本帖最后由 shane007 于 2023-8-26 16:14 编辑
- y! r |6 o* s( r' T" l' o! L9 C# P4 f) t0 S% W5 ~5 {) Q7 h- L) u( f
我用代理dll的方式,让这个游戏窗口化了。
* c- v3 h* x3 |. F8 d: \6 M随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。& ?" I" l/ ?0 e% ^: U8 U1 o# O
在以下地方断下。. _& K9 U. [5 c. I
4 s: |/ K/ p1 j" r' T& J% `
- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01
) \5 S5 T& O) B9 b* D" T) I - 地址004096F5
复制代码 8 X+ Y8 I. r# ~- n
8 [3 i2 y# v$ W随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,
9 _' s, Q* e* P4 ?" r真正的字幕显示函数需要追到上一层,后续再继续分析: G( ?3 m2 I2 s( k: @
" U% O) d- N, N7 H9 R- z- g0 S2 T+ O6 X& u6 I7 Y6 P1 M
- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)1 h6 B. q1 C" J3 g- ?% ]
- {
; [/ j* C1 Q' C% |8 X - _DWORD *v2; // eax3 w: A# D, ?) V9 B
: J1 I) o( m7 t& p8 K6 V7 r& M: P- if ( !dword_5D9B50 )
1 d. K6 S: i" }4 m) T! V8 s - {
- Q- @! n `8 e/ j( i3 S; ] - if ( !a2 )
) l# q2 @4 D5 B9 q! Z c% l - goto LABEL_7;
5 r: @3 ]. E/ m* W8 K+ ~2 E - if ( strlen(a2) >= 0x80 )* x( g v+ H- x/ w* r7 @
- {+ L0 X) l1 E( i" q, [9 z w
- sub_51AEC6("ASSERT\n", a1);5 E; I/ z2 j$ E0 p ]- `
- sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");6 T* i0 P% p. V6 }: n$ e
- sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");, u9 T7 P& P3 M7 n; q: y4 P
- sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");
5 ]1 G4 d% J3 [+ S - }% Y( J. ^( L& Y% s& U
- }
6 M$ J. Z* ?" w: g - if ( a2 )
* B2 ?8 T- H+ f- a0 t& X9 U2 Y( D) j$ s6 s( o - {
! P7 a7 a7 T9 k) Y# j( b4 D - strcpy((char *)&unk_5D3370, a2);
& ]; _9 e' [" s0 Y( b. x( T) a - v2 = (_DWORD *)dword_5D3E6C;3 e8 |2 b/ L, N H* \
- byte_5D33F0 = 1;! q/ U8 r" A, p7 |* c0 X* D
- *(_BYTE *)(dword_5D3E6C + 4) = 1;- i3 F$ `! M8 b$ T' ]! }. I
- v2[2] = 0;/ J" y- I$ |. R( H( P& P0 H! S6 z; J
- v2[4] = 0x100000;6 `( \. m8 z! I: O9 \
- v2[3] = 0;
/ k4 i( Y! u3 N" M" C1 C( n - v2[5] = 786432;
- O# F6 E% P5 l+ ]! ]( p* I4 w8 S - return;; c/ `$ K% ~+ y U8 C: W
- }
2 O1 j/ o- R' u0 h - LABEL_7:
' T" t7 j) w7 D: M& n - byte_5D33F0 = 0;* N5 Y8 k, V# |' B: |1 J
- }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------
' D( A. c0 L% ^5 E0 O: [/ Y* H - .text:004096ED align 10h
~3 f0 h+ ?% l& B - .text:004096F0
, o% r! ^) D" b+ O - .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j% |6 o8 g9 A1 X) Z
- .text:004096F0 ; sub_409670+8A↓j
D0 a; K1 k2 }! m T- ` - .text:004096F0 mov cl, [eax]9 ^& k4 w8 U/ E( S
- .text:004096F2 mov [edx+eax], cl
2 \$ t* O7 X2 x3 j - .text:004096F5 add eax, 1
2 I4 m9 n5 Z: J, I; `3 ]/ w4 { - .text:004096F8 test cl, cl; J7 \2 T% n8 @/ T9 P" b
- .text:004096FA jnz short loc_4096F00 K1 N$ w" v! x
- .text:004096FC mov eax, dword_5D3E6C' I5 V( u0 P1 ~8 h1 W( t, Y8 k6 j, H
- .text:00409701 mov byte_5D33F0, 1' A$ A& @( P; P: n: e
- .text:00409708 mov byte ptr [eax+4], 17 E L+ J" M. A- T% R* I6 X& }
- .text:0040970C mov dword ptr [eax+8], 0# L2 [6 x0 U7 k
- .text:00409713 mov dword ptr [eax+10h], 100000h
M6 p3 e/ |" N - .text:0040971A mov dword ptr [eax+0Ch], 0& H0 @! a* v) K" u" t& V. |# O
- .text:00409721 mov dword ptr [eax+14h], 0C0000h& F- j& `$ J |2 Z
- .text:00409728 retn
) `; I( G6 p9 u* p [& o7 V - .text:00409729 ; ---------------------------------------------------------------------------
复制代码 3 j. u9 p: b: `6 H1 ~; f' ~
|