v75版代碼總整理

1. 說話間隔縮短 0046D411  CF[V][ ]
   
2. 完美人物 0084F65D EAX:0~3
   
3. 神偷無怪落葉斬 0049B44F ZF[V][ ]
   
4. 不空揮 0078E01C ZF[V][V]
   
5. 快速丟錢  007D06F3 EAX:a~c350
   
6. 瞬移到最左邊 007D699A CF [V][V]
   
7. 瞬移到最右邊 007D6A09 CF [V][ ]
   
8. 瞬移到最上面 007D6A9A CF [V][V]
   
9. 高跳 00788F31 ZF[V][ ]
   
10. 飛天 007D46E2 ZF[V][ ]
    
11. 超級撿物 004B84F0 ZF[V][V]
    
12. 怪物變笨 007D9C33 ZF[V][ ]
    
13. 怪物數量 009443A4    offset：10、24
    
14. 頻道資訊 009443BC    offset：2048
    
15. 地圖紅點 009443A4    offset：18
    
16. Char PID 009443AC    offset B70
    
17. 超撿 009443BC    offset：206C
    
18. 角色座標(UberVac) 009443AC  offset   X：B54   Y：B58
    
19. 左牆值 009443AC    offset：24
    
20. 上牆值 009443AC    offset：28
    
21. 右牆值 009443AC    offset：2C
    
22. 下牆值 009443AC    offset：30

複製代碼

[ 本帖最後由 娜莫莉 於 2009-2-4 16:16 編輯 ]

1. 
   
2. 
   
3. //TMS0.75全圖打怪   
   
4. // address：005BB8D9
   
5. // EIP=KiKiVac
   
6. //-------------------
   
7. [enable]
   
8. registersymbol(KiKiVac)
   
9. alloc(KiKiVac,256)
   
10. label(KiKiReturn)
    
11. KiKiVac:
    
12. mov edx,[009443ac]
    
13. lea edx,[edx+b54]
    
14. mov ecx,[edx]
    
15. mov edx,[009443ac]
    
16. lea edx,[edx+b58]
    
17. lea eax,[edx]
    
18. mov eax,[eax]
    
19. jmp KiKiReturn
    
20. KiKiReturn:
    
21. jmp 005BB8DC
    
22. [disable]
    
23. unregistersymbol(KiKiVac)
    
24. dealloc(KiKiVac)

複製代碼

1. //TWMS 0.75閃爍無敵
   
2. //ADD=00777068
   
3. //EIP=god
   
4. [ENABLE]
   
5. registersymbol(god)
   
6. alloc(god,32)
   
7. god:
   
8. mov eax,64
   
9. mov esi,0
   
10. jmp 00777075
    
11. [DISABLE]
    
12. dealloc(god)
    
13. unregistersymbol(god)

複製代碼

1. //-----------------------------------------------
   
2. // TwMS 0.75 maxYoYo DupeX  Ver 1.9  吸怪
   
3. // 7D6D0F EIP=YoYoDupe
   
4. // 更新:tomcat
   
5. // 熱鍵控制：OnOff【1=啟動 0=關閉】
   
6. //-----------------------------------------------
   
7. [ENABLE]
   
8. registersymbol(YoYoDupe)
   
9. registersymbol(OnOff)
   
10. alloc(YoYoDupe, 512)
    
11. alloc(YoyoRunFlag, 4)
    
12. alloc(ESIAddy,4)
    
13. alloc(ESIValue, 4)
    
14. alloc(EDIValue, 4)
    
15. alloc(OnOff,4)
    
16. label(NoVac)
    
17. label(DupeXVac)
    
18. label(Normal)
    
19. YoyoRunFlag:
    
20.     dd 0                // 0=定點吸怪(stay), 1=跟隨吸怪(follow)
    
21. ESIAddy:
    
22.     dd 0
    
23. ESIValue:
    
24.     dd 0
    
25. EDIValue:
    
26.     dd 0
    
27. OnOff:
    
28.     dd 0                // 1=吸怪, 0=不吸
    
29. YoYoDupe:
    
30.     PUSH EAX
    
31.     PUSH ECX
    
32.     Cmp [YoyoRunFlag], 2
    
33.     Je DupeXVac
    
34.     Mov Eax,[9443AC]        //PID   
    
35.     Mov Eax, [Eax+b70]
    
36.     Sub Eax, C
    
37.     Mov [ESIValue],Eax
    
38.     Mov Eax,[Eax+114]
    
39.     Mov [EDIValue],Eax
    
40.     Inc [YoyoRunFlag]
    
41.     Inc [YoyoRunFlag]
    
42. DupeXVac:
    
43.     Cmp Esi,[ESIValue]
    
44.     Je Normal
    
45.     Push Ecx
    
46.     Mov Ecx,ESIAddy
    
47.     Mov [Ecx],Esi
    
48.     Pop Ecx
    
49. Normal:
    
50.     Mov [Esi+110],Edi
    
51.     POP ECX
    
52.     POP EAX
    
53.     Cmp [ESIAddy], 0
    
54.     Je NoVac
    
55.     CMP [ESIValue], esi
    
56.     JE NoVac
    
57.     CMP [OnOff], 0        // 0= 不吸怪
    
58.     JE NoVac
    
59.     Push Ebx
    
60.     Mov Ebx,[EDIValue]
    
61.     mov [esi+110],ebx
    
62.     Pop Ebx
    
63. NoVac:
    
64.     Jmp 7D6D15
    
65. [DISABLE]
    
66. unregistersymbol(YoYoDupe)
    
67. unregistersymbol(OnOff)
    
68. dealloc(YoYoDupe)
    
69. dealloc(YoyoRunFlag)
    
70. dealloc(ESIAddy)
    
71. dealloc(ESIValue)
    
72. dealloc(EDIValue)
    
73. dealloc(OnOff)

複製代碼

1. [ENABLE]
   
2. //召喚獸打怪不延遲 (要有召喚獸的職業才能用哦!)
   
3. // V75 Address：006796CA
   
4. Alloc(NoDelaySummon,128)
   
5. Registersymbol(NoDelaySummon)
   
6. NoDelaySummon: //【EIP】NoDelaySummon
   
7. MOV EAX,8AFEEB
   
8. JMP 006796ED
   
9. [DISABLE]
   
10. Dealloc(NoDelaySummon)
    
11. Unregistersymbol(NoDelaySummon)
    
12. //【EIP】NoDelaySummon    aob= 7F 6F 83 BB B0 00 00 00 01 75
    
13. //  JMP  006796ED   aob= 56 8B CB E8 92 0C 00 00 EB 44

複製代碼

1. 瞬間移動
   
2. //  Address: 007D80b5
   
3. //  EIP: ServerSided
   
4. [enable]
   
5. registersymbol(ServerSided)
   
6. alloc(ServerSided,512)
   
7. registersymbol(OnOff)
   
8. alloc(OnOff,128)
   
9. label(tele1)
   
10. label(tele2)
    
11. label(tele3)
    
12. label(tele4)
    
13. label(teleR)
    
14. label(teleL)
    
15. label(teleUP)
    
16. label(teleDOWN)
    
17. label(end)
    
18. OnOff:
    
19. dd 0
    
20. ServerSided:
    
21. pushad
    
22. mov eax,[009443ac]
    
23. mov edx,[eax+b54]// 取得人物x軸位置 儲存於edx
    
24. mov ecx,[eax+b58]// 取得人物y軸位置 儲存於ecx
    
25. cmp [eax+33c],02
    
26. je tele1
    
27. cmp [eax+33c],03
    
28. je tele2
    
29. cmp [eax+33c],06
    
30. je tele3
    
31. cmp [eax+33c],07
    
32. je tele3
    
33. cmp [eax+33c],a
    
34. je tele4
    
35. cmp [eax+33c],b
    
36. je tele4
    
37. jmp end
    
38. tele1:
    
39. cmp [OnOff],0
    
40. je end
    
41. jmp teleR
    
42. tele2:
    
43. cmp [OnOff],0
    
44. je end
    
45. jmp teleL
    
46. tele3:
    
47. cmp [OnOff],0
    
48. je end
    
49. jmp teleUP
    
50. tele4:
    
51. cmp [OnOff],0
    
52. je end
    
53. jmp teleDOWN
    
54. teleR:
    
55. add edx,12c // 這是瞬移300的距離
    
56. mov [eax+159c],edx
    
57. mov [eax+15a0],ecx
    
58. mov [eax+33c],13
    
59. mov [OnOff],0
    
60. jmp end
    
61. teleL:
    
62. sub edx,12c
    
63. mov [eax+159c],edx
    
64. mov [eax+15a0],ecx
    
65. mov [eax+33c],13
    
66. mov [OnOff],0
    
67. jmp end
    
68. teleUP:
    
69. sub ecx,12c
    
70. mov [eax+159c],edx
    
71. mov [eax+15a0],ecx
    
72. mov [eax+33c],13
    
73. mov [OnOff],0
    
74. jmp end
    
75. teleDOWN:
    
76. add ecx,c8
    
77. mov [eax+159c],edx
    
78. mov [eax+15a0],ecx
    
79. mov [eax+33c],13
    
80. mov [OnOff],0
    
81. jmp end
    
82. end:
    
83. popad
    
84. mov [ebx],eax
    
85. mov edi,[ebp+10]
    
86. jmp 007D80ba
    
87. [disable]
    
88. unregistersymbol(ServerSided)
    
89. dealloc(ServerSided)
    
90. unregistersymbol(OnOff)
    
91. dealloc(OnOff)

複製代碼

1. 疾風N合一
   
2. 複製內容到剪貼板代碼:
   
3. [enable]
   
4. //疾風N合一 for TWMS075
   
5. //原作：jajaja, 感謝99,A,D,L,N,W,W(縮寫)
   
6. //原出處：疾風之莊
   
7. //功能：走,跳怪方向【左趴往左,右趴往右,坐下停止控制】、笨怪、10秒損血一次、
   
8. //紅點暫停、跳怪不跳、致命的吸引力【定點及跟隨角色二種模式，啟動方式提示：5秒】
   
9. //Address：00413268
   
10. //EIP：MyLR
    
11. //=================================================
    
12. alloc(MyLR,1024)
    
13. registersymbol(MyLR)
    
14. alloc(MyDir,4)
    
15. alloc(MyCt,4)
    
16. alloc(MyPt1,4)
    
17. label(MyLR1)
    
18. label(GoLR)
    
19. label(GoLR1)
    
20. label(GoLR2)
    
21. label(GoLR3)
    
22. label(GoLR4)
    
23. label(GoLR5)
    
24. label(GoLRback)
    
25. label(JmpLR)
    
26. label(JmpLR1)
    
27. label(JmpLR2)
    
28. label(JmpLRback)
    
29. label(MyStupid)
    
30. label(MyNoBack)
    
31. label(MyState)
    
32. label(MyCharX)
    
33. label(MyNoJmp)
    
34. label(LRDir1)
    
35. label(LRDir2)
    
36. label(LRDir3)
    
37. label(LRDir4)
    
38. label(LRDir5)
    
39. label(LRDir6)
    
40. MyDir:
    
41. DD 1
    
42. MyLR:
    
43. push eax
    
44. cmp [009443A4],00000000                  
    
45. je MyLR1
    
46. mov eax,[009443A4]
    
47. mov eax,[eax+18]
    
48. cmp eax,0
    
49. jne MyLR1
    
50. pop eax
    
51. cmp dword ptr [esp], 007DAAF7
    
52. je GoLR
    
53. cmp dword ptr [esp],  007DAF0B
    
54. je JmpLR
    
55. cmp dword ptr [esp], 007D9C04
    
56. je MyStupid
    
57. cmp dword ptr [esp], 0079419F
    
58. jz MyNoBack
    
59. cmp dword ptr [esp], 007DAEC3
    
60. jz MyNoJmp
    
61. ret
    
62. MyLR1:
    
63. pop eax
    
64. ret
    
65. //================================
    
66. GoLR:
    
67. add esp,4
    
68. call MyState
    
69. push 03
    
70. pop ecx
    
71. mov [edi+20],eax
    
72. xor edx,edx
    
73. div ecx
    
74. cmp [MyDir], 1
    
75. je GoLRback
    
76. cmp [MyDir], 3
    
77. je GoLR1
    
78. cmp [MyDir], 4
    
79. je GoLR3
    
80. cmp edx, [MyDir]
    
81. je GoLRback
    
82. mov [esi+00000468],0
    
83. jmp GoLRback
    
84. GoLR1:
    
85. push eax
    
86. call MyCharX
    
87. jmp GoLR4
    
88. GoLR3:
    
89. push eax
    
90. mov eax,[MyPt1]
    
91. GoLR4:
    
92. cmp edx, 1
    
93. je GoLR5         
    
94. jg GoLR2
    
95. cmp eax,[esi+1c4]
    
96. pop eax
    
97. mov [esi+00000468],5
    
98. jl GoLRback
    
99. mov [esi+00000468],0
    
100. jmp GoLRback
     
101. GoLR2:
     
102. cmp eax,[esi+1c4]
     
103. pop eax
     
104. mov [esi+00000468],5
     
105. jg GoLRback
     
106. mov [esi+00000468],0
     
107. jmp GoLRback
     
108. GoLR5:
     
109. pop eax
     
110. mov [esi+00000468],0
     
111. GoLRback:
     
112. jmp 7DAB01
     
113. //================================
     
114. JmpLR:
     
115. add esp,4
     
116. call MyState
     
117. cmp [MyDir], 1
     
118. je JmpLRback
     
119. cmp [MyDir], 2
     
120. mov eax,2
     
121. je JmpLRback
     
122. cmp [MyDir], 0
     
123. mov eax,3
     
124. je JmpLRback
     
125. cmp [MyDir], 4
     
126. je JmpLR1
     
127. call MyCharX
     
128. jmp JmpLR2
     
129. JmpLR1:
     
130. mov eax,[MyPt1]
     
131. JmpLR2:
     
132. cmp eax,[esi+1bc]
     
133. mov eax,2
     
134. mov [esi+00000468],5
     
135. jg JmpLRback
     
136. mov eax,3
     
137. JmpLRback:
     
138. push 03
     
139. jmp  007DAF0D
     
140. //================================
     
141. MyCharX:
     
142. mov eax [009443AC]
     
143. mov eax, [eax+b5c]
     
144. ret
     
145. //================================
     
146. MyState:
     
147. push eax
     
148. mov eax, [009443AC]
     
149. mov eax, [eax+33c]
     
150. cmp eax, a
     
151. je LRDir1
     
152. cmp eax, b
     
153. je LRDir2
     
154. cmp eax, 14
     
155. je LRDir3
     
156. cmp eax, 15
     
157. je LRDir3
     
158. mov [MyCt], 0
     
159. jmp LRDir4
     
160. LRDir1:
     
161. mov [MyDir],2
     
162. cmp [MyCt], 32
     
163. ja LRDir5
     
164. inc [MyCt]
     
165. jmp LRDir4
     
166. LRDir2:
     
167. mov [MyDir],0
     
168. cmp [MyCt], 32
     
169. ja LRDir6
     
170. inc [MyCt]
     
171. jmp LRDir4
     
172. LRDir3:
     
173. mov [MyDir],1
     
174. jmp LRDir4
     
175. LRDir5:
     
176. mov [MyDir],3
     
177. jmp LRDir4
     
178. LRDir6:
     
179. mov [MyDir],4
     
180. call MyCharX
     
181. mov [MyPt1],eax
     
182. LRDir4:
     
183. pop eax
     
184. ret
     
185. //============================
     
186. MyStupid:
     
187. add esp, 4
     
188. xor edx,edx
     
189. mov ecx,0000ea60
     
190. div ecx
     
191. lea eax,[esi+00000230]
     
192. add edx,0002bf20
     
193. mov [esi+00000238],edx
     
194. mov edx,[esp+10]
     
195. cmp [eax],edx
     
196. je 007d9c4f
     
197. cmp [esi+00000234],edi   
     
198. lea ecx,[esi+00000234]
     
199. je 007d9c4f
     
200. jmp 7D9C35
     
201. //============================
     
202. MyNoBack:
     
203. add esp,4
     
204. mov eax, [ebp-10]
     
205. push FFFFD8F0 //原始值=FFFFFA24，修改此處可更改無敵秒數
     
206. jmp 007947E5[Enable]
     
207. //CSeax X 數據系列整互版 for TWMS075
     
208. //原作者：kenny0883
     
209. //Address：007D80B5
     
210. //EIP：cseax
     
211. //熱鍵控制：mode【0=關閉、1=滑鼠趕路，2=攻不停、其他數值=遠攻不揮拳套/弓】
     
212. registersymbol(cseax)
     
213. alloc(cseax,64)
     
214. alloc(MouserX,512)
     
215. alloc(MouserY,512)
     
216. label(normalx)
     
217. label(normaly)
     
218. label(back)
     
219. label(return)
     
220. alloc(CSX,512)
     
221. registersymbol(mode)
     
222. alloc(mode,4)
     
223. label(CSXReturn)
     
224. label(bigger)
     
225. label(kenny100)
     
226. mode:
     
227. dd 0  //0=關閉、1=滑鼠趕路，2=攻不停、其他數值=遠攻不揮拳套/弓
     
228. cseax:
     
229. cmp [mode],0
     
230. je normalx
     
231. cmp [mode],1
     
232. je MouserX
     
233. jmp CSX
     
234. back:
     
235. jmp 007D80BA
     
236. return:
     
237. jmp 007D811F
     
238. MouserX:
     
239.     push eax
     
240.     mov eax,[009443ac]
     
241.     mov eax,[eax+b70]
     
242.     cmp esi,eax
     
243.     pop eax
     
244.     jne normalx  
     
245.     mov eax, [00944500]
     
246.     mov eax, [eax+978]
     
247.     mov eax, [eax+84]
     
248.     mov [ebx], eax
     
249.     mov edi,[ebp+10]
     
250.     test    edi, edi
     
251.     jne     MouserY
     
252.     jmp     007D811C
     
253.     normalx:
     
254.     mov [ebx], eax
     
255.     mov edi,[ebp+10]
     
256.     jmp back  
     
257. MouserY:
     
258.     push eax
     
259.     mov eax,[009443ac]
     
260.     mov eax,[eax+b70]
     
261.     cmp esi,eax
     
262.     pop eax
     
263.     jne normaly
     
264.     mov eax, [00944500]
     
265.     mov eax, [eax+978]
     
266.     mov eax, [eax+88]
     
267.     mov [edi], eax
     
268.     mov ebx,[ebp+14]
     
269.     jmp return
     
270.    
     
271. normaly:
     
272. mov [edi], eax
     
273. mov ebx,[ebp+14]
     
274. jmp return
     
275. CSX:
     
276. push eax
     
277. mov eax,[009443ac]
     
278. mov eax,[eax+1b88]
     
279. cmp eax,60
     
280. pop eax
     
281. jg kenny100
     
282. cmp [mode],2
     
283. je CSXReturn
     
284. push eax
     
285. mov eax,[009443ac]
     
286. mov eax,[eax+b70]
     
287. cmp esi,eax
     
288. pop eax
     
289. je CSXReturn
     
290. push edx
     
291. mov edx,[009443ac]
     
292. mov edx,[edx+b5c]
     
293. cmp eax,edx
     
294. pop edx
     
295. jge bigger
     
296. push edx
     
297. mov edx,[009443ac]
     
298. mov edx,[edx+b5c]
     
299. sub edx,6a         //遠攻距離
     
300. cmp edx,eax
     
301. pop edx
     
302. jg CSXReturn
     
303. mov eax,[009443ac]
     
304. mov eax,[eax+b5c]
     
305. sub eax,6a          //遠攻距離
     
306. CSXReturn:
     
307. mov [ebx], eax
     
308. jmp 007D80B7
     
309. bigger:
     
310. push edx
     
311. mov edx,[009443ac]
     
312. mov edx,[edx+b5c]
     
313. add edx,6a
     
314. cmp eax,edx
     
315. pop edx
     
316. jg CSXReturn
     
317. mov eax,[009443ac]
     
318. mov eax,[eax+b5c]
     
319. add eax,6a            //遠攻距離
     
320. jmp CSXReturn
     
321. kenny100:
     
322. push eax
     
323. mov eax,[009443ac]
     
324. mov eax,[eax+b5c]
     
325. cmp esi,eax
     
326. pop eax
     
327. jne CSXReturn
     
328. add eax,8    //位移
     
329. jmp CSXReturn
     
330. [Disable]
     
331. unregistersymbol(cseax)
     
332. dealloc(cseax)
     
333. dealloc(MouserX)
     
334. dealloc(MouserY)
     
335. dealloc(CSX)
     
336. unregistersymbol(mode)
     
337. dealloc(mode)
     
338. CRC Bypass 相信有些人會用到
     
339. 複製內容到剪貼板代碼:
     
340. [Enable]
     
341. //CRC Bypass for TWMS075
     
342. //Address：0047B5E0
     
343. //EIP：newmem
     
344. registersymbol(blaaaa)
     
345. registersymbol(newmem)
     
346. alloc(newmem,2048)
     
347. alloc(blaaaa,5242880) //CEM檔的位元組大小
     
348. label(originalcode)
     
349. loadbinary(blaaaa,TWMS075.CEM) //CEM檔檔名(需加副檔名)
     
350. newmem:
     
351. cmp ecx,00400000 //from 起始位址
     
352. jb originalcode
     
353. cmp ecx,00900000 //to 結束位址
     
354. ja originalcode
     
355. mov eax,blaaaa
     
356. sub eax,00900000 //to 起始位址
     
357. add ecx, eax
     
358. originalcode:
     
359. mov eax,[ebp+10]
     
360. push esi
     
361. push edi
     
362. jmp 0047B5E5
     
363. [Disable]
     
364. dealloc(newmem)
     
365. dealloc(blaaaa)
     
366. unregistersymbol(blaaaa)
     
367. unregistersymbol(newmem)

複製代碼

1. //物品掉落腳下V75
   
2. //更新haroming
   
3. //代碼 007D80B5
   
4. // EIP=UberX
   
5. [ENABLE]
   
6. alloc(UberX,64)
   
7. alloc(UberY,64)
   
8. registersymbol(UberX)
   
9. registersymbol(UberY)
   
10. label(CharX)
    
11. label(CharY)
    
12. UberX:
    
13. push eax
    
14. mov eax, [9443AC]
    
15. lea eax, [eax+B54]
    
16. cmp ebx, eax
    
17. je CharX
    
18. mov eax, [eax]
    
19. add eax,0 //這邊可以修改!!如果是近戰請打20然後跑到地圖的最右邊!!這樣才能全部物品都撿到喔   遠戰系我就不知道了@@
    
20. mov [ebx], eax
    
21. pop eax
    
22. mov edi, [ebp+10]
    
23. jne UberY
    
24. jmp 007D80BA
    
25. CharX:
    
26. pop eax
    
27. mov [ebx], eax
    
28. mov edi, [ebp+10]
    
29. jmp 007D80BA
    
30. UberY:
    
31. push eax
    
32. mov eax, [9443AC]  
    
33. lea eax, [eax+B58]
    
34. cmp edi, eax
    
35. je CharY
    
36. mov eax, [eax]
    
37. mov [edi], eax
    
38. pop eax
    
39. mov ebx,[ebp+14]
    
40. jmp 007D811F
    
41. CharY:
    
42. pop eax
    
43. mov [edi], eax
    
44. mov ebx,[ebp+14]
    
45. jmp 007D811F
    
46. [disable]
    
47. dealloc(UberX)
    
48. dealloc(UberY)
    
49. unregistersymbol(UberX)
    
50. unregistersymbol(UberY)

複製代碼

1. 然後配合攻擊不停     9443Ac Offset：1B88
   
2. 跟快速檢物4B84F0   ZF[V][V](如果想用別的代碼可以不用這個喔~反正一樣可以慢慢撿!!)
   
3. 在配合無敵(有自動回覆的喔不然會被鎖^O^代碼區都有)
   
4. 我在此也提供一個吧

複製代碼

1. 
   
2. // =======================================================
   
3. //
   
4. // 超級停止呼吸_不後退_隱形無敵_搭配時間恢復隱形_TWMS_0.75
   
5. //
   
6. // 原創：99783981
   
7. // 日期：2008-05-15
   
8. // 更新:  uio7963
   
9. // Address ：00413158  //55 8B EC 8B 45 08 53 8B 58 04 56 8B 30 57 6A 05
   
10. // EIP     ：SuperAsphyxiation
    
11. //
    
12. // 隱形時間：StealthTime
    
13. // 隱形取消：Removal
    
14. //
    
15. // 功能：超級停止呼吸-不後退-隱形無敵-搭配時間恢復隱形
    
16. //       終於拆開連續撞擊，前次的數據，好像有點畫蛇添足
    
17. //
    
18. //       偷轉到別論壇的，會拉肚子五年，轉發刪除原創著也是，哈哈
    
19. //
    
20. // =======================================================
    
21. [Enable]
    
22. registersymbol(SuperAsphyxiation)
    
23. registersymbol(StealthTime)
    
24. registersymbol(Removal)
    
25. alloc(SuperAsphyxiation, 512)
    
26. alloc(StealthTime, 4)
    
27. alloc(Removal, 4)
    
28. label(Stop)
    
29. label(Asphyxiation)
    
30. label(StopBreathe)
    
31. label(StealthCancels)
    
32. StealthTime:
    
33. db 99783981 //請別改它，這是我的註冊商標，亂動算你倒楣
    
34. db 95       //隱形時間，記得從這裡做調整
    
35.             //這是  5進位的， 5是 1個單位，每個單位為 2秒
    
36.             //設定  5為 1個單位，相當於 2秒
    
37.             //設定 10為 2個單位，相當於 4秒
    
38.             //設定 15為 3個單位，相當於 6秒
    
39. Removal:
    
40. dd 1        //若要取消隱形時間，請輸入【0】即可
    
41. SuperAsphyxiation:
    
42. cmp [esp], 00794259 //請別改它，亂動算你倒楣
    
43. je Asphyxiation
    
44. Stop:
    
45. push ebp
    
46. jmp 00413159
    
47. Asphyxiation:
    
48. mov [esp], StopBreathe
    
49. jmp Stop
    
50. StopBreathe:
    
51. cmp eax, eax
    
52. pop ecx
    
53. pop ecx
    
54. cmp [Removal],0
    
55. je StealthCancels
    
56. mov eax, [ebp-10]
    
57. push [StealthTime]
    
58. jmp 007947E5
    
59. StealthCancels:
    
60. mov eax, [ebp-10]
    
61. push fffffa24
    
62. jmp 007947E5
    
63. [Disable]
    
64. unregistersymbol(SuperAsphyxiation)
    
65. unregistersymbol(StealthTime)
    
66. unregistersymbol(Removal)
    
67. dealloc(SuperAsphyxiation)
    
68. dealloc(StealthTime)
    
69. dealloc(Removal)

複製代碼

1. [ENABLE]
   
2. 94A06C://穩如泰山
   
3. db BC 5F BA E4 FE D2 25 C7 7B 90 16 52
   
4. [DISABLE]
   
5. 94A06C://穩如泰山
   
6. db DD 69 2E 64 4E 73 21 EB 1C 90 15 72
   
7. [ENABLE]
   
8. 94A0C0://攻擊力OR龍魂 (cs端)
   
9. db 47 33 79 AE 0A FB 76 C5 24 A1 1D 16
   
10. [DISABLE]
    
11. 94A0C0://攻擊力OR龍魂 (cs端)
    
12. db EA B3 5A CD 9F D5 6A 56 BE 8F 2A 92 0A 5A F9 F7 D0 CA BF 57 20 70 2A 92 66 7C 83 9F E3 1B FC 34 46 90 25 8E
    
13. [ENABLE]
    
14. 94A0F0://物防
    
15. db 47 33 79 AE 0A FB 76 C5 24 A1 1D 16
    
16. [DISABLE]
    
17. 94A0F0://物防
    
18. db 91 64 F0 F2 24 83 97 8F C8 6F DA 71 84 15 FA A3 AC D0 1F 25 D8 8F EA 6D 16 4D AF 24 68 7A 25 B1 50 90 15 8E
    
19. [ENABLE]
    
20. 94A120://魔攻OR精神強化 (cs端)
    
21. db 47 33 79 AE 0A FB 76 C5 24 A1 1D 16
    
22. [DISABLE]
    
23. 94A120://魔攻OR精神強化 (cs端)
    
24. db 60 4F C0 02 7B 02 16 00 76 70 D9 6D B1 4F 50 73 7D 82 9A 8B 7A 70 EA 71 9B 8D B5 66 6C AC 35 DB 58 70 16 92
    
25. [ENABLE]
    
26. 94A150://魔防 (cs端)
    
27. db 47 33 79 AE 0A FB 76 C5 24 A1 1D 16
    
28. [DISABLE]
    
29. 94A150://魔防 (cs端)
    
30. db 99 98 BB 9B C4 DC DD CC 08 90 E6 6D 42 5E 66 69 F2 32 4B 13 64 90 E9 91 61 6F 3F 6F 7B FB 79 0B 76 90 26 72
    
31. [ENABLE]
    
32. 94A180://命中 (cs端)
    
33. db 47 33 79 AE 0A FB 76 C5 24 A1 1D 16
    
34. [DISABLE]
    
35. 94A180://命中 (cs端)
    
36. db 52 A7 20 10 3A 05 81 90 F4 6F D5 8D 32 D2 71 F0 91 8E 83 97 A2 6F DA 91 72 18 5A 28 C3 D0 42 91 06 90 DA 8D
    
37. [ENABLE]
    
38. 94A1B0://迴避
    
39. db 47 33 79 AE 0A FB 76 C5 24 A1 1D 16
    
40. [DISABLE]
    
41. 94A1B0://迴避
    
42. db E5 39 7A A9 CF D1 4B 2D 1E 90 EA 6D 14 F4 2F A5 A0 7F 29 A5 C0 8F 25 6E E7 B1 E2 1D 8F 15 EF 38 9E 8F 29 8E
    
43. [ENABLE]
    
44. 94A1E0://靈敏度
    
45. db 47 33 79 AE 0A FB 76 C5 24 A1 1D 16
    
46. [DISABLE]
    
47. 94A1E0://靈敏度
    
48. db 65 E5 74 A5 2B A7 2B A7 2B 2D D6 6F 2A 6E A7 58 F9 95 C5 CA AF 3C 0A 70 2A 8E 0B 59 75 E1 C8 AA 0B 5F 10 70 EA 91
    
49. [ENABLE]
    
50. 94A210://速度激發 速140 跳120
    
51. db 46 28 1B 82 43 D9 10 74 05 90 D6 CD 02 1B DF F9 44 0C CF 77 9C A3 EA F1 D1 E8 2F 8B 33 F2 55 8C F9 02 E2 6D 79 DA 32 4C D0 96 61 EA 23 90 16 92 76 AF E7 C2 7B 3D 17 16 76 90 D9 F1 85 63 FB 27 80 2F 3E 49 1C E4 28 8E 8C 6D D0 2E 19 0E 7A 61 05 FB 1D 6E
    
52. [DISABLE]
    
53. 94A210://速度激發 速140 跳120
    
54. db D8 67 37 3B 3E BB D9 C1 FC 8F E6 6D FF 8E DF 9F 77 FC FE FC 6E 90 2A 8E 60 DE 20 09 F3 06 49 00 66 70 E5 6D
    
55. [ENABLE]
    
56. 94A210://速度
    
57. db 3A B1 D6 D4 88 B5 A6 96 91 8F 1A 52 97 90 76 9B 18 40 DA DC 1C 1B E9 AD 9D 8D CB 13 65 22 92 70 51 56 DD F5
    
58. [DISABLE]
    
59. 94A210://速度
    
60. db 72 E9 86 7F 4B 37 FC 93 16 90 25 92 18 58 AB CD C0 5A 6D C6 00 90 25 72 70 67 FC 5B 3B E3 DF 82 F6 6F EA 71
    
61. [ENABLE]
    
62. 94A240://跳躍
    
63. db 76 AF E7 C2 7B 3D 17 16 76 90 D9 F1 85 63 FB 27 80 2F 3E 49 1C E4 28 8E 8C 6D D0 2E 19 0E 7A 61 05 FB 1D 6E
    
64. [DISABLE]
    
65. 94A240://跳躍
    
66. db 0A 24 82 84 20 11 24 54 C0 8F 15 8E 8E BD CE 88 EC 75 46 74 58 90 D9 8D D6 5F B3 F4 FE 9A A5 B7 7C 90 16 92
    
67. [ENABLE]
    
68. 94A288://隱身術
    
69. db AC 32 56 D2 95 B1 92 6E AA 8F DA 79
    
70. [DISABLE]
    
71. 94A288://隱身術
    
72. db A3 EE 7E 74 75 F7 A3 1B 6A 90 1A 92
    
73. [ENABLE]
    
74. 94A2B5://快速攻擊
    
75. db 00 00 00 D3 4B 5A B1 A1 2D 75 6A 7F EB D4 5A 78 5A E8 E9 59 38 4E 97 AC 65 E8 41 BC 00 AB B8 51 79 C9 E5 D6
    
76. [DISABLE]
    
77. 94A2B5://快速攻擊
    
78. db 00 00 00 86 66 61 25 34 0B 2B 31 E8 6F 29 8E 78 01 FE E8 0B F0 47 C7 96 8F DA 71 A1 89 F3 6D 4D 9C 6F 0B 1A
    
79. [ENABLE]
    
80. 94A2DC://傷害反彈也就是反頓
    
81. db 47 33 79 ae 0a fb 76 c5 24 a1 1d 16
    
82. [DISABLE]
    
83. 94A2DC://傷害反彈也就是反頓
    
84. db AC 92 D3 19 95 9C CE 60 AA 8F EA 6D
    
85. [ENABLE]
    
86. 94A36C://無形箭
    
87. db DB BD F1 2B C2 8D 5F C9 30 70 EA 7D
    
88. [DISABLE]
    
89. 94A36C://無形箭
    
90. db F4 BB D4 3F DF A5 FE A1 3E 70 2A 6E
    
91. [ENABLE]
    
92. 94A420://鬥氣集中
    
93. db 1D A8 47 2D 40 3D 6A D9 00 90 29 5E C4 A1 43 B7 90 9A
    
94. [DISABLE]
    
95. 94A420://鬥氣集中
    
96. db AB 26 E7 98 35 39 C7 5C EA 8F D9 8D 3C 62 35 91 11 AB
    
97. [ENABLE]
    
98. 94A420://進階鬥氣
    
99. db 47 33 79 AE 0A FB 76 C5 24 A1 1D 16 90 22 AC 37 14 61
    
100. [DISABLE]
     
101. 94A420://進階鬥氣
     
102. db AB 26 E7 98 35 39 C7 5C EA 8F D9 8D 3C 62 35 91 11 AB
     
103. [ENABLE]
     
104. 94A4DD://影分身
     
105. db 70 16 92 7E 8D 3B 77 69 DC B9 73 54 90 26 12 B8 DD B2 2B 39 63 5C 11 A6 5C E5 BD 20 25 D8 95 1A B2 A9 94 C3 60 25 FE
     
106. [DISABLE]
     
107. 94A4DD://影分身
     
108. db 70 16 92 FC 2C 90 B1 67 81 8C E5 4E 70 E6 6D FA 9C 31 9F E7 8C F9 D4 4E 70 26 8E 20 25 D8 95 1A B2 A9 94 C3 60 25 FE
     
109. [ENABLE]
     
110. 94A648://楓葉祝福
     
111. db 3c 8f 2c 60 79 64 01 cb 72 70 d5 59 3d 7b 5d 0b 22 97 5b a8 7b
     
112. [DISABLE]
     
113. 94A648://楓葉祝福
     
114. db b1 70 8d f3 85 6b 9c 8f 8a 6f e5 71 9b b8 96 59 c4 b5 cc da 08
     
115. [ENABLE]
     
116. 94A705://無限日鏢
     
117. db 6F 15 72 A2 80 DA 4E 05 D4 76 2A 8A 8F 1A AA 6E
     
118. [DISABLE]
     
119. 94A705://無限日鏢
     
120. db 6F 15 72 B6 DE 4A 58 F5 56 C2 B2 6A 90 D9 91 EC

複製代碼

1. 
   
2. 
   
3. // 召喚獸打怪不延遲 for TwMS v0.75
   
4. //--------------------------------------------------
   
5. // 原創：maxjojo
   
6. // 功能：NoDelaySummon(召喚獸打怪不延遲)
   
7. // 修改：kuruotonix
   
8. // 更新：
   
9. // 日期：2008/07/07
   
10. // Address：006796CA→EIP：max
    
11. //--------------------------------------------------
    
12. [ENABLE]
    
13. registersymbol(max)
    
14. alloc(max,32)
    
15. label(CushionTime)
    
16. max:
    
17. cmp dword ptr [ebx+000000b0],01
    
18. jne 006796f7
    
19. push [ebx+000000a0]
    
20. call CushionTime
    
21. pop ecx
    
22. mov ecx,esi
    
23. sub ecx,[ebx+000000fc]
    
24. cmp ecx,eax
    
25. jmp 006796ED
    
26. CushionTime:
    
27. cmp eax, eax // 緩衝時間 00000000 = 0000 = 0 秒
    
28. mov eax, 000005DC //←緩衝時間 000005DC = 1500 = 1.5秒
    
29. jmp 00653CDA // 緩衝時間 00000BB8 = 3000 = 3 秒
    
30. [DISABLE]
    
31. unregistersymbol(max)
    
32. dealloc(max,32)[ENABLE]
    
33. //物品過濾 for TWMS075
    
34. //Address：004C30A2
    
35. //EIP：ItemFilter
    
36. //物品位址EIP：ItemCounter
    
37. alloc(ItemFilter,124)
    
38. alloc(IFTable,16024)
    
39. alloc(ItemCounter,4)
    
40. label(ifreject)
    
41. label(end)
    
42. label(skip)
    
43. registersymbol(ItemFilter)
    
44. registersymbol(ItemCounter)
    
45. ItemFilter:
    
46. mov [ItemCounter],eax
    
47. push ebx
    
48. push esi
    
49. xor ebx, ebx
    
50. mov esi,IFTable
    
51. ifreject:
    
52. cmp eax,[esi]
    
53. je skip
    
54. cmp [esi],ebx
    
55. je end
    
56. add esi,4
    
57. jmp ifreject
    
58. skip:
    
59. mov eax,00
    
60. end:
    
61. pop esi
    
62. pop ebx
    
63. mov [edi+34],eax
    
64. jmp 004C30A5
    
65. IFTable:
    
66. dd 3D7E3C //怪物卡
    
67. dd 1F6EE0 //Arrow for Bow 箭矢
    
68. dd 1F6EE3 //Arrow for Bow 箭矢
    
69. dd 1F6EE1 //Bronze Arrow for Bow 箭矢
    
70. dd 1F72C8 //Arrow for Crossbow 箭矢
    
71. dd 1F72CB //Arrow for Crossbow 箭矢
    
72. dd 1F72C9 //Bronze Arrow for Crossbow 箭矢
    
73. dd 00
    
74. [DISABLE]
    
75. dealloc(ItemFilter)
    
76. unregistersymbol(ItemFilter)
    
77. dealloc(IFTable)
    
78. dealloc(ItemCounter)
    
79. unregistersymbol(ItemCounter)
    
80. maxRush(定點瞬移) v1.3
    
81. 複製內容到剪貼板代碼:
    
82. [ENABLE]
    
83. //maxRush(定點瞬移) v1.3 for TWMS075
    
84. //原作者；maxjojo
    
85. //maxRush v1.3 Address：007D46C1
    
86. //EIP：maxRush
    
87. //啟動判斷 EIP：maxRushOnOff【0=抓PID 1=啟動】
    
88. //PID編號偵測 EIP：maxRushCounter
    
89. //PID位址偵測 EIP：EDIValue【 16進位】
    
90. //循環判斷 EIP：isLoopMaxRush 【1=循環 0=執行一次】
    
91. registersymbol(maxRush)
    
92. registersymbol(maxRushCounter)
    
93. registersymbol(maxRushOnOff)
    
94. registersymbol(EDIValue)
    
95. registersymbol(isLoopMaxRush)
    
96. alloc(maxRush, 512)
    
97. alloc(maxRushCounter,4)
    
98. alloc(maxRushOnOff,4)
    
99. alloc(EDIValue,4)
    
100. alloc(PlatformIDList,1024)
     
101. alloc(isLoopMaxRush,4)
     
102. label(doRushNormal)
     
103. label(getEDIValue)
     
104. label(doRushTele)
     
105. label(doRushTeleStart)
     
106. label(doRushTeleEnd)
     
107. label(doRushTeleReturn)
     
108. label(doRushResetCounterEnd)
     
109. maxRushCounter:
     
110.     dd 0
     
111. maxRushOnOff:
     
112.     dd 0
     
113.     // {1: On, (char teleport, 定點瞬移) |
     
114.     //  0: Off (platform id detect,平台ID檢測) }
     
115. EDIValue:
     
116.     dd 0                    // platform id (平台ID)
     
117. isLoopMaxRush:
     
118.     dd 1                    // {1: loop (循環) | 0: just one time(只需跑1次)}
     
119. maxRush:                    // 0075344B
     
120.     Push Eax
     
121.     Mov Eax,[009443AC]      // char pointer
     
122.     Add Eax, b70
     
123.     Mov Eax, [Eax]
     
124.     Sub Eax, C              // char pid
     
125.     Cmp Esi,Eax
     
126.     Pop Eax
     
127.     Je doRushNormal
     
128.     jmp 007d46c7
     
129. doRushNormal:
     
130.     call doRushTele
     
131.     JA 007d46c7
     
132.     jmp 007D46C3
     
133. doRushTele:
     
134.     pushfd
     
135.     Cmp [maxRushOnOff],0
     
136.     je getEDIValue
     
137.     call doRushTeleStart
     
138. doRushTeleReturn:
     
139.     popfd
     
140.     ret
     
141. // platform id detect.
     
142. getEDIValue:
     
143.     push eax
     
144.     mov eax,[esi+114]
     
145.     mov [EDIValue],eax
     
146.     pop eax
     
147.     add [maxRushCounter],1
     
148.     jmp doRushTeleReturn
     
149. // start charactor teleport
     
150. doRushTeleStart:
     
151.     push ebx
     
152.     push eax
     
153.     mov ebx,[maxRushCounter]
     
154.     add [maxRushCounter],1
     
155.     mov eax,[PlatformIDList+ebx*4]
     
156.     cmp eax, 0                  // is end of platform id list (比對結束了嗎)?
     
157.     je doRushTeleEnd            // end of rush teleport.
     
158.     mov [esi+110],eax
     
159.     jmp doRushResetCounterEnd
     
160. doRushTeleEnd:
     
161.     cmp [isLoopMaxRush],0
     
162.     je doRushResetCounterEnd
     
163.     mov [maxRushCounter],0      // reset counter (歸零重來)
     
164.     pop eax
     
165.     pop ebx
     
166.     jmp doRushTeleStart
     
167. doRushResetCounterEnd:
     
168.     pop eax
     
169.     pop ebx
     
170.     ret
     
171. PlatformIDList:
     
172.     dd 25876CF8   // spot #1 (平台1號)
     
173.     dd 258B9104   // spot #2 (平台2號)
     
174.     dd 1ED44380   // spot #3 (平台3號)
     
175.     dd 33F7CA20   // spot #4 (平台4號)
     
176.     dd 33F20988   // spot #5 (平台5號)
     
177.     dd 0            // spot #End (最後一筆要填入0)
     
178. [DISABLE]
     
179. dealloc(maxRush)
     
180. dealloc(maxRushCounter)
     
181. dealloc(maxRushOnOff)
     
182. dealloc(EDIValue)
     
183. dealloc(PlatformIDList)
     
184. dealloc(isLoopMaxRush)
     
185. unregistersymbol(maxRush)
     
186. unregistersymbol(maxRushCounter)
     
187. unregistersymbol(maxRushOnOff)
     
188. unregistersymbol(EDIValue)
     
189. unregistersymbol(isLoopMaxRush)[enable]
     
190. //寵物吸物 For Tms 0.75
     
191. //原作者：Smallro
     
192. //Address：004C20B0
     
193. //EIP：PetGetItem
     
194. registersymbol(PetGetItem)
     
195. alloc(PetGetItem,256)
     
196. registersymbol(PetGetItemSwitch)
     
197. alloc(PetGetItemSwitch,4)
     
198. label(NormalPet)
     
199. PetGetItemSwitch:
     
200. dd 1   // 開關【0=關,1=開】
     
201. PetGetItem:
     
202. cmp [PetGetItemSwitch],0
     
203. je NormalPet
     
204. push ebx
     
205. mov ebx,[ebp+0c]
     
206. mov [ebx],esi
     
207. mov [ebx+04],eax
     
208. pop ebx
     
209. jmp 004C20C7
     
210. NormalPet:
     
211. lea eax,[ebp-34]
     
212. push eax
     
213. call dword ptr [00947274]
     
214. jmp 004C20BA
     
215. [disable]
     
216. unregistersymbol(PetGetItem)
     
217. dealloc(PetGetItem)
     
218. unregistersymbol(PetGetItemSwitch)
     
219. dealloc(PetGetItemSwitch)
     
220. ItemVac

複製代碼

1. //-------------------------------
   
2. // forTMS0.75全圖打怪   
   
3. // address：005BB8D9
   
4. // EIP=KiKiVac
   
5. // 備註:不要直接打 很容易鎖
   
6. // 更新:0988422386(楓"簡")
   
7. // 更新:2008/06/28
   
8. // 來源: 未知
   
9. //-------------------
   
10. [enable]
    
11. registersymbol(KiKiVac)
    
12. alloc(KiKiVac,256)
    
13. label(KiKiReturn)
    
14. KiKiVac:
    
15. mov edx,[009443ac]
    
16. lea edx,[edx+b54]
    
17. mov ecx,[edx]
    
18. mov edx,[009443ac]
    
19. lea edx,[edx+b58]
    
20. lea eax,[edx]
    
21. mov eax,[eax]
    
22. jmp KiKiReturn
    
23. KiKiReturn:
    
24. jmp 005BB8DC
    
25. [disable]
    
26. unregistersymbol(KiKiVac)
    
27. dealloc(KiKiVac)
    
28. 
    
29. //TWMS 0.75閃爍無敵
    
30. //ADD=00777068
    
31. //EIP=god
    
32. [ENABLE]
    
33. registersymbol(god)
    
34. alloc(god,32)
    
35. god:
    
36. mov eax,64
    
37. mov esi,0
    
38. jmp 00777075
    
39. [DISABLE]
    
40. dealloc(god)
    
41. unregistersymbol(god)
    
42. /版本 : V75 攻擊不停. ( CSX ) 版
    
43. //更新 : haroming
    
44. //日期 : 2008/7/26
    
45. // 代碼 :7D80B5
    
46. // EIP : CSX
    
47. [Enable]
    
48. registersymbol(CSX)
    
49. alloc(CSX,128)
    
50. label(CSXReturn)
    
51. CSX://CSEAX X  7D80BA
    
52. push eax
    
53. mov eax,[9443AC]
    
54. mov eax,[eax+1b88]
    
55. cmp eax,2   
    
56. pop eax
    
57. jg CSXReturn
    
58. push eax
    
59. mov eax,[9443AC]
    
60. mov eax,[eax+b70]
    
61. cmp esi,eax
    
62. pop eax
    
63. jne CSXReturn
    
64. add eax,0a
    
65. jmp CSXReturn
    
66. CSXReturn:
    
67. mov [ebx], eax
    
68. jmp 7D80B7
    
69.       
    
70. [Disable]
    
71. unregistersymbol(CSX)
    
72. dealloc(CSX)

複製代碼

說話間隔縮短 0046D411  CF[V][ ]
完美人物 0084F65D EAX:0~3
神偷無怪落葉斬 0049B44F ZF[V][ ]
不空揮 0078E01C ZF[V][V]
快速丟錢  007D06F3 EAX:a~c350
瞬移到最左邊 007D699A CF [V][V]
瞬移到最右邊 007D6A09 CF [V][ ]
瞬移到最上面 007D6A9A CF [V][V]
高跳 00788F31 ZF[V][ ]
飛天 007D46E2 ZF[V][ ]
超級撿物 004B84F0 ZF[V][V]
怪物變笨 007D9C33 ZF[V][ ]
怪物數量 009443A4    offset：10、24
頻道資訊 009443BC    offset：2048
地圖紅點 009443A4    offset：18
Char PID 009443AC    offset B70
超撿 009443BC    offset：206C
角色座標(UberVac) 009443AC  offset   X：B54   Y：B58
左牆值 009443AC    offset：24
上牆值 009443AC    offset：28
右牆值 009443AC    offset：2C
下牆值 009443AC    offset：30
本文章轉自外掛聯合國http://www.wgun.net