本帖最后由 shane007 于 2023-8-26 16:14 编辑
/ w J7 S& q/ y! r: ]. _8 L& T+ q: ^& }9 ?9 M. L! ?' e
我用代理dll的方式,让这个游戏窗口化了。: r8 y' ]+ l8 V/ X
随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。% v& h/ { m% E
在以下地方断下。+ i# i& j$ O) F) g' t; H8 r0 {
" j! ?0 H& K) g( \9 }" Q# b- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01 ~. N8 u- c+ V1 p6 @# L1 [- O9 b. C
- 地址004096F5
复制代码
6 L* Y6 d3 J: q
+ d, V% ]. G+ n% I8 j6 O随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,% o$ v5 G3 t% E$ [
真正的字幕显示函数需要追到上一层,后续再继续分析9 N- p/ E+ E' L* D( b
/ R( o) |: I4 B9 W1 H+ I- ! ]0 Z! Y9 ~% g7 g# U
- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)
7 o6 q6 v K/ c7 k, k! @+ }: y - {
/ y1 l/ D3 N. Q7 T0 }9 C - _DWORD *v2; // eax
4 X/ Z2 |/ E" X" N. J - 1 G3 ?1 \2 n3 w* g! Q* ~, }
- if ( !dword_5D9B50 )
) n) l2 @/ [. ]( M - {3 t1 {7 v1 Y9 M. J: W
- if ( !a2 )
. f" s5 B* l. `8 v) r - goto LABEL_7;5 _ B4 f; c% F2 n! {
- if ( strlen(a2) >= 0x80 )
2 c: Z$ [; l/ b( G" K* | - {
D; t& m5 F, O. c7 S. I - sub_51AEC6("ASSERT\n", a1);
+ S6 J6 _0 A* T - sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");8 V! Q7 D1 g8 Z! J
- sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");/ v+ W4 @ y6 h! u" T6 E
- sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");
0 m: D$ @( H# [6 c4 N. A( R" \ - }
% `- B7 R1 h2 G2 K - }
$ p* x- y$ v, {" \& B+ ~ - if ( a2 )) R# n8 b. T: }" ] H
- {7 @- v" ^0 | h0 U9 ~8 e4 q
- strcpy((char *)&unk_5D3370, a2);$ {$ a5 b! W, {& t, a
- v2 = (_DWORD *)dword_5D3E6C;
1 b1 X+ g- S3 j - byte_5D33F0 = 1;
) f& J) T6 n# H C: f( d5 d# I% j4 y - *(_BYTE *)(dword_5D3E6C + 4) = 1;
w% m# D. r. U' V - v2[2] = 0;! [4 G1 e; A- l- h( I! d* g: s# s
- v2[4] = 0x100000;
: b# T7 S% W8 L - v2[3] = 0;
0 a) ~4 U4 q5 a" j) v - v2[5] = 786432;* s+ N1 y& q. x9 R
- return;
' r- w- X. H- m4 T6 \4 { - }
4 b; l& w1 l1 V& y0 }9 @; J - LABEL_7:) ~( A) s5 V4 V
- byte_5D33F0 = 0;' L; p* b/ g( X# ~
- }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------
. G1 ^ r, n+ _& b - .text:004096ED align 10h0 X8 w* ~& n4 E9 k) }& s; q
- .text:004096F08 D( Y }( X: i8 m+ s
- .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j' l2 M2 x! N. @" M' k
- .text:004096F0 ; sub_409670+8A↓j% i+ y. b: I f; y! `
- .text:004096F0 mov cl, [eax]0 o8 d1 J5 S& q7 d
- .text:004096F2 mov [edx+eax], cl/ I. x7 j) q+ \) J9 w6 w, X# Y; k; J
- .text:004096F5 add eax, 1
$ p1 X; ^) A2 @' x+ n - .text:004096F8 test cl, cl% c. D V5 y1 L, n4 w9 u
- .text:004096FA jnz short loc_4096F0
) Y0 Y8 v. O* c/ c9 e: \* ^ - .text:004096FC mov eax, dword_5D3E6C
8 e5 f. B$ d7 p! s/ ~9 @ - .text:00409701 mov byte_5D33F0, 1' Q) g; D; k! S6 k! L$ _8 \
- .text:00409708 mov byte ptr [eax+4], 18 b0 A5 z/ R, V6 o1 E1 Y+ V4 h
- .text:0040970C mov dword ptr [eax+8], 07 F0 q7 `1 ]5 T; q4 F9 D+ v
- .text:00409713 mov dword ptr [eax+10h], 100000h
; f& {: J$ ?8 d) Z/ e1 Q/ V( Q - .text:0040971A mov dword ptr [eax+0Ch], 0
0 ~! N- A6 Q6 m5 |1 u - .text:00409721 mov dword ptr [eax+14h], 0C0000h* P" Y8 q% u* O q6 a
- .text:00409728 retn0 D4 J7 c# e; N: b( H" @* \
- .text:00409729 ; ---------------------------------------------------------------------------
复制代码 / x N5 J2 e A+ f
|