Install IDA PRO. Make sure to have a DESKTOP ICON of it, so you can DRAG - AND - DROP EXE's ontop of it.
Next step, would be to make a subdirectory called OLD EQGAME EXE, and put whatever you have into there, but to make things easier name them like EQGAME20060315.EXE, EQGAME20060419.EXE, etc etc.
Now open this directory and drop EQGAME20060315.EXE (last patch before this one). Basically you want to hit Enter, and not worry about the DLL stuff. Let it load for a good 10 - 15 minutes if it is the DEMO version (Registered version will save the data so don't have to wait as long each time). Repeat this for EQGAME20060419.EXE so you will have 2 versions decompiling at once. Make a note which is which, so you can toggle back and forth.
While you are waiting, goto the EQ directory and open up eqstr_us.txt (there are some that look similar, so be careful -- also never write anything to this file, it has a checksum). This file is basically a good place to start, and contains strings that EQ sends to you like this one :
12693 %1 is too far away, canceling auto-follow.
Guess what that is? That is Farfollow. However, we need to first convert the DECIMAL to HEX. So, using CALC, and making sure you have VIEW set to SCIENTIFIC. Put in 12693 in decimal, then click HEX. You should get 3195. That is what we are going to look up first. Lets look at it in the 3/15 version first. Since we know that :
Code:
[FarFollow]
Description="/follow someone from any distance"
Version="2006.03.15"
address0=4E56A4
normal0="0F 85 82 00 00 00"
crack0="E9 83 00 00 00 90"
Now type in "G" from IDA PRO (the one with 3/15 EXE loaded). You should see a little window pop up asking you where you want it to JUMP to. Type in 4E56A4 (the ADDRESS0 above). You should see this :
Code:
.text:004E56A4 jnz loc_4E572C <---- LONG JUMP
.text:004E56AA mov eax, dword_966194
.text:004E56AF cmp dword_966180, eax
.text:004E56B5 jz short loc_4E56E3 <-----SHORT JUMP
.text:004E56B7 mov ecx, [eax+0DA4h]
.text:004E56BD test ecx, ecx
.text:004E56BF jz short loc_4E56E3 <-----SHORT JUMP
.text:004E56C1 push 0
.text:004E56C3 push 0
.text:004E56C5 push 0
.text:004E56C7 push 0
.text:004E56C9 push 0
.text:004E56CB push 0
.text:004E56CD push 0
.text:004E56CF push 0
.text:004E56D1 call sub_4EE320
.text:004E56D6 push eax
.text:004E56D7 push 3195h <------ Ok this is one, another below also
.text:004E56DC lea eax, [esp+144h+var_100]
.text:004E56E0 push eax
.text:004E56E1 jmp short loc_4E5705
.text:004E56E3
.text:004E56E3 loc_[COLOR="Red"]4E56E3[/COLOR]: ; CODE XREF: sub_4E55F0+C5j
.text:004E56E3 ; sub_4E55F0+CFj
.text:004E56E3 push 0
.text:004E56E5 push 0
.text:004E56E7 push 0
.text:004E56E9 push 0
.text:004E56EB push 0
.text:004E56ED push 0
.text:004E56EF push 0
.text:004E56F1 push 0
.text:004E56F3 mov ecx, esi
.text:004E56F5 call sub_4EE320
.text:004E56FA push eax
.text:004E56FB push 3195h <----BINGO
.text:004E5700 lea ecx, [esp+144h+var_100]
.text:004E5704 push ecx
Code:
00 01 02 03 04 05 06 07-08 09 0A 0B 0C 0D 0E 0F
-----------------------------------------------
E0 F6 C4 41 [COLOR="Red"]0F 85 82 00-00 00[/COLOR] A1 94 61 96 00 39
Ok This looks very complex and it is to the first time viewer. Let me explain a bit about JUMPS, and such.
Usually you see 74, 75, 76, 77 -- These are short jumps, based on conditions like <, >, = etc etc
Also you will see EB <-- very handy --- Jump no matter what conditions
and even better 90 <-- NOP ---- NO OPERATION, Don't do shit
We want to REALLY avoid 4E56E3 like the plague, so nothing JUMPS there, or we screwed up. So we are trying to actually go UP higher, before we get those 2 short jumps to a jump that is above them, that bypasses this push.
0F 85, and 0F 84 are longer jumps, and E9 is a longer version of EB above. So in this case we are going to jump unconditionally from 4E56A4 to 4E572C. Now get those HEX calculators out again, substract 4E56A4 FROM 4E572C, you get HEX 88, but we need to take 5 off here, so we must use 83 HEX. So this becomes crack0="E9 83 00 00 00 90". The 90 at the end actually is there to NOP that spot (we had six before and we shortened to 5). Before we go further we need to "COPY" the "PUSH 3195h" EXACTLY as it is. So highlight it and ALT-C.
Now open the 4/19 version of the EXE and type in "ALT-T", and "PASTE" in the above (ALT-V). Make sure to have "All OCCURANCES" checked, and run it. Let it go for a few minutes, then click cancel. Should see :
Code:
.text:004E5D37 push 3195h
.text:004E5D5B push 3195h
So we want to avoid the 2 short jumps and take the long one EXACTLY like we did before :
Code:
.text:0[COLOR="Red"]04E5D04[/COLOR] jnz loc_4E5D8C <--Offset we need
.text:004E5D0A mov eax, dword_966194
.text:004E5D0F cmp dword_966180, eax
.text:004E5D15 jz short loc_4E5D43 <-- ByPass this by using a jump above here that goes past the pushs below
.text:004E5D17 mov ecx, [eax+0DA4h]
.text:004E5D1D test ecx, ecx
.text:004E5D1F jz short loc_4E5D43 <-- ByPass this by using a jump above here that goes past the pushs below
.text:004E5D21 push 0
.text:004E5D23 push 0
.text:004E5D25 push 0
.text:004E5D27 push 0
.text:004E5D29 push 0
.text:004E5D2B push 0
.text:004E5D2D push 0
.text:004E5D2F push 0
.text:004E5D31 call sub_4EEAA0
.text:004E5D36 push eax
.text:004E5D37 push 3195h <--- want to avoid this
.text:004E5D3C lea eax, [esp+144h+var_100]
.text:004E5D40 push eax
.text:004E5D41 jmp short loc_4E5D65
.text:004E5D43 ; ---------------------------------------------------------------------------
.text:004E5D43
.text:004E5D43 loc_4E5D43: ; CODE XREF: sub_4E5C50+C5j
.text:004E5D43 ; sub_4E5C50+CFj
.text:004E5D43 push 0
.text:004E5D45 push 0
.text:004E5D47 push 0
.text:004E5D49 push 0
.text:004E5D4B push 0
.text:004E5D4D push 0
.text:004E5D4F push 0
.text:004E5D51 push 0
.text:004E5D53 mov ecx, esi
.text:004E5D55 call sub_4EEAA0
.text:004E5D5A push eax
.text:004E5D5B push 3195h <--- want to avoid this
.text:004E5D60 lea ecx, [esp+144h+var_100]
.text:004E5D64 push ecx
Code:
00 01 02 03 04 05 06 07-08 09 0A 0B 0C 0D 0E 0F
-----------------------------------------------
E0 F6 C4 41 [COLOR="Red"]0F 85 82 00-00 00[/COLOR] A1 94 61 96 00 39
Hmm anything look Familiar? This is EXACTLY the same code as before. We found the OFFSET that we can use now for 4/19 -- 4E5D04
so you get :
Code:
[FarFollow]
Description="/follow someone from any distance"
Version="2006.04.19"
address0=4E5D04
normal0="0F 85 82 00 00 00"
crack0="E9 83 00 00 00 90"
Now make a note some place FarFollow found by looking for 3195h, so next time it is easier.
I will do more of these to try and make them easier to follow, etc. This one was not a easy one. Also will try and explain better how jumps work, and when you want to use unconditional jumps vs NOP'ing out code.
(I'd buy a copy)
