WZ、IMG模式
InitializeResMan
//Function Address
auto CWvsApp__InitializeResMan = reinterpret_cast<CWvsApp__InitializeResMan_t>(0xB0A3E0);
auto PcCreateObject_IWzResMan = (void(__cdecl*)(void*, void*, void*))0xB04CA0;
auto PcCreateObject_IWzNameSpace = (void(__cdecl*)(void*, void*, void*))0xB04D30;
auto PcCreateObject_IWzFileSystem = (void(__cdecl*)(void*, void*, void*))0xB05EC0;
auto CWvsApp__Dir_BackSlashToSlash = (void(__cdecl*)(void*))0xB02DC0;
auto CWvsApp__Dir_upDir = (void(__cdecl*)(void*))0xB02EA0;
auto bstr_constructor = (void(__fastcall*)(void*, void*, void*))0x42F750;
auto IWzFileSystem__Init = (void*(__fastcall*)(void*, void*, void*))0xB0A030;
auto IWZNameSpace__Mount = (void*(__fastcall*)(void*, void*, void*, void*, void*))0xB09FA0;
// DWORD Address
auto g_rm = (void**)0xE309AC;
auto g_root = (void**)0xE309B4;
auto pNameSpace = 0xE2E564;
移除HS
00B0B8B0 CWvsApp::SetUp
00B0BE62 -> NOP CSecurityClient::InitModule
00B0C3E5 -> NOP CSecurityClient::StartModule
00B080EC -> NOP CSecurityClient::Update
启动跳过CRC_VM，CRC检测，IP检查
00B07730 CWvsApp::Run
1、 00B07BF2 00B07BFC NOP 00B07C05 JMP
2、00B07D7E JMP
3、 00B083FC 00B08405 00B0840E NOP 00B0841A JMP
4、 00B08723 00B08732 00B08741 NOP
5、 00B08901 00B08916 00B08922 NOP 00B0892B JMP
6、 00B089E4 -> 00B08A09 NOP
7、00B08A88 JMP
8、 00B08B5F 00B08B74 00B08B80 NOP
00B08B89 JMP
9、 00B08C35 -> 00B08C5A NOP
10、 00B08CD9 JMP
11、 00B08E47 00B08E51 NOP
00B08E5D 00B08EA6 JMP
IP白名单
004BEEC0 CClientSocket::Connect
004BF0EE 004BF0FD nop
004BF10C jmp
00B060A0 CWvsApp::CallUpdate
1、00B06364 JMP
2、 00B063D7 00B063DD 00B063E3 NOP
00B063EC JMP
3、 00B066EB 00B066FA 00B06709 NOP