[1.298] Disable experience loss in Ardream AND Bifrost!

[quote name='twostars' timestamp='1296421699' post='176']
Basically, CUser::Attack already has a check for disabling experience loss in a zone (dynamic), however it's not very useful in the case of multiple open zones. So, we'll need to add our own.

In CUser::Attack we'll find the call to CUser::ExpChange at 00496956.

Kod:

00496956    E8 CBB7F6FF   CALL 00402126

Since the call is 5 bytes long, we'll replace it with a jump to our code-cave (which will also be 5 bytes, as it will be a far jump), which I've got at 00499233:

Kod:

00496956    E9 D8280000   JMP 00499233

Upon going to the code-cave, we'll need to make sure that we can access the pointer that was used before to get to the current zone. We're just doing this again as a precaution, as there is one case where eax is re-used (so it wouldn't point to the data we want it to anymore).

Kod:

00499233    8B87 98800000  MOV EAX,DWORD PTR DS:[EDI+8098]

To save bytes, we'll conveniently store the zone ID in CL.

Kod:

00499239    8A48 3C      MOV CL,BYTE PTR DS:[EAX+3C]

Now we can go through our zone blacklist, starting with Ardream!
Compare the zone ID to 0CA (202 - Ardream).

Kod:

0049923C    80F9 CA      CMP CL,0CA

If the zone is Ardream, we'll jump to our "don't take experience" case, down below.

Kod:

0049923F    74 0C        JE SHORT 0049924D

Now we compare the zone ID to 1F (31 - Bifrost).

Kod:

00499241    80F9 1F      CMP CL,1F

If the zone is Bifrost, we'll jump to our "don't take experience" case, down below.

Kod:

00499244    74 07        JE SHORT 0049924D

Since the zone is none of the above, we'll call CUser::ExpChange() to do all the experience stuff!

Kod:

00499246    E8 DB8EF6FF   CALL 00402126

Jump back to the code in CUser::Attack() (this jumps down to the actual jump at the end of the "don't take experience" case below to save bytes).

Kod:

0049924B    EB 03        JMP SHORT 00499250

This is our "don't take experience" case. This line cleans up the stack (3 DWORDs are passed into CUser::ExpChange(), they were pushed onto the stack but we aren't going to call CUser::Attack(), so we'll take them back off the stack!).

Kod:

0049924D    83C4 0C      ADD ESP,0C

Jump back to CUser::Attack().

Kod:

00499250   ^E9 06D7FFFF   JMP 0049695B

Code recap

Jump to code-cave from CUser::Attack():

Kod:

00496956    E9 D8280000   JMP 00499233

Our code-cave:

Kod:

00499233    8B87 98800000  MOV EAX,DWORD PTR DS:[EDI+8098]
00499239    8A48 3C      MOV CL,BYTE PTR DS:[EAX+3C]
0049923C    80F9 CA      CMP CL,0CA
0049923F    74 0C        JE SHORT 0049924D
00499241    80F9 1F      CMP CL,1F
00499244    74 07        JE SHORT 0049924D
00499246    E8 DB8EF6FF   CALL 00402126
0049924B    EB 03        JMP SHORT 00499250
0049924D    83C4 0C      ADD ESP,0C
00499250   ^E9 06D7FFFF   JMP 0049695B

Have fun!
[/quote]