Offset Finding Methods - Revision history

Mithaldu: /* map offset */ - made more clear

2009-10-02T10:11:17Z

map offset: - made more clear

Mithaldu: /* Tools */ - made link to cheat engine correct

2009-10-02T10:10:12Z

Tools: - made link to cheat engine correct

Bartavelle at 13:30, 30 June 2009

2009-06-30T13:30:52Z

Mithaldu: /* map offset */

2009-01-19T00:24:28Z

map offset

Mithaldu: /* Tools */

2009-01-19T00:16:37Z

Tools

Mithaldu: New page: ==Tools== Process Table Access (i.e. Win32::Process::List in Perl) Memory Access (i.e. Win32::Process::Memory in Perl; ReadProcessMemory in C++) Cheat Engine: http://www.websiteweather.c...

2009-01-19T00:16:14Z

New page: ==Tools== Process Table Access (i.e. Win32::Process::List in Perl) Memory Access (i.e. Win32::Process::Memory in Perl; ReadProcessMemory in C++) Cheat Engine: http://www.websiteweather.c...

New page

==Tools==

Process Table Access (i.e. Win32::Process::List in Perl)
Memory Access (i.e. Win32::Process::Memory in Perl; ReadProcessMemory in C++)
Cheat Engine: http://www.websiteweather.com/

==how to identify version==

The PE header timestamp is set each time the executable is compiled and is thus unique for each release. It can be consistently found with a few simple steps and thus is far superior in version identification than any other attribute of the DF executable. The steps are as follows:

* get process table, find DF process
* get executable path from process table
* open DF executable in binary mode, confirm first two bytes are "MZ"
* read long at offset 0x3C, this is the PE header offset
* read 2 bytes at PE header offset, confirm they are "PE"
* read long at PE header offset + 0x08, this is the compilation timestamp

==map offset==

* start on map with boulder in top left corner
* note distance to top and left. offset of this tile in tile type block is ( 2 * ( ( x_dist * 16 ) + y_dist ) )
* find all 2 byte values with 0x0192 in CE
* channel out boulder
* click next scan to find all those that changed to 0x0020, should return 1 result; that is offset of type of tile that was just channeled out
* subtract offset of tile in tile type block from overall offset of tile type; this is offset of tile type in tile data block
* subtract 0x007A from that; this is offset of tile data block (if not, first 4-byte offset before the "FF FF 00 00" block in the tile data header)

!!NOT COMPLETE!!

[[Category:Guides]] [[Category:Hacking]]

@@ Line 3: / Line 3: @@
 * Process Table Access  (i.e. Win32::Process::List in Perl)
 * Memory Access (i.e. Win32::Process::Memory in Perl; ReadProcessMemory in C++)
-* Cheat Engine: http://www.websiteweather.com/
+* Cheat Engine: http://www.cheatengine.org/
 ==how to identify version==

← Older revision		Revision as of 13:30, 30 June 2009
Line 30:		Line 30:
	Next step: Identify start and end of the array of tile data blocks in the chosen vertical column.		Next step: Identify start and end of the array of tile data blocks in the chosen vertical column.

		+	==Economy status==
		+	Find the function using the string "Stocks". It should look like that:
		+	<pre>
		+	mov ebx, offset "Stocks"
		+	mov eax, offset
		+	call something
		+	cmp offset_economy, 0
		+	</pre>

	[[Category:Guides]] [[Category:Hacking]]		[[Category:Guides]] [[Category:Hacking]]

← Older revision		Revision as of 00:24, 19 January 2009
Line 27:		Line 27:

	!!NOT COMPLETE!!		!!NOT COMPLETE!!
		+
		+	Next step: Identify start and end of the array of tile data blocks in the chosen vertical column.


	[[Category:Guides]] [[Category:Hacking]]		[[Category:Guides]] [[Category:Hacking]]

@@ Line 20: / Line 20: @@
 * start on map with boulder in top left corner
 * note distance to top and left. offset of this tile in tile type block is ( 2 * ( ( x_dist * 16 ) + y_dist ) )
-* find all 2 byte values with 0x0192 in CE
+* find all 2 byte values with 0x0192 in Cheat Engine
 * channel out boulder
 * click next scan to find all those that changed to 0x0020, should return 1 result; that is offset of type of tile that was just channeled out