去年发了一个帖子是分析魔女防御战的存档校验. 当时貌似提到了这个程序是Corona SDK, 逻辑核心是lua完成的.
废话不说, 今天我们就来实现针对游戏中lua逻辑的修改.
下载了1.8.0版的Defense Witches, 照例用decar解压(decar -x resource.car .\lu), 得到一堆lu文件.
这些.lu文件+0C的地方开始就是lua字节码, +8是大小.
今天下手的目标决定是初始化的300点, 这里还有个小插曲, 因为一开始以为那个叫做水晶点, 所以费了一番工夫, 各种修改都无效果.
一开始将main.lu反汇编成为main_luadec.asm, 在里面搜索300, 搜索到一行这个:
117 [-]: LOADK R0 K64 ; R0 := 300
118 [-]: SETGLOBAL R0 K63 ; GetCrystal := R0
0A37h: [COLOR=red]04[/COLOR] 0B 00 00 00 47 65 74 43 72 79 73 74 61 6C 00 .....GetCrystal.
0A47h: [COLOR=red]03[/COLOR] [COLOR=darkorange]00 00 00 00 00 C0 72 40[/COLOR] ......Àr@
__text:0008677A 61 6B LDR R1, [R4,#0x34]
__text:0008677C 01 23 MOVS R3, #1 ; flag
__text:0008677E 20 6C LDR R0, [R4,#0x40] ; obj
__text:00086780 09 68 LDR R1, [R1] ; a2
__text:00086782 4A F6 F2 42 C0 F2 09 02 MOV R2, (aMain_lu - 0x8678E) ; "main.lu"
__text:0008678A 7A 44 ADD R2, PC ; "main.lu"
__text:0008678C E3 F7 46 FC BL func_executebytecodefile
__text:00086790 80 46 MOV R8, R0
[FONT=Consolas][COLOR=blue][COLOR=blue]int[/COLOR][COLOR=#000000] my_func_exebytecodefile([/COLOR][COLOR=blue]ResourceObjRef[/COLOR][COLOR=#000000] resource, [/COLOR][COLOR=blue]lua_State[/COLOR][COLOR=#000000] *state, [/COLOR][COLOR=blue]const[/COLOR][COLOR=#000000] [/COLOR][COLOR=blue]char[/COLOR][COLOR=#000000] *filename, [/COLOR][COLOR=blue]int[/COLOR][COLOR=#000000] flag) {[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=blue]if[/COLOR][COLOR=#000000] ([/COLOR][COLOR=green]strcmp[/COLOR][COLOR=#000000](filename, [/COLOR][COLOR=#666666]"main.lu"[/COLOR][COLOR=#000000]) == [/COLOR][COLOR=red]0[/COLOR][COLOR=#000000]) {[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=green]logstderr[/COLOR][COLOR=#000000]([/COLOR][COLOR=#666666]"matched main.lu\n"[/COLOR][COLOR=#000000]);[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=#0080ff]// patch carbuf[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=#0080ff]// 04 0B 00 00 00 47 65 74 43 72 79 73 74 61 6C 00[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=#0080ff]// 03 00 00 00 00 00 C0 72 40[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=blue]uint32_t[/COLOR][COLOR=#000000] start = ([/COLOR][COLOR=blue]uint32_t[/COLOR][COLOR=#000000])resource->[/COLOR][COLOR=#804000]carbuffer[/COLOR][COLOR=#000000];[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=blue]for[/COLOR][COLOR=#000000] ([/COLOR][COLOR=blue]const[/COLOR][COLOR=#000000] [/COLOR][COLOR=blue]unsigned[/COLOR][COLOR=#000000] [/COLOR][COLOR=blue]char[/COLOR][COLOR=#000000]* ptr = ([/COLOR][COLOR=blue]unsigned[/COLOR][COLOR=#000000] [/COLOR][COLOR=blue]char[/COLOR][COLOR=#000000]*)start; ptr < ([/COLOR][COLOR=blue]unsigned[/COLOR][COLOR=#000000] [/COLOR][COLOR=blue]char[/COLOR][COLOR=#000000]*)start + [/COLOR][COLOR=red]0x100000[/COLOR][COLOR=#000000]; ptr++) {[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=#0080ff]// B0 B5 02 AF 1C 46 0D 46[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=blue]if[/COLOR][COLOR=#000000] (*([/COLOR][COLOR=blue]unsigned[/COLOR][COLOR=#000000]*)ptr == [/COLOR][COLOR=red]0x00000B04[/COLOR][COLOR=#000000] && *([/COLOR][COLOR=blue]unsigned[/COLOR][COLOR=#000000]*)(ptr+[/COLOR][COLOR=red]4[/COLOR][COLOR=#000000]) == [/COLOR][COLOR=red]0x74654700[/COLOR][COLOR=#000000] && *([/COLOR][COLOR=blue]unsigned[/COLOR][COLOR=#000000]*)(ptr+[/COLOR][COLOR=red]8[/COLOR][COLOR=#000000]) == [/COLOR][COLOR=red]0x73797243[/COLOR][COLOR=#000000] && *([/COLOR][COLOR=blue]unsigned[/COLOR][COLOR=#000000]*)(ptr+[/COLOR][COLOR=red]12[/COLOR][COLOR=#000000]) == [/COLOR][COLOR=red]0x006C6174[/COLOR]
[COLOR=#000000] && *([/COLOR][COLOR=blue]unsigned[/COLOR][COLOR=#000000]*)(ptr+[/COLOR][COLOR=red]16[/COLOR][COLOR=#000000]) == [/COLOR][COLOR=red]0x00000003[/COLOR][COLOR=#000000] && *([/COLOR][COLOR=blue]unsigned[/COLOR][COLOR=#000000]*)(ptr+[/COLOR][COLOR=red]20[/COLOR][COLOR=#000000]) == [/COLOR][COLOR=red]0x72C00000[/COLOR][COLOR=#000000] && *([/COLOR][COLOR=blue]unsigned[/COLOR][COLOR=#000000] [/COLOR][COLOR=blue]char[/COLOR][COLOR=#000000]*)(ptr+[/COLOR][COLOR=red]24[/COLOR][COLOR=#000000]) == [/COLOR][COLOR=red]0x40[/COLOR][COLOR=#000000]) {[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=#0080ff]// patch + 17[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=green]logstderr[/COLOR][COLOR=#000000]([/COLOR][COLOR=#666666]"found GetCrystal at 0x%08X\n"[/COLOR][COLOR=#000000], ptr);[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=green]hexdump[/COLOR][COLOR=#000000](ptr, [/COLOR][COLOR=red]25[/COLOR][COLOR=#000000]);[/COLOR]
[COLOR=#000000] *([/COLOR][COLOR=blue]double[/COLOR][COLOR=#000000]*)(ptr+[/COLOR][COLOR=red]17[/COLOR][COLOR=#000000]) = [/COLOR][COLOR=red]800[/COLOR][COLOR=#000000];[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=green]hexdump[/COLOR][COLOR=#000000](ptr, [/COLOR][COLOR=red]25[/COLOR][COLOR=#000000]);[/COLOR]
[COLOR=#000000] }[/COLOR]
[COLOR=#000000] }[/COLOR]
[COLOR=#000000] }[/COLOR]
[COLOR=#000000] [/COLOR][COLOR=blue]return[/COLOR][COLOR=#000000] [/COLOR][COLOR=#804000]ms_func_exebytecodefile[/COLOR][COLOR=#000000](resource, state, filename, flag);[/COLOR]
[COLOR=#000000]}[/COLOR]
[/COLOR][/FONT]
36 [-]: GETGLOBAL R1 K3 ; R1 := _G
37 [-]: SETTABLE R1 K18 K15 ; R1["MP"] := 0
38 [-]: GETGLOBAL R1 K3 ; R1 := _G
39 [-]: SETTABLE R1 K19 K20 ; R1["HP"] := 20
100010010 100001111 00000001 001001
8943C049
100010010 100010100 00000001 001001
89450049
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
，学习
