Modding a Fallout: New Vegas Mod

 1: __declspec(naked) UInt32 __fastcall EffectItemGetModifiedDuration(EffectItem *effItem)
 2: {
 3:         __asm
 4:         {
 5:                 xor             eax, eax
 6:                 mov             edx, [ecx+0x14]
 7:                 test    byte ptr [edx+0x58], 0x80
 8:                 jnz             done
 9:                 mov             eax, [ecx+8]
10:                 test    byte ptr [edx+0x58], 1
11:                 jnz             done
12:                 mov             ecx, [ebp]
13:                 mov             ecx, [ecx-0xD4]
14:                 cmp             dword ptr [ecx], 0x1011900
15:                 jnz             done
16:                 mov             dl, [ecx+0x64]
17:                 sub             dl, 0xA
18:                 cmp             dl, 1
19:                 ja              done
20:                 cvtsi2ss        xmm0, eax
21:                 push    ecx
22:                 movss   [esp], xmm0
23:                 push    esp
24:                 push    g_thePlayer
25:                 push    kPerkEntry_ModifyPositiveChemDuration
26:                 CALL_EAX(0x5E58F0)
27:                 add             esp, 0xC
28:                 cvttss2si       eax, [esp]
29:                 pop             ecx
30:         done:
31:                 retn
32:         }
33: }

__declspec(naked) void ModPositiveChemDurationHook()
{
        __asm
        {
                mov             al, [eax+0xA0]
                sub             al, 0xA
                cmp             al, 1
                seta    al
                ja              done
                mov             ecx, [ebp+0x10]
                mov             eax, [ecx+0xC]
                mov             ecx, [eax+0x14]
                mov             al, [ecx+0x58]
                and             al, 1
        done:
                JMP_EDX(0x82370C)
        }
}

class EffectItem
{
public:
        enum
        {
                kRange_Self = 0,
                kRange_Touch,
                kRange_Target,
        };

        UInt32                          magnitude;                      // 00   used as a float
        UInt32                          area;                           // 04
        UInt32                          duration;                       // 08
        UInt32                          range;                          // 0C
        UInt32                          actorValueOrOther;      // 10
        EffectSetting           *setting;                       // 14
        float                           cost;                           // 18 on autocalc items this seems to be the cost
        ConditionList           conditions;                     // 1C
};

class EffectSetting : public TESForm
{
public:
        TESModel                model;                          // 18
        TESDescription  description;            // 30
        TESFullName             fullName;                       // 38
        TESIcon                 icon;                           // 44
        UInt32                  unk50;                          // 50
        UInt32                  unk54;                          // 54
        UInt32                  effectFlags;            // 58
  // ...
};

enum EffectSettingFlags
{
        kEffFlag_Hostile =                      1,
        kEffFlag_Recover =                      2,
        kEffFlag_Detrimental =          4,
        kEffFlag_Hidden =                       8,
        kEffFlag_Self =                         0x10,
        kEffFlag_Touch =                        0x20,
        kEffFlag_Target =                       0x40,
        kEffFlag_NoDuration =           0x80,
        kEffFlag_NoMagnitude =          0x100,
        kEffFlag_NoArea =                       0x200,
        kEffFlag_FXPersist =            0x400,
        kEffFlag_GoryVisuals =          0x1000,
        kEffFlag_DisplayNameOnly =      0x2000,
        kEffFlag_UseSkill =                     0x80000,
        kEffFlag_UseAttribute =         0x100000,
        kEffFlag_Painless =                     0x1000000,
        kEffFlag_NoHitEffect =          0x8000000,
        kEffFlag_NoDeathDispel =        0x10000000
};

WriteRelCall(0x7E0C1F, (UInt32)EffectItemGetModifiedDuration);
WriteRelJump(0x8236FD, (UInt32)ModPositiveChemDurationHook);

PatchMemoryNopRange(GetJIPAddress(0x100128C3), GetJIPAddress(0x100128E1));

WriteRelCall(0x7E0C1F, (UInt32)EffectItemGetModifiedDuration);
WriteRelJump(0x8236FD, (UInt32)ModPositiveChemDurationHook);

**`ModPositiveChemDurationHook`** is an inline assembly hook intended to modify the game’s logic for determining whether a chem (drug) effect is “positive” and should have its duration adjusted by perks such as **Chemist** (which normally doubles the duration of beneficial chems).  

## ?? What the hook does (assembly analysis)

The hook’s assembly code performs the following checks:

```assembly
mov  al, [eax+0xA0]      ; load a byte from offset 0xA0 of the object pointed by eax
sub  al, 0xA             ; subtract 10 (0xA)
cmp  al, 1               ; compare the result to 1
seta al                  ; set al = 1 if (byte‑10) > 1
ja   done                ; jump to “done” if (byte‑10) > 1

; If we get here, the byte is 0xA or 0xB (i.e., a “positive chem” type?)
mov  ecx, [ebp+0x10]     ; follow a chain of pointers
mov  eax, [ecx+0xC]
mov  ecx, [eax+0x14]
mov  al, [ecx+0x58]      ; read a flag byte at offset 0x58
and  al, 1               ; isolate bit 0 (likely a “positive effect” flag)

done:
JMP_EDX(0x82370C)        ; jump back to the original game code
```

### Interpretation:
1. **Byte at `[eax+0xA0]`** likely identifies the **chem type**.  
   - If the byte is `0xA` or `0xB` (10 or 11), the hook proceeds; otherwise it jumps to the end.
   - These values probably correspond to **positive chems** like Med‑X, Buffout, etc.
2. The second part dereferences a pointer chain to reach an **effect‑item structure** and reads **flag bit 0** at offset `0x58`.  
   - This bit likely indicates whether the effect is **beneficial** (positive).
3. The final value in `al` is either `0` or `1`, which the original game code uses to decide whether to apply perk‑based duration modifiers.

## ?? Step‑by‑step analysis of the assembly

```assembly
mov   al, [eax+0xA0]      ; 1. load a byte from offset 0xA0 of the object pointed to by EAX
sub   al, 0xA             ; 2. subtract 10 (0xA) from that byte
cmp   al, 1               ; 3. compare the result with 1
seta  al                  ; 4. set AL = 1 if (byte‑0xA) > 1, else AL = 0
ja    done                ; 5. if (byte‑0xA) > 1, jump to “done” (with AL = 1)

; --- Only reach here if the original byte was 0xA or 0xB (10 or 11) ---
mov   ecx, [ebp+0x10]     ; 6. load a pointer from the stack (likely a function argument)
mov   eax, [ecx+0xC]      ; 7. follow offset +0xC to obtain an EffectItem pointer
mov   ecx, [eax+0x14]     ; 8. follow offset +0x14 to obtain the EffectSetting pointer
mov   al, [ecx+0x58]      ; 9. read the effectFlags field (32‑bit, but we take only the low byte)
and   al, 1               ;10. isolate bit 0 (the “Hostile” flag)

done:
JMP_EDX(0x82370C)         ; jump back to the original game code
```

---

## ?? What each part is testing

### **Part 1 – The “chem‑type” filter**
- **`[eax+0xA0]`** reads a byte from an object (likely an **AlchemyItem** or a related structure).  
- The byte is compared with **0xA** and **0xB** (decimal 10 and 11).  
- **Only if the byte equals 0xA or 0xB** does the hook proceed to Part 2.  
- For any other value, `AL` is set to **1** and the hook jumps to the end.

**Interpretation:** The game apparently uses this byte to classify chems. Values 10 and 11 probably correspond to **addiction‑related chems** (note that `MagicItem::kAddiction = 10` in the SDK). The hook restricts the perk‑duration adjustment to *only* these two chem types.

### **Part 2 – The “hostile‑effect” check**
- The hook traverses a pointer chain to reach the **EffectSetting** associated with the chem’s effect.  
- At offset **0x58** of the EffectSetting is the `effectFlags` field (see `EffectSetting::effectFlags` in `GameForms.h`).  
- **Bit 0** of `effectFlags` is `kEffFlag_Hostile` (value 1).  
- The hook reads that bit and returns `AL = 1` if the effect is hostile, `AL = 0` if it is non‑hostile.

**Interpretation:** Even for chem types 10 and 11, the perk should **not** extend the duration of hostile (detrimental) effects. This check ensures that only *non‑hostile* effects of those chem types receive the duration bonus.

class AlchemyItem : public MagicItemObject
{
public:
        TESModelTextureSwap                     model;                                  // 4C
        TESIcon                                         icon;                                   // 6C
        BGSMessageIcon                          messageIcon;                    // 78
        TESScriptableForm                       scriptable;                             // 88
        TESWeightForm                           weight;                                 // 94
        BGSEquipType                            equipType;                              // 9C
        BGSDestructibleObjectForm       destructible;                   // A4
        BGSPickupPutdownSounds          pickupPutdownsounds;    // AC

        UInt32                                          value;                                  // B8
        UInt8                                           alchFlags;                              // BC
        UInt8                                           padBD[3];                               // BD
        SpellItem                                       *withdrawalEffect;              // C0
        float                                           addictionChance;                // C4
        TESSound                                        *consumeSound;                  // C8
        TESIcon                                         iconCC;                                 // CC

        bool IsPoison() const;
};

mov             al, [eax+0xA0]
sub             al, 0xA
cmp             al, 1
seta    al
ja              done

class BGSEquipType : public BaseFormComponent
{
public:
        enum EquipTypes
        {
                kEqpType_BigGuns,
                kEqpType_EnergyWeapons,
                kEqpType_SmallGuns,
                kEqpType_MeleeWeapons,
                kEqpType_UnarmedWeapons,
                kEqpType_ThrowWeapons,
                kEqpType_Mine,
                kEqpType_BodyWear,
                kEqpType_HeadWear,
                kEqpType_HandWear,
                kEqpType_Chems,
                kEqpType_Stimpack,
                kEqpType_Food,
                kEqpType_Alcohol
        };

        UInt32  equipType;      // 08
};

mov             ecx, [ebp+0x10]
mov             eax, [ecx+0xC]
mov             ecx, [eax+0x14]
mov             al, [ecx+0x58]
and             al, 1