本帖最后由 shane007 于 2023-8-26 16:14 编辑
3 K' V" _. P L" K. ?" @
9 u7 z9 Q+ E. R: i+ g1 ]我用代理dll的方式,让这个游戏窗口化了。
( p/ l+ x* b( z7 x# w8 Y) Y1 S% q+ w随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。$ f* B. j8 ?- e+ F# M6 L: I v1 B- r
在以下地方断下。6 s. q7 V+ {1 |) e2 R
! r8 l8 F1 z3 y. O) t5 l& I' j, d, h2 E
- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,015 M' n+ x7 \ L7 ^
- 地址004096F5
复制代码
! l1 S& n% x: I6 l; g! N. G, Z3 u$ Z& n" z
随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,
/ u* A3 |/ s$ x1 ^1 K5 f/ D! Z8 p真正的字幕显示函数需要追到上一层,后续再继续分析2 @1 \0 P( x# I& V
0 i7 E; G- B# ~, F j
- e/ p! T7 f" [1 O3 J
- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)' {1 P) v6 i3 E: ?0 W0 ~
- { l. c0 L' c+ s9 [8 B$ ?
- _DWORD *v2; // eax D, M# A, ?7 c! h' b
3 D. h$ y7 ~, \$ L0 D4 L* o- if ( !dword_5D9B50 )
! B3 ^3 D L- X - {- O# C. i2 o( W& @4 d, ~; v+ {" A
- if ( !a2 )
# J8 P$ @6 Y& m1 T0 l5 P6 P( k - goto LABEL_7;6 u6 T' h& ^" y9 o- Z1 K) G
- if ( strlen(a2) >= 0x80 )* d, |. u- l" `( q' k) V+ X0 r- s
- {) r8 C) P7 n' R; _1 _) h1 o7 E
- sub_51AEC6("ASSERT\n", a1);
! A5 A2 G- m) W9 a- \( E - sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");
5 t, W) n& C3 D! U1 p - sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed"); f' J4 ~$ G3 f8 ^8 q1 m
- sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");
* s8 Q+ ~, [9 X5 o& O - }2 c4 @0 }8 ]* c, [2 Z
- }. |4 w$ v, a( D+ o: Y
- if ( a2 )# n# n( d! n6 b0 R9 {, g
- {: \" m9 b' w" d; T" }$ O
- strcpy((char *)&unk_5D3370, a2);
$ l* k1 M1 D z" b7 d% x1 a - v2 = (_DWORD *)dword_5D3E6C;
( H& V8 @: S& A; I& {/ T# n - byte_5D33F0 = 1;: a0 c( p% g4 B1 W% j: e% U
- *(_BYTE *)(dword_5D3E6C + 4) = 1;
. n1 C- D5 B! [ M! H, ` - v2[2] = 0;
5 s; p9 `% Y$ ] R - v2[4] = 0x100000;
+ Y- j0 r* U, @8 {% z - v2[3] = 0;
8 u* }& Q+ c+ H: Q# @ - v2[5] = 786432;: y* U) R0 v1 S2 b
- return;& [" D; s3 M5 f; u: r$ v
- }
! e& K; M T/ l# z* E( Y' E! u- p - LABEL_7:% o) _) @- B9 F) D9 r' w
- byte_5D33F0 = 0;7 U! p/ `- q \( `1 e- ~9 w- Y
- }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------
8 E' U0 I% u+ n) Q - .text:004096ED align 10h$ E! o" {; d" d& n! v
- .text:004096F06 _ s; H, _# r8 s7 F0 g, I3 Q$ i
- .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j
) y- N X6 D1 i) m3 R - .text:004096F0 ; sub_409670+8A↓j3 W, o7 k: q3 }- e( @
- .text:004096F0 mov cl, [eax]) E( H- W! _# z3 S& A) M
- .text:004096F2 mov [edx+eax], cl
. b b3 q, l% E4 y. ^$ B1 g- A& A - .text:004096F5 add eax, 13 ]* U6 d3 E5 X) C t& }$ S
- .text:004096F8 test cl, cl7 Y* n+ Y4 P! |5 e5 w1 B
- .text:004096FA jnz short loc_4096F0; }+ w) B; d- ?/ W C' y) Y9 v
- .text:004096FC mov eax, dword_5D3E6C* v9 P! u5 H2 H
- .text:00409701 mov byte_5D33F0, 1; l E2 x2 B6 f, F$ U
- .text:00409708 mov byte ptr [eax+4], 1
9 G" h! C1 Q# ~0 d. m; i - .text:0040970C mov dword ptr [eax+8], 0( {' |" d* p+ S1 b
- .text:00409713 mov dword ptr [eax+10h], 100000h
0 |9 l0 s8 z5 e' `" B( e$ _, k2 u& b3 V - .text:0040971A mov dword ptr [eax+0Ch], 00 e, Y; \, H' W8 ^$ v5 N- [* T
- .text:00409721 mov dword ptr [eax+14h], 0C0000h) p ]# v* G5 G3 D! u& P' b
- .text:00409728 retn
" v4 C" G/ `- T0 }4 J* r" ^5 w - .text:00409729 ; ---------------------------------------------------------------------------
复制代码
0 p! Y# Y; j2 L$ d |