[Reprinted] Find the memory distribution and address of the strange data array (tianlong Babu)

Game: tianlong Babu, version: 0.16.0108, System Windows XP, Tools : Ce5.2 + od1.10 + C #2005
Objective: To find the array format and location of strange data in the memory

First, correct the search method of the character base address in Note 1. The specific search method is described below:
1. Ce finds a unique address based on the person's experience or blood (in reality, I am based on experience)
2. OD writes a breakpoint to memory under an empirical address
0044bc28 8b46 0C mov eax, dword ptr ds: [ESI + C] Here is the write experience address. Obtain the second offset value C and the ESI value.
0044bc2b 89b8 c0060000 mov dword ptr ds: [eax + 6c0], EDI here is the write experience, get the first offset value 6c0 and the address eax Value
0044bc31 8b0d c4b75b00 mov ECx, dword ptr ds: [5bb7c4]
0044bc37 8b11 mov edX, dword ptr ds: [ECx]
0044bc39 68 04755700 push game.00577504; ASCII "Player"
0044bc3e 6a 1D push 1d
0044bc40 ff52 4C call dword ptr ds: [edX + 4C]
3. Reverse Analysis in OD
004d82d0 55 push EBP
........................ Omit ................................................................................................
004d82f6 ff52 44 call dword ptr ds: [edX + 44]
004d82f9 8bd8 mov EBX, eax; EBX = eax
004d82fb 85db test EBX, EBX
004d82fd 0f84 8f080000 je game.004d8b92
004d8303 33c0 XOR eax, eax
004d8305 8a46 0C mov Al, byte ptr ds: [ESI + C]
004d8308 57 push EDI
004d8309 8bbb 2c020000 mov EDI, dword ptr ds: [EBX + 22C]; EDI = EBX + 22C. Here, EBX obtains the third offset value 22C and address EBX.
004d830f 83e0 01 and eax, 1
........................ Omit ................................................................................................
004d838a E8 4137f7ff call game.0044bad0; call experience to obtain Functions
4. EBX value Switching Map Time does not change, and the experience can be obtained after three offsets (Note 1 considers that the EBX is a base address, which is corrected here). The memory write access breakpoint under the EBX address is obtained below Code Fragment
00501957 8945 F0 mov dword ptr ss: [EBP-10], eax
0050195a A1 88895b00 mov eax, dword ptr ds: [5b8988]; base address 5b5888
0050195f 57 push EDI
00501960 8bf9 mov EDI, ECx
00501962 8b48 44 mov ECx, dword ptr ds: [eax + 44]; Fourth offset value 44
00501965 894f 08 mov dword ptr ds: [EDI + 8], ECx; write address
00501968 8b11 mov edX, dword ptr ds: [ECx]
0050196a ff52 3C call dword ptr ds: [edX + 3C]
To sum up, the character data address is [[[5b8988] + 44] + 22C] + C, and the experience value is [character data address + 6c0].

Now, let's start searching for the strange array.
I have learned how to find the memory address over the past few days. Therefore, the following steps are short for writing only methods and key steps.

Step 1: Find a strange name (text) in the current map in CE and find a bunch of addresses. When you switch to the strange area and find the address changes, several addresses are changed. These address features are very similar. It is suggested that these addresses may be a few items in the array. Check the memory area and capture the segment as follows:
02816660 02 00 00 00 41 F1 0f 43 \ u0002a? C
02816668 00 00 00 00 3f 57 5B 42 .? W [B
02816670 00 00 00 00 00 00 00 ..
02816678 B5 C1 C4 B9 D0 A1 D4 F4 tomb thief
02816680 00 00 00 00 00 00 00 ..
02816688 08 00 00 00 0f 00 00 00 \ u0008 \ u000f
02816690 F5 00 00 00 00 00 00?
02816698 00 00 00 00 2D 23 10 43.-# \ u0010c
028166a0 00 00 00 8C 9B 83 42. too large
028166a8 00 00 00 00 00 00 ..
028166b0 B5 C1 C4 B9 D0 A1 D4 F4 tomb thief
028166b8 00 B4 B6 Fe B2 E3 00. have ?.
028166c0 08 00 00 00 0f 00 00 \ u0008 \ u000f
028166c8 EC 00 00 00 00 00?
028166d0 00 00 00 6B 8f 18 43. K? C
028166d8 00 00 00 00 4f 40 26 42. o @ & B
028166e0 00 00 00 00 00 00 ..
028166e8 B5 C1 C4 B9 D0 A1 D4 F4 tomb thief
028166f0 00 B4 B6 Fe B2 E3 00. have ?.
028166f8 08 00 00 00 0f 00 00 \ u0008 \ u000f
02816700 E9 00 00 00 00 00?
02816708 00 00 00 00 2f dB 1B 43 ./? C
02816710 00 00 00 00 1E Ba 52 42. \ u001e 0000b
02816718 00 00 00 00 00 00 00 ..


After analysis, it is found that the strange coordinates, names, numbers, types, and other data are stored.

Step 2: OD writes an access breakpoint to the memory under the address that you think is the most confident. The Code is as follows:
7c364344 89448f E4 mov dword ptr ds: [EDI + ECx * 4-1c], eax
7c364348 8b448e E8 mov eax, dword ptr ds: [ESI + ECx * 4-18]
7c36434c 89448f E8 mov dword ptr ds: [EDI + ECx * 4-18], eax
7c364350 8b448e EC mov eax, dword ptr ds: [ESI + ECx * 4-14]
7c364354 89448f EC mov dword ptr ds: [EDI + ECx * 4-14], eax
7c364358 8b448e F0 mov eax, dword ptr ds: [ESI + ECx * 4-10]
7c36435c 89448f F0 mov dword ptr ds: [EDI + ECx * 4-10], eax
7c364360 8b448e F4 mov eax, dword ptr ds: [ESI + ECx * 4-C]
7c364364 89448f F4 mov dword ptr ds: [EDI + ECx * 4-C], eax
7c364368 8b448e F8 mov eax, dword ptr ds: [ESI + ECx * 4-8]
7c36436c 89448f F8 mov dword ptr ds: [EDI + ECx * 4-8], eax
7c364370 8b448e FC mov eax, dword ptr ds: [ESI + ECx * 4-4]
7c364374 89448f FC mov dword ptr ds: [EDI + ECx * 4-4], eax
7c364378 8d048d 00000000 Lea eax, dword ptr ds: [ECx * 4]

Step 3: Back up the reverse analysis code after interruption:
0050143e 8b0d 50895b00 mov ECx, dword ptr ds: [5b8950]; base address
00501444 8b11 mov edX, dword ptr ds: [ECx]
00501446 ff52 54 call dword ptr ds: [edX + 54]
the preceding red part is the base address. the starting address of the monster array is [5b8950] + 7C