The following start numbers are the bottom middle position after UE opens M2.
I will not give a compilation explanation here. The following is the result after replacing it from the specific address.
The following can successfully implement the warehouse password after any original unencrypted delphi version of M2 except Shenzhou M2.
Those who have used the renshouren tool should know what the previous number means
856668 Backdoor instruction receiving part (i.e. the original backdoor part)
6A006A004975F9538955F88945FC8B45F8E80E22F3FF33C0556889534D0
064FF30648920837DF8000F842B3400008B45FC80B846020000000F8481
000000C680460200000033D28B45F8E8751CF8FF8BD08B45FC80B84702
00000075233B90230100007551C6804702000001BAA0534D0033C98B45
FCE84D92FEFFE9D93300008990230100008BC28D9504FEFFFFE8D172F3F
F8B8D04FEFFFF8D8508FEFFFFBAB0534D00E81320F3FF8B9508FEFFFFB90
1000000EBBDBAC4534D00EBB49090
858466 The backdoor command input and judgment part (where is the subordinate attack)
75538B45FC8B809C020000837808000F8E3E2D00008B45FC8A80A0020
00034018B55FC8882A00200008B45FC80B8A0020000007407BA9C564D
00EB07BAB4564D009090B9010000008B45FCE8728BFEFFE9FE2C0000B
ACC564D008B45F0E87C67F3FF85C075486A006A006A006A006A0066B9
B0288B55FC8B45FCC6804602000001E87460FEFF8B45FCBAAC5B4D008
0B847020000007405BA6C5B4D00B9010000008B45FCE8198BFEFFE9A
52C0000
864582 Jump to clearstorage command
E971010000ffffffff
864956 clearstorage command part
BA745F4D008B45F0E8774EF3FF85C00F8547010000A190A44E008B008B
55ECE860A7FDFF8945D0837DD00074758D851CFEFFFF8B55D083C215E
876FFF2FFFFB51CFEFFFF68895F4D008D9518FEFFFF8B45D08B80230100
00E8A752F3FFFFB518FEFFFF8D853CFEFFFFBA03000000E85D00F3FF8B9
53CFEFFFFB9010000008B45FCE8E271FEFF33D28B45D0899023010000B
A9D5F4D0033C9E8CB71FEFFE9571300008D853CFEFFFFB91CC54C008B
55ECE8A7FFF2FF8B953CFEFFFF8B45FCEBD600000000
870296 Warehouse unlocking New Warehouse password Password error Field part
FFFFFFFF08000000B2D6BFE2BFAACBF8FFFFFFFF0B000000B2D6BFE2D0C
2C3DCC2EB2000FFFFFFFF08000000C3DCC2EBB4EDCEF3
871108 The original backdoor command field is changed to storage
FFFFFFFF0700000073746F7261676500
872300 Required fields
Please press Enter again to enter the new password of the warehouse. Please press Enter again to enter the warehouse unlock password.
C7EBD4D9B0B4D2BBB4CEBBD8B3B5BCFCCAE4C8EBB2D6BFE2D0C2B5C
4C3DCC2EBA1A30000FFFFFFFF0800000073686F77756E697400000000
FFFFFFFF22000000C7EBD4D9B0B4D2BBB4CEBBD8B3B5BCFCCAE4C8EB
B2D6BFE2BFAACBF8C3DCC2EBA1A3
873324 Required fields
clearstorage The old password is your repository password has been cleared, and the current password is 0
FFFFFFFF0C000000636C65617273746F7261676500FFFFFFFF0B000000
BEC9B5C4C3DCC2EBCAC72000FFFFFFFF2200000020C4E3B5C4B2D6B
FE2C3DCC2EBD2D1BEADC7E5B3FDA3ACB5B1C7B0C3DCC2EBCAC73000
898864 Warehouse under the first charging mode
80B84702000000909090909090
899474 The change here is to cooperate with the following originally 44 Since the characters below have been changed, we need to change here 42
BA42C64D00
899642 You must use @storage to open the repository password lock
FFFFFFFF20000000C4E3B1D8D0EBCFC8D3C34073746F72616765B4F
2BFAAB2D6BFE2C3DCC2EBCBF80000
899755 Warehouse under the second charging mode
80B84702000000
900584 You must use @storage to open the repository password lock
FFFFFFFF20000000C4E3B1D8D0EBCFC8D3C34073746F72616765B4F
2BFAAB2D6BFE2C3DCC2EBCBF8