本帖最后由 shane007 于 2023-8-26 16:14 编辑 & u5 N7 G" l. p& T4 O
6 t! C9 M" w3 ?2 p/ s
我用代理dll的方式,让这个游戏窗口化了。
; w9 v7 ?5 W. |" A; G0 D随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。' i5 f6 U/ j; n4 n
在以下地方断下。
% M; z: h0 D, z0 x8 \6 r
+ E' P# [+ S' v4 v# }% Q- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01& b4 U# U7 }% b$ I6 B
- 地址004096F5
复制代码
7 U6 k6 D5 e2 t, N9 G% A; S5 t; w8 {
8 S% F5 B& h/ r* L0 k+ E1 v随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,
' ~( g7 B: _; F5 E- h真正的字幕显示函数需要追到上一层,后续再继续分析8 O: ^$ r% x" \5 x
$ W' W& h7 H- p9 x
5 Y o% ]; I* b- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)0 t! O' ]4 }) I: Z& P
- {
% O4 N& }4 C; l: m Y. h4 N, O4 x0 | - _DWORD *v2; // eax4 Q/ u! g) V/ W7 @5 e
$ Q+ O. Z9 c. w- {% t- if ( !dword_5D9B50 )
! y. V$ b7 M& l. k3 d - {5 m4 U1 s; V8 T* l, ?- G& b
- if ( !a2 )- U% g* @/ }: }0 [5 Q& e& v9 O
- goto LABEL_7;- k+ X1 @# B! w% A
- if ( strlen(a2) >= 0x80 )% i$ e% m: v4 R( X
- {
: g$ A' k: n, E" f - sub_51AEC6("ASSERT\n", a1);% R! g6 r3 D- f; t* C: g
- sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");3 A3 H! R* A2 B' E
- sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");
6 B' O# v9 z6 q" \ - sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");
# H/ A8 W& Z! h( g: { N7 [. Q - }
% K4 M# ]8 S6 e$ w" Y) p1 k5 q8 Z; { - }) Q; q9 y, O ~
- if ( a2 )
, c- m- K4 n4 J& r - {) j7 Q' [' D/ h: B3 o
- strcpy((char *)&unk_5D3370, a2);* r3 Q- W9 c' d3 r
- v2 = (_DWORD *)dword_5D3E6C;
* {- A# D, l9 P; A9 I - byte_5D33F0 = 1;- h2 X, s% T8 d* P/ J5 _1 A# R; i Z
- *(_BYTE *)(dword_5D3E6C + 4) = 1;
9 e; ^& ?1 `, [( u - v2[2] = 0;
+ [ ^: T7 x7 ~, R6 C - v2[4] = 0x100000;
; M* M: A3 T( `& w: ^. M9 ~ - v2[3] = 0;. ^0 }, A7 p5 P6 x( X$ Y
- v2[5] = 786432;
: h/ h. `* [" Y0 `+ t, S4 u/ I- ^ - return;
5 O' _- |/ a1 ]3 q$ S: Z - }* a& ?$ I, Y& U/ j) A8 W
- LABEL_7:
' I4 ^8 u; m+ A7 `# I - byte_5D33F0 = 0;
( r) o/ {: o( r - }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------
5 F0 m( w2 i8 B! Y5 M6 V+ @ - .text:004096ED align 10h
/ z+ _7 n7 U( Z5 ]. f5 t: j7 R - .text:004096F0
( ~. M0 `8 Y9 E0 S' J! ^' x7 Z) H/ O2 H - .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j
; z1 |5 [6 w. ` - .text:004096F0 ; sub_409670+8A↓j
+ ~. s7 r5 ?" i# f0 U9 t) ^ - .text:004096F0 mov cl, [eax]
1 `( P* U- f+ y2 ~7 ~' y4 P# O - .text:004096F2 mov [edx+eax], cl
& F: t3 u# r# ~ - .text:004096F5 add eax, 1- {* L C# n, q/ G7 q7 d! f" b* J
- .text:004096F8 test cl, cl! R: w1 m, Q2 z# X$ a* g. ^
- .text:004096FA jnz short loc_4096F00 R. o9 v$ l2 I' h2 h8 A5 O8 h* T9 i
- .text:004096FC mov eax, dword_5D3E6C- R2 I0 V% l: J3 }- |3 O! M
- .text:00409701 mov byte_5D33F0, 1( ~& E# m* h1 ]8 d. H+ |
- .text:00409708 mov byte ptr [eax+4], 11 H/ B0 c! W* o. G2 {8 r! q; P# m. z
- .text:0040970C mov dword ptr [eax+8], 04 K7 a8 N: s- P2 Y* g/ w/ ^
- .text:00409713 mov dword ptr [eax+10h], 100000h1 A' c5 W8 B; U4 m3 q. [6 v
- .text:0040971A mov dword ptr [eax+0Ch], 0: I* I0 W; I u) t, I0 @2 c H5 w2 X5 s
- .text:00409721 mov dword ptr [eax+14h], 0C0000h' t* k' W/ ]5 E" @# P1 w
- .text:00409728 retn
* D; N4 G; m& M, w8 n2 _ ] - .text:00409729 ; ---------------------------------------------------------------------------
复制代码 p6 r4 ]5 R' l& r; J, [2 E
|