Little Fighter Empire - Forums - Tutorials

Learn lf2.exe from C

Sat, 23 Aug 2014 08:22:49 +0200

Learn lf2.exe from C

This tutorial teach you how to use C to understand what the assembly means in lf2.exe.
Please download the tool IDA and ollydbg, we use these tools to find what lf2.exe doing in this tutorial.

Stack frame

Lets checkout this function func_417400.
At begining

When this function get called, the stack will pushed a return address.
The return address is where to jump back when this function is doned and ready to return.

When the sub esp,30 is executed, stack pointer (esp) will prepare the space for local variables usage.

When the mov eax,dword ptr ss:[esp+34] is executed, we get the first argument of this function and store it in eax register.

So the definition of this function looks like:

C-Code:

int func_417400(arg_1) {
}

When the push esi is executed, we save the data in esi register to prevent the code below from ruining the data in esi register.
We will use esi register for another purpose in code below.

When the mov esi,ecx is executed, we copy the this pointer to esi register.
Because LF2 is developed by Visual C++, by convension, Visual C++ compiler uses ecx register to transfor the this pointer to the function be called.
You can regard this pointer as a first argument of this function in C.
So the definition of this function looks like:

C-Code:

int func_417400(this, arg_1) {
}

Code in function

Now we look this code:

The first line mov eax,dword ptr ds:[esi+eax*4+194] is a little bit complicated, this instruction use two registers to locate the address which data is stored in.
We can translate this intruction to mov eax,dword ptr ds:[this+arg_1*4+194].

By using this image, we know arg_1 should be index of objects and this pointer should be struct 'global' pointer, so the definition of this function becomes:

C-Code:

int func_417400(struct global * global, uint32_t object_index) {
}

By inspecting this intruction mov eax,dword ptr ds:[this+arg_1*4+194], we know corresponding C code:

C-Code:

struct object * a_object = global->objects[object_index];

By using the data structure, we can understand what the code below means.

The second line mov ecx,dword ptr ds:[eax+7C] means:

C-Code:

uint32_t frame_id = a_object->frame_id;

The third line mov edx,dword ptr ds:[eax+368] means:

C-Code:

struct file * a_file = a_object->file;

These two lines imul ecx,ecx,178 and lea ecx,dword ptr ds:[ecx+edx+7A4] means:

C-Code:

struct frame * a_frame = &a_file->frames[frame_id];

So the function should looks like:

C-Code:

int func_417400(struct global * global, uint32_t object_index) {
    struct object * a_object = global->objects[object_index];
    uint32_t frame_id = a_object->frame_id;
    struct file * a_file = a_object->file;
    struct frame * a_frame = &a_file->frames[frame_id];
}

If you have any question, please reply below.
Thanks you for reading this tutorial :)

Changing\Removing ads in exe

Fri, 23 Nov 2012 15:32:36 +0100

I know how to change the links and image.
First change the sprite of the images to what you want in sprite\ad0.bmp
Then go to data folder and open ad0.txt there you will find
ta 0 140 300
ta 140 280 300
ta 280 300 300
And do the same in ad1.bmp and ad1.txt.
Hope you'll understood it.

To remove it

Lord Silva Wrote:Turn updates off (at
the top right). Go to the
data folder and remove
all the files related to
ads. Jobs done.

Le New Video Tutorial

Mon, 02 May 2011 15:25:27 +0200

http://www.lf-empire.de/phoenix/LFE/Debu...202011.mp4

Assumes you already have RadASM installed and can compile dlls and stuff.
Also assumes you have Olly and CheatEngine.

If you can't get it to play, use vlc. Might want to watch the older ones then watch this one if you are struggling with the concepts explained.

[ancient video tutorial] How to debug by Silva

Mon, 14 Sep 2009 22:00:55 +0200

Guys, we found the ultimate solution to your hexing problems...
means no more annoying and noobish posts that all are about the same sh*t and what not.. so prepare to be impressed and don't even dare to complain about quality.. this is more than 2 years old..

Click me

Credits go to:
- Silva for making this videos and the writeup..
- Bp for still having them on his harddisk
- and me for writing this post cause silva couldn't be bothered..

About the LF2 Engine

Wed, 29 Jul 2009 15:18:16 +0200

LF2 consists of "objects". There is a maximum of 400 objects, numbered 0-399. LF2 loops through all the objects and does all the needed operations on them(physics calculations etc).Getting to access an object you first have to get it's base address. That looks something like this:

Code:
mov eax,dword ptr ds:[esi+edi*4+194h]

Now I'll explain what everything is.

eax: that is where the address will be stored. Basic mov operation (mov destination,source).

esi: Lets call it the "base pointer"(incorrect term but w/e), it is always 458B00h.

edi: That is the number of the object. Like I mentioned previously, lf2 loops through the objects, so making this a register means the same line can be used to access any object.

So that line can be expressed as:

Code:
mov eax, dword ptr ds:[458B00h+Object_Number*4+194h]

*The registers used are just examples, they can be, and will be different in different situations.

Advanced (useless to most of you):
It is possible to check if an object exists or not.

Code:
cmp byte ptr ds:[esi+edi+4],0

If it is zero, then the object doesn't exist, if it is 1, it does exist.

After you have access to the "Object", you can access the objects properties. That works something like:
mov dword ptr ds:[eax+70h],0
That sets the objects frame number to 0. A large list of offsets exists here: http://lf-empire.de/forum/thread-2756-po...#pid152651

As of now, you have access to everything on the first page. To get access to the second page/"ID Properties" you have to get the next pointer. Assuming eax holds your object pointer:

Code:
mov eax, dword ptr ds:[eax+368h] ;move the id properties pointer into eax

cmp dword ptr ds:[eax+6f4h],10 ;check if the ID is 10

Basically, the first line loads the pointer for the id properties. Then after you have the pointer stored in eax, you can access all the information on the 2nd page (only useful stuff is ID and Type).

Now all that left is the frame stuff:

Code:
mov eax,dword ptr ds:[esi+edi*4+194h] ;Get object pointer

mov ecx,dword ptr ds:[eax+70h] ; get frame number and store in ecx

mov edx,dword ptr ds:[eax+368h] ; get "id" pointer and store in edx

imul ecx,ecx,178h ; multiply frame(ecx) by 178h

cmp dword ptr ds:[ecx+edx+7ACh],0 ; check if state is 0

Hopefully that all makes sense, it is basically : frame number * 178h + object pointer + Offset.

End.

~Written by (Lord) Silva

Patching exe to load DLL

Sun, 05 Apr 2009 08:42:40 +0200

What you need:
IIDKing v2.01
OllyDBG

1.Open IIDKing and Open LF2 with it.
2.Press "Click to pick DLL(s) and their API(s) to add.
3.Browse to C:/windows/system32/kernel32.dll
4.Scroll down in the window appeared until you see "LoadLibaryA"
5.Select it and press "Add them!"
Should be at this stage:

Just press "Add them!!" and you are finished.

IDDKing made a txt file in your lf2 directory. Open it. It should say something like:

Code:
kernel32.dll::LoadLibraryA->call dword ptr [74f134]

Now it is time for Olly.

1.Open lf2 in olly.
*The first line selected is the called the Entry point.
2.Change the call at the entry point to call an empty location at the bottom of the file. For example:

ASM-Code:

;before
CALL 00445B31
;after
CALL 00446A61

3.Now at 00446A61(or where ever you choose to call), put the original call again( CALL 00445B31).
4.Scroll up a few lines(I did it at 00446A4E), right click, binary> edit. Type in rarara.dll (in the ASCII box).
5.Now scroll back to the call and write PUSH X (X being where you wrote the dll name, for me its 00446A4E).
6.Remember the txt that IDDKing made? Open it and copy paste the call part (call dword ptr [74f134]), then paste it into olly after the push.
7.return to the rest of the code. (RET command, it is a asm command thingy)

Example:

Code:
00446333   . 72 61 72 61 72>ASCII "rarara.dll",0

0044633E  /$ 68 33634400    PUSH lf2_load.00446333                   ; /FileName = "rarara.dll"

00446343  |. FF15 34F17400  CALL DWORD PTR DS:[<&kernel32.LoadLibrar>; \LoadLibraryA

00446349  |. FF15 2E634400  CALL DWORD PTR DS:[44632E]               ;  lf2_load.00445AA1

0044634F  \. C3             RETN

You're done :).

PS: Make sure the exe you are patching is based on the no-num version... Otherwise the DLL won't work.

[UPDATED]"perspective:" Tag in use

Sat, 28 Mar 2009 15:55:11 +0100

Okay, YinYin was one of the people that couldn't get it to work. Well we worked together and I fixed it now.
Exe now has YinYin's seal of approval, therefore it must work :).

I'm not sure how many of you knew about this, but marti and starsky made a "perspective: " tag in lf2 and left it unused(it is for bgs). Well now I decided to give it some value!

Download:
http://www.mediafire.com/?z4gmnmmzjzn << Updated exe, approved by YinYin.

What it does:
Basically, what ever number you put into the perspective, it spawns the object(drops it from the sky).

example:

DC-Code:

width: 2400   zboundary: 289 510 perspective: 78

If that is in your bg, then when you bg is loaded, (id)object 78 will be loaded dropped from the sky! :).

This only runs in VS mode... I don't know if it should be a "feature" or a "bug" :D.

Setting up DLL Compiler

Wed, 04 Mar 2009 20:40:45 +0100

How to setup RadASM to compile the dll code.
These instructions are for dummies. Most of the steps are common sense and if you're intelligent you probably don't need to read them.

Step 1:
Download this: http://www.oby.ro/masm32/m32v10r.zip
Step 2:
Extract the zip file you downloaded, and run install.exe.
Step 3:
It will ask you where to install. Select c:.
Step 4:
Press start
****The next 4 steps tell you to press OK on every window you see pop up, feel free to skip them if you think you can handle it*******
Step 5:
Warning message appears. Feel free to turn off your anti virus, or just ignore it.
Step 6:
It tells you it will install on C. Press Yes.
Step 7:
Another window appears, press OK.
Step 8:
Another window appears, press extract.
****Start reading here again****
Step 9:
Console screen appears and starts spewing text out. Wait for it to finish
Step 10:
After it finishes, a window will pop up telling you to press any key, press any key.
Step 11:
Another window appears just press yes again. Keep pressing OK/close any other windows that appear.

Congratulations! You've installed MASM32, now you need to install RadASM.

Step 1:
Download this: http://www.mediafire.com/?vmzjjvy0mzz
Step 2:
Extract it. I extracted it in C: (c:\radasm) , if u don't do that, you'll have to put c:\ in front of all the include files(read post #5 and #6).
Step 3:
run RadASM.exe which is inside the RadASM folder.

Congratulations, you've installed and ran RadASM!! Now you need to get the DLL project files and learn how to compile them.. I always post the newest version of the code here: http://www.lf-empire.de/forum/showthread.php?tid=2246

Step 1:
Download the newest version of the code.
Step 2:
Extract it in : RadASM > MASM> Projects . It will replace the old rarara folder
Step 3:
In RadASM, the top menu, press File. Then Open Project. Browse to RadASM > MASM > Projects > rarara > rarara.rep

Congratulations! You've opened the project. To open files in the project look at the far right side, you will see the list of files. Since I want this tutorial to apply in the future as well, I won't tell you what they are called, but double click any of them to open them.

To compile press ALT+SHIFT+F5 , or in the top menu go to Make > Build. The output dll (rarara.dll) will be in the project folder (RadASM > MASM > Projects > rarara).

To get LF2 to actually load the exe, you will need to download this:
http://www.mediafire.com/?qzkzzvhfvdv
That exe file will load rarara.dll, the dll file has to be called rarara.dll , the dll has to be in the same folder as the exe.

Congratulations! You've finished reading the tutorial on how to set it up, now you can play around with stuff, until I finish writing the whole dll framework system .