在现有程序中查找并使用内存偏移量？
大多数游戏机器人应用程序使用他们为特定版本的游戏客户端找到的一系列内存偏移量来促进机器人操作。 它们可能有健康状况、x/y 位置等的内存偏移量。每次游戏发布更新时，机器人程序使用的各种信息的偏移量也必须重新找到和更新。
我有兴趣编写一个纸牌机器人作为我的宠物项目。 如果你看这里，mmoglider（一个商业机器人）已经完成了这个作为他们的机器人程序的演示（通常用于机器人魔兽世界）：MMOGlider botting Vista Solitaire 的 YouTube 视频。
准确定位各种有用的内存偏移量的常用方法是什么？ 我如何才能找到指向纸牌程序中“牌组”的内存偏移量，并使用它来确定堆栈上有哪些牌？ 我从滑翔机人员的经验中知道，一旦他们能够找到套牌本身的偏移量，他们就会说整个套牌的每张牌的值都在那里。
那么，有人有逆向工程和从现有程序中提取内存偏移的经验吗？ 一旦有了这些偏移量，如何能够从内存中的“Deck”结构中提取和读取值？
Most game botting applications use a series of memory offsets they have found for that particular version of a game client to facilitate botting. They might have a memory offset for health, x/y position, etc. Every time the game releases an update the offsets for the various pieces of information the bot program uses must be re-found and updated as well.
I'm interested in writing a Solitaire bot as a pet project. If you look here, mmoglider (a commercial bot) has already accomplished this as a demo for their botting program (which normally is used to bot WoW): YouTube video of MMOGlider botting Vista Solitaire.
What is a common method of accurately locating various useful memory offsets? How might I go about locating the memory offset that points to the "deck" in the solitaire program and use that to determine what cards are on the stack? I know from experience with the glider guys that once they were able to locate the offsets for the deck itself they said that every card value for the entire deck was there.
So, does anyone have any experience with reverse engineering and pulling memory offsets out of existing programs? And once you have those offsets how to be able to pull and read the values from that "Deck" structure in memory?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
通常有两种方法可以完成此类任务。 为了简单起见，让我们考虑一个玩家拥有整数“生命值”的游戏。
第一个是在程序运行时操作进程内存。 这对于查找已知值很有用。 当您在游戏中拥有 100 生命值时，在内存空间中搜索 100（很可能是整数）并记录找到的每个位置。 然后，当您的健康状况更改为 99 时，交叉搜索那些相同的位置，看看哪些位置发生了适当的变化。 继续下去，直到缩小健康变量的精确位置范围。 在大多数现代游戏中，您实际上会发现动态分配的内存地址，它是结构的一部分。 该结构将由程序内的指针引用，然后您必须在程序内存中搜索可能是指向健康变量附近空间的指针的值，并在多次游戏运行中重复缩小范围的过程以建立指向所需数据的指针的位置。 这是对于经典 PC 和主机游戏最有用的方法，尤其是任何内存空间较小且易于操作的游戏。
第二种方法需要您反汇编应用程序二进制文件（我使用 IDA Pro 来实现此目的），然后找到已知使用您想要的数据的函数。 例如，假设您在屏幕上看到“健康状况：99”。 在二进制文件中搜索“Health：”字符串，然后找到对该字符串的引用（您可能会找到对 sprintf 或类似函数的调用）并查看这些相同函数引用的其他内存位置，这通常会引导您找到“health”变量或包含它的结构。 这是更现代的游戏中最常见的方法，具有大量的内存空间和更高级的编程实践。
Typically there are two approaches to such tasks. For simplicity, let us consider a game with an integer amount of "health" for the player.
The first is to manipulate the process memory while the program is running. This is good for finding known values. When you have 100 health in a game, search the memory space for 100 (most likely as an integer) and record every location it is found. Then when your health changes to 99, cross-search those same locations to see which have changed appropriately. Continue until you have narrowed down the precise location(s) of the health variable. In most modern games what you will actually find is a dynamically allocated memory address that is part of a struct. That struct will be referenced by a pointer within the program, you then have to search within the program memory for values that may be a pointer to the space near the health variable, and repeat the narrowing-down process over multiple game runs to establish the position of the pointer to the data that you want. This is the method most useful for classic PC and console games, particularly any game where the memory space is small and easy to manipulate.
The second method requires you to disassemble the application binary (I use IDA Pro for this), then locate functions that are known to use the data that you want. For example, say you see "Health: 99" on the screen. Search the binary for the "Health: " string, then find references to that string (you will likely find a call to sprintf or similar) and see what other memory locations those same functions reference, this will usually lead you to the "health" variable or the struct containing it. This is the method most common in more modern games, with massive memory spaces and more advanced programming practices.