May 14, 2011 at 3:15 AM
Join Date: Jan 4, 2008
Location: Lingerie, but also, like, fancy curtains
Posts: 3052
So I made this hack a while ago, and it seems it has garnered enough interest that multiple people have asked how to do it. As I am fairly lazy (don't want to respond to everyone individually), and not everybody even knows that I did this, I feel like a thread will get it out to more people and thus help the hacking community.
Source:
Implementation:
Here's a patched copy of the virgin exe that contains this hack.
Changelog:
13/5/11 - Released to public
14/5/11 - Fixed a few miscopied operand sizes
12/6/11 - Patched copy released, tsc portion changed from 0x425149 to 0x424eaf
Sorry I haven't given much explanation to how this works. If you feel like you need/want clarification on something just point it out.
Source:
Code:
[B]0x4154b8:[/B] mov eax,[49e184] shl eax,5 add [ebp-0C],eax add [ebp-4],eax jmp short 0x4154d4A1 84 E1 49 00 C1 E0 05 01 45 F4 01 45 FC EB 0C
Code:
[B]0x424eaf:[/B] mov ecx,[4a5ad8] add ecx,[4a5ae0] movsx byte edx,[ecx+1] cmp edx,4d jne 0x4251fc mov eax,[4a5ad8] add eax,[4a5ae0] movsx byte ecx,[eax+2] cmp ecx,49 jne 0x4251fc mov edx,[4a5ad8] add edx,[4a5ae0] movsx byte eax,[edx+3] cmp eax,4d jne short 0x4251fc mov ecx,[4a5ae0] add ecx,4 push ecx call 421900 add esp,4 mov [49e184],eax add dword [4a5ae0],8 jmp 0x4252a7A1 D8 5A 4A 00 03 05 E0 5A 4A 00 0F BE 48 01 83F9 4D 75 70 8B 15 D8 5A 4A 00 03 15 E0 5A 4A 000F BE 42 02 83 F8 49 75 5B 8B 0D D8 5A 4A 00 030D E0 5A 4A 00 0F BE 51 03 83 FA 4D 75 46 A1 E05A 4A 00 83 C0 04 50 E8 05 CA FF FF 83 C4 04 A384 E1 49 00 83 05 E0 5A 4A 00 08 E9 98 03 00 00
To make this hack work, you need to do three things:
1) Apply the hack to the exe (or download the patched version).
2) Modify MyChar.pbm to hold however many characters you want. New characters are simply appended to the bottom of the image.
3) Use the new TSC command <MIMXXXX to modify the character index. If XXXX is zero, then the first character will be shown, if XXXX is one, the the second character will be shown, etcetera.
Note that this uses a small bit of flag data in order to save what character you are currently using. High enough flags may screw shit up.
1) Apply the hack to the exe (or download the patched version).
2) Modify MyChar.pbm to hold however many characters you want. New characters are simply appended to the bottom of the image.
3) Use the new TSC command <MIMXXXX to modify the character index. If XXXX is zero, then the first character will be shown, if XXXX is one, the the second character will be shown, etcetera.
Note that this uses a small bit of flag data in order to save what character you are currently using. High enough flags may screw shit up.
Changelog:
13/5/11 - Released to public
14/5/11 - Fixed a few miscopied operand sizes
12/6/11 - Patched copy released, tsc portion changed from 0x425149 to 0x424eaf
Sorry I haven't given much explanation to how this works. If you feel like you need/want clarification on something just point it out.