本帖最后由 shane007 于 2023-8-26 16:14 编辑 ) X6 K9 {3 M5 R) P- L
% w9 d$ X9 [! A我用代理dll的方式,让这个游戏窗口化了。
1 Z5 W; m7 w" l/ z* t- k' F- s随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。/ L3 M$ ?8 e; x5 ]% F
在以下地方断下。
- F2 a3 C# H6 Y, J' e" S5 h2 d
+ P- g, z+ H8 `2 k. ^" J- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01
: I2 x7 a7 M; u9 t5 @ - 地址004096F5
复制代码
8 C! e7 c/ H1 |% ~, C/ p Y; o! P# c* A0 | S" j: @
随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,; d3 [2 n- t- t
真正的字幕显示函数需要追到上一层,后续再继续分析
+ D1 v2 L3 v/ u/ ~. U7 Y. A2 O5 |2 z
3 t: Z) p7 M6 |" L! D9 }- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)% P7 R, \& x1 n/ c
- {7 l+ C3 y( z( U% ^+ {$ U
- _DWORD *v2; // eax! m. ~1 x V* ~6 d
! w- P6 a& S+ o" s) M% \# K- if ( !dword_5D9B50 )
& L) S4 s% i5 b9 x( l0 V% F; m - {" }7 e( w: f# H m/ b
- if ( !a2 )
" A5 D" q, Z, Y# V2 w - goto LABEL_7;
! g' w" z9 ?8 d: L/ p - if ( strlen(a2) >= 0x80 )" Z- [$ g$ Y j3 s$ W4 e
- {
4 q9 a/ T: T6 x& R8 W - sub_51AEC6("ASSERT\n", a1);( p$ e% j# d4 p: g+ K* N
- sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");
2 `8 M2 f+ C3 i1 Q) Q - sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");
$ ]( {5 _6 Z9 I+ F1 J1 L - sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");
1 J9 V+ d4 G) M% M5 h4 K - }/ a: y1 x8 `9 M4 w# ^$ y
- }
1 E* T1 o4 N( s) X - if ( a2 )
0 P. @, F' |8 X9 Z - {% w% y% ` b' D" ^( a9 h+ c
- strcpy((char *)&unk_5D3370, a2);7 I1 Z5 ^- h( {0 @0 C
- v2 = (_DWORD *)dword_5D3E6C;. `# ]% ^1 {4 }) f' |
- byte_5D33F0 = 1;% Z3 A- G8 n1 s% @4 k9 H6 }* z f2 A
- *(_BYTE *)(dword_5D3E6C + 4) = 1;
5 V$ ?+ w9 s% E) D* F5 q; b - v2[2] = 0;
8 U/ f, @0 |( j( `& F! N - v2[4] = 0x100000;: B" _8 X H" h% y% i4 S
- v2[3] = 0;
, d' [7 {# e) a$ P$ V" M - v2[5] = 786432; m; _1 o) a9 X0 b
- return;
2 g& z @4 S* d+ w8 n U - }
# M" e2 N; j$ f% ` B; N3 P) Z* n+ I) K - LABEL_7:$ l: O$ [' x4 R& g
- byte_5D33F0 = 0;
3 @6 l4 ?3 r: R1 |& {2 u. z - }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------3 z2 q1 z, v5 b8 s
- .text:004096ED align 10h
8 _' M& y8 t6 ~2 I7 e - .text:004096F0
7 v+ p/ _# m8 H0 o - .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j
2 t0 i9 B% l5 \; Y/ r" u - .text:004096F0 ; sub_409670+8A↓j: c: h$ Q+ E. i& x& Y/ Q2 j
- .text:004096F0 mov cl, [eax]% t- N; I# ^0 q! h
- .text:004096F2 mov [edx+eax], cl8 l6 V m1 ~ h3 X7 x. }
- .text:004096F5 add eax, 1, X0 Z5 T4 \) k
- .text:004096F8 test cl, cl1 s6 Z, a. G: O' @* f
- .text:004096FA jnz short loc_4096F0
& K5 s5 m. R6 X+ Z: ] - .text:004096FC mov eax, dword_5D3E6C: g: E+ J$ X8 z8 `- K
- .text:00409701 mov byte_5D33F0, 1
* j' N; G; `3 V - .text:00409708 mov byte ptr [eax+4], 15 x: g5 Z4 X/ P: x1 b
- .text:0040970C mov dword ptr [eax+8], 0
+ `2 K, z! X6 l. S1 T - .text:00409713 mov dword ptr [eax+10h], 100000h
4 v5 }1 w. w- e" D1 B$ g; K - .text:0040971A mov dword ptr [eax+0Ch], 0( ?% ?: A @! E- `# j9 X
- .text:00409721 mov dword ptr [eax+14h], 0C0000h+ i' z. Y8 Z V4 q+ ]
- .text:00409728 retn: Z6 A" r7 K5 g9 U2 N0 h7 K' t @
- .text:00409729 ; ---------------------------------------------------------------------------
复制代码 L5 g9 ^+ q0 Y
|