DarkHook - porting engine functionality

SunBeam on 11/7/2009 at 02:55

Beta release currently to be found at this link:

» (http://www.ttlg.com/forums/showthread.php?t=127726&p=1884281)

--

Hello, folks. Allow me to introduce myself first, perhaps you haven't heard of me, though I'm a bit versed around the internet (lol, "quite modest, isn't he?"). Been doing lots of reversing, either to game engines or software alike and I developed some sort of addiction to PE32 files. Love 'em, eat them, sleep with them, etc..

This thread's purpose is to demonstrate how one can simply hook internal game's functions to obtain effects similar to DromEd experience. Starting with something simple, and explaining along the way (NOTE: the next few paragraphs are for the coders that like a bit of reading).

Thought of this idea a long time ago, but real life's issues impeded me from progressing. atom0s helped me put all these thoughts into code and translate the first initial functions I've analyzed from DromEd into C++. For starters we played with DarkMessage and PhysSetGravity/SetBaseFriction functions, thus replicating what DromEd translates as FLY, combined with on-screen messaging:

Quote:

if( bFly ) {
Real_DarkMessage( "Fly: On" );
} else {
Real_DarkMessage( "Fly: Off" );
}

Real_PhysSetGravity( *(DWORD*)gPlayerObj, (bFly) ? 0.0f : 1.0f );
Real_PhysSetBaseFriction( *(DWORD*)gPlayerObj, (bFly) ? 1134559232 : 0 ); // yes, this one didn't want the parameters as floats :-(

Actual result:
(http://www.youtube.com/watch?v=cKzmXcsfhkw)

Please post all things you want DarkHook to be able to do, and I shall reply if doable or not :-) A few requests have been made in another thread, and with users' permission, I will quote them below:

Quote Posted by "malau"

What other features will you include ??
Invisible mode ?? No Physics mode ? Infinite ammo and objects ?? Infinite health ?? Make objects bright mode (so you can see those little hidden levers more easily) ??

--

All the things I mentioned PLUS/AND/OR a full inventory of 999 units of every piece of standard Thief equipment (eg Flashbomb, Frogbeasts, Spiders, Arrows, Potions etc) regardless of the number that the FM designer set up.

Anyway to disable the 'don't knock out anyone' objective too. This option is most often set on Expert, and it it means if you like blackjacking then you can't play the best setting.

Maybe a hotkey to spawn a friendly AI to do combat for you ?

A 'Super Jump' on/off option for massive leaps (probably negated by Fly Mode though)

--

Good idea about the objective disabler !!

A couple more:-

- A hotkey to turn LOCKCHEAT on and off (!)

- One hit kill broadhead arrows.

- One hit kill sword

Quote Posted by "Albert"

Oh, and also the ability to disable objectives. This would especially be good for OMs like Life Of The Party, where you can't stay on the streets for all that long... if, that is, you can find a way onto the streets, which is especially where fly mode will come in. Also, a no clip mode, or for those who don't understand what no clip means, it means to be able to fly through walls and objects that would usually be in your way.

A little debate on the above:

- need I add that "one hit kill" can be done globally - reduce AI health to 0, shoot, dead;

- "lockcheat" - as in, lock an enemy in center of your view?

- objectives can be disabled when I finish up converting the obj structure then can easily pick objective from a list (say you have a total of 10 objectives, hidden, visible, no matter how - iterate and find the ones that require you not to: kill, blackjack, bla bla; once found, remove check OR force it to be completed from start);

- inventory items - to be able to get each and every weapon/item/etc.., I think I need to add in a list and inject it at start of map; saw a video the other day where this dude used various non-usable "weapons" - such as fire shots, ice shots, purple-trap shots, etc.. - video here: (http://www.youtube.com/watch?v=zHClyZKNH5s) - think I can get there as well :-))

Will post more soon.

DJ Riff on 11/7/2009 at 05:46

Switching in-game to show_cell view would be good :rolleyes:

malau on 11/7/2009 at 09:27

LOCKCHEAT as in the 'lockcheat' line you add to your USER.INI file.
It enables all FROBABLE locked doors/chests etc to be opened as if they weren't locked.

The need to be able to switch it off is because people might want to use it for those annoying locked chests, but would want to switch if back off again for doors.

Cut and paste from USER.INI

cheats_active
;lockcheat

The semi colon (obviously) means that the command is currently not activated when T2 starts up.

Telliamed on 11/7/2009 at 20:01

There are three versions of Thief 1, two of Thief 2, two each of Dromed 1 and Dromed 2. Two versions of System Shock 2, and thankfully only one version of ShockEd. That's twelve different games that appear almost identical... so yeah, good luck with all that. I'm not even counting the demos.

But please change the name. "Dark Hook" already has relevance in custom scripts, and I'd like to avoid any confusion.

SunBeam on 11/7/2009 at 22:27

@Telliamed: It has relevance for this purpose as well, since I HOOK functions in DARK engine. And don't worry, once I finish the main part, it can easily be made to look for patterns inside your application and store needed data in a user config (like darkhook.ini) so once found, it doesn't look for them again.

Darn it, LG loves to implement command hashes T_T. Reading up from user.cfg led to cheats_active command being hashed to 0xA4; lockcheat got 0x74 as hash value. Wondering where these values are used - probably inside "open_door" function?

EDIT: Made it ;-) Now DarkHook supports NoKillGoalCheat and LockCheat ;-) Releasing a beta shortly.. To be tested (for now) with DromEd, then I'll move it to main Thief2.exe (didn't finish IDA conversion of functions yet; will take a bit)..

SunBeam on 12/7/2009 at 02:29

I am using it at first on T2, then (since Engine is the same) I'll convert the needed data to patterns which can be looked for in game's memory instance. These get dumped to an .ini file where they are read for next sessions (we don't want memory always to be scanned for data, now do we?).. I am doing this alone, so it will take a while - work is killing me (very less time)..

SunBeam on 12/7/2009 at 03:20

I am planning to spawn all to be sure I don't miss a thing LOL :-)

P.S.: That blasted NoKillGoalCheat works only on init of a mission =\ As in, Thief loads convict.osm and looks if NoKillGoalCheat's hash has been performed (_hash_lookup). And this happens exactly before the "loading" screen finishes. You can however enable it in-game, and restart mission. It will work thereafter ;-)

malau on 12/7/2009 at 03:38

Quote Posted by SunBeam

EDIT: Made it ;-) Now DarkHook supports NoKillGoalCheat and LockCheat ;-) Releasing a beta shortly.. To be tested (for now) with DromEd, then I'll move it to main Thief2.exe (didn't finish IDA conversion of functions yet; will take a bit)..

Congrats ! My God !!! You are fast !!!

Are you able to give us a list of the features you have got working so far, and a full list of the features you intend the finished APP to have ??

This is going to be one awesome piece of software !

redface on 12/7/2009 at 09:44

And a patch the next day.

SunBeam on 12/7/2009 at 15:13

@DJ Riff: show_cell is an entirely debug_version function. I would have to recreate the function (poly_draw_.. something) and adjust callers to include the pointer compares as well.. Never said it's not doable ;-)

EDIT: Implemented a quick change of plyrSpeed ;-) Normal player speed boosted from .1f to .2f (as if you drank a Speed Potion). Going for god mode now. Any useful DromEd command lines I could look up?

For invincibility I know of only "add_hp". Is there any other or even better, an user.cfg command?

Cheers,
Sun