This is written bye ~={HAL9000}=~ on Monday 8. Feb. 00:42 AM

______________
|Introduction|
|____________|

Allright, this is not a tutorial, but is a collection of tips and other information i use when
i HaCk Games and other Programs. I will explain how to make CALLs and use the StaCk and other
things that is nescessary when HaCking Diablo. I don't take any responsibility to what you, the
user are using this to. I hope that you will find this information useful to maybe learn to HaCk,
Diablo and other Games, and maybe begin CraCking Programs and Games. Don't ask me how to, cause
i can't help you. You will need to figure things about the art of HaCking yourself. If you
cannot, i recommend you stop reading this piece of TXT. Sorry for my bad grammatical errors,
i hope you will be able to understand it.


________________________________
|What you will find in this TXT|
|______________________________|

How to make simple CALLs and JuMPs
How to use the StaCk
How to use SoftICE
How my Auto Heal works
Other information about Diablo.EXE

_____________________________
|How to make CALLs and JUMPs|
|___________________________|

OK, this is the basics about how to calculate a JUMP without using SoftICE to anything, but
calculating a Positive number to a Negative number. This is a slow method, and can be hard 
to use, but i will explain it anyway. You can also use this to calculate a CALL. Now we want 
to JUMP from offset 43e798 to 479e40. First we will find out that a JUMP will take 5 bytes
for a Uncoditional jump, and 6 byte for a Conditional. We will use a Unconditional.
First you will need a HEX calculator, and SoftICE. I recommend getting Hex Workshop, it has
a good calculator in it, that can calculate both hexadicimal numbers and decimal numbers.
http://www.bpsoftware.com
OK, now we begin calculating. Start the calculator and type in 479e3f. Why that ?? Shouldn't
we jump to offset 479e40 ?? Yes, but inside the program it really don't jumps to offset 479e40,
but to the byte right before that. OK, substract that with 43e79c. We know the an unconditional
jump is 5 bytes long, so we jump from offset 43e79c. OK, now you have the value 3b6a3 hex.
That is how many bytes there is between offset 479e3f, and offset 43e79c. Now we need the jump
to jump 3b6a3. In W32DASM it will look like this :
43E798 E9A3B60300	;JMP 00479E40
Try look at the line above, especially at 'E9A3B60300' and take away the first byte. (E9)
Now we have the value A3B60300. That is the value we calculated before, just in another
succession. Try place the last byte as the first byte and vice versa. It will look like this:
0003B6A3, and that is the value we calculated before. The same methods is used when CALLing an
offset, just when the first byte is changed to 'E8' Like this:
E8A3B60300

That was KueL E H ?? ehe.. OK, now we want to make a negative JUMP.
We want to jump from offset 479e40 to offset 43e798. Type in 479e44 in the calculator.
Then substract that with 43e797. It will be 3b6ad. That is the bytes between offset 479e44,
and offset 43e797. Now you will need to use SoftICE to calculate the Positive number to a
Negative number. Go to SoftICE with pressing CTRL-D, and type this:
? -3b6ad
It will then give you some numbers:
FFFC4953 4294723923 (-243373)
The inly one you need is the first number, FFFC4953
That is the negative hexadicimal number of 3b6ad. Then we need to make it as a JUMP like before
with the Positive JUMP. It will look like this:
E95349FCFF
Like before the first byte is the last when placing it in the code. The same method is then used
when making a CALL. Like this:
E85349FCFF
That should be all you need to make JUMPs and CALLs.

______________________
|How to use the StaCk|
|____________________|

To access the StaCk can be very tricky, and can easily crash the program you are HaCking.
The mostly commands used is PUSH and POP e.g.
PUSH ECX	;will PUSH the bytes in register ECX into the StaCk
POP ECX		;will POP it out of the Stack again and store in register ECX
Always remember when PUSHing data into StaCk, the last byte in is always the first byte out.
e.g.
PUSH EDX
POP ECX
This will PUSH data stored at register EDX into StaCk.
After that it POPs ECX, and so it ECX will then have the same value as EDX.
We don't use the ASM language like that. Instead we just do this:
MOV ECX, EDX 	;That is the most used command when copying data from a register to another.
But if we now want to move a special value into a register we can use the StaCk. e.g.
PUSH 08
POP EAX
This command is basically a MOV EAX, 01  command, but is shorter than the other one.
But still remember that the last byte in is the first byte out. So if now we want to set
the offsets EDX, ECX and EAX safely aside into the StaCk, and them POP them out again we need
to do this:
PUSH EDX
PUSH ECX
PUSH EAX
<some asm code>
POP EAX
POP ECX
POP EDX
So the registers will have the right values when POPing them out of the StaCk again.
Quite simple isn't it ?
There is also commands as PUSHAD and POPAD
I am unfamilar to these commands as i have never used them before.

________________________________________________
|How to use SoftICE, and the different commands|
|______________________________________________|

If you have SoftICE, and know how to use it, you will no longer need to use other programs,
except for a good text-editor. I am still using W32DASM, but not much. Before i begin, i will
just say that SoftICE can be very hard, and tricky to use for a newbie.
OK, i will now begin with the different commands used in SoftICE, and how they works.
First of all, you need to know how to go to SoftICE, when debugging a program.
Install it on your system, and choose the Universal driver. That should be present in the
newest version of the debugger (SoftICE 3.24).
After you have installed it, you will need to know how to go to it. Press the CTRL-D, then you
will be in SoftICE. To get out again, just press F5, and you will be baCk at the program.
To break the system on a certain offset you will use this command:
BPX 4403d2
Then it will break at that offset, when accessing it.
The instruction started at offset 4403d2 will in Diablo be:
JA 00440437
It means Jump if Above to offset 440437
Above that you will see:
CMP DWORD PTR [ECX+02], 0002EE00
It's where it checks if the damage caused by another player is over 0002EE00 hex.
0002EE00 equals 3000 in Diablo.EXE (3000*64=192000 decimal, and 0002ee00 in hex).
If above that it will JUMP to offset 440437, and nothing happens with your life.
Now if you want to edit it inside the program you can use the command:
A 4403d2
Then you can type in all the different commands in Diablo.EXE, with SoftICE.
So if you know how to use the Intel Assembly Language Instruction Set you can now type in the
new commands you want to, e.g. type
A 4403D2   and then enter.
Now type in:
JBE 440437   and then enter, and after that ESC.
Now you have actually made a GoD ModE from Auto Kill, cause now it will only JUMP if the damage
is Above of if it is Equal. All normal Auto Kills will damage cause the damage of 3000 (0002ee00)
But your little HaCk here will jumpif the damage is Equal or if it is higher that 3000.
No normal Auto Kills will then work on you.
Other commands you will need to know are below:
F10	will go to next instruction in memory (Trace).
F11	will go into next instruction. e.g. If you want to find out what the next CALL goes to
	you will need to press F11, else it will just go to next instruction.
D xx	The 'D' command is used to view data at an offset or a register. e.g.:
	D ECX	will view the value of register ECX. You can use offset too.
F5	exit to Windows.
F1	help

I think that is all you need to use SoftICE, if you know how to solve your own problems you will
find out things about everything yourself.

____________________________
|PlayerDamagePlayer Routine|
|__________________________|

Beginning at offset 0043e460
Register ECX holds attacking playernumber
Register EDX holds attacked playernumber

Example:
;StartCode

MOV ECX, 01 	;the attacking player, you can use any number from 0 to 3
            	;there is no check to wich player attacks, so you can use playernumber 1, even
            	;if there is no player in slot 1

MOV EDX, 02 	;the attacked player is stored in Register EDX
		;if you want to damage everyone in game, you must make a repeatfunction, that
		;"traces" through all the playernumbers

PUSH 0002ee00	;PUSHes the damage into stack. 0002ee00 equals 3000 in game. (3000*64=192000
		;decimal, and 0002ee00 in hex) 3000 is max damage restriction, set by Blizzard

CALL 43e460	;CALLs the PlayerDamagePlayer routine in Diablo.EXE

;EndCode

________________________
|How my Auto Heal Works|
|______________________|

Now i will then explain  how my Auto Heal works.
Format <offset> <olddata> <newdata> <explanation>

start 1.07 -Improved- Configurable Auto-Heal by HAL9000
# Created and written by ~={HAL9000}=~

435c95 29be107968 e8a6410400	;overwrites the SUBstraction in Diablo.EXE with CALLing offset
                                ;00479e40 where my autoheal code starts

435c99 0029 eb05		;JuMPs 00435c9f like nothing happened

42af79 298e107968 e8c2ee0400	;same as above

42af7d 0029 eb05		;just used to another SUBstraction

42ae86 298e107968 e8b5ef0400	;--''--

42ae8a 0029 eb05		;--''--

4403d4 8bc769c0d8 e8679a0300	;--''--

4403d8 5400 eb5c		;--''--

42e093 8b4d1c6a24 e8a8bd0400	;--''--

42e097 5ae8 eb41		;--''--

42cf04 8b4d1c6a23 e837cf0400	;--''--

42cf08 5ae8 eb43		;--''--

479e40 50			;PUSH EAX register into stack if in use
479e41 56			;PUSH ESI
479e42 51			;PUSH ECX
479e43 52			;PUSH EDX

479e44 8b3574776800		;MOV ESI, [00687774] MOVs playernumber into register ESI

479e4a 69f6d8540000		;IMUL ESI, 54d8 MULtiplies playernumber with 54d8h

479e50 8b8608796800		;MOV EAX, [ESI+00687908] MOVs value at offset 00687908 + register
				;ESI into EAX reason for + ESI is that if you have playernumber
				;2 your life will be stored at another offset

479e56 8b8e10796800		;MOV ECX, [ESI+00687910] MOVs value at offset 00687910 + register
				;ESI into ECX your life has two offsets where your life is
				;stored at used if you have an item that increases your life
				
479e5c 8b159f9e4700		;MOV EDX, [00479E9F] MOVs the value at offset 00479e9f into
				;register EDX value at offset 00479e9f is the life amount you
				;wish to lose when something hits you

479e62 6bd240			;IMUL EDX, 40 MULtiplies the value in EDX with 40h and equals
				;64 in decimal (1 HP = 40 hex = 64 decimal)

479e65 2bc2			;SUB EAX, EDX SUBstracts register EAX with register EDX and
				;stores in register EAX

479e67 2bca			;SUB ECX, EDX SUBstracts register ECX with register EDX and
				;stores in register ECX

479e69 83f940			;CMP ECX, 40 CoMPares register ECX with 40h

479e6c 7c17			;JL 00479E85 Jumps if Less to offset 00479e85
				;(1 HP = 40 hex = 64 decimal) if less than 40 then jump
				
479e6e 898608796800		;MOV [ESI+00687908], EAX MOVs value in register EAX into offset
				;00687908 + ESI after SUBstracted with value in register EDX
				
479e74 898e10796800		;MOV [ESI+00687910], ECX MOVs value in register ECX into offset
				;00687910 + ESI after SUBstracted with value in register EDX

479e7a 891598974b00		;MOV [004B9798], EDX MOVs value in register into offset 004b9798
				;and tell Diablo to update life

479e80 5a			;POP EDX register and restore old value
479e81 59			;POP ECX always remember that the last byte in is the
479e82 5e			;POP ESI first byte out
479e83 58			;POP EAX

479e84 c3			;RET RETurns from instruction and end Auto Heal

479e85 8b8614796800		;MOV EAX, [ESI+00687914] MOVs value at offset 00687914 + register
				;ESI into register EAX value of your full base life + items is 
				;stored there

479e8b 898610796800		;MOV [ESI+00687910], EAX MOVs value at register EAX into offset
				;687910 + register ESI and restore full life

479e91 8b8e0c796800		;MOV ECX, [ESI+0068790C] MOVs value at offset 0068790c + register
				;ESI into register ECX value of your full base life is stored 
				;there

479e97 898e08796800		;MOV [ESI+00687908], ECX MOVs value at register ECX into offset
				;687908 + register ESI and restore full life

479e9d ebdb			;JMP 00479E7A JuMPs to offset 00479e7a and end Auto Heal

#
# Configurable amount of damage on you per hit (in hex):
#
479e9f 00 0d
end


___________________
|Different offsets|
|_________________|

Base life is stored at this offset
687908

Full base life is stored at this offset
68790c

Base life plus items that increases life amount is stored at this offset
687910

Full base life plus items that increases life amount is stored at this offset
687914

Character Stats is starting at offset:
6878dc
to
6878f8

Your own player number is stored here
687774

Offset always being modified. Used with the spell Stone Course
648498

This is a call used when casting Town Portal
43dd72

This call is used every time the Golem "CraCks"
43dd00

This is used every time you point at something with Telekinesis
41f973

This is used every time you point at something with Identify
42377b

This is CALLed every time you cast a spell
42e1ab

This is CALLed every time you cast a spell
4519c0