本帖最后由 shane007 于 2023-8-26 16:14 编辑 ' s' p3 O% e+ {/ Y
6 p" b( y$ a {$ \, P9 |我用代理dll的方式,让这个游戏窗口化了。3 s+ J, S4 c* o* S* m( F5 K; `& l
随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。
* q' e+ J4 x: Q% Y在以下地方断下。6 b* [2 [2 y8 n* d% N# }' a" s/ f
5 x; h. g1 t! C: \* l4 v
- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01
( U2 a2 w) Q, }$ z- Z3 ^/ x - 地址004096F5
复制代码 * u4 X+ Y8 I, @
( h3 ]2 T3 }# Z# a) G
随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,/ t6 S/ ?5 o3 U7 H5 [2 O U
真正的字幕显示函数需要追到上一层,后续再继续分析8 f% U$ v1 W, L8 g$ F( s
; |) k, ~+ p) w" M- I
3 v |6 u: T) z6 v- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)5 B, {2 W0 `! ^
- {
0 f+ ?+ n/ P9 w' V - _DWORD *v2; // eax
: j- M1 T+ R; {; X* g9 `/ ]
" n3 }: }1 g- f: J8 ^# L+ Z1 z- if ( !dword_5D9B50 )
1 b" G: Y% [ ]( V$ }" R - {/ D! L9 [* N1 G' i" M# L
- if ( !a2 )
. e3 {" @3 j W$ D. a' g5 e2 t* R - goto LABEL_7;1 I; c: d/ N: L
- if ( strlen(a2) >= 0x80 )3 x1 p& u5 y, k) [
- {
3 ^6 y$ U9 _5 g R% g - sub_51AEC6("ASSERT\n", a1);
6 Y, a0 Y! c7 p( G9 A- H - sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");' y6 A- b$ u, O+ {; ^) X
- sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");8 a0 f* v- q4 O6 y, |
- sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");
: {: y, i6 \) ~: _( @ - }4 `& I" H( j; {6 F/ y; q- F# H
- }# F3 { }5 y+ n, \5 X& G! Y5 o# T
- if ( a2 )
( [) n. E- Q+ m2 Q3 L - {( ^8 l. Z1 z4 G' `* Q
- strcpy((char *)&unk_5D3370, a2);
9 H$ D+ \0 p. ~- e3 A - v2 = (_DWORD *)dword_5D3E6C;
% x% a+ B; V, a7 C3 X - byte_5D33F0 = 1; E" n6 N: h2 p5 v1 C0 C
- *(_BYTE *)(dword_5D3E6C + 4) = 1;
: U- i! H8 q; j) e# f - v2[2] = 0;
4 s: i1 `; R5 x4 ?% g - v2[4] = 0x100000;
! q% }- y/ U: V - v2[3] = 0;' p; z8 \) F) C) j3 A2 K4 X
- v2[5] = 786432;
' Y" o1 t, ]% B - return;1 Z+ D5 X+ l- S; n8 b
- }
- _8 M) a/ y# l1 n - LABEL_7:
5 U" x" r& Z" V4 u- `- @% V( z - byte_5D33F0 = 0;" n' a( o7 Z/ c/ N
- }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------$ U! U2 q4 z) N: O1 c8 u
- .text:004096ED align 10h
1 y( |" i7 J% j/ U# V3 s - .text:004096F01 S& m9 `0 v7 E4 t* M' f! M! Z
- .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j
& L8 x& b0 c, w0 H& n - .text:004096F0 ; sub_409670+8A↓j0 l0 p7 c! Q0 |/ G; f4 R; S9 V0 X
- .text:004096F0 mov cl, [eax]
9 c$ p7 E# z. y- Z - .text:004096F2 mov [edx+eax], cl
. o s# `; x: M0 ?: m1 S$ N - .text:004096F5 add eax, 19 w* e) [9 i$ Z
- .text:004096F8 test cl, cl
+ [, J: d1 E% S: V$ H - .text:004096FA jnz short loc_4096F0
+ o7 X* \8 J Y - .text:004096FC mov eax, dword_5D3E6C2 v b; J0 S5 ^5 C) L" ^
- .text:00409701 mov byte_5D33F0, 1! G, b( _0 o- N$ r2 P9 _
- .text:00409708 mov byte ptr [eax+4], 1
2 |" R& i6 U# N* ~( x, {% }$ m - .text:0040970C mov dword ptr [eax+8], 0/ H. U# a0 m0 k& }
- .text:00409713 mov dword ptr [eax+10h], 100000h% i. t k2 E6 E y: C. k% q1 C. ?
- .text:0040971A mov dword ptr [eax+0Ch], 02 r, f( k! Q+ Z+ m. t+ q) {: t$ Y
- .text:00409721 mov dword ptr [eax+14h], 0C0000h8 c& k' K4 l* i! D4 C
- .text:00409728 retn E7 m3 ]- D" i, X- S/ [) B O
- .text:00409729 ; ---------------------------------------------------------------------------
复制代码 7 E, g$ L3 H* S- F% B1 W3 E* ^' R
|