If I remember correctly positive limitspeed values were disabled at some point. I think they're enabled in 07, but disabled in 08.
Looking in the 1.5 source confirms this:
Code:
float ZCharacter::GetMoveSpeedRatio()
{
float fRatio = 1.f;
MMatchItemDesc* pMItemDesc = GetSelectItemDesc();
if(pMItemDesc)
{
if( pMItemDesc->m_nLimitSpeed.Ref() <=100) //Á¤»ó À¯Àúµé..
fRatio = pMItemDesc->m_nLimitSpeed.Ref()/100.f;
else //ÇØÄ¿µé...Áë³» °³ ´À·ÁÁú²¬..¤»¤»¤»¤»
fRatio = 0.1f;
}
return m_pModule_Movable->GetMoveSpeedRatio()*fRatio;
}
As we can see, if limitspeed is greater than 100, the movement speed ratio gets set to 0.1f, making you 10 times slower.
So, we need to disable this limitation. In the source, it would be as simple as removing the if statement, and the else block, like so:
Code:
float ZCharacter::GetMoveSpeedRatio()
{
float fRatio = 1.f;
MMatchItemDesc* pMItemDesc = GetSelectItemDesc();
if(pMItemDesc)
{
//if( pMItemDesc->m_nLimitSpeed.Ref() <=100) //Á¤»ó À¯Àúµé..
fRatio = pMItemDesc->m_nLimitSpeed.Ref()/100.f;
//else //ÇØÄ¿µé...Áë³» °³ ´À·ÁÁú²¬..¤»¤»¤»¤»
// fRatio = 0.1f;
}
return m_pModule_Movable->GetMoveSpeedRatio()*fRatio;
}
However, since you're using the 08 runnable, we're going to need to do some ASM.
First, I found the relevant function here:
Code:
00477FB0 /. 55 PUSH EBP
00477FB1 |. 8BEC MOV EBP,ESP
00477FB3 |. 51 PUSH ECX
00477FB4 |. D905 D82D6200 FLD DWORD PTR DS:[622DD8]
00477FBA |. 56 PUSH ESI
00477FBB |. 57 PUSH EDI
00477FBC |. D955 FC FST [LOCAL.1]
00477FBF |. 8BF9 MOV EDI,ECX
00477FC1 |. 8D77 6C LEA ESI,DWORD PTR DS:[EDI+6C]
00477FC4 |. 85F6 TEST ESI,ESI
00477FC6 |. 74 54 JE SHORT Repack_3.0047801C
00477FC8 |. 8BCE MOV ECX,ESI
00477FCA |. DDD8 FSTP ST
00477FCC |. E8 5F530000 CALL Repack_3.0047D330
00477FD1 |. 85C0 TEST EAX,EAX ; kernel32.BaseThreadInitThunk
00477FD3 |. 74 44 JE SHORT Repack_3.00478019
00477FD5 |. 8BCE MOV ECX,ESI
00477FD7 |. E8 54530000 CALL Repack_3.0047D330
00477FDC |. 8BC8 MOV ECX,EAX ; kernel32.BaseThreadInitThunk
00477FDE |. E8 9D600900 CALL Repack_3.0050E080
00477FE3 |. 85C0 TEST EAX,EAX ; kernel32.BaseThreadInitThunk
00477FE5 |. 74 32 JE SHORT Repack_3.00478019
00477FE7 |. 8B40 6C MOV EAX,DWORD PTR DS:[EAX+6C]
00477FEA |. 83F8 64 CMP EAX,64
00477FED |. 8945 FC MOV [LOCAL.1],EAX ; kernel32.BaseThreadInitThunk
00477FF0 |. 7F 15 JG SHORT Repack_3.00478007
00477FF2 |. DB45 FC FILD [LOCAL.1]
00477FF5 |. 8B47 68 MOV EAX,DWORD PTR DS:[EDI+68]
00477FF8 |. 5F POP EDI ; kernel32.753A339A
00477FF9 |. 5E POP ESI ; kernel32.753A339A
00477FFA |. D80D 442E6200 FMUL DWORD PTR DS:[622E44]
00478000 |. D848 58 FMUL DWORD PTR DS:[EAX+58]
00478003 |. 8BE5 MOV ESP,EBP
00478005 |. 5D POP EBP ; kernel32.753A339A
00478006 |. C3 RETN
00478007 |> 8B47 68 MOV EAX,DWORD PTR DS:[EDI+68]
0047800A |. D905 342E6200 FLD DWORD PTR DS:[622E34]
00478010 |. D848 58 FMUL DWORD PTR DS:[EAX+58]
00478013 |. 5F POP EDI ; kernel32.753A339A
00478014 |. 5E POP ESI ; kernel32.753A339A
00478015 |. 8BE5 MOV ESP,EBP
00478017 |. 5D POP EBP ; kernel32.753A339A
00478018 |. C3 RETN
00478019 |> D945 FC FLD [LOCAL.1]
0047801C |> 8B47 68 MOV EAX,DWORD PTR DS:[EDI+68]
0047801F |. D848 58 FMUL DWORD PTR DS:[EAX+58]
00478022 |. 5F POP EDI ; kernel32.753A339A
00478023 |. 5E POP ESI ; kernel32.753A339A
00478024 |. 8BE5 MOV ESP,EBP
00478026 |. 5D POP EBP ; kernel32.753A339A
00478027 \. C3 RETN
Now to remove the limit, we need to edit this line:
Code:
00477FF0 7F 15 JG SHORT Repack_3.00478007
To never jump, by replacing it with NOPs:
Code:
00477FF0 90 NOP
00477FF1 90 NOP
I haven't tested it, but that should work. Report back with results :).
Edit: The value for limitspeed is a percentage of normal speed, so 100% = 1 times normal speed, 3000% = 30 times normal speed, etc.