|
|
BigPig2
Adventuring Hero
|
posted October 26, 2026 09:13 PM |
|
|
|
The short answer is I dont understand these data structures.
|
|
purerogue3
Famous Hero
|
|
posted October 26, 2026 09:25 PM |
|
|
the number of registers is limited - how about just trying them all, then the stack
the first thing i see in CastSpell is
mov eax, [ebp+spellID]
so 50 push eax at 1A874B
|
|
BigPig2
Adventuring Hero
|
|
posted October 26, 2026 09:48 PM |
|
|
My understanding of asm is pretty shallow so Im not going to go into what I imagine this is but I see references to [ebp + 8] when functions nearby fetch the spell ID. I have tried to push that instead (and removing an INC edx further down to make space for it, that INC just adds 1 to the monster level for the purposes of comparison so its easy to track the consequences of removing it) but the game crashes when I try to cast any of the spells routed to the case.
I have tried eax too but I feel the check gets skipped, same if I select a number higher than the highest spell ID.
|
|
purerogue3
Famous Hero
|
|
posted October 26, 2026 10:50 PM |
|
|
|
Can we just add a new case to the jumptable and go to free space?
|
|
BigPig2
Adventuring Hero
|
|
posted October 27, 2026 02:09 PM |
|
|
|
You likely can if you have the free space for it somewhere but thats not necessarily easier. And this switch case is very close to what were trying to achieve, its a bit of a shame not to explore this possibility first.
|
|
|
|
This Popular Thread is pages long: 
