NPC发红字广播

NPC发红字广播（带名字）
中间代码有点烦琐~~~可以自己简化

同样适合NOEYES的M2，M2要先扩容，不也可以，不过我要加的东西很多~~

UE的没整理，忙了，以后吧

这里给出的是完整的代码了，大家自己汇编吧，一起来~~~

选择在"@@buildguildnow"这段代码插入：
1：———————————————————————————————
* Possible StringData Ref from Code Obj ->"@@buildguildnow"
                                  |
:004A3662 BA54374A00              mov edx, 004A3754
:004A3667 8B45F0                  mov eax, dword ptr [ebp-10]
:004A366A E8D156F6FF              call 00408D40
:004A366F 85C0                    test eax, eax
:004A3671 750E                    jne 004A3681
:004A3673 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004A3676 8B55F8                  mov edx, dword ptr [ebp-08]
:004A3679 8B45FC                  mov eax, dword ptr [ebp-04]
:004A367C E8A3FAFFFF              call 004A3124

dedecms.com

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A3671(C)
|
:004A3681 E9CA8F0600              jmp 0050C650   ---   跳，插入NPC发红字广播命令"@@Announcement"

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0050C674(U)
|
:004A3686 8B45F0                  mov eax, dword ptr [ebp-10]
:004A3689 E8B256F6FF              call 00408D40
:004A368E 85C0                    test eax, eax
:004A3690 750E                    jne 004A36A0
:004A3692 8B4DEC                  mov ecx, dword ptr [ebp-14]
:004A3695 8B55F8                  mov edx, dword ptr [ebp-08]
:004A3698 8B45FC                  mov eax, dword ptr [ebp-04] dedecms.com
:004A369B E8C8FCFFFF              call 004A3368
————————————————————————————————

参考“跳，插入NPC发红字广播命令"@@Announcement"”，来到这里
2：———————————————————————————————
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A3681(U)
|
:0050C650 BACAC55000              mov edx, 0050C5CA   ---   取命令"@@Announcement"
:0050C655 8B45F0                  mov eax, dword ptr [ebp-10]   ---   操作人
:0050C658 E8E3C6EFFF              call 00408D40
:0050C65D 85C0                    test eax, eax
:0050C65F 750E                    jne 0050C66F   ---   M2典型的比较字符串的语句↑ dedecms.com
:0050C661 8B4DEC                  mov ecx, dword ptr [ebp-14]
:0050C664 8B55F8                  mov edx, dword ptr [ebp-08]
:0050C667 8B45FC                  mov eax, dword ptr [ebp-04]
:0050C66A E8C8FCFFFF              call 0050C337   ---   实现NPC发红字广播（带名字）子程序

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0050C65F(C)
|

* Possible StringData Ref from Code Obj ->"@@guildwar"
                                  |
:0050C66F BA6C374A00              mov edx, 004A376C
:0050C674 E90D70F9FF              jmp 004A3686   ---   上面的JMP被截断，写好我的代码，跳回去
—————————————————————————————————

“实现NPC发红字广播（带名字）子程序”
3：———————————————————————————————
:0050C320 FFFFFFFF                BYTE  4 DUP(0ffh)

:0050C324 0D0000005B              or eax, 5B000000
:0050C329 4E                      dec esi
:0050C32A 50                      push eax
:0050C32B 43                      inc ebx
:0050C32C B7A2                    mov bh, A2
:0050C32E BBB0B2E2CA              mov ebx, CAE2B2B0
:0050C333 D45D                    aam (base93)
:0050C335 0000                    add byte ptr [eax], al   ---   命令"@@Announcement",一些字符,没什么可以解释的↑

* Referenced by a CALL at Address:   ---   子程序(主要代码)
|:0050C66A  
|
:0050C337 55                      push ebp
:0050C338 8BEC                    mov ebp, esp
:0050C33A 83C4EC                  add esp, FFFFFFEC
:0050C33D 53                      push ebx
:0050C33E 33DB                    xor ebx, ebx
:0050C340 895DEC                  mov dword ptr [ebp-14], ebx
:0050C343 894DF4                  mov dword ptr [ebp-0C], ecx
:0050C346 8955F8                  mov dword ptr [ebp-08], edx
:0050C349 8945FC                  mov dword ptr [ebp-04], eax
:0050C34C 8B45F4                  mov eax, dword ptr [ebp-0C]
:0050C34F E82C7DEFFF              call 00404080
:0050C354 33C0                    xor eax, eax
:0050C356 55                      push ebp dedecms.com
:0050C357 6805C45000              push 0050C405
:0050C35C 64FF30                  push dword ptr fs:[eax]
:0050C35F 648920                  mov dword ptr fs:[eax], esp
:0050C362 8B45F8                  mov eax, dword ptr [ebp-08]   ---   这里开始到0050C394,发话费用操作.
:0050C365 81783030750000          cmp dword ptr [eax+30], 00007530   ---   检测人物身上金币(30W)
:0050C36C 7C19                    jl 0050C387   ---   没有30W,跳"你的金币不够了。"
:0050C36E BA30750000              mov edx, 00007530 dedecms.com
:0050C373 8B45F8                  mov eax, dword ptr [ebp-08]
:0050C376 E82D33FBFF              call 004BF6A8
:0050C37B 8B45F8                  mov eax, dword ptr [ebp-08]
:0050C37E E87186FBFF              call 004C49F4
:0050C383 EB11                    jmp 0050C396   ---   扣除30W后,跳0050C396--"广播代码"
:0050C385 33C9                    xor ecx, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0050C36C(C)
|

* Possible StringData Ref from Code Obj ->"你的金币不够了。"
                                  |
:0050C387 BA40344A00              mov edx, 004A3440
:0050C38C 8B45F8                  mov eax, dword ptr [ebp-08]
:0050C38F E890EDFAFF              call 004BB124
:0050C394 EB4A                    jmp 0050C3E0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:   ---   "广播代码"
|:0050C383(U)
|
:0050C396 8D45F0                  lea eax, dword ptr [ebp-10]
:0050C399 8B55F8                  mov edx, dword ptr [ebp-08]
:0050C39C 83C215                  add edx, 00000015
:0050C39F E8CC7AEFFF              call 00403E70
:0050C3A4 E86B000000              call 0050C414   ---   在要发的字符前加 [名字]
:0050C3A9 90                      nop

:0050C3AA 8B4DF4                  mov ecx, dword ptr [ebp-0C]   ---   在要发的字符
:0050C3AD E8667BEFFF              call 00403F18
:0050C3B2 8B55EC                  mov edx, dword ptr [ebp-14]   ---   操作人发的字符(带名字)
:0050C3B5 A190A44E00              mov eax, dword ptr [004EA490]   ---   令操作人发的字符所有人都能看见，有如GM'(*)功能
:0050C3BA 8B00                    mov eax, dword ptr [eax]
:0050C3BC E82F27FAFF              call 004AEAF0
:0050C3C1 A18CA74E00              mov eax, dword ptr [004EA78C]
:0050C3C6 50                      push eax
:0050C3C7 8B0D4CA64E00            mov ecx, dword ptr [004EA64C]
:0050C3CD 8B09                    mov ecx, dword ptr [ecx]
:0050C3CF A190A44E00              mov eax, dword ptr [004EA490]
:0050C3D4 8B00                    mov eax, dword ptr [eax]
:0050C3D6 BACC000000              mov edx, 000000CC
:0050C3DB E84833FAFF              call 004AF728   ---   令操作人发的字符所有人都能看见，有如GM'(*)功能↑

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0050C394(U)
|
:0050C3E0 C745F001000000          mov [ebp-10], 00000001
:0050C3E7 33C0                    xor eax, eax
:0050C3E9 5A                      pop edx
:0050C3EA 59                      pop ecx
:0050C3EB 59                      pop ecx
:0050C3EC 648910                  mov dword ptr fs:[eax], edx
:0050C3EF 680CC45000              push 0050C40C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0050C40A(U)
|
:0050C3F4 8D45EC                  lea eax, dword ptr [ebp-14]
:0050C3F7 E85078EFFF              call 00403C4C
:0050C3FC 8D45F4                  lea eax, dword ptr [ebp-0C]
:0050C3FF E84878EFFF              call 00403C4C
:0050C404 C3                      ret

:0050C405 E95672EFFF              jmp 00403660
:0050C40A EBE8                    jmp 0050C3F4
:0050C40C 8B45F0                  mov eax, dword ptr [ebp-10]
:0050C40F 5B                      pop ebx
:0050C410 8BE5                    mov esp, ebp
:0050C412 5D                      pop ebp
:0050C413 C3                      ret

* Referenced by a CALL at Address:
|:0050C3A4  
|
:0050C414 68E4744800              push 004874E4   ---   "["
:0050C419 FF75F0                  push [ebp-10]   ---   "操作人名字"
:0050C41C 68D8744800              push 004874D8   ---   "]"
:0050C421 8D45F0                  lea eax, dword ptr [ebp-10]
:0050C424 BA03000000              mov edx, 00000003
:0050C429 E85E7BEFFF              call 00403F8C
:0050C42E 8B55F0                  mov edx, dword ptr [ebp-10]
:0050C431 8D45EC                  lea eax, dword ptr [ebp-14]
:0050C434 C3                      ret dedecms.com

UE改法如下：

查找
BA6C374A00
替换
E9CA8F0600

0x106a51h
查找
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
替换
BA CA C5 50 00 8B 45 F0 E8 E3 C6 EF FF 85 C0 75 0E 8B 4D EC 8B 55 F8 8B 45 FC E8 C8 FC FF FF BA 6C 37 4A 00 E9 0D 70 F9 FF

0x106720h
查找
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
替换
FFFFFFFF0D0000005B4E5043B7A2BBB0B2E2CAD45D0000558BEC83C4EC5333DB895DEC894DF48955F88945FC8B45F4E82C7DEFFF33C0556805C4500064FF306489208B45F8817830307500007C19BA307500008B45F8E82D33FBFF8B45F8E87186FBFFEB1133C9BA40344A008B45F8E890EDFAFFEB4A8D45F08B55F883C215E8CC7AEFFFE86B000000908B4DF4E8667BEFFF8B55ECA190A44E00E82F27FAFFA18CA74E00508B0D4CA64E008B09A190A44E008B00BACC000000E84833FAFFC745F00100000033C05A5959648910680CC450008D45ECE85078EFFF8D45F4E84878EFFFC3E95672EFFFEBE88B45F05B8BE55DC368E4744800FF75F068D87448008D45F0BA03000000E85E7BEFFF8B55F08D45ECC3

dedecms.com