本帖最后由 shane007 于 2023-8-26 16:14 编辑 1 u! N, w3 F. ?- x) u! _. [
. U' q( @* V2 Q$ a$ E' u
我用代理dll的方式,让这个游戏窗口化了。( s7 ~* @9 _5 _' T, t
随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。8 O/ z3 Y. Z% S0 q, r
在以下地方断下。5 p7 m6 I+ R' |
2 M; d w" L/ J' _; [* r$ g6 m0 n! w
- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01( ]; ]# h' G1 Q! N# D# n
- 地址004096F5
复制代码
) M8 h+ Z( R2 h" @; v& e3 B P
# J. H* M3 r+ N) V9 R随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,9 r! L2 ~1 U9 y0 \* R* Q2 x
真正的字幕显示函数需要追到上一层,后续再继续分析
2 Q6 n. u* E' L2 V* e) |" c9 m9 W
3 d4 o: w5 K/ r( i' p$ u- ' U7 M* S! v3 ?
- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)3 c! k; x6 z- G, g
- {
( e9 a z" h: I, B/ }+ `$ @ - _DWORD *v2; // eax
/ k. q0 p% D5 A - ; U% \" D+ a. z4 J; L6 h
- if ( !dword_5D9B50 )( d" o8 d$ A5 t0 n1 ]; D: [. v
- {" B0 K( @6 E9 x0 `0 H( u
- if ( !a2 )
1 c5 q$ Y; A s3 o9 F$ m - goto LABEL_7;
) D6 G8 Q1 _& m, x9 u - if ( strlen(a2) >= 0x80 ): f8 x5 b9 a- Z; J
- {( g* K: {4 O; _: @: \3 H* o
- sub_51AEC6("ASSERT\n", a1);6 g, J5 B+ D3 O' W; I; B8 w1 L5 B7 B
- sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");3 Y( v: O) Q# D, E4 e
- sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");' t R0 C2 ^# w5 F. y" N& t8 V* C
- sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");# u& [, X7 F( q( @% D- b
- }
( H" @: F+ u" X V0 l* [ } - }
4 H$ }& Q* Y8 p/ |8 E - if ( a2 )7 z2 Z- y2 \) H( x, T! S8 j
- {
& x: f N2 \. X - strcpy((char *)&unk_5D3370, a2); ]& y* ~& x* [% B* w2 b7 b
- v2 = (_DWORD *)dword_5D3E6C;
( o+ ^8 L3 s+ G$ I3 `( I. f) |& a - byte_5D33F0 = 1;
) C0 ?1 l5 ^* L - *(_BYTE *)(dword_5D3E6C + 4) = 1; b& C+ \/ F' Q/ J
- v2[2] = 0;
1 N3 Z5 A7 j1 r) D - v2[4] = 0x100000;
' M- A0 L8 X9 c6 T - v2[3] = 0;/ Q6 I: E& V6 X l) E: {6 M4 F5 ^
- v2[5] = 786432;# K; ]+ r7 P( p) t. h1 P4 N
- return;) T8 J# q d7 `* e) m0 Q
- }
) u" S ^9 G; M6 F' Y/ J+ C - LABEL_7:9 R% A+ }2 E+ `0 o8 I0 w+ i
- byte_5D33F0 = 0;6 ^3 Y9 [# U& c
- }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------+ v( z# Z+ n* ^; [# v% @. P, X
- .text:004096ED align 10h
0 v5 u3 q ^* X0 e$ H - .text:004096F0
% N: c, m0 S$ y- \( t" ^# V - .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j
" |6 \8 q5 {+ d8 u- ?& a) S( w - .text:004096F0 ; sub_409670+8A↓j2 ~- D% u- r5 Z& j
- .text:004096F0 mov cl, [eax]) V5 h6 k# x( z9 u
- .text:004096F2 mov [edx+eax], cl
& t; |& B# x/ n$ U* K - .text:004096F5 add eax, 1
( ~( v7 d* q, m' F' K/ F0 U - .text:004096F8 test cl, cl
: l" r* @0 J0 Z9 V, `8 n* {/ ?( D E! H - .text:004096FA jnz short loc_4096F0
, y- E9 k( _* ? - .text:004096FC mov eax, dword_5D3E6C8 D* F0 Z. w# s0 V* @% R8 Q
- .text:00409701 mov byte_5D33F0, 15 L5 f- E( W# V' g9 y' x
- .text:00409708 mov byte ptr [eax+4], 1
7 h& q( m8 C4 O# D3 y - .text:0040970C mov dword ptr [eax+8], 09 J4 K0 i5 D' E U
- .text:00409713 mov dword ptr [eax+10h], 100000h) W+ f# t: r6 I9 x1 J
- .text:0040971A mov dword ptr [eax+0Ch], 08 H1 {& C5 X/ Y7 a( L U' i
- .text:00409721 mov dword ptr [eax+14h], 0C0000h" F- G" Q0 P7 `# F/ n# i G
- .text:00409728 retn
2 b, L7 B6 r. Z' O - .text:00409729 ; ---------------------------------------------------------------------------
复制代码
! |/ P' R0 V9 { |