About LF2 Text [Loading Text Example]

[Boop]

In this tutorial I will be using the loading text as an example but this applies to all (most) of the text in lf2 which isn't stored in the bitmaps.

Open up lf2 in OllyDBG and goto 00412198 (Right click>Goto>expression, or press ctrl+G)

Code:

0041218D  |. 68 27010000    ||PUSH 127                               ;  Y pos
00412192  |. 68 0F010000    ||PUSH 10F                               ;  x Pos
00412197  |. 68 5A77D800    ||PUSH 0D8775A                           ;  Text Color
0041219C  |. 8D9424 F400000>||LEA EDX,DWORD PTR SS:[ESP+F4]          ;  Makes EDX point to the text
004121A3  |. 68 12256500    ||PUSH client.00652512                   ;  Background Color
004121A8  |. 52             ||PUSH EDX                               ;  Push text(edx contains text)
004121A9  |. 50             ||PUSH EAX                               ;  random stuff(I don't know)
004121AA  |. E8 A1F1FEFF    ||CALL client.00401350                   ;  call the showy text function

(the name of my exe is client.exe that's why it says client.004xxxx , in your window it'll probably say lf2.004xxxx or what ever your exe is called)
Okay that is the code you'll see there. As you can see I took the time to add comments to explain which each bit does. As you can see it's all very simple, you can change all the stuff quite easily, the only hard bit is the text which requires a bit more work. Lets change

Code:

LEA EDX,DWORD PTR SS:[ESP+F4]

into

Code:

LEA EDX,DWORD PTR DS:[442474]

(I know for a fact that 42474 is empty) and save the exe(copy to executable>all modifications | New window pops up>Right click>save file) as lf2text.exe.

Open lf2text.exe with Hex workshop and go to offset 42474( not 442474, you need to remove one 4). Type the text you want to display and save the file. Volia you are done.

PS: If you just want to remove text, you can either make the color the same as the color of the background bitmap, or you can make the X pos or the Y pos be off screen.

Screenshot:


I would like to say, that this might of not been the best example in the world, since the loading text always changes so we have an extra function (LEA EDX,DWORD PTR SS:[ESP+F4]) which we normally wouldn't have. But you get the idea.

Usually it's something like

Code:

00423D17   . 68 646A4400    PUSH client1.00446A64                    ;  ASCII "Press F4 or 'Attack' to exit"
00423D1C   . 52             PUSH EDX
00423D1D   . E8 2ED6FDFF    CALL client1.00401350

And you just have to change PUSH 00446A64 to the your address( push 442474 , if you are using the address from this example.

[Silverthorn]

I like this one
Guess, I'll start messing around with the exe again until the version crashes....

[MH-Razen]

Added to LFE:
http://www.lf-empire.de/content/view/595/154/lang,en/

Great work silva