libanogs.so+3B2EC8: 132 libanogs.so+3B2CD8: 68 memcpy 27 libanogs.so+439A00: 38 libanogs.so+439A28: 38 libanogs.so+4C4260: 12 case8 libanogs.so+1C7454 libanort.so+151B18: libanogs.so+502F58 libanogs.so+3B3E60 CMP W19, #1 libanogs.so+3B3C88 CMP W2 libanogs.so+33598C local anogsPatches = { --memcpy扫描 {offset = 0x336818, value = "~A8 NOP"}, {offset = 0x33E50C, value = "~A8 NOP"}, --防闪 {offset = 0x218B5C, value = "~A8 RET"}, --mrpcs异常上报 {offset = 0x40984C, value = "~A8 LDRSW X10, [X8,#0x10]"}, --hash {offset = 0x43A9C4, value = "~A8 B [PC,#0x90]"}, {offset = 0x43AAA0, value = "~A8 B [PC,#0x90]"}, {offset = 0x441A30, value = "~A8 B [PC,#0x90]"}, --hash数据扫描上报 {offset = 0x2B4B6C, value = "~A8 RET"}, --扫描数据异常上报 {offset = 0x379B00, value = "~A8 B [PC,#0x74]"}, --内存扫描以及基于堆的检测 {offset = 0x3B5534, value = "~A8 LDR X9, [X26,#0x70]"}, --hash验证上下文 {offset = 0x40F068, value = "~A8 MOV W9, WZR"}, {offset = 0x40FE9C, value = "~A8 MOVZ W8, #0x0"}, --第二局crc32 {offset = 0x344754, value = "~A8 MOV W0, #0x1"}, {offset = 0x4C56CC, value = "~A8 LDRB W10, [X19]"}, --CRC32自身效验 {offset = 0x3B3DF4, value = "~A8 LDR X10, [X8,#0x20]"}, {offset = 0x3B3C78, value = "~A8 LDR X9, [X21,#0x20]"}, --crc32 {offset = 0x22C74C, value = "~A8 NOP"}, {offset = 0x3BFC08, value = "~A8 NOP"}, {offset = 0x3C2440, value = "~A8 LDR X9, [X8,#0x10]"}, {offset = 0x380FB0, value = "~A8 CMP X16, X16"}, {offset = 0x3B3E60, value = "~A8 CMP W19, W19"}, {offset = 0x3B3C88, value = "~A8 CMP W2, W2"}, {offset = 0x3EB560, value = "~A8 B [PC,#0x1750]"}, {offset = 0x2D0B54, value = "~A8 LDR X8, [X28,#0x10]"}, --memcpy校验 {offset = 0x3BFC08, value = "~A8 LDR X8, [X28,#0x10]"}, --文件crc校验 {offset = 0x299870, value = "~A8 RET"}, } local ue4Patches = { --杀前端67且过校验 {offset = 0xDEC6DE4, value = "~A8 MOV W0, WZR"}, {offset = 0xDEC6DE8, value = "~A8 RET"}, {offset = 0xDE18EB0, value = "~A8 MOV W0, WZR"}, {offset = 0xDE18EB4, value = "~A8 RET"}, {offset = 0xDDAF8A8, value = "~A8 MOV W0, WZR"}, {offset = 0xDDAF8AC, value = "~A8 RET"}, {offset = 0xDDADCA4, value = "~A8 MOV W0, WZR"}, {offset = 0xDDADCA8, value = "~A8 RET"}, {offset = 0xDDAD9B4, value = "~A8 MOV W0, WZR"}, {offset = 0xDDAD9B8, value = "~A8 RET"}, {offset = 0x34, value = "4096"} } processModule("libanogs.so", anogsPatches) processModule("libUE4.so", ue4Patches)