本帖最后由 shane007 于 2023-8-26 16:14 编辑
' k& f# ?- R' g& P; c, j- W1 c
2 T, w: a9 |: k* R7 b9 j我用代理dll的方式,让这个游戏窗口化了。
; M' `4 M6 I8 t1 j随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。
& { m! _5 P' w在以下地方断下。- b6 t; M+ B R3 A
, {. C0 m6 [4 |3 Q# l! \4 ^) R
- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01
/ `8 N* Q. N: h9 j) y* z( Z - 地址004096F5
复制代码
% T2 X8 u; w$ k9 C
+ W3 M* c5 C3 W# k; `6 E随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,! B0 d5 f; M/ G9 K1 X9 s. \
真正的字幕显示函数需要追到上一层,后续再继续分析9 _- w0 q0 C- r1 t9 e7 C
! r( d6 Z5 ]1 b( ^' S$ d" G- 1 U% `' |$ U' u% w
- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)$ {! l( o$ n; F0 D7 _% ?
- {
( F6 Y# I1 u1 r- Y; e& I1 h - _DWORD *v2; // eax
, z& t0 V; i: T( \
5 H6 `( ~, F/ w/ @' [4 O- if ( !dword_5D9B50 )9 B1 x- U4 K3 d1 T9 T
- {
" Q8 t) N& i5 ?6 \) s6 A2 D - if ( !a2 )
, g4 T1 K4 d- Z- e! n - goto LABEL_7;
% f x- D) l9 a! N5 Q0 O. o5 C4 G - if ( strlen(a2) >= 0x80 )2 F# K9 M' b4 X# i i) H
- {
7 x+ m" e" c* G5 h" D - sub_51AEC6("ASSERT\n", a1);
1 [# [ Z. z# O - sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");
, |2 ^6 W J9 x$ Q8 q" N- ` U8 W1 P - sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");
# T5 l0 y/ ?. l% ]: a" Y% s& q1 k - sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");
' r* `" I& q" V u2 z1 k - }
- d4 I4 @7 K" l2 G+ o - }/ o) K9 [" |* k( n8 O
- if ( a2 )) \9 X! S% A; i! v2 ~3 c3 [( w; R5 [3 J
- {3 P1 U8 {0 ? q" v; B, I
- strcpy((char *)&unk_5D3370, a2);
- P) A+ Y$ g1 H6 r7 }7 b2 F; n& Q - v2 = (_DWORD *)dword_5D3E6C;
2 [6 P" U8 j( R# D - byte_5D33F0 = 1;
3 b! [ F' o! F" |; l - *(_BYTE *)(dword_5D3E6C + 4) = 1;' X! c+ M5 `! i, ], B3 A0 t; w A
- v2[2] = 0;9 g( ?5 A; \9 R: r4 U, y$ @
- v2[4] = 0x100000;4 h" ^) f D! |; t& _8 M0 S O. p
- v2[3] = 0;
! T% h7 M. ~7 o* ?7 I, k - v2[5] = 786432;
$ A3 q: }: h) ^7 z# h - return;
3 A9 J5 T) _2 c - }
" M. Z& r0 d; L' A - LABEL_7:2 A7 A+ B+ T! O- R# _, E( t
- byte_5D33F0 = 0;
& u) k& ~* z3 F - }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------
: l2 _$ u/ T+ ` - .text:004096ED align 10h9 l4 t" ~6 x8 o. \5 s
- .text:004096F0+ v+ A4 D$ }* C4 r6 C3 _, h2 m0 A9 s
- .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j
: Q7 K3 F5 s3 S5 R4 c2 z* f# h% o5 m6 B# U - .text:004096F0 ; sub_409670+8A↓j7 Y6 i6 Z; H" x: m
- .text:004096F0 mov cl, [eax]
$ g& f5 e. n2 W2 X7 n+ o - .text:004096F2 mov [edx+eax], cl
0 \2 w8 G# ^0 Z$ G) d, X7 I6 v( u - .text:004096F5 add eax, 1
. {' n5 m3 i; v1 n8 N, T - .text:004096F8 test cl, cl, g. W, {! X5 x% e
- .text:004096FA jnz short loc_4096F0
" P; I, r! @+ c, ^, f8 w% W - .text:004096FC mov eax, dword_5D3E6C
6 j% a2 E, T; x* B - .text:00409701 mov byte_5D33F0, 14 g# ~# ?% i% z8 i
- .text:00409708 mov byte ptr [eax+4], 1
+ k. X) w, N; G4 G - .text:0040970C mov dword ptr [eax+8], 0; l' {9 C- z* Q* H; n
- .text:00409713 mov dword ptr [eax+10h], 100000h8 {5 p2 y5 D5 o1 @: l) a
- .text:0040971A mov dword ptr [eax+0Ch], 0
& u6 B) b: }5 s9 ]( Q - .text:00409721 mov dword ptr [eax+14h], 0C0000h
' Q- J5 B9 r7 G4 { - .text:00409728 retn
4 |! }, B: }3 H& G - .text:00409729 ; ---------------------------------------------------------------------------
复制代码
+ K6 z" D) U$ m2 x |