本帖最后由 shane007 于 2023-8-26 16:14 编辑
$ ~1 M; K( d! `, Z
: c5 w. u6 E+ F# Y) P5 o& }我用代理dll的方式,让这个游戏窗口化了。/ l% O3 R: O' ~* ?; a0 [
随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。
& f2 n7 {) _7 t2 p在以下地方断下。
7 C! ]! y0 C0 Q/ j
3 Q. L' X+ s4 Y. i8 H9 A3 I- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01
; d% H8 }8 w, Y - 地址004096F5
复制代码 $ O! Y* F% y9 H2 p' `
4 B, Q J, s- R+ w
随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,& ?/ I: C& d3 F( w% b5 w. Q
真正的字幕显示函数需要追到上一层,后续再继续分析
$ V7 i7 W/ \" g7 ^* t q; Q6 g5 H% Y b' S: A% o$ T3 y
" j8 Z2 Z2 l0 H! F- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)
- T7 c# J* l: q! C8 R4 V( N - {* [( O2 a7 W& n: m4 C
- _DWORD *v2; // eax5 V) v) i4 E' z2 e& e0 }2 D
- 0 B c3 T5 T$ W" a
- if ( !dword_5D9B50 )/ E! e7 d' M1 N6 ?# J, A6 `- j2 I
- {# O) ~! X# U8 O; c% h) G9 H
- if ( !a2 )! h; r7 U) K6 r8 ?3 k% d( W5 u6 X4 c
- goto LABEL_7;, `7 A# l5 r3 n, I" Y, E" i# n8 Q
- if ( strlen(a2) >= 0x80 )# a6 o$ @% m+ Z: P' {+ u: c' L
- {
. t L* {3 X8 M( W0 y+ s8 y- F( K - sub_51AEC6("ASSERT\n", a1);. P2 p( l: @/ |% u$ L
- sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");: e% X* A8 C& `
- sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");2 E3 c: |; i* k$ i$ C
- sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");
! c4 F+ Q. g, C% ?9 D - }
' G& j( j% g4 o4 }8 y0 x4 C& ~ - }6 i: q( i/ `- R' T) a5 L* r
- if ( a2 )
# \- G& G' k; i) k3 X1 F - {# |$ \+ I; F$ C2 z+ G1 S
- strcpy((char *)&unk_5D3370, a2);
( L4 A2 _/ p5 r {, Y- Q! Y - v2 = (_DWORD *)dword_5D3E6C;
3 _7 i H5 a; E7 t1 k - byte_5D33F0 = 1;! G- w3 f! b }) J+ V0 F: S* U
- *(_BYTE *)(dword_5D3E6C + 4) = 1;
6 ^' `! D4 r3 }2 z3 z" R - v2[2] = 0;
1 Y# Q; q2 I; U6 L! L; d5 A$ T - v2[4] = 0x100000;
3 Y2 b+ |4 e: h/ J. t; {- E- X, r% A4 m - v2[3] = 0;% `9 X) ?4 ?& r P. r
- v2[5] = 786432;
5 w+ r/ T( C2 L! d- w - return;
! C( j* @% j3 s, v - }; m! l9 g- S" o7 N6 Z4 w
- LABEL_7:* K' z0 \, O0 ^' A( }" A+ w
- byte_5D33F0 = 0;
- Q; q7 b1 V; g8 ]( _ - }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------6 C) p: O$ x9 M" p9 f$ c
- .text:004096ED align 10h' |9 _ x' q7 u! s( n! ^( T4 F' j4 y
- .text:004096F03 Z7 y" y1 } ]# h8 ~5 [
- .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j) j" D2 b0 T4 v) r" [1 f
- .text:004096F0 ; sub_409670+8A↓j
" T3 e/ z" D4 i+ B& D' t1 a - .text:004096F0 mov cl, [eax]
0 P5 V' `( h$ u8 {4 H8 j - .text:004096F2 mov [edx+eax], cl1 r+ m2 v( n( o; `
- .text:004096F5 add eax, 1
" }7 Y6 x1 f* D; \' Q3 o) R - .text:004096F8 test cl, cl5 z' j7 y8 `) @1 x6 I. T; g
- .text:004096FA jnz short loc_4096F0
0 E/ V: C% n# s/ @ - .text:004096FC mov eax, dword_5D3E6C0 y4 V3 P2 w2 Z# C3 r: W8 F
- .text:00409701 mov byte_5D33F0, 1
( u; N& G2 Y5 s - .text:00409708 mov byte ptr [eax+4], 14 w8 A! P* t9 ~+ o
- .text:0040970C mov dword ptr [eax+8], 0
* A9 H3 y" U& f; {( o - .text:00409713 mov dword ptr [eax+10h], 100000h k* ?/ J$ o/ f: g$ x( c
- .text:0040971A mov dword ptr [eax+0Ch], 0
9 v: t h0 s% s T - .text:00409721 mov dword ptr [eax+14h], 0C0000h
( A5 o$ I2 G! z6 ?& o - .text:00409728 retn
# Z* Y1 B1 x- e( D8 {) @ - .text:00409729 ; ---------------------------------------------------------------------------
复制代码 ) {5 N, x# B! _
|