本帖最后由 shane007 于 2023-8-26 16:14 编辑
' O Z% R6 T# p3 c" h7 i/ _3 J* K; L: G0 \
我用代理dll的方式,让这个游戏窗口化了。# x t: S- @* f: B( j h
随后用cheat engine(用其他工具老是出异常,无法正常调试)在内存中检索一句字幕,下内存方位断点。3 Q! ]' p C% }( q1 `
在以下地方断下。3 T: t/ w O5 r o
7 T. \' n' k% ]9 j. Z) Q. G9 h
- CaptainMorgane.exe+96F5 - 83 C0 01 - add eax,01
& O) c4 `, }! s; h+ X7 i# o3 X& t - 地址004096F5
复制代码
- e' {. D& D9 X5 y% V2 M3 z d, f. b
随后,在ida pro中查看伪代码,感觉这是一个字符串长度的check函数,
8 q4 f( g) q' B. e" Q6 f真正的字幕显示函数需要追到上一层,后续再继续分析
* k' }; Q$ M4 R( T1 N
' l5 y/ Y, I' W6 b9 z, `& u- : E( X/ H& D v: q+ }9 ~$ u/ i
- void __usercall sub_409670(char a1@<dil>, const char *a2@<esi>)
8 ~+ a9 j' N( [3 A5 M# n6 v - {
& [4 Z. h& K! K# S; X" j- i - _DWORD *v2; // eax+ h5 z* F4 U+ k7 j3 K
- - z7 l8 q( Q7 V; V* _
- if ( !dword_5D9B50 )
* u# d4 Z0 K, K) d' [- F - {8 }. V. g) [( b. O
- if ( !a2 )% |. [. e- D j* l% L: k, y
- goto LABEL_7;3 W( h; F9 _3 G7 w
- if ( strlen(a2) >= 0x80 )7 M% x( F0 F n) s9 }! y
- {
' S; A6 G# v1 _& G" A& V7 b5 q4 f - sub_51AEC6("ASSERT\n", a1);& `+ T! c2 h3 a3 T1 ?
- sub_51AEC6("file: %s(%d)\n", (unsigned int)"..\\..\\Source\\Dialogs\\Common\\DialogInterface.cpp");+ y8 ~$ `8 s6 \$ }: m; z5 W
- sub_51AEC6("function: %s\n", (unsigned int)"DialogInterface::SetCaptionDisplayed");: M1 Z2 a& O. U3 M
- sub_51AEC6("condition: %s\n", (unsigned int)"sCaption==NULL || strlen(sCaption)< NB_CHAR_MAX");
9 h0 G4 K3 m& J3 W$ N1 b - } o3 M# S+ H7 [; j4 W4 a& ~/ l% F7 f
- }
; V" h. `: U/ Y$ O" K) t I5 b - if ( a2 )
) s1 m$ i5 J# _# V# w& Z - {
! I1 \4 _7 _# M5 ]4 E* x - strcpy((char *)&unk_5D3370, a2);
" C/ J4 U5 {; H+ d; m - v2 = (_DWORD *)dword_5D3E6C;# a3 a, c: l) X4 o) f* S% z
- byte_5D33F0 = 1;! N6 b ^5 u) R& B( N6 Y: ]7 w
- *(_BYTE *)(dword_5D3E6C + 4) = 1;; [ S6 b# P2 | T* M9 U
- v2[2] = 0;4 ?* z: C( Q5 g" Q4 A& G
- v2[4] = 0x100000;- X. t6 E, U7 y1 d
- v2[3] = 0;+ T9 q4 s1 B" e' o% v$ C0 G
- v2[5] = 786432;9 _- g7 h4 P9 S( x0 G# |* B; M
- return;# y4 E/ W3 {2 L( P/ B
- }; N4 l. L2 A* ^0 h9 Q
- LABEL_7:+ @8 }( f- W% Q1 A' q
- byte_5D33F0 = 0;9 k% N( }( E7 y' [
- }
复制代码- .text:004096EB ; ---------------------------------------------------------------------------
2 {2 i& M" E7 K6 D/ ` - .text:004096ED align 10h
$ v% y: Y0 Z: p1 ^) V O; ] - .text:004096F0
. L0 T( x: Q, X/ r( @/ u - .text:004096F0 loc_4096F0: ; CODE XREF: sub_409670+7B↑j0 Q$ @7 u* y2 ^4 \6 a/ Y
- .text:004096F0 ; sub_409670+8A↓j6 ^( y. h. H% m! I; _( W7 ]$ i
- .text:004096F0 mov cl, [eax]
! ], b7 r6 Q h7 _ - .text:004096F2 mov [edx+eax], cl
$ T, ~# `( J7 t! y8 H - .text:004096F5 add eax, 1$ @" B' M* {7 S& f, L
- .text:004096F8 test cl, cl
% b( h8 t3 k3 `# N2 b - .text:004096FA jnz short loc_4096F0
4 H) Y4 C1 b; F) p8 b* z e - .text:004096FC mov eax, dword_5D3E6C
+ v/ `7 w5 r, r; W; r6 v - .text:00409701 mov byte_5D33F0, 1
% j2 @1 R- H# [! C/ y - .text:00409708 mov byte ptr [eax+4], 10 S) l8 Q+ n& p5 O
- .text:0040970C mov dword ptr [eax+8], 04 | v/ g& z! a
- .text:00409713 mov dword ptr [eax+10h], 100000h- W- l3 `4 P' Y
- .text:0040971A mov dword ptr [eax+0Ch], 0& n' O' h, z* U5 I
- .text:00409721 mov dword ptr [eax+14h], 0C0000h$ ]* L2 E5 h$ F' x6 C
- .text:00409728 retn9 }8 y& ]& E- z0 v" o( n) C: o7 F
- .text:00409729 ; ---------------------------------------------------------------------------
复制代码
* F }6 V3 l: u" m3 L1 L |