HearthBuddy 第一次调试

 HearthBuddy

https://www.jiligame.com/70639.html

解压缩包，打开hearthbuddy.exe直接运行就可以；
不用替换mono.dll直接可用；
不需要校验任何文件hash值；
key随便输入什么字符；

by大神beebee102

https://pan.baidu.com/share/init?surl=IMIPJmm6npndufE5Wx44QQ  提取码ac9g

双开教程 https://tieba.baidu.com/p/6054698162?see_lz=1

在运行的时候，提示错误信息

CollectionManagerScene_COLLECTION] An exception occurred when calling CacheCustomDecks: System.MissingMethodException: Method 'CollectionDeckBoxVisual.IsValid' not found.
at Triton.Game.Mono.MonoClass.method_7(String string_4, Enum20[] enum20_0, Object[] object_0)   这是最后触发错误的地方
at Triton.Game.Mono.MonoClass.method_10[T](String string_4, Enum20[] enum20_0, Object[] object_0)
at Triton.Bot.Utility.smethod_4()
at Triton.Bot.Logic.Bots.DefaultBot.DefaultBot.Struct57.MoveNext().  这是入口

MonoClass.method_10调用method_7

    internal T method_10<T>(string string_4, Class276.Enum20[] enum20_0, params object[] object_0) where T : struct
        {
            IntPtr intPtr = this.method_7(string_4, enum20_0, object_0);
            if (intPtr == IntPtr.Zero)
            {
                return default(T);
            }
            if (typeof(T) == typeof(bool))
            {
                IntPtr addr = MonoClass.Class276_0.method_26(intPtr);
                return (T)((object)(MonoClass.ExternalProcessMemory_0.Read<byte>(addr) > 0));
            }
            return MonoClass.ExternalProcessMemory_0.Read<T>(MonoClass.Class276_0.method_26(intPtr));
        }

 
使用dnSpy的搜索功能，Utility.smethod_4，然后发现在foreach循环中，有在调用deckBox.IsValid

internal static void smethod_4()
        {
            try
            {
                CollectionDeckTray collectionDeckTray = CollectionDeckTray.Get();
                if (collectionDeckTray != null)
                {
                    foreach (TraySection traySection in collectionDeckTray.m_decksContent.m_traySections)
                    {
                        CollectionDeckBoxVisual deckBox = traySection.m_deckBox;
                        long deckID = deckBox.GetDeckID();
                        string text = deckBox.m_deckName.Text;
                        bool isWild = deckBox.m_isWild;
                        if (deckID != -1L && deckBox.IsValid())
                        {
                            CustomDeckCache customDeckCache = null;
                            bool flag = true;
                            foreach (CustomDeckCache customDeckCache2 in MainSettings.Instance.CustomDecks)
                            {
                                if (customDeckCache2.DeckId == deckID)
                                {
                                    customDeckCache = customDeckCache2;
                                    customDeckCache.Name = text;
                                    customDeckCache.IsWild = isWild;
                                    customDeckCache.Save();
                                    flag = false;
                                    break;
                                }
                            }
                            if (customDeckCache == null)
                            {
                                customDeckCache = new CustomDeckCache(deckID)
                                {
                                    DeckId = deckID,
                                    HeroCardId = deckBox.m_heroCardID,
                                    Name = deckBox.GetDeckNameText().Text,
                                    IsWild = isWild
                                };
                            }
                            CollectionDeck deck = CollectionManager.Get().GetDeck(deckID);
                            if (!deck.m_netContentsLoaded)
                            {
                                if (customDeckCache.CardIds.Count == 30 && flag)
                                {
                                    MainSettings.Instance.CustomDecks.Add(customDeckCache);
                                }
                            }
                            else
                            {
                                customDeckCache.CardIds.Clear();
                                foreach (CollectionDeckSlot collectionDeckSlot in deck.m_slots)
                                {
                                    for (int i = 0; i < collectionDeckSlot.Count; i++)
                                    {
                                        customDeckCache.CardIds.Add(collectionDeckSlot.CardID);
                                    }
                                }
                                customDeckCache.Save();
                                if (flag)
                                {
                                    MainSettings.Instance.CustomDecks.Add(customDeckCache);
                                    MainSettings.Instance.Save();
                                }
                            }
                        }
                    }
                }
            }
            catch (Exception)
            {
                MainSettings.Instance.CustomDecks.Clear();
                MainSettings.Instance.Save();
                throw;
            }
        }

跳转过去看一下，发现函数是存在的，不太明白为什么会报错

public bool IsValid()
        {
            return base.method_11<bool>("IsValid", Array.Empty<object>());
        }

还是回到smethod_4这个方法，在菜单栏，Edit，选择Edit Class

if (deckID != -1L && deckBox.IsValid())

然后把这个if判断的后半句去掉，再编译一下

然后菜单栏File，Save module,保存成一个exe文件名带日期的  Hearthbuddy-20190713.exe

错误

发现这个exe好像检查自己的文件hash来判断是否正版

2019-07-12 20:00:23,184 [1] INFO Logger (null) - Hearthbuddy Version: 0.3.1446.417
Path: C:Users<Username>DesktopHearthbuddy 0.3.1446.417<ExeName>

OS Name: Microsoft Windows 10 Pro
OS Version: 10.0.17134
OS Architecture: 64-bit
InstalledUICulture: en-US [English (United States)]
CurrentUICulture: en-US [English (United States)]
CurrentCulture: en-US [English (United States)]

2019-07-12 20:00:23,235 [1] INFO Logger (null) - Now setting up JitProfiles...
2019-07-12 20:00:23,239 [1] INFO Logger (null) - JitProfiles successfully setup!
2019-07-12 20:00:23,239 [1] INFO Logger (null) - Now beginning pre-start tasks.
2019-07-12 20:00:23,240 [1] INFO Logger (null) - Now checking prerequisites...
2019-07-12 20:00:24,154 [1] INFO Logger (null) - Prerequisite check complete!
2019-07-12 20:00:24,177 [1] ERROR Logger (null) - The current process file does not match the expected process file. Please reinstall Hearthbuddy.

找到主程序入口，在HearthBuddy下面的APP文件中搜索，找到如下代码。把这个检查直接去掉

if (!first.SequenceEqual(second))
                {
                    App.ilog_0.Error("The current process file does not match the expected process file. Please reinstall Hearthbuddy.");
                    Logger.OpenLogFile();
                    base.Shutdown(1);
                    return;
                }

 移除代码之后，尝试编译发现报错，是因为变量的名字不符合C#的规范导致的

右键选中字段，然后Edit Field，把<>9改成Instance9。<>9_5_0改为Instance9_5_0

这样程序可以运行了，但是其他地方还是会报错isvalid 找不到。

换一个角度思考，直接重命名isvalid为isvalidchuck

搜CollectionDeckBoxVisual.IsValid，然后edit method

 

上面的错误应该是在下面这段代码中触发的，

IntPtr intPtr = this.method_0(string_4, enum20_0);  这一段代码的返回值有问题

internal IntPtr method_7(string string_4, Class276.Enum20[] enum20_0, params object[] object_0)
        {
            IntPtr classInstance = this.GetClassInstance();
            if (classInstance == IntPtr.Zero)
            {
                throw new Exception("Cannot call a method on an object instance that has no address!");
            }
            IntPtr intPtr = this.method_0(string_4, enum20_0);
            if (intPtr == IntPtr.Zero)
            {
                throw new MissingMethodException(this.ClassName, string_4);
            }
            return MonoClass.Class276_0.method_43(intPtr, classInstance, object_0);
        }

 在第二个if里面打印日志，App.ilog_0.Info(stringBuilder);

看了一下method_0的处理

        internal IntPtr method_0(string string_4, Class276.Enum20[] enum20_0)
        {
            if (this.IntPtr_0 == IntPtr.Zero)
            {
                throw new InvalidOperationException("Cannot get a method pointer on an object that has no MonoClass pointer.");
            }
            return MonoClass.smethod_4(this.IntPtr_0, string_4, enum20_0);
        }

最终的处理还是在smethod_4里面，里面的class2拿到是空的。打印enum20_0参数，发现这个参数为空，是null，不确定这个外面传递的参数是否有问题

所以smethod_4函数，只用到了前面2个参数。前面方法传递的this.IntPtr_0不知道是什么

private static IntPtr smethod_4(IntPtr intptr_1, string string_4, Class276.Enum20[] enum20_0)
        {
            MonoClass.Class274 @class = new MonoClass.Class274();
            @class.string_0 = string_4;
            @class.enum20_0 = enum20_0;
            Dictionary<string, List<MonoClass.Class273>> dictionary;
            if (!MonoClass.dictionary_3.TryGetValue(intptr_1, out dictionary))
            {
                MonoClass.dictionary_3.Add(intptr_1, new Dictionary<string, List<MonoClass.Class273>>());
                dictionary = MonoClass.dictionary_3[intptr_1];
            }
            List<MonoClass.Class273> list;
            if (!dictionary.TryGetValue(@class.string_0, out list))
            {
                dictionary.Add(@class.string_0, new List<MonoClass.Class273>());
                list = dictionary[@class.string_0];
            }
            MonoClass.Class273 class2 = list.FirstOrDefault(new Func<MonoClass.Class273, bool>(@class.method_0));
            if (class2 == null)
            {
                IntPtr intPtr = MonoClass.Class276_0.method_33(intptr_1, @class.string_0, @class.enum20_0);
                if (intPtr != IntPtr.Zero)
                {
                    class2 = new MonoClass.Class273(@class.string_0, intPtr, @class.enum20_0);
                    list.Add(class2);
                }
            }
            if (class2 == null)
            {
                return IntPtr.Zero;
            }
            return class2.IntPtr_0;
        }

第一个函数是，在缓存卡组

internal static void smethod_4()
        {
            try
            {
                CollectionDeckTray collectionDeckTray = CollectionDeckTray.Get();
                if (collectionDeckTray != null)
                {
                    foreach (TraySection traySection in collectionDeckTray.m_decksContent.m_traySections)
                    {
                        CollectionDeckBoxVisual deckBox = traySection.m_deckBox;
                        long deckID = deckBox.GetDeckID();
                        string text = deckBox.m_deckName.Text;
                        bool isWild = deckBox.m_isWild;
                        if (deckID != -1L && deckBox.IsValid())
                        {
                            CustomDeckCache customDeckCache = null;
                            bool flag = true;
                            foreach (CustomDeckCache customDeckCache2 in MainSettings.Instance.CustomDecks)
                            {
                                if (customDeckCache2.DeckId == deckID)
                                {
                                    customDeckCache = customDeckCache2;
                                    customDeckCache.Name = text;
                                    customDeckCache.IsWild = isWild;
                                    customDeckCache.Save();
                                    flag = false;
                                    break;
                                }
                            }
                            if (customDeckCache == null)
                            {
                                customDeckCache = new CustomDeckCache(deckID)
                                {
                                    DeckId = deckID,
                                    HeroCardId = deckBox.m_heroCardID,
                                    Name = deckBox.GetDeckNameText().Text,
                                    IsWild = isWild
                                };
                            }
                            CollectionDeck deck = CollectionManager.Get().GetDeck(deckID);
                            if (!deck.m_netContentsLoaded)
                            {
                                if (customDeckCache.CardIds.Count == 30 && flag)
                                {
                                    MainSettings.Instance.CustomDecks.Add(customDeckCache);
                                }
                            }
                            else
                            {
                                customDeckCache.CardIds.Clear();
                                foreach (CollectionDeckSlot collectionDeckSlot in deck.m_slots)
                                {
                                    for (int i = 0; i < collectionDeckSlot.Count; i++)
                                    {
                                        customDeckCache.CardIds.Add(collectionDeckSlot.CardID);
                                    }
                                }
                                customDeckCache.Save();
                                if (flag)
                                {
                                    MainSettings.Instance.CustomDecks.Add(customDeckCache);
                                    MainSettings.Instance.Save();
                                }
                            }
                        }
                    }
                }
            }
            catch (Exception)
            {
                MainSettings.Instance.CustomDecks.Clear();
                MainSettings.Instance.Save();
                throw;
            }
        }

设置断点调试，发现第一次进来classname是CollectionDeckBoxVisual的时候，method name是"GetDeckID"

this是{Triton.Game.Mapping.CollectionDeckBoxVisual}

classInstance是0x233203F0

this.IntPtr_0是0x0B278258

MonoClass.dictionary_3有0x11个元素，也就是16个元素。key-value键值对如下

private static readonly Dictionary<IntPtr, Dictionary<string, List<MonoClass.Class273>>> dictionary_3 = new Dictionary<IntPtr, Dictionary<string, List<MonoClass.Class273>>>();

[0x0B2CD070, Count = 0x00000002]
[0x0B4C7610, Count = 0x00000002]
[0x0B1CCAD8, Count = 0x00000006]
[0x0B1CF9C0, Count = 0x00000002]
[0x0B1DAE28, Count = 0x00000001]
[0x0AAAB438, Count = 0x00000003]
[0x0B37E388, Count = 0x00000002]
[0x0B1B98B8, Count = 0x00000002]
[0x0AC269A8, Count = 0x00000002]
[0x0B4CEC78, Count = 0x00000001]
[0x0B1DAF00, Count = 0x00000002]
[0x0B1BAB40, Count = 0x00000002]
[0x0B394ED8, Count = 0x00000001]
[0x0B2ED1F8, Count = 0x00000001]
[0x0B1B8310, Count = 0x00000003]
[0x0B303008, Count = 0x00000002]
[0x0B278258, Count = 0x00000001]   value是["get_collider", Count = 0x00000000]

Dictionary<string, List<MonoClass.Class273>> dictionary;

key是"get_collider"，value是

if (!dictionary.TryGetValue(@class.string_0, out list))
{

//这里没有tryget失败了，然后进入这里
dictionary.Add(@class.string_0, new List<MonoClass.Class273>());
list = dictionary[@class.string_0];
}

MonoClass.Class273 class2 = list.FirstOrDefault(new Func<MonoClass.Class273, bool>(@class.method_0));
if (class2 == null)
{

进入这里
IntPtr intPtr = MonoClass.Class276_0.method_33(intptr_1, @class.string_0, @class.enum20_0);
if (intPtr != IntPtr.Zero)
{
class2 = new MonoClass.Class273(@class.string_0, intPtr, @class.enum20_0);
list.Add(class2);
}
}

// Token: 0x06001A79 RID: 6777 RVA: 0x000DD024 File Offset: 0x000DB224
        internal IntPtr method_33(IntPtr intptr_37, string string_0, params Class276.Enum20[] enum20_0)
        {
            while (intptr_37 != IntPtr.Zero)
            {
                using (AllocatedMemory allocatedMemory = this.externalProcessMemory_0.CreateAllocatedMemory(256))
                {
                    allocatedMemory.AllocateOfChunk<IntPtr>("Itr");
                    IntPtr intPtr;
                    while ((intPtr = this.method_35(intptr_37, allocatedMemory["Itr"])) != IntPtr.Zero)
                    {
                        IntPtr address = this.method_37(intPtr);
                        if (this.externalProcessMemory_0.ReadStringA(address) == string_0)
                        {
                            if (enum20_0 != null)
                            {
                                Class276.Enum20[] array = this.method_31(intPtr);
                                if (array.Length != enum20_0.Length || !array.SequenceEqual(enum20_0))
                                {
                                    continue;
                                }
                            }
                            return intPtr;
                        }
                    }
                    intptr_37 = this.method_25(intptr_37);
                }
            }
            return IntPtr.Zero;
        }

方法是isvalid是时候，

+ intptr_37 0x0B278258 System.IntPtr

address第一次赋值后是0x0C22AA22

address第二次赋值后是+ address 0x0C266E38 System.IntPtr

+ intPtr 0x0B52C120 System.IntPtr
+ address 0x0C266E38 System.IntPtr

+ intptr_37 0x0B278258 System.IntPtr，这个并且没有在while里面返回

然后执行

intptr_37 = this.method_25(intptr_37);

+ intptr_37 0x0B1BB738 System.IntPtr

回到上面重新进入while循环，再来一次intptr_37 = this.method_25(intptr_37);

+ intptr_37 0x0AA6C1D0 System.IntPtr

+ intptr_37 0x05292F78 System.IntPtr   12152

+ intptr_37 0x05293030 System.IntPtr   12336  和上面相差184

+ intptr_37 0x052930E8 System.IntPtr   12520   相差184

这里会循环很多次，最后return IntPtr.Zero;

// Token: 0x06001A7B RID: 6779 RVA: 0x00013223 File Offset: 0x00011423
        internal IntPtr method_35(IntPtr intptr_37, IntPtr intptr_38)
        {
            return this.method_17<IntPtr>(this.intptr_19, new object[]
            {
                intptr_37,
                intptr_38
            });
        }

this.intptr_0 = this.method_18("mono.dll");

this.intptr_19 = this.intptr_0 + 120353;

this.intptr_21 = this.intptr_0 + 231261;

// Token: 0x06001A69 RID: 6761 RVA: 0x00013183 File Offset: 0x00011383
        private T method_17<T>(IntPtr intptr_37, params object[] object_0) where T : struct
        {

　　　这里的局部变量intptr_37是method_35里面的this.intptr_19
            return this.externalProcessMemory_0.CallInjected<T>(intptr_37, CallingConvention.Cdecl, object_0);
        }

internal IntPtr method_37(IntPtr intptr_37)
{
return this.method_17<IntPtr>(this.intptr_21, new object[]
{
intptr_37
});
}

进入method_7的时候，

第一次遇到

+ this.IntPtr_0 0x0B1F2720 System.IntPtr
string_4 "GetDeckID" string

第二次遇到

+ this.IntPtr_0 0x0B1F2720 System.IntPtr
string_4 "IsValid" string

最终出错是在class Class276的method_33里面拿不到东西

this.externalProcessMemory_0.ReadStringA(address) ".ctor" string
+ address 0x0C191A22 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "get_SCALED_UP_LOCAL_SCALE" string
+ address 0x0C1CDE38 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "set_SCALED_UP_LOCAL_SCALE" string
+ address 0x0C1CDE52 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "Awake" string
+ address 0x0C1C0FDF System.IntPtr  1839071

this.externalProcessMemory_0.ReadStringA(address) "Update" string
+ address 0x0C12E68E System.IntPtr  1238670

this.externalProcessMemory_0.ReadStringA(address) "Show" string
+ address 0x0C1C1174 System.IntPtr  1839476

this.externalProcessMemory_0.ReadStringA(address) "Hide" string
+ address 0x0C18679B System.IntPtr  1599387

this.externalProcessMemory_0.ReadStringA(address) "IsShown" string
+ address 0x0C1C2B02 System.IntPtr  ‭1846018‬

this.externalProcessMemory_0.ReadStringA(address) "SetDeckName" string
+ address 0x0C1CDE6C System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "GetDeckNameText" string
+ address 0x0C1CDE78 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "HideDeckName" string
+ address 0x0C1CDE88 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "ShowDeckName" string
+ address 0x0C1CDE95 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "HideRenameVisuals" string
+ address 0x0C1CDEA2 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "ShowRenameVisuals" string
+ address 0x0C1CDEB4 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "SetDeckID" string
+ address 0x0C1CDEC6 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "GetDeckID" string
+ address 0x0C1CDED0 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "GetCollectionDeck" string
+ address 0x0C1CDEDA System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "GetHeroPortraitTexture" string
+ address 0x0C1CDEEC System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "GetCardDef" string
+ address 0x0C1C29A6 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "GetFullDef" string
+ address 0x0C1CDF03 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "GetClass" string
+ address 0x0C1CD616 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "GetHeroCardID" string
+ address 0x0C1CDF0E System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "SetHeroCardID" string
+ address 0x0C1CDF1C System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "SetHeroCardPremiumOverride" string
+ address 0x0C1CDF2A System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "GetHeroCardPremium" string
+ address 0x0C1CDF45 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "SetShowGlow" string
+ address 0x0C1CDF58 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "IsWild" string
+ address 0x0C1CDF64 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "PlayGlowAnim" string    从这里开始脱节了
+ address 0x0C1CDF6B System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "OnGlowAnimPeak" string
+ address 0x0C1CDF78 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "SetFormat" string   从这里开始又回到正轨了
+ address 0x0C1CDF87 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "SetPositionIndex" string
+ address 0x0C1CDF91 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "GetPositionIndex" string
+ address 0x0C1CDFA2 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "UpdateDeckLabel" string
+ address 0x0C1CDFB3 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "SetDeckNameAsSingleLine" string
+ address 0x0C1CDFC3 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "IsValidForCurrentMode" string
+ address 0x0C1CDFDB System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "CanClickToConvertToStandard" string
+ address 0x0C1CDFF1 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "get_IsMissingCards" string

this.externalProcessMemory_0.ReadStringA(address) "set_IsMissingCards" string
+ address 0x0C1CE020 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "UpdateMissingCardsIndicator" string
+ address 0x0C1CE033 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "IsShared" string
+ address 0x0C1CE04F System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "SetIsShared" string
+ address 0x0C1CE058 System.IntPtr

在islocked上面本来应该有isvalid的，但是没有找到

this.externalProcessMemory_0.ReadStringA(address) "IsLocked" string
+ address 0x0C1CE064 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "SetIsLocked" string
+ address 0x0C1CE06D System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "IsSelected" string
+ address 0x0C1C7550 System.IntPtr

this.externalProcessMemory_0.ReadStringA(address) "SetIsSelected" string
+ address 0x0C1CE079 System.IntPtr

- this {ns27.Class276} ns27.Class276
+ dictionary_0 Count = 0x0000000F System.Collections.Generic.Dictionary<System.Type, System.IntPtr>
+ externalProcessMemory_0 {GreyMagic.ExternalProcessMemory} GreyMagic.ExternalProcessMemory
+ intptr_0 0x10000000 System.IntPtr
+ intptr_1 0x100191C7 System.IntPtr
+ intptr_10 0x1002B350 System.IntPtr
+ intptr_11 0x1006220D System.IntPtr
+ intptr_12 0x1002B121 System.IntPtr
+ intptr_13 0x10037380 System.IntPtr
+ intptr_14 0x10036ECA System.IntPtr
+ intptr_15 0x10038470 System.IntPtr
+ intptr_16 0x100165DF System.IntPtr
+ intptr_17 0x10080386 System.IntPtr
+ intptr_18 0x1007F8A1 System.IntPtr
+ intptr_19 0x1001D621 System.IntPtr
+ intptr_2 0x100B30F3 System.IntPtr
+ intptr_20 0x100165B2 System.IntPtr
+ intptr_21 0x1003875D System.IntPtr
+ intptr_22 0x1005E214 System.IntPtr
+ intptr_23 0x10068901 System.IntPtr
+ intptr_24 0x1005E1B8 System.IntPtr
+ intptr_25 0x1005F14F System.IntPtr
+ intptr_26 0x1005D8A3 System.IntPtr
+ intptr_27 0x1007DF61 System.IntPtr
+ intptr_28 0x100165A7 System.IntPtr
+ intptr_29 0x10027C32 System.IntPtr
+ intptr_3 0x100165D4 System.IntPtr
+ intptr_30 0x10016635 System.IntPtr
+ intptr_31 0x1007F72E System.IntPtr
+ intptr_32 0x1005F22D System.IntPtr
+ intptr_33 0x1005C820 System.IntPtr
+ intptr_34 0x1005DD17 System.IntPtr
+ intptr_35 0x100164BF System.IntPtr
+ intptr_36 0x1005D6D3 System.IntPtr
+ intptr_4 0x10012DB5 System.IntPtr
+ intptr_5 0x100B305F System.IntPtr
+ intptr_6 0x10013355 System.IntPtr
+ intptr_7 0x10011F91 System.IntPtr
+ intptr_8 0x1001A2FD System.IntPtr
+ intptr_9 0x10027C38 System.IntPtr

- this.externalProcessMemory_0.Process {System.Diagnostics.Process (Hearthstone)} System.Diagnostics.Process
Associated true bool
BasePriority 0x00000008 int
CanRaiseEvents true bool
CanRaiseEventsInternal true bool
Container null System.ComponentModel.IContainer
DesignMode false bool
EnableRaisingEvents true bool
+ Events {System.ComponentModel.EventHandlerList} System.ComponentModel.EventHandlerList
+ ExitCode {System.InvalidOperationException: Process must exit before requested information can be determined.
at System.Diagnostics.Process.EnsureState(State state)
at System.Diagnostics.Process.get_ExitCode()} int {System.InvalidOperationException}
+ ExitTime {System.InvalidOperationException: Process must exit before requested information can be determined.
at System.Diagnostics.Process.EnsureState(State state)
at System.Diagnostics.Process.get_ExitTime()} System.DateTime {System.InvalidOperationException}
+ Handle 0x00000890 System.IntPtr
HandleCount 0x0000040C int
HasExited false bool
Id 0x00001E8C int
Identity null object
MachineName "." string
+ MainModule {System.Diagnostics.ProcessModule (Hearthstone.exe)} System.Diagnostics.ProcessModule
+ MainWindowHandle 0x00020514 System.IntPtr
MainWindowTitle "炉石传说" string
+ MaxWorkingSet 0x00159000 System.IntPtr
+ MinWorkingSet 0x00032000 System.IntPtr
+ Modules {System.Diagnostics.ProcessModuleCollection} System.Diagnostics.ProcessModuleCollection
NonpagedSystemMemorySize 0x00014E00 int
NonpagedSystemMemorySize64 0x0000000000014E00 long
+ OperatingSystem {Microsoft Windows NT 6.2.9200.0} System.OperatingSystem
PagedMemorySize 0x246CC000 int
PagedMemorySize64 0x00000000246CC000 long
PagedSystemMemorySize 0x00084A00 int
PagedSystemMemorySize64 0x0000000000084A00 long
PeakPagedMemorySize 0x28BD5000 int
PeakPagedMemorySize64 0x0000000028BD5000 long
PeakVirtualMemorySize 0x35EED000 int
PeakVirtualMemorySize64 0x0000000035EED000 long
PeakWorkingSet 0x28753000 int
PeakWorkingSet64 0x0000000028753000 long
PriorityBoostEnabled true bool
PriorityClass Normal System.Diagnostics.ProcessPriorityClass
PrivateMemorySize 0x246CC000 int
PrivateMemorySize64 0x00000000246CC000 long
+ PrivilegedProcessorTime {00:08:20.5000000} System.TimeSpan
ProcessName "Hearthstone" string
+ ProcessorAffinity 0x0000000F System.IntPtr
Responding true bool
+ SafeHandle {Microsoft.Win32.SafeHandles.SafeProcessHandle} Microsoft.Win32.SafeHandles.SafeProcessHandle
SessionId 0x00000001 int
Site null System.ComponentModel.ISite
+ StandardError {System.InvalidOperationException: StandardError has not been redirected.
at System.Diagnostics.Process.get_StandardError()} System.IO.StreamReader {System.InvalidOperationException}
+ StandardInput {System.InvalidOperationException: StandardIn has not been redirected.
at System.Diagnostics.Process.get_StandardInput()} System.IO.StreamWriter {System.InvalidOperationException}
+ StandardOutput {System.InvalidOperationException: StandardOut has not been redirected or the process hasn't started yet.
at System.Diagnostics.Process.get_StandardOutput()} System.IO.StreamReader {System.InvalidOperationException}
+ StartInfo {System.Diagnostics.ProcessStartInfo} System.Diagnostics.ProcessStartInfo
+ StartTime {07/13/2019 15:49:19} System.DateTime
SynchronizingObject null System.ComponentModel.ISynchronizeInvoke
+ Threads {System.Diagnostics.ProcessThreadCollection} System.Diagnostics.ProcessThreadCollection
+ TotalProcessorTime {00:27:20.3906250} System.TimeSpan
+ UserProcessorTime {00:18:59.9687500} System.TimeSpan
VirtualMemorySize 0x33710000 int
VirtualMemorySize64 0x0000000033710000 long
WorkingSet 0x0B497000 int
WorkingSet64 0x000000000B497000 long
disposed false bool
+ error null System.Diagnostics.AsyncStreamReader
ErrorDataReceived null System.Diagnostics.DataReceivedEventHandler
errorStreamReadMode undefined System.Diagnostics.Process.StreamReadMode
+ events {System.ComponentModel.EventHandlerList} System.ComponentModel.EventHandlerList
exitCode 0x00000103 int
exited false bool
+ exitTime {01/01/0001 00:00:00} System.DateTime
haveExitTime false bool
haveMainWindow true bool
havePriorityBoostEnabled true bool
havePriorityClass true bool
haveProcessHandle true bool
haveProcessId true bool
haveProcessorAffinity true bool
haveResponding false bool
haveWorkingSetLimits true bool
isRemoteMachine false bool
machineName "." string
+ mainWindowHandle 0x00020514 System.IntPtr
mainWindowTitle "炉石传说" string
+ maxWorkingSet 0x00159000 System.IntPtr
+ minWorkingSet 0x00032000 System.IntPtr
+ modules {System.Diagnostics.ProcessModuleCollection} System.Diagnostics.ProcessModuleCollection
m_processAccess 0x001F0FFF int
+ m_processHandle {Microsoft.Win32.SafeHandles.SafeProcessHandle} Microsoft.Win32.SafeHandles.SafeProcessHandle
+ onExited {System.EventHandler} System.EventHandler
+ operatingSystem {Microsoft Windows NT 6.2.9200.0} System.OperatingSystem
+ output null System.Diagnostics.AsyncStreamReader
OutputDataReceived null System.Diagnostics.DataReceivedEventHandler
outputStreamReadMode undefined System.Diagnostics.Process.StreamReadMode
pendingErrorRead false bool
pendingOutputRead false bool
priorityBoostEnabled true bool
priorityClass Normal System.Diagnostics.ProcessPriorityClass
processId 0x00001E8C int
+ processInfo {System.Diagnostics.ProcessInfo} System.Diagnostics.ProcessInfo
+ processorAffinity 0x0000000F System.IntPtr
raisedOnExited false bool
+ registeredWaitHandle {System.Threading.RegisteredWaitHandle} System.Threading.RegisteredWaitHandle
responding true bool
signaled false bool
site null System.ComponentModel.ISite
+ standardError null System.IO.StreamReader
+ standardInput null System.IO.StreamWriter
+ standardOutput null System.IO.StreamReader
+ startInfo {System.Diagnostics.ProcessStartInfo} System.Diagnostics.ProcessStartInfo
synchronizingObject null System.ComponentModel.ISynchronizeInvoke
+ threads {System.Diagnostics.ProcessThreadCollection} System.Diagnostics.ProcessThreadCollection
+ waitHandle {System.Diagnostics.ProcessWaitHandle} System.Threading.WaitHandle {System.Diagnostics.ProcessWaitHandle}
watchForExit true bool
watchingForExit true bool
__identity null object

我发下教程 打开HearthstoneHearthstone_DataPlugins 删除king-sdk.dll文件 
打开HearthstoneHearthstone_DataMono 替换mono.dll
文件地址 /s/1urwX_TsqBtZXFRekJsbrJA 密码: c7wr

https://pan.baidu.com/s/1urwX_TsqBtZXFRekJsbrJA

尝试下载并替换，炉石可以正常启动，但是启动hearthbuddy会导致炉石crash