hearthbuddy中的Class276

构造函数

需要注意的是this.intptr_0 = this.method_18("mono.dll");

所以，这个类里面的操作，最后是和mono.dll相关的

internal Class276(ExternalProcessMemory memory)
        {
            this.externalProcessMemory_0 = memory;
            this.intptr_0 = this.method_18("mono.dll");
            this.intptr_31 = this.intptr_0 + 522030;
            this.intptr_28 = this.intptr_0 + 91559;
            this.intptr_13 = this.intptr_0 + 226176;
            this.intptr_16 = this.intptr_0 + 91615;
            this.intptr_6 = this.intptr_0 + 78677;
            this.intptr_1 = this.intptr_0 + 102855;
            this.intptr_15 = this.intptr_0 + 230512;
            this.intptr_14 = this.intptr_0 + 224970;
            this.intptr_7 = this.intptr_0 + 73617;
            this.intptr_19 = this.intptr_0 + 120353;
            this.intptr_29 = this.intptr_0 + 162866;
            this.intptr_17 = this.intptr_0 + 525190;
            this.intptr_25 = this.intptr_0 + 389455;
            this.intptr_24 = this.intptr_0 + 385464;
            this.intptr_32 = this.intptr_0 + 389677;
            this.intptr_34 = this.intptr_0 + 384279;
            this.intptr_36 = this.intptr_0 + 382675;
            this.intptr_35 = this.intptr_0 + 91327;
            this.intptr_23 = this.intptr_0 + 428289;
            this.intptr_33 = this.intptr_0 + 378912;
            this.intptr_27 = this.intptr_0 + 515937;
            this.intptr_12 = this.intptr_0 + 176417;
            this.intptr_10 = this.intptr_0 + 176976;
            this.intptr_4 = this.intptr_0 + 77237;
            this.intptr_8 = this.intptr_0 + 107261;
            this.intptr_21 = this.intptr_0 + 231261;
            this.intptr_18 = this.intptr_0 + 522401;
            this.intptr_5 = this.intptr_0 + 733279;
            this.intptr_30 = this.intptr_0 + 91701;
            this.intptr_2 = this.intptr_0 + 733427;
            this.intptr_9 = this.intptr_0 + 162872;
            this.intptr_3 = this.intptr_0 + 91604;
            this.intptr_26 = this.intptr_0 + 383139;
            this.intptr_22 = this.intptr_0 + 385556;
            this.intptr_20 = this.intptr_0 + 91570;
            this.intptr_11 = this.intptr_0 + 401933;
            this.method_15<bool>("boolean");
            this.method_15<object>("object");
            this.method_15<sbyte>("sbyte");
            this.method_15<byte>("byte");
            this.method_15<short>("int16");
            this.method_15<ushort>("uint16");
            this.method_15<int>("int32");
            this.method_15<uint>("uint32");
            this.method_15<long>("int64");
            this.method_15<ulong>("uint64");
            this.method_15<float>("single");
            this.method_15<double>("double");
            this.method_15<char>("char");
            this.method_15<string>("string");
            this.method_15<Enum>("enum");
        }

this.intptr_0 = this.method_18("mono.dll");

+ intptr_0 0x10000000 System.IntPtr

 

this.intptr_28 = this.intptr_0 + 91559;

+ intptr_28 0x100165A7 System.IntPtr   和intptr_0相比，相差0x165A7，也就是‭91559‬

 

this.intptr_19 = this.intptr_0 + 120353;

+ intptr_19 0x1001D621 System.IntPtr  和intptr_0相比，相差0x‭‭1D621‬，也就是120353‬

 

this.intptr_21 = this.intptr_0 + 231261;

+ intptr_21 0x1003875D System.IntPtr  和intptr_0相比，相差0x3875D，也就是231261

 

 

https://www.cnblogs.com/chucklu/p/11658814.html

https://github.com/ChuckHearthstone/SilverFish/tree/master/MonoTest

 

作者:Chuck Lu    GitHub