本帖最后由 shane007 于 2023-8-26 16:14 编辑 ' g+ g/ B$ p+ A5 h4 j
3 p f h7 j) o5 Q/ p; j h我用代理dll的方式,让这个游戏窗口化了。/ n( S- \" t6 Z0 w
随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。
; ~. j! e; a2 b( [4 V在以下地方断下。+ `6 ?; j7 L% f T( H. b
! f$ r: M, V2 O Z& H. p
- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01
\/ M% R5 f; C1 Z& K! o/ | - 地址004096F5
复制代码 & f2 ?! c/ j' v, t# d
; _( a% u6 S5 d; E, k/ a2 p随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,
. Z: t% u/ B# L- W& m, @2 _4 g真正的字幕显示函数需要追到上一层,后续再继续分析0 r a3 ^, V3 R- L0 Y3 ~
. L, A& B4 ~& _6 x w% e
8 D/ q( V" E9 B4 Z+ X( T7 l" e- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)) n v7 X8 B% l; T
- {
7 U( ~' D) c( a) T8 y - _DWORD *v2; // eax
) r- `! k4 Z* K9 f) F - 2 M6 y( g( x/ A
- if ( !dword_5D9B50 ) T- u |! S: v- G& U U
- {
5 }2 X% @% z& a& o, J9 x - if ( !a2 )
2 m% J/ I8 ?9 J* ] - goto LABEL_7;& W& m5 V, b; p% N) q
- if ( strlen(a2) >= 0x80 )) @7 }6 S' t9 o
- {
' E1 |$ t0 x2 B/ ^* } - sub_51AEC6("ASSERT\n", a1);
% ~# X2 ?6 q6 Z3 g' s( m$ y# ` - sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");
' c5 D) f" T; M) N$ `- } O; V: J - sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");
$ `% N/ W* g2 A - sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");
r# E) g2 e8 ^ - }1 [: h9 v* A/ ]3 v
- }
5 C- f0 a! t9 B/ L2 L. Z - if ( a2 )3 i0 ^, Q* P/ g! g" E
- {
1 M% c0 u; [) ^7 W4 I! D9 p - strcpy((char *)&unk_5D3370, a2);' I4 o# ^: ~" u- u' O
- v2 = (_DWORD *)dword_5D3E6C;6 B" z; u" Q' W# |% U
- byte_5D33F0 = 1;
7 w/ Y: K* `3 K) \ - *(_BYTE *)(dword_5D3E6C + 4) = 1;
' ^( m/ T! _9 B) K+ N9 \ - v2[2] = 0;! i Z; `& X8 U) _3 B/ F& A
- v2[4] = 0x100000;
# o0 a7 t7 L" U4 `4 A0 f T - v2[3] = 0;
% @8 I, A5 g8 I% \: P% i6 Y8 L$ J; A0 A - v2[5] = 786432;
, h0 Q* Q: i) B+ O; F7 n( \* q+ s - return;
! u; p- B- [+ R) H' [ - }% L8 R1 J6 E2 o Z$ o O) d
- LABEL_7:
* d i, o: J% r- f4 M - byte_5D33F0 = 0;
% \/ z" D6 S+ b) j7 A X - }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------7 f, r) v' ]( V
- .text:004096ED align 10h
4 q2 f- i0 d8 @3 S - .text:004096F0# ~2 P' f5 y6 W% O
- .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j
' Y- U4 |' @5 ]% t; Y - .text:004096F0 ; sub_409670+8A↓j
( f# p3 V' l1 g# r - .text:004096F0 mov cl, [eax]; s K" s. M* b# G" f
- .text:004096F2 mov [edx+eax], cl
0 f0 x4 I0 r# _5 y% L9 ?, } - .text:004096F5 add eax, 12 b# C) F- Z/ S( D4 R; W# q6 R1 R' u/ V
- .text:004096F8 test cl, cl- i' V W% F- }2 _ Q; b
- .text:004096FA jnz short loc_4096F0
6 r; o( ~5 B9 ]/ C% g1 ]% J - .text:004096FC mov eax, dword_5D3E6C1 b+ [' X, O3 ~5 f# n+ T
- .text:00409701 mov byte_5D33F0, 18 N$ [/ \# @4 U, A
- .text:00409708 mov byte ptr [eax+4], 1/ i; H9 u, b% r$ G8 U3 X$ m3 @# C
- .text:0040970C mov dword ptr [eax+8], 0+ P1 F# {: R& C3 S
- .text:00409713 mov dword ptr [eax+10h], 100000h$ J" C/ Z5 a- T) l8 e, d
- .text:0040971A mov dword ptr [eax+0Ch], 0
3 G: u" V) Z+ A( s: z5 X - .text:00409721 mov dword ptr [eax+14h], 0C0000h" k2 q- H9 o Q p% f: `9 ~
- .text:00409728 retn% d" Z& s Y5 O) M1 t4 }- E
- .text:00409729 ; ---------------------------------------------------------------------------
复制代码
. W$ a3 j7 D3 H2 |2 v |