AyamiKaze2021-4-3 00:13 /
这是别人委托搞的，由于没有说要回封，我就只写了提取部分。其实这个脚本要回封很简单，直接把文本塞回去就可以了。由于没有记录脚本长度，所以回封时可以不考虑修正offset之类的玩意儿。
#pragma pack (1)
typedef struct {
char Magic[8]; // PCATSCN\0
DWORD unk; // 0x20
DWORD unk2; // 0x1
DWORD FuncStart; // 从文件头开始计算
DWORD FuncEnd; // 从文件头开始计算
DWORD FuncCount; // 计算从UnkSize到UnkSize2内的函数名个数（autoexec.adv）
} adv_header;
#pragma pack ()
int main(int argc, char* argv[])
{
//char FileName[] = "partA1.adv";
char* FileName = argv[1];
FILE* fp = fopen(FileName, "rb");
fseek(fp, 0, SEEK_END);
DWORD FileSize = ftell(fp);
fseek(fp, 0, SEEK_SET);
char* FileBuff = (char*)malloc(FileSize);
if (!fp)
return E("No FileBuff");
fread(FileBuff, FileSize, 1, fp);
fclose(fp);
adv_header* header = (adv_header*)FileBuff;
if (strcmp(header->Magic, "PCATSCN"))
return E("Not PCATSCN");
FileBuff += header->FuncEnd;
char nfnm[MAX_PATH] = { 0 };
sprintf(nfnm, "%s.txt", FileName);
fp = fopen(nfnm, "wb");
char* text_buf = nullptr;
DWORD text_len = 0;
// sub_4221C0
for (int pos = 0; pos < FileSize - header->FuncEnd;)
{
switch (FileBuff[pos] & 0xFF)
{
case 0x90:
pos++;
switch (FileBuff[pos] & 0xFF)
{
case 0x11:
case 0x25:
case 0x28:
pos++;
text_buf = FileBuff + pos;
text_len = strlen(text_buf);
WriteLine(text_buf, text_len, fp);
pos += text_len;
break;
default:
pos++;
break;
}
break;
default:
pos++;
break;
}
}
fclose(fp);
system("pause");
return 0;
}