0500睡到1024睡到1120，上床迟了就会熬夜，没办法没办法。没办法吗，有办法有办法。
frida好像能打印当下执行的函数，或许从这里入手好点。
Frida + frida-il2cpp-bridge
frida -n twinkle_starknightsX.exe -l dist/agent.js也能得到Unity Version: 2021.3.25f1，frida真好呀真好呀。
发现TSKBattleAI$$LotterySkill的返回值根据不放技能，技能1，技能2分别是-1，0，1，可以先从hook这里入手，星骑士的ai是出名的弱智，如果能自己定义会方便很多；题外话，它ai还做了很多特殊判断，有随机数，还有计算cd，很奇怪，cd应该是和ui相关的，不该在逻辑这里出现，且游戏中ct循环是关键，一个角色常常会只需要放一个技能；另外undefined8 TSKBattleAI$$LotterySkill(longlong param_1,longlong param_2,longlong param_3)却能
1
2
3
| for (let i = 0; i < 10; i++) {
console.log(`arg${i}: ${args[i]}`);
}
|
多余打印，能通过frida就知道入参个数吗。
1
2
3
4
5
6
7
8
9
10
11
| ==== TSKBattleAI.LotterySkill ====
arg0: 0x27dea25e8d0
arg1: 0x27b605252d0
arg2: 0x27de96e8b40
arg3: 0x0
arg4: 0x27de8911c00
arg5: 0x27d00000002
arg6: 0x0
arg7: 0x0
arg8: 0x27d814beb10
arg9: 0x7ffa9ff64648
|
k__BackingField是某个自动属性对应的隐藏字段。。
好难看，TSKBattleSkillData想看看buff，结果发现字段多的头大
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
| <ID>k__BackingField = -1
<Type>k__BackingField = AtkUp
<SkillTarget>k__BackingField = Self
<SkillTargetValue>k__BackingField = 0
<SkillTargetValue2>k__BackingField = 0
<SkillTargetValue3>k__BackingField = 0
<TimeType>k__BackingField = CT
<Time>k__BackingField = 9991
<TimeMax>k__BackingField = 9999
<SkillValue1>k__BackingField = 520
<SkillValue2>k__BackingField = -1
<SkillValue3>k__BackingField = -1
<SkillValue4>k__BackingField = 2
<SkillValue5>k__BackingField = -1
<Apply>k__BackingField = None
<ApplyRate>k__BackingField = -1
<ApplyValueList>k__BackingField = System.Collections.Generic.List`1[System.Int32]
<Trigger>k__BackingField = 0
<TriggerRate>k__BackingField = 0
<TriggerValue1>k__BackingField = 0
<TriggerValue2>k__BackingField = 0
<TriggerValue3>k__BackingField = 0
<PassiveCoolTime>k__BackingField = 0
<SkillEffectValue>k__BackingField = 520
<Note>k__BackingField = Note (TSKBattleNote)
<IsCopy>k__BackingField = false
<IsApplyAttackBuffUp>k__BackingField = false
<IsProhibited>k__BackingField = false
<IsUsed>k__BackingField = false
<IconPriority>k__BackingField = 0
|