Question Maple Story World: Land of the Wind — Tracing Player Pointers in xLua

[byte_corvus]

Anyone currently digging into the xLua garbage in Maple Story World? I've been trying to pin down the player's X-coordinate in Land of the Wind, but the register shuffling is a nightmare. This isn't your standard static offset; we're dealing with a VM-based dispatch here.

The Reversing Problem
I found the write instruction where the coordinate vector is updated:

movups xmmword ptr ds:[r9], xmm0

The issue is R9. It's volatile as hell. Depending on where you break, R9 is either a function pointer, a scrap register, or the actual coordinate struct. The game seems to be using an xLua implementation, meaning we're likely looking at a bridge between the C++ engine and the Lua stack.

Assembly Breakdown
Looking at the dump, the address isn't coming from a single

LEA

or static pointer. It’s being passed around through various jumps and calls:

1. Initial setup:

   mov r9, qword ptr ds:[rdi+B0]

   — here it looks like a function call preparation.
2. The pivot:

   mov r9, r12

   occurs after a series of bitwise shifts (

   SHR

   ,

   SHL

   ) which usually screams "array index calculation" or "table lookup" in Lua objects.
3. The source: In the final block, R9 is set by

   mov r9, rax

   immediately after a call to a Lua management function (

   xlua.7FFB6DA98D20

   ).

Spoiler: Raw ASM Dump

// ... snippets from the trace
mov r14,qword ptr ds:[r15+20]
mov r10,qword ptr ss:[rbp+188]
mov r11,qword ptr ss:[rbp+190]
mov eax,edi
shr eax,6
movzx ebx,al
// ... coordinate resolution logic ...
movups xmm0,xmmword ptr ds:[rax]
mov r10,qword ptr ss:[rbp+188]
mov r11,qword ptr ss:[rbp+190]
movups xmmword ptr ds:[r9],xmm0

Technical Troubleshooting
If you're trying to find where R9 gets its "coordinate address" identity, you need to back-trace RAX after the call to

xlua.7FFB6DA98D20

. This function is almost certainly a getter for the entity's position component. In these modern "classic" remakes, the engine often keeps the physics and the visual representation in two different places, synced through these xLua wrappers.

Prevention and Ethics

1. Don't hook the

   MOVUPS

   directly without checking the calling context, or you'll crash every time an NPC moves.
2. Disable Secure Boot to ensure your debugger doesn't get stripped of handles by the AC.
3. Watch out for the Subtick-like updates; Land of the Wind has some weird latency interpolation.

Has anyone mapped out the r11 / r15 base structures yet? It looks like R15+20 is the head for the entity list, but the offsets are still shifting. Drop your crash logs or IDA pseudo-code below if you've got a cleaner way to resolve the local player base.