30.06.2021, 15:15
(Dieser Beitrag wurde zuletzt bearbeitet: 30.06.2021, 21:44 von iNvIcTUs oRCuS.)
Aaaahhh the "Lithtech" engine... Nice one...
This is pretty easy...
This is the code section for the players armor...
And your code injection can be look like this...
This is pretty easy...
This is the code section for the players armor...
Code:
object.lto+9CCA3 - D9 46 68 - fld dword ptr [esi+68] <<<--- inject here
object.lto+9CCA6 - D8 64 24 1C - fsub dword ptr [esp+1C]
object.lto+9CCAA - D9 56 68 - fst dword ptr [esi+68]
object.lto+9CCAD - D8 1D 58 86 9B 12 - fcomp dword ptr [object.lto+238658] { (0) }
object.lto+9CCB3 - DF E0 - fnstsw ax
object.lto+9CCB5 - F6 C4 01 - test ah,01 { 1 }
object.lto+9CCB8 - 74 07 - je object.lto+9CCC1
object.lto+9CCBA - C7 46 68 00 00 00 00 - mov [esi+68],00000000 { 0 }
object.lto+9CCC1 - D9 46 60 - fld dword ptr [esi+60]
And your code injection can be look like this...
Code:
fld dword ptr [esi+68] <<<--- original code
push eax <<<--- save EAX to the stack
mov eax,[esi+000000E4] <<<--- copy value of [esi+e4] to eax
cmp [eax],79616C50 { "Play" } <<<--- cmp value at address that eax holds with 'Play' (Player)
pop eax <<<--- restore eax
je originalcode <<<--- if player address...
fsub dword ptr [esp+1C] <<<--- ... than dont subtract armor value when hit
jmp object.lto+9CCAA <<<--- jump back to original code
nop