mirror of
https://github.com/yincongcyincong/wechat_chatter.git
synced 2026-07-15 10:26:52 +08:00
update
This commit is contained in:
yincong
+35
-403
@@ -1,412 +1,44 @@
|
||||
// pure_js_keyboard_injector.js
|
||||
console.log("Pure JS Keyboard Injector - Starting...");
|
||||
/**
|
||||
* 构造内存数据并调用 sub_10481C304
|
||||
*/
|
||||
function callTargetFunction() {
|
||||
const mod = Process.getModuleByName("WeChat");
|
||||
const sub_10481C304_addr = ptr("0x10481C304").sub("0x100000000").add(mod.base);
|
||||
const sub_10481C304 = new NativeFunction(sub_10481C304_addr, 'void', ['pointer']);
|
||||
|
||||
// 常量定义
|
||||
const NSEventTypeKeyDown = 10;
|
||||
const NSEventTypeKeyUp = 11;
|
||||
const kVK_Return = 36; // 回车键
|
||||
// 2. 准备原始字节数据 (Hex 形式)
|
||||
// 注意：0x18 偏移处的 8 字节（原数据 60 E1 39 78 05 00 00 00）会被动态生成的指针覆盖
|
||||
const rawData = [
|
||||
0x00, 0x00, 0x00, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x18 指针位置
|
||||
0x05, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x80, 0x00, 0x01, 0x11, 0x01, 0x00, 0xAA, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00,
|
||||
0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
|
||||
0x00, 0xAA, 0xAA, 0xAA, 0xFF, 0xFF, 0xFF, 0xFF, 0xAA, 0xAA, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
||||
];
|
||||
|
||||
// 1. Hook QNSView的handleKeyEvent方法
|
||||
if (ObjC.available) {
|
||||
const QNSView = ObjC.classes.QNSView;
|
||||
// 3. 申请结构体内存
|
||||
const structPtr = Memory.alloc(rawData.length);
|
||||
structPtr.writeByteArray(rawData);
|
||||
|
||||
if (QNSView) {
|
||||
console.log("✓ Found QNSView class");
|
||||
// 4. 申请字符串内存并写入指针 (偏移 0x18)
|
||||
const cgiPath = "/cgi-bin/micromsg-bin/newsendmsg";
|
||||
const pathPtr = Memory.allocUtf8String(cgiPath);
|
||||
structPtr.add(0x18).writePointer(pathPtr);
|
||||
|
||||
// Hook方法
|
||||
const handleKeyEventMethod = QNSView['- handleKeyEvent:eventType:'];
|
||||
if (handleKeyEventMethod) {
|
||||
Interceptor.attach(handleKeyEventMethod.implementation, {
|
||||
onEnter: function(args) {
|
||||
console.log("\n[QNSView Hook]");
|
||||
const event = new ObjC.Object(args[2]);
|
||||
const eventType = args[3];
|
||||
console.log(`Event Type (a4): ${eventType}`);
|
||||
console.log(`KeyCode: ${event.keyCode()}`);
|
||||
console.log(`Characters: ${event.characters()}`);
|
||||
}
|
||||
});
|
||||
console.log("✓ QNSView handleKeyEvent hooked");
|
||||
}
|
||||
}
|
||||
}
|
||||
console.log("[+] 内存结构体已准备完毕: " + structPtr + " [+] 字符串地址: " + pathPtr + " 内容: " + cgiPath);
|
||||
console.log();
|
||||
|
||||
// 2. 发送回车键的函数
|
||||
function sendEnterKey() {
|
||||
// 5. 调用函数
|
||||
try {
|
||||
console.log("\n=== 发送回车键 ===");
|
||||
console.log("[*] 结构体内存布局 (调用前):");
|
||||
sub_10481C304(structPtr);
|
||||
console.log("[+] sub_10481C304 调用成功！");
|
||||
|
||||
const NSApplication = ObjC.classes.NSApplication;
|
||||
const NSEvent = ObjC.classes.NSEvent;
|
||||
const app = NSApplication.sharedApplication();
|
||||
const keyWindow = app.keyWindow();
|
||||
console.log(hexdump(structPtr, { offset: 0, length: rawData.length, header: true, ansi: true }));
|
||||
|
||||
if (!keyWindow) {
|
||||
console.log("❌ 没有找到活动窗口");
|
||||
return;
|
||||
}
|
||||
|
||||
console.log(`窗口: ${keyWindow}`);
|
||||
|
||||
// 查找QNSView
|
||||
function findQNSView(view) {
|
||||
if (view.$className === 'QNSView') {
|
||||
return view;
|
||||
}
|
||||
|
||||
try {
|
||||
const subviews = view.subviews();
|
||||
const count = subviews.count();
|
||||
for (let i = 0; i < count; i++) {
|
||||
const subview = subviews.objectAtIndex_(i);
|
||||
const found = findQNSView(subview);
|
||||
if (found) return found;
|
||||
}
|
||||
} catch (e) {
|
||||
// 忽略错误
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
const contentView = keyWindow.contentView();
|
||||
const qnsView = findQNSView(contentView);
|
||||
|
||||
if (!qnsView) {
|
||||
console.log("❌ 没有找到QNSView，使用备用方法");
|
||||
sendEnterKeyAlternative();
|
||||
return;
|
||||
}
|
||||
|
||||
console.log(`✓ 找到QNSView: ${qnsView}`);
|
||||
|
||||
// 创建回车键按下事件
|
||||
const keyDownEvent = NSEvent.keyEventWithType_location_modifierFlags_timestamp_windowNumber_context_characters_charactersIgnoringModifiers_isARepeat_keyCode_(
|
||||
NSEventTypeKeyDown, // type = 10 (按下)
|
||||
{ x: 100, y: 100 }, // 位置
|
||||
0, // 修饰键
|
||||
Date.now() / 1000, // 时间戳（秒）
|
||||
keyWindow.windowNumber(), // 窗口编号
|
||||
NULL, // 上下文
|
||||
'\r', // 字符（回车）
|
||||
'\r', // 忽略修饰键的字符
|
||||
0, // 是否重复
|
||||
kVK_Return // 键码36=回车
|
||||
);
|
||||
|
||||
// 创建回车键释放事件
|
||||
const keyUpEvent = NSEvent.keyEventWithType_location_modifierFlags_timestamp_windowNumber_context_characters_charactersIgnoringModifiers_isARepeat_keyCode_(
|
||||
NSEventTypeKeyUp, // type = 11 (释放)
|
||||
{ x: 100, y: 100 }, // 位置
|
||||
0, // 修饰键
|
||||
(Date.now() / 1000) + 0.05, // 稍后的时间
|
||||
keyWindow.windowNumber(), // 窗口编号
|
||||
NULL, // 上下文
|
||||
'\r', // 字符
|
||||
'\r', // 忽略修饰键的字符
|
||||
0, // 是否重复
|
||||
kVK_Return // 键码
|
||||
);
|
||||
|
||||
// 发送按键按下（根据逆向分析，a4=6可能是按键按下）
|
||||
console.log("发送回车键按下...");
|
||||
qnsView.handleKeyEvent_eventType_(keyDownEvent, 6);
|
||||
|
||||
// 延迟发送按键释放
|
||||
setTimeout(() => {
|
||||
console.log("发送回车键释放...");
|
||||
qnsView.handleKeyEvent_eventType_(keyUpEvent, 7); // 猜测7是按键释放
|
||||
}, 50);
|
||||
|
||||
console.log("✓ 回车键发送完成");
|
||||
|
||||
} catch (error) {
|
||||
console.error(`❌ 发送回车键失败: ${error}`);
|
||||
} catch (e) {
|
||||
console.log("[-] 调用出错: " + e);
|
||||
}
|
||||
}
|
||||
|
||||
// 3. 备用方法：使用CGEvent
|
||||
function sendEnterKeyAlternative() {
|
||||
try {
|
||||
console.log("尝试使用CGEvent发送回车键...");
|
||||
|
||||
const CGEventCreateKeyboardEvent = Module.findExportByName('CoreGraphics', 'CGEventCreateKeyboardEvent');
|
||||
const CGEventPost = Module.findExportByName('CoreGraphics', 'CGEventPost');
|
||||
|
||||
if (CGEventCreateKeyboardEvent && CGEventPost) {
|
||||
const kCGHIDEventTap = 0;
|
||||
|
||||
// 发送回车键按下
|
||||
const keyDown = new NativeFunction(CGEventCreateKeyboardEvent, 'pointer', ['pointer', 'uint64', 'bool'])(
|
||||
NULL,
|
||||
kVK_Return,
|
||||
true
|
||||
);
|
||||
new NativeFunction(CGEventPost, 'void', ['uint32', 'pointer'])(kCGHIDEventTap, keyDown);
|
||||
|
||||
// 延迟发送释放
|
||||
setTimeout(() => {
|
||||
const keyUp = new NativeFunction(CGEventCreateKeyboardEvent, 'pointer', ['pointer', 'uint64', 'bool'])(
|
||||
NULL,
|
||||
kVK_Return,
|
||||
false
|
||||
);
|
||||
new NativeFunction(CGEventPost, 'void', ['uint32', 'pointer'])(kCGHIDEventTap, keyUp);
|
||||
console.log("✓ CGEvent 回车键发送完成");
|
||||
}, 50);
|
||||
} else {
|
||||
console.log("❌ CGEvent API 不可用");
|
||||
}
|
||||
} catch (error) {
|
||||
console.error(`❌ CGEvent方法失败: ${error}`);
|
||||
}
|
||||
}
|
||||
|
||||
// 4. 发送文本"123"的函数
|
||||
function sendText123() {
|
||||
try {
|
||||
console.log("\n=== 发送文本 '123' ===");
|
||||
|
||||
const NSApplication = ObjC.classes.NSApplication;
|
||||
const NSEvent = ObjC.classes.NSEvent;
|
||||
const app = NSApplication.sharedApplication();
|
||||
const keyWindow = app.keyWindow();
|
||||
|
||||
if (!keyWindow) {
|
||||
console.log("❌ 没有找到活动窗口");
|
||||
return;
|
||||
}
|
||||
|
||||
// 查找QNSView
|
||||
function findQNSView(view) {
|
||||
if (view.$className === 'QNSView') return view;
|
||||
try {
|
||||
const subviews = view.subviews();
|
||||
const count = subviews.count();
|
||||
for (let i = 0; i < count; i++) {
|
||||
const found = findQNSView(subviews.objectAtIndex_(i));
|
||||
if (found) return found;
|
||||
}
|
||||
} catch (e) {}
|
||||
return null;
|
||||
}
|
||||
|
||||
const qnsView = findQNSView(keyWindow.contentView());
|
||||
|
||||
if (!qnsView) {
|
||||
console.log("❌ 没有找到QNSView");
|
||||
return;
|
||||
}
|
||||
|
||||
// 要发送的字符和对应的键码
|
||||
const textToSend = [
|
||||
{ char: '1', keyCode: 18 },
|
||||
{ char: '2', keyCode: 19 },
|
||||
{ char: '3', keyCode: 20 }
|
||||
];
|
||||
|
||||
// 逐个发送字符
|
||||
textToSend.forEach((item, index) => {
|
||||
setTimeout(() => {
|
||||
try {
|
||||
console.log(`发送字符: ${item.char}`);
|
||||
|
||||
// 创建按键按下事件
|
||||
const keyDownEvent = NSEvent.keyEventWithType_location_modifierFlags_timestamp_windowNumber_context_characters_charactersIgnoringModifiers_isARepeat_keyCode_(
|
||||
NSEventTypeKeyDown,
|
||||
{ x: 100, y: 100 },
|
||||
0,
|
||||
Date.now() / 1000,
|
||||
keyWindow.windowNumber(),
|
||||
NULL,
|
||||
item.char,
|
||||
item.char,
|
||||
0,
|
||||
item.keyCode
|
||||
);
|
||||
|
||||
// 创建按键释放事件
|
||||
const keyUpEvent = NSEvent.keyEventWithType_location_modifierFlags_timestamp_windowNumber_context_characters_charactersIgnoringModifiers_isARepeat_keyCode_(
|
||||
NSEventTypeKeyUp,
|
||||
{ x: 100, y: 100 },
|
||||
0,
|
||||
(Date.now() / 1000) + 0.03,
|
||||
keyWindow.windowNumber(),
|
||||
NULL,
|
||||
item.char,
|
||||
item.char,
|
||||
0,
|
||||
item.keyCode
|
||||
);
|
||||
|
||||
// 发送按键按下
|
||||
qnsView.handleKeyEvent_eventType_(keyDownEvent, 6);
|
||||
|
||||
// 延迟发送按键释放
|
||||
setTimeout(() => {
|
||||
qnsView.handleKeyEvent_eventType_(keyUpEvent, 7);
|
||||
}, 30);
|
||||
|
||||
} catch (error) {
|
||||
console.error(`发送字符 ${item.char} 失败: ${error}`);
|
||||
}
|
||||
}, index * 100); // 每个字符间隔100ms
|
||||
});
|
||||
|
||||
console.log("✓ 文本'123'发送中...");
|
||||
|
||||
} catch (error) {
|
||||
console.error(`❌ 发送文本失败: ${error}`);
|
||||
}
|
||||
}
|
||||
|
||||
// 5. 组合函数：先发送123，然后回车
|
||||
function send123AndEnter() {
|
||||
console.log("\n=== 开始发送: 123 + 回车 ===");
|
||||
|
||||
// 先发送123
|
||||
sendText123();
|
||||
|
||||
// 延迟500ms后发送回车
|
||||
setTimeout(() => {
|
||||
console.log("\n=== 发送回车键 ===");
|
||||
sendEnterKey();
|
||||
}, 500);
|
||||
}
|
||||
|
||||
// 6. 通用按键注入函数
|
||||
function injectKey(keyCode, eventType, characters = '') {
|
||||
try {
|
||||
const NSApplication = ObjC.classes.NSApplication;
|
||||
const NSEvent = ObjC.classes.NSEvent;
|
||||
const app = NSApplication.sharedApplication();
|
||||
const keyWindow = app.keyWindow();
|
||||
|
||||
if (!keyWindow) {
|
||||
console.log("❌ 没有活动窗口");
|
||||
return false;
|
||||
}
|
||||
|
||||
// 查找QNSView
|
||||
function findQNSView(view) {
|
||||
if (view.$className === 'QNSView') return view;
|
||||
try {
|
||||
const subviews = view.subviews();
|
||||
for (let i = 0; i < subviews.count(); i++) {
|
||||
const found = findQNSView(subviews.objectAtIndex_(i));
|
||||
if (found) return found;
|
||||
}
|
||||
} catch (e) {}
|
||||
return null;
|
||||
}
|
||||
|
||||
const qnsView = findQNSView(keyWindow.contentView());
|
||||
|
||||
if (qnsView) {
|
||||
const event = NSEvent.keyEventWithType_location_modifierFlags_timestamp_windowNumber_context_characters_charactersIgnoringModifiers_isARepeat_keyCode_(
|
||||
eventType, // 10=按下, 11=释放
|
||||
{ x: 100, y: 100 },
|
||||
0,
|
||||
Date.now() / 1000,
|
||||
keyWindow.windowNumber(),
|
||||
NULL,
|
||||
characters,
|
||||
characters,
|
||||
0,
|
||||
keyCode
|
||||
);
|
||||
|
||||
// 根据逆向分析，a4参数：6可能是按下，7可能是释放
|
||||
const a4Param = eventType === NSEventTypeKeyDown ? 6 : 7;
|
||||
qnsView.handleKeyEvent_eventType_(event, a4Param);
|
||||
|
||||
console.log(`✓ 发送按键: keyCode=${keyCode}, type=${eventType}, a4=${a4Param}`);
|
||||
return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
|
||||
} catch (error) {
|
||||
console.error(`❌ 注入按键失败: ${error}`);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// 7. 直接调用Qt事件发送（基于逆向分析）
|
||||
function sendQtKeyEvent(keyCode, text, modifiers = 0) {
|
||||
try {
|
||||
console.log(`\n=== 直接发送Qt键盘事件: ${text} ===`);
|
||||
|
||||
// 尝试找到QNSView并调用底层函数
|
||||
const NSApplication = ObjC.classes.NSApplication;
|
||||
const app = NSApplication.sharedApplication();
|
||||
const keyWindow = app.keyWindow();
|
||||
|
||||
if (!keyWindow) return;
|
||||
|
||||
// 查找QNSView
|
||||
function findQNSView(view) {
|
||||
if (view.$className === 'QNSView') return view;
|
||||
try {
|
||||
const subviews = view.subviews();
|
||||
for (let i = 0; i < subviews.count(); i++) {
|
||||
const found = findQNSView(subviews.objectAtIndex_(i));
|
||||
if (found) return found;
|
||||
}
|
||||
} catch (e) {}
|
||||
return null;
|
||||
}
|
||||
|
||||
const qnsView = findQNSView(keyWindow.contentView());
|
||||
|
||||
if (qnsView && qnsView.handleKeyEvent) {
|
||||
// 创建模拟的事件对象
|
||||
const fakeEvent = {
|
||||
keyCode: function() { return keyCode; },
|
||||
characters: function() { return text; },
|
||||
charactersIgnoringModifiers: function() { return text; },
|
||||
timestamp: function() { return Date.now() / 1000; },
|
||||
modifierFlags: function() { return modifiers; },
|
||||
isARepeat: function() { return 0; }
|
||||
};
|
||||
|
||||
// 包装成ObjC对象
|
||||
const eventWrapper = new ObjC.Object(fakeEvent);
|
||||
|
||||
// 发送事件
|
||||
qnsView.handleKeyEvent_eventType_(eventWrapper, 6);
|
||||
|
||||
console.log(`✓ Qt事件发送: ${text} (keyCode: ${keyCode})`);
|
||||
}
|
||||
|
||||
} catch (error) {
|
||||
console.error(`❌ Qt事件发送失败: ${error}`);
|
||||
}
|
||||
}
|
||||
|
||||
// 9. 创建交互式菜单
|
||||
function showMenu() {
|
||||
console.log("\n" + "=".repeat(50));
|
||||
console.log("🎹 键盘注入器 - 纯JS版本");
|
||||
console.log("=".repeat(50));
|
||||
console.log("可用命令:");
|
||||
console.log("1. sendEnterKey() - 发送回车键");
|
||||
console.log("2. sendText123() - 发送文本 '123'");
|
||||
console.log("3. send123AndEnter() - 发送 '123' 然后回车");
|
||||
console.log("4. injectKey(36, 10) - 发送回车键按下");
|
||||
console.log("5. injectKey(36, 11) - 发送回车键释放");
|
||||
console.log("6. sendQtKeyEvent(18, '1') - 直接发送Qt事件");
|
||||
console.log("=".repeat(50));
|
||||
console.log("示例: 发送 '123' 然后回车:");
|
||||
console.log(" send123AndEnter()");
|
||||
console.log("=".repeat(50));
|
||||
}
|
||||
|
||||
// 10. 自动执行（可选）
|
||||
// 取消下面行的注释可以自动发送
|
||||
// setTimeout(send123AndEnter, 1000);
|
||||
|
||||
// 显示菜单
|
||||
showMenu();
|
||||
|
||||
console.log("\n✅ 键盘注入器加载完成！");
|
||||
console.log("📝 输入命令开始注入键盘事件...");
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
/**
|
||||
* 构造内存数据并调用 sub_10481C304
|
||||
*/
|
||||
function callTargetFunction() {
|
||||
// 1. 查找函数地址 (请确保模块名正确，这里假设是 WeChat)
|
||||
const moduleName = "WeChat";
|
||||
const sub_10481C304_addr = Module.findBaseAddress(moduleName).add(0x481C304);
|
||||
const sub_10481C304 = new NativeFunction(sub_10481C304_addr, 'void', ['pointer']);
|
||||
|
||||
// 2. 准备原始字节数据 (Hex 形式)
|
||||
// 注意：0x18 偏移处的 8 字节（原数据 60 E1 39 78 05 00 00 00）会被动态生成的指针覆盖
|
||||
const rawData = [
|
||||
0x00, 0x00, 0x00, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x18 指针位置
|
||||
0x05, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x80, 0x00, 0x01, 0x11, 0x01, 0x00, 0xAA, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00,
|
||||
0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
|
||||
0x00, 0xAA, 0xAA, 0xAA, 0xFF, 0xFF, 0xFF, 0xFF, 0xAA, 0xAA, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
||||
];
|
||||
|
||||
// 3. 申请结构体内存
|
||||
const structPtr = Memory.alloc(rawData.length);
|
||||
structPtr.writeByteArray(rawData);
|
||||
|
||||
// 4. 申请字符串内存并写入指针 (偏移 0x18)
|
||||
const cgiPath = "/cgi-bin/micromsg-bin/newsendmsg";
|
||||
const pathPtr = Memory.allocUtf8String(cgiPath);
|
||||
|
||||
// 将字符串地址写入结构体的 0x18 偏移处 (64位系统占8字节)
|
||||
structPtr.add(0x18).writePointer(pathPtr);
|
||||
|
||||
console.log("[+] 内存结构体已准备完毕: " + structPtr);
|
||||
console.log("[+] 字符串地址: " + pathPtr + " 内容: " + cgiPath);
|
||||
|
||||
// 5. 调用函数
|
||||
try {
|
||||
sub_10481C304(structPtr);
|
||||
console.log("[+] sub_10481C304 调用成功！");
|
||||
|
||||
console.log("[*] 结构体内存布局 (调用后):");
|
||||
console.log(hexdump(structPtr, { offset: 0, length: rawData.length, header: true, ansi: true }));
|
||||
|
||||
} catch (e) {
|
||||
console.log("[-] 调用出错: " + e);
|
||||
}
|
||||
}
|
||||
+416
-104
@@ -15,110 +15,422 @@ cgi 字符串指针
|
||||
sub_10481C304 taskId生成函数
|
||||
|
||||
```azure
|
||||
debug5059:0000000175ED6600 DCB 0x9A
|
||||
debug5059:0000000175ED6601 DCB 2
|
||||
debug5059:0000000175ED6602 DCB 0
|
||||
debug5059:0000000175ED6603 DCB 0
|
||||
debug5059:0000000175ED6604 DCB 0xA
|
||||
debug5059:0000000175ED6605 DCB 2
|
||||
debug5059:0000000175ED6606 DCB 0
|
||||
debug5059:0000000175ED6607 DCB 0
|
||||
debug5059:0000000175ED6608 DCB 0
|
||||
debug5059:0000000175ED6609 DCB 0
|
||||
debug5059:0000000175ED660A DCB 0
|
||||
debug5059:0000000175ED660B DCB 0
|
||||
debug5059:0000000175ED660C DCB 0
|
||||
debug5059:0000000175ED660D DCB 0
|
||||
debug5059:0000000175ED660E DCB 0
|
||||
debug5059:0000000175ED660F DCB 0
|
||||
debug5059:0000000175ED6610 DCB 3
|
||||
debug5059:0000000175ED6611 DCB 0
|
||||
debug5059:0000000175ED6612 DCB 0
|
||||
debug5059:0000000175ED6613 DCB 0
|
||||
debug5059:0000000175ED6614 DCB 1
|
||||
debug5059:0000000175ED6615 DCB 0
|
||||
debug5059:0000000175ED6616 DCB 0
|
||||
debug5059:0000000175ED6617 DCB 0
|
||||
debug5059:0000000175ED6618 DCB 0x60 ; `
|
||||
debug5059:0000000175ED6619 DCB 0xE1
|
||||
debug5059:0000000175ED661A DCB 0x39 ; 9
|
||||
debug5059:0000000175ED661B DCB 0x78 ; x
|
||||
debug5059:0000000175ED661C DCB 5
|
||||
debug5059:0000000175ED661D DCB 0
|
||||
debug5059:0000000175ED661E DCB 0
|
||||
debug5059:0000000175ED661F DCB 0
|
||||
debug5059:0000000175ED6620 DCB 0x20
|
||||
debug5059:0000000175ED6621 DCB 0
|
||||
debug5059:0000000175ED6622 DCB 0
|
||||
debug5059:0000000175ED6623 DCB 0
|
||||
debug5059:0000000175ED6624 DCB 0
|
||||
debug5059:0000000175ED6625 DCB 0
|
||||
debug5059:0000000175ED6626 DCB 0
|
||||
debug5059:0000000175ED6627 DCB 0
|
||||
debug5059:0000000175ED6628 DCB 0x30 ; 0
|
||||
debug5059:0000000175ED6629 DCB 0
|
||||
debug5059:0000000175ED662A DCB 0
|
||||
debug5059:0000000175ED662B DCB 0
|
||||
debug5059:0000000175ED662C DCB 0
|
||||
debug5059:0000000175ED662D DCB 0
|
||||
debug5059:0000000175ED662E DCB 0
|
||||
debug5059:0000000175ED662F DCB 0x80
|
||||
debug5059:0000000175ED6630 DCB 0
|
||||
debug5059:0000000175ED6631 DCB 1
|
||||
debug5059:0000000175ED6632 DCB 1
|
||||
debug5059:0000000175ED6633 DCB 1
|
||||
debug5059:0000000175ED6634 DCB 0
|
||||
debug5059:0000000175ED6635 DCB 0xAA
|
||||
debug5059:0000000175ED6636 DCB 0xAA
|
||||
debug5059:0000000175ED6637 DCB 0xAA
|
||||
debug5059:0000000175ED6638 DCB 0
|
||||
debug5059:0000000175ED6639 DCB 0
|
||||
debug5059:0000000175ED663A DCB 0
|
||||
debug5059:0000000175ED663B DCB 0
|
||||
debug5059:0000000175ED663C DCB 3
|
||||
debug5059:0000000175ED663D DCB 0
|
||||
debug5059:0000000175ED663E DCB 0
|
||||
debug5059:0000000175ED663F DCB 0
|
||||
debug5059:0000000175ED6640 DCB 1
|
||||
debug5059:0000000175ED6641 DCB 0
|
||||
debug5059:0000000175ED6642 DCB 0
|
||||
debug5059:0000000175ED6643 DCB 0
|
||||
debug5059:0000000175ED6644 DCB 0xFF
|
||||
debug5059:0000000175ED6645 DCB 0xFF
|
||||
debug5059:0000000175ED6646 DCB 0xFF
|
||||
debug5059:0000000175ED6647 DCB 0xFF
|
||||
debug5059:0000000175ED6648 DCB 0xFF
|
||||
debug5059:0000000175ED6649 DCB 0xFF
|
||||
debug5059:0000000175ED664A DCB 0xFF
|
||||
debug5059:0000000175ED664B DCB 0xFF
|
||||
debug5059:0000000175ED664C DCB 0
|
||||
debug5059:0000000175ED664D DCB 0xAA
|
||||
debug5059:0000000175ED664E DCB 0xAA
|
||||
debug5059:0000000175ED664F DCB 0xAA
|
||||
debug5059:0000000175ED6650 DCB 0xFF
|
||||
debug5059:0000000175ED6651 DCB 0xFF
|
||||
debug5059:0000000175ED6652 DCB 0xFF
|
||||
debug5059:0000000175ED6653 DCB 0xFF
|
||||
debug5059:0000000175ED6654 DCB 0xAA
|
||||
debug5059:0000000175ED6655 DCB 0xAA
|
||||
debug5059:0000000175ED6656 DCB 0xAA
|
||||
debug5059:0000000175ED6657 DCB 0xAA
|
||||
debug5059:0000000175ED6658 DCB 0
|
||||
debug5059:0000000175ED6659 DCB 0
|
||||
debug5059:0000000175ED665A DCB 0
|
||||
debug5059:0000000175ED665B DCB 0
|
||||
debug5059:0000000175ED665C DCB 0
|
||||
debug5059:0000000175ED665D DCB 0
|
||||
debug5059:0000000175ED665E DCB 0
|
||||
debug5059:0000000175ED665F DCB 0
|
||||
debug5059:0000000175ED6660 DCB 0xA
|
||||
debug5059:0000000175ED6661 DCB 2
|
||||
debug5059:0000000175ED6662 DCB 0
|
||||
debug5059:0000000175ED6663 DCB 0
|
||||
debug5059:0000000175ED6664 DCB 0
|
||||
debug5059:0000000175ED6665 DCB 0
|
||||
debug5059:0000000175ED6666 DCB 0
|
||||
debug5059:0000000175ED6667 DCB 0
|
||||
debug697:0000000175ED6600 DCB 0xE2
|
||||
debug697:0000000175ED6601 DCB 0
|
||||
debug697:0000000175ED6602 DCB 0
|
||||
debug697:0000000175ED6603 DCB 0
|
||||
debug697:0000000175ED6604 DCB 0xA
|
||||
debug697:0000000175ED6605 DCB 2
|
||||
debug697:0000000175ED6606 DCB 0
|
||||
debug697:0000000175ED6607 DCB 0
|
||||
debug697:0000000175ED6608 DCB 0
|
||||
debug697:0000000175ED6609 DCB 0
|
||||
debug697:0000000175ED660A DCB 0
|
||||
debug697:0000000175ED660B DCB 0
|
||||
debug697:0000000175ED660C DCB 0
|
||||
debug697:0000000175ED660D DCB 0
|
||||
debug697:0000000175ED660E DCB 0
|
||||
debug697:0000000175ED660F DCB 0
|
||||
debug697:0000000175ED6610 DCB 3
|
||||
debug697:0000000175ED6611 DCB 0
|
||||
debug697:0000000175ED6612 DCB 0
|
||||
debug697:0000000175ED6613 DCB 0
|
||||
debug697:0000000175ED6614 DCB 1
|
||||
debug697:0000000175ED6615 DCB 0
|
||||
debug697:0000000175ED6616 DCB 0
|
||||
debug697:0000000175ED6617 DCB 0
|
||||
debug697:0000000175ED6618 DCB 0x30 ; 0
|
||||
debug697:0000000175ED6619 DCB 0x5B ;
|
||||
debug697:0000000175ED661A DCB 0x58 ; X
|
||||
debug697:0000000175ED661B DCB 0xD9
|
||||
debug697:0000000175ED661C DCB 0xC
|
||||
debug697:0000000175ED661D DCB 0
|
||||
debug697:0000000175ED661E DCB 0
|
||||
debug697:0000000175ED661F DCB 0
|
||||
debug697:0000000175ED6620 DCB 0x20
|
||||
debug697:0000000175ED6621 DCB 0
|
||||
debug697:0000000175ED6622 DCB 0
|
||||
debug697:0000000175ED6623 DCB 0
|
||||
debug697:0000000175ED6624 DCB 0
|
||||
debug697:0000000175ED6625 DCB 0
|
||||
debug697:0000000175ED6626 DCB 0
|
||||
debug697:0000000175ED6627 DCB 0
|
||||
debug697:0000000175ED6628 DCB 0x30 ; 0
|
||||
debug697:0000000175ED6629 DCB 0
|
||||
debug697:0000000175ED662A DCB 0
|
||||
debug697:0000000175ED662B DCB 0
|
||||
debug697:0000000175ED662C DCB 0
|
||||
debug697:0000000175ED662D DCB 0
|
||||
debug697:0000000175ED662E DCB 0
|
||||
debug697:0000000175ED662F DCB 0x80
|
||||
debug697:0000000175ED6630 DCB 0
|
||||
debug697:0000000175ED6631 DCB 1
|
||||
debug697:0000000175ED6632 DCB 1
|
||||
debug697:0000000175ED6633 DCB 1
|
||||
debug697:0000000175ED6634 DCB 0
|
||||
debug697:0000000175ED6635 DCB 0xAA
|
||||
debug697:0000000175ED6636 DCB 0xAA
|
||||
debug697:0000000175ED6637 DCB 0xAA
|
||||
debug697:0000000175ED6638 DCB 0
|
||||
debug697:0000000175ED6639 DCB 0
|
||||
debug697:0000000175ED663A DCB 0
|
||||
debug697:0000000175ED663B DCB 0
|
||||
debug697:0000000175ED663C DCB 3
|
||||
debug697:0000000175ED663D DCB 0
|
||||
debug697:0000000175ED663E DCB 0
|
||||
debug697:0000000175ED663F DCB 0
|
||||
debug697:0000000175ED6640 DCB 1
|
||||
debug697:0000000175ED6641 DCB 0
|
||||
debug697:0000000175ED6642 DCB 0
|
||||
debug697:0000000175ED6643 DCB 0
|
||||
debug697:0000000175ED6644 DCB 0xFF
|
||||
debug697:0000000175ED6645 DCB 0xFF
|
||||
debug697:0000000175ED6646 DCB 0xFF
|
||||
debug697:0000000175ED6647 DCB 0xFF
|
||||
debug697:0000000175ED6648 DCB 0xFF
|
||||
debug697:0000000175ED6649 DCB 0xFF
|
||||
debug697:0000000175ED664A DCB 0xFF
|
||||
debug697:0000000175ED664B DCB 0xFF
|
||||
debug697:0000000175ED664C DCB 0
|
||||
debug697:0000000175ED664D DCB 0xAA
|
||||
debug697:0000000175ED664E DCB 0xAA
|
||||
debug697:0000000175ED664F DCB 0xAA
|
||||
debug697:0000000175ED6650 DCB 0xFF
|
||||
debug697:0000000175ED6651 DCB 0xFF
|
||||
debug697:0000000175ED6652 DCB 0xFF
|
||||
debug697:0000000175ED6653 DCB 0xFF
|
||||
debug697:0000000175ED6654 DCB 0xAA
|
||||
debug697:0000000175ED6655 DCB 0xAA
|
||||
debug697:0000000175ED6656 DCB 0xAA
|
||||
debug697:0000000175ED6657 DCB 0xAA
|
||||
debug697:0000000175ED6658 DCB 0
|
||||
debug697:0000000175ED6659 DCB 0
|
||||
debug697:0000000175ED665A DCB 0
|
||||
debug697:0000000175ED665B DCB 0
|
||||
debug697:0000000175ED665C DCB 0
|
||||
debug697:0000000175ED665D DCB 0
|
||||
debug697:0000000175ED665E DCB 0
|
||||
debug697:0000000175ED665F DCB 0
|
||||
debug697:0000000175ED6660 DCB 0xA
|
||||
debug697:0000000175ED6661 DCB 2
|
||||
debug697:0000000175ED6662 DCB 0
|
||||
debug697:0000000175ED6663 DCB 0
|
||||
debug697:0000000175ED6664 DCB 0
|
||||
debug697:0000000175ED6665 DCB 0
|
||||
debug697:0000000175ED6666 DCB 0
|
||||
debug697:0000000175ED6667 DCB 0
|
||||
debug697:0000000175ED6668 DCB 0x64 ; d
|
||||
debug697:0000000175ED6669 DCB 0x65 ; e
|
||||
debug697:0000000175ED666A DCB 0x66 ; f
|
||||
debug697:0000000175ED666B DCB 0x61 ; a
|
||||
debug697:0000000175ED666C DCB 0x75 ; u
|
||||
debug697:0000000175ED666D DCB 0x6C ; l
|
||||
debug697:0000000175ED666E DCB 0x74 ; t
|
||||
debug697:0000000175ED666F DCB 0x2D ; -
|
||||
debug697:0000000175ED6670 DCB 0x6C ; l
|
||||
debug697:0000000175ED6671 DCB 0x6F ; o
|
||||
debug697:0000000175ED6672 DCB 0x6E ; n
|
||||
debug697:0000000175ED6673 DCB 0x67 ; g
|
||||
debug697:0000000175ED6674 DCB 0x6C ; l
|
||||
debug697:0000000175ED6675 DCB 0x69 ; i
|
||||
debug697:0000000175ED6676 DCB 0x6E ; n
|
||||
debug697:0000000175ED6677 DCB 0x6B ; k
|
||||
debug697:0000000175ED6678 DCB 0
|
||||
debug697:0000000175ED6679 DCB 0xAA
|
||||
debug697:0000000175ED667A DCB 0xAA
|
||||
debug697:0000000175ED667B DCB 0xAA
|
||||
debug697:0000000175ED667C DCB 0xAA
|
||||
debug697:0000000175ED667D DCB 0xAA
|
||||
debug697:0000000175ED667E DCB 0xAA
|
||||
debug697:0000000175ED667F DCB 0x10
|
||||
debug697:0000000175ED6680 DCB 0
|
||||
debug697:0000000175ED6681 DCB 0
|
||||
debug697:0000000175ED6682 DCB 0
|
||||
debug697:0000000175ED6683 DCB 0
|
||||
debug697:0000000175ED6684 DCB 0
|
||||
debug697:0000000175ED6685 DCB 0
|
||||
debug697:0000000175ED6686 DCB 0
|
||||
debug697:0000000175ED6687 DCB 0
|
||||
debug697:0000000175ED6688 DCB 0
|
||||
debug697:0000000175ED6689 DCB 0
|
||||
debug697:0000000175ED668A DCB 0
|
||||
debug697:0000000175ED668B DCB 0
|
||||
debug697:0000000175ED668C DCB 0
|
||||
debug697:0000000175ED668D DCB 0
|
||||
debug697:0000000175ED668E DCB 0
|
||||
debug697:0000000175ED668F DCB 0
|
||||
debug697:0000000175ED6690 DCB 0
|
||||
debug697:0000000175ED6691 DCB 0
|
||||
debug697:0000000175ED6692 DCB 0
|
||||
debug697:0000000175ED6693 DCB 0
|
||||
debug697:0000000175ED6694 DCB 0
|
||||
debug697:0000000175ED6695 DCB 0
|
||||
debug697:0000000175ED6696 DCB 0
|
||||
debug697:0000000175ED6697 DCB 0
|
||||
debug697:0000000175ED6698 DCB 0
|
||||
debug697:0000000175ED6699 DCB 0
|
||||
debug697:0000000175ED669A DCB 0
|
||||
debug697:0000000175ED669B DCB 0
|
||||
debug697:0000000175ED669C DCB 0
|
||||
debug697:0000000175ED669D DCB 0
|
||||
debug697:0000000175ED669E DCB 0
|
||||
debug697:0000000175ED669F DCB 0
|
||||
debug697:0000000175ED66A0 DCB 0
|
||||
debug697:0000000175ED66A1 DCB 0
|
||||
debug697:0000000175ED66A2 DCB 0
|
||||
debug697:0000000175ED66A3 DCB 0
|
||||
debug697:0000000175ED66A4 DCB 0
|
||||
debug697:0000000175ED66A5 DCB 0
|
||||
debug697:0000000175ED66A6 DCB 0
|
||||
debug697:0000000175ED66A7 DCB 0
|
||||
debug697:0000000175ED66A8 DCB 0
|
||||
debug697:0000000175ED66A9 DCB 0
|
||||
debug697:0000000175ED66AA DCB 0
|
||||
debug697:0000000175ED66AB DCB 0
|
||||
debug697:0000000175ED66AC DCB 0
|
||||
debug697:0000000175ED66AD DCB 0
|
||||
debug697:0000000175ED66AE DCB 0
|
||||
debug697:0000000175ED66AF DCB 0
|
||||
debug697:0000000175ED66B0 DCB 0
|
||||
debug697:0000000175ED66B1 DCB 0
|
||||
debug697:0000000175ED66B2 DCB 0
|
||||
debug697:0000000175ED66B3 DCB 0
|
||||
debug697:0000000175ED66B4 DCB 0xAA
|
||||
debug697:0000000175ED66B5 DCB 0xAA
|
||||
debug697:0000000175ED66B6 DCB 0xAA
|
||||
debug697:0000000175ED66B7 DCB 0xAA
|
||||
debug697:0000000175ED66B8 DCB 0xC0
|
||||
debug697:0000000175ED66B9 DCB 0x66 ; f
|
||||
debug697:0000000175ED66BA DCB 0xED
|
||||
debug697:0000000175ED66BB DCB 0x75 ; u
|
||||
debug697:0000000175ED66BC DCB 1
|
||||
debug697:0000000175ED66BD DCB 0
|
||||
debug697:0000000175ED66BE DCB 0
|
||||
debug697:0000000175ED66BF DCB 0
|
||||
debug697:0000000175ED66C0 DCB 0
|
||||
debug697:0000000175ED66C1 DCB 0
|
||||
debug697:0000000175ED66C2 DCB 0
|
||||
debug697:0000000175ED66C3 DCB 0
|
||||
debug697:0000000175ED66C4 DCB 0
|
||||
debug697:0000000175ED66C5 DCB 0
|
||||
debug697:0000000175ED66C6 DCB 0
|
||||
debug697:0000000175ED66C7 DCB 0
|
||||
debug697:0000000175ED66C8 DCB 0
|
||||
debug697:0000000175ED66C9 DCB 0
|
||||
debug697:0000000175ED66CA DCB 0
|
||||
debug697:0000000175ED66CB DCB 0
|
||||
debug697:0000000175ED66CC DCB 0
|
||||
debug697:0000000175ED66CD DCB 0
|
||||
debug697:0000000175ED66CE DCB 0
|
||||
debug697:0000000175ED66CF DCB 0
|
||||
debug697:0000000175ED66D0 DCB 0
|
||||
debug697:0000000175ED66D1 DCB 0
|
||||
debug697:0000000175ED66D2 DCB 0
|
||||
debug697:0000000175ED66D3 DCB 0
|
||||
debug697:0000000175ED66D4 DCB 0
|
||||
debug697:0000000175ED66D5 DCB 0
|
||||
debug697:0000000175ED66D6 DCB 0
|
||||
debug697:0000000175ED66D7 DCB 0
|
||||
debug697:0000000175ED66D8 DCB 0
|
||||
debug697:0000000175ED66D9 DCB 0
|
||||
debug697:0000000175ED66DA DCB 0
|
||||
debug697:0000000175ED66DB DCB 0
|
||||
debug697:0000000175ED66DC DCB 0
|
||||
debug697:0000000175ED66DD DCB 0
|
||||
debug697:0000000175ED66DE DCB 0
|
||||
debug697:0000000175ED66DF DCB 0
|
||||
debug697:0000000175ED66E0 DCB 0
|
||||
debug697:0000000175ED66E1 DCB 0
|
||||
debug697:0000000175ED66E2 DCB 0
|
||||
debug697:0000000175ED66E3 DCB 0
|
||||
debug697:0000000175ED66E4 DCB 0
|
||||
debug697:0000000175ED66E5 DCB 0
|
||||
debug697:0000000175ED66E6 DCB 0
|
||||
debug697:0000000175ED66E7 DCB 0
|
||||
debug697:0000000175ED66E8 DCB 0
|
||||
debug697:0000000175ED66E9 DCB 0
|
||||
debug697:0000000175ED66EA DCB 0
|
||||
debug697:0000000175ED66EB DCB 0
|
||||
debug697:0000000175ED66EC DCB 0
|
||||
debug697:0000000175ED66ED DCB 0
|
||||
debug697:0000000175ED66EE DCB 0
|
||||
debug697:0000000175ED66EF DCB 0
|
||||
debug697:0000000175ED66F0 DCB 0
|
||||
debug697:0000000175ED66F1 DCB 0
|
||||
debug697:0000000175ED66F2 DCB 0
|
||||
debug697:0000000175ED66F3 DCB 0
|
||||
debug697:0000000175ED66F4 DCB 0
|
||||
debug697:0000000175ED66F5 DCB 0
|
||||
debug697:0000000175ED66F6 DCB 0
|
||||
debug697:0000000175ED66F7 DCB 0
|
||||
debug697:0000000175ED66F8 DCB 0
|
||||
debug697:0000000175ED66F9 DCB 0
|
||||
debug697:0000000175ED66FA DCB 0
|
||||
debug697:0000000175ED66FB DCB 0
|
||||
debug697:0000000175ED66FC DCB 0
|
||||
debug697:0000000175ED66FD DCB 0
|
||||
debug697:0000000175ED66FE DCB 0
|
||||
debug697:0000000175ED66FF DCB 0
|
||||
debug697:0000000175ED6700 DCB 0
|
||||
debug697:0000000175ED6701 DCB 0
|
||||
debug697:0000000175ED6702 DCB 0
|
||||
debug697:0000000175ED6703 DCB 0
|
||||
debug697:0000000175ED6704 DCB 0
|
||||
debug697:0000000175ED6705 DCB 0
|
||||
debug697:0000000175ED6706 DCB 0
|
||||
debug697:0000000175ED6707 DCB 0
|
||||
debug697:0000000175ED6708 DCB 0
|
||||
debug697:0000000175ED6709 DCB 0
|
||||
debug697:0000000175ED670A DCB 0
|
||||
debug697:0000000175ED670B DCB 0
|
||||
debug697:0000000175ED670C DCB 0
|
||||
debug697:0000000175ED670D DCB 0
|
||||
debug697:0000000175ED670E DCB 0
|
||||
debug697:0000000175ED670F DCB 0
|
||||
debug697:0000000175ED6710 DCB 0
|
||||
debug697:0000000175ED6711 DCB 0
|
||||
debug697:0000000175ED6712 DCB 0
|
||||
debug697:0000000175ED6713 DCB 0
|
||||
debug697:0000000175ED6714 DCB 0
|
||||
debug697:0000000175ED6715 DCB 0
|
||||
debug697:0000000175ED6716 DCB 0
|
||||
debug697:0000000175ED6717 DCB 0
|
||||
debug697:0000000175ED6718 DCB 0
|
||||
debug697:0000000175ED6719 DCB 0
|
||||
debug697:0000000175ED671A DCB 0
|
||||
debug697:0000000175ED671B DCB 0
|
||||
debug697:0000000175ED671C DCB 0
|
||||
debug697:0000000175ED671D DCB 0
|
||||
debug697:0000000175ED671E DCB 0
|
||||
debug697:0000000175ED671F DCB 0
|
||||
debug697:0000000175ED6720 DCB 0
|
||||
debug697:0000000175ED6721 DCB 0
|
||||
debug697:0000000175ED6722 DCB 0
|
||||
debug697:0000000175ED6723 DCB 0
|
||||
debug697:0000000175ED6724 DCB 0
|
||||
debug697:0000000175ED6725 DCB 0
|
||||
debug697:0000000175ED6726 DCB 0
|
||||
debug697:0000000175ED6727 DCB 0
|
||||
debug697:0000000175ED6728 DCB 0
|
||||
debug697:0000000175ED6729 DCB 0
|
||||
debug697:0000000175ED672A DCB 0
|
||||
debug697:0000000175ED672B DCB 0
|
||||
debug697:0000000175ED672C DCB 0
|
||||
debug697:0000000175ED672D DCB 0
|
||||
debug697:0000000175ED672E DCB 0
|
||||
debug697:0000000175ED672F DCB 0
|
||||
debug697:0000000175ED6730 DCB 0
|
||||
debug697:0000000175ED6731 DCB 0
|
||||
debug697:0000000175ED6732 DCB 0
|
||||
debug697:0000000175ED6733 DCB 0
|
||||
debug697:0000000175ED6734 DCB 0
|
||||
debug697:0000000175ED6735 DCB 0
|
||||
debug697:0000000175ED6736 DCB 0
|
||||
debug697:0000000175ED6737 DCB 0
|
||||
debug697:0000000175ED6738 DCB 0
|
||||
debug697:0000000175ED6739 DCB 0
|
||||
debug697:0000000175ED673A DCB 0
|
||||
debug697:0000000175ED673B DCB 0
|
||||
debug697:0000000175ED673C DCB 0
|
||||
debug697:0000000175ED673D DCB 0
|
||||
debug697:0000000175ED673E DCB 0
|
||||
debug697:0000000175ED673F DCB 0
|
||||
debug697:0000000175ED6740 DCB 0
|
||||
debug697:0000000175ED6741 DCB 0
|
||||
debug697:0000000175ED6742 DCB 0
|
||||
debug697:0000000175ED6743 DCB 0
|
||||
debug697:0000000175ED6744 DCB 0
|
||||
debug697:0000000175ED6745 DCB 0
|
||||
debug697:0000000175ED6746 DCB 0
|
||||
debug697:0000000175ED6747 DCB 0
|
||||
debug697:0000000175ED6748 DCB 1
|
||||
debug697:0000000175ED6749 DCB 0
|
||||
debug697:0000000175ED674A DCB 0
|
||||
debug697:0000000175ED674B DCB 0
|
||||
debug697:0000000175ED674C DCB 0xAA
|
||||
debug697:0000000175ED674D DCB 0xAA
|
||||
debug697:0000000175ED674E DCB 0xAA
|
||||
debug697:0000000175ED674F DCB 0xAA
|
||||
debug697:0000000175ED6750 DCB 0
|
||||
debug697:0000000175ED6751 DCB 0
|
||||
debug697:0000000175ED6752 DCB 0
|
||||
debug697:0000000175ED6753 DCB 0
|
||||
debug697:0000000175ED6754 DCB 0
|
||||
debug697:0000000175ED6755 DCB 0
|
||||
debug697:0000000175ED6756 DCB 0
|
||||
debug697:0000000175ED6757 DCB 0
|
||||
debug697:0000000175ED6758 DCB 0
|
||||
debug697:0000000175ED6759 DCB 0
|
||||
debug697:0000000175ED675A DCB 0
|
||||
debug697:0000000175ED675B DCB 0
|
||||
debug697:0000000175ED675C DCB 0
|
||||
debug697:0000000175ED675D DCB 0
|
||||
debug697:0000000175ED675E DCB 0
|
||||
debug697:0000000175ED675F DCB 0
|
||||
debug697:0000000175ED6760 DCB 0
|
||||
debug697:0000000175ED6761 DCB 0
|
||||
debug697:0000000175ED6762 DCB 0
|
||||
debug697:0000000175ED6763 DCB 0
|
||||
debug697:0000000175ED6764 DCB 0
|
||||
debug697:0000000175ED6765 DCB 0
|
||||
debug697:0000000175ED6766 DCB 0
|
||||
debug697:0000000175ED6767 DCB 0
|
||||
debug697:0000000175ED6768 DCB 0
|
||||
debug697:0000000175ED6769 DCB 0
|
||||
debug697:0000000175ED676A DCB 0
|
||||
debug697:0000000175ED676B DCB 0
|
||||
debug697:0000000175ED676C DCB 0
|
||||
debug697:0000000175ED676D DCB 0
|
||||
debug697:0000000175ED676E DCB 0
|
||||
debug697:0000000175ED676F DCB 0
|
||||
debug697:0000000175ED6770 DCB 0
|
||||
debug697:0000000175ED6771 DCB 0
|
||||
debug697:0000000175ED6772 DCB 0
|
||||
debug697:0000000175ED6773 DCB 0
|
||||
debug697:0000000175ED6774 DCB 0
|
||||
debug697:0000000175ED6775 DCB 0
|
||||
debug697:0000000175ED6776 DCB 0
|
||||
debug697:0000000175ED6777 DCB 0
|
||||
debug697:0000000175ED6778 DCB 0
|
||||
debug697:0000000175ED6779 DCB 0
|
||||
debug697:0000000175ED677A DCB 0
|
||||
debug697:0000000175ED677B DCB 0
|
||||
debug697:0000000175ED677C DCB 0
|
||||
debug697:0000000175ED677D DCB 0
|
||||
debug697:0000000175ED677E DCB 0
|
||||
debug697:0000000175ED677F DCB 0
|
||||
debug697:0000000175ED6780 DCB 3
|
||||
debug697:0000000175ED6781 DCB 0
|
||||
debug697:0000000175ED6782 DCB 0
|
||||
debug697:0000000175ED6783 DCB 0
|
||||
debug697:0000000175ED6784 DCB 0
|
||||
debug697:0000000175ED6785 DCB 0
|
||||
debug697:0000000175ED6786 DCB 0
|
||||
debug697:0000000175ED6787 DCB 0
|
||||
debug697:0000000175ED6788 DCB 0
|
||||
debug697:0000000175ED6789 DCB 0
|
||||
debug697:0000000175ED678A DCB 0xAA
|
||||
debug697:0000000175ED678B DCB 0xAA
|
||||
debug697:0000000175ED678C DCB 0xAA
|
||||
debug697:0000000175ED678D DCB 0xAA
|
||||
debug697:0000000175ED678E DCB 0xAA
|
||||
debug697:0000000175ED678F DCB 0xAA
|
||||
debug697:0000000175ED6790 DCB 0x98
|
||||
debug697:0000000175ED6791 DCB 0x67 ; g
|
||||
debug697:0000000175ED6792 DCB 0xED
|
||||
debug697:0000000175ED6793 DCB 0x75 ; u
|
||||
debug697:0000000175ED6794 DCB 1
|
||||
debug697:0000000175ED6795 DCB 0
|
||||
debug697:0000000175ED6796 DCB 0
|
||||
debug697:0000000175ED6797 DCB 0
|
||||
debug697:0000000175ED6798 DCB 0
|
||||
debug697:0000000175ED6799 DCB 0
|
||||
debug697:0000000175ED679A DCB 0
|
||||
debug697:0000000175ED679B DCB 0
|
||||
debug697:0000000175ED679C DCB 0
|
||||
debug697:0000000175ED679D DCB 0
|
||||
debug697:0000000175ED679E DCB 0
|
||||
debug697:0000000175ED679F DCB 0
|
||||
```
|
||||
|
||||
|
||||
|
||||
@@ -193,4 +193,4 @@ analyze_all_args()
|
||||
example_usage()
|
||||
"""
|
||||
|
||||
print_register_struct("X2", 128, 4)
|
||||
print_register_struct("X1", 128, 4)
|
||||
@@ -0,0 +1,66 @@
|
||||
import ida_idd
|
||||
import ida_bytes
|
||||
|
||||
# 改task id， 改 cgi，改第一个指针即可
|
||||
|
||||
payload = (
|
||||
b"\xFF\x00\x00\x00\x0A\x02\x00\x00" # 0x00 // task id / cmd id 175ED6600
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x08
|
||||
b"\x03\x00\x00\x00\x10\x00\x00\x00" # 0x10
|
||||
b"\x70\xa9\x07\xb8\x0c\x00\x00\x00" # 0x18 // cgi
|
||||
b"\x20\x00\x00\x00\x00\x00\x00\x00" # 0x20
|
||||
b"\x30\x00\x00\x00\x00\x00\x00\x80" # 0x28
|
||||
b"\x00\x01\x01\x01\x00\xAA\xAA\xAA" # 0x30
|
||||
b"\x00\x00\x00\x00\x03\x00\x00\x00" # 0x38
|
||||
b"\x01\x00\x00\x00\xFF\xFF\xFF\xFF" # 0x40
|
||||
b"\xFF\xFF\xFF\xFF\x00\xAA\xAA\xAA" # 0x48
|
||||
b"\xFF\xFF\xFF\xFF\xAA\xAA\xAA\xAA" # 0x50
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x58
|
||||
b"\x0A\x02\x00\x00\x00\x00\x00\x00" # 0x60
|
||||
b"\x64\x65\x66\x61\x75\x6C\x74\x2D" # 0x68 (default-)
|
||||
b"\x6C\x6F\x6E\x67\x6C\x69\x6E\x6B" # 0x70 (longlink)
|
||||
b"\x00\xAA\xAA\xAA\xAA\xAA\xAA\x10" # 0x78
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x80
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x88
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x90
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x98
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xA0
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xA8
|
||||
b"\x00\x00\x00\x00\xAA\xAA\xAA\xAA" # 0xB0
|
||||
b"\xC0\x66\xED\x75\x01\x00\x00\x00" # 0xB8
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xC0
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xC8
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xD0
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xD8
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xE0
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xE8
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xF0
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xF8
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x100
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x108
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x110
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x118
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x120
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x128
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x130
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x138
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x140
|
||||
b"\x01\x00\x00\x00\xAA\xAA\xAA\xAA" # 0x148
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x150
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x158
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x160
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x168
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x170
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x178
|
||||
b"\x03\x00\x00\x00\x00\x00\x00\x00" # 0x180
|
||||
b"\x00\x00\xAA\xAA\xAA\xAA\xAA\xAA" # 0x188
|
||||
b"\x98\x67\xED\x75\x01\x00\x00\x00" # 0x190
|
||||
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x198
|
||||
)
|
||||
ida_bytes.patch_bytes(0x175ED6600, payload)
|
||||
|
||||
try:
|
||||
Appcall.sub_10444B75C(0x8776FE800, 0x175ED6600)
|
||||
print("Executed with manually set X0.")
|
||||
except Exception as e:
|
||||
print(f"Error: {e}")
|
||||
@@ -0,0 +1,3 @@
|
||||
|
||||
|
||||
Appcall.netimplement_StartTask_1033EEC84(0xC374FC818, 0xC3813F200)
|
||||
Reference in New Issue
Block a user