WMPFDebugger ida 偏移量

您好在您给出的教程中我已经找到了 16965版本的三个偏移量 sub_182570220+65 = 0x2570220 sub_182F844A0 = 0x2F844A0 sub_1825D0BA0+2B4 = 0x25D0BA0

在教程中还有一个在frida/hook.js中的onLoadStartHook 函数所调用的是 case 16965: structOffset = [1416, 1360, 16, 488];

我根据ai 得到了一个1416i64 1416 还有剩下的三个1360, 16, 488 是这么得出来的呢在进入伪代码中

{
  unsigned __int64 result; // rax
  __int64 v5; // rax
  __int64 v6; // rax
  __int64 v7; // rax
  __int64 v8; // r15
  __int64 v9; // rax
  _BYTE v10[40]; // [rsp+0h] [rbp-188h] BYREF
  _QWORD v11[2]; // [rsp+28h] [rbp-160h] BYREF
  __int64 v12; // [rsp+38h] [rbp-150h] BYREF
  _QWORD v13[10]; // [rsp+40h] [rbp-148h] BYREF
  char v14; // [rsp+97h] [rbp-F1h]
  char v15[176]; // [rsp+A8h] [rbp-E0h] BYREF
  __int64 v16; // [rsp+158h] [rbp-30h]

  result = (unsigned __int64)v10 ^ _security_cookie;
  if ( dword_18C2BDFD0 <= 2 && qword_18C2BDFD8 )
  {
    sub_1802C45D0(v11, "..\\..\\flue\\browser\\applet\\applet_index_container.cc", 962i64, 2i64);
    v5 = sub_1841EC740(&v12, "[Perf] AppletIndexContainer::OnLoadStart ", 41i64);
    v6 = sub_1841EC740(v5, " is_main_frame: ", 16i64);
    v7 = sub_18195EBB0(v6, a2);
    v8 = sub_1841EC740(v7, " time = ", 8i64);
    v9 = sub_1825CCAB0();
    sub_1812207E0(v8, v9);
    v11[0] = off_18A906180;
    sub_180A679C0(v11);
    *(_QWORD *)((char *)&v13[-1] + *(int *)(v12 + 4)) = &off_18A8E8A90;
    v13[0] = &off_18A8ED320;
    if ( v14 < 0 )
      ((void (__fastcall *)(_QWORD))unk_184A41650)(v13[8]);
    ((void (__fastcall *)(_QWORD *))unk_183BD3570)(v13);
    ((void (__fastcall *)(_QWORD *))unk_1833DB780)(v13);
    result = ((__int64 (__fastcall *)(char *))unk_183BD3560)(v15);
  }
  if ( (_BYTE)a2 )
    result = sub_182A64870(*(_QWORD *)(*(_QWORD *)(a1 + 56) + 1416i64), *(_QWORD *)(*(_QWORD *)(a1 + 80) + 56i64));
  if ( ((unsigned __int64)v10 ^ v16) != _security_cookie )
  {
    ((void (*)(void))unk_184A46080)();
    __debugbreak();
  }
  return result;
}