本帖最后由 shane007 于 2023-8-26 16:14 编辑
5 k; s- V: o) C3 J* X6 `0 \$ e9 u+ E# i
8 o+ _* F: r g p" [我用代理dll的方式,让这个游戏窗口化了。
9 C0 _& d7 f0 _随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。
4 o2 {( x, Y4 b6 W& D在以下地方断下。3 l$ R* y2 Z5 I$ n! t
4 e0 x4 r% S3 R& w- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01
, u: X- n( V, D2 U* ]% @& R - 地址004096F5
复制代码
5 h6 B3 L. n+ ?7 n) z c0 }# G8 w8 E8 v0 G
随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,% Q. j/ ^( q+ m! \$ B( l
真正的字幕显示函数需要追到上一层,后续再继续分析8 z" ]9 _+ F/ X7 F- u
# D% U/ n1 u) p& F/ I& t" }
# ]; ~0 w7 ]! F- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)2 |0 {; s! c6 G% x5 h
- {
* n( e1 C; [ _) s1 X! g7 _$ X' m - _DWORD *v2; // eax8 T f. V/ S1 O! J2 r
- ( }( k4 p7 O, b* I
- if ( !dword_5D9B50 )
( M" {. D! S+ V$ h4 V- o8 ?+ d0 p - {
! n# Z( f$ p5 P" V# |- Q' U- { - if ( !a2 )
+ \9 f, M3 u, D0 i4 A - goto LABEL_7;. ?* \; ]" S6 P, A5 q! J
- if ( strlen(a2) >= 0x80 )' Y. |5 F% Z( j V& l
- {
( K( _9 G/ ^- w8 L3 X% T - sub_51AEC6("ASSERT\n", a1);
' }. r' d* I$ N9 [, e - sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");
) H3 n3 o& i7 {4 I. J" { - sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");
- l9 \9 c7 | ]3 Z7 d4 B4 n - sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");, F, y: o! t- V
- }
7 E: L, _* b# D6 G4 c3 ?, m - }# Q* ]! H% M7 n; X A# n8 _) V" Q
- if ( a2 )
7 w5 L" Q/ ?# ^$ N4 y4 v - {1 Y# u3 j' x4 T7 v- z: C
- strcpy((char *)&unk_5D3370, a2);
' z t- n0 M! W8 Z! a - v2 = (_DWORD *)dword_5D3E6C;. g: c# k6 v5 a) I1 m
- byte_5D33F0 = 1;( M$ Z4 s) Z/ X
- *(_BYTE *)(dword_5D3E6C + 4) = 1;
7 V8 P# v* u& V9 i7 T; s) Z - v2[2] = 0;
4 _4 I8 b, a1 E0 |) ] - v2[4] = 0x100000;
4 U6 P: N) p* P7 u0 @+ b4 g% P - v2[3] = 0;
2 W- G+ p- l' y, B" ^/ g2 b* C$ j - v2[5] = 786432;
O+ l2 |0 i2 f+ D2 Y - return;0 O: d7 y Y) a
- }
/ r+ V; W( I. V" f; f- ]; `$ O. M% T - LABEL_7:
( x. C4 l( Y7 B$ e - byte_5D33F0 = 0;& L5 V2 p% `4 v7 U
- }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------$ u0 |+ D6 g* ?8 L
- .text:004096ED align 10h
/ s, E4 r* \8 Q( D! O& n - .text:004096F0
8 t* e, v+ k4 b | - .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j
2 Y7 W1 r3 @2 {: {7 i4 p9 W - .text:004096F0 ; sub_409670+8A↓j* @6 s5 I! A+ S- L
- .text:004096F0 mov cl, [eax] X/ Q+ n O% ^/ K4 s( y3 {
- .text:004096F2 mov [edx+eax], cl% o$ V1 C6 @* K0 Y8 y/ I) k
- .text:004096F5 add eax, 1
5 X8 y) g2 C' Q, B; b# ? - .text:004096F8 test cl, cl
! N- U+ d |) W, m( d! _1 S - .text:004096FA jnz short loc_4096F0
' `+ o, P. f& B( k4 }# t - .text:004096FC mov eax, dword_5D3E6C% c. k. _" _ u5 p7 I1 j% L+ V
- .text:00409701 mov byte_5D33F0, 18 P6 Z+ L5 T. ]5 T9 o K
- .text:00409708 mov byte ptr [eax+4], 1- J, X. p* w+ O: L; \" D& m
- .text:0040970C mov dword ptr [eax+8], 0 |2 P3 T' b% O( _
- .text:00409713 mov dword ptr [eax+10h], 100000h
2 N' h7 \4 k3 X) D; ~- n+ \ - .text:0040971A mov dword ptr [eax+0Ch], 0
+ ^0 R: f% T# c3 a7 F+ q/ n- K o - .text:00409721 mov dword ptr [eax+14h], 0C0000h' T* ^# f3 q4 p% E
- .text:00409728 retn
9 N2 v* v5 h$ e - .text:00409729 ; ---------------------------------------------------------------------------
复制代码
5 @. ?4 z% v- s5 y( P0 d+ y# v, G/ ~ |