本帖最后由 shane007 于 2023-8-26 16:14 编辑
! j) q4 G( Y2 \
% R8 N) }) ^9 B" R0 [, b( m* o我用代理dll的方式,让这个游戏窗口化了。
) g6 i) f7 }2 A8 w9 A. V随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。' p/ `7 _* k8 ~. o, X
在以下地方断下。
; C" Z1 J/ X0 Q+ P7 u/ I+ T1 Y* W% j8 [$ k, I
- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01" e; D7 p& I/ X2 ?
- 地址004096F5
复制代码 , @9 T# ^4 }" J
$ H* O+ u* H S- t m2 G
随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,- o1 H' q) H# L* u% U! l1 o: {8 S
真正的字幕显示函数需要追到上一层,后续再继续分析
7 N" q* _! @, t& g) d0 p7 V& B& X8 w% Y. u- s
- 5 ^3 ]" D% @6 B3 U& a* |( g
- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)
4 ^, N' \; ~7 R) G - {$ }3 t0 g& u* V- F
- _DWORD *v2; // eax
2 E* F" F1 r T! F9 H [ - % d% M7 v6 V6 K& p2 D3 J
- if ( !dword_5D9B50 )! q# D- \7 i+ D1 k, n9 p' k3 o
- {9 c0 O7 N* A8 K3 v7 W# T7 w$ l5 [) t
- if ( !a2 )( v: S) T* L& V& c9 g
- goto LABEL_7;
$ T4 j& I1 G: T6 I# h6 M - if ( strlen(a2) >= 0x80 )
: G1 S. i3 l1 p$ p ` - {1 C' d0 m R# d! R! p1 w
- sub_51AEC6("ASSERT\n", a1);. _) e& P% T" r! p, g% x; p* Q
- sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");
! {1 ^/ }) H% ^7 ` - sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");
, D. E$ p1 }% T8 O7 k$ t7 [ - sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");" E* Y. _+ @) t, d
- }
1 h, P; K8 f. K2 I - }
. I+ N, M. T) Q6 h - if ( a2 )* W$ u7 @* x% [6 t! e- _
- {
" @' P; X$ O7 D; b' R5 N - strcpy((char *)&unk_5D3370, a2);
" R4 G2 x+ s( b8 w - v2 = (_DWORD *)dword_5D3E6C;
9 \) @$ L. m; {# s" l* O - byte_5D33F0 = 1;
/ S2 s/ B( z) u5 M: V - *(_BYTE *)(dword_5D3E6C + 4) = 1;0 B, O& }( o+ r2 F0 {
- v2[2] = 0;" T8 _, @* }% x, [0 ]6 r
- v2[4] = 0x100000;6 A3 l+ S2 i/ O8 s- ?* k* p
- v2[3] = 0;
2 f- D8 ]& h: [; ^% X! o: G - v2[5] = 786432;
" d( k! D! ~% a- K1 T - return; c$ i! p5 v4 A& C9 b' n
- }
$ T9 j) ?2 b2 d: i - LABEL_7:, H. n* }4 y( F
- byte_5D33F0 = 0;. t$ A; V" }1 ^8 ]
- }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------
- c$ P E4 \& l O; i7 V - .text:004096ED align 10h
' a- } J9 o4 c9 y - .text:004096F0
. h' B4 y f! y7 j, t/ z; m - .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j
) O9 z _" i& M6 T1 K' h - .text:004096F0 ; sub_409670+8A↓j
' ~( t* t) c# h# n, [ - .text:004096F0 mov cl, [eax]- w& U3 `7 {: ]% n4 B3 P
- .text:004096F2 mov [edx+eax], cl
0 N. M1 J2 k6 {, E6 w+ @ - .text:004096F5 add eax, 1
; T: L' N9 @: O4 y% ?, ] - .text:004096F8 test cl, cl
8 V2 q0 Q' C* g: e( [; i, ~ - .text:004096FA jnz short loc_4096F0* N4 q& ?3 O3 I
- .text:004096FC mov eax, dword_5D3E6C
9 X- u/ V/ g& x; K$ F8 r# i+ s - .text:00409701 mov byte_5D33F0, 1# }. K2 ^1 x# B/ a5 K
- .text:00409708 mov byte ptr [eax+4], 1
( h; G: u/ F+ z2 V* S: {9 i% B U' y - .text:0040970C mov dword ptr [eax+8], 0- v v5 L& e: j: r! h5 Z
- .text:00409713 mov dword ptr [eax+10h], 100000h
# w0 }. S/ V: ~5 R - .text:0040971A mov dword ptr [eax+0Ch], 08 D- A3 u J& n9 X" N; D
- .text:00409721 mov dword ptr [eax+14h], 0C0000h
0 @4 C: ?/ r2 K% }4 P* o. K2 w: Y - .text:00409728 retn
: b5 L) C( q" a$ p; r/ s - .text:00409729 ; ---------------------------------------------------------------------------
复制代码 4 u* @1 I5 Z' Q) d. _& b
|