Warhammer 40k Winter Assault Trainer

[shortferret]

Originally Posted by saulob

Ferret,
tested now.. on a skirmish map, and i think all the options, including the instant build works the same for the computer player.

he build A LOT, i mean A LOT of the first squad soldier... and fast...

the instant build, its not instant build for all, works only on updating the structures and creating squads... but for the peon building the structures its the same speed.. (its great for me that way )

too bad that works for the enemy too, I played the order campaing thinking about that.. ehhe, the enemy had a lot of soldiers, more than normal.. but i didn´t give up..

btw, nice gui

Hey thanks for testing it out Guess it's back to the old drawing board for me then

[saulob]

Originally Posted by shortferret

Hey thanks for testing it out Guess it's back to the old drawing board for me then

no problem, i´m justing playing the game now
thanks for your trainer.. ehehe

and... just started the 'disorder' campaing, and the 'pop hack' it´s not working... only the 'resource' one...

[shortferret]

Man been really busy these few days...

fixed the orks unit limit, and unlimited resources + unit/veh limits for human player only. Instant build still affects both human and computer players.

http://www.filelodge.com/files/hdd7/...iner_Plus4.rar

[DABhand]

A bit of advice, look deeper into the registers for quick builds.


Set a breakpoint before you amend the code, and keep note of eax.

See if it changes when you build, or when the computer builds.


For an example this is what the coding is like for FABLE.

10abf

mov eax,esi 
mov [00548a62],eax 
cmp [eax],127293c                          - is it going to be NPC? 
je 10ae2                                        - jump here if so 
cmp [eax],12457fc                          - is it going to be player? 
je 10af1                                        - jump here if so 
fstp [esi+b4]                                  - if none above, move current stack value to pointer 
jmp 6a6338                                    - jump back to game 
fstp [esi+b4]                                  - NPC health routine, change to mov [esi+b4],00 for 1hit kill 
nop 
nop 
nop 
nop                                              - nops needed for mov instruction later since its needs 10 bytes 
jmp 6a6338                                   - jump back to game 
fstp [esi+b4]                                 - hero's health, nop out for infinite health. Or you can force a value in? 
jmp 6a6338                                   - jump back to game.. 


6a6332 

jmp 10abf                                     - jump to code injection 
nop 



If we want 1 hit kill, rename 2nd fstp to mov [esi+b4],00

Basically when playing the game, I set a breakpoint at the real address when calculating out dmg done and removing, so i get hit game broke into debugger checked eax value, hit bad guy, broke back seen new value, tried a few times to make sure.

So then I had these 2 values...

012457fc was the players' eax value
0127293c is the NPCs'


With a bit more digging (Fable will be more complicated than Warhammer so I doubt you will need to do this)... I found out where it stored these values before moving em, then found out it used the same address each time [00548a62].

If warhammer is the same idea, then just look before the code you want to manipulate, you will eventually find the evidence you need. But I doubt it, dont have the game so cant help you any further.

[shortferret]

Hey DABhand, thanks for the tips!

I managed to find the screen update address the human player used for resources, which the comp player never uses, so was able to modify only the human player values.

I have tried to use your method for finding the specific pointer to the human player's address for instant build, seems that both player and computer are obviously using the same routines and the pointers are different for EACH building not just a simple matter of either human or comp? i might be wrong but this is what my tiny brain is interpreting now.. mebbe I'll post the Tsearch results later

[DABhand]

What you will have to do is set a read brakepoint on the screen addy/ies, so that is the just the screen values, so it has to read them from somewhere.

Tsearch should break at wherever it reads the values from, then when you find that, you should be able to set a brakepoint again to find out where the calculation for the values is. (or look about to see if you find a JMP or CALL)


EDIT: Brakepoint??? I musta been tired :P

[shortferret]

Hey thanks DABhand! I managed to find the location to poke for human player only instant build Cheers!

http://www.filelodge.com/files/hdd7/...ner_Plus4b.rar

It's been fun