[Revised] Unlocking Framerate

[*M*]

Ok, so I was looking back in to unlocking framerate for someone, and the old JNB-JMP method still works the same but the unfortunate side effect is that 100% of the resources go into that unlocked client, slowing down the rest of the PC.

The proper way to do it is to set the framerate the same as the refresh rate, as most people have a screen that runs at 60Hz, I have attached a 60fps client for Patch 5363.

REINFORCE: THERE IS NO POINT IN GETTING 100+ FPS IF YOU ONLY HAVE A SCREEN THAT RUNS AT 60Hz(most lcd's on the market)

Here is the patch, you can usually find this code segment by searching the .text code section of conquer for ADD ECX,19:

Original

CPU Disasm
Address   Hex dump          Command                                  Comments
005823BD  /.  E8 F3B01800   CALL <JMP.&WINMM.timeGetTime>
005823C2  |.  8B0D D0568D00 MOV ECX,DWORD PTR DS:[8D56D0]
005823C8      8D51 19       LEA EDX,[ECX+19]
005823CB  |.  3BC2          CMP EAX,EDX
005823CD  |.  73 0E         JNB SHORT 005823DD
005823CF  |.  2BC8          SUB ECX,EAX
005823D1      83C1 19       ADD ECX,19
005823D4  |.  51            PUSH ECX
005823D5  |.  FF15 E4907D00 CALL DWORD PTR DS:[<&KERNEL32.Sleep>]
005823DB  |.  EB 19         JMP SHORT 005823F6
005823DD  |>  A3 D0568D00   MOV DWORD PTR DS:[8D56D0],EAX
005823E2  |.  A1 CC568D00   MOV EAX,DWORD PTR DS:[8D56CC]
005823E7  |.  6A 01         PUSH 1                                   ; /Arg1 = 1
005823E9  |.  8D48 40       LEA ECX,[EAX+40]                         ; |
005823EC  |.  E8 ED440000   CALL 005868DE                            ; \Conquer.005868DE
005823F1  |.  E8 E7EDFFFF   CALL 005811DD                            ; [Conquer.005811DD
005823F6  |>  6A 01         PUSH 1
005823F8  |.  58            POP EAX
005823F9  \.  C2 0400       RETN 4

Patched

CPU Disasm
Address   Hex dump          Command                                  Comments
005823BD  /.  E8 F3B01800   CALL <JMP.&WINMM.timeGetTime>
005823C2  |.  8B0D D0568D00 MOV ECX,DWORD PTR DS:[8D56D0]
005823C8  |.  8D51 10       LEA EDX,[ECX+10]
005823CB  |.  3BC2          CMP EAX,EDX
005823CD  |.  73 0E         JNB SHORT 005823DD
005823CF      90            NOP
005823D0      90            NOP
005823D1      90            NOP
005823D2      31C9          XOR ECX,ECX
005823D4  |.  51            PUSH ECX
005823D5  |.  FF15 E4907D00 CALL DWORD PTR DS:[<&KERNEL32.Sleep>]
005823DB  |.  EB 19         JMP SHORT 005823F6
005823DD  |>  A3 D0568D00   MOV DWORD PTR DS:[8D56D0],EAX
005823E2  |.  A1 CC568D00   MOV EAX,DWORD PTR DS:[8D56CC]
005823E7  |.  6A 01         PUSH 1                                   ; /Arg1 = 1
005823E9  |.  8D48 40       LEA ECX,[EAX+40]                         ; |
005823EC  |.  E8 ED440000   CALL 005868DE                            ; \Conquer_[60-FPS].005868DE
005823F1  |.  E8 E7EDFFFF   CALL 005811DD                            ; [Conquer_[60-FPS].005811DD
005823F6  |>  6A 01         PUSH 1
005823F8  |.  58            POP EAX
005823F9  \.  C2 0400       RETN 4

By NOPing out SUB ECX,EAX and ADD ECX,19 and replacing it with XOR ECX,ECX (set ECX to zero), we can exploit the code above to set the frame limit. By changing the 19 in LEA EDX,[ECX+19], you will change how often the conditional jump below runs the code to sleep.

Numbers below 19 = increase in framerate (I used 10 in this example, giving roughly 60 FPS)
Numbers above 19 = decrease in framerate (decreasing framerate has its uses, while TG or botting for example you can set fps to one. On my pc this resulted in 1% usage of GPU, and 4% of CPU)

[*M*]

@Ushiro for russian client

CPU Disasm
Address   Hex dump          Command                                  Comments
004A3696    E8 1D870C00     CALL 0056BDB8
004A369B    8B0D 300C6500   MOV ECX,DWORD PTR DS:[650C30]
004A36A1    8D51 10         LEA EDX,[ECX+10]
004A36A4    3BC2            CMP EAX,EDX
004A36A6    73 0E           JNB SHORT 004A36B6
004A36A8    90              NOP
004A36A9    90              NOP
004A36AA    90              NOP
004A36AB    31C9            XOR ECX,ECX
004A36AD    51              PUSH ECX
004A36AE    FF15 98A05D00   CALL DWORD PTR DS:[<&KERNEL32.Sleep>]
004A36B4    EB 19           JMP SHORT 004A36CF
004A36B6    A3 300C6500     MOV DWORD PTR DS:[650C30],EAX
004A36BB    A1 2C0C6500     MOV EAX,DWORD PTR DS:[650C2C]
004A36C0    6A 01           PUSH 1
004A36C2    8D48 40         LEA ECX,[EAX+40]
004A36C5    E8 24280000     CALL 004A5EEE
004A36CA    E8 D0F6FFFF     CALL 004A2D9F
004A36CF    6A 01           PUSH 1
004A36D1    58              POP EAX
004A36D2    C2 0400         RETN 4

[ushiro]

Thanks man but i couldnot find commands you listed in my conquer.exe

[*M*]

Then go to the address



That will get you to the code section, then you can do a search for add ecx,19. If not you should just be able to go CTRL+G to 004A3696.

But I used ollydbg 2.0 and just did a straight search for add ecx,19, its pretty straight forward, if you can't figure that out then you won't be able to do it for future patches as I can't keep updating when I don't play it anymore.

[Huseby]

Nice work M.

[ushiro]

Thanks brother, thank you so much, it worked.

[IAmHawtness]

Nice to see you back!