debug - 打补丁 - 浮点数加法-编程知识

文章目录

- debug - 打补丁 - 浮点数加法
- 概述
- 笔记
- demo
- 用CE查看汇编(x64debug)
- main()
- update_info()
- 快捷键 - CE中查看代码时的导航
- 打补丁的时机 - 浮点数加法
- 补丁代码
- 补丁效果
- 浮点数寄存器组的保存
- END

debug - 打补丁 - 浮点数加法

概述

在cm中, UI上显示的数值仅仅用来显示, 改这个显示值没用.
显示时, 是从一个结构体中取出值(浮点数), 然后转成整数显示.
写了一个demo(vs2019 + console + debug/x64), 模拟结构体信息中的浮点数赋值和浮点数的显示.
用CE来看, 和cm中取值显示的汇编实现很像.
拿自己写的demo, 来打个补丁, 让显示之前, 先对结构体中的浮点值加上一些额外的值, 然后再去显示
这样的话, 显示值和结构体中的值就一致了.

笔记

demo

/*!
* \file fDataOpt.cpp
* \brief 测试在汇编中的浮点数操作的打补丁(浮点加法)
*/#include <windows.h>#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <cstdint>typedef struct _tag_info
{int id;float money;
} TAG_INFO;void init();
int rand_ranged(int range_min, int range_max);
void update_info(TAG_INFO& info);int main()
{TAG_INFO info;memset(&info, 0, sizeof(info));init();do {Sleep(1000);update_info(info);printf("money = %d\n", (int)info.money);if (info.money >= 9999) {break;}} while (true);system("pause");return 0;
}void update_info(TAG_INFO& info)
{info.id = 0x1000;info.money += (float)rand_ranged(1, 10);
}void init()
{srand(0215);
}int rand_ranged(int range_min, int range_max)
{// Generate random numbers in the interval [range_min, range_max], inclusive.// Note: This method of generating random numbers in a range isn't suitable for// applications that require high quality random numbers.// rand() has a small output range [0,32767], making it unsuitable for// generating random numbers across a large range using the method below.// The approach below also may result in a non-uniform distribution.// More robust random number functionality is available in the C++ <random> header.// See https://learn.microsoft.com/cpp/standard-library/randomreturn (int)(((double)rand() / RAND_MAX) * (range_max - range_min) + range_min);
}

用CE查看汇编(x64debug)

main()


fDataOpt.main - 40 55                 - push rbp
fDataOpt.main+2- 57                    - push rdi
fDataOpt.main+3- 48 81 EC 08010000     - sub rsp,00000108 { 264 }
fDataOpt.main+A- 48 8D 6C 24 20        - lea rbp,[rsp+20]
fDataOpt.main+F- 48 8D 7C 24 20        - lea rdi,[rsp+20]
fDataOpt.main+14- B9 0A000000           - mov ecx,0000000A { 10 }
fDataOpt.main+19- B8 CCCCCCCC           - mov eax,CCCCCCCC { -858993460 }
fDataOpt.main+1E- F3 AB                 - repe stosd 
fDataOpt.main+20- 48 8B 05 F1B50000     - mov rax,[fDataOpt.__security_cookie] { (192) }
fDataOpt.main+27- 48 33 C5              - xor rax,rbp
fDataOpt.main+2A- 48 89 85 D8000000     - mov [rbp+000000D8],rax
fDataOpt.main+31- 48 8D 0D ED050100     - lea rcx,[fDataOpt.exe+22015] { (1) }
fDataOpt.main+38- E8 52F9FFFF           - call fDataOpt.exe+1137F
fDataOpt.main+3D- 41 B8 08000000        - mov r8d,00000008 { 8 }
fDataOpt.main+43- 33 D2                 - xor edx,edx
fDataOpt.main+45- 48 8D 4D 08           - lea rcx,[rbp+08]
fDataOpt.main+49- E8 92F8FFFF           - call fDataOpt.exe+112D0 { memset()}
fDataOpt.main+4E- E8 66F7FFFF           - call fDataOpt.exe+111A9 { init()}
fDataOpt.main+53- B9 E8030000           - mov ecx,000003E8 { 1000 }
fDataOpt.main+58- FF 15 B2F50000        - call qword ptr [fDataOpt._imp_Sleep] { ->KERNEL32.Sleep }
fDataOpt.main+5E- 48 8D 4D 08           - lea rcx,[rbp+08]
fDataOpt.main+62- E8 9DF7FFFF           - call fDataOpt.exe+111F4 { update_info()}
fDataOpt.main+67- F3 0F2C 45 0C         - cvttss2si eax,[rbp+0C] { 浮点数强转整数}
fDataOpt.main+6C- 8B D0                 - mov edx,eax
fDataOpt.main+6E- 48 8D 0D 43920000     - lea rcx,[fDataOpt.exe+1ACA8] { ("money = %d
") }
fDataOpt.main+75- E8 30F7FFFF           - call fDataOpt.exe+1119A { printf()}
fDataOpt.main+7A- F3 0F10 45 0C         - movss xmm0,[rbp+0C] { 载入浮点数}
fDataOpt.main+7F- 0F2F 05 56920000      - comiss xmm0,[fDataOpt.exe+1ACCC] { (9999.00) }
fDataOpt.main+86- 72 02                 - jb fDataOpt.main+8A
fDataOpt.main+88- EB 07                 - jmp fDataOpt.main+91
fDataOpt.main+8A- 33 C0                 - xor eax,eax
fDataOpt.main+8C- 83 F8 01              - cmp eax,01 { 1 }
fDataOpt.main+8F- 75 C2                 - jne fDataOpt.main+53
fDataOpt.main+91- 48 8D 0D 30920000     - lea rcx,[fDataOpt.exe+1ACB8] { ("pause") }
fDataOpt.main+98- FF 15 3AF80000        - call qword ptr [fDataOpt._imp_system] { ->ucrtbased.system }
fDataOpt.main+9E- 33 C0                 - xor eax,eax
fDataOpt.main+A0- 8B F8                 - mov edi,eax
fDataOpt.main+A2- 48 8D 4D E0           - lea rcx,[rbp-20]
fDataOpt.main+A6- 48 8D 15 E3910000     - lea rdx,[fDataOpt.exe+1AC80] { (1) }
fDataOpt.main+AD- E8 79F8FFFF           - call fDataOpt.exe+1131B
fDataOpt.main+B2- 8B C7                 - mov eax,edi
fDataOpt.main+B4- 48 8B 8D D8000000     - mov rcx,[rbp+000000D8]
fDataOpt.main+BB- 48 33 CD              - xor rcx,rbp
fDataOpt.main+BE- E8 05F7FFFF           - call fDataOpt.exe+111B8
fDataOpt.main+C3- 48 8D A5 E8000000     - lea rsp,[rbp+000000E8]
fDataOpt.main+CA- 5F                    - pop rdi
fDataOpt.main+CB- 5D                    - pop rbp
fDataOpt.main+CC- C3                    - ret 
fDataOpt.exe+11ABD- CC                    - int 3

update_info()

fDataOpt.update_info - 48 89 4C 24 08        - mov [rsp+08],rcx { rcx是结构体指针}
fDataOpt.update_info+5- 55                    - push rbp
fDataOpt.update_info+6- 57                    - push rdi
fDataOpt.update_info+7- 48 81 EC E8000000     - sub rsp,000000E8 { 232 }
fDataOpt.update_info+E- 48 8D 6C 24 20        - lea rbp,[rsp+20]
fDataOpt.update_info+13- 48 8D 0D 6B070100     - lea rcx,[fDataOpt.exe+22015] { (1) }
fDataOpt.update_info+1A- E8 D0FAFFFF           - call fDataOpt.exe+1137F
fDataOpt.update_info+1F- 48 8B 85 E0000000     - mov rax,[rbp+000000E0] { rbp + 0xE0 也是结构体指针}
fDataOpt.update_info+26- C7 00 00100000        - mov [rax],00001000 { 4096 }
fDataOpt.update_info+2C- BA 0A000000           - mov edx,0000000A { 10 }
fDataOpt.update_info+31- B9 01000000           - mov ecx,00000001 { 1 }
fDataOpt.update_info+36- E8 80F7FFFF           - call fDataOpt.exe+1104B { 产生随机数(1~10)}
fDataOpt.update_info+3B- F3 0F2A C0            - cvtsi2ss xmm0,eax { eax是返回的随机数
cvtsi2ss 是将4字节内容整型内容, 强转为浮点数(e.g. 1 => 1.0f)}
fDataOpt.update_info+3F- 48 8B 85 E0000000     - mov rax,[rbp+000000E0] { rbp + 0xE0是结构体指针}
fDataOpt.update_info+46- F3 0F10 48 04         - movss xmm1,[rax+04] { 将info.money给xmm1}
fDataOpt.update_info+4B- F3 0F58 C8            - addss xmm1,xmm0 { 2个浮点数相加}
fDataOpt.update_info+4F- 0F28 C1               - movaps xmm0,xmm1 { 浮点数拷贝}
fDataOpt.update_info+52- 48 8B 85 E0000000     - mov rax,[rbp+000000E0]
fDataOpt.update_info+59- F3 0F11 40 04         - movss [rax+04],xmm0 { 浮点数转为2进制存储, 更新money}
fDataOpt.update_info+5E- 48 8D A5 C8000000     - lea rsp,[rbp+000000C8]
fDataOpt.update_info+65- 5F                    - pop rdi
fDataOpt.update_info+66- 5D                    - pop rbp
fDataOpt.update_info+67- C3                    - ret 
fDataOpt.update_info+68- CC                    - int 3

看了汇编实现, 就大概知道怎么给显示前的值打补丁(浮点加法)

快捷键 - CE中查看代码时的导航

在这里插入图片描述
如果不知道导航键, 在查看代码时, 无法回到查看的原始点. 只能按F8执行一步, 那样太麻烦了, 耽误事.

打补丁的时机 - 浮点数加法

在这里插入图片描述
在浮点数更新完, 即将要显示的时候, 打补丁.
打完补丁后, 浮点数增加了, 再执行原始的取浮点数的汇编代码.

补丁代码

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048,"fDataOpt.exe"+11A57) 
label(returnhere)
label(originalcode)
label(exit)newmem: //this is allocated memory, you have read,write,execute access
//place your code here// save env
push rax// do task
movss xmm1, [rbp+0x0C] // 将info.money给xmm1// 在原始值上加100(CE的汇编写法中, 数字默认都是16进制)
mov eax, 0x64
cvtsi2ss xmm0,eax // eaxcvtsi2ss 是将4字节内容整型内容, 强转为浮点数(e.g. 1 => 1.0f)addss xmm1,xmm0 // 2个浮点数相加movss [rbp+0x0C], xmm1 // 更新改过的info.money到info结构体// restore env
pop raxoriginalcode:
cvttss2si eax,[rbp+0C]exit:
jmp returnhere"fDataOpt.exe"+11A57:
jmp newmem
returnhere:[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"fDataOpt.exe"+11A57:
db F3 0F 2C 45 0C
//cvttss2si eax,[rbp+0C]

补丁效果

money = 96
money = 99
money = 108
money = 112
money = 118 // 这里是原始的实现, 每次money增加1~10
money = 224 // < 从这开始, 加了补丁, 每次money额外增加了100
money = 333
money = 436
money = 543
money = 652

浮点数寄存器组的保存

模拟了一下, 只看到浮点数寄存器组的保存, 没看到浮点数寄存器组的恢复.
等后续再看看哪里能看到浮点数寄存器的恢复, 或者用CE写个补丁试试. 估计就是用movss就行了.

		// 模拟一下函数外边有浮点数, 函数参数也传浮点数, 函数内部也进行浮点数操作// 看看汇编代码如何保存和恢复浮点寄存器组?f3 = f1 + f2;f4 = f1 - f2;f5 = test_xmmx(f1, f2, f3, f4);printf("f5 = %.2f\n", f5);} while (true);system("pause");return 0;
}float test_xmmx(float& f1, float& f2, float f3, float f4)
{float f_rc = (f1 + f2) * f3 / f4;return f_rc;
}

		// 模拟一下函数外边有浮点数, 函数参数也传浮点数, 函数内部也进行浮点数操作// 看看汇编代码如何保存和恢复浮点寄存器组?f3 = f1 + f2;
00007FF629391B48  movss       xmm0,dword ptr [f1]  
00007FF629391B4D  addss       xmm0,dword ptr [f2]  
00007FF629391B52  movss       dword ptr [f3],xmm0  f4 = f1 - f2;
00007FF629391B57  movss       xmm0,dword ptr [f1]  
00007FF629391B5C  subss       xmm0,dword ptr [f2]  
00007FF629391B61  movss       dword ptr [f4],xmm0  f5 = test_xmmx(f1, f2, f3, f4);
00007FF629391B69  movss       xmm3,dword ptr [f4]  
00007FF629391B71  movss       xmm2,dword ptr [f3]  
00007FF629391B76  lea         rdx,[f2]  
00007FF629391B7A  lea         rcx,[f1]  
00007FF629391B7E  call        test_xmmx (07FF6293913B1h)  
00007FF629391B83  movss       dword ptr [f5],xmm0  printf("f5 = %.2f\n", f5);
00007FF629391B8B  cvtss2sd    xmm0,dword ptr [f5]  
00007FF629391B93  movaps      xmm1,xmm0  
00007FF629391B96  movq        rdx,xmm1  
00007FF629391B9B  lea         rcx,[string "f5 = %.2f\n" (07FF62939AD50h)]  
00007FF629391BA2  call        printf (07FF62939119Ah)  } while (true);

--- D:\my_dev\my_local_git_prj\study\asm\case\fxmmxOpt\fDataOpt.cpp ------------float test_xmmx(float& f1, float& f2, float f3, float f4)
{
00007FF6293918A0  movss       dword ptr [rsp+20h],xmm3  // 保存浮点数寄存器
00007FF6293918A6  movss       dword ptr [rsp+18h],xmm2  
00007FF6293918AC  mov         qword ptr [rsp+10h],rdx  
00007FF6293918B1  mov         qword ptr [rsp+8],rcx  
00007FF6293918B6  push        rbp  
00007FF6293918B7  push        rdi  
00007FF6293918B8  sub         rsp,118h  
00007FF6293918BF  lea         rbp,[rsp+30h]  
00007FF6293918C4  lea         rcx,[__E9A00158_fDataOpt@cpp (07FF6293A2015h)]  
00007FF6293918CB  call        __CheckForDebuggerJustMyCode (07FF62939137Fh)  float f_rc = (f1 + f2) * f3 / f4;
00007FF6293918D0  mov         rax,qword ptr [f1]  
00007FF6293918D7  mov         rcx,qword ptr [f2]  
00007FF6293918DE  movss       xmm0,dword ptr [rax]  
00007FF6293918E2  addss       xmm0,dword ptr [rcx]  // 浮点数加法
00007FF6293918E6  mulss       xmm0,dword ptr [f3]  // 浮点数乘法
00007FF6293918EE  divss       xmm0,dword ptr [f4]  // 浮点数除法
00007FF6293918F6  movss       dword ptr [f_rc],xmm0  return f_rc;
00007FF6293918FB  movss       xmm0,dword ptr [f_rc]  
}
00007FF629391900  lea         rsp,[rbp+0E8h]  
00007FF629391907  pop         rdi  
00007FF629391908  pop         rbp  
00007FF629391909  ret