Jump to content

Kotel

Members
  • Posts

    8
  • Joined

  • Last visited

Posts posted by Kotel

  1. Maybe final solution, but not universal (each client has probably different function start). This is for 2018-01-24bRagexeRE

     

    previous post + this

     

    before this :

      return true;
    }
    
    //=================================//
    // Disable for Unsupported Clients //
    //=================================//
    function Enable64kHairstyle_() {
      return (exe.getClientDate() > 20111102);
    }

     

    add this:

     

          code =
          " 55"                 //PUSH ebp
        + " 8B EC"              //mov ebp, esp
        + " 6A FF"              //push 0xffffffff
        + " 68 AB AB AB AB"     //PUSH address
        + " 64 A1 00 00 00 00"  //mov eax,dword ptr [0x0] 
        + " 50"                 //push eax 
        + " 81 EC 90 00 00 00"  //sub esp,0x90
        + " A1 AB AB AB AB"    //mov eax,dword ptr address
        + " 33 C5"              //xor eax, ebp
        + " 89 AB AB"         //mov dword ptr [ebp-0x10],eax
        + " 53"              //push ebx
        + " 56"              //push esi
        + " 57"              //push edi
        + " 50"              //push eax
        ;
        offset = exe.find(code, PTYPE_HEX, true, "\xAB");
        
      
     if(offset !== -1) 
     {
        code =
            " 8B 0E"              //MOV ecx, [esi]
          + " A1 AB AB AB AB"    //MOV reg32_A, DWORD PTR DS:[addr]
          + " 8B 14"             //MOV EDX, DWORD PTR DS:[reg32_B * 4 + reg32_A]
          ;
          offsets = exe.findAll(code, PTYPE_HEX, true, "\xAB", offset, offset+1000);
    
    
        if (offsets.length == 2) { 
    
            for (var i = 0; i < offsets.length; i++) {
              offset2 = offsets[i] + code.hexlength();
              exe.replaceWord(offset2 - 1, 0x9010 + (exe.fetchByte(offset2) & 0x7));
            }
        } 
        else
     	    return "Failed in Step Y - offsets not found";
     }
     else
    	 return "Failed in Step Y - start of the function not found";
  2. Some part is individual for every client.

    more universal code (AB can be everythink):

     

    //Step X - extra for 2017/2018 clients, again Find the string table fetchers and remove reg32_B * 4
      code =
          " 8B AB AB AB AB AB"  //MOV reg32_B, DWORD PTR DS:[EBP - 8C]
        + " A1 AB AB AB AB"    //MOV reg32_A, DWORD PTR DS:[addr]
        + " 8B 14"             //MOV EDX, DWORD PTR DS:[reg32_B * 4 + reg32_A]
        ;
    	//need find probably 2 occurences (male, female)
        offsets = exe.findAll(code, PTYPE_HEX, true, "\xAB", offset-1000, assignOffset);
      
    
      if (offsets.length !== 0) { 
    
          for (var i = 0; i < offsets.length; i++) {
            offset2 = offsets[i] + code.hexlength();
            exe.replaceWord(offset2 - 1, 0x9010 + (exe.fetchByte(offset2) & 0x7));
          }
      } 

     

    this works for 2018-01-24bRagexeRE and maybe 2017

     

    edit: found another problem, this works only without headgear ?

  3. This is fix for 2017 clients, patch Enable 64k Hairstyle

     

    Problem:

    client crashes with some hair style ids (31, 81 and randomly 30, 32 and others)

     

    Solution:

    edit Enable64kHairstyle.qs

     

    after:

      //Step 4b - Remove the reg32_B * 4 from all the matches
      for (var i = 0; i < offsets.length; i++) {
        offset2 = offsets[i] + code.hexlength();
        exe.replaceWord(offset2 - 1, 0x9010 + (exe.fetchByte(offset2) & 0x7));
      }   

     

    add:

      //Step X - extra for 2017 clients, again Find the string table fetchers
      code =
          " 8B AB AB AB AB AB"  //MOV reg32_B, DWORD PTR DS:[EBP - 8C]
        + " A1 AB AB AB 00"    //MOV reg32_A, DWORD PTR DS:[addr]
        + " 8B 14"             //MOV EDX, DWORD PTR DS:[reg32_B * 4 + reg32_A]
        ;
    	//need find probably 2 occurences
        offsets = exe.findAll(code, PTYPE_HEX, true, "\xAB", offset-1000, assignOffset);
      
    
      if (offsets.length !== 0) { 
    
          for (var i = 0; i < offsets.length; i++) {
            offset2 = offsets[i] + code.hexlength();
            exe.replaceWord(offset2 - 1, 0x9010 + (exe.fetchByte(offset2) & 0x7));
          }
      }  

     

     

    Tested on:

    2017-06-14bRagexeRE 
    2017-05-17aRagexeRE

     

    • Upvote 2
×
×
  • Create New...