Outpost

huhuhaha you aware of the slate bug? bring up window 43 and fill the slate in once then cancel then bring the window up again and you can make unlimited slates
Did this slate bug still work? how does it work actually? if u mean u can continue producing ancient slates even when your bag is empty ...

instead of modifying the jumptable directly, use modify integer

or you prefer CTL-SHIFT-F12 to revive instead of auto-revive.


Revive
------
004519A4 27124500 dd HelFart.00451227
004519A4 00286000 dd HelFart.00602800

00602800 83BD C42A0700 00 cmp dword ptr [ebp+72AC4], 0
00602807 -0F84 1AEAE4FF je HelFart.00451227
0060280D 83BD CC2A0700 00 cmp dword ptr [ebp ...

huhuhaha you aware of the slate bug? bring up window 43 and fill the slate in once then cancel then bring the window up again and you can make unlimited slates
nope, I don't really play/explore HB since 3.2 update.

The actual revival code is


.text:004470F0 push 0
.text:004470F2 push 0
.text ...

with this bug you hack the client can auto revive yourself to 1/2 of your hp everytime the hp drop below certain level, maybe 50-100? That is like near invicibility. Warriors can solo nonstop.

when you load a section from file you basically add a new section with the content of a file.

This is to answer binarydata & charlie's question.
I'm very lazy to explain. So I use the old helgame v2.95 2003-11-05 as an example.

1. I add a 'filler'/empty section header (VOffset=00172000 VSize=0008E000) so that the next section will start at address 0x600000 (VOffset 0x200000). I do that ...

That is the hb internal speedtrap that will dc you if you're faster than 300ms between each action (swing, shoot, pretend corpse etc). It will not however bypass the serverside speedtrap. the one given by charlie is wrong (different helgame version?).

speed trap
----------
00465328 |. 8B8D A0EA0600 mov ecx, dword ptr [ebp+6EAA0]
00465328 E9 C42C0000 jmp HelFart.00467FF1
0046532D 90 nop


Curse
-----
004A4608 |. 0F84 F9020000 je HelFart.004A4907
004A4608 E9 FA020000 jmp HelFart.004A4907
004A460D 90 nop


Global Spam
-----------
00451057 . 3C 21 ...

I use lordpe deluxe v1.4 for adding sections & then rebuild it using procdump.

yep, charlie is 1/2 right. My housemate friend check this forum & some other hb forum everyday using my login.

as for adding section, I use lordpe as well as procdump.

00456247 |. 50 push eax
00456248 |. 895C24 1C mov dword ptr [esp+1C], ebx
0045624C |. E8 CF990300 call HelGame_.0048FC20
00456251 |. FF15 48F24900 call dword ptr [<&WINMM.timeGetTime>] ; WINMM.timeGetTime


1. this is where the magic pause code are.
2. 49ED60 near end of code section can be used ...

I use lordpe to add the new section. You don't really need to do so.
the empty part at the end of the code section should be ok, although if you intend to patch it into the exe instead of memory patching, you will need to rebuild the exe so that the vsize=psize (virtual size = physical size).

1. the code that you need to modify is about 50 lines above the code referencing to Network Traffic...
2. You need to change it to jump to a code cave, I used additional section.
3. speed trap never change much. it is just couple line below 'cmp esi, 12C'. That part will after that will dc you if ...

:lol: ignore that .txt thingie. It is bcoz I copied the lines from IDA pro.

for no cast delay search for this code sequence
push 4
push 0FA314D5h

for no magic pause it will be slightly more difficult. also you need to change the jump to different address. It is about 50 lines above the code ...