U2 Upgrade – Stat Boost Exploit

Seems like there are lots of peculiarity with stats in Ultima 2, but this time this one was introduced by me. There is currently an exploit where it’s possible to max out your stats without spending any gold. This one was reported to me by a user of the upgrade.

The way to reproduce is this: head to the hotel clerk and offer him 0 gold. If he says “Alakazam!” he will max one stat up to 99. The game follows the stat boost logic anyway, even if you offer 0 gold. I suppose I didn’t quite realize this when I added the stat rollover fix.

The code for the stat check looks like this:

; al = current stat value

49f0 mov ah,al         ; save orig stat in ah
49f2 popf
49f3 adc al,[0027]     ; add in offer amount
49f7 daa               ; adjust for bcd
49f8 pushf             ; save state of carry flag
49f9 cmp al,ah
49fb ja 49ff          ; if new stat > orig stat, jump to end
49fd mov al,99        ; else, cap stat at 99

The problem here is at line 49fb. I did this to check that the stat was actually raised and there was no overflow. Unfortunately, I didn’t check what happens if the stat doesn’t change.  Instead of a “>” operator it should be “>=”. So line 49fb becomes:

49fb jae 49ff         ; if new stat >= orig stat, jump to end

I’ve checked this fix into my v2.1 branch. Shout out to Stephen Lambert for reporting this!

5 thoughts on “U2 Upgrade – Stat Boost Exploit

  1. Thanks for these upgrade patches. To me they are the definitive way to play these games.
    Do you think you may remove the windows dependency for the Ultima 4 and 5 patches?
    Just asking because it would be nice to be able to patch these on mobile devices.

  2. I hope this isn’t a double post.

    First, thank you for making these patches. For me these are the definitive versions of the early Ultima games.

    Any chance you’ll be updating the older patches (4 and 5) to no longer rely on windows? Just asking because it would be nice to be able to patch then on mobile devices.

    1. Hi Alex, and thanks for your interest!

      By no longer relying on Windows, I assume you mean the message you get when you try to run the config or patching tools. For U5 yes I do plan on releasing a new version that will fix that problem. U4 however is another matter as it wasn’t originally my project and i don’t own the source code. However I’ve given some thought on fixing some of its problems.

      Having said that, I’ve run all the upgrades successfully on mobile devices using magicbox. I just had to install them on my desktop first and then copy them over.

      1. Yes, that’s what I typically do as well.

        I’ve just tried an alternate avpatch.exe for the U4 upgrade and it worked through Magicdosbox. I was wondering if you’d be able to include that file in your U4 alternate arrangement package for posterity’s sake. The original file is hosted on a geocities page that hasn’t been updated since 2003!


Leave a Reply

Your email address will not be published. Required fields are marked *