传奇3私服密文服务器端修改成明文服务器端的方法
I.原理:跳过解密代码.
II.正题:
------------------------------------------------------------------
◆A.!setup.txt 修改3个地方.
1.
------------------------------------------------------------------
:0048613E 8B45EC mov eax, dword ptr [ebp-14]
:00486141 8B55E8 mov edx, dword ptr [ebp-18]★
:00486144 80341004 xor byte ptr [eax+edx], 04 ;这里解密
:00486148 FF45E8 inc [ebp-18]
:0048614B 817DE8900A0000 cmp dword ptr [ebp-18], 00000A90
:00486152 75EA jne 0048613E
●:00486154 8B45FC mov eax, dword ptr [ebp-04]
------------------------------------------------------------------
2.
------------------------------------------------------------------
:0048623B 8B45EC mov eax, dword ptr [ebp-14]
:0048623E 8B55E8 mov edx, dword ptr [ebp-18]★
:00486241 80341004 xor byte ptr [eax+edx], 04 ;这里解密
:00486245 FF45E8 inc [ebp-18]
:00486248 817DE8900A0000 cmp dword ptr [ebp-18], 00000A90
:0048624F 75EA jne 0048623B
●:00486251 8B55EC mov edx, dword ptr [ebp-14]
------------------------------------------------------------------
上面两个地方从★处开始汇编
Mov dword ptr[ebp-18],0A90 ;这里是以防万一
JMP ● ;这里JMP到各自的●处
------------------------------------------------------------------
以上修改可以统一修改如下:
查找:8B45EC8B55E880341004FF45E8817DE8900A000075EA
替换:8B45ECC745E8900A0000EB0A90817DE8900A000075EA
------------------------------------------------------------------
3.
-----------------------------------------------------------------
:004957BB 40 inc eax
:004957BC 8945E8 mov dword ptr [ebp-18], eax
:004957BF C745EC00000000 mov [ebp-14], 00000000★
:004957C6 8B45F8 mov eax, dword ptr [ebp-08]
:004957C9 8B55EC mov edx, dword ptr [ebp-14]
:004957CC 80341004 xor byte ptr [eax+edx], 04 ;保存之前的加密
:004957D0 FF45EC inc [ebp-14]
:004957D3 FF4DE8 dec [ebp-18]
:004957D6 75EE jne 004957C6
●:004957D8 8A45F3 mov al, byte ptr [ebp-0D]
----------------------------------------------------------------
上面从★处汇编,直接跳到●处.
Mov dword ptr[ebp-14],eax ;这里以防万一
JMP ●
十六进制的字符串替换如下:
查找:408945E8C745EC000000008B45F88B55EC80341004FF45ECFF4DE875EE8A45F3
替换:408945E88945ECEB14909090909090909090909090FF45ECFF4DE875EE8A45F3
===============================================================
◆B.adminlist.txt
---------------------------------------------------------------
:0045701A 8B5DF8 mov ebx, dword ptr [ebp-08]
:0045701D 8A4C19FF mov cl, byte ptr [ecx+ebx-01]
:00457021 80F107 xor cl, 07 ;这里解密,NOP掉
:00457024 884C10FF mov byte ptr [eax+edx-01], cl
:00457028 FF45F8 inc [ebp-08]
:0045702B FF4DF4 dec [ebp-0C]
:0045702E 75DA jne 0045700A
--------------------------------------------------------------
因为adminlist.txt体积很小,所以NOP即可,不影响读取速度.
查找:8B5DF88A4C19FF80F107884C10FF
替换:8B5DF88A4C19FF909090884C10FF
=============================================================
◆C:mapinfo.txt 和以及其他用同样方法加解密的文件
-------------------------------------------------------------
1.修改DBsrv.exe,使其能读取解密的mapinfo.txt 修改两处
-------------------------------------------------------------
:0040493B 83C41C add esp, 0000001C
:0040493E 84C0 test al, al ;这里,校验.
:00404940 750E jne 00404950 ;修改这里,无视校验.
:00404942 57 push edi
:00404943 E877770000 call 0040C0BF
:00404948 59 pop ecx
:00404949 32C0 xor al, al
:0040494B E9E0000000 jmp 00404A30
:00404950 8D7708 lea esi, dword ptr [edi+08] ;修改这里,从$0开始读取
:00404953 85F6 test esi, esi
:00404955 0F84D3000000 je 00404A2E
:0040495B 8D85F4FEFFFF lea eax, dword ptr [ebp+FFFFFEF4]
-------------------------------------------------------------
DBsrv.exe 修改上面两处足够,无需其他修改.
------------------------------------
:00404940 jmp 00404950
------------------------------------
:00404950 lea esi, dword ptr [edi]
------------------------------------
统一一下:
查找:83C41C84C0750E57E8777700005932C0E9E00000008D770885F60F84D30000008D85F4FEFFFF
替换:83C41C84C0EB0E57E8777700005932C0E9E00000008D379085F60F84D30000008D85F4FEFFFF
-------------------------------------------------------------
2.ei主程序 修改两处.
-------------------------------------------------------------
:00534571 8B55EC mov edx, dword ptr [ebp-14]
:00534574 8B45E4 mov eax, dword ptr [ebp-1C]
:00534577 E8F0FDFFFF call 0053436C ;这里,校验解密,NOP!
:0053457C 8B45E4 mov eax, dword ptr [ebp-1C]
:0053457F 83C008 add eax, 00000008 ;这里,文件读取起始,NOP!
:00534582 8945E0 mov dword ptr [ebp-20], eax
-------------------------------------------------------------
综合一下,只要
查找:8B55EC8B45E4E8F0FDFFFF8B45E483C0088945E0
替换:8B55EC8B45E4EB099090909090909090908945E0
=============================================================
还有3个数据库,算了吧,工具都不支持解密数据库.:)
有兴趣的朋友自己就看一下吧,都是非常简单的加密解密.
ps..
(a:提 醒一下，上面 “3."那个地方如果修改了，就不能读取加密的dat文件。没有解密DAT的朋友请不要修改那里。)
(b:错了 只要用明文的!setup.txt就没问题 测试全部通过)
........................................................................................
本文出自:
搜传奇3转载请注明来处：http://www.so373.com/showarticle.asp?id=232
