龙之谷-关于解压龙之谷虚拟文件的方法探讨2

这一节，我们先来讨论一下，龙之谷单机版程序中的解压CALL

在004B2D00 处下断点
004B2D00   $ 8B4424 04     mov     eax, dword ptr [esp+4]           ; 解压主程序
004B2D04   . 83EC 2C       sub     esp, 2C                          ; 参数表44个字节
004B2D07   . 85C0          test    eax, eax                         ;
004B2D09   . 55            push    ebp                              ;
004B2D0A   . 57            push    edi
004B2D0B   . 0F84 23150000 je      004B4234

判断文件是否为压缩文件
004B2DA0   > /85D2          test    edx, edx                         ; 压入标志位:0x7801
004B2DA2   . |0F84 A9130000 je      004B4151
004B2DA8   . |0FB645 00     movzx   eax, byte ptr [ebp]
004B2DAC   . |8BCE          mov     ecx, esi
004B2DAE   . |D3E0          shl     eax, cl
004B2DB0   . |83EA 01       sub     edx, 1
004B2DB3   . |83C6 08       add     esi, 8
004B2DB6   . |83C5 01       add     ebp, 1
004B2DB9   . |03D8          add     ebx, eax
004B2DBB   . |83FE 10       cmp     esi, 10
004B2DBE   . |895424 10     mov     dword ptr [esp+10], edx
004B2DC2   . |895C24 18     mov     dword ptr [esp+18], ebx
004B2DC6   .^\72 D8         jb      short 004B2DA0

跟据[EDI]进行Select 转移
004B2D80   > /FF2485 40424B>jmp     dword ptr [eax*4+4B4240]
004B2D87   > |837F 08 00    cmp     dword ptr [edi+8], 0
004B2D8B   . |75 0B         jnz     short 004B2D98

Case $0B
004B3485   > \837F 04 00    cmp     dword ptr [edi+4], 0
004B3489   . 74 18         je      short 004B34A3

Case $0F
004B361D   > \83FE 0E       cmp     esi, 0E
004B3620   . 73 24         jnb     short 004B3646

Case $12
004B3AA3   > \83FA 06       cmp     edx, 6
004B3AA6   . 72 65         jb      short 004B3B0D

Case $17
004B3F90   > \837C24 1C 00 cmp     dword ptr [esp+1C], 0            ;
004B3F95   . 0F84 B6010000 je      004B4151

Case $18
004B3FBB   > \837F 08 00    cmp     dword ptr [edi+8], 0             ;
004B3FBF   . 0F84 D1000000 je      004B4096

Case $1B; 非0x7801标识的文件
004B4149      C74424 30 FDF>mov     dword ptr [esp+30], -3           ;
004B4151   > 837F 28 00    cmp     dword ptr [edi+28], 0
004B4155   . 8B4424 40     mov     eax, dword ptr [esp+40]

解压程序循环处
004B40ED   > \C707 1B000000 mov     dword ptr [edi], 1B              ;
004B40F3   > 8B07          mov     eax, dword ptr [edi]             ;
004B40F5   . 83F8 1C       cmp     eax, 1C                          ;
004B40F8   .^ 0F86 82ECFFFF jbe     004B2D80                         ;

整个主干程序可以写为:

Global *MemVirFile
Global _FileName$ = “aibat_black_easy.lua”

Procedure ResolveData_Open()
FileHandle = CreateFile_(_FileName$, $40000000 | $80000000, 3, 0, 3, 0, 0)
If FileHandle >0
_FileSize = FileSize(_FileName$)
*MemVirFile = AllocateMemory(_FileSize)
Paddess = SetFilePointer_(FileHandle, 0, 0, 0)
ReadFile_(FileHandle, *MemVirFile, _FileSize, @Paddess, 0)
CloseHandle_(FileHandle)
Else
MessageRequester(“出错提示”, “找不到” + _FileName$ + “]资源文件…” )
ProcedureReturn -1
EndIf
EndProcedure

Repeat
Select [EDI]
Case $0B : ResolveData_0B( *MemVirFile )
Case $0F : ResolveData_0F( *MemVirFile )
ResolveData_12( *MemVirFile )
Case $12 : ResolveData_12( *MemVirFile )
Case $17 : ResolveData_17( *MemVirFile )
Case $18 : ResolveData_18( *MemVirFile )
Case $1B : ResolveData_18( *MemVirFile )
Endselect
Until [EDI] <= $1C

具体的 ResolveData_0B() 至 ResolveData_1B()的过程，大家就自己辛苦了。
我就不多说了.