Ok, now that I finally got swsro downloaded.
Quote:
Originally Posted by ovidiu
I did exactly like it says ( i think):
|
Your crash is because of what I mentioned in my second post:
Quote:
|
I just wanted to add that I've tested this and it works fine in sunsro private server. However, their client is really old, so things are not as straight forward. For example, you have to find the GetGlobalData function by looking at other clients to identify a location where it is used. Once you do that though and follow the rest of the guide, you can have an English version. You do need to patch the CRC check on the client though, but that's pretty simple.
|
So, the call you are referencing in your code is not the right one. Instead, you have to find the GetGlobalSettings function call another way.
Here's the method I used originally to determine the patch:
1. Search for all referenced text strings and find the language name of the client version you are using. In this case Chinese.
2. On the original language flag code, you will want to set a breakpoint on the language flag code. For this client:
Code:
00643039 . C783 60070000>MOV DWORD PTR DS:[EBX+760],1
3. Now, when you run the client in Olly (bypass the launcher msg) and you hit the BP, you will want to set a Hardware Breakpoint on the memory address that is getting the language flag. This is a pointer to the structure that the GetGlobalSettings function returns. To set the HWBP:
First, click on the address in the preview pane and choose Follow Address in Dump.
Second, select the first byte in the dump, right click and choose: Breakpoint->Hardware, on access->Byte.
4. Now press F9. You should hit the HWBP. If you look at the call, you will notice it's NOT what you want. However, you can see how the language flag is being used to load data from specific pk2 files.
Press F9 again 4 more times until that loading code is complete and the client starts.
5. You end up hitting another PK2 loading code, so hit F9. You can check the call to make sure it's not the right one.
6. Now, you hit another access on the byte, but this time, if you check the call, it looks like the right one. Here is where you should be now:
If you look at the call above and follow it, you will see:
Code:
004968DF CC INT3
004968E0 /$ B8 90C6A900 MOV EAX,SRO_Clie.00A9C690
004968E5 \. C3 RETN
004968E6 CC INT3
That is how we know that is our GetGlobalData function. if we go back to the current code, we can see how the language flag is used:
Code:
0065B411 . E8 CAB4E3FF CALL SRO_Clie.004968E0
0065B416 . 83B8 38010000>CMP DWORD PTR DS:[EAX+138],1
This is just like the guide shows, except it's in a different spot.
Now you know the correct call address is: 0x4968E0 and you need to modify the flag by using:
Code:
MOV DWORD PTR DS:[EAX+0x138],1
instead!
Go to Debug->Hardware Breakpoints in the OllyDbg menu and Delete the hardware breakpoint now.
Now, you can patch the two English/Chinese flags as needed, then add in the new code for the language flag:
Don't forget to add in the CRC patch (I see you did, but to anyone else reading this post) and then save all the patches to the exe.
Now, you should have a correctly patched client
Attached is mine if anyone needs to compare.
![[Guide] How to patch any client into an English client](https://www.elitepvpers.com/forum/iconimages/sro-guides-templates/guide-how-patch-any-client-into-english-client_ltr.gif){kind=small}
