[Solved] Old Item Mall / Old Mainpop

[florian0]

Originally Posted by bilalctn

which code ?

The assembly code you see in the debugger.

Originally Posted by bilalctn

Bro Help pls

You've successfully completed the task of repeatedly recognizing and replacing a PUSH EBX and a CALL EAX instructions. What's left is finding the exactly same pattern once more right below the part you already patched. You literally only need to scroll once, if at all. Recognize the pattern and patch it to NOP aswell. Then the background will appear.

[bilalctn]

Originally Posted by florian0

The assembly code you see in the debugger.



You've successfully completed the task of repeatedly recognizing and replacing a PUSH EBX and a CALL EAX instructions. What's left is finding the exactly same pattern once more right below the part you already patched. You literally only need to scroll once, if at all. Recognize the pattern and patch it to NOP aswell. Then the background will appear.

my english is a little bad, i guess that's why i don't understand

Originally Posted by florian0

The assembly code you see in the debugger.



You've successfully completed the task of repeatedly recognizing and replacing a PUSH EBX and a CALL EAX instructions. What's left is finding the exactly same pattern once more right below the part you already patched. You literally only need to scroll once, if at all. Recognize the pattern and patch it to NOP aswell. Then the background will appear.

you king ty i did, working now

Originally Posted by sarkoplata

You can use the new quest window.

PHP Code:

void CGInterface::SwitchQuestWindow()
{
    return reinterpret_cast<void(__thiscall*)(CGInterface*)>(0x007990E0)(this);
} 


how do i use it?

Originally Posted by florian0

The assembly code you see in the debugger.



You've successfully completed the task of repeatedly recognizing and replacing a PUSH EBX and a CALL EAX instructions. What's left is finding the exactly same pattern once more right below the part you already patched. You literally only need to scroll once, if at all. Recognize the pattern and patch it to NOP aswell. Then the background will appear.

sorry for spams posts

I need fix *Quest*

[xTomasky]

anyone have this files with out any problems ?

[DillerUnlimited]

Originally Posted by florian0

This is one call to ShowGWnd. It's a . The function address is stored in EAX and read from the virtual function table at offset 0x5c.


A function call in general consists of PUSH and CALL (and maybe ADD ESP, x). Each PUSH is likely to be that argument of a function call. ShowGWnd has only one argument. You can see that because there is only one PUSH. PUSH EBX will pass a 0 to the function (because EBX was set no 0 waaaaayyyyyyy earilier in that function). So ShowGWnd(false). But we don't know what to modify with ShowGWnd(false). The object to modify is stored in ECX. It's also called the (Ghidra named it 'this' automatically). 'This' comes from the result of [ESI + 0x7dc], which is m_btnInventory.

I know it's m_btnInventory because I have seen 0x7dc before. Right here:



This part retrives a control with the ID 0xC (12). And 12 is our Inventory Button. I got the ID from ifmainpopup.txt

So in order to make the stuff show instead of hide, you could just skip calling ShowGWnd. That means you replace the PUSH and the CALL with a NOP.

Since you now learned something, you can go and test it out. My proposed change does show the buttons, but not the background. But have no fear. The call for hiding the background is a little below the region I proposed. You only need to recognize the virtual call and the parameter. Replace it with NOP, done.

Pro Can You Counect Me Descord SiZR#6730

[sangtieungao]

Originally Posted by sarkoplata

You can use the new quest window.

PHP Code:

void CGInterface::SwitchQuestWindow()
{
    return reinterpret_cast<void(__thiscall*)(CGInterface*)>(0x007990E0)(this);
} 


Originally Posted by florian0

Okay. Lets go.

Load up your favourite disassembler. I'm using x32dbg.



I gave away the addresses to look at. Explaining how I got there is part of another story.

Press Ctrl+G, enter the address you want to go to:



Now we got the location where the ShowGWnd(false) is called. From my post before we know PUSH and CALL are the important parts of a function call.

Select the PUSH instruction. Press Space to open the assembler. It will show the current instruction.



Enter "NOP" to replace it with a No-Operation. Make sure to tick the "Fill with NOP" Box.

Replace the PUSH and the CALL with NOPs. When you are done, it should look like this:



Repeat this step until you replaced all ShowGWnd(false) calls:



After that, press Ctrl+P to open the Patches-Window. Press "Patch File" to export a patched binary. You can not use the file you opened (e.g. sro_client.exe), so choose a different name.




sro_client_ruined.exe sounds like a good choice to me:



Now you are done. You have successfully patched the client. The icons are now visible. What's left is the background image. Use your acquired knowledge to analyze the code right below of what to patched to find another CALL thats using [edx+5C]. Thats the background. Replace it with NOP and the visuals are fine.

thanks you

[Judgelemental]

Thank you.

I'm not a developer and I have no idea what I've done but I have managed to make it work :

Between 006a28ff and 006a295f -> fill them in with NOP

Then between 006a2970 to 006a2989 (I think the last address had some letters at the end of it, too lazy to check) -> fill them in with NOP
Not sure if I should have NOP'd more addresses or less but the result is :