Guide: Debug console

plixbugmenot · 12/27/2008, 14:59

you used

Code:

MOV DWORD PTR ES:[939F70],1

but 939F70 was the memory addres for pw international 1.3.9, could have been changed since last release (release at the moment of writing this is v 1.4.0 build 2265)

so you will have to find out the addres to write the 1 to yourself.

this is the function call:

Code:

0043B7AF   |.  68 709F9300       PUSH ecDMCMul.00939F70
0043B7B4   |.  68 FC168E00       PUSH ecDMCMul.008E16FC                                     ;  UNICODE "console:%d"
0043B7B9   |.  50                PUSH EAX
0043B7BA   |.  FFD3              CALL EBX

see that PUSH ecDMCMul.00939F70 ?

and call ebx calls swscanf, and swscanf returns the value (it gets that value from console:1, since the other parameter is console:%d it writes 1) in 00939F70.

Now for your version lets take a look

it is PUSH CFclient.903E80

so to patch your client into having console, you will have to do it like this:

Code:

MOV DWORD PTR ES:[903E80],1
JMP SHORT CFclient.0043B81F

ColdFire_ · 12/27/2008, 17:07

Thanks

You're really a kind friendly helpful person ^.^

plixbugmenot · 12/27/2008, 22:49

You are welcome

stt_blaine · 04/05/2009, 09:37

yeah works fne but i know u can spawn some mobs with special items.but how???
any1 an idea??

plixbugmenot · 04/07/2009, 19:23

no, it is only good for showing mob id's (which is only usefull for bot developers) and some other minor stuff. You can't do anything with it that will benefit you.

dedesayang · 04/07/2009, 23:58

wew.. please.. tutor in indonesia

fusioncal · 04/08/2009, 08:51

Unless "d_godmode ON" or "d_unlimited_ammo 1" command works, most of the commands aren't useful for normal uses.

aloa · 04/08/2009, 11:47

work this also for the MY-EN Version?

aloa · 04/08/2009, 17:03

3 you will see this code:

Code:

0043BB70      PUSH perfectw.008F3794  ;  UNICODE "console:"
0043BB75      PUSH ESI
0043BB76      CALL EDI
0043BB78      ADD ESP,8

4 Replace that code with this

Code:

0043BB70      XOR EAX,EAX			;sets EAX to 0
0043BB72      INC EAX				;sets EAX to 1
0043BB73      MOV DWORD PTR ES:[94D450],EAX 	;puts EAX into 94D450
0043BB79      JMP SHORT perfectw.[COLOR="Red"]0043BB8F[/COLOR] 	;jumps to the end of the function

For me, the numbers are slightly different. How do I take the point which I've marked in red?

plixbugmenot · 04/11/2009, 16:57

the number in red is from where the function begins to end.

in this case it's from here:

Code:

0043B7A0    >  26:C705 709F9300 >MOV DWORD PTR ES:[939F70],1
0043B7AB    .  EB 12             JMP SHORT ecDMCMul.[COLOR="Red"]0043B7BF[/COLOR]
0043B7AD    .  74 10             JE SHORT ecDMCMul.0043B7BF
0043B7AF    .  68 709F9300       PUSH ecDMCMul.00939F70
0043B7B4    .  68 FC168E00       PUSH ecDMCMul.008E16FC                                     ;  UNICODE "console:%d"
0043B7B9    .  50                PUSH EAX
0043B7BA    .  FFD3              CALL EBX
0043B7BC    .  83C4 0C           ADD ESP,0C
[COLOR="Red"]0043B7BF[/COLOR]    >  5F                POP EDI                                                    ;  kernel32.7C817067
0043B7C0    .  5E                POP ESI                                                    ;  kernel32.7C817067
0043B7C1    .  5B                POP EBX                                                    ;  kernel32.7C817067
0043B7C2    .  C3                RETN

the address here is different too, but the idea behind it is the same

billythebad · 11/07/2010, 14:31

hello dono if people still watching and replying to this but.. i keep getting wrong parameter number...

hottrodd · 01/13/2011, 04:22

All the seemingly useful ones do nothing, even the ones that don't get wrong parameter number.(NOT INCLUDING GM)