https://imgur.com/a/x3iC1pw

Just wanted to dump my brain a bit about how this practice setting works. There's three injection points:

1. Most obviously, I have to disable opening the doors. Both random panels are wired up to 0x00017C68, which is the ID of the double doors, so I swap that with 0x00000000 (nothing)

2. Modding Entity_Door::close Here's the original code: 140092CD3 | mov rcx, qword ptr ds:[rdi+0x58] ; Offset 0x58 is pattern_name 140092CD7 | lea rdx, qword ptr ds:[0x1404B4880] ; ":peekaboo_panel" 140092CDE | call <witness64_d3d11.strings_match> 140092CE3 | test al, al 140092CE5 | je witness64_d3d11.140092CF8 140092CE7 | comiss xmm7, dword ptr ds:[rdi+0x29C] ; xmm7 is 0.5f, offset 0x29C is solved_t_target 140092CEE | jbe witness64_d3d11.140092CF8 ; jbe: Jump if below/equal 140092CF0 | mov rcx, rdi 140092CF3 | call <witness64_d3d11.Entity_Machine_Panel::power_off> 140092CF8 | inc rsi 140092CFB | cmp rsi, rbx 140092CFE | jl witness64_d3d11.140092CC0 ; Look at the next panel The important part here is on 140092CE7-140092CEE: "If the panel is solved, jump to the next panel". More importantly, the converse is "If the panel isn't solved, power it off". Once a random panel is powered off, it will be randomized when it is powered on. Thus, I want the exact opposite: The panel should remain on if it's unsolved, and power off if it's solved. The fix is easy, just change 'jbe' to 'jna' (jump if not above).

3. Modding Entity_Door::open This one's a bit more complicated. But again, here's the original code: 140093E03 | mov rcx, qword ptr ds:[rdi+0x58] ; Offset 0x58 is pattern_name 140093E07 | lea rdx, qword ptr ds:[0x1404B4880] ; ":peekaboo_panel" 140093E0E | call <witness64_d3d11.strings_match> 140093E13 | test al, al 140093E15 | je witness64_d3d11.140093E30 140093E17 | comiss xmm6, dword ptr ds:[rdi+0x29C] ; xmm6 is 0.5f, offset 0x29C is solved_t_target 140093E1E | jbe witness64_d3d11.140093E30 ; jbe: Jump if below/equal 140093E20 | mov rcx, rdi 140093E23 | call <witness64_d3d11.Entity_Machine_Panel::reset> ; Reset in this context is "clear lines" not "randomize" 140093E28 | mov rcx, rdi 140093E2B | call <witness64_d3d11.Entity_Machine_Panel::power_on> 140093E30 | inc rsi 140093E33 | cmp rsi, rbx 140093E36 | jl witness64_d3d11.140093DF0 ; Look at the next panel Again, the important part is 140093E17-140093E1E, and it works the same as above: "If the panel is solved, don't clear its lines or power it on (as it's already on)", and the important converse, "If the panel is not solved, clear its lines and power it on (re-randomize it)". To inject my changes, I now make a slightly different swap: 'jbe ..E30' becomes 'jmp ..E28'. 'jmp' is an uncoditional jump, so this now reads "Always turn a panel on, and never clear its lines". This is a safety in case a panel is off when the cheat is activated. When the changes are turned off, I change it back to 'jbe ..E28', again preserving the "always turn a panel on" logic, since I'm not certain what state the cheat is de-activated in.