Direct Death is one of the earliest Non-Boot-Technologies in the cheap character community. It directly modifies the enemy's alive [pGameVar -> pPlayer [i] (i>0 and i<=60) -> Alive (0xE24)] or [[0x4B5B4C]+0xB750+i*4]+0xE24 to cause M.U.G.E.N to fail automatic determination. Due to the direct modification of memory addresses without the need for overflow using multiple null state controllers, it's called Direct Death.
If you set this memory address to any value other than 0 and keep it, then this technique can be used for defense.
Detailed methods[]
1. Memory Modification method:
(0x4B5B4C) -> +(0xB750 + i * 4) -> + 0xE24 (i>0 and i<=60) is the standard location for storing the Alive value of a character, where "->" represents a pointer.
If you want to use it for attacks, you can keep the enemy's value at 0. If you want to use it for defense, you can use various exploits to keep it at any non-zero value (including negative numbers).
First, use the following article or your own method to obtain a person's physical base address (to attack, please avoid your own base address, and to defend, please avoid other people's base addresses).
Assuming eax is the base address of the character:
;Direct Death
mov dword [eax+0xE24], 0
;Alive Restore
;mov dword [eax+0xE24],1
When multithreading, its speed is much faster than methods utilizing %n or %f, as they cannot be executed in a timely manner by comparison.
2. Source Modification method:
To easily find key addresses, we can use a debugger and set an access breakpoint on a player's alive address.
Open a debugger (on this example we will use Cheat Engine) to add a player's live address to the address list, then right-click on the list item and select "Find out what accesses this address". If your list is in pointer form, please select "Find what access the address pointed by this pointer" in the following dialog box. [1]
This displays the address and number of visits to this address. [1]
Then let one character defeat his opponent, and you will find that an address has been added here, located at 0x00440C06.
We checked this place and found the following assembly instructions:
mov edx,[eax+00000E24]
test edx,edx
je 00440C24
If you have a good understanding of assembly language, you will soon discover:
- test edx, edx is a statement that determines whether edx is 0. If it's 0, then je will trigger!
- If it's not 0, jne will trigger. We will try to change the jump under this address to nop (doing nothing).
Unfortunately, in this situation, the character will still be defeated. Why is this? Let's observe the following code: We set a breakpoint here, then click, and when it is broken, click "Step Out" to pop up this function.
You will find that the return value of this function is independent of our victory or defeat judgment, and the return value eax at 0x004205F4 is directly replicated. The instructions we modified only affect the condition of whether the function returns. Observing the original function, we can see that the character's health value has been adjusted here (starting from 0x00440C67), but the victory or defeat is not determined.
So we observed other instructions in the "Find Code Dialog Box", and the one at 0x0041F873 was very suspicious because it directly determined whether the character's alive was 0.
cmp dword ptr [eax+00000E24],00
Recover by je. [2]
Let's go to this address and change the jump (je) below to nop. [2]
Observing MUGEN's performance after a character is defeated again, you will find that simple alive modifications have become ineffective. Modify it slightly, and the character will be wrongly judged and defeated.
Principle[]
Decompiled pseudo code in IDA32bit, which introduces header files for easy type definition. [3]
In the explanation of the source code modification method, the purpose is actually to determine whether the alive of the current enumerated character is 0, and if so, to modify the value of whether the character in the stack has been defeated.
As shown in the right figure [3], the stack positions of v220 are continuous and connected to v221. Here, 0xBC38 (end match-type) and 0xBC34 (winning team) have been determined and modified. After BC38 and BC34 are modified, M.U.G.E.N. will automatically enter roundstate=3.