views:

266

answers:

3

Hi,

I've been looking through a piece of code of a pc game that I'm trying to "improve". (ok so maybe I suck at the game but I still want to play it). Could you please look into the following code:

fld dword ptr[ebp+00007B1C]
fsub dword ptr[esp+64]
fst dword ptr[ebp+00007B1C]
call 004A2E48

This code is called every second for the level countdown timer. I need to stay on a particular level for a few minutes. If I can modify the above code so that the value pushed into the address [ebp+00007B1C] is 0 then the game level will always time out and it will save me playing those crazy "survival" minigames.

I'll explain what I understand from this code. Dont worry, you dont have to go deep into this. In the first line we get the timer value. For example if 97 seconds are remaining then it is here that this value is loaded.
In the second line a value (1 second) is subtracted from 97.
In the third line 96 is again moved to memory. And finally we have the function call that will do other processing based on the time remaining.

Now all I need to do is patch this piece of code somehow so that the value that is pushed is 0 (in the third step).
Can you please help me out with this?

+1  A: 

Just nop out the second command. That is, find out how many bytes the fsub command takes and overwrite it with that many no-operation bytecodes (0x90).

Philip Davis
He doesn't want the time not to change, which is what removing the fsub would do. He wants to pass 0 as an argument to the function being called.
Falaina
True, OP asked for that. But without knowing more about the game, the statements seem to contradict (specifically, "stay on a level for a few minutes" and "make the game time out")... so I interpreted "staying on a level" as having the clock not time out. But, absolutely, your answer does what OP specifically asks for.
Philip Davis
What I meant by "stay on a level for a few minutes" was "forced to stay on a level for a few minutes" which was until the timer finishes. <for people who want to know more about the game its my pleasure - a little rant here :-) ..> The mini game was about dodging falling rocks - something which hurts my eyes since you can only control the horizontal movement of the character which is already at the centre of the screen. And the game keeps becoming faster and faster and even if there was 1 second left and we die then we need to restart from the beginning. My eyes were hurting because of that.
Mugen
Hence, I agree with Falaina that nopping the last line might not work out as expected but thanks for replying anyway :-).
Mugen
+4  A: 

Replace

fld dword ptr[ebp+00007B1C]
fsub dword ptr[esp+64]

with

fldz ; Push zero on to top of floating point stack
nop ; From the end of the fldz to the beginning of the store instruction
Falaina
Wow I think that might just work. I'll try it when I come to that mini-game level again. Thanks a load for this!
Mugen
+2  A: 

Another patch:
replace

fld dword ptr[ebp+00007B1C]

with

fld dword ptr[esp+64]
NOP
NOP
Nick D
I think this one should work too. Too bad I cant select two answers as my accepted answer.
Mugen
@Mugen, I had upvoted Falaina's answer and I'd have accepted it too ;-)
Nick D
I'm not very sure actually whether this might work out. I think we might get stuck at 1 second forever, havent tried it out though.
Mugen