楓之谷 TwMS v237.1 CRC MSCRC // 單mscrc bypass,需要搭配bccrc bypass使用

此數據僅為 Ms Crc bypass 並未處理 NGS 使用後僅能開crc過圖等不會崩潰 但還是會被NGS檢測

1. // TwMs v237.1 CRC MSCRC（update from gms）
   
2. // 單mscrc bypass,需要搭配bccrc bypass使用
   
3. 
   
4. define(CRC1,0560B10A)
   
5. define(CRC2,053985B3)
   
6. define(CRC1Reg,ebx)
   
7. define(CRC2Reg,ebx)
   
8. define(CRC1CHANGE,5)
   
9. define(CRC2CHANGE,6)
   
10. define(CRCSTART,00401000)
    
11. define(CRCEND,0640A000)
    
12. 
    
13. [ENABLE]
    
14. globalalloc(DisableCRCBypass,200)
    
15. alloc(CRCHook,200)
    
16. alloc(MemCopy,100700160)
    
17. registersymbol(MemCopy)
    
18. alloc(MemCopier,200)
    
19. registersymbol(MemCopier)
    
20. label(Hook1)
    
21. label(Hook2)
    
22. label(Hook1End)
    
23. label(Hook2End)
    
24. label(Hook1Ret)
    
25. label(Hook2Ret)
    
26. label(CopyExit)
    
27. label(Hook2Ending)
    
28. label(Hook1Ending)
    
29. label(Counter)
    
30. createthread(MemCopier)
    
31. 
    
32. ///////////////////////////////////////////////////////////////////////////
    
33. 
    
34. MemCopier:
    
35. cmp [MemCopier+200],1
    
36. je CopyExit
    
37. 
    
38. push CRCEND-CRCSTART //size
    
39. push CRCSTART //*src
    
40. push MemCopy //*dest
    
41. call memcpy
    
42. add esp,0C
    
43. 
    
44. CopyExit:
    
45. Hook1Ending:
    
46. mov eax,[Counter]
    
47. mov bh, [CRC1+eax]
    
48. mov BYTE PTR [Hook1End+eax],bh
    
49. mov BYTE PTR [DisableCRCBypass+150+eax],bh
    
50. inc [Counter]
    
51. cmp [Counter],CRC1CHANGE
    
52. jl Hook1Ending
    
53. mov [Counter],0
    
54. 
    
55. Hook2Ending:
    
56. mov eax,[Counter]
    
57. mov bh, [CRC2+eax]
    
58. mov BYTE PTR [Hook2End+eax],bh
    
59. mov BYTE PTR [DisableCRCBypass+160+eax],bh
    
60. inc [Counter]
    
61. cmp [Counter],CRC2CHANGE
    
62. jl Hook2Ending
    
63. mov [Counter],0
    
64. 
    
65. mov eax,Hook1
    
66. sub eax,CRC1+5
    
67. mov byte ptr [CRC1],E9
    
68. mov [CRC1+1],eax
    
69. 
    
70. mov eax,Hook2
    
71. sub eax,CRC2+5
    
72. mov byte ptr [CRC2],E9
    
73. mov [CRC2+1],eax
    
74. 
    
75. mov [MemCopier+200],1
    
76. jmp terminatethread
    
77. 
    
78. 
    
79. Counter:
    
80. dd 0
    
81. 
    
82. ///////////////////////////////////////////////////////////////////////////
    
83. 
    
84. CRCHook:
    
85. Hook1:
    
86. cmp CRC1Reg,CRCSTART
    
87. jb Hook1End
    
88. cmp CRC1Reg,CRCEND
    
89. ja Hook1End
    
90. sub CRC1Reg,CRCSTART
    
91. add CRC1Reg,MemCopy
    
92. jmp Hook1End
    
93. 
    
94. Hook1End:
    
95. db 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
    
96. jmp Hook1Ret
    
97. 
    
98. Hook2:
    
99. cmp CRC2Reg,CRCSTART
    
100. jb Hook2End
     
101. cmp CRC2Reg,CRCEND
     
102. ja Hook2End
     
103. sub CRC2Reg,CRCSTART
     
104. add CRC2Reg,MemCopy
     
105. jmp Hook2End
     
106. 
     
107. Hook2End:
     
108. db 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
     
109. jmp Hook2Ret
     
110. 
     
111. CRC1+CRC1CHANGE:
     
112. Hook1Ret:
     
113. 
     
114. CRC2+CRC2CHANGE:
     
115. Hook2Ret:
     
116. 
     
117. /////////////////////////////////////////////////////////////////////////
     
118. DisableCRCBypass:
     
119. mov eax,[DisableCRCBypass+150]
     
120. mov bh, [DisableCRCBypass+154]
     
121. mov [CRC1],eax
     
122. mov BYTE PTR [CRC1+4],bh
     
123. 
     
124. mov eax,[DisableCRCBypass+160]
     
125. mov bh, [DisableCRCBypass+164]
     
126. mov [CRC2],eax
     
127. mov BYTE PTR [CRC2+4],bh
     
128. 
     
129. jmp terminatethread
     
130. ///////////////////////////////////////////////////////////////////////////
     
131. 
     
132. [DISABLE]
     
133. createthread(DisableCRCBypass)
     
134. dealloc(CRCHook)
     
135. dealloc(MemCopy)
     
136. dealloc(MemCopier)
     
137. unregistersymbol(MemCopy)
     
138. unregistersymbol(MemCopier)

複製代碼