-- xxqf.lua - Tersafe检测屏蔽 最终修复版 (三轮IDA深度逆向)
-- 目标: libtersafe2.so (TenProtect)
-- 核心改进: patch调度器/调用者 → 不动引擎本体 → 不触发CRC → 不闪退
local so=gg.getRangesList("libtersafe2.so")[1]
if not so or so["start"]==0 then gg.alert("未找到libtersafe2.so\n请先进游戏大厅");return end
local B=so["start"]
gg.toast("XXQF修复版 屏蔽中...")
gg.sleep(300)

-- [A-G] 五大引擎调度链切断(不碰引擎本体!)
gg.addListItems({
 [1]={address=B+0x2EDD4C,flags=4,value="~A8 ret",freeze=true},
 [2]={address=B+0x36F4FC,flags=4,value="~A8 ret",freeze=true},
 [3]={address=B+0x4357CC,flags=4,value="~A8 ret",freeze=true},
 [4]={address=B+0x3304EC,flags=4,value="~A8 ret",freeze=true},
 [5]={address=B+0x51B5B8,flags=4,value=0,freeze=true},
 [6]={address=B+0x42080C,flags=4,value="~A8 nop",freeze=true},
 [7]={address=B+0x43E004,flags=4,value="~A8 nop",freeze=true},
})
gg.toast("1/4 引擎调度链已切断")
gg.sleep(200)

-- 数据段标志位清零
gg.addListItems({
 [8]={address=B+0x54BF10,flags=4,value=0,freeze=true},
 [9]={address=B+0x54BF18,flags=4,value=0,freeze=true},
 [10]={address=B+0x54BF20,flags=4,value=0,freeze=true},
 [11]={address=B+0x56AF4C,flags=4,value=0,freeze=true},
 [12]={address=B+0x56AF50,flags=4,value=0,freeze=true},
 [13]={address=B+0x56AFB0,flags=4,value=0,freeze=true},
 [14]={address=B+0x563854,flags=4,value=0,freeze=true},
 [15]={address=B+0x565698,flags=4,value=0,freeze=true},
 [16]={address=B+0x565738,flags=4,value=0,freeze=true},
 [17]={address=B+0x566638,flags=4,value=0,freeze=true},
 [18]={address=B+0x5685F8,flags=4,value=0,freeze=true},
 [19]={address=B+0x2B7B80,flags=4,value=0,freeze=true},
 [20]={address=B+0x2B7B88,flags=4,value=0,freeze=true},
 [21]={address=B+0x2B7B90,flags=4,value=0,freeze=true},
 [22]={address=B+0x2B7BE0,flags=4,value=0,freeze=true},
 [23]={address=B+0x2B7BE8,flags=4,value=0,freeze=true},
})
gg.toast("2/4 标志位已清零")
gg.sleep(200)

-- TDM/CONNECTOR独立上报层
gg.addListItems({
 [24]={address=B+0x4C7118,flags=4,value="~A8 ret",freeze=true},
 [25]={address=B+0x4C676C,flags=4,value="~A8 ret",freeze=true},
 [26]={address=B+0x4C5898,flags=4,value="~A8 ret",freeze=true},
 [27]={address=B+0x4C5B0C,flags=4,value="~A8 ret",freeze=true},
 [28]={address=B+0x4C7078,flags=4,value="~A8 ret",freeze=true},
 [29]={address=B+0x4C739C,flags=4,value="~A8 ret",freeze=true},
 [30]={address=B+0x4C743C,flags=4,value="~A8 ret",freeze=true},
 [31]={address=B+0x4C74FC,flags=4,value="~A8 ret",freeze=true},
})
gg.toast("3/4 TDM/CONNECTOR已屏蔽")
gg.sleep(200)

-- 环境/校验/VM/文件/其他
gg.addListItems({
 [32]={address=B+0x2EF36C,flags=4,value="~A8 ret",freeze=true},
 [33]={address=B+0x2F33B8,flags=4,value="~A8 ret",freeze=true},
 [34]={address=B+0x3D1AC8,flags=4,value="~A8 ret",freeze=true},
 [35]={address=B+0x47F730,flags=4,value="~A8 ret",freeze=true},
 [36]={address=B+0x2DF7B0,flags=4,value="~A8 ret",freeze=true},
 [37]={address=B+0x2F1C70,flags=4,value="~A8 ret",freeze=true},
 [38]={address=B+0x3D95DC,flags=4,value="~A8 ret",freeze=true},
 [39]={address=B+0x4D0548,flags=4,value="~A8 ret",freeze=true},
 [40]={address=B+0x1CCF80,flags=4,value="~A8 ret",freeze=true},
 [41]={address=B+0x4E8CCC,flags=4,value="~A8 ret",freeze=true},
 [42]={address=B+0x4E8F2C,flags=4,value="~A8 ret",freeze=true},
 [43]={address=B+0x4CEB50,flags=4,value="~A8 ret",freeze=true},
 [44]={address=B+0x343518,flags=4,value="~A8 ret",freeze=true},
})
gg.sleep(400)
gg.alert("XXQF修复版完成!\n44组检测点\n\n核心:patch调度器\n不碰引擎本体\n不触发CRC不闪退\n\n等5秒后注入工具")