov [MyCt], 0
jmp LRDir4
LRDir1:
mov [MyDir],2
cmp [MyCt], 32
ja LRDir5
inc [MyCt]
jmp LRDir4
LRDir2:
mov [MyDir],0
cmp [MyCt], 32
ja LRDir6
inc [MyCt]
jmp LRDir4
LRDir3:
mov [MyDir],1
jmp LRDir4
LRDir5:
mov [MyDir],3
jmp LRDir4
LRDir6:
mov [MyDir],4
call MyCharX
mov [MyPt1],eax
LRDir4:
pop eax
ret
//============================
MyStupid:
add esp, 4
xor edx,edx
mov ecx,0000ea60
div ecx
lea eax,[esi+00000238]
add edx,0002bf20
mov [esi+00000240],edx
mov edx,[esp+10]
cmp [eax],edx
je 0092045F
cmp [esi+0000023c],edi
lea ecx,[esi+0000023c]
je 0092045F
jmp 00920445
//====================================
MyNoBack:
add esp,4

mov eax,[ebp-10]
lea ecx, [eax+00001A0C]
push FFFFD8F0 //原始值=FFFFFA24，修改此處可更改無敵秒數
jmp 008C6AB9
//============================
MyNoJmp:
add esp,4
jmp 00921863
00414952:
jmp MyLR
[disable]
00414952:
db 5f 5e 5d 5b c3
dealloc(MyLR)
unregistersymbol(MyLR)
dealloc(MyDir)
dealloc(MyCt)
dealloc(MyPt1)

//v103
[enable]
00647ADE://快速生怪
jmp 00647AE0
[disable]
00647ADE://快速生怪
db 74 40

//=================================================
//版本：TWMS0103 (CRC版)
//功能：攻擊不停 CSX
//更新：豕者示申 (感謝小老百姓提供address和pointer)
//日期：2009/10/8
//=================================================

[Enable]
registersymbol(CSX)
alloc(CSX,128)
label(CSXReturn)

CSX: //CSEAX X
push eax
mov eax,[00B0B904] //a1 ? ? ? ?
mov eax,[eax+271c] // 8b 80 ? ? ? ?
cmp eax,2       //3d 02 00 00 00
pop eax          //58
jg CSXReturn

push eax
mov eax,[00B0B904] //a1 ? ? ? ?
mov eax,[eax+272c] //8b 80 ? ? ? ? 57 33 ff
cmp eax,2
pop eax
jg CSXReturn

push eax
mov eax,[00B0B904]
mov eax,[eax+0E90]
cmp esi,eax
pop eax
jne CSXReturn
add eax,0a
jmp CSXReturn

CSXReturn:
mov [ebx], eax
mov edi,[ebp+10]
jmp 0091DCE7

0091DCE2:
jmp CSX

[Disable]
0091DCE2:
DB 89 03 8B 7D 10

unregistersymbol(CSX)
dealloc(CSX)

//=================================================
//版本：TWMS0103 (CRC版)
//功能：怪物圖鑑全開
//更新：SHARK
//日期：2009/10/08
//=================================================
[Enable]
Alloc(Palerma,256)
Label(exit)
Palerma:
exit:
mov eax,5
jmp 008CD609
008CD604:
jmp Palerma
[Disable]
008CD604:
db e8 f8 24 e0 ff

//TWMS 0103[EIP]招喚獸攻擊(單純物品落腳下)
//原作:zgende
//Address: 0073BEEE
//EIP:FIX_TTBOX_DOWN
//-----------------------------------------------
[ENABLE]
registersymbol(FIX_TTBOX_DOWN)
alloc(FIX_TTBOX_DOWN,1024)
registersymbol(FIX_TTBOX_DOWN_XX)
alloc(FIX_TTBOX_DOWN_XX,4)
registersymbol(FIX_TTBOX_DOWN_YY)
alloc(FIX_TTBOX_DOWN_YY,4)
label(FIX_TTBOX_DOWN_X)
label(FIX_TTBOX_DOWN_Y)
//-----------------------------------------------
FIX_TTBOX_DOWN_XX:
DD 0
FIX_TTBOX_DOWN_YY:
DD 0
//-----------------------------------------------
FIX_TTBOX_DOWN:
call FIX_TTBOX_DOWN_X
mov ax,[FIX_TTBOX_DOWN_XX]
lea ecx,[ebp-44]
push eax
call 004254CA
mov eax,[esi]
lea ecx,[eax+04]
mov eax,[ecx]
call FIX_TTBOX_DOWN_Y
mov ax,[FIX_TTBOX_DOWN_YY]
jmp 0073BF0B
//-----------------------------------------------
FIX_TTBOX_DOWN_X:
push eax
mov eax,[00B0B904]
mov eax,[eax+0E50]
mov [FIX_TTBOX_DOWN_XX],eax
pop eax
ret
//-----------------------------------------------
FIX_TTBOX_DOWN_Y:
push eax
mov eax,[00B0B904]
mov eax,[eax+0E54]
mov [FIX_TTBOX_DOWN_YY],eax
pop eax
ret
//-----------------------------------------------
0073BEEE:
jmp FIX_TTBOX_DOWN
[DISABLE]
0073BEEE:
db ff 50 10
dealloc(FIX_TTBOX_DOWN)
unregistersymbol(FIX_TTBOX_DOWN)

//====================================================
//版本：TWMS0100 (CRC版)
//功能：怪物瞬移1號
//更新：呆baby
//日期：2009/10/09
//====================================================
[Enable]
00667A0A:
nop
nop
nop
nop
nop
[Disable]
00667A0A:
call 00414846

//====================================================
//版本：TWMS0100 (CRC版)
//功能：怪物瞬移2號
//更新：呆baby
//日期：2009/10/09
//====================================================
[Enable]
006679BF:
nop
nop
nop
nop
nop
[Disable]
006679BF:
call 00414846

//====================================================
//版本：TWMS0100 (CRC版)
//功能：怪物瞬移3號
//更新：呆baby
//日期：2009/10/09
//====================================================
[Enable]
006679B1:
nop
nop
nop
nop
nop
[Disable]
006679B1:
call 00414846

//====================================================
//版本：TWMS0100 (CRC版)
//功能：怪物瞬移4號
//更新：呆baby
//日期：2009/10/09
//====================================================
[Enable]
00667A2A:
nop
nop
nop
nop
nop
[Disable]
00667A2A:
call 00414846

//==================================================
//  TWMS_V1.3 快速恢復HP/MP 合併版
//
//  代碼原創：頑皮鬼
//  代碼修改：RUYANG
//  說明：每次恢復10倍HP，8倍MP
//==================================================

[Enable]
  alloc(HookFR,1024)
  registersymbol(HookFR)
  label(HookRet)
  label(HPHandler)
  label(MPHandler)

  label(FastRecoverHP)
  label(DoNormalHP)
  label(HPCheck)
  alloc(HPCounter,4)
  alloc(SetHPCounter,4)
  alloc(RecoverTime,4)
  registersymbol(SetHPCounter)

  label(FastRecoverMP)
  label(DoNormalMP)
  label(MPCheck)
  alloc(MPCounter,4)
  alloc(SetMPCounter,4)
  registersymbol(SetMPCounter)

HookFR:
  cmp [esp],009BEDB7
  je HPHandler
  cmp [esp],00962407
  je MPHandler
HookRet:
  push ebp
  mov ebp,esp
  sub esp,0c
  jmp 00425E68
HPHandler:
  mov [esp],FastRecoverHP
  jmp HookRet
MPHandler:
  mov [esp],FastRecoverMP
  jmp HookRet

FastRecoverHP:
  push eax
  mov eax,[ebp-1c]
  mov [RecoverTime],eax
  pop eax

  cmp [HPCounter],0
  je HPCheck
  dec [HPCounter]
  cmp ebx,1
  jmp 0096229C

HPCheck:
  sub [RecoverTime],0A
  cmp ebx,[RecoverTime]
  jna DoNormalHP

  push eax
  mov eax,[SetHPCounter]
  dec eax
  mov [HPCounter],eax
  pop eax

DoNormalHP:
  cmp ebx,[ebp-1c]
  jmp 0096229C

FastRecoverMP:
  cmp [MPCounter],0
  je MPCheck
  dec [MPCounter]
  cmp ebx,1
  jmp 0096240D

MPCheck:
  cmp ebx,00002708
  jna DoNormalMP
  push eax
  mov eax,[SetMPCounter]
  dec eax
  mov [MPCounter],eax
  pop eax

DoNormalMP:
  cmp ebx,00002710
  jmp 0096240D

SetHPCounter:
  dd A       // 10倍HP，易斷線的請調低倍數
SetMPCounter:
  dd 8       // 8倍MP，易斷線的請調低倍數
00425E62:
jmp HookFR
[Disable]
00425E62:
db 55 8b ec 83 ec 0c

  unregistersymbol(HookFR)
  dealloc(HookFR)

  dealloc(HPCounter)
  dealloc(SetHPCounter)
  dealloc(RecoverTime)
  unregistersymbol(SetHPCounter)

  dealloc(MPCounter)
  dealloc(SetMPCounter)
  unregistersymbol(SetMPCounter)

//逃出奇幻
[enable]
0051fe1c:
jmp 0051fe57
//db eb 39
[disable]
0051fe1c:
jna 0051fe57
//db 76 39

//丟道具不能丟錢
[enable]
009679cb:
jmp 00967a0d
//db eb 40
[disable]
009679cb:
jna 00967a0d
//db 76 40

//放技能
[enable]
008d4c70:
jmp 008d4ca1
//db eb 2f
[disable]
008d4c70:
jna 008d4ca1
//db 76 2f

//HKMS/TWMSv1.3 SuperTubi [超撿]

[Enable]
004E5E65:
db 90 90

[Disable]
004E5E65:
db 75 36

//原作:歷史太久了~好像有人發過功能一樣的
//全圖打(可調範圍)TWMS1.3
//更新: DrakeDog,WeiWey86
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 1024)
registersymbol(IwallEXPX)
alloc(IwallEXPX, 4)
registersymbol(IwallEXPY)
alloc(IwallEXPY, 4)
label(IwallEXP00)
IwallEXPX:
dd 12C //16進位橫向範圍目前500
IwallEXPY:
dd 12C //16進位直向範圍  目前設定500
IwallEXP:
mov edx,[00B0B904]
mov edx,[edx+0E50]
add edx,[IwallEXPX]
cmp ecx,edx
jg IwallEXP00
mov edx,[00B0B904]
mov edx,[edx+0E50]
sub edx,[IwallEXPX]
cmp ecx,edx
jl IwallEXP00

mov edx,[00B0B904]
mov edx,[edx+0E54]
add edx,[IwallEXPY]
cmp eax,edx
jg IwallEXP00
mov edx,[00B0B904]
mov edx,[edx+0E54]
sub edx,[IwallEXPY]
cmp eax,edx
jl IwallEXP00

mov ecx,[00B0B904]
mov ecx,[ecx+0E50]
mov eax,[00B0B904]
mov eax,[eax+0E54]
mov [ebx+00000484],ecx
jmp 00647A33
//-----------------------------
IwallEXP00:
mov [ebx+00000484],ecx
jmp 00647A33
00647A2D:
jmp  IwallEXP
[DISABLE]
00647A2D:
db 89 8B 84 04 00
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
dealloc(IwallEXPX)
unregistersymbol(IwallEXPX)
dealloc(IwallEXPY)
unregistersymbol(IwallEXPY)

//招喚獸全圖打crc(可調範圍)TWMS103
//更新:星光:卍走召目害卍
//目前切圖版的，已經確定更新好了(雖然很多高手早就更新好了)，
//但是似乎搶不贏已發佈的全圖打，因為切換地圖，有頻率，所以移
//除掉，這樣可以狂打，但有少(有時)，看個人喜好下去使用吧
//-----------------------------------------------
[ENABLE]
registersymbol(O76)
alloc(O76, 2048)
label(GOD02)
label(WIN01)
registersymbol(x2)
alloc(x2, 4)
registersymbol(x1)
alloc(x1, 4)
registersymbol(y1)
alloc(y1, 4)
registersymbol(y2)
alloc(y2, 4)

x2:
dd 3F8 //x軸範圍
y2:
dd 1F4 //y軸範圍

O76:

mov edx,[x2]
mov [x1],edx
sub [x2],1f4

mov edx,[y2]
mov [y1],edx

cmp [x2], FFFFFC18
jge WIN01

mov [x2],3e8
sub [y2],1f4

cmp [y2], FFFFFE0C
jge WIN01

mov [y2],1f4

WIN01:
mov edx,[00B0B904]
mov edx,[edx+0E50]
add edx,[x1]
cmp ecx,edx
jg GOD02
sub edx,1f4 // 500
cmp ecx,edx
jl GOD02

mov edx,[00B0B904]
mov edx,[edx+0E54]
add edx,[y1]
cmp eax,edx
jg GOD02
sub edx,1f4
cmp eax,edx
jl GOD02

mov ecx,[00B0B904]
mov ecx,[ecx+0E50]
mov eax,[00B0B904]
mov eax,[eax+0E54]
mov [ebx+00000484],ecx
jmp 00647A33

//-----------------------------

GOD02:
mov [ebx+00000484],ecx

jmp 00647A33

00647A2D:
jmp O76
[DISABLE]
00647A2D:
db 89 8B 84 04 00
dealloc(O76)
unregistersymbol(O76)
unregistersymbol(x1)
dealloc(x1)
unregistersymbol(y1)
dealloc(y1)
unregistersymbol(x2)
dealloc(x2)
unregistersymbol(y2)
dealloc(y2)

// 版本：TWMS v1.3召喚獸分身攻擊CRC
// 更新: DrakeDog, WeiWey86
[Enable]
0073A4DD:
jmp 0073A4EB

[Disable]
0073A4DD:
db 7E 0C FF 37 56

//按拍賣不跳出訊息
[enable]
00971029:
jmp 00971056

[disable]
00971029:
jna 00971056

//可用普攻
[enable]
008BCB7A:
jmp 008bcbaf
[disable]
008BCB7A:
jna 008bcbaf

//丟錢不跳出訊息
[enable]
00981791:
jmp 009817bf
[disable]
00981791:
jna 009817bf

//V103 招喚獸短擊 (法師 CRC 版)
//原作:zgenden
//-----------------------------------------------
[ENABLE]
registersymbol(FIR)
alloc(FIR,1024)
registersymbol(FIRTIMESS)
alloc(FIRTIMESS,4)
registersymbol(FIRSKILL)
alloc(FIRSKILL,4)
registersymbol(FIREDI)
alloc(FIREDI,4)
label(FIR00)
label(FIR01)
//-----------------------------------------------
FIRTIMESS:
DD 0    //招喚獸攻擊時間
FIRSKILL:
DD 0    //招喚獸攻擊次數
FIREDI:
DD 0    //招喚獸EDI
//-----------------------------------------------
FIR:
cmp [FIREDI],edi
je FIR00
//push eax
call FIR01
pop ecx
pop ecx
mov dword ptr [ebx+000000cc],01
push [ebx+000000e8]
lea eax,[ebx+000000e0]
push eax
call FIR01
pop ecx
pop ecx
mov dword ptr [ebx+000000c0],01
push [ebx+000000b0]
call 0070669d
pop ecx
push esi
mov ecx,ebx
call 0073b42a
push eax
mov eax,[ebx+0000010c]
cmp [FIRTIMESS],eax
pop eax
je 0073a7da
push eax
mov eax,[ebx+0000010c]
mov [FIRTIMESS],eax
mov [FIREDI],edi
pop eax
jmp 0073a7da
//-----------------------------------------------
FIR00:
call 00414846
jmp 0073A689
//-----------------------------------------------
FIR01:
push ebp
mov ebp,esp
mov eax,[ebp+08]
push ebx
mov ebx,[eax+04]
push esi
mov esi,[eax]
push edi
push 05
push ebx
call 009bc13b
mov edi,eax
xor edi,esi
push 05
xor esi,baadf00d
push esi
call 009bbd84
add eax,ebx
add esp,10
mov eax,edi
pop edi
pop esi
pop ebx
pop ebp
ret

0073A684:
jmp FIR

//-----------------------------------------------
[DISABLE]
0073A684:
call 00414846

dealloc(FIR)
unregistersymbol(FIR)
dealloc(FIRTIMESS)
unregistersymbol(FIRTIMESS)
dealloc(FIREDI)
unregistersymbol(FIREDI)
dealloc(FIRSKILL)
unregistersymbol(FIRSKILL)

//v1.3 Instant Drop
//妮可GG

[ENABLE]
004f43ec:

je 004f43f8

[DISABLE]

004f43ec:
db eb 4e

//=================================================
// 攻擊加速 for Twms103
// 原作：不知道 ><
// 更新：Yttuir
// ADR：0044D915
// EIP：FastAttack
// 加速次數：FastSpeed
//=================================================
[Enable]
Registersymbol(FastAttack)
Registersymbol(FastSpeed)
Alloc(FastAttack,128)
Alloc(FastSpeed,4)
//-----------------------------------------------
FastSpeed:
Dd 1 //攻擊次數，代表幾次攻擊中會有一次加速，請自行調整
//-----------------------------------------------
FastAttack:
Pushad
Mov Eax,[00B0B904]
Mov Edx,[Eax+271C]
Mov Ecx,[FastSpeed]
Mov Eax,Edx
Shr Edx,0F
Idiv Ecx
Dec Ecx
Cmp Edx,Ecx
Popad
Jne 0044D91A
Jmp 0044D93C
//-----------------------------------------------
[Disable]
Dealloc(FastSpeed)
Dealloc(FastAttack)
Unregistersymbol(FastSpeed)
Unregistersymbol(FastAttack)

//招喚獸全圖打(切小圖)TWMS103
//原作:不祥
//修改 : dkgffo
//這個全圖打一擊秒殺很好用
//但是打強怪建議不使用
//會一下一下慢慢打...
//-----------------------------------------------
[ENABLE]
registersymbol(IwallEXP)
alloc(IwallEXP, 2048)
label(IwallEXP00)
label(IwallEXP01)
registersymbol(IwallTimes)
alloc(IwallTimes, 4)
registersymbol(x2)
alloc(x2, 4)
registersymbol(x1)
alloc(x1, 4)
registersymbol(y1)
alloc(y1, 4)
registersymbol(y2)
alloc(y2, 4)
registersymbol(Timer)
alloc(Timer, 4)

IwallTimes:
dd 0
Timer:
dd 8// 8ms
x2:
dd 514 // 1300
y2:
dd 384 //900

IwallEXP:
mov edx,[00B0BAAC] //
mov edx,[edx+18]
sub edx,[Timer] //每 8 ms 換下一張圖
cmp edx,[IwallTimes]
jl IwallEXP01

mov edx,[00B0BAAC] //
mov edx,[edx+18]
mov [IwallTimes],edx

mov edx,[x2]
mov [x1],edx
sub [x2],1f4

mov edx,[y2]
mov [y1],edx

cmp [x2], FFFFFC18
jge IwallEXP01

mov [x2],3e8
sub [y2],1f4

cmp [y2], FFFFFE0C
jge IwallEXP01

mov [y2],1f4

IwallEXP01:
mov edx,[00B0B904]
mov edx,[edx+0e50]
add edx,[x1]
cmp ecx,edx
jg IwallEXP00
sub edx,1f4 // 500
cmp ecx,edx
jl IwallEXP00

mov edx,[00B0B904]
mov edx,[edx+0e54]
add edx,[y1]
cmp eax,edx
jg IwallEXP00
sub edx,1f4
cmp eax,edx
jl IwallEXP00

mov ecx,[00B0B904]
mov ecx,[ecx+0e50]
mov eax,[00B0B904]
mov eax,[eax+0e54]
mov [ebx+00000484],ecx
jmp 00647A33

//-----------------------------

IwallEXP00:
mov [ebx+00000484],ecx

jmp 00647A33

00647A2D:
jmp IwallEXP
[DISABLE]
00647A2D:
db 89 8B 84 04 00
dealloc(IwallEXP)
unregistersymbol(IwallEXP)
unregistersymbol(IwallTimes)
dealloc(IwallTimes)
unregistersymbol(x1)
dealloc(x1)
unregistersymbol(y1)
dealloc(y1)
unregistersymbol(x2)
dealloc(x2)
unregistersymbol(y2)
dealloc(y2)
unregistersymbol(Timer)
dealloc(Timer)

回覆

使用道具舉報

ko985389

74 主題	8 好友	512 積分

高級會員

Rank: 4

UID: 1242
帖子: 1894
主題: 74
精華: 0
積分: 512
楓幣: 1328
威望: 422
存款: 0
贊助金額: 0
推廣: 0
ＧＰ: 5
閱讀權限: 50
性別: 男
在線時間: 1808 小時
註冊時間: 2011-12-31
最後登入: 2023-10-7

發消息

6樓

發表於 2014-2-5 19:58:40 |只看該作者

看到我眼睛都花了@@

回覆

使用道具舉報

返回列表

免責聲明：本網站是以即時上載留言的方式運作，本站對所有留言的真實性、完整性及立場等，不負任何法律責任。

而一切留言之言論只代表留言者個人意見，並非本網站之立場，用戶不應信賴內容，並應自行判斷內容之真實性。

		保持登入	找回密碼
密碼			立即註冊

[其餘數據] TWMS094~103（一些舊數據，僅供參考＆研究）

您可能感興趣的文章

TWMS096 （一些舊數據，僅供參考＆研究）

TWMS098 （一些舊數據，僅供參考＆研究）

TWMS100 （一些舊數據，僅供參考＆研究）

TWMS103 （一些舊數據，僅供參考＆研究）

2024年紀念勳章

2023聖誕節紀念勳章

2023年紀念勳章

2022聖誕節紀念勳章

2022中秋節紀念勳章

2022端午節紀念勳章

2022年紀念勳章

2021聖誕節紀念勳章

2021端午節紀念勳章

2021年紀念勳章

2020聖誕節紀念勳章

2020中秋節紀念勳章

2020端午節紀念勳章

2020年紀念勳章

2019聖誕節紀念勳章

2019中秋節紀念勳章

2019端午節紀念勳章

2019年紀念勳章

2018端午節紀念勳章

2018年紀念勳章

2017中秋節紀念勳章

2016端午節紀念勳章

2015聖誕節紀念勳章

Apple勳章

Android勳章

2014年紀念勳章

2015年紀念勳章

2013年紀念勳章

富可敵國

2015端午節紀念勳章

積分勳章

解說達人

高級客戶

在線終極王

論壇支持王

熱心助人

管理者

論壇粉絲

貢獻王

發帖達人

精華帖

VIP會員

核心勳章

版主勳章

副站長勳章

中秋節紀念勳章

太陽勳章

幼兒勳章

性別（男）

長老勳章

音樂勳章

神手勳章

除蟲大隊

私服達人

富豪勳章

instagram紀念勳章

2015中秋節紀念勳章

2016年紀念勳章

2016聖誕節紀念勳章

2017年紀念勳章

2017端午節紀念勳章

2017聖誕節紀念勳章

2018中秋節紀念勳章

2018萬聖節紀念勳章

2018聖誕節紀念勳章

2021中秋節紀念勳章

2023端午節紀念勳章

2023中秋節紀念勳章

聖誕節紀念勳章

聖誕節紀念勳章2

懶人勳章