HearthBuddy的class276以及class247

使用de4dot-cex反编译原版的hearthbuddy得到的

链接: https://pan.baidu.com/s/1hT79LpIjbyvODsjnkSe_5A 提取码: iemx 

class276里面的指针是通过class247得到的

internal Class276(ExternalProcessMemory memory)
{
    this.externalProcessMemory_0 = memory;
    this.intptr_0 = this.method_18("mono.dll");
    this.intptr_31 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_9;
    this.intptr_28 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_17;
    this.intptr_13 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_22;
    this.intptr_16 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_16;
    this.intptr_6 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_7;
    this.intptr_1 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_15;
    this.intptr_15 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_24;
    this.intptr_14 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_21;
    this.intptr_7 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_5;
    this.intptr_19 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_10;
    this.intptr_29 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_35;
    this.intptr_17 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_1;
    this.intptr_25 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_30;
    this.intptr_24 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_25;
    this.intptr_32 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_31;
    this.intptr_34 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_28;
    this.intptr_36 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_0;
    this.intptr_35 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_29;
    this.intptr_23 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_34;
    this.intptr_33 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_33;
    this.intptr_27 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_32;
    this.intptr_12 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_4;
    this.intptr_10 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_3;
    this.intptr_4 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_6;
    this.intptr_8 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_11;
    this.intptr_21 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_23;
    this.intptr_18 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_8;
    this.intptr_5 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_2;
    this.intptr_30 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_19;
    this.intptr_2 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_12;
    this.intptr_9 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_18;
    this.intptr_3 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_14;
    this.intptr_26 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_27;
    this.intptr_22 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_26;
    this.intptr_20 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_13;
    this.intptr_11 = this.intptr_0 + TritonHs.class247_0.struct106_0.int_20;
    this.method_15<bool>("boolean");
    this.method_15<object>("object");
    this.method_15<sbyte>("sbyte");
    this.method_15<byte>("byte");
    this.method_15<short>("int16");
    this.method_15<ushort>("uint16");
    this.method_15<int>("int32");
    this.method_15<uint>("uint32");
    this.method_15<long>("int64");
    this.method_15<ulong>("uint64");
    this.method_15<float>("single");
    this.method_15<double>("double");
    this.method_15<char>("char");
    this.method_15<string>("string");
    this.method_15<Enum>("enum");
}

赋值处理

try
                {
                    TritonHs.class247_0 = new Class247();
                    TritonHs.class247_0.method_1(array, TritonHs.Memory.ImageBase);
                }
                catch (Exception)
                {
                    string_0 = string.Format("The data required to run the bot is corrupted. Please make sure your key is still valid at the Buddy Auth Portal: http://buddyauth.com/User/Keys {0}{0}For any further assistance, please contact support: https://bosslandgmbh.zendesk.com/home", Environment.NewLine);
                    return false;
                }
                TritonHs.class276_0 = new Class276(TritonHs.externalProcessMemory_0);
                using (TritonHs.AcquireFrame())
                {
                    TritonHs.intptr_1 = TritonHs.Class276_0.method_2();
                }

直接new一个class247的实例对象，然后调用method_1。传递的参数是array和TritonHs.Memory.ImageBase

public static ExternalProcessMemory Memory
        {
            get
            {
                return TritonHs.externalProcessMemory_0;
            }
        }

array参数的获取，delegate6_0貌似是从服务器获取地址数据

byte[] array = delegate6_0(TritonHs.String_0, out string_0);
            if (array == null)
            {
                if (string.IsNullOrEmpty(string_0))
                {
                    string_0 = string.Format("The data required to run the bot was not successfully obtained. Please make sure your key is still valid at the Buddy Auth Portal: http://buddyauth.com/User/Keys {0}{0}For any further assistance, please contact support: https://bosslandgmbh.zendesk.com/home", Environment.NewLine);
                }
                return false;
            }

class247里面的method1方法

// ns25.Class247
// Token: 0x06001990 RID: 6544 RVA: 0x000DAF40 File Offset: 0x000D9140
internal unsafe void method_1(byte[] byte_0, IntPtr intptr_1)
{
    this.intptr_0 = new IntPtr[byte_0.Length / 4];
    byte b = 1;
    byte* ptr;
    if (byte_0 != null && byte_0.Length != 0)
    {
        fixed (byte* ptr = &byte_0[0])
        {
        }
    }
    else
    {
        ptr = null;
    }
    uint* ptr2 = (uint*)ptr;
    for (int i = 0; i < this.intptr_0.Length; i++)
    {
        uint uint_ = ptr2[i];
        IntPtr intPtr = new IntPtr((long)((ulong)Class247.smethod_0(uint_, b)));
        this.intptr_0[i] = intPtr;
        b = ((b + 1) ?? 0);
    }
    ptr = null;
    this.method_0(intptr_1);
}

method0方法在对struct106_0 进行赋值

if (ptr4 != null)
    {
        this.struct106_0 = *(Struct106*)ptr4;
    }

// ns25.Class247
// Token: 0x0600198F RID: 6543 RVA: 0x000DAE44 File Offset: 0x000D9044
internal unsafe void method_0(IntPtr intptr_1)
{
    IntPtr[] array = new IntPtr[this.intptr_0.Length];
    this.intptr_0.CopyTo(array, 0);
    ArraySegment<IntPtr> arraySegment_;
    ArraySegment<IntPtr> arraySegment_2;
    this.method_4(array, out arraySegment_, out arraySegment_2);
    for (int i = arraySegment_.Offset; i < arraySegment_.Count; i++)
    {
        if (arraySegment_.Array[i].ToInt32() > 4194304)
        {
            array[i] = array[i] - 4194304 + intptr_1.ToInt32();
        }
    }
    IntPtr[] array2;
    IntPtr* ptr;
    if ((array2 = this.method_2<IntPtr>(arraySegment_)) != null && array2.Length != 0)
    {
        fixed (IntPtr* ptr = &array2[0])
        {
        }
    }
    else
    {
        ptr = null;
    }
    byte* ptr2 = (byte*)ptr;
    if (ptr2 != null)
    {
        this.struct105_0 = *(Struct105*)ptr2;
    }
    ptr = null;
    IntPtr* ptr3;
    if ((array2 = this.method_2<IntPtr>(arraySegment_2)) != null && array2.Length != 0)
    {
        fixed (IntPtr* ptr3 = &array2[0])
        {
        }
    }
    else
    {
        ptr3 = null;
    }
    byte* ptr4 = (byte*)ptr3;
    if (ptr4 != null)
    {
        this.struct106_0 = *(Struct106*)ptr4;
    }
    ptr3 = null;
}

所以之前的工作原理，是从服务器获取mono的偏移地址，然后进行后续操作的。