_DkExports.dll 与游戏引擎接口的数据说明,非常重要!
*. 注: 1. 这部分数据位于 _DkOriPerInitInsVar 函数内,当 _DkExports.dll 被装入内存时被初始化为指定值,
游戏改动导致无法自创武将、读写自创武将名失败、格式化自创武将名失败等时参考修改
g_lpProcAddrHead = (LPDWORD)0x518090; // 自建_DkExports.dll输入表入口地址(首地址0x518090存放了DLL模块句柄)
lpDwordVar = (LPDWORD)0x4B6A60;
g_hInstanceMain = (HINSTANCE)*lpDwordVar; // 主模块句柄
lpDwordVar += 2;
g_hWinMain = (HWND)*lpDwordVar; // 主窗口句柄
lpDwordVar = (LPDWORD)0x500EF5;
g_hTouDll = (HMODULE)*lpDwordVar; // TouDll模块句柄
lpDwordVar = (LPDWORD)0x4CEA00;
g_lpSavImage = (LPBYTE)*lpDwordVar; // 武将SAV映射指针
g_lpNameImage = (PORI_PER_NAME_IMAGE)0x518010; // 原创武将检索区域组入口
g_lpGalVar_4050 = (LPDWORD)0x505F48; // 4050号整形变量地址
_48BEA8H = 0x48BEA8; // 兵种名地址数组
_4179B4H = 0x4179B4; // 从EEX 剧本映射中读取文字格式化处理时成功返回
_417A08H = 0x417A08; // 从EEX 剧本映射中读取文字格式化处理时非自创武将返回
_41383CH = 0x41383C; // [14H: 对话] 指令武将真彩头像显示格式化处理时成功返回
_413801H = 0x413801; // [14H: 对话] 指令武将真彩头像显示格式化处理时非自创武将返回
_44BEF5H = 0x44BEF5; // [1AH: 显示胜利条件] 指令内容格式化处理时成功返回
_44BF44H = 0x44BF44; // [1AH: 显示胜利条件] 指令内容格式化处理时非自创武将返回
反汇编形式(左侧虚拟地址看玩家的系统而定):
021D20AC C705 A8B11D02 90805100 mov dword ptr [21DB1A8], 518090
021D20B6 C745 F4 606A4B00 mov dword ptr [ebp-C], 4B6A60
021D20BD 8B45 F4 mov eax, dword ptr [ebp-C]
021D20C0 8B08 mov ecx, dword ptr [eax]
021D20C2 890D D0B11D02 mov dword ptr [21DB1D0], ecx
021D20C8 8B45 F4 mov eax, dword ptr [ebp-C]
021D20CB 83C0 08 add eax, 8
021D20CE 8945 F4 mov dword ptr [ebp-C], eax
021D20D1 8B45 F4 mov eax, dword ptr [ebp-C]
021D20D4 8B08 mov ecx, dword ptr [eax]
021D20D6 890D CCB11D02 mov dword ptr [21DB1CC], ecx
021D20DC C745 F4 F50E5000 mov dword ptr [ebp-C], 500EF5
021D20E3 8B45 F4 mov eax, dword ptr [ebp-C]
021D20E6 8B08 mov ecx, dword ptr [eax]
021D20E8 890D C8B11D02 mov dword ptr [21DB1C8], ecx
021D20EE C745 F4 00EA4C00 mov dword ptr [ebp-C], 4CEA00
021D20F5 8B45 F4 mov eax, dword ptr [ebp-C]
021D20F8 8B08 mov ecx, dword ptr [eax]
021D20FA 890D C0B11D02 mov dword ptr [21DB1C0], ecx
021D2100 C705 B8B11D02 10805100 mov dword ptr [21DB1B8], 518010
021D210A C705 ACB11D02 485F5000 mov dword ptr [21DB1AC], 505F48
021D2114 C705 98B11D02 A8BE4800 mov dword ptr [21DB198], 48BEA8
021D211E C705 94B11D02 B4794100 mov dword ptr [21DB194], 4179B4
021D2128 C705 90B11D02 087A4100 mov dword ptr [21DB190], 417A08
021D2132 C705 8CB11D02 3C384100 mov dword ptr [21DB18C], 41383C
021D213C C705 88B11D02 01384100 mov dword ptr [21DB188], 413801
021D2146 C705 84B11D02 F5BE4400 mov dword ptr [21DB184], 44BEF5
021D2150 C705 80B11D02 44BF4400 mov dword ptr [21DB180], 44BF44
;-----------------------------------------------------------------------------------------------------------
_test2.bin 内容文件说明:
*. 注: 1. 游戏改动导致无法自创武将、读写自创武将名失败、格式化自创武将名失败等时参考修改
一: 初始化原创武将检索区域内存,增加_DkExports.dll 名字符串,初始化导入函数地址表
(00 数据进入游戏时会被映射)
00518000 CE E4 BD AB BC EC CB F7 C7 F8 D3 F2 CA BC 00 00 武将检索区域始..
00518010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518070 5F 44 6B 45 78 70 6F 72 74 73 2E 64 6C 6C 00 00 _DkExports.dll..
00518080 B5 BC C8 EB BA AF CA FD B5 D8 D6 B7 B1 ED 00 00 导入函数地址表..
00518090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
005180A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
005180B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
005180C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
005180D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
005180E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
005180F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00518110 00 00 00 00 00 00 00 00 B4 FA C2 EB C7 F8 00 00 ........代码区..
二: 反汇编代码部分
(1). 游戏启动成功时装载_DkExports.dll
00518120 68 70805100 push 00518070 ; ASCII "_DkExports.dll"
00518125 FF15 24614800 call dword ptr [<&KERNEL32.LoadLibraryA>] ; kernel32.LoadLibraryA
0051812B 09C0 or eax, eax
0051812D - 0F84 7BD4F5FF je 004755AE
00518133 BA 90805100 mov edx, 00518090
00518138 8902 mov dword ptr [edx], eax
0051813A 6A 00 push 0
0051813C 68 F4010000 push 1F4
00518141 - E9 4DD4F5FF jmp 00475593
(2). 游戏退出时卸载_DkExports.dll
0051814C B8 90805100 mov eax, 00518090
00518151 FF30 push dword ptr [eax]
00518153 FF15 1C614800 call dword ptr [<&KERNEL32.FreeLibrary>] ; kernel32.FreeLibrary
00518159 - E9 A134F1FF jmp 0042B5FF
(3). 原创武将名存档读出处理
00518164 B8 90805100 mov eax, 00518090
00518169 B9 01000000 mov ecx, 1
0051816E 8D0488 lea eax, dword ptr [eax+ecx*4]
00518171 8B00 mov eax, dword ptr [eax]
00518173 09C0 or eax, eax
00518175 74 05 je short 0051817C
00518177 FF75 08 push dword ptr [ebp+8]
0051817A FFD0 call eax
0051817C - E9 D171FBFF jmp 004CF352
(4). 原创武将名存档写入处理
00518188 FF75 08 push dword ptr [ebp+8]
0051818B E8 3A6DFBFF call 004CEECA
00518190 B8 90805100 mov eax, 00518090
00518195 B9 02000000 mov ecx, 2
0051819A 8D0488 lea eax, dword ptr [eax+ecx*4]
0051819D 8B00 mov eax, dword ptr [eax]
0051819F 09C0 or eax, eax
005181A1 74 05 je short 005181A8
005181A3 FF75 08 push dword ptr [ebp+8]
005181A6 FFD0 call eax
005181A8 - E9 8930F0FF jmp 0041B236
(5). [71H: 特效请求] 指令处理函数
005181B4 55 push ebp
005181B5 8BEC mov ebp, esp
005181B7 83C4 FC add esp, -4
005181BA 6A 04 push 4
005181BC 8B4D 08 mov ecx, dword ptr [ebp+8]
005181BF E8 3302F0FF call 004183F7
005181C4 3D 00000080 cmp eax, 80000000
005181C9 74 07 je short 005181D2
005181CB 3D FF030000 cmp eax, 3FF
005181D0 76 02 jbe short 005181D4
005181D2 EB 33 jmp short 00518207
005181D4 8945 FC mov dword ptr [ebp-4], eax
005181D7 B8 90805100 mov eax, 00518090
005181DC B9 03000000 mov ecx, 3
005181E1 8D0488 lea eax, dword ptr [eax+ecx*4]
005181E4 8B00 mov eax, dword ptr [eax]
005181E6 0BC0 or eax, eax
005181E8 74 1D je short 00518207
005181EA 6A 5A push 5A
005181EC 6A 46 push 46
005181EE 6A 28 push 28
005181F0 FF75 FC push dword ptr [ebp-4]
005181F3 68 00040000 push 400
005181F8 6A 01 push 1
005181FA FFD0 call eax
005181FC 0BC0 or eax, eax
005181FE 74 07 je short 00518207
00518200 B8 01000000 mov eax, 1
00518205 EB 05 jmp short 0051820C
00518207 B8 05000000 mov eax, 5
0051820C C9 leave
0051820D C2 0400 retn 4
(6). 00518220 以后未使用,可自由发挥
;-----------------------------------------------------------------------------------------------------------
|