?--------------------------------------------------------------------------------------------------------------------------------------------------------

    封包的比對(duì)！網(wǎng)絡(luò)游戲都是通過(guò)數(shù)據(jù)交換實(shí)現(xiàn)游戲競(jìng)技滴，所以分析封包是制作外掛的一個(gè)步驟。

    --------------------------------------------------------------------------------------------------------------------------------------------------------

    網(wǎng)絡(luò)游戲封包分為2種封包：1。明文封包2。加密封包

    多數(shù)網(wǎng)絡(luò)游戲都是加密封包，其原因是為了信息不被修改。明文封包的也有，呵呵“cs”呀這些

    --------------------------------------------------------------------------------------------------------------------------------------------------------

    好了，進(jìn)入正題。封包這玩意其實(shí)很難。但是如果你入門了就不難了！

    明文的好對(duì)付，but加密的就有點(diǎn).......但也是有辦法滴

    就是“多抓包，多分析，多解密！”呵呵！

    --------------------------------------------------------------------------------------------------------------------------------------------------------

    抓包篇：什么抓包呢？抓包當(dāng)然就是用pe，或者自己編寫軟件拉，上次（呵呵`也就是昨天）已經(jīng)做過(guò)了！

    0056df383e53556c6442466en>tsvujldcbmfjn

    0056df484b3f78794766505fakb?qxvyegzflp=_

    0056df58525a615d686f4451\am]chgod;q

    0056df68583c6b7260494f73ux[#

    0056df9824383912091b290e2$89%..*):

    0056dfa8070f36373416151a5&+67?40

    這個(gè)就是某個(gè)網(wǎng)絡(luò)游戲的封包！當(dāng)然是加了密的。

    00878be0414e4e4e4e424e4euannnnnnnnnbnnpn

    00878bf0454e41584e65aevn>a>xynke

    00878be010000000000b0000...........6.

    00878bf0200010310018.

1.

    0087cc040000000000800105.........?b
.

    \x

    什么意思呢？當(dāng)然就是要分析拉！

    --------------------------------------------------------------------------------------------------------------------------------------------------------

    分析篇：分析主要就是分析ram里面的東西拉?？梢缘健翱囱比W(xué)學(xué)簡(jiǎn)單的匯編命令

    004f3b9c/$pushebx

    004f3b9d|.83c4addesp,-8

    004f3ba0|.8bdamovebx,edx;解密后數(shù)據(jù)目標(biāo)地址

    004f3ba2|.8bd4movedx,esp;數(shù)據(jù)傳遞目標(biāo)地址

    004f3ba4|.04000000movecx,4;傳遞個(gè)數(shù)為4

    004f3ba9|.12eef8f;把侍解密的4數(shù)值傳遞過(guò)來(lái)進(jìn)行解密

    004f3bae|.8a0424moval,byteptrss:[esp];第一位

    004f3bb1|.c1e0shleax,2

    004f3bb4|.33d2xoredx,edx

    004f3bb6|.8a5424movdl,byteptrss:[esp+1];第二位

    004f3bba|.c1eashredx,4

    004f3bbd|.0ac2al,dl;第一位與每二位

    004f3bbf|.8803movbyteptrds:[ebx],al;輸出第1位

    004f3bc1|.cebx;計(jì)數(shù)器+1指向第二位

    004f3bc2|.8a4424moval,byteptrss:[esp+1];第二位

    004f3bc6|.c1e0shleax,4

    004f3bc9|.33d2xoredx,edx

    004f3bcb|.8a5424movdl,byteptrss:[esp+2];第三位

    004f3bcf|.c1eashredx,2

    004f3bd2|.0ac2al,dl;第二位與第三位

    004f3bd4|.8803movbyteptrds:[ebx],al;輸出第二位

    004f3bd6|.cebx;計(jì)數(shù)器+1指向第三位

    004f3bd7|.8a4424moval,byteptrss:[esp+2];第三位

    004f3bdb|.c1e0shleax,6

    004f3bde|.8a5424movdl,byteptrss:[esp+3];第4個(gè)

    004f3be2|.0ac2al,dl;第三個(gè)與第四個(gè)

    004f3be4|.8803movbyteptrds:[ebx],al;輸出第三位

    004f3be6|.popecx

    004f3be7|.popedx

    004f3be8|.popebx

    004f3be9\.retn

    004f3bea8boveax,eax

    004f3bec/$pushebx

    004f3bed|.pushesi

    004f3bee|.pushedi

    004f3bef|.pushebp

    004f3bf0|.pusheax;封包

    004f3bf1|.02000000moveax,2

    004f3bf6|>81c404f0ffff/addesp,-0ffc

    004f3bfc|.|pusheax

    004f3bfd|.|deceax

    004f3bfe|.^75\jn

    004f3c00|.8b84240020000>moveax,dordptrss:[esp+2000]

    004f3c07|.8bd9movebx,ecx

    004f3c09|.8bfamovedi,edx

    004f3c0b|.8bd3movedx,ebx

    004f3c0d|.81e203000080andedx,80000003

    004f3c13|.05

    004f3c15|.decedx

    004f3c16|.83caoredx,fffffffc

    004f3c19|.cedx

    004f3c1a|>85d2testedx,edx

    004f3c1c|.

    004f3c1e|.83c8oreax,ffffffff

    004f3c21|.7b

    004f3c23|>8bd3movedx,ebx

    004f3c25|.85d2testedx,edx

    004f3c27|.03

    004f3c29|.83c2addedx,3

    004f3c2c|>c1fasaredx,2

    004f3c2f|.891424movdordptrss:[esp],edx

    004f3c32|.8d5424leaedx,dordptrss:[esp+4]

    004f3c36|.8bcbmovecx,ebx

    004f3c38|.83edf8f;整理出封包傳遞給解密地址進(jìn)行解密

    004f3c3d|.c6441ovbyteptrss:[esp+ebx+4],0

    004f3c42|.8b1c24movebx,dordptrss:[esp]

    004f3c45|.c1e3shlebx,2

    004f3c48|.decebx

    004f3c49|.85dbtestebx,ebx

    004f3c4b|.

    004f3c4d|.cebx

    004f3c4e|.8d4424leaeax,dordptrss:[esp+4];一個(gè)封包

    004f3c52|>8a10/movdl,byteptrds:[eax];第n位

    004f3c54|.80fa|cmpdl,3b

    004f3c57|.05

    004f3c59|.80fa|cmpdl,7a

    004f3c5c|.05|jb

    004f3c5e|>83c8|oreax,ffffffff;出錯(cuò)處理

    004f3c61|.3b|jm

    004f3c63|>81e2ff000000|andedx,0ff

    004f3c69|.8a923def5a00|movdl,byteptrds:[edx+5aef3d];54ef3d是一串字符串.

    004f3c6f|.8810|movbyteptrds:[eax],dl;轉(zhuǎn)換后代碼

    004f3c71|.|inceax;下一個(gè)封包字符

    004f3c72|.|decebx;計(jì)數(shù)器減1

    004f3c73|.^75\jn

    004f3c75|>8b1c24movebx,dordptrss:[esp]

    004f3c78|.decebx

    004f3c79|.85dbtestebx,ebx

    004f3c7b|.

    004f3c7d|.cebx

    004f3c7e|.33edxorebp,ebp

    004f3c80|.8d7424leaesi,dordptrss:[esp+4];取上面轉(zhuǎn)化后的數(shù)值

    004f3c84|>8d546d/leaedx,dordptrss:[ebp+ebp*2]

    004f3c88|.03d7|addedx,edi;目標(biāo)地址每次轉(zhuǎn)化3

    004f3c8a|.8bc6|moveax,esi;源地址每次取

    004f3c8c|.0bffffff|;解密數(shù)據(jù)(取4個(gè).轉(zhuǎn)化3個(gè))

    004f3c91|.|incebp

    004f3c92|.83c6|addesi,4

    004f3c95|.|decebx

    004f3c96|.^75\jn

    004f3c98|>8b0424moveax,dordptrss:[esp]

    004f3c9b|.8d0440leaeax,dordptrds:[eax+eax*2]

    004f3c9e|>81c404200000addesp,2004

    004f3ca4|.popebp

    004f3ca5|.popedi

    004f3ca6|.popesi

    004f3ca7|.popebx

    004f3ca8\.retn

    什么意思？就是要解密后制作外掛拉！

    --------------------------------------------------------------------------------------------------------------------------------------------------------

    外掛的制作就不介紹了設(shè)計(jì)到vb匯編指針的問(wèn)題了，vb指針的應(yīng)用下一次給大家講！