- Joined
- May 21, 2010
- Messages
- 51
- Reaction score
- 7
You will need to create a section with a good amount of bytes to have a good space to add the maps.
Open Hex Workshop, click New on files and so the portion you type appears click the right mouse button and choose insert, open a message which asks how many bytes and add below which byte to put simple, I put 9000 bytes and the value 00, it will create 9000 spaces and 00 in each, so it did save it with the name you want, just be careful with a dot in front for example. newsec
After doing this, you will open the LordPE, select your. Executable, and then click Sections in the new window opens click the right mouse button on the final table, had opened a menu section and choose load from disk and box dialog select the table created by Hex Workshop, so insert the new table click on the x just above this window and the save command, click OK and exit LordPE
Now open your game with PeExplorer in Section Headers and go, there you will find the session you just added, after it finds
see Virtual Address tab, and note the offset that there will be the offset that this is your session in Olly.
Open game.exe in olly and find the offset of any map that already has the. Exe
I for one found Ice2
00434B68 68 PUSH 80C65B00 game.005BC680; ASCII "ice2"
00434B6D 68 70C65B00 PUSH Game.005BC670; ASCII "Ice \ ice_2.ASE"
B9 CCC87900 00434B72 MOV ECX, Game.0079C8CC
00434B77 E8 04C0FFFF CALL Game.00430B80
00434B7C 68 PUSH F69C0000 9CF6
00434B81 68 PUSH A88D0000 8DA8
B9 CCC87900 00434B86 MOV ECX, Game.0079C8CC
00434B8B C705 90C97900 00> MOV DWORD PTR DS: [79C990], 900
C705 00434B95 94C97900 23> MOV DWORD PTR DS: [79C994], 23
00434B9F C705 98C97900 24> MOV DWORD PTR DS: [79C998], 24
00434BA9 C705 9CC97900 25> MOV DWORD PTR DS: [79C99C], 25
00434BB3 ECDC7900 8935 MOV DWORD PTR DS: [79DCEC], ESI
00434BB9 C705 A0C97900 0B> MOV DWORD PTR DS: [79C9A0] 0B
00434BC3 E8 38C0FFFF CALL Game.00430C00
00434BC8 6A 20 PUSH 20
00434BCA 6A 40 PUSH 40
00434BCC 68 C0040000 PUSH 4C0
00434BD1 68 66C60000 PUSH 0C666
00434BD6 945D 68 PUSH 5D940000
00434BDB E8 40C1FFFF CALL Game.00430D20
00434BE0 68 E8050000 PUSH 5E8
00434BE5 68 PUSH 74C30000 0C374
00434BEA 68 E8800000 PUSH 80E8
00434BEF 68 48DD7900 PUSH Game.0079DD48
00434BF4 E8 E7C1FFFF CALL Game.00430DE0
Select it over as shown in the above code and Ctrl + C and Ctrl + V to paste a block of note.Latter it back to
olly with the map still selected and click the right button and go on BINARY> Binary copy.
Now go to the new section of its game, it will be found for the offset that you wrote down when opened. Exe with PEExplorer
Select a good amount of bytes and click the right button and go into binary> Binary paste and ready, their codes have been added
successfully save.Nao not forget to forget to get some calls, like you copied the codes from an existing map, you need
Calls to change some of your map to not bugar (not to be the same)
Pay attention to Movs your map, they are responsible for the number of Field and also the music and effects, you see that in all
the maps they are different, since they follow a numerical pattern, now let's fix some "Mov ECX"
In my map there are 3 pieces of code called "mov ecx value" appears and he is responsible for the number of field sample
/ Field 42.
To fix it find the last map that was added to his. Exes, find codes that map in my
last map "Dun-1" which is Endless Tower 2nd Floor has the final "mov ecx" which is the / field 41, a ctrl + c ctrl + v this mov
paste in a notepad and copy the value
it will look like this "mov ecx, 7A43B4" open the scientific calculator windows click "hex" paste the value in
My case is 7A43B4 and make the sum of + 147C.
The value of your map will be generated, in my case I get like "mov ecx, 7A5830" then copy the code along with the mov ecx, VALUE (it
course), go to the table of your map to find the 3 and go replacing mov ecx.
Now note that on every map there is normal 6 mov dword like this:
mov dword ptr ds: [7A4478], 500
mov dword ptr ds: [7A447C], ebx
mov dword ptr ds: [7A4480], ebx
mov dword ptr ds: [7A4484], ebx
mov dword ptr ds: [7A4488], ebp
mov dword ptr ds: [7A57D4], esi
They determine the effects and music in your map to correct they is practically the same thing then mov ecx lets go.
Look for Dun-8 again, it will be the sixth mov dword.
Select 6 click the right button Binary> binary copy and then go up from the table that you created in your new map,
select the 6 de la click the right button and go on BINARY> binary paste.
Now we choose the music in your map.
Note that in the end mov dword have something like this:
500
ebx
ebx
ebx
ebp
esi
This determines the music in your map and change it just put another map, for example I want to have music
City then I see it I search by name "Ricarten" I copy it the ebp, ebx, edi, edi, ebp, esi (example) and paste it in the late
their mov dword.
Now look what came up "waste" of code at the bottom and the middle of the mov dword after this change, select them (have
sure you are rubbish) click the right button to go on BINARY> Fill NOPs.
Will form a 3 or 4 nops in the code of your map then go in the first nop and jmp short for an offset that ends the
last and get your map again.
PS> It is not in the last nop but where it starts again at your map.
Now add the value in mov dword +147 C as in the example:
mov dword ptr ds: [7A57D4 +147 C], esi
When you do this it will automatically do the sum and generate the code, do so when finished with six select
everything, save, open the executable you save again and go for the next step.
Now go at the end of your executable where you will find lots of "Db 00" select few (not too little not too much
large) and press Ctrl + E in ASCII type the name of your map example (MyMap).
After having done this will generate some codes, go to it first, copy it and save the offset on your notepad.
Now let's create the directory, do the same with the name only that this is the folder where your map example (mymap \ mymap.aSE), go
formed in the early codes copy the offset and save in notepad as well, select all, save, open the executable
you saved it again and go for the next step.
La table that your map is probably the name like:
push 005BE8BC; ASCII "fore-1"
push 005BE8A8; ASCII "forest \ fore-1.The"
In the first push in my case is "push 005BE8BC" put the offset of the name and the second in my case is "push 005BE8A8"
place the offset of the directory, select all, save, open the executable you save again and go for the next step.
Now to put the coordinates are only dealing with some push, you need to know to place them correctly on your map
Many have problems with this part, but try to explain the easy way. (I have not had time to make myself part of the tutorial
so I took that part of the tutorial of Panzer, thank you for it.)
you get to the actual values of the position of char, you have got to change the position of z by y: Example
38 281 X = Y = 254 Z =- 17 121
The correct is:
X = Y =- 28 281 17 121 Z = 254
You just change the values of Y to Z.
Now I already picked the place where they will get my map, we create it, position that I chose for him was
(Already showing with the letters in the correct coordinates) X = Y =- 26 851 -45 988 Z = 254
Stirring the Executables ();
1 - Open your server.exe with Olly and search by map
After I open the server.exe in olly and have come to the offset of the map
The assembly code in my map is the following.
Code:
08C9F3B5 68 2083C808 PUSH Crystal_.08C88320; ASCII "Panzer"
08C9F3BA 68 2783C808 PUSH Crystal_.08C88327; ASCII "Panzer-City \ Panzer.ase"
08C9F3BF E8 CCFD78F7 CALL Crystal_.0042F190
08C9F3C4 68 DE260100 PUSH 126DE <------- pivot position Y on the map
08C9F3C9 68 A50B0000 PUSH 0BA5 <------- pivot position of the map X
08C9F3CE B9 10,617,800 MOV ECX, Crystal_.00786110
08C9F3D3 56 PUSH ESI
08C9F3D4 6A 06 PUSH 6
08C9F3D6 6A 11 PUSH 11
08C9F3D8 6A 13 PUSH 13
08C9F3DA 6A 12 PUSH 12
68 00010000 PUSH 100 08C9F3DC
08C9F3E1 51 PUSH ECX
08C9F3E2 E8 5A64ECFF CALL Crystal_.08B65841
08C9F3E7 E8 24FE78F7 CALL Crystal_.0042F210
08C9F3EC 68 12 193 93,210,100 PUSH <------- pivot position Y on the map
08C9F3F1 68 EF080000 PUSH 8EF <------- pivot position of the map X
08C9F3F6 E8 950479F7 CALL Crystal_.0042F890
08C9F3FB 68 EC260100 PUSH 126EC <------- pivot position Y on the map
08C9F400 68 DB0D0000 PUSH 0DDB <------- pivot position of the map X
08C9F405 E8 860479F7 CALL Crystal_.0042F890
08C9F40A 6A 20 PUSH 20
08C9F40C 6A 40 PUSH 40
08C9F40E 68 E9020000 PUSH 2E9
08C9F413 68 B3310100 PUSH 131B3 <------- pivot position Y on the map
08C9F418 68 C5080000 PUSH 8C5 <------- pivot position of the map X
08C9F41D E8 0EFF78F7 CALL Crystal_.0042F330
08C9F422 68 F2020000 PUSH 2F2
08C9F427 68 D9300100 PUSH 130D9 <------- pivot position Y on the map
08C9F42C 68 CC080000 PUSH 8CC <------- pivot position of the map X
08C9F431 68 10617800 PUSH Crystal_.00786110
08C9F436 E8 B5FF78F7 CALL Crystal_.0042F3F0
08C9F43B E8 3364ECFF CALL Crystal_.08B65873
I'll put my map in the folder called 'Panzer-City', and the name of arquivo.ase is 'Panzer.ase', q q I'll change the example above, the map coordinates and the place q is born ....
So let it.
My code was as follows: ->
Code:
08C9F3B5 68 2083C808 PUSH cPT__.08C88320; ASCII "Panzer"
08C9F3BA 68 2783C808 PUSH cPT__.08C88327; ASCII "Panzer-City \ Panzer.ase"
08C9F3BF E8 CCFD78F7 CALL cPT__.0042F190
08C9F3C4 68 1D97FFFF PUSH FFFF971D <-was so because the value is negative and I put a sign '-' in front of
08C9F3C9 68 5C4CFFFF FFFF4C5C PUSH <- number in Hex.
08C9F3CE B9 10617800 MOV ECX, cPT__.00786110
08C9F3D3 56 PUSH ESI
08C9F3D4 6A 06 PUSH 6
08C9F3D6 6A 11 PUSH 11
08C9F3D8 6A 13 PUSH 13
08C9F3DA 6A 12 PUSH 12
68 00010000 PUSH 100 08C9F3DC
08C9F3E1 51 PUSH ECX
08C9F3E2 E8 5A64ECFF CALL cPT__.08B65841
08C9F3E7 E8 24FE78F7 CALL cPT__.0042F210
08C9F3EC 68 1D97FFFF PUSH FFFF971D
08C9F3F1 68 5C4CFFFF PUSH FFFF4C5C
08C9F3F6 E8 950479F7 CALL cPT__.0042F890
68 08C9F3FB 1D97FFFF PUSH FFFF971D
08C9F400 68 5C4CFFFF PUSH FFFF4C5C
08C9F405 E8 860479F7 CALL cPT__.0042F890
08C9F40A 6A 20 PUSH 20
08C9F40C 6A 40 PUSH 40
08C9F40E 68 E9020000 PUSH 2E9
08C9F413 68 1D97FFFF PUSH FFFF971D
08C9F418 68 5C4CFFFF PUSH FFFF4C5C
08C9F41D E8 0EFF78F7 CALL cPT__.0042F330
08C9F422 68 F2020000 PUSH 2F2
08C9F427 68 1D97FFFF PUSH FFFF971D
08C9F42C 68 5C4CFFFF PUSH FFFF4C5C
08C9F431 68 10617800 PUSH cPT__.00786110
08C9F436 E8 B5FF78F7 CALL cPT__.0042F3F0
08C9F43B E8 3364ECFF CALL cPT__.08B65873
I hope you understand.
Now go in the codes of Dun-8 as explained before, will be similar as in the example:
push 005BC578; ASCII "dun-8"
mov dword ptr ds: [ecx +7 A31B8], 64
push 005BC564; ASCII "endless \ dun-8.rays"
mov ecx, 007A43B4
call 00430B40
push FFFF6BF7
push 1487
mov ecx, 007A43B4
mov dword ptr ds: [7A4478], 500
mov dword ptr ds: [7A447C], ebx
mov dword ptr ds: [7A4480], ebx
mov dword ptr ds: [7A4484], ebx
mov dword ptr ds: [7A4488], ebp
mov dword ptr ds: [7A57D4], esi
call 00430BC0
push 20
push 40
push 45
push FFFF6CB4
push 1485
call 00430CE0
push 0DC
push FFFF5F11
37A2 push
push 007A2F38
call 00430DA0
mov edx, dword ptr ds: [7A4558]
mov cl, byte ptr ds: [8C76F4]
In "mov edx, dword ptr ds: [7A4558] mov copy this and paste into a notepad, after saving it again in olly click
him and a jmp to offset your new table where this your map.
Will form more waste of code, a nop them. select all, save, open the executable you save again and go to the
next step.
As mentioned in the code above, below the "mov edx, dword ptr ds: [7A4558] to replace by a jmp, there is a" mov cl, byte
ptr ds: [8C76F4] copy the offset and store it in a notebook (it will be the place where we return our jmp.
Step into your map added, and at the end add "mov edx, dword ptr ds: [7A4558]" you have had replaced with a jmp and soon
Under a jmp to offset the "mov cl, byte ptr ds: [8C76F4]."
Save and close.
Now the map was added 100% on your game, remember to add the server is practically the same, just some things change.
Differences.
1.The movs value added in the game was "147C", plus the server is now "EA8".
2.For add this value mov in you'll have to add the calculator, because it does not automatically sum in olly.
(Do like we did with "mov ecx").
3.In the game, you had which replaced a code to give the jmp and then had to put it on your table before giving jmp,
in server.exe you have a space where you can add your nops jmp without having to add anything later.
Some pictures
Thank you for the quiet to read, summarize as much as possible, thanks to Matheus my great and good friend, soon I will provide
tutorials more important to you,becouse is important to share,this forum is for this,I started a short time, and slowly try to show all I got you, I apologize if not
understand the tutorial, as you know I'm from Spain and I have trouble expressing myself in English, I hope everyone can follow
the steps and have a great day.
Open Hex Workshop, click New on files and so the portion you type appears click the right mouse button and choose insert, open a message which asks how many bytes and add below which byte to put simple, I put 9000 bytes and the value 00, it will create 9000 spaces and 00 in each, so it did save it with the name you want, just be careful with a dot in front for example. newsec
After doing this, you will open the LordPE, select your. Executable, and then click Sections in the new window opens click the right mouse button on the final table, had opened a menu section and choose load from disk and box dialog select the table created by Hex Workshop, so insert the new table click on the x just above this window and the save command, click OK and exit LordPE
Now open your game with PeExplorer in Section Headers and go, there you will find the session you just added, after it finds
see Virtual Address tab, and note the offset that there will be the offset that this is your session in Olly.
Open game.exe in olly and find the offset of any map that already has the. Exe
I for one found Ice2
00434B68 68 PUSH 80C65B00 game.005BC680; ASCII "ice2"
00434B6D 68 70C65B00 PUSH Game.005BC670; ASCII "Ice \ ice_2.ASE"
B9 CCC87900 00434B72 MOV ECX, Game.0079C8CC
00434B77 E8 04C0FFFF CALL Game.00430B80
00434B7C 68 PUSH F69C0000 9CF6
00434B81 68 PUSH A88D0000 8DA8
B9 CCC87900 00434B86 MOV ECX, Game.0079C8CC
00434B8B C705 90C97900 00> MOV DWORD PTR DS: [79C990], 900
C705 00434B95 94C97900 23> MOV DWORD PTR DS: [79C994], 23
00434B9F C705 98C97900 24> MOV DWORD PTR DS: [79C998], 24
00434BA9 C705 9CC97900 25> MOV DWORD PTR DS: [79C99C], 25
00434BB3 ECDC7900 8935 MOV DWORD PTR DS: [79DCEC], ESI
00434BB9 C705 A0C97900 0B> MOV DWORD PTR DS: [79C9A0] 0B
00434BC3 E8 38C0FFFF CALL Game.00430C00
00434BC8 6A 20 PUSH 20
00434BCA 6A 40 PUSH 40
00434BCC 68 C0040000 PUSH 4C0
00434BD1 68 66C60000 PUSH 0C666
00434BD6 945D 68 PUSH 5D940000
00434BDB E8 40C1FFFF CALL Game.00430D20
00434BE0 68 E8050000 PUSH 5E8
00434BE5 68 PUSH 74C30000 0C374
00434BEA 68 E8800000 PUSH 80E8
00434BEF 68 48DD7900 PUSH Game.0079DD48
00434BF4 E8 E7C1FFFF CALL Game.00430DE0
Select it over as shown in the above code and Ctrl + C and Ctrl + V to paste a block of note.Latter it back to
olly with the map still selected and click the right button and go on BINARY> Binary copy.
Now go to the new section of its game, it will be found for the offset that you wrote down when opened. Exe with PEExplorer
Select a good amount of bytes and click the right button and go into binary> Binary paste and ready, their codes have been added
successfully save.Nao not forget to forget to get some calls, like you copied the codes from an existing map, you need
Calls to change some of your map to not bugar (not to be the same)
Pay attention to Movs your map, they are responsible for the number of Field and also the music and effects, you see that in all
the maps they are different, since they follow a numerical pattern, now let's fix some "Mov ECX"
In my map there are 3 pieces of code called "mov ecx value" appears and he is responsible for the number of field sample
/ Field 42.
To fix it find the last map that was added to his. Exes, find codes that map in my
last map "Dun-1" which is Endless Tower 2nd Floor has the final "mov ecx" which is the / field 41, a ctrl + c ctrl + v this mov
paste in a notepad and copy the value
it will look like this "mov ecx, 7A43B4" open the scientific calculator windows click "hex" paste the value in
My case is 7A43B4 and make the sum of + 147C.
The value of your map will be generated, in my case I get like "mov ecx, 7A5830" then copy the code along with the mov ecx, VALUE (it
course), go to the table of your map to find the 3 and go replacing mov ecx.
Now note that on every map there is normal 6 mov dword like this:
mov dword ptr ds: [7A4478], 500
mov dword ptr ds: [7A447C], ebx
mov dword ptr ds: [7A4480], ebx
mov dword ptr ds: [7A4484], ebx
mov dword ptr ds: [7A4488], ebp
mov dword ptr ds: [7A57D4], esi
They determine the effects and music in your map to correct they is practically the same thing then mov ecx lets go.
Look for Dun-8 again, it will be the sixth mov dword.
Select 6 click the right button Binary> binary copy and then go up from the table that you created in your new map,
select the 6 de la click the right button and go on BINARY> binary paste.
Now we choose the music in your map.
Note that in the end mov dword have something like this:
500
ebx
ebx
ebx
ebp
esi
This determines the music in your map and change it just put another map, for example I want to have music
City then I see it I search by name "Ricarten" I copy it the ebp, ebx, edi, edi, ebp, esi (example) and paste it in the late
their mov dword.
Now look what came up "waste" of code at the bottom and the middle of the mov dword after this change, select them (have
sure you are rubbish) click the right button to go on BINARY> Fill NOPs.
Will form a 3 or 4 nops in the code of your map then go in the first nop and jmp short for an offset that ends the
last and get your map again.
PS> It is not in the last nop but where it starts again at your map.
Now add the value in mov dword +147 C as in the example:
mov dword ptr ds: [7A57D4 +147 C], esi
When you do this it will automatically do the sum and generate the code, do so when finished with six select
everything, save, open the executable you save again and go for the next step.
Now go at the end of your executable where you will find lots of "Db 00" select few (not too little not too much
large) and press Ctrl + E in ASCII type the name of your map example (MyMap).
After having done this will generate some codes, go to it first, copy it and save the offset on your notepad.
Now let's create the directory, do the same with the name only that this is the folder where your map example (mymap \ mymap.aSE), go
formed in the early codes copy the offset and save in notepad as well, select all, save, open the executable
you saved it again and go for the next step.
La table that your map is probably the name like:
push 005BE8BC; ASCII "fore-1"
push 005BE8A8; ASCII "forest \ fore-1.The"
In the first push in my case is "push 005BE8BC" put the offset of the name and the second in my case is "push 005BE8A8"
place the offset of the directory, select all, save, open the executable you save again and go for the next step.
Now to put the coordinates are only dealing with some push, you need to know to place them correctly on your map
Many have problems with this part, but try to explain the easy way. (I have not had time to make myself part of the tutorial
so I took that part of the tutorial of Panzer, thank you for it.)
you get to the actual values of the position of char, you have got to change the position of z by y: Example
38 281 X = Y = 254 Z =- 17 121
The correct is:
X = Y =- 28 281 17 121 Z = 254
You just change the values of Y to Z.
Now I already picked the place where they will get my map, we create it, position that I chose for him was
(Already showing with the letters in the correct coordinates) X = Y =- 26 851 -45 988 Z = 254
Stirring the Executables ();
1 - Open your server.exe with Olly and search by map
After I open the server.exe in olly and have come to the offset of the map
The assembly code in my map is the following.
Code:
08C9F3B5 68 2083C808 PUSH Crystal_.08C88320; ASCII "Panzer"
08C9F3BA 68 2783C808 PUSH Crystal_.08C88327; ASCII "Panzer-City \ Panzer.ase"
08C9F3BF E8 CCFD78F7 CALL Crystal_.0042F190
08C9F3C4 68 DE260100 PUSH 126DE <------- pivot position Y on the map
08C9F3C9 68 A50B0000 PUSH 0BA5 <------- pivot position of the map X
08C9F3CE B9 10,617,800 MOV ECX, Crystal_.00786110
08C9F3D3 56 PUSH ESI
08C9F3D4 6A 06 PUSH 6
08C9F3D6 6A 11 PUSH 11
08C9F3D8 6A 13 PUSH 13
08C9F3DA 6A 12 PUSH 12
68 00010000 PUSH 100 08C9F3DC
08C9F3E1 51 PUSH ECX
08C9F3E2 E8 5A64ECFF CALL Crystal_.08B65841
08C9F3E7 E8 24FE78F7 CALL Crystal_.0042F210
08C9F3EC 68 12 193 93,210,100 PUSH <------- pivot position Y on the map
08C9F3F1 68 EF080000 PUSH 8EF <------- pivot position of the map X
08C9F3F6 E8 950479F7 CALL Crystal_.0042F890
08C9F3FB 68 EC260100 PUSH 126EC <------- pivot position Y on the map
08C9F400 68 DB0D0000 PUSH 0DDB <------- pivot position of the map X
08C9F405 E8 860479F7 CALL Crystal_.0042F890
08C9F40A 6A 20 PUSH 20
08C9F40C 6A 40 PUSH 40
08C9F40E 68 E9020000 PUSH 2E9
08C9F413 68 B3310100 PUSH 131B3 <------- pivot position Y on the map
08C9F418 68 C5080000 PUSH 8C5 <------- pivot position of the map X
08C9F41D E8 0EFF78F7 CALL Crystal_.0042F330
08C9F422 68 F2020000 PUSH 2F2
08C9F427 68 D9300100 PUSH 130D9 <------- pivot position Y on the map
08C9F42C 68 CC080000 PUSH 8CC <------- pivot position of the map X
08C9F431 68 10617800 PUSH Crystal_.00786110
08C9F436 E8 B5FF78F7 CALL Crystal_.0042F3F0
08C9F43B E8 3364ECFF CALL Crystal_.08B65873
I'll put my map in the folder called 'Panzer-City', and the name of arquivo.ase is 'Panzer.ase', q q I'll change the example above, the map coordinates and the place q is born ....
So let it.
My code was as follows: ->
Code:
08C9F3B5 68 2083C808 PUSH cPT__.08C88320; ASCII "Panzer"
08C9F3BA 68 2783C808 PUSH cPT__.08C88327; ASCII "Panzer-City \ Panzer.ase"
08C9F3BF E8 CCFD78F7 CALL cPT__.0042F190
08C9F3C4 68 1D97FFFF PUSH FFFF971D <-was so because the value is negative and I put a sign '-' in front of
08C9F3C9 68 5C4CFFFF FFFF4C5C PUSH <- number in Hex.
08C9F3CE B9 10617800 MOV ECX, cPT__.00786110
08C9F3D3 56 PUSH ESI
08C9F3D4 6A 06 PUSH 6
08C9F3D6 6A 11 PUSH 11
08C9F3D8 6A 13 PUSH 13
08C9F3DA 6A 12 PUSH 12
68 00010000 PUSH 100 08C9F3DC
08C9F3E1 51 PUSH ECX
08C9F3E2 E8 5A64ECFF CALL cPT__.08B65841
08C9F3E7 E8 24FE78F7 CALL cPT__.0042F210
08C9F3EC 68 1D97FFFF PUSH FFFF971D
08C9F3F1 68 5C4CFFFF PUSH FFFF4C5C
08C9F3F6 E8 950479F7 CALL cPT__.0042F890
68 08C9F3FB 1D97FFFF PUSH FFFF971D
08C9F400 68 5C4CFFFF PUSH FFFF4C5C
08C9F405 E8 860479F7 CALL cPT__.0042F890
08C9F40A 6A 20 PUSH 20
08C9F40C 6A 40 PUSH 40
08C9F40E 68 E9020000 PUSH 2E9
08C9F413 68 1D97FFFF PUSH FFFF971D
08C9F418 68 5C4CFFFF PUSH FFFF4C5C
08C9F41D E8 0EFF78F7 CALL cPT__.0042F330
08C9F422 68 F2020000 PUSH 2F2
08C9F427 68 1D97FFFF PUSH FFFF971D
08C9F42C 68 5C4CFFFF PUSH FFFF4C5C
08C9F431 68 10617800 PUSH cPT__.00786110
08C9F436 E8 B5FF78F7 CALL cPT__.0042F3F0
08C9F43B E8 3364ECFF CALL cPT__.08B65873
I hope you understand.
Now go in the codes of Dun-8 as explained before, will be similar as in the example:
push 005BC578; ASCII "dun-8"
mov dword ptr ds: [ecx +7 A31B8], 64
push 005BC564; ASCII "endless \ dun-8.rays"
mov ecx, 007A43B4
call 00430B40
push FFFF6BF7
push 1487
mov ecx, 007A43B4
mov dword ptr ds: [7A4478], 500
mov dword ptr ds: [7A447C], ebx
mov dword ptr ds: [7A4480], ebx
mov dword ptr ds: [7A4484], ebx
mov dword ptr ds: [7A4488], ebp
mov dword ptr ds: [7A57D4], esi
call 00430BC0
push 20
push 40
push 45
push FFFF6CB4
push 1485
call 00430CE0
push 0DC
push FFFF5F11
37A2 push
push 007A2F38
call 00430DA0
mov edx, dword ptr ds: [7A4558]
mov cl, byte ptr ds: [8C76F4]
In "mov edx, dword ptr ds: [7A4558] mov copy this and paste into a notepad, after saving it again in olly click
him and a jmp to offset your new table where this your map.
Will form more waste of code, a nop them. select all, save, open the executable you save again and go to the
next step.
As mentioned in the code above, below the "mov edx, dword ptr ds: [7A4558] to replace by a jmp, there is a" mov cl, byte
ptr ds: [8C76F4] copy the offset and store it in a notebook (it will be the place where we return our jmp.
Step into your map added, and at the end add "mov edx, dword ptr ds: [7A4558]" you have had replaced with a jmp and soon
Under a jmp to offset the "mov cl, byte ptr ds: [8C76F4]."
Save and close.
Now the map was added 100% on your game, remember to add the server is practically the same, just some things change.
Differences.
1.The movs value added in the game was "147C", plus the server is now "EA8".
2.For add this value mov in you'll have to add the calculator, because it does not automatically sum in olly.
(Do like we did with "mov ecx").
3.In the game, you had which replaced a code to give the jmp and then had to put it on your table before giving jmp,
in server.exe you have a space where you can add your nops jmp without having to add anything later.
Some pictures
Thank you for the quiet to read, summarize as much as possible, thanks to Matheus my great and good friend, soon I will provide
tutorials more important to you,becouse is important to share,this forum is for this,I started a short time, and slowly try to show all I got you, I apologize if not
understand the tutorial, as you know I'm from Spain and I have trouble expressing myself in English, I hope everyone can follow
the steps and have a great day.
Last edited:
