需要的请测试一下,我没有条件测试
掉落的概率大约是(1属性为100的话)
2属性:33
其他属性:11
全属性应该可以掉出,但是概率不大
修改方法:从gs文件偏移地址009193开始,
原数据为:
88 45 FC 8A 45 FC 5F 5E 5B 8B E5 5D C3 CC CC CC。。。
替换为:
EB 0B 90 8A 45 FC 5F 5E 5B 8B E5 5D C3
88 45 FC E8 15 43 09 00 24 03 75 EA 8A
45 FC 08 E0 88 45 FC 75 E0
下面是修改后的反汇编代码(红色部分为修改添加内容):
00409100 <> 55 push ebp
00409101 8BEC mov ebp,esp
00409103 83EC 44 sub esp,44
00409106 53 push ebx
00409107 56 push esi
00409108 |. 57 push edi
00409109 |. C645 FC 00 mov byte ptr ss:[ebp-4],0
0040910D |. E8 AB430900 call <GAMESERV.getPosRadom>
00409112 |. 99 cdq
00409113 |. B9 06000000 mov ecx,6
00409118 |. F7F9 idiv ecx
0040911A |. 8BCA mov ecx,edx
0040911C |. BA 01000000 mov edx,1
00409121 |. D3E2 shl edx,cl
00409123 |. 8855 FC mov byte ptr ss:[ebp-4],dl
00409126 |. 8B45 FC mov eax,dword ptr ss:[ebp-4]
00409129 |. 25 FF000000 and eax,0FF
0040912E |. 83E0 02 and eax,2
00409131 |. 85C0 test eax,eax
00409133 |. 74 2E je short GAMESERV.00409163
00409135 |. E8 83430900 call <GAMESERV.getPosRadom>
0040913A |. 25 01000080 and eax,80000001
0040913F |. 79 05 jns short GAMESERV.00409146
00409141 |. 48 dec eax
00409142 |. 83C8 FE or eax,FFFFFFFE
00409145 |. 40 inc eax
00409146 |> 85C0 test eax,eax
00409148 |. 74 19 je short GAMESERV.00409163
0040914A |. E8 6E430900 call <GAMESERV.getPosRadom>
0040914F |. 99 cdq
00409150 |. B9 06000000 mov ecx,6
00409155 |. F7F9 idiv ecx
00409157 |. 8BCA mov ecx,edx
00409159 |. BA 01000000 mov edx,1
0040915E |. D3E2 shl edx,cl
00409160 |. 8855 FC mov byte ptr ss:[ebp-4],dl
00409163 |> E8 55430900 call <GAMESERV.getPosRadom>
00409168 |. 25 03000080 and eax,80000003
0040916D |. 79 05 jns short GAMESERV.00409174
0040916F |. 48 dec eax
00409170 |. 83C8 FC or eax,FFFFFFFC
00409173 |. 40 inc eax
00409174 |> 85C0 test eax,eax
00409176 |. 75 1E jnz short GAMESERV.00409196
00409178 |. E8 40430900 call <GAMESERV.getPosRadom>
0040917D |. 99 cdq
0040917E |. B9 06000000 mov ecx,6
00409183 |. F7F9 idiv ecx
00409185 |. 8BCA mov ecx,edx
00409187 |. BA 01000000 mov edx,1
0040918C |. D3E2 shl edx,cl
0040918E |. 8A45 FC mov al,byte ptr ss:[ebp-4]
00409191 |. 0AC2 or al,dl
00409193 EB 0B jmp short GAMESERV.004091A0
00409195 90 nop
00409196 |> 8A45 FC mov al,byte ptr ss:[ebp-4]
00409199 |. 5F pop edi
0040919A |. 5E pop esi
0040919B |. 5B pop ebx
0040919C |. 8BE5 mov esp,ebp
0040919E |. 5D pop ebp
0040919F . C3 retn
004091A0 8845 FC mov byte ptr ss:[ebp-4],al
004091A3 E8 15430900 call <GAMESERV.getPosRadom>
004091A8 24 03 and al,3
004091AA ^ 75 EA jnz short GAMESERV.00409196
004091AC 8A45 FC mov al,byte ptr ss:[ebp-4]
004091AF 08E0 or al,ah
004091B1 8845 FC mov byte ptr ss:[ebp-4],al
004091B4 ^ 75 E0 jnz short GAMESERV.00409196
|
|