DP and CE

[BlubBlab]

I have a question how does the vectors for direction works(e.g. in rom I did look into it)?
I tried to find the direction and the position of chars in DP, about the position the game give no info were you are, so I tried the direction.

I was misconception about how the direction are saved in memory in the game I thought they should be an YX-Axis and ZY-Axis in rad.
Is there a way to say which approximately value they have when I face a specific angle ?

I think I got the base idea :

What I don't know what format those infos have are there points coordinates or rad when it in rad shouldn't the Y-vectors point on the same values as I sought?


EDIT: Ups I did find something similar for coordinaten in the CE board

[Administrator]

It all depends on the game engine. There's a number of ways of storing angles. Even within the vector subset you can still have delta vectors, unit vectors, Euler angles, quaternions, or a combination of those.

First thing you need to do is figure out how that data is presented. Figure out which data is attributed to X, Y, and Z. As you rotate your character around you'll notice that two of them change between 0 and 6.28, or -3.14 and +3.14; this indicates that you are using radians, but it is important to make note of the origin (0 or -3.14).

Is there a way to say which approximately value they have when I face a specific angle ?

I'm not entirely sure what you're asking. Arc tangent (atan2) can be used to give you an angle that you are facing based on the difference between a point in front of the object and the position of the object itself. Normally you would subtract the two Y values and the two X values, however, since you are centering around the same object you can skip that and simply use the vector itself. If you wanted to take your vector and convert it into an angle, you would do this:

Code: Select all

local angle = math.atan2(player.yvec, player.xvec);

To get the angle to an object, you would do this:

Code: Select all

local angle2 = math.atan2(target.y - player.y, target.x - player.x);

You can then figure out the difference between the two angles by subtracting them.

[BlubBlab]

I though about which format I should expect since its very close to rom. Today I found the XYZ coordinates, I also found a 4th float which response to moving. I found the XYZ coordinates with the help of some tuts from the CE board(which was basically the same idea I had for direction)

I think I will solve this tomorrow I have a good idea how it could be (found something about 2x unsigned short (float 4 bytes) to safe both axis). Than I "only" need the infos about the mops and yeah..target pointer.

[lisa]

Been a long time since I did anything in this game but I will post what I had in regards to direction and coords.

Code: Select all

		self.X = memoryReadRepeat("float",getProc(),base2 + addresses.X) or 0
		self.Y = memoryReadRepeat("float",getProc(),base2 + addresses.Y) or 0
		self.Dir1 = memoryReadRepeat("float",getProc(),base2 + addresses.dir1) or 0
		self.Dir2 = memoryReadRepeat("float",getProc(),base2 + addresses.dir2) or 0

	dir1 = 0x10,
	dir2 = 0x18,
	X = 0x40,
	Y = 0x48,

So if you have your X,Y values then do -0x30 from them and that should be your dir1 and dir2, they are floats, well they are all floats.

--=== Added ===--
Or that could be from a completely different game =(

[BlubBlab]

I found it, it was -1,+1,with 2 axis/vars unfortunately I must fix the coordinates again the pointers weren't stable enough.
I will post it later, so I only need find the mops values(list start/end) now(and target pointer). I have already read I should find it with a second char I can't do that at the moment I need a second PC for that.

I think I will walk to a yellow mop copy xyz values and try somehow to find the same structure I have as player. Hm...I think I must learn to use custom advanced search for this.

[Administrator]

If the values range from -1 to +1 that indicates unit vectors. If you really need to convert that to an angle, you can still use atan2 to figure that out. You also can use sin/cos to calculate points along the front-vector, just the same as if you had any regular point.

If you are using MM2, you might also look into using the vector class as it will take care of a lot of the math for you.

[BlubBlab]

Okay I have done the most^^ now I need to find the rest

EDIT: I did take a look how to find enemies but that could take a while CE seems not to support something like:
First Value between x1 and y1
+4 bytes value between x2 and y2
+4 bytes value between x3 and y3

On top of that I have the feeling that the infos about the mops is split into 2 tables.

[BlubBlab]

Okay I found a way through group scan to find the xyz of the mop but nothing about something other is close by no name, or HP, or level and the object seems to move in the memory when you wander around.

Any idea how I can find some infos about the pawn list ?

EDIT:
Okay I tried to find some infos through the name. I found out that so long I don't kill any mob there is no name in the memory. The only way is to target some and every time I move the target on/off the the address of the name will move.

So those infos are generated on fly , I found one pointer that end in a lower region where a huge list is which constantly is in change like crazy. MSVCR90 a dll from MS Visual Studio seems to work a great deal in it. So far I remember I also run into something similar with the mob coordinates.

EDIT:
MSVCR90 is the MS string c/c++ API seems those string are coded in some other form before displayed

[lisa]

Finding the mob "table" can be daunting, if it was as simple as all the info being in a little section of memory then anyone could do it.

Most of the time I have gone looking I have found the game using a structure like this.

What you will find though is you have a section of memory which has addresses which point to the "base address" of an object and from there it will lead you to relevent information of that object.

The way I start to look for this is by first finding the information of the targeted object, because that is something you can find farely easily because you control what you target. If you can get target coords, hp, mp, name then you will find it easier to find the objects base address. Then you can do a pointer scan of that base address or just do a "find what accesses this address", this will hopefully get you to the section of memory where all the pointers to base addresses is held.

Believe it or not that is kind of the easy part, then you need to work out the "table structure" in order to be able to find the relevent information that those base addresses point to.

I'll try to do an example to see if I can sum up what I have said.

You will have a section of memory that looks like this

Code: Select all

0x45453465 0x34543978 0 0
0 0x343243223 0x 4324324324
0 0 0 0x77654353

very small example, so it has 0's and addresses
Those addresses are the pointer to the base of an object.

If we go to 0x45453465 we might see this

Code: Select all

0x255 0x255 0 0
0x234324234 0x32432423 0 0
0x324324324 0x32432432 0x24324243 0x56745654

First parts of memory are usually exactly the same for every object, and then we get some addresses.
0x234324234 might point to the objects name
0x32432423 might point to a section of memory with the objects coords and directions
0x24324243 might point to the objects HP

Now quite a lot of the time it isn't that simple, quite often the address has a few offsets, so it might go to an address and then an offset of that address points to another address and an offset of that address points to yet another address and then you finally get to the information you want.

After writing all this out I am thinking this probably won't really help you, the game might be structured in a completely different way =(

[BlubBlab]

Hm what I did found is the targets HP DP seems to move some infos for the target to the player table instead of giving a pointer.
I can get in CE a target's coordinates by searching but it is kinda hard because the grid is really small and the mop don't return to 100% to it's original position. I have asked in the CE board about how I can make a lua script for a group scan with in between values.(I haven't a clue of the CE api yet)

HP I can get easily but it's define its purpose I have already the player table.(and I can't change it without moving it in memory)

The "true" name string for mops exist only once it seems that all mops with the same name (should) pointing on it, and if I change the target the string moves in the memory.....and if you kill the mob the string will be there 15x times in the memory. I checked them those others are log infos.

Today I had a little luck I got the vector instead of the mop coordinates (yeah I must correct me I found yzx vectors in the game)
I followed it until I couldn't find anything new any more(downwards in the memory) with "find what accesses this address". It seems automated pointer scan and dissembler are useless at that point only think is I could try to find it on foot.

I think that was what you said

[BlubBlab]

I think I might found something the player coordinate table moves also but only when I change the sky-island by a skyship.
(I wanted to change the region for better mops for yzx coord pure accident)

I suspect that they somewhere under the first object that will be initialized when the game loads the world at the first time, so that the table will at game start always be on the same spot in the pointer table.

I made quick look and yeah its look like it that the base is a big table for pointer but It seems some pointing extremely high in the memory and also start and end are not much clear yet. I will test it more out tomorrow.

[BlubBlab]

Okay the begin of the object list seems to be around at "dp_x64.exe"+01DB0090.
The problem is I didn't find anything with the pointer path that I have for the player to get any valid position.
I think the pointer path is not really good that I have from the player to many possible paths(about 400kk).
With the player coord I hit very soon the limits with the dissembler. I remember I had found some earlier but didn't recognize that it was what I searched with the mops.

At the moment I try to perfect getting the mops address for coordinates which is still hard to do.
I wrote a small lua script for CE but something don't work and I can't find it. The search works only the compare seems somehow not to work:

Code: Select all

function customscan(v1, v2, v3, howmuch)
	local start1 = v1 - howmuch;
	local ende1 = v1 + howmuch;
	local memscan1 = createMemScan()
	local protectionflags = "";
	local foundlist1 = createFoundList(memscan1) 
	memscan1.firstScan(soValueBetween, vtSingle,rtExtremerounded, start1, ende1,
               "0","7fffffff",protectionflags,
               fsmAligned,"4",
               false, false, false, false)
	memscan1.waitTillDone()
	foundlist1.initialize() 
  
	local start2 = v2 - howmuch;
	local ende2 = v2 + howmuch;
	local memscan2 = createMemScan()
	local foundlist2 = createFoundList(memscan2) 
	memscan2.firstScan(soValueBetween, vtSingle,rtExtremerounded, start2, ende2,
               "0","7fffffff",protectionflags,
               fsmAligned,"4",
               false, false, false, false)
	memscan2.waitTillDone()
	foundlist2.initialize() 
  
	local start3 = v3 - howmuch;
	local ende3 = v3 + howmuch;
	local memscan3 = createMemScan()
	local foundlist3 = createFoundList(memscan3) 
	memscan3.firstScan(soValueBetween, vtSingle,rtExtremerounded, start3, ende3,
               "0","7fffffff",protectionflags,
               fsmAligned,"4",
               false, false, false, false)
	memscan3.waitTillDone()
	foundlist3.initialize() 
  
	local result  = {};
	local list1 = {};
	local list2 = {};
	local list3 = {};
	local resultcounter = 0;
	
	for i=0,foundlist1.Count-1 do 
		if(foundlist1.getAddress(i) ~= nil)then
			local adress = string.format("%X",tonumber(foundlist1.getAddress(i),16));
			list1[adress]= foundlist1.getValue(i)
		end
	end
	for i=0,foundlist2.Count-1 do 
		if(foundlist2.getAddress(i) ~= nil)then
			local adress = string.format("%X",tonumber(foundlist2.getAddress(i),16));
			--print(" list 2: "..adress.."");
			list2[adress]= foundlist2.getValue(i)
		end
	end
	for i=0,foundlist3.Count-1 do 
		if(foundlist3.getAddress(i) ~= nil)then
			local adress = string.format("%X",tonumber(foundlist3.getAddress(i),16));
			--print(" list 3: "..adress.."");
			list3[adress]= foundlist3.getValue(i)
		end
	end
	 for key,value in pairs(list1) do
         local keyholder = tonumber(key,16)
		 local m1 = keyholder + 4; -- we add 4 bytes
		 local m2 = keyholder + 8; -- we add 8 bytes (4 more)
		 local s1 = string.format("%X", m1);
		 local s2 = string.format("%X", m2);
		---print("byte1 "..key.." byte2: "..s1.." byte3: "..s2.."");
		 if(list2[s1]~=nil and list3[s2]~=nil)then
			 print("found at adresse: "..key.." value: "..value.."");
			resultcounter = resultcounter +1;
			result[resultcounter] = list1[key];
		 end
     end
	 for key,value in pairs(result) do
           print("found at adresse: "..key.." value: "..value.."");
     end
end

By the way that is the function for a group scan with between values.EDIT: works now

[BlubBlab]

Yeah I have 70th possible pointer paths and all valid....
I got pawn: xzy coord, vec , hp , action points , dragon energy by the way all flot's and not integer.

The advanced options in the pointer search a really helpful.(improve pointer scan with heap data, first element must be module)
Missing of the list: the exact begin and end of the object list, what is it NPC, pawn, player? , name of the pawn.

[Administrator]

Not sure if this is the problem you are running into or not, but you'll probably be unable to read from the 64-bit version of the game using 32-bit MicroMacro.

[BlubBlab]

I think I will found a way around I experimented with a 64bit version of mm2 earlier I maybe need to compile against lua 5.3( or lua 5.2 customized) for full int64 support but it should be working. If everything fails I can extract part of the code of mm2 and built my own MM as windows native/ MS Studio project with lua 5.3

[BlubBlab]

Okay I had a setback the pointer weren't this stable what I hoped and an top of it they pointed in mid of the structure instead of the first element. But I snooped around in the memory first from what I read from RomBot's adresse.lua DP and Rom are very identical with the object structure and DP has also a Lua engine in it(http://dragons-prophet.wikia.com/wiki/Macro_Management) and macros.

Means......even more code copy & past than I expected in DP

EDIT: WOW finally I got it ^^ This time I'm 200% sure I can always change the offset to the next and have always valid object.(there are 0 between each)

I think those 0 are leading for 64-bit pointers. Above E8C0 are I think are counters with the some luck I find the right counter.
The thing why it was so hard was the list is behind a 3 level pointer and when you seek manually you find 24-30x results in which many are in a list or something that look like a list. I only got it with much luck&brain and a custom filter:

Code: Select all

function RescanFilter(base , offsets, target)
	--ignore invalid base maybe we got a 0 this time in the list
	if base == nil then
		return true;
	end
	local basevalue = readInteger(base);
	if basevalue == 0  or basevalue == -1 or basevalue == 2147483647 or basevalue == 4294967295 then
		return true;
	end
	
	if target then
-- find pattern
		local targetvalue = readFloat(target)
		if targetvalue and targetvalue ~= 0 then
			local value2 = readInteger(target + 4)
			--local value3 = readFloat(target + 28);
			--local value4 = readFloat(target + 32);
			--local value5 = readFloat(target + 36);
			if( value2 == 0)then
				return true;
			else
				return false;
			end
		else
			return false;
		end 
	else
		return false;
	end
end

Which by the way weren't built for this xD

[lisa]

grats, sounds like you made a break through =)

[Administrator]

Nice job. I'm glad you decided to share your findings. The more we share around here, the more we progress as a whole.

I still want to check into a 64-bit version for MM but, to be honest, right now I'm pretty much addicted to ArcheAge. Those leading zeroes could be anything though.