[ENABLE]//maxRush(定點瞬移) v1.3 for TWMS1.00//原作者;maxjojo 更改;APIAL//maxRush v1.3 Address:00919DFB//EIP:maxRush//maxRushCounter: 設定 N 個定點數量//maxRushOnOff : 0= 關 1= 重新抓定點 ( 設熱鍵 = 1 )//RushCounter : 目前定點位置registersymbol(maxRush)registersymbol(maxRushCounter)registersymbol(maxRushOnOff)alloc(maxRush, 1024)alloc(maxRushCounter,4)alloc(maxRushOnOff,4)label(doRushNormal)label(getEDIValue)label(getEDIValue2)label(getEDIValue3)label(doRushTele)label(doRushTeleStart)label(doRushTeleReturn)label(doRushTeleEnd)alloc(loctn,64)registersymbol(RushCounter)alloc(RushCounter,4)alloc(After_time,4)After_time: dd 0maxRushCounter: dd 4RushCounter: dd 1maxRushOnOff: // 0= 關 1= 重新抓定點 2= 續抓定點 3= 跳定點 dd 0maxRush: // 0075344B Push Eax Mov Eax,[00B0B904] // char pointer Add Eax, 0E90 Mov Eax, [Eax] Sub Eax, C // char pid Cmp Esi,Eax Pop Eax Je doRushNormal jmp 00919E01doRushNormal: call doRushTele JA 00919E01 jmp 00919DFDdoRushTele: pushfd mov eax, [00B1011C] mov eax,[eax+1dc] cmp eax,[After_time] jl doRushTeleReturn mov eax, [00B1011C] mov eax,[eax+1dc] mov [After_time],eax add [After_time],3e8 //延遲一秒 Cmp [maxRushOnOff],1 je getEDIValue Cmp [maxRushOnOff],2 je getEDIValue2 Cmp [maxRushOnOff],3 je doRushTeleStart doRushTeleReturn: popfd ret// platform id detect.getEDIValue: mov [RushCounter],1 mov eax,[esi+114] mov [loctn+4],eax cmp [maxRushCounter],1 jle getEDIValue3 mov [maxRushOnOff],2 jmp doRushTeleReturngetEDIValue2: add [RushCounter],1 mov ecx,[RushCounter] mov eax,[esi+114] mov [loctn+ecx*4],eax cmp ecx,[maxRushCounter] jge getEDIValue3 jmp doRushTeleReturngetEDIValue3: mov [maxRushOnOff],3 jmp doRushTeleReturn// start charactor teleportdoRushTeleStart: mov ecx,[RushCounter] cmp ecx,[maxRushCounter] jge doRushTeleEnd add [RushCounter],1 mov ecx,[RushCounter] mov eax,[loctn+ecx*4] mov [esi+110],eax jmp doRushTeleReturndoRushTeleEnd: mov [RushCounter],1 mov eax,[loctn+4] mov [esi+110],eax jmp doRushTeleReturn [DISABLE]dealloc(maxRush)dealloc(maxRushCounter)dealloc(maxRushOnOff)unregistersymbol(maxRush)unregistersymbol(maxRushCounter)unregistersymbol(maxRushOnOff)dealloc(loctn)unregistersymbol(RushCounter)dealloc(RushCounter) |