Alright; here goes another round:
ship damage. Will cut it a bit short this time around, focusing on the important stuff:
Code: Select all
ACOdyssey.exe+2F0B1A0 - 48 89 5C 24 08 - mov [rsp+08],rbx // break here
ACOdyssey.exe+2F0B1A5 - 48 89 6C 24 10 - mov [rsp+10],rbp
ACOdyssey.exe+2F0B1AA - 48 89 74 24 18 - mov [rsp+18],rsi
ACOdyssey.exe+2F0B1AF - 57 - push rdi
ACOdyssey.exe+2F0B1B0 - 48 83 EC 30 - sub rsp,30 { 48 }
ACOdyssey.exe+2F0B1B4 - 48 8B 81 70050000 - mov rax,[rcx+00000570]
ACOdyssey.exe+2F0B1BB - 49 8B D8 - mov rbx,r8
ACOdyssey.exe+2F0B1BE - 0F29 74 24 20 - movaps [rsp+20],xmm6
ACOdyssey.exe+2F0B1C3 - 48 8B FA - mov rdi,rdx
ACOdyssey.exe+2F0B1C6 - F3 0F10 35 F653EC00 - movss xmm6,[ACOdyssey.exe+3DD05C4] { [1.00] }
ACOdyssey.exe+2F0B1CE - 48 8B F1 - mov rsi,rcx
ACOdyssey.exe+2F0B1D1 - 4C 8B 48 08 - mov r9,[rax+08]
ACOdyssey.exe+2F0B1D5 - 49 C1 E1 20 - shl r9,20 { 32 }
ACOdyssey.exe+2F0B1D9 - 49 C1 F9 3F - sar r9,3F { 63 }
ACOdyssey.exe+2F0B1DD - 4C 23 08 - and r9,[rax]
ACOdyssey.exe+2F0B1E0 - 74 40 - je ACOdyssey.exe+2F0B222
ACOdyssey.exe+2F0B1E2 - 8B 92 00010000 - mov edx,[rdx+00000100]
ACOdyssey.exe+2F0B1E8 - 85 D2 - test edx,edx
ACOdyssey.exe+2F0B1EA - 74 26 - je ACOdyssey.exe+2F0B212
ACOdyssey.exe+2F0B1EC - 41 8B 81 FC010000 - mov eax,[r9+000001FC]
ACOdyssey.exe+2F0B1F3 - C1 E8 11 - shr eax,11 { 17 }
ACOdyssey.exe+2F0B1F6 - 3B D0 - cmp edx,eax
ACOdyssey.exe+2F0B1F8 - 77 18 - ja ACOdyssey.exe+2F0B212
ACOdyssey.exe+2F0B1FA - 8D 04 D2 - lea eax,[rdx+rdx*8]
ACOdyssey.exe+2F0B1FD - 8D 0C C5 B8FFFFFF - lea ecx,[rax*8-00000048]
ACOdyssey.exe+2F0B204 - 49 03 89 F4010000 - add rcx,[r9+000001F4]
ACOdyssey.exe+2F0B20B - 74 05 - je ACOdyssey.exe+2F0B212
ACOdyssey.exe+2F0B20D - 8B 49 08 - mov ecx,[rcx+08]
ACOdyssey.exe+2F0B210 - EB 05 - jmp ACOdyssey.exe+2F0B217
ACOdyssey.exe+2F0B212 - B9 01000000 - mov ecx,00000001 { 1 }
ACOdyssey.exe+2F0B217 - 45 33 C0 - xor r8d,r8d
ACOdyssey.exe+2F0B21A - E8 41E0F3FF - call ACOdyssey.exe+2E49260
ACOdyssey.exe+2F0B21F - 0F28 F0 - movaps xmm6,xmm0
ACOdyssey.exe+2F0B222 - 48 63 43 08 - movsxd rax,dword ptr [rbx+08]
ACOdyssey.exe+2F0B226 - 48 8D 4E 20 - lea rcx,[rsi+20]
ACOdyssey.exe+2F0B22A - 8B 97 04010000 - mov edx,[rdi+00000104]
ACOdyssey.exe+2F0B230 - 48 03 C8 - add rcx,rax
ACOdyssey.exe+2F0B233 - FF 13 - call qword ptr [rbx]
ACOdyssey.exe+2F0B235 - 48 63 43 08 - movsxd rax,dword ptr [rbx+08]
ACOdyssey.exe+2F0B239 - 48 8D 8E E0000000 - lea rcx,[rsi+000000E0]
ACOdyssey.exe+2F0B240 - 8B 97 08010000 - mov edx,[rdi+00000108]
ACOdyssey.exe+2F0B246 - 48 03 C8 - add rcx,rax
ACOdyssey.exe+2F0B249 - FF 13 - call qword ptr [rbx]
ACOdyssey.exe+2F0B24B - 66 0F6E 8F 4C010000 - movd xmm1,[rdi+0000014C]
ACOdyssey.exe+2F0B253 - 48 8D 8E A0010000 - lea rcx,[rsi+000001A0]
ACOdyssey.exe+2F0B25A - 48 63 43 08 - movsxd rax,dword ptr [rbx+08]
ACOdyssey.exe+2F0B25E - 0F5B C9 - cvtdq2ps xmm1,xmm1
ACOdyssey.exe+2F0B261 - 48 03 C8 - add rcx,rax
ACOdyssey.exe+2F0B264 - F3 0F59 CE - mulss xmm1,xmm6
ACOdyssey.exe+2F0B268 - F3 0F2C D1 - cvttss2si edx,xmm1
ACOdyssey.exe+2F0B26C - FF 13 - call qword ptr [rbx]
ACOdyssey.exe+2F0B26E - 66 0F6E 87 BC010000 - movd xmm0,[rdi+000001BC]
ACOdyssey.exe+2F0B276 - 48 8D 8E 20030000 - lea rcx,[rsi+00000320]
ACOdyssey.exe+2F0B27D - 48 63 43 08 - movsxd rax,dword ptr [rbx+08]
ACOdyssey.exe+2F0B281 - 0F5B C0 - cvtdq2ps xmm0,xmm0
ACOdyssey.exe+2F0B284 - 48 03 C8 - add rcx,rax
ACOdyssey.exe+2F0B287 - F3 0F59 C6 - mulss xmm0,xmm6
ACOdyssey.exe+2F0B28B - F3 0F2C D0 - cvttss2si edx,xmm0
ACOdyssey.exe+2F0B28F - FF 13 - call qword ptr [rbx]
ACOdyssey.exe+2F0B291 - 66 0F6E 87 34020000 - movd xmm0,[rdi+00000234]
ACOdyssey.exe+2F0B299 - 48 8D 8E 60020000 - lea rcx,[rsi+00000260]
ACOdyssey.exe+2F0B2A0 - 48 63 43 08 - movsxd rax,dword ptr [rbx+08]
ACOdyssey.exe+2F0B2A4 - 0F5B C0 - cvtdq2ps xmm0,xmm0
ACOdyssey.exe+2F0B2A7 - 48 03 C8 - add rcx,rax
ACOdyssey.exe+2F0B2AA - F3 0F59 C6 - mulss xmm0,xmm6
ACOdyssey.exe+2F0B2AE - F3 0F2C D0 - cvttss2si edx,xmm0
ACOdyssey.exe+2F0B2B2 - FF 13 - call qword ptr [rbx]
ACOdyssey.exe+2F0B2B4 - 33 D2 - xor edx,edx
ACOdyssey.exe+2F0B2B6 - 8B EA - mov ebp,edx
ACOdyssey.exe+2F0B2B8 - 39 97 6C020000 - cmp [rdi+0000026C],edx
ACOdyssey.exe+2F0B2BE - 76 36 - jna ACOdyssey.exe+2F0B2F6
ACOdyssey.exe+2F0B2C0 - 66 0F6E 87 4C010000 - movd xmm0,[rdi+0000014C]
ACOdyssey.exe+2F0B2C8 - 66 0F6E 8F BC010000 - movd xmm1,[rdi+000001BC]
ACOdyssey.exe+2F0B2D0 - 0F5B C0 - cvtdq2ps xmm0,xmm0
ACOdyssey.exe+2F0B2D3 - 0F5B C9 - cvtdq2ps xmm1,xmm1
ACOdyssey.exe+2F0B2D6 - F3 0F59 87 54010000 - mulss xmm0,[rdi+00000154]
ACOdyssey.exe+2F0B2DE - F3 0F59 8F C4010000 - mulss xmm1,[rdi+000001C4]
ACOdyssey.exe+2F0B2E6 - F3 0F59 C6 - mulss xmm0,xmm6
ACOdyssey.exe+2F0B2EA - F3 0F59 CE - mulss xmm1,xmm6
ACOdyssey.exe+2F0B2EE - F3 0F2C D0 - cvttss2si edx,xmm0
ACOdyssey.exe+2F0B2F2 - F3 0F2C E9 - cvttss2si ebp,xmm1
ACOdyssey.exe+2F0B2F6 - 48 63 43 08 - movsxd rax,dword ptr [rbx+08]
ACOdyssey.exe+2F0B2FA - 48 8D 8E E0030000 - lea rcx,[rsi+000003E0]
ACOdyssey.exe+2F0B301 - 48 03 C8 - add rcx,rax
ACOdyssey.exe+2F0B304 - FF 13 - call qword ptr [rbx]
ACOdyssey.exe+2F0B306 - 48 63 43 08 - movsxd rax,dword ptr [rbx+08]
ACOdyssey.exe+2F0B30A - 48 8D 8E A0040000 - lea rcx,[rsi+000004A0]
ACOdyssey.exe+2F0B311 - 48 03 C8 - add rcx,rax
ACOdyssey.exe+2F0B314 - 8B D5 - mov edx,ebp
ACOdyssey.exe+2F0B316 - 48 8B 03 - mov rax,[rbx]
ACOdyssey.exe+2F0B319 - 48 8B 5C 24 40 - mov rbx,[rsp+40]
ACOdyssey.exe+2F0B31E - 48 8B 6C 24 48 - mov rbp,[rsp+48]
ACOdyssey.exe+2F0B323 - 48 8B 74 24 50 - mov rsi,[rsp+50]
ACOdyssey.exe+2F0B328 - 0F28 74 24 20 - movaps xmm6,[rsp+20]
ACOdyssey.exe+2F0B32D - 48 83 C4 30 - add rsp,30 { 48 }
ACOdyssey.exe+2F0B331 - 5F - pop rdi
ACOdyssey.exe+2F0B332 - 48 FF E0 - jmp rax
The function above breaks when you open the
Ship menu. If you check RCX, you will see that:
Code: Select all
IStruct: 0x1F9C5D7C0
IName: 0x14527CFF0
ObjStr: ShipStatsViewModel
ObjHash: 0x7E46CF7C
These are my ship's attributes:
Let's trace:
[Link]
Remember that 0.65 I mentioned? (you will have to check above link for that). Well.. Turns out it applies for all ship damage types; doesn't affect Health and Armor. So that's our
damage multiplier. Let's study the code inside the function here:
Code: Select all
ACOdyssey.exe+2F0B212 - B9 01000000 - mov ecx,00000001
ACOdyssey.exe+2F0B217 - 45 33 C0 - xor r8d,r8d
ACOdyssey.exe+2F0B21A - E8 41E0F3FF - call ACOdyssey.exe+2E49260
We see that:
That's about it for the analysis. Will let you know where to patch optimally.
BR,
Sun