分析过程

在金手指未找到相关的信息
进入出招简化rom对比

• 找到简化出招rom对比得到出招代码位置0x38B30

  

• 从0x38B30向上找到出招列表0x3884A

  

• wp 3884A,4,r
  断下代码位置在0x2E894

  

• 开始分析进入0x2E8C4

  

  image.png

  单步分析到0x2E960 对Fighter1和Fighter2输入操作
  0x100400+b8
  0x100400+b9
  这个地址测试之后是出招判定地址；
  0x100400+95
  0x100400+5c
  还有
  a0 0x1041C6 Fighter1和Fighter2输入的地方
  a1 0x10D062
  未分析

实现过程

从金手指找到使用隐藏角色坂崎良测试不行
通过上边未分析的a0 0x1041C6附近发现0x10419B和0x10419D是显示Fighter1和Fighter2的人物

switch (a1) {case 93:if (combineView == null) {combineView = new CombineView(context, pluginControl);combineView.addDatas(pluginEntryView.getList(100 + currentId));if (floatManager == null)floatManager = new FloatManager(currentActivity, Gravity.RIGHT | Gravity.BOTTOM);floatManager.showFloat(combineView);new Thread(new Runnable() {@Overridepublic void run() {while (true) {final int ret = NativeUtils.readMemary(0x10419B);if (currentId != ret) {currentId = ret;combineView.post(new Runnable() {@Overridepublic void run() {combineView.addDatas(pluginEntryView.getList(currentId + 100));}});}try {Thread.sleep(2000);} catch (InterruptedException e) {e.printStackTrace();}}}}).start();} else {if (a3 == 1) {floatManager.showFloat(combineView);} else {floatManager.hideFloat(combineView);}}break;default:if (a1 >= 300 && a1 <= 9000) {try {String code = configManager.getHashMapCodes().get(a1);if (code.equals("09")) {NativeUtils.writeMemary(0x10049A,0x10);//4／1血量}NativeUtils.writeMemary(0x1004B8, Integer.parseInt(code, 16));NativeUtils.writeMemary(0x1004B9, 0x04);} catch (Exception e) {Logger.e("e:" + e.getMessage());}} else {configManager.parseFBACheatLock(configManager.getHashMapCodes().get(a1), a3 == 1);}break;}