[1351/KO 2.0/1397]Moradon Arena Attack Enabling!

[quote name='AKUMA' timestamp='1298322655' post='4200']

Kod:


Patch 1 : Moradon Arena Attack (Skill)
00451761  . /E9 170E0B00  JMP    0050257D                          ;  Moradon Arena Attack (Skill)
00451766    |90            NOP
00451767    |90            NOP
00451768    |90            NOP

0050257D  > \8B87 98800000 MOV    EAX, DWORD PTR DS:[EDI+8098]
00502583  .  8078 3B 15    CMP    BYTE PTR DS:[EAX+3B], 15
00502587  .^ 0F84 17F3F4FF JE      004518A4
0050258D  .  85FF          TEST    EDI, EDI
0050258F  .^ 0F84 0FF3F4FF JE      004518A4
00502595  .^ E9 CFF1F4FF  JMP    00451769

Patch 2 : Moradon Arena Attack (R Damage)

0047CF54  . /E9 44560800  JMP    0050259D                          ;  Moradon Arena Attack IRK (R Damage)
0047CF59    |90            NOP
0047CF5A    |90            NOP
0047CF5B    |90            NOP

0050259D  >  8B8F 98800000 MOV    ECX, DWORD PTR DS:[EDI+8098]
005025A3  .  8079 3B 15    CMP    BYTE PTR DS:[ECX+3B], 15
005025A7  .^ 0F84 AFA9F7FF JE      0047CF5C
005025AD  .  85C0          TEST    EAX, EAX
005025AF  .^ 0F84 4DACF7FF JE      0047D202
005025B5  .^ E9 A2A9F7FF  JMP    0047CF5C


General Note : Not tested in 1351. (Tested on 1397)
Update Note : Updated Codes, Mele attack smoothly.
Patch Bugs : Nova, Inferno, Blizard, Meteor etc, Area Skill Not Working
Development Codes : Nova, Inferno, Blizard, Meteor etc.
Development Code Bugs : Moradon Arena Outside in the works area skills.

Kod:


004530AA  . /E9 0EF50A00  JMP    005025BD
004530AF    |90            NOP
004530B0    |90            NOP
004530B1    |90            NOP
004530B2    |90            NOP
004530B3    |90            NOP

005025BD  > \8B8F 98800000 MOV    ECX, DWORD PTR DS:[EDI+8098]
005025C3  .  8079 3B 15    CMP    BYTE PTR DS:[ECX+3B], 15
005025C7  .  74 08        JE      SHORT 005025D1
005025C9  .  85C0          TEST    EAX, EAX
005025CB  .^ 0F84 EC0AF5FF JE      004530BD
005025D1  >  0FBF06        MOVSX  EAX, WORD PTR DS:[ESI]
005025D4  >  8B4D F8      MOV    ECX, DWORD PTR SS:[EBP-8]
005025D7  .^ E9 D80AF5FF  JMP    004530B4

004530C7    /E9 13F50A00  JMP    005025DF
004530CC    |90            NOP
004530CD    |90            NOP
004530CE    |90            NOP
004530CF    |90            NOP

005025DF      8B8F 98800000 MOV    ECX, DWORD PTR DS:[EDI+8098]
005025E5      8079 3B 15    CMP    BYTE PTR DS:[ECX+3B], 15
005025E9    ^ 0F84 E10AF5FF JE      004530D0
005025EF      3B45 D8      CMP    EAX, DWORD PTR SS:[EBP-28]
005025F2    ^ 0F8C FB09F5FF JL      00452FF3
005025F8    ^ E9 D30AF5FF  JMP    004530D0


[/quote]

[quote name='twostars' timestamp='1298412324' post='4328']
It can be.

Kod:

00451761 /E9 AD0E0B00 JMP 00502613
00451766 |. |90 NOP
00451767 |. |90 NOP
00451768 |. |90 NOP

This is here in 1.298 (you'll have to find an unused codecave to jump to!):

Kod:

00464FA7                test    edi, edi

Kod:

00502619 8078 3B 15 CMP BYTE PTR DS:[EAX+3B], 15

In 1.298, this should read: CMP BYTE PTR DS:[EAX+3C], 15

And this:

Kod:

0047CF54 /E9 DA560800 JMP 00502633
0047CF59 |90 NOP
0047CF5A |90 NOP
0047CF5B |90 NOP

Is here in 1.298:

Kod:

00496424                test    eax, eax

Again, you'll have to find your own unused codecave to jump to.

With the jumps in the codecaves, we've got:

Kod:

JE 004518A4

Which is this in 1.298:

Kod:

JE 004650EA

We've got:

Kod:

JMP 00451769

Which is this in 1.298:

Kod:

JMP 00464FAF

We've got:

Kod:

JE 0047CF5C

Which is this in 1.298:

Kod:

JE 0049642C

We've got:

Kod:

JE 0047D202

Which is this in 1.298:

Kod:

JE 004966D2

And finally we've got:

Kod:

JMP 0047CF5C

Which is, as before, this in 1.298:

Kod:

JMP 0049642C

So the patch (minus the codecave itself) looks like this for 1.298:

Kod:

00464FA7 /E9 AD0E0B00 JMP CODECAVE_1
90 NOP
90 NOP
90 NOP

CODECAVE_1 MOV EAX, DWORD PTR DS:[EDI+8098]
CODECAVE_1 CMP BYTE PTR DS:[EAX+3C], 15
CODECAVE_1 JE 004650EA
CODECAVE_1 TEST EDI, EDI
CODECAVE_1 JE 004650EA
CODECAVE_1 JMP 00464FAF

00496424 /E9 DA560800 JMP CODECAVE_2
|90 NOP
|90 NOP
|90 NOP

CODECAVE_2 MOV EAX, DWORD PTR DS:[EDI+8098]
CODECAVE_2 CMP BYTE PTR DS:[EAX+3C], 15
CODECAVE_2 JE 0049642C
CODECAVE_2 TEST EAX, EAX
CODECAVE_2 JE 004966D2
CODECAVE_2 JMP 0049642C

Now you just have to find a suitable unused codecave (with 1.298 it's easy, there's probably room just outside of each method itself (CUser::Attack(), CMagicProcess::IsAvailalable()!).
[/quote]