;-----------------------------------------------------------------------------------------------------------
DkOriPer.dll 与游戏引擎接口的数据说明,非常重要!
*. 注: 1. 这部分数据位于 _DkOriPerInitInsVar 函数内,当 DkOriPer.dll 被装入内存时被初始化为指定值,
游戏改动导致无法自创武将、读写自创武将名失败、格式化自创武将名失败等时参考修改
2. 提供DkOriPer.dll 源代码下载参考
3. 源代码未经太大改动,未注释部分请参考旧版文本
mov ecx, 004B6A60H
mov eax, dword ptr [ecx] ; 主模块句柄
mov hInstanceMain, eax
mov eax, dword ptr [ecx+8H] ; 主窗口句柄
mov hWinMain, eax
mov ecx, 500EF5H ; TouDll模块句柄存放地址
mov eax, [ecx]
mov hTouDll, eax
mov ecx, 4CEA00H ; 武将SAV映射指针
mov eax, [ecx]
mov lpSavImage, eax
mov lpNameImage, 518010H ; 用于检索新建武将以及格式化武将名
mov _48BEA8H, 48BEA8H ; 兵种名地址数组
mov eax, 505F48H ; 4050号整型变量地址
mov lpGalVar_4050, eax
mov _4179B4H, 4179B4H ; 从EEX 剧本映射中读取文字格式化处理时成功返回
mov _417A08H, 417A08H ; 从EEX 剧本映射中读取文字格式化处理时非自创武将返回
mov _41383CH, 41383CH ; [14H: 对话] 指令武将真彩头像显示格式化处理时成功返回
mov _413801H, 413801H ; [14H: 对话] 指令武将真彩头像显示格式化处理时非自创武将返回
mov _44BEF5H, 44BEF5H ; [1AH: 显示胜利条件] 指令内容格式化处理时成功返回
mov _44BF44H, 44BF44H ; [1AH: 显示胜利条件] 指令内容格式化处理时非自创武将返回
反汇编形式:
B9 606A4B00 mov ecx, 4B6A60
8B01 mov eax, dword ptr [ecx]
A3 26300502 mov dword ptr [2053026], eax
8B41 08 mov eax, dword ptr [ecx+8]
A3 2A300502 mov dword ptr [205302A], eax
B9 F50E5000 mov ecx, 500EF5
8B01 mov eax, dword ptr [ecx]
A3 2E300502 mov dword ptr [205302E], eax
B9 00EA4C00 mov ecx, 4CEA00
8B01 mov eax, dword ptr [ecx]
A3 32300502 mov dword ptr [2053032], eax
C705 36300502 10805100 mov dword ptr [2053036], 518010
C705 3A300502 A8BE4800 mov dword ptr [205303A], 48BEA8
B8 485F5000 mov eax, 505F48
A3 3E300502 mov dword ptr [205303E], eax
C705 56300502 B4794100 mov dword ptr [2053056], 4179B4
C705 5A300502 087A4100 mov dword ptr [205305A], 417A08
C705 5E300502 3C384100 mov dword ptr [205305E], 41383C
C705 62300502 01384100 mov dword ptr [2053062], 413801
C705 66300502 F5BE4400 mov dword ptr [2053066], 44BEF5
C705 6A300502 44BF4400 mov dword ptr [205306A], 44BF44
;-----------------------------------------------------------------------------------------------------------
_test2.bin 内容文件说明:
*. 注: 1. 游戏改动导致无法自创武将、读写自创武将名失败、格式化自创武将名失败等时参考修改
一: 初始化原创武将检索区域内存,增加DkOriPer.dll 名字符串,初始化导入函数地址表
(00 数据进入游戏时会被映射)
00518000 CE E4 BD AB BC EC CB F7 C7 F8 D3 F2 CA BC 00 00 武将检索区域始..
00518010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518070 44 6B 4F 72 69 50 65 72 2E 64 6C 6C 00 00 00 00 DkOriPer.dll....
00518080 B5 BC C8 EB BA AF CA FD B5 D8 D6 B7 B1 ED 00 00 导入函数地址表..
00518090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
005180A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
005180B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
005180C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
005180D0 B4 FA C2 EB C7 F8 00 00 代码区..
二: 反汇编代码部分
(1). 游戏启动成功时装载DkOriPer.dll
005180D8 68 70805100 push 00518070 ; ASCII "DkOriPer.dll"
005180DD FF15 24614800 call dword ptr [<&KERNEL32.LoadLibraryA>] ; kernel32.LoadLibraryA
005180E3 BA 90805100 mov edx, 00518090
005180E8 8902 mov dword ptr [edx], eax
005180EA 68 A74B4700 push 00474BA7 ; 入口地址
005180EF - E9 E0D4F5FF jmp 004755D4
(2). 游戏退出时卸载DkOriPer.dll
005180F8 B8 90805100 mov eax, 00518090
005180FD FF30 push dword ptr [eax]
005180FF FF15 1C614800 call dword ptr [<&KERNEL32.FreeLibrary>] ; kernel32.FreeLibrary
00518105 - E9 F534F1FF jmp 0042B5FF
(3). [71H: 特效请求] 指令处理函数
00518110 55 push ebp
00518111 8BEC mov ebp, esp
00518113 83C4 FC add esp, -4
00518116 6A 04 push 4
00518118 8B4D 08 mov ecx, dword ptr [ebp+8]
0051811B E8 D702F0FF call 004183F7
00518120 3D 00000080 cmp eax, 80000000
00518125 75 02 jnz short 00518129
00518127 EB 34 jmp short 0051815D
00518129 3D FF030000 cmp eax, 3FF
0051812E 76 02 jbe short 00518132
00518130 EB 2B jmp short 0051815D
00518132 8945 FC mov dword ptr [ebp-4], eax
00518135 B8 90805100 mov eax, 00518090
0051813A B9 03000000 mov ecx, 3
0051813F C1E1 02 shl ecx, 2
00518142 03C1 add eax, ecx
00518144 8B00 mov eax, dword ptr [eax]
00518146 90 nop
00518147 0BC0 or eax, eax
00518149 74 12 je short 0051815D
0051814B 6A 5A push 5A
0051814D 6A 46 push 46
0051814F 6A 28 push 28
00518151 FF75 FC push dword ptr [ebp-4]
00518154 FFD0 call eax
00518156 B8 01000000 mov eax, 1
0051815B EB 05 jmp short 00518162
0051815D B8 05000000 mov eax, 5
00518162 C9 leave
00518163 C2 0400 retn 4
(4). 原创武将名存档写入处理
0051816C FF75 08 push dword ptr [ebp+8]
0051816F E8 566DFBFF call 004CEECA
00518174 B8 90805100 mov eax, 00518090
00518179 B9 02000000 mov ecx, 2
0051817E C1E1 02 shl ecx, 2
00518181 03C1 add eax, ecx
00518183 8B00 mov eax, dword ptr [eax]
00518185 09C0 or eax, eax
00518187 74 05 je short 0051818E
00518189 FF75 08 push dword ptr [ebp+8]
0051818C FFD0 call eax
0051818E - E9 A330F0FF jmp 0041B236
(5). 原创武将名存档读出处理
0051819A B8 90805100 mov eax, 00518090
0051819F B9 01000000 mov ecx, 1
005181A4 C1E1 02 shl ecx, 2
005181A7 03C1 add eax, ecx
005181A9 8B00 mov eax, dword ptr [eax]
005181AB 09C0 or eax, eax
005181AD 74 05 je short 005181B4
005181AF FF75 08 push dword ptr [ebp+8]
005181B2 FFD0 call eax
005181B4 - E9 9971FBFF jmp 004CF352
(6). 005181BA 以后未使用,可自由发挥
;-----------------------------------------------------------------------------------------------------------
[ 本帖最后由 蛇夫座 于 2010-10-4 15:07 编辑 ]
|