<![CDATA[Little Fighter Empire - Forums - Tutorials]]> https://lf-empire.de/forum/ Sat, 14 Nov 2026 12:05:48 +0000 MyBB <![CDATA[[Tut] Reversing the effects of a CFG.]]> https://lf-empire.de/forum/showthread.php?tid=7183 Tue, 25 Oct 2011 12:10:26 +0200 Electric2Shock]]> https://lf-empire.de/forum/showthread.php?tid=7183
You need:
1. Either a Hex editor or a CFG patcher.
2. Some patience
3. Ability to understand

Using Hex editor (Click to View)
Using CFG patcher (Click to View)
P.S: You need to have the CFG applied before you can use this method.
And to know how to apply CFGs without the Patcher, see >>this<<

Some moderator who happens to pass by please move this thread to the Tutorials section.]]>
You need:
1. Either a Hex editor or a CFG patcher.
2. Some patience
3. Ability to understand

Using Hex editor (Click to View)
Using CFG patcher (Click to View)
P.S: You need to have the CFG applied before you can use this method.
And to know how to apply CFGs without the Patcher, see >>this<<

Some moderator who happens to pass by please move this thread to the Tutorials section.]]> <![CDATA[[Tut] Apply CFG Patches using HEX Editor.]]> https://lf-empire.de/forum/showthread.php?tid=6343 Tue, 26 Apr 2011 16:58:53 +0200 Electric2Shock]]> https://lf-empire.de/forum/showthread.php?tid=6343 P.S: Never use this tutorial on Moleboxed exe's such as NTSD.
Tutorial (Click to View)
Also do not mind to use this tutorial unless it is a very small CFG or a modified EXE. Please have a little bit mercy to me as becuase it is my first HEX tutorial. I did not post this in the Tutorials section becuase I was not allowed to. Feedback is welcome.]]> P.S: Never use this tutorial on Moleboxed exe's such as NTSD.
Tutorial (Click to View)
Also do not mind to use this tutorial unless it is a very small CFG or a modified EXE. Please have a little bit mercy to me as becuase it is my first HEX tutorial. I did not post this in the Tutorials section becuase I was not allowed to. Feedback is welcome.]]> <![CDATA[Newbie Hex Introduction + Edit Solid Colors]]> https://lf-empire.de/forum/showthread.php?tid=852 Wed, 13 Aug 2008 17:19:02 +0200 Silverthorn]]> https://lf-empire.de/forum/showthread.php?tid=852 I know, in this area I still feel like a noob =P

Sometimes, people ask, how you change the colors that are not stored in a bitmap (which themselves are integrated in the exe as socalled "Resources"). If you've never heard about hex yet, it's time to get into the matter now. Let's get started :)

LF2 was programmed in C, a language that looks like this:
Code:
#include <stdio.h> #include <stdlib.h> int main(void) { printf("Hello World!\n"); return EXIT_SUCCESS; }

Well, this would be the raw code, but for a computer, a code file is not more than a useless bunch of letters. To give the computer the information that it needs to work with, you need to compile the code. Compiling = making the code unreadable for humans but very readable for the computer.
Now, our program has become something totally different. You can't really edit it anymore (except you have knowledge of hex-editing) and it's a pretty secure way of hiding algorithms.

To get back to our topic, get the exe ready (probably it's a good idea to make a backup in case you get something wrong). Then, open the hex-editor of your choice (if you don't have any, go >here<). Paste the exe in there, and you'll see a bunch of random numbers, between 00 and FF.
00-FF? Yes, this is the hexadecimal system, our common decimal system has (as you hopefully know) 10 different digits, the hexadecimal system (latin ftw!) has 16 different digits: 0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F. So, FF is the same like 255 in decimal system.
Now we need another tool to work with: FarbHexe. It sounds funny, works simple but thus is easy to use. You can download it from the link a few lines ago. Start FarbHexe and then LF2 (actually, the order doesn't really matter). You have this typical blue background that doesn't really fit if you have, for example an orange skin in progress. So, we need a nice, orange color. Now, hover over the background and read what FarbHexe says:
10 20 6c
Well, that sounds promising. Go back to the hex editor, and search for the value. But if you'll look for 10206c (I'd recommend no space if you search for hex), you'll be disappointed. The problem is that not every color is in RGB (Red,Green,Blue). There are also some things in BGR (the devil knows why...). What you're ought to do is just switch the value from 10206c to 6c2010. And, surprise, you'll get a 6c2010! If you have 1.9c as a basis, the value should be in line 26ec, on the e-th place. Convenient-wise you'd write it as an offset: 26ece (For the lf2-patcher, you should add the zeros in front, so 00026ece). Let's change it to orange. I'll take this color. Since it's BGR, you have to write it as 0088FF. Be sure to have the exe already closed, so that you can save your result!
Save the change, and you should have an orange background at the start screen.

You can do the same with any color that you can't find in the bitmaps. However, you should first search for RGB, if the supposed change doesn't work at any offset, try to search for BGR.

I know, this was a lot matter for such a simple thing, I just tried to write it in a way that people with absolutely no knowledge of hex can understand it ;)

Hope this helps :)]]> I know, in this area I still feel like a noob =P

Sometimes, people ask, how you change the colors that are not stored in a bitmap (which themselves are integrated in the exe as socalled "Resources"). If you've never heard about hex yet, it's time to get into the matter now. Let's get started :)

LF2 was programmed in C, a language that looks like this:
Code:
#include <stdio.h> #include <stdlib.h> int main(void) { printf("Hello World!\n"); return EXIT_SUCCESS; }

Well, this would be the raw code, but for a computer, a code file is not more than a useless bunch of letters. To give the computer the information that it needs to work with, you need to compile the code. Compiling = making the code unreadable for humans but very readable for the computer.
Now, our program has become something totally different. You can't really edit it anymore (except you have knowledge of hex-editing) and it's a pretty secure way of hiding algorithms.

To get back to our topic, get the exe ready (probably it's a good idea to make a backup in case you get something wrong). Then, open the hex-editor of your choice (if you don't have any, go >here<). Paste the exe in there, and you'll see a bunch of random numbers, between 00 and FF.
00-FF? Yes, this is the hexadecimal system, our common decimal system has (as you hopefully know) 10 different digits, the hexadecimal system (latin ftw!) has 16 different digits: 0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F. So, FF is the same like 255 in decimal system.
Now we need another tool to work with: FarbHexe. It sounds funny, works simple but thus is easy to use. You can download it from the link a few lines ago. Start FarbHexe and then LF2 (actually, the order doesn't really matter). You have this typical blue background that doesn't really fit if you have, for example an orange skin in progress. So, we need a nice, orange color. Now, hover over the background and read what FarbHexe says:
10 20 6c
Well, that sounds promising. Go back to the hex editor, and search for the value. But if you'll look for 10206c (I'd recommend no space if you search for hex), you'll be disappointed. The problem is that not every color is in RGB (Red,Green,Blue). There are also some things in BGR (the devil knows why...). What you're ought to do is just switch the value from 10206c to 6c2010. And, surprise, you'll get a 6c2010! If you have 1.9c as a basis, the value should be in line 26ec, on the e-th place. Convenient-wise you'd write it as an offset: 26ece (For the lf2-patcher, you should add the zeros in front, so 00026ece). Let's change it to orange. I'll take this color. Since it's BGR, you have to write it as 0088FF. Be sure to have the exe already closed, so that you can save your result!
Save the change, and you should have an orange background at the start screen.

You can do the same with any color that you can't find in the bitmaps. However, you should first search for RGB, if the supposed change doesn't work at any offset, try to search for BGR.

I know, this was a lot matter for such a simple thing, I just tried to write it in a way that people with absolutely no knowledge of hex can understand it ;)

Hope this helps :)]]> <![CDATA[Fusion Tutorial]]> https://lf-empire.de/forum/showthread.php?tid=734 Tue, 29 Jul 2008 12:50:29 +0200 Boop]]> https://lf-empire.de/forum/showthread.php?tid=734 . So here is a really quick and easy way to do it ( I'll write a detailed explanation at some point :p). PS : I decided to just release this without an explanation because I doubt most people will read it anyway...

First of all apply this patch with the cfg patcher(remove all the spaces the board adds):
Code:
0000238D,83F9077409,E994000400 00002405,BA0F0000,E9500004 00002537,83BAF406000033,E93DFF03009090 000025C1,C7427022010000,E9E2FE03009090 000026BA,83BAF406000033,E90CFE03009090 000442426,000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,83F907740583F908750CC605D01F450000E95FFFFBFF83F915740983F9160F855902FCFFC605D01F450001E945FFFBFF00000000803DD01F450000750ABA0F000000E99DFFFBFFBA2B000000E993FFFBFF0000803DD01F450000751283BAF4060000330F84CA00FCFFE9AC00FCFF83BAF4060000340F84B800FCFFE99A00FCFF0000803DD01F450000750CC7427022010000E90B01FCFFC7427036010000E9FF00FCFF0000803DD01F450000751283BAF4060000330F84E601FCFFE9F006FCFF83BAF4060000340F84D401FCFFE9DE06FCFF

Then right click > go to > expression > 00442426 .

Here is an out line of what you have to change :

Code:
00442426 > 83F9 07 CMP ECX,7 00442429 . 74 05 JE SHORT lf2_fusi.00442430 0044242B . 83F9 08 CMP ECX,8 0044242E . 75 0C JNZ SHORT lf2_fusi.0044243C 00442430 > C605 D01F4500 >MOV BYTE PTR DS:[451FD0],0 00442437 .^E9 5FFFFBFF JMP lf2_fusi.0040239B 0044243C > 83F9 15 CMP ECX,15 ; ID 1 0044243F . 74 09 JE SHORT lf2_fusi.0044244A 00442441 . 83F9 16 CMP ECX,16 ; ID 2 00442444 .^0F85 5902FCFF JNZ lf2_fusi.004026A3 0044244A > C605 D01F4500 >MOV BYTE PTR DS:[451FD0],1 00442451 .^E9 45FFFBFF JMP lf2_fusi.0040239B 00442456 00 DB 00 00442457 00 DB 00 00442458 00 DB 00 00442459 00 DB 00 0044245A > 803D D01F4500 >CMP BYTE PTR DS:[451FD0],0 00442461 . 75 0A JNZ SHORT lf2_fusi.0044246D 00442463 . BA 0F000000 MOV EDX,0F 00442468 .^E9 9DFFFBFF JMP lf2_fusi.0040240A 0044246D > BA 2B000000 MOV EDX,2B ; ID 1 + ID 2(in this case 16+15 = 2B) 00442472 .^E9 93FFFBFF JMP lf2_fusi.0040240A 00442477 00 DB 00 00442478 00 DB 00 00442479 > 803D D01F4500 >CMP BYTE PTR DS:[451FD0],0 00442480 . 75 12 JNZ SHORT lf2_fusi.00442494 00442482 . 83BA F4060000 >CMP DWORD PTR DS:[EDX+6F4],33 00442489 .^0F84 CA00FCFF JE lf2_fusi.00402559 0044248F .^E9 AC00FCFF JMP lf2_fusi.00402540 00442494 > 83BA F4060000 >CMP DWORD PTR DS:[EDX+6F4],34 ; ID you want to fuse too 0044249B .^0F84 B800FCFF JE lf2_fusi.00402559 004424A1 .^E9 9A00FCFF JMP lf2_fusi.00402540 004424A6 00 DB 00 004424A7 00 DB 00 004424A8 > 803D D01F4500 >CMP BYTE PTR DS:[451FD0],0 004424AF . 75 0C JNZ SHORT lf2_fusi.004424BD 004424B1 . C742 70 220100>MOV DWORD PTR DS:[EDX+70],122 004424B8 .^E9 0B01FCFF JMP lf2_fusi.004025C8 004424BD > C742 70 360100>MOV DWORD PTR DS:[EDX+70],136 ; frame you go to after fusion 004424C4 .^E9 FF00FCFF JMP lf2_fusi.004025C8 004424C9 00 DB 00 004424CA 00 DB 00 004424CB > 803D D01F4500 >CMP BYTE PTR DS:[451FD0],0 004424D2 . 75 12 JNZ SHORT lf2_fusi.004424E6 004424D4 . 83BA F4060000 >CMP DWORD PTR DS:[EDX+6F4],33 004424DB .^0F84 E601FCFF JE lf2_fusi.004026C7 004424E1 .^E9 F006FCFF JMP lf2_fusi.00402BD6 004424E6 > 83BA F4060000 >CMP DWORD PTR DS:[EDX+6F4],34 ; id you you fuse 2, if you want the fusion to be permanent then just put some unused id here 004424ED .^0F84 D401FCFF JE lf2_fusi.004026C7 004424F3 .^E9 DE06FCFF JMP lf2_fusi.00402BD6

Detailed explanation :

Coming at some point.]]> . So here is a really quick and easy way to do it ( I'll write a detailed explanation at some point :p). PS : I decided to just release this without an explanation because I doubt most people will read it anyway...

First of all apply this patch with the cfg patcher(remove all the spaces the board adds):
Code:
0000238D,83F9077409,E994000400 00002405,BA0F0000,E9500004 00002537,83BAF406000033,E93DFF03009090 000025C1,C7427022010000,E9E2FE03009090 000026BA,83BAF406000033,E90CFE03009090 000442426,000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,83F907740583F908750CC605D01F450000E95FFFFBFF83F915740983F9160F855902FCFFC605D01F450001E945FFFBFF00000000803DD01F450000750ABA0F000000E99DFFFBFFBA2B000000E993FFFBFF0000803DD01F450000751283BAF4060000330F84CA00FCFFE9AC00FCFF83BAF4060000340F84B800FCFFE99A00FCFF0000803DD01F450000750CC7427022010000E90B01FCFFC7427036010000E9FF00FCFF0000803DD01F450000751283BAF4060000330F84E601FCFFE9F006FCFF83BAF4060000340F84D401FCFFE9DE06FCFF

Then right click > go to > expression > 00442426 .

Here is an out line of what you have to change :

Code:
00442426 > 83F9 07 CMP ECX,7 00442429 . 74 05 JE SHORT lf2_fusi.00442430 0044242B . 83F9 08 CMP ECX,8 0044242E . 75 0C JNZ SHORT lf2_fusi.0044243C 00442430 > C605 D01F4500 >MOV BYTE PTR DS:[451FD0],0 00442437 .^E9 5FFFFBFF JMP lf2_fusi.0040239B 0044243C > 83F9 15 CMP ECX,15 ; ID 1 0044243F . 74 09 JE SHORT lf2_fusi.0044244A 00442441 . 83F9 16 CMP ECX,16 ; ID 2 00442444 .^0F85 5902FCFF JNZ lf2_fusi.004026A3 0044244A > C605 D01F4500 >MOV BYTE PTR DS:[451FD0],1 00442451 .^E9 45FFFBFF JMP lf2_fusi.0040239B 00442456 00 DB 00 00442457 00 DB 00 00442458 00 DB 00 00442459 00 DB 00 0044245A > 803D D01F4500 >CMP BYTE PTR DS:[451FD0],0 00442461 . 75 0A JNZ SHORT lf2_fusi.0044246D 00442463 . BA 0F000000 MOV EDX,0F 00442468 .^E9 9DFFFBFF JMP lf2_fusi.0040240A 0044246D > BA 2B000000 MOV EDX,2B ; ID 1 + ID 2(in this case 16+15 = 2B) 00442472 .^E9 93FFFBFF JMP lf2_fusi.0040240A 00442477 00 DB 00 00442478 00 DB 00 00442479 > 803D D01F4500 >CMP BYTE PTR DS:[451FD0],0 00442480 . 75 12 JNZ SHORT lf2_fusi.00442494 00442482 . 83BA F4060000 >CMP DWORD PTR DS:[EDX+6F4],33 00442489 .^0F84 CA00FCFF JE lf2_fusi.00402559 0044248F .^E9 AC00FCFF JMP lf2_fusi.00402540 00442494 > 83BA F4060000 >CMP DWORD PTR DS:[EDX+6F4],34 ; ID you want to fuse too 0044249B .^0F84 B800FCFF JE lf2_fusi.00402559 004424A1 .^E9 9A00FCFF JMP lf2_fusi.00402540 004424A6 00 DB 00 004424A7 00 DB 00 004424A8 > 803D D01F4500 >CMP BYTE PTR DS:[451FD0],0 004424AF . 75 0C JNZ SHORT lf2_fusi.004424BD 004424B1 . C742 70 220100>MOV DWORD PTR DS:[EDX+70],122 004424B8 .^E9 0B01FCFF JMP lf2_fusi.004025C8 004424BD > C742 70 360100>MOV DWORD PTR DS:[EDX+70],136 ; frame you go to after fusion 004424C4 .^E9 FF00FCFF JMP lf2_fusi.004025C8 004424C9 00 DB 00 004424CA 00 DB 00 004424CB > 803D D01F4500 >CMP BYTE PTR DS:[451FD0],0 004424D2 . 75 12 JNZ SHORT lf2_fusi.004424E6 004424D4 . 83BA F4060000 >CMP DWORD PTR DS:[EDX+6F4],33 004424DB .^0F84 E601FCFF JE lf2_fusi.004026C7 004424E1 .^E9 F006FCFF JMP lf2_fusi.00402BD6 004424E6 > 83BA F4060000 >CMP DWORD PTR DS:[EDX+6F4],34 ; id you you fuse 2, if you want the fusion to be permanent then just put some unused id here 004424ED .^0F84 D401FCFF JE lf2_fusi.004026C7 004424F3 .^E9 DE06FCFF JMP lf2_fusi.00402BD6

Detailed explanation :

Coming at some point.]]> <![CDATA[10 HP when Opointed]]> https://lf-empire.de/forum/showthread.php?tid=711 Sun, 27 Jul 2008 17:01:29 +0200 Boop]]> https://lf-empire.de/forum/showthread.php?tid=711 .

0042269A . 83F9 05 CMP ECX,5 << Rudolf's ID
0042269D 74 05 JE SHORT lf2.004226A4
0042269F . 83F9 34 CMP ECX,34 << Julian's ID
004226A2 75 36 JNZ SHORT lf2.004226DA
004226A4 > B9 0A000000 MOV ECX,0A << 10 hp


Replace CMP ECX,5 with JMP 00442XXX (I'm using JMP 00442963). Then Right click>Go to>expression > 00442XXX( 00442963)

And write this code:

CMP ECX,5
JE 004226A4
CMP ECX, ID (the ID you want to copy to)
JE 004226A4
JMP 004226DA

Have fun.]]> .

0042269A . 83F9 05 CMP ECX,5 << Rudolf's ID
0042269D 74 05 JE SHORT lf2.004226A4
0042269F . 83F9 34 CMP ECX,34 << Julian's ID
004226A2 75 36 JNZ SHORT lf2.004226DA
004226A4 > B9 0A000000 MOV ECX,0A << 10 hp


Replace CMP ECX,5 with JMP 00442XXX (I'm using JMP 00442963). Then Right click>Go to>expression > 00442XXX( 00442963)

And write this code:

CMP ECX,5
JE 004226A4
CMP ECX, ID (the ID you want to copy to)
JE 004226A4
JMP 004226DA

Have fun.]]> <![CDATA[Tutorial Links Libary]]> https://lf-empire.de/forum/showthread.php?tid=706 Sun, 27 Jul 2008 15:22:19 +0200 Boop]]> https://lf-empire.de/forum/showthread.php?tid=706 Change Loading text
Stage Mode Only LF2
Bitmap In Middle Of Screen (random stupid thing)

ID Related:
AI Part 1
AI Part 2
Range AI
ID Armor
Weapon Broken Peices
MP Regeneration
10 HP when opointed
Fusion]]> Change Loading text
Stage Mode Only LF2
Bitmap In Middle Of Screen (random stupid thing)

ID Related:
AI Part 1
AI Part 2
Range AI
ID Armor
Weapon Broken Peices
MP Regeneration
10 HP when opointed
Fusion]]> <![CDATA[Range AI]]> https://lf-empire.de/forum/showthread.php?tid=697 Sat, 26 Jul 2008 22:10:59 +0200 Boop]]> https://lf-empire.de/forum/showthread.php?tid=697
Range AI is split into 4 parts. I didn't bother finding out what each part does :p.

part one:

00407A8A |. 8B89 F4060000 MOV ECX,DWORD PTR DS:[ECX+6F4] ; RANGE
00407A90 |. 83F9 04 CMP ECX,4 << ID 4
00407A93 |. 0F84 3B010000 JE lf2.00407BD4
00407A99 |. 83F9 05 CMP ECX,5 << ID 5
00407A9C |. 0F84 32010000 JE lf2.00407BD4
00407AA2 |. 83F9 1F CMP ECX,1F << ID 31
00407AA5 |. 0F84 29010000 JE lf2.00407BD4

part 2:(looks the same as part one)
00407EC8 |. 8B80 F4060000 MOV EAX,DWORD PTR DS:[EAX+6F4] ; RANGE
00407ECE |. 83F8 04 CMP EAX,4
00407ED1 |. 74 0A JE SHORT lf2.00407EDD
00407ED3 |. 83F8 05 CMP EAX,5
00407ED6 |. 74 05 JE SHORT lf2.00407EDD
00407ED8 |. 83F8 1F CMP EAX,1F

part 3:
0040806B |. 83F8 04 CMP EAX,4
0040806E |. 74 13 JE SHORT lf2.00408083
00408070 |. 83F8 05 CMP EAX,5
00408073 |. 74 0E JE SHORT lf2.00408083
00408075 |. 83F8 1F CMP EAX,1F
00408078 |. 74 09 JE SHORT lf2.00408083
0040807A |. 83F8 24 CMP EAX,24 << jans' ID! huh?!

I suspect part 3 just tell them to run around a lot :p, if you haven't noticed jans AI tries to keep a distance and cast those devil/angle things all the time, doesn't usually fight melee if she can help it:p.

Part 4 (update, I guess I missed this):
00407F81 |. 8B82 F4060000 MOV EAX,DWORD PTR DS:[EDX+6F4]
00407F87 |. 83F8 04 CMP EAX,4
00407F8A |. 74 0E JE SHORT lf2.00407F9A
00407F8C |. 83F8 05 CMP EAX,5
00407F8F |. 74 09 JE SHORT lf2.00407F9A
00407F91 |. 83F8 1F CMP EAX,1F
00407F94 |. 0F85 B2000000 JNZ lf2.0040804C




To copy the range AI to more ID's just replace(using part one as an example :
00407A90 |. 83F9 04 CMP ECX,4 << ID 4

With
JMP XXXXXXX

Then at XXXXXX:

CMP ECX,4
JE 00407BD4
CMP ECX,30 (id 48, the ID you want to copy to)
JE 00407BD4
JMP 00407A99

Hopefully you should be able to apply this to the other 2 parts (if you can't I'll edit the tutorial).]]>
Range AI is split into 4 parts. I didn't bother finding out what each part does :p.

part one:

00407A8A |. 8B89 F4060000 MOV ECX,DWORD PTR DS:[ECX+6F4] ; RANGE
00407A90 |. 83F9 04 CMP ECX,4 << ID 4
00407A93 |. 0F84 3B010000 JE lf2.00407BD4
00407A99 |. 83F9 05 CMP ECX,5 << ID 5
00407A9C |. 0F84 32010000 JE lf2.00407BD4
00407AA2 |. 83F9 1F CMP ECX,1F << ID 31
00407AA5 |. 0F84 29010000 JE lf2.00407BD4

part 2:(looks the same as part one)
00407EC8 |. 8B80 F4060000 MOV EAX,DWORD PTR DS:[EAX+6F4] ; RANGE
00407ECE |. 83F8 04 CMP EAX,4
00407ED1 |. 74 0A JE SHORT lf2.00407EDD
00407ED3 |. 83F8 05 CMP EAX,5
00407ED6 |. 74 05 JE SHORT lf2.00407EDD
00407ED8 |. 83F8 1F CMP EAX,1F

part 3:
0040806B |. 83F8 04 CMP EAX,4
0040806E |. 74 13 JE SHORT lf2.00408083
00408070 |. 83F8 05 CMP EAX,5
00408073 |. 74 0E JE SHORT lf2.00408083
00408075 |. 83F8 1F CMP EAX,1F
00408078 |. 74 09 JE SHORT lf2.00408083
0040807A |. 83F8 24 CMP EAX,24 << jans' ID! huh?!

I suspect part 3 just tell them to run around a lot :p, if you haven't noticed jans AI tries to keep a distance and cast those devil/angle things all the time, doesn't usually fight melee if she can help it:p.

Part 4 (update, I guess I missed this):
00407F81 |. 8B82 F4060000 MOV EAX,DWORD PTR DS:[EDX+6F4]
00407F87 |. 83F8 04 CMP EAX,4
00407F8A |. 74 0E JE SHORT lf2.00407F9A
00407F8C |. 83F8 05 CMP EAX,5
00407F8F |. 74 09 JE SHORT lf2.00407F9A
00407F91 |. 83F8 1F CMP EAX,1F
00407F94 |. 0F85 B2000000 JNZ lf2.0040804C




To copy the range AI to more ID's just replace(using part one as an example :
00407A90 |. 83F9 04 CMP ECX,4 << ID 4

With
JMP XXXXXXX

Then at XXXXXX:

CMP ECX,4
JE 00407BD4
CMP ECX,30 (id 48, the ID you want to copy to)
JE 00407BD4
JMP 00407A99

Hopefully you should be able to apply this to the other 2 parts (if you can't I'll edit the tutorial).]]> <![CDATA[Weapon's Broken Pieces of ID]]> https://lf-empire.de/forum/showthread.php?tid=690 Sat, 26 Jul 2008 07:21:49 +0200 xxtomnyxx]]> https://lf-empire.de/forum/showthread.php?tid=690 yuo may think about problem, it has no pieces after it broke.
Now this problem could be solved.

There are three parts that relate with the broken pieces of each id.
If you want to copy the id or creat a new one,you have to change these parts.


First part

004228E3 . 8B81 F4060000 mov eax,dword ptr ds:[ecx+6F4]
004228E9 . 83F8 65 cmp eax,65
004228EC . 74 07 je short lf2-t.004228F5
004228EE . 3D DA000000 cmp eax,0DA
004228F3 . 75 09 jnz short lf2-t.004228FE
004228F5 > BE 07000000 mov esi,7
004228FA . 897424 14 mov dword ptr ss:[esp+14],esi
004228FE 83F8 64 cmp eax,64
00422901 74 0E je short lf2-t.00422911
00422903 . 3D D5000000 cmp eax,0D5
00422908 . 74 07 je short lf2-t.00422911
0042290A . 3D D9000000 cmp eax,0D9
0042290F . 75 09 jnz short lf2-t.0042291A
00422911 > BE 05000000 mov esi,5
00422916 . 897424 14 mov dword ptr ss:[esp+14],esi
0042291A > 3D C9000000 cmp eax,0C9
0042291F . 75 09 jnz short lf2-t.0042292A
00422921 . BE 03000000 mov esi,3
00422926 . 897424 14 mov dword ptr ss:[esp+14],esi
0042292A > 3D 96000000 cmp eax,96
0042292F . 75 09 jnz short lf2-t.0042293A
00422931 . BE 0D000000 mov esi,0D
00422936 . 897424 14 mov dword ptr ss:[esp+14],esi
0042293A > 3D 97000000 cmp eax,97
0042293F . 75 09 jnz short lf2-t.0042294A
00422941 . BE 0F000000 mov esi,0F
00422946 . 897424 14 mov dword ptr ss:[esp+14],esi
0042294A > 83F8 78 cmp eax,78
0042294D . 74 05 je short lf2-t.00422954
0042294F . 83F8 7C cmp eax,7C
00422952 . 75 09 jnz short lf2-t.0042295D
00422954 > BE 03000000 mov esi,3
00422959 . 897424 14 mov dword ptr ss:[esp+14],esi
0042295D > 83F8 79 cmp eax,79
00422960 . 75 09 jnz short lf2-t.0042296B
00422962 . BE 04000000 mov esi,4
00422967 . 897424 14 mov dword ptr ss:[esp+14],esi
0042296B > 83F8 7A cmp eax,7A
0042296E . 74 05 je short lf2-t.00422975
00422970 . 83F8 7B cmp eax,7B
00422973 . 75 09 jnz short lf2-t.0042297E
00422975 > BE 09000000 mov esi,9
0042297A . 897424 14 mov dword ptr ss:[esp+14],esi
0042297E > 8B81 AC000000 mov eax,dword ptr ds:[ecx+AC]


Second part

00422AD9 . 8B82 F4060000 mov eax,dword ptr ds:[edx+6F4]
00422ADF . 3D 96000000 cmp eax,96
00422AE4 . 74 0E je short lf2-t.00422AF4
00422AE6 . 3D 97000000 cmp eax,97
00422AEB . 74 07 je short lf2-t.00422AF4
00422AED . 3D D5000000 cmp eax,0D5
00422AF2 . 75 29 jnz short lf2-t.00422B1D
00422AF4 > 6A 14 push 14
00422AF6 . E8 4572FFFF call lf2-t.00419D40
00422AFB . 99 cdq
00422AFC . 2BC2 sub eax,edx
00422AFE . 83C4 04 add esp,4
00422B01 . D1F8 sar eax,1
00422B03 . F7D8 neg eax
00422B05 . 894424 24 mov dword ptr ss:[esp+24],eax
00422B09 . 8B84B3 94010000 mov eax,dword ptr ds:[ebx+esi*4+194]
00422B10 . DB4424 24 fild dword ptr ss:[esp+24]
00422B14 . DC25 30324400 fsub qword ptr ds:[443230]
00422B1A . DD58 48 fstp qword ptr ds:[eax+48]
00422B1D > 8B8CBB 94010000 mov ecx,dword ptr ds:[ebx+edi*4+194]
00422B24 . 8B91 68030000 mov edx,dword ptr ds:[ecx+368]
00422B2A . 8B82 F4060000 mov eax,dword ptr ds:[edx+6F4]
00422B30 . E9 8BF90100 jmp lf2-t.004424C0
00422B35 > 3D C9000000 cmp eax,0C9
00422B3A . 74 2C je short lf2-t.00422B68
00422B3C . 83F8 65 cmp eax,65
00422B3F . 74 27 je short lf2-t.00422B68
00422B41 . 83F8 78 cmp eax,78
00422B44 . 74 22 je short lf2-t.00422B68
00422B46 . 83F8 79 cmp eax,79
00422B49 . 74 1D je short lf2-t.00422B68
00422B4B . 83F8 7A cmp eax,7A
00422B4E . 74 18 je short lf2-t.00422B68
00422B50 . 83F8 7B cmp eax,7B
00422B53 . 74 13 je short lf2-t.00422B68
00422B55 . 83F8 7C cmp eax,7C
00422B58 . 74 0E je short lf2-t.00422B68
00422B5A . 3D D9000000 cmp eax,0D9
00422B5F . 74 07 je short lf2-t.00422B68
00422B61 . 3D DA000000 cmp eax,0DA
00422B66 . 75 29 jnz short lf2-t.00422B91
00422B68 > 6A 08 push 8


Third part

00422BB3 |. 8B94BB 94010000 ||mov edx,dword ptr ds:[ebx+edi*4+194]
00422BBA |. 8B82 68030000 ||mov eax,dword ptr ds:[edx+368]
00422BC0 |. 81B8 F4060000 96000000 ||cmp dword ptr ds:[eax+6F4],96
00422BCA |. 75 34 ||jnz short lf2.00422C00
00422BCC |. 8B4424 10 ||mov eax,dword ptr ss:[esp+10]
　　　.　　　　　　　　　.　　　　　　　　　　　　　　　　　.　
　　　.　　　　　　　　　.　　　　　　　　　　　　　　　　　.　
　　　.　　　　　　　　　.　　　　　　　　　　　　　　　　　.　
　　　.　　　　　　　　　.　　　　　　　　　　　　　　　　　.　
　　　.　　　　　　　　　.　　　　　　　　　　　　　　　　　.　
　　　.　　　　　　　　　.　　　　　　　　　　　　　　　　　.　
00422F54 |> \8B8CBB 94010000 ||mov ecx,dword ptr ds:[ebx+edi*4+194]
00422F5B |. 8B91 68030000 ||mov edx,dword ptr ds:[ecx+368]
00422F61 |. 8B82 F4060000 ||mov eax,dword ptr ds:[edx+6F4]
00422F67 |. 3D D9000000 ||cmp eax,0D9
00422F6C |. 74 07 ||je short lf2.00422F75
00422F6E |. 3D DA000000 ||cmp eax,0DA
00422F73 |. 75 19 ||jnz short lf2.00422F8E
00422F75 |> 6A 04 ||push 4
00422F77 |. E8 C46DFFFF ||call lf2.00419D40
00422F7C |. 8B8CB3 94010000 ||mov ecx,dword ptr ds:[ebx+esi*4+194]
00422F83 |. 83C4 04 ||add esp,4
00422F86 |. 05 AE000000 ||add eax,0AE
00422F8B |. 8941 70 ||mov dword ptr ds:[ecx+70],eax
00422F8E |> 8B4424 10 ||mov eax,dword ptr ss:[esp+10]
00422F92 |. 8B4C24 14 ||mov ecx,dword ptr ss:[esp+14]
00422F96 |. 40 ||inc eax
00422F97 |. 3BC1 ||cmp eax,ecx
00422F99 |. 894424 10 ||mov dword ptr ss:[esp+10],eax
00422F9D |.^ 0F8C 07FAFFFF |\jl lf2.004229AA

Third part settles each id and it's pieces.
The red code is the weapon's id.
I created a new weapon id and it's own broken pieces.
You can consult it to copy or creat a new id and broke pieces by yourself.

I use id 100 (weapon0) to make procedure detour.

First part
004228FA . 897424 14 mov dword ptr ss:[esp+14],esi
004228FE E9 9DFB0100 jmp lf2-t.004424A0
00422903 . 3D D5000000 cmp eax,0D5
00422908 . 74 07 je short lf2-t.00422911

Second part
00422B2A . 8B82 F4060000 mov eax,dword ptr ds:[edx+6F4]
00422B30 . E9 8BF90100 jmp lf2-t.004424C0
00422B35 > 3D C9000000 cmp eax,0C9
00422B3A . 74 2C je short lf2-t.00422B68

Third part
00422C00 > \8B84BB 94010000 mov eax,dword ptr ds:[ebx+edi*4+194]
00422C07 . 8B88 68030000 mov ecx,dword ptr ds:[eax+368]
00422C0D . E9 EEF80100 jmp lf2-t.00442500
00422C12 90 nop
00422C13 90 nop
00422C14 . 75 37 jnz short lf2-t.00422C4D
00422C16 > 8B4424 10 mov eax,dword ptr ss:[esp+10]
00422C1A . 6A 04 push 4
00422C1C . 83F8 02 cmp eax,2


Detour of First part
004424A0 83F8 64 cmp eax,64
004424A3 ^ 0F84 6804FEFF je lf2-t.00422911
004424A9 3D 82000000 cmp eax,82
004424AE ^ 0F84 5D04FEFF je lf2-t.00422911
004424B4 ^ E9 4A04FEFF jmp lf2-t.00422903

Detour of Second part
004424C0 > 83F8 64 cmp eax,64
004424C3 .^ 0F84 9F06FEFF je lf2-t.00422B68
004424C9 3D 82000000 cmp eax,82
004424CE .^ 0F84 9406FEFF je lf2-t.00422B68
004424D4 .^ E9 5C06FEFF jmp lf2-t.00422B35

Detour of Third part
00442500 > \83B9 F4060000 64 cmp dword ptr ds:[ecx+6F4],64
00442507 .^ 0F84 0907FEFF je lf2-t.00422C16
0044250D . 81B9 F4060000 82000000 cmp dword ptr ds:[ecx+6F4],82
00442517 ^ 0F85 3007FEFF jnz lf2-t.00422C4D
0044251D 8B4424 10 mov eax,dword ptr ss:[esp+10]
00442521 6A 04 push 4
00442523 83F8 02 cmp eax,2
00442526 7D 20 jge short lf2-t.00442548
00442528 90 nop
00442529 90 nop
0044252A 90 nop
0044252B 90 nop
0044252C E8 0F78FDFF call lf2-t.00419D40
00442531 8B94B3 94010000 mov edx,dword ptr ds:[ebx+esi*4+194]
00442538 83C4 04 add esp,4
0044253B 05 B4000000 add eax,0B4
00442540 8942 70 mov dword ptr ds:[edx+70],eax
00442543 ^ E9 0507FEFF jmp lf2-t.00422C4D
00442548 E8 F377FDFF call lf2-t.00419D40
0044254D 8B8CB3 94010000 mov ecx,dword ptr ds:[ebx+esi*4+194]
00442554 83C4 04 add esp,4
00442557 05 B8000000 add eax,0B8
0044255C 8941 70 mov dword ptr ds:[ecx+70],eax
0044255F ^ E9 E906FEFF jmp lf2-t.00422C4D

The new id I creat is 130(82 in Hex).
After it broke, it's pieces is frame 180(0B4) and frame 184(0B8) in broken_weapon.dat


If you only want to copy the id, just replace the code at 00442517 and 0044251D
with
00442517　　je lf2-t.00422C16
0044251D　　jmp 00422C4D
And you don't have to write anything after line 0044251D]]> yuo may think about problem, it has no pieces after it broke.
Now this problem could be solved.

There are three parts that relate with the broken pieces of each id.
If you want to copy the id or creat a new one,you have to change these parts.


First part

004228E3 . 8B81 F4060000 mov eax,dword ptr ds:[ecx+6F4]
004228E9 . 83F8 65 cmp eax,65
004228EC . 74 07 je short lf2-t.004228F5
004228EE . 3D DA000000 cmp eax,0DA
004228F3 . 75 09 jnz short lf2-t.004228FE
004228F5 > BE 07000000 mov esi,7
004228FA . 897424 14 mov dword ptr ss:[esp+14],esi
004228FE 83F8 64 cmp eax,64
00422901 74 0E je short lf2-t.00422911
00422903 . 3D D5000000 cmp eax,0D5
00422908 . 74 07 je short lf2-t.00422911
0042290A . 3D D9000000 cmp eax,0D9
0042290F . 75 09 jnz short lf2-t.0042291A
00422911 > BE 05000000 mov esi,5
00422916 . 897424 14 mov dword ptr ss:[esp+14],esi
0042291A > 3D C9000000 cmp eax,0C9
0042291F . 75 09 jnz short lf2-t.0042292A
00422921 . BE 03000000 mov esi,3
00422926 . 897424 14 mov dword ptr ss:[esp+14],esi
0042292A > 3D 96000000 cmp eax,96
0042292F . 75 09 jnz short lf2-t.0042293A
00422931 . BE 0D000000 mov esi,0D
00422936 . 897424 14 mov dword ptr ss:[esp+14],esi
0042293A > 3D 97000000 cmp eax,97
0042293F . 75 09 jnz short lf2-t.0042294A
00422941 . BE 0F000000 mov esi,0F
00422946 . 897424 14 mov dword ptr ss:[esp+14],esi
0042294A > 83F8 78 cmp eax,78
0042294D . 74 05 je short lf2-t.00422954
0042294F . 83F8 7C cmp eax,7C
00422952 . 75 09 jnz short lf2-t.0042295D
00422954 > BE 03000000 mov esi,3
00422959 . 897424 14 mov dword ptr ss:[esp+14],esi
0042295D > 83F8 79 cmp eax,79
00422960 . 75 09 jnz short lf2-t.0042296B
00422962 . BE 04000000 mov esi,4
00422967 . 897424 14 mov dword ptr ss:[esp+14],esi
0042296B > 83F8 7A cmp eax,7A
0042296E . 74 05 je short lf2-t.00422975
00422970 . 83F8 7B cmp eax,7B
00422973 . 75 09 jnz short lf2-t.0042297E
00422975 > BE 09000000 mov esi,9
0042297A . 897424 14 mov dword ptr ss:[esp+14],esi
0042297E > 8B81 AC000000 mov eax,dword ptr ds:[ecx+AC]


Second part

00422AD9 . 8B82 F4060000 mov eax,dword ptr ds:[edx+6F4]
00422ADF . 3D 96000000 cmp eax,96
00422AE4 . 74 0E je short lf2-t.00422AF4
00422AE6 . 3D 97000000 cmp eax,97
00422AEB . 74 07 je short lf2-t.00422AF4
00422AED . 3D D5000000 cmp eax,0D5
00422AF2 . 75 29 jnz short lf2-t.00422B1D
00422AF4 > 6A 14 push 14
00422AF6 . E8 4572FFFF call lf2-t.00419D40
00422AFB . 99 cdq
00422AFC . 2BC2 sub eax,edx
00422AFE . 83C4 04 add esp,4
00422B01 . D1F8 sar eax,1
00422B03 . F7D8 neg eax
00422B05 . 894424 24 mov dword ptr ss:[esp+24],eax
00422B09 . 8B84B3 94010000 mov eax,dword ptr ds:[ebx+esi*4+194]
00422B10 . DB4424 24 fild dword ptr ss:[esp+24]
00422B14 . DC25 30324400 fsub qword ptr ds:[443230]
00422B1A . DD58 48 fstp qword ptr ds:[eax+48]
00422B1D > 8B8CBB 94010000 mov ecx,dword ptr ds:[ebx+edi*4+194]
00422B24 . 8B91 68030000 mov edx,dword ptr ds:[ecx+368]
00422B2A . 8B82 F4060000 mov eax,dword ptr ds:[edx+6F4]
00422B30 . E9 8BF90100 jmp lf2-t.004424C0
00422B35 > 3D C9000000 cmp eax,0C9
00422B3A . 74 2C je short lf2-t.00422B68
00422B3C . 83F8 65 cmp eax,65
00422B3F . 74 27 je short lf2-t.00422B68
00422B41 . 83F8 78 cmp eax,78
00422B44 . 74 22 je short lf2-t.00422B68
00422B46 . 83F8 79 cmp eax,79
00422B49 . 74 1D je short lf2-t.00422B68
00422B4B . 83F8 7A cmp eax,7A
00422B4E . 74 18 je short lf2-t.00422B68
00422B50 . 83F8 7B cmp eax,7B
00422B53 . 74 13 je short lf2-t.00422B68
00422B55 . 83F8 7C cmp eax,7C
00422B58 . 74 0E je short lf2-t.00422B68
00422B5A . 3D D9000000 cmp eax,0D9
00422B5F . 74 07 je short lf2-t.00422B68
00422B61 . 3D DA000000 cmp eax,0DA
00422B66 . 75 29 jnz short lf2-t.00422B91
00422B68 > 6A 08 push 8


Third part

00422BB3 |. 8B94BB 94010000 ||mov edx,dword ptr ds:[ebx+edi*4+194]
00422BBA |. 8B82 68030000 ||mov eax,dword ptr ds:[edx+368]
00422BC0 |. 81B8 F4060000 96000000 ||cmp dword ptr ds:[eax+6F4],96
00422BCA |. 75 34 ||jnz short lf2.00422C00
00422BCC |. 8B4424 10 ||mov eax,dword ptr ss:[esp+10]
　　　.　　　　　　　　　.　　　　　　　　　　　　　　　　　.　
　　　.　　　　　　　　　.　　　　　　　　　　　　　　　　　.　
　　　.　　　　　　　　　.　　　　　　　　　　　　　　　　　.　
　　　.　　　　　　　　　.　　　　　　　　　　　　　　　　　.　
　　　.　　　　　　　　　.　　　　　　　　　　　　　　　　　.　
　　　.　　　　　　　　　.　　　　　　　　　　　　　　　　　.　
00422F54 |> \8B8CBB 94010000 ||mov ecx,dword ptr ds:[ebx+edi*4+194]
00422F5B |. 8B91 68030000 ||mov edx,dword ptr ds:[ecx+368]
00422F61 |. 8B82 F4060000 ||mov eax,dword ptr ds:[edx+6F4]
00422F67 |. 3D D9000000 ||cmp eax,0D9
00422F6C |. 74 07 ||je short lf2.00422F75
00422F6E |. 3D DA000000 ||cmp eax,0DA
00422F73 |. 75 19 ||jnz short lf2.00422F8E
00422F75 |> 6A 04 ||push 4
00422F77 |. E8 C46DFFFF ||call lf2.00419D40
00422F7C |. 8B8CB3 94010000 ||mov ecx,dword ptr ds:[ebx+esi*4+194]
00422F83 |. 83C4 04 ||add esp,4
00422F86 |. 05 AE000000 ||add eax,0AE
00422F8B |. 8941 70 ||mov dword ptr ds:[ecx+70],eax
00422F8E |> 8B4424 10 ||mov eax,dword ptr ss:[esp+10]
00422F92 |. 8B4C24 14 ||mov ecx,dword ptr ss:[esp+14]
00422F96 |. 40 ||inc eax
00422F97 |. 3BC1 ||cmp eax,ecx
00422F99 |. 894424 10 ||mov dword ptr ss:[esp+10],eax
00422F9D |.^ 0F8C 07FAFFFF |\jl lf2.004229AA

Third part settles each id and it's pieces.
The red code is the weapon's id.
I created a new weapon id and it's own broken pieces.
You can consult it to copy or creat a new id and broke pieces by yourself.

I use id 100 (weapon0) to make procedure detour.

First part
004228FA . 897424 14 mov dword ptr ss:[esp+14],esi
004228FE E9 9DFB0100 jmp lf2-t.004424A0
00422903 . 3D D5000000 cmp eax,0D5
00422908 . 74 07 je short lf2-t.00422911

Second part
00422B2A . 8B82 F4060000 mov eax,dword ptr ds:[edx+6F4]
00422B30 . E9 8BF90100 jmp lf2-t.004424C0
00422B35 > 3D C9000000 cmp eax,0C9
00422B3A . 74 2C je short lf2-t.00422B68

Third part
00422C00 > \8B84BB 94010000 mov eax,dword ptr ds:[ebx+edi*4+194]
00422C07 . 8B88 68030000 mov ecx,dword ptr ds:[eax+368]
00422C0D . E9 EEF80100 jmp lf2-t.00442500
00422C12 90 nop
00422C13 90 nop
00422C14 . 75 37 jnz short lf2-t.00422C4D
00422C16 > 8B4424 10 mov eax,dword ptr ss:[esp+10]
00422C1A . 6A 04 push 4
00422C1C . 83F8 02 cmp eax,2


Detour of First part
004424A0 83F8 64 cmp eax,64
004424A3 ^ 0F84 6804FEFF je lf2-t.00422911
004424A9 3D 82000000 cmp eax,82
004424AE ^ 0F84 5D04FEFF je lf2-t.00422911
004424B4 ^ E9 4A04FEFF jmp lf2-t.00422903

Detour of Second part
004424C0 > 83F8 64 cmp eax,64
004424C3 .^ 0F84 9F06FEFF je lf2-t.00422B68
004424C9 3D 82000000 cmp eax,82
004424CE .^ 0F84 9406FEFF je lf2-t.00422B68
004424D4 .^ E9 5C06FEFF jmp lf2-t.00422B35

Detour of Third part
00442500 > \83B9 F4060000 64 cmp dword ptr ds:[ecx+6F4],64
00442507 .^ 0F84 0907FEFF je lf2-t.00422C16
0044250D . 81B9 F4060000 82000000 cmp dword ptr ds:[ecx+6F4],82
00442517 ^ 0F85 3007FEFF jnz lf2-t.00422C4D
0044251D 8B4424 10 mov eax,dword ptr ss:[esp+10]
00442521 6A 04 push 4
00442523 83F8 02 cmp eax,2
00442526 7D 20 jge short lf2-t.00442548
00442528 90 nop
00442529 90 nop
0044252A 90 nop
0044252B 90 nop
0044252C E8 0F78FDFF call lf2-t.00419D40
00442531 8B94B3 94010000 mov edx,dword ptr ds:[ebx+esi*4+194]
00442538 83C4 04 add esp,4
0044253B 05 B4000000 add eax,0B4
00442540 8942 70 mov dword ptr ds:[edx+70],eax
00442543 ^ E9 0507FEFF jmp lf2-t.00422C4D
00442548 E8 F377FDFF call lf2-t.00419D40
0044254D 8B8CB3 94010000 mov ecx,dword ptr ds:[ebx+esi*4+194]
00442554 83C4 04 add esp,4
00442557 05 B8000000 add eax,0B8
0044255C 8941 70 mov dword ptr ds:[ecx+70],eax
0044255F ^ E9 E906FEFF jmp lf2-t.00422C4D

The new id I creat is 130(82 in Hex).
After it broke, it's pieces is frame 180(0B4) and frame 184(0B8) in broken_weapon.dat


If you only want to copy the id, just replace the code at 00442517 and 0044251D
with
00442517　　je lf2-t.00422C16
0044251D　　jmp 00422C4D
And you don't have to write anything after line 0044251D]]> <![CDATA[Armour Effect of ID]]> https://lf-empire.de/forum/showthread.php?tid=684 Fri, 25 Jul 2008 16:38:35 +0200 xxtomnyxx]]> https://lf-empire.de/forum/showthread.php?tid=684

0042CCE6 |. 8B87 F4060000 |mov eax,dword ptr ds:[edi+6F4]
0042CCEC |. 83F8 25 |cmp eax,25←←←←←←←←←←←←←←←id 37， Knight
0042CCEF |. 894424 30 |mov dword ptr ss:[esp+30],eax
0042CCF3 |. 75 61 |jnz short lf2.0042CD56
0042CCF5 |. 83BE B8000000 0F |cmp dword ptr ds:[esi+B8],0F←←←←←←bdefend restore speed
0042CCFC |. 7F 58 |jg short lf2.0042CD56
0042CCFE |. 8B4C24 10 |mov ecx,dword ptr ss:[esp+10]
0042CD02 |. B8 67666666 |mov eax,66666667
0042CD07 |. 8B49 2C |mov ecx,dword ptr ds:[ecx+2C]
0042CD0A |. F7E9 |imul ecx
0042CD0C |. C1FA 02 |sar edx,2
0042CD0F |. 8BC2 |mov eax,edx
0042CD11 |. C1E8 1F |shr eax,1F
0042CD14 |. 03D0 |add edx,eax
0042CD16 |. 83FA 02 |cmp edx,2
0042CD19 |. 74 33 |je short lf2.0042CD4E
0042CD1B |. 83FA 03 |cmp edx,3
0042CD1E |. 74 2E |je short lf2.0042CD4E
0042CD20 |. 83F9 02 |cmp ecx,2
0042CD23 |. 74 29 |je short lf2.0042CD4E
0042CD25 |. 83F9 03 |cmp ecx,3
0042CD28 |. 74 24 |je short lf2.0042CD4E
0042CD2A |. 8B4C24 0C |mov ecx,dword ptr ss:[esp+C]
0042CD2E |. 8B11 |mov edx,dword ptr ds:[ecx]
0042CD30 |. 8B82 68030000 |mov eax,dword ptr ds:[edx+368]
0042CD36 |. 8B80 F4060000 |mov eax,dword ptr ds:[eax+6F4]
0042CD3C |. 3D D6000000 |cmp eax,0D6←←←←←←←←←←←←←←which id's attack can't be withstood
0042CD41 |. 74 0B |je short lf2.0042CD4E
0042CD43 |. 3D D0000000 |cmp eax,0D0←←←←←←←←←←←←←←which id's attack can't be withstood
0042CD48 |. 0F85 49130000 |jnz lf2.0042E097
0042CD4E |> 8B5424 14 |mov edx,dword ptr ss:[esp+14]
0042CD52 |. 8B4424 30 |mov eax,dword ptr ss:[esp+30]


0042CD56 |> 83F8 06 |cmp eax,6←←←←←←←←←←←←←←←id 6， Louis
0042CD59 |. 0F85 97000000 |jnz lf2.0042CDF6
0042CD5F 83BE B8000000 01 |cmp dword ptr ds:[esi+B8],1←←←←←←bdefend restore speed
0042CD66 |. 0F8F 8A000000 |jg lf2.0042CDF6
0042CD6C |. 8B4C24 10 |mov ecx,dword ptr ss:[esp+10]
0042CD70 |. B8 67666666 |mov eax,66666667
0042CD75 |. 8B49 2C |mov ecx,dword ptr ds:[ecx+2C]
0042CD78 |. F7E9 |imul ecx
0042CD7A |. C1FA 02 |sar edx,2
0042CD7D |. 8BC2 |mov eax,edx
0042CD7F |. C1E8 1F |shr eax,1F
0042CD82 |. 03D0 |add edx,eax
0042CD84 |. 83FA 02 |cmp edx,2
0042CD87 |. 74 65 |je short lf2.0042CDEE
0042CD89 |. 83FA 03 |cmp edx,3
0042CD8C |. 74 60 |je short lf2.0042CDEE
0042CD8E |. 83F9 02 |cmp ecx,2
0042CD91 |. 74 5B |je short lf2.0042CDEE
0042CD93 |. 83F9 03 |cmp ecx,3
0042CD96 |. 74 56 |je short lf2.0042CDEE
0042CD98 |. 8B4C24 0C |mov ecx,dword ptr ss:[esp+C]
0042CD9C |. 8B11 |mov edx,dword ptr ds:[ecx]
0042CD9E |. 8B82 68030000 |mov eax,dword ptr ds:[edx+368]
0042CDA4 |. 8B80 F4060000 |mov eax,dword ptr ds:[eax+6F4]
0042CDAA |. 3D D6000000 |cmp eax,0D6←←←←←←←←←←←←←←which id's attack can't be withstood
0042CDAF |. 74 3D |je short lf2.0042CDEE
0042CDB1 |. 3D D0000000 |cmp eax,0D0←←←←←←←←←←←←←←which id's attack can't be withstood
0042CDB6 |. 74 36 |je short lf2.0042CDEE
0042CDB8 |. 8B46 70 |mov eax,dword ptr ds:[esi+70]
0042CDBB |. 83F8 14 |cmp eax,14
0042CDBE |. 0F8C D3120000 |jl lf2.0042E097
0042CDC4 |. 8D0C40 |lea ecx,dword ptr ds:[eax+eax*2]
0042CDC7 |. C1E1 04 |shl ecx,4
0042CDCA |. 2BC8 |sub ecx,eax
0042CDCC |. 8B84CF AC070000 |mov eax,dword ptr ds:[edi+ecx*8+7AC]
0042CDD3 |. 83F8 05 |cmp eax,5
0042CDD6 |. 0F84 BB120000 |je lf2.0042E097
0042CDDC |. 83F8 04 |cmp eax,4
0042CDDF |. 0F84 B2120000 |je lf2.0042E097
0042CDE5 |. 83F8 07 |cmp eax,7
0042CDE8 |. 0F84 A9120000 |je lf2.0042E097
0042CDEE |> 8B5424 14 |mov edx,dword ptr ss:[esp+14]
0042CDF2 |. 8B4424 30 |mov eax,dword ptr ss:[esp+30]


0042CDF6 |> 83F8 34 |cmp eax,34←←←←←←←←←←←←←←←id 52 ，Julian
0042CDF9 |. 75 2D |jnz short lf2.0042CE28
0042CDFB |. 83BE B8000000 0F |cmp dword ptr ds:[esi+B8],0F←←←←←←bdefend restore speed
0042CE02 |. 7F 24 |jg short lf2.0042CE28
0042CE04 |. 8B4424 0C |mov eax,dword ptr ss:[esp+C]
0042CE08 |. 8B08 |mov ecx,dword ptr ds:[eax]
0042CE0A |. 8B81 68030000 |mov eax,dword ptr ds:[ecx+368]
0042CE10 |. 8B80 F4060000 |mov eax,dword ptr ds:[eax+6F4]
0042CE16 |. 3D D6000000 |cmp eax,0D6 ←←←←←←←←←←←←←←which id's attack can't be withstood
0042CE1B |. 74 0B |je short lf2.0042CE28
0042CE1D |. 3D D0000000 |cmp eax,0D0 ←←←←←←←←←←←←←←which id's attack can't be withstood
0042CE22 |. 0F85 73120000 |jnz lf2.0042E09B
0042CE28 |> 8B7424 10 |mov esi,dword ptr ss:[esp+10]

The id can't be withstood can also be character or weapon.
If you want creat a new id with Armour Effect, just replace the code ''mov eax,dword ptr ds:[edi+6F4]'' at 0042CCE6 with ''JMP XXXXXXXX ''.
Then at XXXXXXXX should like this:
XXXXXXXX　　　　　 　mov eax,dword ptr ds:[edi+6F4]
XXXXXXXX　　　　　　cmp eax,25
XXXXXXXX　　　　　　je 0042CCEF
XXXXXXXX　　　　　　cmp eax,#←←←the id you want to creat
XXXXXXXX　　　　　　jnz 0042CD56
XXXXXXXX　　　　　　cmp dword ptr ds:[esi+B8],0F←←←you can type any number(hex) you want. The bigger the number is, the stronger your character will be
XXXXXXXX　　　　　　jg lf2.0042CD56
XXXXXXXX　　　　　　mov ecx,dword ptr ss:[esp+10]
XXXXXXXX　　　　　　mov eax,66666667
XXXXXXXX　　　　　　mov ecx,dword ptr ds:[ecx+2C]
XXXXXXXX　　　　　　imul ecx
XXXXXXXX　　　　　　sar edx,2
XXXXXXXX　　　　　　mov eax,edx
XXXXXXXX　　　　　　shr eax,1F
XXXXXXXX　　　　　　add edx,eax
XXXXXXXX　　　　　　cmp edx,2
XXXXXXXX　　　　　　je lf2.0042CD4E
XXXXXXXX　　　　　　cmp edx,3
XXXXXXXX　　　　　　je lf2.0042CD4E
XXXXXXXX　　　　　　cmp ecx,2
XXXXXXXX　　　　　　je lf2.0042CD4E
XXXXXXXX　　　　　　cmp ecx,3
XXXXXXXX　　　　　　je lf2.0042CD4E
XXXXXXXX　　　　　　mov ecx,dword ptr ss:[esp+C]
XXXXXXXX　　　　　　mov edx,dword ptr ds:[ecx]
XXXXXXXX　　　　　　mov eax,dword ptr ds:[edx+368]
XXXXXXXX　　　　　　mov eax,dword ptr ds:[eax+6F4]
XXXXXXXX　　　　　　*cmp eax,%%%←which id's attack can break defend
XXXXXXXX　　　　　　*je lf2.0042CD4E
XXXXXXXX　　　　　　*cmp eax,%%%←which id's attack can break defend
XXXXXXXX　　　　　　*je lf2.0042CD4E
　　.　　　　　　　　　　　　　.
　　.　　　　　　　　　　　　　.
　　.　　　　　　　　　　　　　.
　　.　　　　　　　　　　　　　.
　　.　　　　　　　　　　　　　.
XXXXXXXX　　　　　　*cmp eax,%%%←which id's attack can break defend
XXXXXXXX　　　　　　*je lf2.0042CD4E
XXXXXXXX　　　　　　jmp 0042E097

If you want your new id to be invincible,
just don't type * code


This is my fist time post a thread.
Besides, I come from Taiwan, and my English grade is poor....
If there has any problem, please tell me.]]>

0042CCE6 |. 8B87 F4060000 |mov eax,dword ptr ds:[edi+6F4]
0042CCEC |. 83F8 25 |cmp eax,25←←←←←←←←←←←←←←←id 37， Knight
0042CCEF |. 894424 30 |mov dword ptr ss:[esp+30],eax
0042CCF3 |. 75 61 |jnz short lf2.0042CD56
0042CCF5 |. 83BE B8000000 0F |cmp dword ptr ds:[esi+B8],0F←←←←←←bdefend restore speed
0042CCFC |. 7F 58 |jg short lf2.0042CD56
0042CCFE |. 8B4C24 10 |mov ecx,dword ptr ss:[esp+10]
0042CD02 |. B8 67666666 |mov eax,66666667
0042CD07 |. 8B49 2C |mov ecx,dword ptr ds:[ecx+2C]
0042CD0A |. F7E9 |imul ecx
0042CD0C |. C1FA 02 |sar edx,2
0042CD0F |. 8BC2 |mov eax,edx
0042CD11 |. C1E8 1F |shr eax,1F
0042CD14 |. 03D0 |add edx,eax
0042CD16 |. 83FA 02 |cmp edx,2
0042CD19 |. 74 33 |je short lf2.0042CD4E
0042CD1B |. 83FA 03 |cmp edx,3
0042CD1E |. 74 2E |je short lf2.0042CD4E
0042CD20 |. 83F9 02 |cmp ecx,2
0042CD23 |. 74 29 |je short lf2.0042CD4E
0042CD25 |. 83F9 03 |cmp ecx,3
0042CD28 |. 74 24 |je short lf2.0042CD4E
0042CD2A |. 8B4C24 0C |mov ecx,dword ptr ss:[esp+C]
0042CD2E |. 8B11 |mov edx,dword ptr ds:[ecx]
0042CD30 |. 8B82 68030000 |mov eax,dword ptr ds:[edx+368]
0042CD36 |. 8B80 F4060000 |mov eax,dword ptr ds:[eax+6F4]
0042CD3C |. 3D D6000000 |cmp eax,0D6←←←←←←←←←←←←←←which id's attack can't be withstood
0042CD41 |. 74 0B |je short lf2.0042CD4E
0042CD43 |. 3D D0000000 |cmp eax,0D0←←←←←←←←←←←←←←which id's attack can't be withstood
0042CD48 |. 0F85 49130000 |jnz lf2.0042E097
0042CD4E |> 8B5424 14 |mov edx,dword ptr ss:[esp+14]
0042CD52 |. 8B4424 30 |mov eax,dword ptr ss:[esp+30]


0042CD56 |> 83F8 06 |cmp eax,6←←←←←←←←←←←←←←←id 6， Louis
0042CD59 |. 0F85 97000000 |jnz lf2.0042CDF6
0042CD5F 83BE B8000000 01 |cmp dword ptr ds:[esi+B8],1←←←←←←bdefend restore speed
0042CD66 |. 0F8F 8A000000 |jg lf2.0042CDF6
0042CD6C |. 8B4C24 10 |mov ecx,dword ptr ss:[esp+10]
0042CD70 |. B8 67666666 |mov eax,66666667
0042CD75 |. 8B49 2C |mov ecx,dword ptr ds:[ecx+2C]
0042CD78 |. F7E9 |imul ecx
0042CD7A |. C1FA 02 |sar edx,2
0042CD7D |. 8BC2 |mov eax,edx
0042CD7F |. C1E8 1F |shr eax,1F
0042CD82 |. 03D0 |add edx,eax
0042CD84 |. 83FA 02 |cmp edx,2
0042CD87 |. 74 65 |je short lf2.0042CDEE
0042CD89 |. 83FA 03 |cmp edx,3
0042CD8C |. 74 60 |je short lf2.0042CDEE
0042CD8E |. 83F9 02 |cmp ecx,2
0042CD91 |. 74 5B |je short lf2.0042CDEE
0042CD93 |. 83F9 03 |cmp ecx,3
0042CD96 |. 74 56 |je short lf2.0042CDEE
0042CD98 |. 8B4C24 0C |mov ecx,dword ptr ss:[esp+C]
0042CD9C |. 8B11 |mov edx,dword ptr ds:[ecx]
0042CD9E |. 8B82 68030000 |mov eax,dword ptr ds:[edx+368]
0042CDA4 |. 8B80 F4060000 |mov eax,dword ptr ds:[eax+6F4]
0042CDAA |. 3D D6000000 |cmp eax,0D6←←←←←←←←←←←←←←which id's attack can't be withstood
0042CDAF |. 74 3D |je short lf2.0042CDEE
0042CDB1 |. 3D D0000000 |cmp eax,0D0←←←←←←←←←←←←←←which id's attack can't be withstood
0042CDB6 |. 74 36 |je short lf2.0042CDEE
0042CDB8 |. 8B46 70 |mov eax,dword ptr ds:[esi+70]
0042CDBB |. 83F8 14 |cmp eax,14
0042CDBE |. 0F8C D3120000 |jl lf2.0042E097
0042CDC4 |. 8D0C40 |lea ecx,dword ptr ds:[eax+eax*2]
0042CDC7 |. C1E1 04 |shl ecx,4
0042CDCA |. 2BC8 |sub ecx,eax
0042CDCC |. 8B84CF AC070000 |mov eax,dword ptr ds:[edi+ecx*8+7AC]
0042CDD3 |. 83F8 05 |cmp eax,5
0042CDD6 |. 0F84 BB120000 |je lf2.0042E097
0042CDDC |. 83F8 04 |cmp eax,4
0042CDDF |. 0F84 B2120000 |je lf2.0042E097
0042CDE5 |. 83F8 07 |cmp eax,7
0042CDE8 |. 0F84 A9120000 |je lf2.0042E097
0042CDEE |> 8B5424 14 |mov edx,dword ptr ss:[esp+14]
0042CDF2 |. 8B4424 30 |mov eax,dword ptr ss:[esp+30]


0042CDF6 |> 83F8 34 |cmp eax,34←←←←←←←←←←←←←←←id 52 ，Julian
0042CDF9 |. 75 2D |jnz short lf2.0042CE28
0042CDFB |. 83BE B8000000 0F |cmp dword ptr ds:[esi+B8],0F←←←←←←bdefend restore speed
0042CE02 |. 7F 24 |jg short lf2.0042CE28
0042CE04 |. 8B4424 0C |mov eax,dword ptr ss:[esp+C]
0042CE08 |. 8B08 |mov ecx,dword ptr ds:[eax]
0042CE0A |. 8B81 68030000 |mov eax,dword ptr ds:[ecx+368]
0042CE10 |. 8B80 F4060000 |mov eax,dword ptr ds:[eax+6F4]
0042CE16 |. 3D D6000000 |cmp eax,0D6 ←←←←←←←←←←←←←←which id's attack can't be withstood
0042CE1B |. 74 0B |je short lf2.0042CE28
0042CE1D |. 3D D0000000 |cmp eax,0D0 ←←←←←←←←←←←←←←which id's attack can't be withstood
0042CE22 |. 0F85 73120000 |jnz lf2.0042E09B
0042CE28 |> 8B7424 10 |mov esi,dword ptr ss:[esp+10]

The id can't be withstood can also be character or weapon.
If you want creat a new id with Armour Effect, just replace the code ''mov eax,dword ptr ds:[edi+6F4]'' at 0042CCE6 with ''JMP XXXXXXXX ''.
Then at XXXXXXXX should like this:
XXXXXXXX　　　　　 　mov eax,dword ptr ds:[edi+6F4]
XXXXXXXX　　　　　　cmp eax,25
XXXXXXXX　　　　　　je 0042CCEF
XXXXXXXX　　　　　　cmp eax,#←←←the id you want to creat
XXXXXXXX　　　　　　jnz 0042CD56
XXXXXXXX　　　　　　cmp dword ptr ds:[esi+B8],0F←←←you can type any number(hex) you want. The bigger the number is, the stronger your character will be
XXXXXXXX　　　　　　jg lf2.0042CD56
XXXXXXXX　　　　　　mov ecx,dword ptr ss:[esp+10]
XXXXXXXX　　　　　　mov eax,66666667
XXXXXXXX　　　　　　mov ecx,dword ptr ds:[ecx+2C]
XXXXXXXX　　　　　　imul ecx
XXXXXXXX　　　　　　sar edx,2
XXXXXXXX　　　　　　mov eax,edx
XXXXXXXX　　　　　　shr eax,1F
XXXXXXXX　　　　　　add edx,eax
XXXXXXXX　　　　　　cmp edx,2
XXXXXXXX　　　　　　je lf2.0042CD4E
XXXXXXXX　　　　　　cmp edx,3
XXXXXXXX　　　　　　je lf2.0042CD4E
XXXXXXXX　　　　　　cmp ecx,2
XXXXXXXX　　　　　　je lf2.0042CD4E
XXXXXXXX　　　　　　cmp ecx,3
XXXXXXXX　　　　　　je lf2.0042CD4E
XXXXXXXX　　　　　　mov ecx,dword ptr ss:[esp+C]
XXXXXXXX　　　　　　mov edx,dword ptr ds:[ecx]
XXXXXXXX　　　　　　mov eax,dword ptr ds:[edx+368]
XXXXXXXX　　　　　　mov eax,dword ptr ds:[eax+6F4]
XXXXXXXX　　　　　　*cmp eax,%%%←which id's attack can break defend
XXXXXXXX　　　　　　*je lf2.0042CD4E
XXXXXXXX　　　　　　*cmp eax,%%%←which id's attack can break defend
XXXXXXXX　　　　　　*je lf2.0042CD4E
　　.　　　　　　　　　　　　　.
　　.　　　　　　　　　　　　　.
　　.　　　　　　　　　　　　　.
　　.　　　　　　　　　　　　　.
　　.　　　　　　　　　　　　　.
XXXXXXXX　　　　　　*cmp eax,%%%←which id's attack can break defend
XXXXXXXX　　　　　　*je lf2.0042CD4E
XXXXXXXX　　　　　　jmp 0042E097

If you want your new id to be invincible,
just don't type * code


This is my fist time post a thread.
Besides, I come from Taiwan, and my English grade is poor....
If there has any problem, please tell me.]]> <![CDATA[AI copying [Part 2]]]> https://lf-empire.de/forum/showthread.php?tid=638 Sat, 19 Jul 2008 10:51:28 +0200 Boop]]> https://lf-empire.de/forum/showthread.php?tid=638
Right click > goto > expression > 004093B5.

You will see some code like this:
Code:
004093B5 |. 83F8 02 CMP EAX,2 004093B8 |. 74 31 JE SHORT lf2.004093EB >>>004093BA<<< |. 83F8 04 CMP EAX,4

Replace :
Code:
CMP EAX,2

With(You can jump anywhere you want, I just choose a random place) :
Code:
JMP 0044280D
This line will overwrite the CMP and JE in the next line, this is suppoused to happen.

Now right click>goto>expression> 0044280D(or where ever you jumped to). First thing that has to be done is writing the code we over wrote, so write this:
Code:
CMP EAX,2 JE 004093EB

Now we begin adding our own ID's to the code. This is done by writing CMP EAX, ID and then a JE 004093EB after it. After all adding all your ID's you have to jump back to the rest of the code, so write "JMP 004093BA" ( look at the first snippet of code if you don't understand where I got the number from).

Here is an example of how your code can look:

Code:
004093B5 E9 53940300 JMP lf2.0044280D 004093BA |. 83F8 04 CMP EAX,4

Code:
0044280D 83F8 02 CMP EAX,2 00442810 ^0F84 D56BFCFF JE lf2.004093EB 00442816 83F8 40 CMP EAX,40 00442819 ^0F84 CC6BFCFF JE lf2.004093EB 0044281F 83F8 45 CMP EAX,45 00442822 ^0F84 C36BFCFF JE lf2.004093EB 00442828 ^E9 8D6BFCFF JMP lf2.004093BA

The same code appears at 004094B2, it is basically the same except you have to change the numbers. I won't bother explaining it all again and I'll just show you how the code should look like.

Code:
004094B2 E9 56950300 JMP lf2.00442A0D 004094B7 |. 83F8 04 CMP EAX,4

Code:
00442A0D 83F8 02 CMP EAX,2 00442A10 ^0F84 D26AFCFF JE lf2.004094E8 00442A16 83F8 40 CMP EAX,40 00442A19 ^0F84 C96AFCFF JE lf2.004094E8 00442A1F 83F8 45 CMP EAX,45 00442A22 ^0F84 C06AFCFF JE lf2.004094E8 00442A28 ^E9 8A6AFCFF JMP lf2.004094B7

Notice how the JE's and JMP's go to different places than before. Anyway you are done :)]]>
Right click > goto > expression > 004093B5.

You will see some code like this:
Code:
004093B5 |. 83F8 02 CMP EAX,2 004093B8 |. 74 31 JE SHORT lf2.004093EB >>>004093BA<<< |. 83F8 04 CMP EAX,4

Replace :
Code:
CMP EAX,2

With(You can jump anywhere you want, I just choose a random place) :
Code:
JMP 0044280D
This line will overwrite the CMP and JE in the next line, this is suppoused to happen.

Now right click>goto>expression> 0044280D(or where ever you jumped to). First thing that has to be done is writing the code we over wrote, so write this:
Code:
CMP EAX,2 JE 004093EB

Now we begin adding our own ID's to the code. This is done by writing CMP EAX, ID and then a JE 004093EB after it. After all adding all your ID's you have to jump back to the rest of the code, so write "JMP 004093BA" ( look at the first snippet of code if you don't understand where I got the number from).

Here is an example of how your code can look:

Code:
004093B5 E9 53940300 JMP lf2.0044280D 004093BA |. 83F8 04 CMP EAX,4

Code:
0044280D 83F8 02 CMP EAX,2 00442810 ^0F84 D56BFCFF JE lf2.004093EB 00442816 83F8 40 CMP EAX,40 00442819 ^0F84 CC6BFCFF JE lf2.004093EB 0044281F 83F8 45 CMP EAX,45 00442822 ^0F84 C36BFCFF JE lf2.004093EB 00442828 ^E9 8D6BFCFF JMP lf2.004093BA

The same code appears at 004094B2, it is basically the same except you have to change the numbers. I won't bother explaining it all again and I'll just show you how the code should look like.

Code:
004094B2 E9 56950300 JMP lf2.00442A0D 004094B7 |. 83F8 04 CMP EAX,4

Code:
00442A0D 83F8 02 CMP EAX,2 00442A10 ^0F84 D26AFCFF JE lf2.004094E8 00442A16 83F8 40 CMP EAX,40 00442A19 ^0F84 C96AFCFF JE lf2.004094E8 00442A1F 83F8 45 CMP EAX,45 00442A22 ^0F84 C06AFCFF JE lf2.004094E8 00442A28 ^E9 8A6AFCFF JMP lf2.004094B7

Notice how the JE's and JMP's go to different places than before. Anyway you are done :)]]> <![CDATA[NEW 4xxx]]> https://lf-empire.de/forum/showthread.php?tid=531 Sun, 29 Jun 2008 11:55:34 +0200 manxeater]]> https://lf-empire.de/forum/showthread.php?tid=531 but i just managed to find out how to turn the old one into the new one.
i persuaded silva to help,and succeeded.
(initially i thought persuading him would be harder than coding the exe)
but i was wrong.i didnt know how to save the exe =='
any way,
silva Wrote:Patch the exe with normal state 4xxx.
Open exe with olly and go to line 00442D7A . Right click that line > Binary > Fill with nops . You are done...

its that easy.

invisible wont take you anywhere.
oh and i wanted to PM you to say thanks but you were ignoring me.........;)]]> but i just managed to find out how to turn the old one into the new one.
i persuaded silva to help,and succeeded.
(initially i thought persuading him would be harder than coding the exe)
but i was wrong.i didnt know how to save the exe =='
any way,
silva Wrote:Patch the exe with normal state 4xxx.
Open exe with olly and go to line 00442D7A . Right click that line > Binary > Fill with nops . You are done...

its that easy.

invisible wont take you anywhere.
oh and i wanted to PM you to say thanks but you were ignoring me.........;)]]> <![CDATA[AI Copying [Part 1]]]> https://lf-empire.de/forum/showthread.php?tid=489 Fri, 20 Jun 2008 23:34:46 +0200 Boop]]> https://lf-empire.de/forum/showthread.php?tid=489
Requirements :
*LF2
*OllyDbg
*A half decent brain

Do not attempt this if you lack a half decent brain.

First thing is first, open up Olly and load LF2 up. After it finishes press CTRL+F and copy paste this command(make sure the "Entire block" checkbox is ticked):
Code:
CMP DWORD PTR DS:[ECX+6F4],X
Where X is the ID number you want to duplicate. For example if you want to copy ID 4 then you type in:
Code:
CMP DWORD PTR DS:[ECX+6F4],04

You will then get to a point where you see these three lines:
Code:
0040A0DD . 83B9 F4060000 >CMP DWORD PTR DS:[ECX+6F4],4 0040A0E4 . 0F85 44020000 JNZ lf2.>>>>>0040A32E<<<<< >>>>0040A0EA<<<< . 81B8 08030000 >CMP DWORD PTR DS:[EAX+308],168
( don't worry about the arrows pointing at the number, you'll see why I put them when you keep reading)

Now I'll try to explain what they mean. The first line is a compare(CMP) command, it checks if [ECX+6F4](the address where the character ID is stored) is equal to 4. The next line is "Jump if not equal"(or to be exact Jump if not Zero, but don't worry about that :p), so that means if the CMP in the line above isn't true it will jump and skip all the AI code. For example if the character ID is 6 the jump is executed and all the AI stuff is skipped, if its 4 it isn't skipped and AI code is executed.

So basically, if we want to "Copy" the AI functions to another ID we just have to make the jump NOT execute on 4 AND our new ID. There are a lot of ways of writing that code, but I'm going to teach the simplest, straight forward , no brainier way of doing it.

Lets replace:
Code:
CMP DWORD PTR DS:[ECX+6F4],4
With:
Code:
JMP 00442612
This is just a JMP to a random place near the end of the program that is empty, it doesn't really matter where you jump. Now just press CTRL+G and type in 00442612 (or where ever you choose to jump) so that we can start writing our code at the new location.

First lets start by writing the original compare line. After that we will write a JE command(Jump if Equal) to 0040A0EA(this is the line after the JNZ, look up at the first block of code I copy pasted if you still don't know where the number came from). So your code should like like this:

Code:
00442612 83B9 F4060000 >CMP DWORD PTR DS:[ECX+6F4],4 00442619 ^0F84 CB7AFCFF JE lf2.0040A0EA
In english the code pretty much says: " If the id is 4 then go to the part of the code that handles AI".

So lets say we want to copy ID 4 AI to ID 60(which is 3C in hex, remember everything is in hex), all we have to do is add another CMP and a JE. So now our code looks like this:
Code:
00442612 83B9 F4060000 >CMP DWORD PTR DS:[ECX+6F4],4 00442619 ^0F84 CB7AFCFF JE test.0040A0EA 0044261F 83B9 F4060000 >CMP DWORD PTR DS:[ECX+6F4],3C 00442626 ^0F84 BE7AFCFF JE test.0040A0EA

To copy it to more ID's you just need to add another CMP and another JE after that. You can do this as much as you want.

All thats left now is to add a JMP(Unconditional jump) at the end of all of that, this is to make sure that if its any other ID the code continues to work and the program doesn't crash. So we do JMP 0040A32E(this is where it would normally jump if the ID wasn't 4, look at the JNZ part in the first block of code if you don't understand where the number came from).

Code:
00442612 83B9 F4060000 >CMP DWORD PTR DS:[ECX+6F4],4 00442619 ^0F84 CB7AFCFF JE test.0040A0EA 0044261F 83B9 F4060000 >CMP DWORD PTR DS:[ECX+6F4],3C 00442626 ^0F84 BE7AFCFF JE test.0040A0EA 0044262C ^E9 FD7CFCFF JMP test.0040A32E

In pseudo code the code means this:
Code:
IF ID = 4 OR ID = 60 { Goto: AI section 4 } ElSE { Skip AI section 4}

NOTE : Thanks to RUDOLF27 for finding out that ID's
Quote:John - 2 (or 02)
Jack - 33 (21)
Jan - 36 (24)
Bat - 38 (26)
don't work. If you want to copy them, then just follow the tutorial normally and everytime you see ECX+6F4 replace it with EDX+6F4 .

----------------------------------------------------------

Tutorial end, don't copy this next bit if you want to copy this tutorial anywhere :p.
I tried my best to explain everything as clearly as possible, if you still don't understand that means you aren't trying enough, or you lack one of the requirements (half decent brain). Don't PM me for help as that will just annoy me, post here if something isn't clear.]]>
Requirements :
*LF2
*OllyDbg
*A half decent brain

Do not attempt this if you lack a half decent brain.

First thing is first, open up Olly and load LF2 up. After it finishes press CTRL+F and copy paste this command(make sure the "Entire block" checkbox is ticked):
Code:
CMP DWORD PTR DS:[ECX+6F4],X
Where X is the ID number you want to duplicate. For example if you want to copy ID 4 then you type in:
Code:
CMP DWORD PTR DS:[ECX+6F4],04

You will then get to a point where you see these three lines:
Code:
0040A0DD . 83B9 F4060000 >CMP DWORD PTR DS:[ECX+6F4],4 0040A0E4 . 0F85 44020000 JNZ lf2.>>>>>0040A32E<<<<< >>>>0040A0EA<<<< . 81B8 08030000 >CMP DWORD PTR DS:[EAX+308],168
( don't worry about the arrows pointing at the number, you'll see why I put them when you keep reading)

Now I'll try to explain what they mean. The first line is a compare(CMP) command, it checks if [ECX+6F4](the address where the character ID is stored) is equal to 4. The next line is "Jump if not equal"(or to be exact Jump if not Zero, but don't worry about that :p), so that means if the CMP in the line above isn't true it will jump and skip all the AI code. For example if the character ID is 6 the jump is executed and all the AI stuff is skipped, if its 4 it isn't skipped and AI code is executed.

So basically, if we want to "Copy" the AI functions to another ID we just have to make the jump NOT execute on 4 AND our new ID. There are a lot of ways of writing that code, but I'm going to teach the simplest, straight forward , no brainier way of doing it.

Lets replace:
Code:
CMP DWORD PTR DS:[ECX+6F4],4
With:
Code:
JMP 00442612
This is just a JMP to a random place near the end of the program that is empty, it doesn't really matter where you jump. Now just press CTRL+G and type in 00442612 (or where ever you choose to jump) so that we can start writing our code at the new location.

First lets start by writing the original compare line. After that we will write a JE command(Jump if Equal) to 0040A0EA(this is the line after the JNZ, look up at the first block of code I copy pasted if you still don't know where the number came from). So your code should like like this:

Code:
00442612 83B9 F4060000 >CMP DWORD PTR DS:[ECX+6F4],4 00442619 ^0F84 CB7AFCFF JE lf2.0040A0EA
In english the code pretty much says: " If the id is 4 then go to the part of the code that handles AI".

So lets say we want to copy ID 4 AI to ID 60(which is 3C in hex, remember everything is in hex), all we have to do is add another CMP and a JE. So now our code looks like this:
Code:
00442612 83B9 F4060000 >CMP DWORD PTR DS:[ECX+6F4],4 00442619 ^0F84 CB7AFCFF JE test.0040A0EA 0044261F 83B9 F4060000 >CMP DWORD PTR DS:[ECX+6F4],3C 00442626 ^0F84 BE7AFCFF JE test.0040A0EA

To copy it to more ID's you just need to add another CMP and another JE after that. You can do this as much as you want.

All thats left now is to add a JMP(Unconditional jump) at the end of all of that, this is to make sure that if its any other ID the code continues to work and the program doesn't crash. So we do JMP 0040A32E(this is where it would normally jump if the ID wasn't 4, look at the JNZ part in the first block of code if you don't understand where the number came from).

Code:
00442612 83B9 F4060000 >CMP DWORD PTR DS:[ECX+6F4],4 00442619 ^0F84 CB7AFCFF JE test.0040A0EA 0044261F 83B9 F4060000 >CMP DWORD PTR DS:[ECX+6F4],3C 00442626 ^0F84 BE7AFCFF JE test.0040A0EA 0044262C ^E9 FD7CFCFF JMP test.0040A32E

In pseudo code the code means this:
Code:
IF ID = 4 OR ID = 60 { Goto: AI section 4 } ElSE { Skip AI section 4}

NOTE : Thanks to RUDOLF27 for finding out that ID's
Quote:John - 2 (or 02)
Jack - 33 (21)
Jan - 36 (24)
Bat - 38 (26)
don't work. If you want to copy them, then just follow the tutorial normally and everytime you see ECX+6F4 replace it with EDX+6F4 .

----------------------------------------------------------

Tutorial end, don't copy this next bit if you want to copy this tutorial anywhere :p.
I tried my best to explain everything as clearly as possible, if you still don't understand that means you aren't trying enough, or you lack one of the requirements (half decent brain). Don't PM me for help as that will just annoy me, post here if something isn't clear.]]> <![CDATA[About LF2 Text [Loading Text Example]]]> https://lf-empire.de/forum/showthread.php?tid=277 Thu, 01 May 2008 19:38:04 +0200 Boop]]> https://lf-empire.de/forum/showthread.php?tid=277
Open up lf2 in OllyDBG and goto 00412198 (Right click>Goto>expression, or press ctrl+G)

Code:
0041218D |. 68 27010000 ||PUSH 127 ; Y pos 00412192 |. 68 0F010000 ||PUSH 10F ; x Pos 00412197 |. 68 5A77D800 ||PUSH 0D8775A ; Text Color 0041219C |. 8D9424 F400000>||LEA EDX,DWORD PTR SS:[ESP+F4] ; Makes EDX point to the text 004121A3 |. 68 12256500 ||PUSH client.00652512 ; Background Color 004121A8 |. 52 ||PUSH EDX ; Push text(edx contains text) 004121A9 |. 50 ||PUSH EAX ; random stuff(I don't know) 004121AA |. E8 A1F1FEFF ||CALL client.00401350 ; call the showy text function
(the name of my exe is client.exe that's why it says client.004xxxx , in your window it'll probably say lf2.004xxxx or what ever your exe is called)
Okay that is the code you'll see there. As you can see I took the time to add comments to explain which each bit does. As you can see it's all very simple, you can change all the stuff quite easily, the only hard bit is the text which requires a bit more work. Lets change
Code:
LEA EDX,DWORD PTR SS:[ESP+F4]
into
Code:
LEA EDX,DWORD PTR DS:[442474]
(I know for a fact that 42474 is empty) and save the exe(copy to executable>all modifications | New window pops up>Right click>save file) as lf2text.exe.

Open lf2text.exe with Hex workshop and go to offset 42474( not 442474, you need to remove one 4). Type the text you want to display and save the file. Volia you are done.

PS: If you just want to remove text, you can either make the color the same as the color of the background bitmap, or you can make the X pos or the Y pos be off screen.

Screenshot:
[Image: 85549577mt6.png]

I would like to say, that this might of not been the best example in the world, since the loading text always changes so we have an extra function (LEA EDX,DWORD PTR SS:[ESP+F4]) which we normally wouldn't have. But you get the idea.

Usually it's something like

Code:
00423D17 . 68 646A4400 PUSH client1.00446A64 ; ASCII "Press F4 or 'Attack' to exit" 00423D1C . 52 PUSH EDX 00423D1D . E8 2ED6FDFF CALL client1.00401350

And you just have to change PUSH 00446A64 to the your address( push 442474 , if you are using the address from this example.]]>
Open up lf2 in OllyDBG and goto 00412198 (Right click>Goto>expression, or press ctrl+G)

Code:
0041218D |. 68 27010000 ||PUSH 127 ; Y pos 00412192 |. 68 0F010000 ||PUSH 10F ; x Pos 00412197 |. 68 5A77D800 ||PUSH 0D8775A ; Text Color 0041219C |. 8D9424 F400000>||LEA EDX,DWORD PTR SS:[ESP+F4] ; Makes EDX point to the text 004121A3 |. 68 12256500 ||PUSH client.00652512 ; Background Color 004121A8 |. 52 ||PUSH EDX ; Push text(edx contains text) 004121A9 |. 50 ||PUSH EAX ; random stuff(I don't know) 004121AA |. E8 A1F1FEFF ||CALL client.00401350 ; call the showy text function
(the name of my exe is client.exe that's why it says client.004xxxx , in your window it'll probably say lf2.004xxxx or what ever your exe is called)
Okay that is the code you'll see there. As you can see I took the time to add comments to explain which each bit does. As you can see it's all very simple, you can change all the stuff quite easily, the only hard bit is the text which requires a bit more work. Lets change
Code:
LEA EDX,DWORD PTR SS:[ESP+F4]
into
Code:
LEA EDX,DWORD PTR DS:[442474]
(I know for a fact that 42474 is empty) and save the exe(copy to executable>all modifications | New window pops up>Right click>save file) as lf2text.exe.

Open lf2text.exe with Hex workshop and go to offset 42474( not 442474, you need to remove one 4). Type the text you want to display and save the file. Volia you are done.

PS: If you just want to remove text, you can either make the color the same as the color of the background bitmap, or you can make the X pos or the Y pos be off screen.

Screenshot:
[Image: 85549577mt6.png]

I would like to say, that this might of not been the best example in the world, since the loading text always changes so we have an extra function (LEA EDX,DWORD PTR SS:[ESP+F4]) which we normally wouldn't have. But you get the idea.

Usually it's something like

Code:
00423D17 . 68 646A4400 PUSH client1.00446A64 ; ASCII "Press F4 or 'Attack' to exit" 00423D1C . 52 PUSH EDX 00423D1D . E8 2ED6FDFF CALL client1.00401350

And you just have to change PUSH 00446A64 to the your address( push 442474 , if you are using the address from this example.]]> <![CDATA[ID Specfic MP Regeneration]]> https://lf-empire.de/forum/showthread.php?tid=68 Sat, 08 Mar 2008 12:12:36 +0100 Boop]]> https://lf-empire.de/forum/showthread.php?tid=68
First of all you have to decide if you want it to be one ID or a range of ID's.

For one ID use this CFG for the patcher: (For some reason, the forum auto adds a space in the cfg, I don't know why... Just remove it when you copy paste)
Code:
00021F6F,8B89F4060000,E96C0B020090 00042AE0,000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,8B89F406000083F9000F8586F4FDFFB9F40100002BC8B81F85EB51F7E9C1FA058BC2C1E81F03D08B86080300008D4C1004E990F4FDFF

For a range of ID's use this CFG for the patcher: (For some reason, the forum auto adds a space in the cfg, I don't know why... Just remove it when you copy paste)
Code:
00021F6F,8B89F4060000,E96C0B020090 00042AE0,000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,8B89F406000083F9000F8C86F4FDFF83F90A0F8F7DF4FDFFB9F40100002BC8B81F85EB51F7E9C1FA058BC2C1E81F03D08B86080300008D4C1004E987F4FDFF

Alright, so after you patched the exe with one of these thingies, open the the exe with olly and go to offset 00442AE0 (Press ctrl+g and write in 00442AE0).

Then you will see a bunch of code like this:
Code:
00442AE0 > 8B89 F4060000 MOV ECX,DWORD PTR DS:[ECX+6F4] 00442AE6 . 83F9 00 CMP ECX,0 ; First ID 00442AE9 ^0F8C 86F4FDFF JL id_0.00421F75 00442AEF 83F9 0A CMP ECX,0A ; last ID 00442AF2 ^0F8F 7DF4FDFF JG id_0.00421F75 00442AF8 B9 F4010000 MOV ECX,1F4 00442AFD 2BC8 SUB ECX,EAX 00442AFF B8 1F85EB51 MOV EAX,51EB851F 00442B04 F7E9 IMUL ECX 00442B06 C1FA 05 SAR EDX,5 00442B09 8BC2 MOV EAX,EDX 00442B0B C1E8 1F SHR EAX,1F 00442B0E 03D0 ADD EDX,EAX 00442B10 8B86 08030000 MOV EAX,DWORD PTR DS:[ESI+308] 00442B16 8D4C10 04 LEA ECX,DWORD PTR DS:[EAX+EDX+4] ; MP Regen Rate 00442B1A ^E9 87F4FDFF JMP id_0.00421FA6

I took the time to label the important parts, as you can see you only have to edit the CMP ECX,0 (replace 0 with your start ID) and CMP ECX,0A (replace 0A with your end ID). By default all ID's between 0 and 10 get uber fast mana regeneration(Remember the numbers should be in hex, thats why 0A = 10).
*Note*If you want only 1 ID, it's basically the same, you only have to change the CMP ECX,0

To change the rate the mana regenerates you need to change this line : LEA ECX,DWORD PTR DS:[EAX+EDX+4] , I set it to +4, the original is +1. If you set it -1 he will lose mp, but when his HP is low he will start regenerating again, this has something to do with the other part of the code which I don't understand :D.

There you have it folks :), I might dig deeper into this to figure out the other code, but I don't think I'll be doing that any time soon :D.]]>
First of all you have to decide if you want it to be one ID or a range of ID's.

For one ID use this CFG for the patcher: (For some reason, the forum auto adds a space in the cfg, I don't know why... Just remove it when you copy paste)
Code:
00021F6F,8B89F4060000,E96C0B020090 00042AE0,000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,8B89F406000083F9000F8586F4FDFFB9F40100002BC8B81F85EB51F7E9C1FA058BC2C1E81F03D08B86080300008D4C1004E990F4FDFF

For a range of ID's use this CFG for the patcher: (For some reason, the forum auto adds a space in the cfg, I don't know why... Just remove it when you copy paste)
Code:
00021F6F,8B89F4060000,E96C0B020090 00042AE0,000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,8B89F406000083F9000F8C86F4FDFF83F90A0F8F7DF4FDFFB9F40100002BC8B81F85EB51F7E9C1FA058BC2C1E81F03D08B86080300008D4C1004E987F4FDFF

Alright, so after you patched the exe with one of these thingies, open the the exe with olly and go to offset 00442AE0 (Press ctrl+g and write in 00442AE0).

Then you will see a bunch of code like this:
Code:
00442AE0 > 8B89 F4060000 MOV ECX,DWORD PTR DS:[ECX+6F4] 00442AE6 . 83F9 00 CMP ECX,0 ; First ID 00442AE9 ^0F8C 86F4FDFF JL id_0.00421F75 00442AEF 83F9 0A CMP ECX,0A ; last ID 00442AF2 ^0F8F 7DF4FDFF JG id_0.00421F75 00442AF8 B9 F4010000 MOV ECX,1F4 00442AFD 2BC8 SUB ECX,EAX 00442AFF B8 1F85EB51 MOV EAX,51EB851F 00442B04 F7E9 IMUL ECX 00442B06 C1FA 05 SAR EDX,5 00442B09 8BC2 MOV EAX,EDX 00442B0B C1E8 1F SHR EAX,1F 00442B0E 03D0 ADD EDX,EAX 00442B10 8B86 08030000 MOV EAX,DWORD PTR DS:[ESI+308] 00442B16 8D4C10 04 LEA ECX,DWORD PTR DS:[EAX+EDX+4] ; MP Regen Rate 00442B1A ^E9 87F4FDFF JMP id_0.00421FA6

I took the time to label the important parts, as you can see you only have to edit the CMP ECX,0 (replace 0 with your start ID) and CMP ECX,0A (replace 0A with your end ID). By default all ID's between 0 and 10 get uber fast mana regeneration(Remember the numbers should be in hex, thats why 0A = 10).
*Note*If you want only 1 ID, it's basically the same, you only have to change the CMP ECX,0

To change the rate the mana regenerates you need to change this line : LEA ECX,DWORD PTR DS:[EAX+EDX+4] , I set it to +4, the original is +1. If you set it -1 he will lose mp, but when his HP is low he will start regenerating again, this has something to do with the other part of the code which I don't understand :D.

There you have it folks :), I might dig deeper into this to figure out the other code, but I don't think I'll be doing that any time soon :D.]]> <![CDATA[Making A stage mode only lf2.]]> https://lf-empire.de/forum/showthread.php?tid=64 Sat, 08 Mar 2008 08:48:33 +0100 Boop]]> https://lf-empire.de/forum/showthread.php?tid=64
OllyDbg ( found on the main site)
PE explorer: http://www.heaventools.com (get the 30 day trial)
Hex workshop ( found on the main site).

Behind the secene stuff:

Well this works by changing the first item selected by lf2 to stage mode and then using my hex tweak to pass the menu( found in the quick reference theard).


How to do it:

Open olly and then using it open lf2. Right click anywhere in the upper part of the screen and press goto >expression and type in 442BE7, it will take you to this place double click the selected line and copy paste this : "MOV BYTE PTR DS:[449094],1" (without the qoutes ). Now on the line under it type: "JMP 0043AB71" (without qoutes). Now save the exe by doing the following :
1.Right click on the upper part of the screen
2.Copy to exuctable > All modifications > copy all
3. On the new window which poped up, right click on the upper part of the screen and press save file.

Now quit olly and run PE explorer, and open lf2 using it. Now where it says Address of entery point change it to 442BE7 and press the green tick/v (no idea how it's called in english) and press ctrl+s to save the file . Now test you're exe and make sure everything works fine and that when you start the game the first thing which is slected is stage mode. Now just go to the Hex reference theard and do the hex tweak, and if you're to lazy here you go:

-------------------------------------------------------------------------------------
Title: Skip Menu (Goes straight to the first thing selected by default thats VS mode, trying to change it)
Original: 0F84C3000000
Offset: 0002FE2B
Edit: 909090909090
-------------------------------------------------------------------------------------



Fun stuff :

If you change the last number of this line you can get to any part of the menu(it starts from 0, for example vs mode is 0 stage mode is 1 etc etc etc) : MOV BYTE PTR DS:[449094],1

Tutorial By Silva!!(me :D)]]>
OllyDbg ( found on the main site)
PE explorer: http://www.heaventools.com (get the 30 day trial)
Hex workshop ( found on the main site).

Behind the secene stuff:

Well this works by changing the first item selected by lf2 to stage mode and then using my hex tweak to pass the menu( found in the quick reference theard).


How to do it:

Open olly and then using it open lf2. Right click anywhere in the upper part of the screen and press goto >expression and type in 442BE7, it will take you to this place double click the selected line and copy paste this : "MOV BYTE PTR DS:[449094],1" (without the qoutes ). Now on the line under it type: "JMP 0043AB71" (without qoutes). Now save the exe by doing the following :
1.Right click on the upper part of the screen
2.Copy to exuctable > All modifications > copy all
3. On the new window which poped up, right click on the upper part of the screen and press save file.

Now quit olly and run PE explorer, and open lf2 using it. Now where it says Address of entery point change it to 442BE7 and press the green tick/v (no idea how it's called in english) and press ctrl+s to save the file . Now test you're exe and make sure everything works fine and that when you start the game the first thing which is slected is stage mode. Now just go to the Hex reference theard and do the hex tweak, and if you're to lazy here you go:

-------------------------------------------------------------------------------------
Title: Skip Menu (Goes straight to the first thing selected by default thats VS mode, trying to change it)
Original: 0F84C3000000
Offset: 0002FE2B
Edit: 909090909090
-------------------------------------------------------------------------------------



Fun stuff :

If you change the last number of this line you can get to any part of the menu(it starts from 0, for example vs mode is 0 stage mode is 1 etc etc etc) : MOV BYTE PTR DS:[449094],1

Tutorial By Silva!!(me :D)]]>