-- xxqf.lua - Tersafe反作弊全面检测屏蔽 最终版 (三轮IDA深度分析)
-- 目标: libtersafe2.so (TenProtect) | 检测点: 58组/50+
-- 策略: 数据段清零(安全) > 引擎内部nop > TDM层ret > 小函数ret
-- 用法: 进游戏大厅→运行→等5秒→注入工具

local so = gg.getRangesList("libtersafe2.so")[1]
if not so or so["start"] == 0 then
    gg.alert("未找到 libtersafe2.so\n请先进入游戏大厅再运行\n\n如库名不同请修改脚本第一行")
    return
end
local B = so["start"]
gg.toast("XXQF最终版 58组检测点屏蔽中...")
gg.sleep(400)

-- === 第1组: 数据段标志位清零 (16项,零风险) ===
gg.addListItems({
 [1] ={address=B+0x54BF10,flags=4,value=0,freeze=true},
 [2] ={address=B+0x54BF18,flags=4,value=0,freeze=true},
 [3] ={address=B+0x54BF20,flags=4,value=0,freeze=true},
 [4] ={address=B+0x56AF4C,flags=4,value=0,freeze=true},
 [5] ={address=B+0x56AF50,flags=4,value=0,freeze=true},
 [6] ={address=B+0x56AFB0,flags=4,value=0,freeze=true},
 [7] ={address=B+0x563854,flags=4,value=0,freeze=true},
 [8] ={address=B+0x565698,flags=4,value=0,freeze=true},
 [9] ={address=B+0x565738,flags=4,value=0,freeze=true},
 [10]={address=B+0x566638,flags=4,value=0,freeze=true},
 [11]={address=B+0x5685F8,flags=4,value=0,freeze=true},
 [12]={address=B+0x2B7B80,flags=4,value=0,freeze=true},
 [13]={address=B+0x2B7B88,flags=4,value=0,freeze=true},
 [14]={address=B+0x2B7B90,flags=4,value=0,freeze=true},
 [15]={address=B+0x2B7BE0,flags=4,value=0,freeze=true},
 [16]={address=B+0x2B7BE8,flags=4,value=0,freeze=true},
})
gg.toast("1/5 标志位已清零")
gg.sleep(200)

-- === 第2组: 五大巨型扫描引擎 内部switch跳转nop (11项) ===
gg.addListItems({
 [17]={address=B+0x31F358,flags=4,value="~A8 nop",freeze=true},
 [18]={address=B+0x31F424,flags=4,value="~A8 nop",freeze=true},
 [19]={address=B+0x31F698,flags=4,value="~A8 nop",freeze=true},
 [20]={address=B+0x32104C,flags=4,value="~A8 nop",freeze=true},
 [21]={address=B+0x3213A0,flags=4,value="~A8 nop",freeze=true},
 [22]={address=B+0x330388,flags=4,value="~A8 nop",freeze=true},
 [23]={address=B+0x3295C4,flags=4,value="~A8 nop",freeze=true},
 [24]={address=B+0x458E84,flags=4,value="~A8 nop",freeze=true},
 [25]={address=B+0x45F8E0,flags=4,value="~A8 nop",freeze=true},
 [26]={address=B+0x35A644,flags=4,value="~A8 nop",freeze=true},
 [27]={address=B+0x3468F8,flags=4,value="~A8 nop",freeze=true},
})
gg.toast("2/5 五大引擎已屏蔽")
gg.sleep(200)

-- === 第3组: TDM/CONNECTOR独立上报层 ret (8项) ===
gg.addListItems({
 [28]={address=B+0x4C7118,flags=4,value="~A8 ret",freeze=true},
 [29]={address=B+0x4C676C,flags=4,value="~A8 ret",freeze=true},
 [30]={address=B+0x4C5898,flags=4,value="~A8 ret",freeze=true},
 [31]={address=B+0x4C5B0C,flags=4,value="~A8 ret",freeze=true},
 [32]={address=B+0x4C7078,flags=4,value="~A8 ret",freeze=true},
 [33]={address=B+0x4C739C,flags=4,value="~A8 ret",freeze=true},
 [34]={address=B+0x4C743C,flags=4,value="~A8 ret",freeze=true},
 [35]={address=B+0x4C74FC,flags=4,value="~A8 ret",freeze=true},
})
gg.toast("3/5 TDM/CONNECTOR已屏蔽")
gg.sleep(200)


-- === 第4组: 核心扫描/校验层 内部nop (12项) ===
gg.addListItems({
 [36]={address=B+0x3FED18,flags=4,value="~A8 nop",freeze=true},
 [37]={address=B+0x3FED60,flags=4,value="~A8 nop",freeze=true},
 [38]={address=B+0x3FEDB0,flags=4,value="~A8 nop",freeze=true},
 [39]={address=B+0x3FEE00,flags=4,value="~A8 nop",freeze=true},
 [40]={address=B+0x3FF348,flags=4,value="~A8 nop",freeze=true},
 [41]={address=B+0x3FF460,flags=4,value="~A8 nop",freeze=true},
 [42]={address=B+0x41B51C,flags=4,value="~A8 nop",freeze=true},
 [43]={address=B+0x41B6E0,flags=4,value="~A8 nop",freeze=true},
 [44]={address=B+0x34359C,flags=4,value="~A8 nop",freeze=true},
 [45]={address=B+0x4E8D2C,flags=4,value="~A8 nop",freeze=true},
 [46]={address=B+0x4E8F54,flags=4,value="~A8 nop",freeze=true},
 [47]={address=B+0x4CEBE0,flags=4,value="~A8 nop",freeze=true},
})
gg.toast("4/5 扫描/校验层已屏蔽")
gg.sleep(200)

-- === 第5组: 环境/VM/文件/其他 ret (11项) ===
gg.addListItems({
 [48]={address=B+0x2EF36C,flags=4,value="~A8 ret",freeze=true},
 [49]={address=B+0x2F33B8,flags=4,value="~A8 ret",freeze=true},
 [50]={address=B+0x3D1AC8,flags=4,value="~A8 ret",freeze=true},
 [51]={address=B+0x47F730,flags=4,value="~A8 ret",freeze=true},
 [52]={address=B+0x2DF7B0,flags=4,value="~A8 ret",freeze=true},
 [53]={address=B+0x2F1C70,flags=4,value="~A8 ret",freeze=true},
 [54]={address=B+0x3D95DC,flags=4,value="~A8 ret",freeze=true},
 [55]={address=B+0x4D0548,flags=4,value="~A8 ret",freeze=true},
 [56]={address=B+0x1CCF80,flags=4,value="~A8 ret",freeze=true},
 [57]={address=B+0x4E8CCC,flags=4,value="~A8 ret",freeze=true},
 [58]={address=B+0x4E8F2C,flags=4,value="~A8 ret",freeze=true},
})
gg.toast("5/5 环境/VM/文件层已屏蔽")

-- === 完成 ===
gg.sleep(500)
gg.alert([[
================================
  XXQF 最终版 已完成!
  58组 / 50+检测点已屏蔽

  涵盖三轮IDA分析:
  * 五大巨型扫描引擎(>140KB)
  * TDM/CONNECTOR独立上报
  * ChkInit/ChkGameStatus校验
  * VM执行/QA时序/全部标志位

  请等5秒后再注入内存工具
  如仍闪退需改用ptrace C方案
================================]])