本帖最后由 shane007 于 2023-8-26 16:14 编辑 6 s, r& B% B9 B7 k- L
! n# O, n$ t+ V9 u
我用代理dll的方式,让这个游戏窗口化了。+ y( u" r2 C) w+ _
随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。$ z7 S, ` w: u' ~
在以下地方断下。" ?7 p" j C/ w- b% ~
. _6 C- V; b# ] d2 M9 ~+ F6 u4 J- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,013 X* a _0 { }- s9 n
- 地址004096F5
复制代码
, C. a0 {8 z8 \- Z. u6 {7 }
0 }, Y5 ]% {8 {, o- M随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,
* T0 r4 E& T& |6 I% E真正的字幕显示函数需要追到上一层,后续再继续分析/ f7 S. J8 O+ b6 u+ H5 L
" @$ V B) |$ }" ]# P! |2 m0 k
- 0 e1 t; L% m# B- K/ R1 U! |/ _
- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)- i. i/ U3 {& S/ \
- {5 V) z4 m; Z3 O% t( n
- _DWORD *v2; // eax% q. }# z4 s! u( @
- 9 b, i7 u: e0 S7 F2 y1 D
- if ( !dword_5D9B50 )1 x4 |1 M4 J: x1 c; M
- {
. @! k4 C$ n) g$ e2 Q; D/ m$ O3 P) E - if ( !a2 )
, X# u" G( G. I1 }- C0 q& o - goto LABEL_7;
3 W& Y' b8 P6 i& d* g - if ( strlen(a2) >= 0x80 )2 t' h2 x, x. t5 D1 v
- {7 Y* z" J3 g. q" g4 Y- e1 U2 b+ e
- sub_51AEC6("ASSERT\n", a1);
5 {' a2 F& A- d( y! [ - sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");
( D, C* c2 o$ B6 ]+ F `8 L) J( B - sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");
" m, C: |! T3 E! ~ - sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");# M; {$ O. P! v0 Y4 P
- }" M& u" S; M8 F% W$ J1 j) e) F. w4 c
- }
5 Z& N! ?) ?. c# V' h - if ( a2 )
" B* Q5 i+ Z" z( s- b% A- u2 l: c8 }1 E - {
; R- Y* D4 U" n8 {, `$ r - strcpy((char *)&unk_5D3370, a2);, E* |1 c3 ~! o4 S" B
- v2 = (_DWORD *)dword_5D3E6C; G; ` D/ ^* [3 U P2 }
- byte_5D33F0 = 1;, k( m+ o H7 ~0 h+ E- w" _
- *(_BYTE *)(dword_5D3E6C + 4) = 1;
8 H# t# ]6 p8 g* [3 l; [ - v2[2] = 0;/ ^, Q- I8 c2 z
- v2[4] = 0x100000;4 a$ ~. Q8 A% j* ~& ~4 [& r7 D
- v2[3] = 0;
2 w- r* }' R( j7 J5 ?9 H$ L - v2[5] = 786432;
% ^2 ]6 g( K7 a; S - return;4 H8 l1 A; T i# a+ B/ }, ^& V
- }' q4 v. N& i0 s
- LABEL_7:
+ |; B0 r E, t" Q4 o3 p5 s* [ - byte_5D33F0 = 0;
7 ?: |2 K' x/ j - }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------7 E5 h! ^5 @, ~; |
- .text:004096ED align 10h% D; ]& w7 N; d. [9 _& b
- .text:004096F0
7 m4 q8 b0 }4 N/ X4 C- b - .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j
( @% \, P s# Q4 n$ g( d - .text:004096F0 ; sub_409670+8A↓j
# p2 O6 Y1 [: j - .text:004096F0 mov cl, [eax]
$ y: z3 K/ s! Y6 A4 W: t0 U2 p7 p7 ^ - .text:004096F2 mov [edx+eax], cl
$ ^2 U4 [4 F7 ?9 c9 v1 I - .text:004096F5 add eax, 1+ t6 {" K8 F" J5 k7 Y# e( v
- .text:004096F8 test cl, cl
% J$ q' @* e3 v% x( e' Q" j: m$ _ - .text:004096FA jnz short loc_4096F0% y" P" r7 \) Y/ A* n
- .text:004096FC mov eax, dword_5D3E6C
- x+ S: X! i0 {; Q: ~# {8 R - .text:00409701 mov byte_5D33F0, 10 b. t3 i8 S/ [" ~
- .text:00409708 mov byte ptr [eax+4], 1. T2 l. o8 e. `& y
- .text:0040970C mov dword ptr [eax+8], 0
$ F# u5 Q; O$ x+ { y1 Z - .text:00409713 mov dword ptr [eax+10h], 100000h
$ ] V; O9 K2 p' U6 Y+ C) W - .text:0040971A mov dword ptr [eax+0Ch], 0 P/ s' V2 j5 p$ b' Z1 u8 k
- .text:00409721 mov dword ptr [eax+14h], 0C0000h
* {" h9 Y5 I3 Z j, M - .text:00409728 retn
9 e; L! b& n+ j6 t - .text:00409729 ; ---------------------------------------------------------------------------
复制代码 ! }+ m3 [; `" x2 x
|