Reverse engineering

12/21/2016, 07:43	#76
AnonymousEVPV elite*gold: 0 The Black Market: 0/0/0 Join Date: Nov 2012 Posts: 49 Received Thanks: 1	I support you 100%, (i support Nilzao and berkay too ^^) i have 0 skill but i support you, NFS:W is old and better (or not) game is available but.... you need never give up because maybe, one day... you fix it/we found more help Keep me informed pls

12/30/2016, 18:16	#77
AnonymousEVPV elite*gold: 0 The Black Market: 0/0/0 Join Date: Nov 2012 Posts: 49 Received Thanks: 1	some news ?

12/30/2016, 18:20	#78
leorblx elite*gold: 0 The Black Market: 0/0/0 Join Date: Mar 2016 Posts: 174 Received Thanks: 265	no, working on a different NFS:W thing...

12/30/2016, 18:59	#79
AnonymousEVPV elite*gold: 0 The Black Market: 0/0/0 Join Date: Nov 2012 Posts: 49 Received Thanks: 1	...

01/09/2017, 09:19

#80

hlyab

elite*gold: 0

The Black Market: 0/0/0

Join Date: Jun 2015

Posts: 136

Received Thanks: 52

Quote:

Originally Posted by leorblx

no, working on a different NFS:W thing...

But it wouldn't be simpler to write on new online, using resources of a game or at the same time it won't turn out to adjust communication with the DATA folder?

09/18/2017, 13:00	#81
marek17 elite*gold: 0 The Black Market: 0/0/0 Join Date: Dec 2011 Posts: 170 Received Thanks: 81	I found a solution to my problem. Spoiler Sub_672340 (start 40000) But I do not understand the code, I understand some things. First: HASH 0D280A1F4h - HANDLING ,second: 0A2E2BBBEh - ACCELERATION , Third: 55B54322h - TOPSPEED 19.9.2017 I found the correct function but do not understand assembler code. Spoiler 00672340 sub_672340 proc near ; CODE XREF: sub_672670+71p 00672340 ; sub_678400+44p ... 00672340 00672340 var_14= dword ptr -14h 00672340 var_10= dword ptr -10h 00672340 var_4= dword ptr -4 00672340 arg_0= dword ptr 8 00672340 arg_4= dword ptr 0Ch 00672340 arg_8= dword ptr 10h 00672340 00672340 push ebp 00672341 mov ebp, esp 00672343 mov eax, [ebp+arg_0] 00672346 sub esp, 14h 00672349 push 0 0067234B push eax 0067234C push 4A97EC8Fh 00672351 call sub_6C1D10 00672356 add esp, 8 00672359 push eax 0067235A lea ecx, [ebp+var_14] 0067235D call sub_6C1740 00672362 cmp [ebp+var_10], 0 00672366 jnz short loc_672375 00672368 push 24h 0067236A call sub_7564D0 0067236F add esp, 4 00672372 mov [ebp+var_10], eax 00672375 00672375 loc_672375: ; CODE XREF: sub_672340+26j 00672375 cmp [ebp+var_14], 0 00672379 jnz short loc_672387 0067237B lea ecx, [ebp+var_14] 0067237E call sub_6C4460 00672383 mov esp, ebp 00672385 pop ebp 00672386 retn 00672387 ; --------------------------------------------------------------------------- 00672387 00672387 loc_672387: ; CODE XREF: sub_672340+39j 00672387 mov ecx, [ebp+arg_4] 0067238A push ebx 0067238B push esi 0067238C mov esi, [ebp+arg_8] 0067238F push edi 00672390 push esi 00672391 push ecx 00672392 call sub_672230 00672397 add esp, 8 0067239A push 3 0067239C push 0D280A1F4h 006723A1 lea ecx, [ebp+var_14] 006723A4 call sub_6C4700 006723A9 test eax, eax 006723AB jnz short loc_6723B7 006723AD push 4 006723AF call sub_7564D0 006723B4 add esp, 4 006723B7 006723B7 loc_6723B7: ; CODE XREF: sub_672340+6Bj 006723B7 push 2 006723B9 push 0D280A1F4h 006723BE lea ecx, [ebp+var_14] 006723C1 mov [ebp+var_4], eax 006723C4 call sub_6C4700 006723C9 test eax, eax 006723CB jnz short loc_6723D7 006723CD push 4 006723CF call sub_7564D0 006723D4 add esp, 4 006723D7 006723D7 loc_6723D7: ; CODE XREF: sub_672340+8Bj 006723D7 push 1 006723D9 push 0D280A1F4h 006723DE lea ecx, [ebp+var_14] 006723E1 mov ebx, eax 006723E3 call sub_6C4700 006723E8 test eax, eax 006723EA jnz short loc_6723F6 006723EC push 4 006723EE call sub_7564D0 006723F3 add esp, 4 006723F6 006723F6 loc_6723F6: ; CODE XREF: sub_672340+AAj 006723F6 push 0 006723F8 push 0D280A1F4h 006723FD lea ecx, [ebp+var_14] 00672400 mov edi, eax 00672402 call sub_6C4700 00672407 test eax, eax 00672409 jnz short loc_672415 0067240B push 4 0067240D call sub_7564D0 00672412 add esp, 4 00672415 00672415 loc_672415: ; CODE XREF: sub_672340+C9j 00672415 movss xmm1, dword ptr [esi] 00672419 movss xmm2, dword ptr [esi+4] 0067241E movss xmm3, off_B1F780 00672426 movss xmm0, dword ptr [esi+8] 0067242B movss xmm4, dword ptr [edi] 0067242F mov edx, [ebp+var_4] 00672432 subss xmm3, xmm1 00672436 subss xmm3, xmm2 0067243A subss xmm3, xmm0 0067243E mulss xmm3, dword ptr [eax] 00672442 mulss xmm0, dword ptr [edx] 00672446 mulss xmm4, xmm1 0067244A movss xmm1, dword ptr [ebx] 0067244E addss xmm3, xmm4 00672452 mulss xmm1, xmm2 00672456 addss xmm3, xmm1 0067245A push 3 0067245C addss xmm3, xmm0 00672460 cvttss2si eax, xmm3 00672464 push 0A2E2BBBEh 00672469 lea ecx, [ebp+var_14] 0067246C mov [esi+18h], eax 0067246F call sub_6C4700 00672474 test eax, eax 00672476 jnz short loc_672482 00672478 push 4 0067247A call sub_7564D0 0067247F add esp, 4 00672482 00672482 loc_672482: ; CODE XREF: sub_672340+136j 00672482 push 2 00672484 push 0A2E2BBBEh 00672489 lea ecx, [ebp+var_14] 0067248C mov [ebp+var_4], eax 0067248F call sub_6C4700 00672494 test eax, eax 00672496 jnz short loc_6724A2 00672498 push 4 0067249A call sub_7564D0 0067249F add esp, 4 006724A2 006724A2 loc_6724A2: ; CODE XREF: sub_672340+156j 006724A2 push 1 006724A4 push 0A2E2BBBEh 006724A9 lea ecx, [ebp+var_14] 006724AC mov ebx, eax 006724AE call sub_6C4700 006724B3 test eax, eax 006724B5 jnz short loc_6724C1 006724B7 push 4 006724B9 call sub_7564D0 006724BE add esp, 4 006724C1 006724C1 loc_6724C1: ; CODE XREF: sub_672340+175j 006724C1 push 0 006724C3 push 0A2E2BBBEh 006724C8 lea ecx, [ebp+var_14] 006724CB mov edi, eax 006724CD call sub_6C4700 006724D2 test eax, eax 006724D4 jnz short loc_6724E0 006724D6 push 4 006724D8 call sub_7564D0 006724DD add esp, 4 006724E0 006724E0 loc_6724E0: ; CODE XREF: sub_672340+194j 006724E0 movss xmm0, dword ptr [esi] 006724E4 movss xmm1, dword ptr [esi+4] 006724E9 movss xmm3, off_B1F780 006724F1 movss xmm2, dword ptr [esi+8] 006724F6 movss xmm4, dword ptr [ebx] 006724FA mov ecx, [ebp+var_4] 006724FD subss xmm3, xmm0 00672501 mulss xmm0, dword ptr [edi] 00672505 subss xmm3, xmm1 00672509 subss xmm3, xmm2 0067250D mulss xmm3, dword ptr [eax] 00672511 mulss xmm4, xmm1 00672515 movss xmm1, dword ptr [ecx] 00672519 addss xmm3, xmm4 0067251D mulss xmm1, xmm2 00672521 addss xmm3, xmm1 00672525 push 3 00672527 addss xmm3, xmm0 0067252B cvttss2si edx, xmm3 0067252F push 55B54322h 00672534 lea ecx, [ebp+var_14] 00672537 mov [esi+1Ch], edx 0067253A call sub_6C4700 0067253F test eax, eax 00672541 jnz short loc_67254D 00672543 push 4 00672545 call sub_7564D0 0067254A add esp, 4 0067254D 0067254D loc_67254D: ; CODE XREF: sub_672340+201j 0067254D push 2 0067254F push 55B54322h 00672554 lea ecx, [ebp+var_14] 00672557 mov [ebp+var_4], eax 0067255A call sub_6C4700 0067255F test eax, eax 00672561 jnz short loc_67256D 00672563 push 4 00672565 call sub_7564D0 0067256A add esp, 4 0067256D 0067256D loc_67256D: ; CODE XREF: sub_672340+221j 0067256D push 1 0067256F push 55B54322h 00672574 lea ecx, [ebp+var_14] 00672577 mov ebx, eax 00672579 call sub_6C4700 0067257E test eax, eax 00672580 jnz short loc_67258C 00672582 push 4 00672584 call sub_7564D0 00672589 add esp, 4 0067258C 0067258C loc_67258C: ; CODE XREF: sub_672340+240j 0067258C push 0 0067258E push 55B54322h 00672593 lea ecx, [ebp+var_14] 00672596 mov edi, eax 00672598 call sub_6C4700 0067259D test eax, eax 0067259F jnz short loc_6725AB 006725A1 push 4 006725A3 call sub_7564D0 006725A8 add esp, 4 006725AB 006725AB loc_6725AB: ; CODE XREF: sub_672340+25Fj 006725AB movss xmm1, dword ptr [esi] 006725AF movss xmm4, dword ptr [edi] 006725B3 movss xmm2, dword ptr [esi+4] 006725B8 movss xmm0, off_B1F780 006725C0 movss xmm3, dword ptr [esi+8] 006725C5 mov edi, [esi+1Ch] 006725C8 subss xmm0, xmm1 006725CC subss xmm0, xmm2 006725D0 subss xmm0, xmm3 006725D4 mulss xmm0, dword ptr [eax] 006725D8 mov eax, [ebp+var_4] 006725DB mulss xmm4, xmm1 006725DF movss xmm1, dword ptr [eax] 006725E3 addss xmm0, xmm4 006725E7 mulss xmm1, xmm3 006725EB addss xmm0, xmm1 006725EF movss xmm1, dword ptr [ebx] 006725F3 mov ebx, [esi+18h] 006725F6 mulss xmm1, xmm2 006725FA addss xmm0, xmm1 006725FE cvttss2si eax, xmm0 00672602 mov [esi+20h], eax 00672605 lea ecx, [ebx+edi] 00672608 add ecx, eax 0067260A mov eax, 55555556h 0067260F imul ecx 00672611 mov ecx, edx 00672613 shr ecx, 1Fh 00672616 add ecx, edx 00672618 mov [esi+24h], ecx 0067261B cvtsi2ss xmm1, dword_C85290 00672623 cvtsi2ss xmm0, ebx 00672627 divss xmm0, xmm1 0067262B movss dword ptr [esi+0Ch], xmm0 00672630 cvtsi2ss xmm1, dword_C85290 00672638 cvtsi2ss xmm0, edi 0067263C divss xmm0, xmm1 00672640 movss dword ptr [esi+10h], xmm0 00672645 cvtsi2ss xmm1, dword_C85290 0067264D cvtsi2ss xmm0, dword ptr [esi+20h] 00672652 divss xmm0, xmm1 00672656 lea ecx, [ebp+var_14] 00672659 movss dword ptr [esi+14h], xmm0 0067265E call sub_6C4460 00672663 pop edi 00672664 pop esi 00672665 pop ebx 00672666 mov esp, ebp 00672668 pop ebp 00672669 retn 00672669 sub_672340 endp 00672669 00672669 ; --------------------------------------------------------------------------- 0067266A align 10h 00672670 Theoretically, it could be like this. Spoiler 0x55B54322,3 (v5,v30)- T-Top Speed 0x55B54322,2 (v6,v7)- T-Acceleration 0x55B54322,1 (v8,v9)- T-Handling 0x55B54322,0 (v10)- T-STOCK 0xA2E2BBBE,3 (v11,v30)- A,Top speed 0xA2E2BBBE,2 (v12,v13)- A,Acceleration 0xA2E2BBBE,1 (v14,v15)- A,Handling 0xA2E2BBBE,0 (v16)- A,STOCK 0xD280A1F4,3 (v17,v30)- H,Top Speed 0xD280A1F4,2 (v18,v19)- H,Acceleration 0xD280A1F4,1 (v20,v21)- H,Handling 0xD280A1F4,0 (v22) - H,STOCK Possibly: Spoiler Value0 - (value1+Value2+Value3)

Page 6 of 6

« First