本帖最后由 shane007 于 2023-8-26 16:14 编辑 - J ^5 [7 U: u1 _% @# V
2 ^% ~, W2 I* R; v8 A
我用代理dll的方式,让这个游戏窗口化了。
+ ^7 T9 u$ ?' a/ } b( H' E1 h2 `随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。' P: x ] d/ M% Z% A& @
在以下地方断下。
4 n! v3 P7 V. d3 Z* b1 Y$ X: b. ^" n/ u
- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01
( B! _" K% v- _( d# F - 地址004096F5
复制代码
! ]" n2 O7 s2 V3 B; m+ Q" d* m/ }: h; p8 c2 H6 Q D
随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,' a- ^* x( D3 K( c- H& t# k: B! G
真正的字幕显示函数需要追到上一层,后续再继续分析
7 {# a! q* F+ G3 u7 Q
1 z) J& {) x8 Y" _1 v
' O# Y$ W P+ g- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)0 q3 N' J* T4 {# b) E1 X
- {$ T8 t/ E; }! S3 L5 n# i# d
- _DWORD *v2; // eax
4 r# {! `& }% r0 p8 R - " e" c( X, \# c0 G- b' I1 u
- if ( !dword_5D9B50 )) i: P" L% V7 f
- {
* g3 w1 e: H! O# K+ { - if ( !a2 )6 ~& F+ _$ s6 D/ K5 F6 c
- goto LABEL_7;
( ]9 v2 n6 b" s* M5 \8 v; t - if ( strlen(a2) >= 0x80 )
1 s1 L8 n8 r* o9 s; I; L - {0 x8 `* F0 l5 B8 k W
- sub_51AEC6("ASSERT\n", a1);
( l# M% Z+ j$ C - sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");
) `8 Z# u' P( D1 N - sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");; n; b# P8 g7 P5 X# I9 j1 o3 h
- sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");
/ C3 m* E7 Q6 N5 n3 b' Z7 t - }
6 v1 z/ E& ?; o& T6 M/ j - }
4 f& ^$ B5 }5 q9 f9 w. R- w7 M - if ( a2 )* @: _, w" L+ k U z6 s8 _
- {
; M5 m% f$ c& k - strcpy((char *)&unk_5D3370, a2);
c. `* U; q' W) x0 Z. S: ^/ f; c - v2 = (_DWORD *)dword_5D3E6C;/ _& S) Q" X- a5 v1 l
- byte_5D33F0 = 1;
, y5 D) `% W" B' H4 z1 Q - *(_BYTE *)(dword_5D3E6C + 4) = 1;
; m% @+ @! E& T! {1 R8 } - v2[2] = 0;
1 B- Y- |' s( A# j) m+ {- \- T - v2[4] = 0x100000;
2 u+ j, r+ x$ _/ ?& x - v2[3] = 0;- c& r/ u4 Z- H3 N0 G/ u7 t
- v2[5] = 786432;3 f$ G/ B( a" G; n- X
- return;
# |& H5 {- _2 ~ B+ _8 [ - }: N) Z* Y, `9 T7 [% B% p: F
- LABEL_7:
2 `9 w0 D/ T4 M - byte_5D33F0 = 0;
6 R3 r: n" N) g! `, A2 s - }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------
- r7 Q O+ m3 k - .text:004096ED align 10h5 \! @& q; X. ^2 K0 _
- .text:004096F0 q0 w- q/ i9 v
- .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j& M$ K: k& [9 K2 V# V; q3 _. M
- .text:004096F0 ; sub_409670+8A↓j
# y Z8 G2 G% ]5 J& |7 z. g - .text:004096F0 mov cl, [eax]/ m: f; O( M/ F. s$ N* k
- .text:004096F2 mov [edx+eax], cl
, A1 [& x" } ~ - .text:004096F5 add eax, 1
: C$ j y1 [8 _/ v9 h - .text:004096F8 test cl, cl' c7 a5 t9 q$ t. k6 u0 e# v" Q
- .text:004096FA jnz short loc_4096F0
c2 y' V% m& V6 n - .text:004096FC mov eax, dword_5D3E6C4 ]$ @4 Q6 C+ e, q
- .text:00409701 mov byte_5D33F0, 1% w# ~6 B8 @- S; b+ r. K
- .text:00409708 mov byte ptr [eax+4], 1! N/ `) }9 v" E' k/ r6 H
- .text:0040970C mov dword ptr [eax+8], 0" J6 [0 ^/ _4 g- z/ h: \3 B/ r
- .text:00409713 mov dword ptr [eax+10h], 100000h
6 o0 z* i- V3 j - .text:0040971A mov dword ptr [eax+0Ch], 0
. \4 H# T5 }, H4 L M4 Y+ H - .text:00409721 mov dword ptr [eax+14h], 0C0000h
Q0 E% v: Y, e - .text:00409728 retn
( w. e* k5 g" e - .text:00409729 ; ---------------------------------------------------------------------------
复制代码 ( z( m; S5 U4 f @, G* M
|