Question

I’ve been looking through a piece of code of a pc game that I’m trying to “improve”. (ok so maybe I suck at the game but I still want to play it). Could you please look into the following code:

fld dword ptr[ebp+00007B1C]
fsub dword ptr[esp+64]
fst dword ptr[ebp+00007B1C]
call 004A2E48

This code is called every second for the level countdown timer. I need to stay on a particular level for a few minutes. If I can modify the above code so that the value pushed into the address [ebp+00007B1C] is 0 then the game level will always time out and it will save me playing those crazy “survival” minigames.

I’ll explain what I understand from this code. Dont worry, you dont have to go deep into this.
In the first line we get the timer value. For example if 97 seconds are remaining then it is here that this value is loaded.
In the second line a value (1 second) is subtracted from 97.
In the third line 96 is again moved to memory.
And finally we have the function call that will do other processing based on the time remaining.

Now all I need to do is patch this piece of code somehow so that the value that is pushed is 0 (in the third step).
Can you please help me out with this?

Answer 1

Replace

fld dword ptr[ebp+00007B1C]
fsub dword ptr[esp+64]

with

fldz ; Push zero on to top of floating point stack
nop ; From the end of the fldz to the beginning of the store instruction