|
|
楼主 |
发表于 2026-1-10 10:05:05
|
显示全部楼层
第二步,frida执行以下函数,药剂ID自行定义
function epicPotion(){
const potion_id = 25102001;//史诗爆率药剂ID
const expert_job_CAlchemist_IsExistContinuousEffectItem = new NativeFunction(ptr(0x085D121E), 'int', ['pointer', 'int'], "sysv");
const CParty_checkValidUser = new NativeFunction(ptr(0x085B4D12), 'pointer', ['pointer', 'int'], "sysv");
const CParty_get_member_count = new NativeFunction(ptr(0x0859A16A), 'int', ['pointer'], "sysv");
Interceptor.attach(ptr(0x08535726), {
onEnter: function (args) {
if(this.returnAddress == 0x8535ce0){
const a2 = args[1]; //stGenerateRefData_t
const isKilledAllHellGruoups = a2.add(64).readU8(); //isKilledAllHellGruoups
const hellparty_diff = a2.add(66).readU8(); // 1非常困难 2困难
//最后深渊APC死亡
if (isKilledAllHellGruoups){
const battle_field = this.context.ebp.readPointer().readPointer().add(8).readPointer();
const party = battle_field.readPointer();
const member_cnt = CParty_get_member_count(party);//只希望单人生效判断用
for (let i = 0; i < 4; i++) {
const user = CParty_get_user(party, i);
if (CParty_checkValidUser(party, i).toInt32() && expert_job_CAlchemist_IsExistContinuousEffectItem(user,potion_id)) {
if (hellparty_diff == 1)
a2.add(66).writeU8(3); //调用pvf爆率权重对应行
else if (hellparty_diff == 2)
a2.add(66).writeU8(4);
}
}
}
}
},
onLeave: function (retval) {}
});
} |
|