Jul 9, 2009 at 3:11 AM
Join Date: Jun 22, 2008
Location:
Posts: 251
In this thread, I will try to provide documentation of some of the easy weapon hacks you can do, simply by looking up values and changing them in your disassembler. (If you don't know how to use a disassembler, read my Un-Advanced Hacking FAQ!) I'm going to basically put comments in OllyDbg, and then copy/paste the code in here. That way you can look up the same offset very easily (the offset is in the left most column).
The polar star!
Polar star is a very simple weapon, you shoot it, it travels straight at a constant speed. You can only easily change what that speed is. I've labeled the speed offsets, and the frame rects, so you can finally change the size of the bullet graphic.
The fireball!
The fireball is more complex. I've commented a lot, it should be enough to get some great new weapons.
The snake! (levels 2 and 3)
The snake can't be changed quite as much as the fireball, but you can still get some neat effects out of it.
The polar star!
Polar star is a very simple weapon, you shoot it, it travels straight at a constant speed. You can only easily change what that speed is. I've labeled the speed offsets, and the frame rects, so you can finally change the size of the bullet graphic.
Code:
00404826 JMP DWORD PTR DS:[EAX*4+404AFA]
0040482D MOV ECX,DWORD PTR SS:[EBP+8]
00404830 MOV DWORD PTR DS:[ECX+18],-1000 ; -1000 = speed of bullet when fired left
00404837 JMP SHORT Doukutsu.0040485B
00404839 MOV EDX,DWORD PTR SS:[EBP+8]
0040483C MOV DWORD PTR DS:[EDX+1C],-1000 ; -1000 = speed of bullet when fired up
00404843 JMP SHORT Doukutsu.0040485B
00404845 MOV EAX,DWORD PTR SS:[EBP+8]
00404848 MOV DWORD PTR DS:[EAX+18],1000 ; 1000 = speed of bullet when fired right
0040484F JMP SHORT Doukutsu.0040485B
00404851 MOV ECX,DWORD PTR SS:[EBP+8]
00404854 MOV DWORD PTR DS:[ECX+1C],1000 ; 1000 = speed of bullet when fired down
0040485B MOV EDX,DWORD PTR SS:[EBP+C]
0040485E MOV DWORD PTR SS:[EBP-68],EDX
00404861 CMP DWORD PTR SS:[EBP-68],1
00404865 JE SHORT Doukutsu.00404872
00404867 CMP DWORD PTR SS:[EBP-68],2
0040486B JE SHORT Doukutsu.004048BC
0040486D JMP Doukutsu.00404904
00404872 MOV EAX,DWORD PTR SS:[EBP+8]
00404875 MOVZX ECX,BYTE PTR DS:[EAX+38]
00404879 MOV DWORD PTR SS:[EBP-6C],ECX
0040487C CMP DWORD PTR SS:[EBP-6C],3
00404880 JA SHORT Doukutsu.004048BA
00404882 MOV EDX,DWORD PTR SS:[EBP-6C]
00404885 JMP DWORD PTR DS:[EDX*4+404B0A]
0040488C MOV EAX,DWORD PTR SS:[EBP+8]
0040488F MOV DWORD PTR DS:[EAX+64],400
00404896 JMP SHORT Doukutsu.004048BA
00404898 MOV ECX,DWORD PTR SS:[EBP+8]
0040489B MOV DWORD PTR DS:[ECX+60],400
004048A2 JMP SHORT Doukutsu.004048BA
004048A4 MOV EDX,DWORD PTR SS:[EBP+8]
004048A7 MOV DWORD PTR DS:[EDX+64],400
004048AE JMP SHORT Doukutsu.004048BA
004048B0 MOV EAX,DWORD PTR SS:[EBP+8]
004048B3 MOV DWORD PTR DS:[EAX+60],400
004048BA JMP SHORT Doukutsu.00404904
004048BC MOV ECX,DWORD PTR SS:[EBP+8]
004048BF MOVZX EDX,BYTE PTR DS:[ECX+38]
004048C3 MOV DWORD PTR SS:[EBP-70],EDX
004048C6 CMP DWORD PTR SS:[EBP-70],3
004048CA JA SHORT Doukutsu.00404904
004048CC MOV EAX,DWORD PTR SS:[EBP-70]
004048CF JMP DWORD PTR DS:[EAX*4+404B1A]
004048D6 MOV ECX,DWORD PTR SS:[EBP+8]
004048D9 MOV DWORD PTR DS:[ECX+64],800
004048E0 JMP SHORT Doukutsu.00404904
004048E2 MOV EDX,DWORD PTR SS:[EBP+8]
004048E5 MOV DWORD PTR DS:[EDX+60],800
004048EC JMP SHORT Doukutsu.00404904
004048EE MOV EAX,DWORD PTR SS:[EBP+8]
004048F1 MOV DWORD PTR DS:[EAX+64],800
004048F8 JMP SHORT Doukutsu.00404904
004048FA MOV ECX,DWORD PTR SS:[EBP+8]
004048FD MOV DWORD PTR DS:[ECX+60],800
00404904 JMP SHORT Doukutsu.0040492A
00404906 MOV EDX,DWORD PTR SS:[EBP+8]
00404909 MOV EAX,DWORD PTR DS:[EDX+10]
0040490C MOV ECX,DWORD PTR SS:[EBP+8]
0040490F ADD EAX,DWORD PTR DS:[ECX+18]
00404912 MOV EDX,DWORD PTR SS:[EBP+8]
00404915 MOV DWORD PTR DS:[EDX+10],EAX
00404918 MOV EAX,DWORD PTR SS:[EBP+8]
0040491B MOV ECX,DWORD PTR DS:[EAX+14]
0040491E MOV EDX,DWORD PTR SS:[EBP+8]
00404921 ADD ECX,DWORD PTR DS:[EDX+1C]
00404924 MOV EAX,DWORD PTR SS:[EBP+8]
00404927 MOV DWORD PTR DS:[EAX+14],ECX
0040492A MOV DWORD PTR SS:[EBP-20],80 ; frame A left
00404931 MOV DWORD PTR SS:[EBP-1C],20 ; frame A top
00404938 MOV DWORD PTR SS:[EBP-18],90 ; frame A right
0040493F MOV DWORD PTR SS:[EBP-14],30 ; frame A down
00404946 MOV DWORD PTR SS:[EBP-10],90 ; frame B left
0040494D MOV DWORD PTR SS:[EBP-C],20 ; frame B top
00404954 MOV DWORD PTR SS:[EBP-8],0A0 ; etc...
0040495B MOV DWORD PTR SS:[EBP-4],30
The fireball!
The fireball is more complex. I've commented a lot, it should be enough to get some great new weapons.
Code:
00404C67 JMP DWORD PTR DS:[EDX*4+405103]
00404C6E MOV EAX,DWORD PTR SS:[EBP+8]
00404C71 MOV DWORD PTR DS:[EAX+18],-400 ; -400 = speed of fireball when shot left
00404C78 JMP Doukutsu.00404D16
00404C7D MOV ECX,DWORD PTR SS:[EBP+8]
00404C80 MOV EDX,DWORD PTR DS:[49E66C]
00404C86 MOV DWORD PTR DS:[ECX+18],EDX
00404C89 CMP DWORD PTR DS:[49E66C],0
00404C90 JGE SHORT Doukutsu.00404C9B
00404C92 MOV EAX,DWORD PTR SS:[EBP+8]
00404C95 MOV BYTE PTR DS:[EAX+38],0
00404C99 JMP SHORT Doukutsu.00404CA2
00404C9B MOV ECX,DWORD PTR SS:[EBP+8]
00404C9E MOV BYTE PTR DS:[ECX+38],2
00404CA2 CMP DWORD PTR DS:[49E640],0
00404CA9 JNZ SHORT Doukutsu.00404CBE
00404CAB MOV EDX,DWORD PTR SS:[EBP+8]
00404CAE MOV EAX,DWORD PTR DS:[EDX+18]
00404CB1 SUB EAX,80 ; 80 = horizontal speed added to fireball when shot up if you are facing left
00404CB6 MOV ECX,DWORD PTR SS:[EBP+8]
00404CB9 MOV DWORD PTR DS:[ECX+18],EAX
00404CBC JMP SHORT Doukutsu.00404CCF
00404CBE MOV EDX,DWORD PTR SS:[EBP+8]
00404CC1 MOV EAX,DWORD PTR DS:[EDX+18]
00404CC4 ADD EAX,80 ; 80 = horizontal speed added to fireball when shot up if you are facing right
00404CC9 MOV ECX,DWORD PTR SS:[EBP+8]
00404CCC MOV DWORD PTR DS:[ECX+18],EAX
00404CCF MOV EDX,DWORD PTR SS:[EBP+8]
00404CD2 MOV DWORD PTR DS:[EDX+1C],-5FF ; -5FF = speed of fireball when shot up
00404CD9 JMP SHORT Doukutsu.00404D16
00404CDB MOV EAX,DWORD PTR SS:[EBP+8]
00404CDE MOV DWORD PTR DS:[EAX+18],400 ; 400 = speed of fireball when shot right
00404CE5 JMP SHORT Doukutsu.00404D16
00404CE7 MOV ECX,DWORD PTR SS:[EBP+8]
00404CEA MOV EDX,DWORD PTR DS:[49E66C]
00404CF0 MOV DWORD PTR DS:[ECX+18],EDX
00404CF3 CMP DWORD PTR DS:[49E66C],0
00404CFA JGE SHORT Doukutsu.00404D05
00404CFC MOV EAX,DWORD PTR SS:[EBP+8]
00404CFF MOV BYTE PTR DS:[EAX+38],0
00404D03 JMP SHORT Doukutsu.00404D0C
00404D05 MOV ECX,DWORD PTR SS:[EBP+8]
00404D08 MOV BYTE PTR DS:[ECX+38],2
00404D0C MOV EDX,DWORD PTR SS:[EBP+8]
00404D0F MOV DWORD PTR DS:[EDX+1C],5FF ; 5FF = speed of fireball when shot down
00404D16 JMP Doukutsu.00404DBA
00404D1B MOV EAX,DWORD PTR SS:[EBP+8]
00404D1E MOV ECX,DWORD PTR DS:[EAX]
00404D20 AND ECX,8
00404D23 JE SHORT Doukutsu.00404D31
00404D25 MOV EDX,DWORD PTR SS:[EBP+8]
00404D28 MOV DWORD PTR DS:[EDX+1C],-400 ; -400 = how fast the fireball goes up after hitting the floor
00404D2F JMP SHORT Doukutsu.00404D5B
00404D31 MOV EAX,DWORD PTR SS:[EBP+8]
00404D34 MOV ECX,DWORD PTR DS:[EAX]
00404D36 AND ECX,1
00404D39 JE SHORT Doukutsu.00404D47
00404D3B MOV EDX,DWORD PTR SS:[EBP+8]
00404D3E MOV DWORD PTR DS:[EDX+18],400 ; 400 = how fast sideways the fireball goes after hitting the left wall
00404D45 JMP SHORT Doukutsu.00404D5B
00404D47 MOV EAX,DWORD PTR SS:[EBP+8]
00404D4A MOV ECX,DWORD PTR DS:[EAX]
00404D4C AND ECX,4
00404D4F JE SHORT Doukutsu.00404D5B
00404D51 MOV EDX,DWORD PTR SS:[EBP+8]
00404D54 MOV DWORD PTR DS:[EDX+18],-400 ; -400 = how fast sideways the fireball goes after hitting the right wall
00404D5B MOV EAX,DWORD PTR SS:[EBP+8]
00404D5E MOV ECX,DWORD PTR DS:[EAX+1C]
00404D61 ADD ECX,55 ; 55 = strength of gravity
00404D64 MOV EDX,DWORD PTR SS:[EBP+8]
00404D67 MOV DWORD PTR DS:[EDX+1C],ECX
00404D6A MOV EAX,DWORD PTR SS:[EBP+8]
00404D6D CMP DWORD PTR DS:[EAX+1C],3FF ; 3FF = max downward speed of fireball (note: must also change below)
00404D74 JLE SHORT Doukutsu.00404D80
00404D76 MOV ECX,DWORD PTR SS:[EBP+8]
00404D79 MOV DWORD PTR DS:[ECX+1C],3FF ; 3FF = max downward speed of fireball (note: must also change above)
00404D80 MOV EDX,DWORD PTR SS:[EBP+8]
00404D83 MOV EAX,DWORD PTR DS:[EDX+10]
00404D86 MOV ECX,DWORD PTR SS:[EBP+8]
00404D89 ADD EAX,DWORD PTR DS:[ECX+18]
00404D8C MOV EDX,DWORD PTR SS:[EBP+8]
00404D8F MOV DWORD PTR DS:[EDX+10],EAX
00404D92 MOV EAX,DWORD PTR SS:[EBP+8]
00404D95 MOV ECX,DWORD PTR DS:[EAX+14]
00404D98 MOV EDX,DWORD PTR SS:[EBP+8]
00404D9B ADD ECX,DWORD PTR DS:[EDX+1C]
00404D9E MOV EAX,DWORD PTR SS:[EBP+8]
00404DA1 MOV DWORD PTR DS:[EAX+14],ECX
00404DA4 MOV ECX,DWORD PTR SS:[EBP+8]
00404DA7 MOV EDX,DWORD PTR DS:[ECX]
00404DA9 AND EDX,0D
00404DAC JE SHORT Doukutsu.00404DBA
00404DAE PUSH 1 ; /Arg2 = 00000001
00404DB0 PUSH 22 ; |Arg1 = 00000022
00404DB2 CALL Doukutsu.00420640 ; \Doukutsu.00420640
00404DB7 ADD ESP,8
00404DBA MOV DWORD PTR SS:[EBP-A8],80 ; frame A left
00404DC4 MOV DWORD PTR SS:[EBP-A4],0 ; frame A top
00404DCE MOV DWORD PTR SS:[EBP-A0],90 ; frame A right
00404DD8 MOV DWORD PTR SS:[EBP-9C],10 ; frame A bottom
00404DE2 MOV DWORD PTR SS:[EBP-98],90 ; frame B left
00404DEC MOV DWORD PTR SS:[EBP-94],0 ; etc...
00404DF6 MOV DWORD PTR SS:[EBP-90],0A0
00404E00 MOV DWORD PTR SS:[EBP-8C],10
The snake! (levels 2 and 3)
The snake can't be changed quite as much as the fireball, but you can still get some neat effects out of it.
Code:
00404478 JMP DWORD PTR DS:[EDX*4+404769]
0040447F MOV EAX,DWORD PTR SS:[EBP+8]
00404482 MOV DWORD PTR DS:[EAX+18],-200 ; -200 = speed when fired left
00404489 JMP SHORT Doukutsu.004044AD
0040448B MOV ECX,DWORD PTR SS:[EBP+8]
0040448E MOV DWORD PTR DS:[ECX+1C],-200 ; -200 = speed when fired up
00404495 JMP SHORT Doukutsu.004044AD
00404497 MOV EDX,DWORD PTR SS:[EBP+8]
0040449A MOV DWORD PTR DS:[EDX+18],200 ; 200 = speed when fired right
004044A1 JMP SHORT Doukutsu.004044AD
004044A3 MOV EAX,DWORD PTR SS:[EBP+8]
004044A6 MOV DWORD PTR DS:[EAX+1C],200 ; 200 = speed when fired down
004044AD MOV ECX,DWORD PTR DS:[49BC98]
004044B3 ADD ECX,1 ; change 1 to 0 to make the snake not alternate going up and down
004044B6 MOV DWORD PTR DS:[49BC98],ECX
004044BC MOV EDX,DWORD PTR SS:[EBP+8]
004044BF MOVZX EAX,BYTE PTR DS:[EDX+38]
004044C3 MOV DWORD PTR SS:[EBP-38],EAX
004044C6 CMP DWORD PTR SS:[EBP-38],3
004044CA JA SHORT Doukutsu.00404528
004044CC MOV ECX,DWORD PTR SS:[EBP-38]
004044CF JMP DWORD PTR DS:[ECX*4+404779]
004044D6 MOV EAX,DWORD PTR DS:[49BC98]
004044DB XOR EDX,EDX
004044DD MOV ECX,2
004044E2 DIV ECX
004044E4 TEST EDX,EDX
004044E6 JE SHORT Doukutsu.004044F4
004044E8 MOV EDX,DWORD PTR SS:[EBP+8]
004044EB MOV DWORD PTR DS:[EDX+1C],400
004044F2 JMP SHORT Doukutsu.004044FE
004044F4 MOV EAX,DWORD PTR SS:[EBP+8]
004044F7 MOV DWORD PTR DS:[EAX+1C],-400
004044FE JMP SHORT Doukutsu.00404528
00404500 MOV EAX,DWORD PTR DS:[49BC98]
00404505 XOR EDX,EDX
00404507 MOV ECX,2
0040450C DIV ECX
0040450E TEST EDX,EDX
00404510 JE SHORT Doukutsu.0040451E
00404512 MOV EDX,DWORD PTR SS:[EBP+8]
00404515 MOV DWORD PTR DS:[EDX+18],400
0040451C JMP SHORT Doukutsu.00404528
0040451E MOV EAX,DWORD PTR SS:[EBP+8]
00404521 MOV DWORD PTR DS:[EAX+18],-400
00404528 JMP Doukutsu.00404639
0040452D MOV ECX,DWORD PTR SS:[EBP+8]
00404530 MOVZX EDX,BYTE PTR DS:[ECX+38]
00404534 MOV DWORD PTR SS:[EBP-3C],EDX
00404537 CMP DWORD PTR SS:[EBP-3C],3
0040453B JA SHORT Doukutsu.00404595
0040453D MOV EAX,DWORD PTR SS:[EBP-3C]
00404540 JMP DWORD PTR DS:[EAX*4+404789]
00404547 MOV ECX,DWORD PTR SS:[EBP+8]
0040454A MOV EDX,DWORD PTR DS:[ECX+18]
0040454D SUB EDX,80 ; 80 = acceleration when shooting left
00404553 MOV EAX,DWORD PTR SS:[EBP+8]
00404556 MOV DWORD PTR DS:[EAX+18],EDX
00404559 JMP SHORT Doukutsu.00404595
0040455B MOV ECX,DWORD PTR SS:[EBP+8]
0040455E MOV EDX,DWORD PTR DS:[ECX+1C]
00404561 SUB EDX,80 ; 80 = acceleration when shooting up
00404567 MOV EAX,DWORD PTR SS:[EBP+8]
0040456A MOV DWORD PTR DS:[EAX+1C],EDX
0040456D JMP SHORT Doukutsu.00404595
0040456F MOV ECX,DWORD PTR SS:[EBP+8]
00404572 MOV EDX,DWORD PTR DS:[ECX+18]
00404575 ADD EDX,80 ; 80 = acceleration when shooting right
0040457B MOV EAX,DWORD PTR SS:[EBP+8]
0040457E MOV DWORD PTR DS:[EAX+18],EDX
00404581 JMP SHORT Doukutsu.00404595
00404583 MOV ECX,DWORD PTR SS:[EBP+8]
00404586 MOV EDX,DWORD PTR DS:[ECX+1C]
00404589 ADD EDX,80 ; 80 = acceleration when shooting down
0040458F MOV EAX,DWORD PTR SS:[EBP+8]
00404592 MOV DWORD PTR DS:[EAX+1C],EDX
00404595 MOV ECX,DWORD PTR SS:[EBP+8]
00404598 MOVZX EDX,BYTE PTR DS:[ECX+38]
0040459C MOV DWORD PTR SS:[EBP-40],EDX
0040459F CMP DWORD PTR SS:[EBP-40],3
004045A3 JA SHORT Doukutsu.00404615
004045A5 MOV EAX,DWORD PTR SS:[EBP-40]
004045A8 JMP DWORD PTR DS:[EAX*4+404799]
004045AF MOV ECX,DWORD PTR SS:[EBP+8]
004045B2 MOV EAX,DWORD PTR DS:[ECX+4C]
004045B5 CDQ
004045B6 MOV ECX,5
004045BB IDIV ECX
004045BD CMP EDX,2
004045C0 JNZ SHORT Doukutsu.004045E1
004045C2 MOV EDX,DWORD PTR SS:[EBP+8]
004045C5 CMP DWORD PTR DS:[EDX+1C],0
004045C9 JGE SHORT Doukutsu.004045D7
004045CB MOV EAX,DWORD PTR SS:[EBP+8]
004045CE MOV DWORD PTR DS:[EAX+1C],400 ; 400 = down speed of wave
004045D5 JMP SHORT Doukutsu.004045E1
004045D7 MOV ECX,DWORD PTR SS:[EBP+8]
004045DA MOV DWORD PTR DS:[ECX+1C],-400 ; -400 = up speed of wave
004045E1 JMP SHORT Doukutsu.00404615
004045E3 MOV EDX,DWORD PTR SS:[EBP+8]
004045E6 MOV EAX,DWORD PTR DS:[EDX+4C]
004045E9 CDQ
004045EA MOV ECX,5
004045EF IDIV ECX
004045F1 CMP EDX,2
004045F4 JNZ SHORT Doukutsu.00404615
004045F6 MOV EDX,DWORD PTR SS:[EBP+8]
004045F9 CMP DWORD PTR DS:[EDX+18],0
004045FD JGE SHORT Doukutsu.0040460B
004045FF MOV EAX,DWORD PTR SS:[EBP+8]
00404602 MOV DWORD PTR DS:[EAX+18],400 ; 400 = right speed of wave
00404609 JMP SHORT Doukutsu.00404615
0040460B MOV ECX,DWORD PTR SS:[EBP+8]
0040460E MOV DWORD PTR DS:[ECX+18],-400 ; -400 = left speed of wave
00404615 MOV EDX,DWORD PTR SS:[EBP+8]
00404618 MOV EAX,DWORD PTR DS:[EDX+10]
0040461B MOV ECX,DWORD PTR SS:[EBP+8]
0040461E ADD EAX,DWORD PTR DS:[ECX+18]
00404621 MOV EDX,DWORD PTR SS:[EBP+8]
00404624 MOV DWORD PTR DS:[EDX+10],EAX
00404627 MOV EAX,DWORD PTR SS:[EBP+8]
0040462A MOV ECX,DWORD PTR DS:[EAX+14]
0040462D MOV EDX,DWORD PTR SS:[EBP+8]
00404630 ADD ECX,DWORD PTR DS:[EDX+1C]
00404633 MOV EAX,DWORD PTR SS:[EBP+8]
00404636 MOV DWORD PTR DS:[EAX+14],ECX
00404639 MOV ECX,DWORD PTR SS:[EBP+8]
0040463C MOV EDX,DWORD PTR DS:[ECX+30]
0040463F ADD EDX,1
00404642 MOV EAX,DWORD PTR SS:[EBP+8]
00404645 MOV DWORD PTR DS:[EAX+30],EDX
00404648 MOV ECX,DWORD PTR SS:[EBP+8]
0040464B CMP DWORD PTR DS:[ECX+30],0
0040464F JLE SHORT Doukutsu.0040466A
00404651 MOV EDX,DWORD PTR SS:[EBP+8]
00404654 MOV DWORD PTR DS:[EDX+30],0
0040465B MOV EAX,DWORD PTR SS:[EBP+8]
0040465E MOV ECX,DWORD PTR DS:[EAX+34]
00404661 ADD ECX,1
00404664 MOV EDX,DWORD PTR SS:[EBP+8]
00404667 MOV DWORD PTR DS:[EDX+34],ECX
0040466A MOV EAX,DWORD PTR SS:[EBP+8]
0040466D CMP DWORD PTR DS:[EAX+34],2
00404671 JLE SHORT Doukutsu.0040467D
00404673 MOV ECX,DWORD PTR SS:[EBP+8]
00404676 MOV DWORD PTR DS:[ECX+34],0 ; frame A left
0040467D MOV DWORD PTR SS:[EBP-30],0C0 ; frame A top
00404684 MOV DWORD PTR SS:[EBP-2C],10 ; frame A right
0040468B MOV DWORD PTR SS:[EBP-28],0D0 ; frame A bottom
00404692 MOV DWORD PTR SS:[EBP-24],20 ; frame B left
00404699 MOV DWORD PTR SS:[EBP-20],0D0 ; etc...
004046A0 MOV DWORD PTR SS:[EBP-1C],10
004046A7 MOV DWORD PTR SS:[EBP-18],0E0