Disabling the battle swirl?

[nijado]

anyone know how its done, and more importantly, is willing to tell me how its done? I searched a lot, but couldnt find anything even closely related to it.

 

[dziugo]

Some info here.

dziugo

 

[nijado]

what program would one go about to edit the op codes. OllyDbg is what alhexx used, but i dont know if that program can edit it, since its just a debugger. Once i know the program, it all seems really simple

 

[Sub Xero]

You can use OllyDbg. Just find the address, then right click on it, click Binary, then Fill with NOP's. Then right click again and select copy to executable.
I suggest you make a backup first.

[EDIT] I have the English/US (are they the same?) version and the opcode is at 00673EDA

 

[nijado]

OK, Im officialy confused, theres not just one MOV DX,WORD PTR DS:[ECX] in the ff7.exe theres hundreds, do they all need to be nop'd, since they are th e same command?

also, is there a way to search for opcodes, i can only find how to search for other things like commands.

 

[Sub Xero]

Right click and choose Goto->Expression and try 00673EDA
You should end up in this loop:
Code: [Select]

00673EB2  |> 8B4D 08        |/MOV ECX,DWORD PTR SS:[EBP+8]00673EB5  |. 8B55 C8        ||MOV EDX,DWORD PTR SS:[EBP-38]00673EB8  |. 0351 14        ||ADD EDX,DWORD PTR DS:[ECX+14]00673EBB  |. 8955 C8        ||MOV DWORD PTR SS:[EBP-38],EDX00673EBE  |> 8B45 C8        | MOV EAX,DWORD PTR SS:[EBP-38]00673EC1  |. 3B45 C0        ||CMP EAX,DWORD PTR SS:[EBP-40]00673EC4  |. 7D 3E          ||JGE SHORT ff7.00673F0400673EC6  |. 8B4D D4        ||MOV ECX,DWORD PTR SS:[EBP-2C]00673EC9  |. 8B55 C8        ||MOV EDX,DWORD PTR SS:[EBP-38]00673ECC  |. 3B91 54090000  ||CMP EDX,DWORD PTR DS:[ECX+954]00673ED2  |. 7D 0E          ||JGE SHORT ff7.00673EE200673ED4  |. 8B45 BC        ||MOV EAX,DWORD PTR SS:[EBP-44]00673ED7  |. 8B4D D0        ||MOV ECX,DWORD PTR SS:[EBP-30]00673EDA  |. 66:8B11        ||MOV DX,WORD PTR DS:[ECX]00673EDD  |. 66:8910        ||MOV WORD PTR DS:[EAX],DX00673EE0  |. EB 08          ||JMP SHORT ff7.00673EEA00673EE2  |> 8B45 BC        ||MOV EAX,DWORD PTR SS:[EBP-44]00673EE5  |. 66:C700 0000   ||MOV WORD PTR DS:[EAX],000673EEA  |> 8B4D 08        ||MOV ECX,DWORD PTR SS:[EBP+8]00673EED  |. 8B51 14        ||MOV EDX,DWORD PTR DS:[ECX+14]00673EF0  |. 8B45 D0        ||MOV EAX,DWORD PTR SS:[EBP-30]00673EF3  |. 8D0C50         ||LEA ECX,DWORD PTR DS:[EAX+EDX*2]00673EF6  |. 894D D0        ||MOV DWORD PTR SS:[EBP-30],ECX00673EF9  |. 8B55 BC        ||MOV EDX,DWORD PTR SS:[EBP-44]00673EFC  |. 83C2 02        ||ADD EDX,200673EFF  |. 8955 BC        ||MOV DWORD PTR SS:[EBP-44],EDX00673F02  |.^EB AE          |\JMP SHORT ff7.00673EB2

You might not land at the exact same point. But you should be in this area.
You only need to NOP the command MOV DX,WORD PTR DS:[ECX] at this specific point.