For now, this is just for upgrading your gray matter, because there is still a few bugs I need to work out. That and the addresses are for the trial version :ohdear:, don't worry I will update this to CE soon. Just don't try to compile this and run to me when you fail.
The following code is the console command processing function in C++ I reversed straight from Halo's engine in assembly. OllyDbg was used for the analyzation. I commented on most of the code so others can understand it better.
The main problem I am having is with the Cmd parameter. It is not pushed on the stack before this function is called, it is moved into the EDI 32-bit register. There is no way to specify which parameter uses which register and no calling convention that I am aware of uses EDI like this. Just seems like a compiler optimization, which is why I added the simple fix at the beginning. I was hoping someone like kornman00 had advice on something like this.
I also think my GetScriptIndex function proto is not correct. The first 3 params are also moved into registers, if I remember correctly. If anyone can help me fix up bugs, awesome. :downs:
I know reversing this entire function was not really necessary, I did it for knowledge of how it works and what is going on and to share it with others. I also can't get enough of what I do in my free time, I love reversing code! :eng101:
// Compares the first and second character of Cmd string against characters it doesn't like
if(*Cmd != ';' && *Cmd != '#' && (*Cmd != '/' || *(Cmd + 1) != '/'))
{
// Copy Cmd string into another variable, w/o null-terminating character
// unless the amount of characters in Cmd is less than 255
strncpy(Dest, Cmd, 255);
// Check if there is a space character in the Cmd string
// If there is a space, return a pointer to the first occurrence
// and put a null terminating character there
char* SpaceResult = strchr(Dest, ' ');
if(SpaceResult)
*SpaceResult = 0;
/* Once entered, commands are stored. Previously entered cmds can be accessed
using the UP/Down arrow keys. Max is 8. */
// Updates the index number of the last command stored
// so we can store our command string in the right address
// Max stored commands is 8
short StoreIndex = *LastCmdIndex;
StoreIndex = (StoreIndex + 1) % 8; // modulo-n counter. sheer awesomeness.
if(StoreIndex < 0)
StoreIndex = 0;
*LastCmdIndex = StoreIndex;
// Gets the address where our Cmd is stored and copies it there
// Each stored element is max 255 characters
char* CmdStoreAddress = &StoredCmds[StoreIndex];
strncpy(CmdStoreAddress, Cmd, 255);
// Updates the amount of stored commands
// Once it reaches the max(8), it will always be that way
short Count = *StoredCmdsCount;
Count++;
*StoredCmdsCount = 8;
if(Count <= 8)
*StoredCmdsCount = Count;
// We are no longer cycling through the stored index, reset it
*ListedCmdIndex = -1;
// Searches list of scripts and returns an index to it
// Not found? Invalid command.
int ScriptIndex = GetScriptIndex(Dest, UnkFunc(Num), 256, 0x28, &Base);
if(ScriptIndex <= 0)
{
BAD_CMD:
// Invalid console command, draw some output text
ConsoleTxt(0, "Requested function \"%s\" cannot be executed now.", Dest);
return false;
}
else
{
// Compares inputed Cmd against script
while(_stricmp(Dest, (const char*)(&Base + (ScriptIndex * sizeof(int)))))
{
--ScriptIndex;
if(ScriptIndex <= 0)
goto BAD_CMD;
}
// Not sure what the unknown is yet, but this runs the known script command
*pUnknown = 1;
bool bResult = ScriptCmd(Cmd);
*pUnknown = 0;
return bResult;
}
}
else
return false;
}
Is anyone interested in making an app to allow you to run multiple instances of Halo? Would it be useful to you?
Some gamers, like me, find it useful to be able to run multiple instances of a game. Extremely so when you don't have a partner to help you reverse! Pretty much all games add this check to make sure you don't open an instance of it more than once. I'm sure there is more than one method of these checks, but so far I have seen the same exact method in a few games. It's very simple and easy to bypass. I'm not gonna go into details really, except show you what they are doing and what extra steps to take. After all, it is a few simple NOP's and changing a profile path.
Before the game window is created, it creates a named mutex with CreateMutex() for all the processes running on your system. If the function fails, that means that there is already a process running that created a mutex with that name and returns a handle to the existing object.
If the function succeeded, the FindWindow() function is called with the class and game title. If the function fails, it means there is another process instance with those names.
The check for Halo looks like this in C++:
Here's what it looks like in OllyDbg: http://img10.imageshack.us/img10/1481/procn.jpg
See how easy that check is? Well, you should know what to do from there Mr. Coder.
But WAIT. I thought I was done there, but nope. Whenever you start Halo, it auto loads the last profile used and then puts your saved games folder in use. To fix it, search for the string in OllyDbg of the path your saved games folder is set to and change it to something else like Gaylo.
Oh yea, if you want to play multiplayer, you will have to run the games on separate ports, usually done through command line parameters. For changing the client port, you would need to use ‘-cport 1234′. Of course, ‘1234′ could be any port number.
Thats all there is to it, thanks for reading. Hope it helps some of you.
September 20th, 2009, 01:23 PM
Skarma
cheat_spawn_warthog
This is the cheat_spawn_warthog console command, in C++. This is reversed from assembly in Olly and is exactly how Halo does it. Some of the types you might not recognize, if you need them I'll post them. Address for Halo PC 1.08
With a valid TagReference, you can spawn ANY object with SpawnObject() function, not just a warthog. :downs:
September 20th, 2009, 01:28 PM
Skarma
Console Text Output Guide
E: Outdated, I've updated my methods since then, but I decided to post anyway since it's very informational.
Console Output using Halo Engine By: Skarma September 05, 2008 ----------------------------------------------------------------- Using Halo engine to draw console text http://img204.imageshack.us/img204/7944/halotextzj0.png Console output using Halo engine Prologue
This is a short reference guide on how Halo outputs messages for the console and how to hook it so you can do it youself. The examples given will be in Assembly and C++. Programming experience is required to follow along, although it is still a good read. I will be showing pictures of disassembly with comments to the side, so you can see a more visual of what's happening. Where to start
There are other text output functions in Halo, but I will be focusing on just one. The most common used one is the console output. If you have ever used console or devmode, you know what I am refering to. "Requested function "%s" cannot be executed now." is probably the most common string you will see, since it always outputs when a console or devmode command is not valid.
If you don't already know how to use console, you will need to edit the Halo desktop shortcut and add a command line parameter to enable it. To do so, create a shortcut to "halo.exe" on your desktop if you have not done so already. Right click the shortcut and click on Properties. A new window will pop up and you will see an edit box field named Target, which we will be editing. To enable console, you will need to add -console at the end of the Target box, after the quotes. Put a space between each parameter that you add. When I am working with Halo and I need to access tools, I also add -window as a parameter which will run Halo in a window every time I start it with the shortcut.
For a full list of argument, visit: http://hce.halomaps.org/index.cfm?nid=309.
To open / close console, press the Tilde ( ~ ) key anytime that Halo is open. To output the string I mentioned earlier, just type in some random text into the console box and press enter. I will not be using this string as a reference point, since is a different text out function that I don't personally like. I will be using the string "sv_kick is a server-only function!". You move a color into a register before calling it, which is why I like it. I use a debugger called OllyDbg to analyze binary code, which I will using in this guide for Halo. If you don't already have it you can download it at the official website: http://www.ollydbg.de/. I am already assuming you know how to use a debugger, so unfortunatly I will not be going over that subject. Let's move on. Finding the console output function
Let's start by attaching Halo to OllyDbg. If you have a version of Halo before 1.08 and it has SafeDisc ( no crack ), you will need to reset the debug port, which is an anti debug protection SafeDisc uses. It's a simple detection, but there are tools on the net to bypass this. I like using HelioS Debug Reset. Fortunately for us, the 1.08 patch removed this protection and allows you to play with no cd.
Once attached, open Executable Modules and double click halo.exe a few times to open it in the CPU window. Right click in the CPU window and select Search for > All referenced text strings. Once in the reference window, right click and select Search for text. We need to find the string we will be referencing from, so just type in sv_kick is and click OK. It will bring you to the string we need, which was "sv_kick is a server-only function!". Hit Enter or double click it to see it in the CPU window. Examine the function
The address for Halo 1.08 is 0x004E3C85, where this string is pushed on the stack. Let's examine the code. http://img530.imageshack.us/img530/573/ollymm4.png
I have commented out the above disassembly, which tells exactly what is happening. This is the regular procedure of outputting console text. When formatted arguments are added, they are also pushed on the stack before the text function is called, but we won't be dealing with that since we can format a string in our code before we push it on the stack.
You can see above that they are pushing a colour from a static address in memory. If you go to that address in RAM hex editor, you will see an array of floating point values in the format of ARGB ( Alpha, Red, Green, Blue ). You will also notice that it is 1.0f, 1.0f, 0.0f, 0.0f which is Red, the colour of the string when it is outputted to the Halo screen. This is how I figured out that this was the colour. Usually, colour values are in the range from 0 to 255. Well, this is the same thing, but using floats. If you have a colour value in this range, you can do an easy conversion: float value = range / 255.
After the colour is moved to EAX, the string is pushed on top of the stack, then the console output function is called, followed by a stack balance. If you don't balance out the stack, the game will just crash.
Pretty simple huh? Let's continue on and put it to good use! Recreating the function in C++
I like using DLL projects, because you can directly work with the process once you have it injected into the process space. The benefits are not having to use any Windows memory API's like WriteProcessMemory, which are slow. Instead we can use pointers, since we have direct access to the process, which is more efficient in the end.
In C++, you can use the __asm keyword to write inline assembly, just like what we see in a debugger. I will be using this to recreate our function. We don't need to return anything, so our function will be of a void type. I want to be able to use custom colours. Let's use a float array of 4 elements for our color parameter ( remember ARGB? ). We also need to pass a string, which is in ASCII, so I will use a pointer to a char. The function I use looks exactly like this:
We need to create a function prototype and an instance so we can detour this function in Halo to our recreated function. This is also called hooking. oTextOut will be a call to the original function.
Detouring
The word detouring is exactly what it means. We detour something. In this case we are detouring the original console output function to our function, which will then call the original. There are a few ways of doing this. You can use Microsoft Detours Library, which is free to download. In the most recent library version is the function DetourAttach, which accomplishes what we need. In the old detours library, the function was called DetourFunction, which ultimately does the same exact thing. The other way we could do it is write our own detour function, so we do not need to include any extra files. I choose to write my own, which I will share with you:
The length is usually 5 or 6 bytes, depending on the disassembly. This just inserts a JMP from the original code to our function so each time it gets called, it will "detour" to ours. The alternate way to do this would be to write a code cave, which is best when writing a normal Windows Application, but this is not needed since we have direct access. Page Protection & Calling our output function
Like most binary executables, it is write protected, which means we cannot modify any code in memory, so calling our DetourFunc will not do anything and most likely crash the game or our application. We need to change the access protection of the region we are modifying. The VirtualProtect API is just fine for doing this. After we are done, we should put the original protection back, just in case. While we have access we need to call our the console output function before setting the original protection. I wrote the below function for drawing text to minimize the task to something very, very simple. The detouring and page protection is all done for you when you call it.
Note: When detouring the text function, we need to write the original bytes back. If you enter in a console command while the function is detoured, the game will crash. In the below function I declare the original bytes and write them after I am done drawing text and before I change back the original page protection.
These are just examples. I explained earlier how to do a conversion from those 0 to 255 values. Let's call our function!
Code:
hkDrawText( "I am drawing text! Woo!", fGreen );
That's it! If you want to format you string with additional arguements, you can use sprintf function in the fstream header like so:
Code:
char buf[256]; // will hold our formatted string
int a = 2; // an argument I am adding
sprintf(buf, "This is example %i with blue text!", a); // format our string
hkDrawText(buf, fBlue); // draw
Epilogue
This ends the draw text guide. I hope it was as exciting for you as it was for me!
-------------------------------------------------------------------------------------------------------
I have hooked 2 functions that can draw text like console output through Halo's Engine! I don't feel like explaining how it's all done, but I will just provide the source code here as an example of how to do it in C++/inline asm. One draws gray text and one draws white text.
Skyline edited this method too to allow spawning of other vehicles for our OS code.
E.g.
(dont mean to steal thread skarma :))
September 20th, 2009, 01:31 PM
chrisk123999
Re: Console Text Output Guide
Doesn't the print command do the same thing? Although it doesn't work in-game...
It works in sapien.
September 20th, 2009, 01:33 PM
Skarma
Re: cheat_spawn_warthog
Wow, nice. Glad you got the code to work and glad someone found it useful! w00t
I didn't realize I posted this on alot of forums, didn't know anyone even seen it lol
September 20th, 2009, 01:35 PM
Skarma
Re: Console Text Output Guide
Quote:
Originally Posted by chrisk123999
Doesn't the print command do the same thing? Although it doesn't work in-game...
It works in sapien.
I bet you the print command doesn't have text formatting, custom colors and changable coordinates...
September 20th, 2009, 01:39 PM
Limited
Re: cheat_spawn_warthog
Quote:
Originally Posted by Skarma
Wow, nice. Glad you got the code to work and glad someone found it useful! w00t
I didn't realize I posted this on alot of forums, didn't know anyone even seen it lol
Oh well, we didnt really use your code/work, Skyline worked it out himself. Although you did tell me it was possible on MSN at the time :D
September 20th, 2009, 01:40 PM
FRain
Re: cheat_spawn_warthog
Hey, Skarma, this is great stuff, but could you please put this into one thread and not 35,001,412 threads?
September 20th, 2009, 01:41 PM
Skarma
Re: cheat_spawn_warthog
Quote:
Originally Posted by Limited
Oh well, we didnt really use your code/work, Skyline worked it out himself. Although you did tell me it was possible on MSN at the time :D
Well, shit on a stick. My bad. Back to hopelessness...:haw:
Quote:
Originally Posted by FRain
Hey, Skarma, this is great stuff, but could you please put this into one thread and not 35,001,412 threads?
too late =p
September 20th, 2009, 01:41 PM
chrisk123999
Re: Console Text Output Guide
No, but I was just saying.
September 20th, 2009, 01:44 PM
Limited
Re: Halo Multiple Instances
I looked into this for testing purposes, but I was looking at the CreateWindowExA API, thinking that around it, would be the check to see if process was already running, didnt realise Halo used the MutexA API.
Nice work.
The issue I had also, was I kept corrupting Halo's exe, is there a way to bypass the protection?
September 20th, 2009, 01:51 PM
Skarma
GBXModel Rendering Info
Address are for Halo PC 1.08. Just some rendering code for Halo. There are so many more functions for rendering, but gotta start somewhere.
These structs are from the GBXModel tag in the Halo map files. They describe every model in that map and needed for rendering models. Reversed using MHS, Olly, and Guerilla(Bungie's tag editor).
A function that does some if statements and calls different render functions, I have only done one out of five or six here, so this function is not even near complete, because I have to reverse 6 other functions to finish this one ><
A function that renders a model. It is missing a chunk of code because it was some advanced assembly that changed the vertex processing mode based on the stride count(?). Other than that, it is complete and untested lol. Also, it can't render more than 10,000 primitives at once, or at least it doesn't want you to, so it loops and renders in chunks if it is greater.
Code:
HRESULT RenderModel(unsigned int PrimitiveCount, GBXModel_Geometries_Parts_Vertices* VerticeInfo, GBXModel_Geometries_Parts_Indices* IndiceInfo)
{
unsigned short Stride;
D3DPRIMITIVETYPE PrimitiveType;
unsigned int PrimCount;
unsigned int StartIndex = 0;
while(PrimitiveCount > 0)
{
if(!IndiceInfo)
break;
if(!IndiceInfo->pIndexData)
break;
if(!VerticeInfo)
break;
if(!VerticeInfo->pStreamData)
break;
Do you think you could maybe keep these to one thread?
September 20th, 2009, 01:56 PM
Limited
Re: Console Text Output Guide
Ah yeah, thinks is the method Omega used for his version changer.
September 20th, 2009, 03:15 PM
king_nothing_
Re: Halo Multiple Instances
I would be interested in such an app, as I have two copies of Halo and two monitors. I've tried to figure out a way to do it in the past but was never able to.
September 20th, 2009, 03:47 PM
Pyong Kawaguchi
Re: Halo Multiple Instances
If It would be possible to dedicate another keyboard/mouse combo to the other window, that would be great aswell.
September 20th, 2009, 05:31 PM
Aßyll
Re: Halo Multiple Instances
Another option for running multiple instances of ANYTHING I've found is Sandboxie. I tested it with Halo a bit, and I got 2 instances to start up easily. The first one I ran started a LAN server just fine, the second didn't seem to want to work. I think there are a few more inherit issues with 2 instances of halo sharing resources - namely .map files, and maybe network shtuff.
September 20th, 2009, 05:34 PM
Skarma
Re: Halo Multiple Instances
To fix the network problem, you just have to change the client ports through the command line parameters, like in my first post.
September 20th, 2009, 06:54 PM
Choking Victim
Re: GBXModel Rendering Info
This is some pretty cool research, have you seen anything that would cause this problem:
If a model has vertices weighted to > 41 nodes, then the vertices will stretch.
I could give you examples if you want.
September 20th, 2009, 07:42 PM
Skarma
Re: GBXModel Rendering Info
Quote:
Originally Posted by Choking Victim
This is some pretty cool research, have you seen anything that would cause this problem:
If a model has vertices weighted to > 41 nodes, then the vertices will stretch.
I could give you examples if you want.
Nope, I did this research a long time ago. If you could tell me where in the model structures this value is located, I could check it out. I barely know anything about modeling, just some direct3d stuff which helped greatly with this. Is a node another name for a single vertex?
September 20th, 2009, 07:44 PM
Advancebo
Re: GBXModel Rendering Info
A node is like the central point of activity. Like the bones on the cyborg model, that controls the arms, legs, and body movement. Or the frames on a warthog, that controls the wheels, suspension, and chaingun.
September 20th, 2009, 07:54 PM
Skarma
Re: GBXModel Rendering Info
Gotcha. Well, I really need to reverse more model functions so I can figure out stuff for my Forge project. I'll post all my research in this thread. I just need a bit more info to hunt down your problem asap.
September 20th, 2009, 09:26 PM
Dwood
Re: [Info]Console Command Function
Must_spread_rep.
September 20th, 2009, 10:48 PM
FRain
Re: [Info]Console Command Function
Dude, keep it to one thread!
September 20th, 2009, 10:52 PM
Con
Re: [Info]Console Command Function
Skarma you are just awesome
September 21st, 2009, 07:10 PM
Con
Re: [INFO] Reverse Engineering References
Skarma, post all future information in this thread and edit the OP to include a link to that post. This way we can keep all of your information together under one release thread and people wont have to go searching for each one.
edit: If you want me to give the thread a better name, just let me know.
September 22nd, 2009, 12:49 PM
FireScythe
Re: [INFO] Reverse Engineering References
This reminded me of a program I made to automatically build tag definitions from guerilla exported text files. It was originally built for kornmans old C# tag interface, but i've repurposed it to build definitions for OS. So the output isn't quite what you need but it might help somewhat.
Things to note though, it doesn't put any pads or flag/enum values and it doesn't check for duplicate names. No error checking and such either, so no guarantees or warranties :P. Link.
Use empty/new tags when you export from guerilla, and its best to not export from guerilla with one of every block and sub block added as guerilla crashes if you do.
Typical I/O:
In
Code:
biped untitled
3
flags word flags 0
bounding radius real 0.000000
bounding offset real point 3d 0.000000 0.000000 0.000000
origin offset real point 3d 0.000000 0.000000 0.000000
acceleration scale real 0.000000
model tag reference mod2
animation graph tag reference antr
collision model tag reference coll
physics tag reference phys
modifier shader tag reference shdr
creation effect tag reference effe
render bounding radius real 0.000000
A in enum none
B in enum none
C in enum none
D in enum none
hud text message index short integer 0
forced shader permuation index short integer 0
attachments block 1
element 0
type tag reference ÿÿÿÿ
marker string
primary scale enum none
secondary scale enum none
change color enum none
end element 0
widgets block 1
element 0
reference tag reference ÿÿÿÿ
end element 0
functions block 1
element 0
flags long flags 0
period real 0.000000
scale period by enum none
function enum one
scale function by enum none
wobble function enum one
wobble period real 0.000000
wobble magnitude real 0.000000
square wave threshold real fraction 0.000000
step count short integer 0
map to enum linear
sawtooth count short integer 0
add enum none
scale result by enum none
bounds mode enum clip
bounds fraction bounds 0.000000 0.000000
turn off with short block index NONE -1
scale by real 0.000000
usage string
end element 0
change colors block 1
element 0
darken by enum none
scale by enum none
scale flags long flags 0
color lower bound real rgb color 0.000000 0.000000 0.000000
color upper bound real rgb color 0.000000 0.000000 0.000000
permutations block 1
element 0
weight real 0.000000
color lower bound real rgb color 0.000000 0.000000 0.000000
color upper bound real rgb color 0.000000 0.000000 0.000000
end element 0
end element 0
predicted resources block 1
element 0
type enum bitmap
resource index short integer 0
tag index long integer 0
end element 0
flags long flags 0
default team enum none
constant sound volume enum silent
rider damage fraction real 0.000000
integrated light toggle tag reference effe
A in enum none
B in enum none
C in enum none
D in enum none
camera field of view angle 0.000000
camera stiffness real 0.000000
camera marker name string
camera submerged marker name string
pitch auto-level angle 0.000000
pitch range angle bounds 0.000000 0.000000
camera tracks block 1
element 0
track tag reference trak
end element 0
seat acceleration scale real vector 3d 0.000000 0.000000 0.000000
soft ping threshold real 0.000000
soft ping interrupt time real 0.000000
hard ping threshold real 0.000000
hard ping interrupt time real 0.000000
hard death threshold real 0.000000
feign death threshold real 0.000000
feign death time real 0.000000
distance of evade anim real 0.000000
distance of dive anim real 0.000000
stunned movement threshold real 0.000000
feign death chance real 0.000000
feign repeat chance real 0.000000
spawned actor tag reference actv
spawned actor count short integer bounds 0 0
spawned velocity real 0.000000
aiming velocity maximum angle 0.000000
aiming acceleration maximum angle 0.000000
casual aiming modifier real fraction 0.000000
looking velocity maximum angle 0.000000
looking acceleration maximum angle 0.000000
AI vehicle radius real 0.000000
AI danger radius real 0.000000
melee damage tag reference jpt!
motion sensor blip size enum medium
NEW HUD INTERFACES block 1
element 0
unit hud interface tag reference unhi
end element 0
dialogue variants block 1
element 0
variant number short integer 0
dialogue tag reference udlg
end element 0
grenade velocity real 0.000000
grenade type enum human fragmentation
grenade count short integer 0
powered seats block 1
element 0
driver powerup time real 0.000000
driver powerdown time real 0.000000
end element 0
weapons block 1
element 0
weapon tag reference weap
end element 0
seats block 1
element 0
flags long flags 0
label string
marker name string
acceleration scale real vector 3d 0.000000 0.000000 0.000000
yaw rate real 0.000000
pitch rate real 0.000000
camera marker name string
camera submerged marker name string
pitch auto-level angle 0.000000
pitch range angle bounds 0.000000 0.000000
camera tracks block 1
element 0
track tag reference trak
end element 0
unit hud interface block 1
element 0
unit hud interface tag reference unhi
end element 0
hud text message index short integer 0
yaw minimum angle 0.000000
yaw maximum angle 0.000000
built-in gunner tag reference actv
end element 0
moving turning speed angle 0.000000
flags long flags 0
stationary turning threshold angle 0.000000
A in enum none
B in enum none
C in enum none
D in enum none
DON'T USE tag reference jpt!
bank angle angle 0.000000
bank apply time real 0.000000
bank decay time real 0.000000
pitch ratio real 0.000000
max velocity real 0.000000
max sidestep velocity real 0.000000
acceleration real 0.000000
deceleration real 0.000000
angular velocity maximum angle 0.000000
angular acceleration maximum angle 0.000000
crouch velocity modifier real 0.000000
maximum slope angle angle 0.000000
downhill falloff angle angle 0.000000
downhill cutoff angle angle 0.000000
downhill velocity scale real 0.000000
uphill falloff angle angle 0.000000
uphill cutoff angle angle 0.000000
uphill velocity scale real 0.000000
footsteps tag reference foot
jump velocity real 0.000000
maximum soft landing time real 0.000000
maximum hard landing time real 0.000000
minimum soft landing velocity real 0.000000
minimum hard landing velocity real 0.000000
maximum hard landing velocity real 0.000000
death hard landing velocity real 0.000000
standing camera height real 0.000000
crouching camera height real 0.000000
crouch transition time real 0.000000
standing collision height real 0.000000
crouching collision height real 0.000000
collision radius real 0.000000
autoaim width real 0.000000
contact points block 1
element 0
marker name string
end element 0
The only thing holding me back from using it. In Guerilla, some of the variable names are cutoff, so I might use it for those. I'm OCD when it comes to getting struct member offsets correct, which is why I like doing it manually and double check everything. I was even thinking about making a function to compare my struct sizes to the actual structs sizes, just to be sure I didn't miss anything lol!
I got a weird system going on for reversing tags lol First I open Halo CE and start a server. Then I use a function I wrote that iterates through the map tag index thats loaded in virtual memory and prints out the addresses of every tag of a specified taggroup and it's tag path. Then I open a tag group I want to reverse in Guerilla and go to the address in a memory hex editor that was printed out for the equivelent tag I opened in guerilla. The reason I don't just view the tags in a binary hex editor, is because guerillas tag format is not the same as when its compiled into the map and makes it confusing. Plus seeing where the pointers actually point to in memory is very helpful, I don't have to go using magic algos, I can just go to the pointer address.
For finding unknowns and padding, I changed variables in guerilla, saved the tag as a different name, then open both tags in a binary hex editor and switch back and forth looking for the changes lol. The way I do it is actually quite efficient for me even though it sounds rough
I've reversed quite a few tags already, it's just a slow process when there are so many different tags and tag blocks. I will post all completed ones.
Thanks for the info and app FireScythe. It will come in handy. Maybe you want to help with my Forge project, seeing as you are a very good coder. :downs: or maybe not
September 22nd, 2009, 03:23 PM
FireScythe
Re: [INFO] Reverse Engineering References
Well it's not meant to be a one click and your done, just a way to get a basic structure so you can fill in the blanks, without having to type and format everything yourself.
Quote:
Maybe you want to help with my Forge project, seeing as you are a very good coder. :downs: or maybe not.
Well i'm still busy working with OS (Post processing stuff) so I haven't the time for other projects (plus i'm probably not at the skill level you think i am :P).
October 8th, 2009, 02:08 AM
Skarma
Re: [INFO] Reverse Engineering References
This function was one I didn't care to reverse, but it caught my attention of some reason or another. This function is called in the player nametags function(as well as many other functions). I'm working on the nametags function because it has the engine world space to screen space, which I'm using for CE Forge. I will be posting that next when it's done. This is for Halo CE 1.08.
Thnx to OllyDbg, IDA Pro, Hexrays, and Kornman00.
Needed structs/globals:
Code:
typedef signed int int32; typedef unsigned int uint32;
typedef signed short int16; typedef unsigned short uint16;
typedef signed char int8; typedef unsigned char uint8;
CPU Disasm
Address Command
0043F290 PUSH EBX
0043F291 XOR EBX,EBX
0043F293 CMP EAX,-1
0043F296 JE 0043F325
0043F29C MOV ECX,DWORD PTR DS:[816D04]
0043F2A2 AND EAX,0000FFFF
0043F2A7 SHL EAX,5
0043F2AA PUSH ESI
0043F2AB MOV ESI,DWORD PTR DS:[ECX+EAX+14]
0043F2AF TEST ESI,ESI
0043F2B1 JE SHORT 0043F320
0043F2B3 MOV ECX,DWORD PTR DS:[ESI+54]
0043F2B6 TEST ECX,ECX
0043F2B8 PUSH EBP
0043F2B9 JLE SHORT 0043F300
0043F2BB MOVSX EAX,WORD PTR SS:[Arg1]
0043F2C0 CDQ
0043F2C1 IDIV ECX
0043F2C3 MOV EBP,DWORD PTR DS:[ESI+58]
0043F2C6 MOV ECX,EDX
0043F2C8 SHL ECX,6
0043F2CB MOV AX,WORD PTR DS:[EBP+ECX+22]
0043F2D0 ADD ECX,EBP
0043F2D2 TEST AX,AX
0043F2D5 JLE SHORT 0043F2E6
0043F2D7 MOVSX EBP,AX
0043F2DA MOVSX EAX,DI
0043F2DD CDQ
0043F2DE IDIV EBP
0043F2E0 ADD DX,WORD PTR DS:[ECX+20]
0043F2E4 JMP SHORT 0043F2FA
0043F2E6 MOV EAX,DWORD PTR DS:[ECX+34]
0043F2E9 TEST EAX,EAX
0043F2EB JE SHORT 0043F300
0043F2ED MOV EAX,DWORD PTR DS:[ECX+38]
0043F2F0 MOVSX EDX,DI
0043F2F3 SHL EDX,5
0043F2F6 MOV DX,WORD PTR DS:[EAX+EDX]
0043F2FA CMP DX,0FFFF
0043F2FE JNE SHORT 0043F302
0043F300 MOV EDX,EDI
0043F302 TEST DX,DX
0043F305 POP EBP
0043F306 JL SHORT 0043F320
0043F308 MOV ECX,DWORD PTR DS:[ESI+60]
0043F30B MOVSX EAX,DX
0043F30E CMP EAX,ECX
0043F310 JGE SHORT 0043F320
0043F312 MOV ECX,DWORD PTR DS:[ESI+64]
0043F315 LEA EAX,[EAX*2+EAX]
0043F318 SHL EAX,4
0043F31B POP ESI
0043F31C ADD EAX,ECX
0043F31E POP EBX
0043F31F RETN
0043F320 POP ESI
0043F321 MOV EAX,EBX
0043F323 POP EBX
0043F324 RETN
0043F325 MOV EAX,EBX
0043F327 POP EBX
0043F328 RETN
October 16th, 2009, 11:46 PM
Skarma
Re: [INFO] Reverse Engineering References
This function was reversed from Halo CE 1.08 using OllyDbg, IDA Pro, Hexrays and my brain.
This function clears a surface that can be a render target, a stencil buffer, or a depth buffer. Refer to IDirect3DDevice9 interface documentation on MSDN for more information on the Direct3d functions.
Note: pDevice should be the global device, defined outside of this function, but for no-compile error sake, I just threw it in there.
Reversed from Halo CE 1.08 using OllyDbg, IDA Pro, Hexrays, and msdn.
This function releases resources used in Halo rendering code. There is a total of 9 textures and surfaces. Halo only uses one vertex buffer and one index buffer for optimization. They pack as much object data in one buffer, instead of creating one for each object or whatever.
Reversed from Halo CE 1.08 using OllyDbg, IDA Pro, Hexrays, and msdn.
Creates a CRC table from all 256 possible ASCII characters. The only argument used in this function in Halo CE 1.08 is 0x00652968, where the table is stored. This is called only once when Halo first loads up.
The byte at 0x006B4CA0 is set to 1 after the Crc table is initialized.
Reversed from Halo CE 1.08 using OllyDbg, IDA Pro, Hexrays, and msdn.
Calculates a Crc32 from the inputed buffer, the buffer length, and the current Crc32 value. It first checks if a Crc32 lookup table has been created, then uses it in calculating the Crc32.
memset((void*)CacheAddress, 0, sizeof(DataHeader));
strncpy_s((char*)CacheAddress, 31, CacheName, 31);
//Sub005C8DA0(CacheAddress, CacheName, 31);
// Actual call^, IDA says it's stncpy.
// When compared in olly, they look similar and achieve same results
// Guess they wrote their own strncpy func? heh
Reversed from Halo CE 1.08 using OllyDbg, IDA Pro, Hexrays, and msdn.
Initializes the player data caches, including those without data headers. I provided a bunch of the needed structs, only thing extra you will need is CRC stuff from my other posts.
Code:
//----- (004763C0) --------------------------------------------------------
struct Identity
{
union
{
uint32 Ident;
struct
{
int16 Index;
int16 Salt;
};
};
};
struct DataHeader
{
unsigned char Name[32];
WORD Max;
WORD Size;
bool IsValid;
bool IdentifierZeroInvalid;
WORD Padding;
DWORD Signature;
short NextIndex;
short LastIndex;
Identity Next;
DWORD First;
};
struct Players
{
short PlayerID;
short IsLocal; // 0=Local(no bits set), -1=Other Client(All bits set)
wchar_t Name[12]; // Unicode
Identity UnknownIdent;
long Team; // 0=Red, 1=Blue
Identity SwapObject;
short SwapType;
short SwapSeat; // Warthog-Driver=0, Passenger=1, Gunner=2, Weapon=-1
long RespawnTimer; // Counts down when dead, Alive=0
long Unknown;
Identity CurrentBiped;
Identity PreviousBiped;
long ClusterIndex;
Identity UnknownIdent1;
long LastBulletShotTime; // since game start(0)
wchar_t Name1[12];
Identity UnknownIdent2;
long PlayerInfo;
long Unknown1;
float VelocityMultiplier;
Identity UnknownIdent3[4];
long Unknown2;
long LastDeathTime; // since game start(0)
char Unknown3[18];
short KillsCount;
char Unknown4[6];
short AssistsCount;
char Unknown5[8];
short BetrayedCount;
short DeathCount;
short SuicideCount;
char Unknown6[18];
short FlagStealCount;
short FlagReturnCount;
short FlagCaptureCount;
char Unknown7[6];
Identity UnknownIdent4;
char Unknown8[8];
short Ping;
char Unknown9[14];
Identity UnknownIdent5;
long Unknown10;
long SomeTime;
float World[3];
Identity UnknownIdent6;
char Unknown11[20];
char Melee : 1;
char Swap : 1;
char UnknownBit : 1;
char Flashlight : 1;
char UnknownBit1 : 4;
char UnknownBit2 : 5;
char Reload : 1;
char UnknownBit3 : 2;
char Unknown12[26];
float Rotation[2];
float VerticalVelocityMultiplier;
float HorizontalVelocityMultiplier;
float RateOfFireVelocityMultiplier;
char Unknown13[180];
};
Halo uses frustum culling on sphere bounding volumes to determine object visibility. There is a sphere-tree in memory I found that contains all the necessary information to determine if an object is completely outside, partially inside, or completely inside the view frustum. All the frustum plane normals and positions are calculated and filled into the sphere-tree before the object rendering code is even called, not sure exactly how or where yet.
The sphere-tree is located at memory address 0x0075E2B0 for Halo CE 1.08, if you want to check it out. It is an array of 128? possible sphere volumes. The format is this:
Note: The plane normals, plane positions, and unknown reals are quaternions. There is a total of 6 planes in the view frustum.
