Memory Hacking, VB.net, and Player Positions

[staticchanger]

Hi all, I'm working on a Shadowrun style teleport app for CE. I can do basic memory modding like changing the value of a guns ammunition, and I can make a VB.net app to go with it. I do this by using cheat engine to determine what values change, and through about 3 or 4 steps of trial and error I narrow down the memory address, make sure it works and make a simple little app.
My roadblock now is finding the player position. I know and see numbers like death count and ammo amount, but a value like the y position of a player is giving me trouble. First off I'm assuming info like that would be a float right? Second off I have no way of knowing if I'm increasing or decreasing or if I'm moving on the y axis at all. I don't think I understand the method of determining addresses like this. Any of you experienced flycam makers or something have any tips?


----------------------Update------------------------------
Well I have the Score Display app working just about perfect now. Major kudos to Patrickssj6 for showing me what to do, and then correcting my mistakes after I did it. Here's a video showing the display in action, It may be hard to make it out, but that's the best I can do. Enjoy. (http://barrettrouton.com/videos/ScoreDisplay.wmv)


http://www.youtube.com/watch?v=9ZM_g_LZ4hE

[Limited]

G0t AIM?

Player position is indeed a float. You dont need to know if tis increased or decreased, use the "changed" and "unchanged" searches. Bit of advice, finding the player table, would be very helpful :D.

[Con]

This is relevant to my interests.

[Omega]

As a small trick you can use sparkedit to get the coordinates. Then (because it's indeed a float) you can do a few "between range" searches and get the address.

If I'm correct modifying the coordinates in the "player tables" as Limited called it will have no effect. The player tables we're mentioning contain more useful information that's all close to each other in memory (kills, deaths, coordinates, etc). Addresses that will allow you to change your location are not static. Search for "defeating DMA" or something similar.

[Limited]

They also change when a play dies, if I recall correctly.

[Skarma]

You can change your players coordinates through your players object structure. All the object structures are laid out in an array and since object creation varies during the game, the elements of the table will not be in any particular order which is why the address is different each time. As far as finding which object structure is your players, you will have to refer to the object data header/array which is another array of elements that hold basic object info like type, an index number, and a pointer to that object structure. To find out what your players index is within the object data header, you will have to refer to the players data table. It has the names of players as well as the object index and other stuff. OpenSauce has all the structures you need to accomplish this, go check it out and do some research. There are other methods to do this but it would require some debugging which you seem to not be ready for yet Hope this helps you along your quest

[Con]

You can change your players coordinates through your players object structure. All the object structures are laid out in an array and since object creation varies during the game, the elements of the table will not be in any particular order which is why the address is different each time. As far as finding which object structure is your players, you will have to refer to the object data header/array which is another array of elements that hold basic object info like type, an index number, and a pointer to that object structure. To find out what your players index is within the object data header, you will have to refer to the players data table. It has the names of players as well as the object index and other stuff. OpenSauce has all the structures you need to accomplish this, go check it out and do some research. There are other methods to do this but it would require some debugging which you seem to not be ready for yet Hope this helps you along your quest

So basically iterate through the object data header elements until I find the one with the index of my player, then use the associated pointer to get the object structure?

edit: or can I just multiply an offset by index to get the right header element?

[staticchanger]

Wow thanks for the responses guys. OK so let em get this straight, there is no definitive address for player position (I figured that), but the object array of the player is referenced in the player table? I'm gonna do some figuring/experimenting. Does anyone remember Patrick's Jumper app for PC? It basically recorded positions and reloaded them from the number pad. I wonder how he got that to work.... (with the changing memory address and all) Yes I do have AIM my screen name is the same as it is here

[Limited]

Magic :D

You should AIM me.

[staticchanger]

Wait.. Whats your AIM?

[Skarma]

Halo CE 1.09
0x402AAF94 = Player Data Header
0x402AD408 = Local Player
0x400506B4 = Object Data Header


struct Player;
struct LocalPlayerObject;
struct LocalPlayer;
struct Entity;
struct DataHeader;
struct ObjectInfo;

struct Player
{
short playerid;
short host;
wchar_t PlayerName0[12]; // Unicode / Max - 11 Chars + EOS (12 total)
long Unknown0; // Always -1 / 0xFFFFFFFF
long Team; // 0 = Red / 1 = Blue
long SwapID; // is an ObjectID
short SwapType; // 8 = Vehicle / 6 = Weapon
short SwapSeat; // Warthog - Driver = 0 / Passenger = 1 / Gunner = 2 / Weapon = -1
long RespawnTimer; // ?????? Counts down when dead, Alive = 0
long Unknown1; // Always 0
Entity Object; // matches object table
long Unknown3; // Some sort of ID
long Sector;
long Unknown4;
long BulletCount; // Something to do with bullets increases - weird.
wchar_t PlayerName1[12]; // Unicode / Max - 11 Chars + EOS (12 total)
long Unknown5;
char MachineIndex;
BYTE Unknown6;
char Team2;
char PlayerIndex;
long Unknown7;
float SpeedModifier;
BYTE Unknown8[42];
short Kills; // Number of kills
BYTE Unknown9[6];
short Assists;
BYTE Unknown10[8];
short Teamkills;
short Deaths;
short Suicides; // suicides, i think. Suicides make you die, you killed someone on your team, but also count to suicide count too.
BYTE Unknown11[40];
short Ping;
BYTE Unknown12[158];
BYTE Unknown13[12]; // 0xFF's
BYTE Unknown14[120];
};

struct LocalPlayerObject
{
uint8 Unk[16];
Entity Object;
uint8 Unk2[8];
float Rotation[3];
};

struct LocalPlayer
{
Entity Player;
BYTE Unknown00[144];
LocalPlayerObject LocalObject;
};

struct Entity
{
int32 Id;

union
{
int16 Index;
int16 Salt;
};
};

struct DataHeader
{
char name[32];
short Max; // Max number of <things> possible
short Size; // Size of each <thing> class instance
bool is_valid;
bool Entityifier_zero_invalid;
short padding;
unsigned long signature; // d@t@
short next_index;
short last_index;
Entity next; // the next <thing> to be initialized
union
{
uint32 First;
PVOID pFirst; // Pointer to the first <thing> class instance
ObjectInfo* pHeader;
};
};

struct ObjectInfo
{
int16 Salt;
uint8 Flags;
uint8 Type;
int16 Sector; // portal rendering ( cluster index )
int16 Size; // Structure size
void *Address;
};If you're doing dll project you could use all pointers. Assign the above addresses, then do like this, pseudo:
PlayerObject = ObjectHeader->pHeader[pLocalPlayer->LocalObject.Object.Index].Address;

Else if in an exe, you have to read and write memory, so you have to manually read in the addresses.

After you get the object structure, the offset is 0x5C. I gave you enough info to run with dude =p My structs are outdated, I dont have any new stuff, so sorry for bad naming lol

EDIT: Yea I did slaughter naming stuff. I forgot to say yea LocalPlayer is YOUR player, so you can just use that Object index instead of iterating through all the player data. There is a different index/id for players than there is for objects so dont confuse them... unless you want to change other players stuff, stick with local player.

@Con you can multiply the size of the structure by the index number plus the address of the first element

[Vicky]

This thread should be called 'Hacks for halo, now available for everyone!' :P

[Syuusuke]

For everyone who is a competent programmer.

[Vicky]

Heey, still alive ay?

Yeah well, don't they learn that in kindergarten nowadays? Or is it on the labels of bottled breastmilk already...

[staticchanger]

Halo CE 1.09
0x402AAF94 = Player Data Header
0x402AD408 = Local Player
0x400506B4 = Object Data Header

Else if in an exe, you have to read and write memory, so you have to manually read in the addresses.

After you get the object structure, the offset is 0x5C. I gave you enough info to run with dude =p My structs are outdated, I dont have any new stuff, so sorry for bad naming lol

EDIT: Yea I did slaughter naming stuff. I forgot to say yea LocalPlayer is YOUR player, so you can just use that Object index instead of iterating through all the player data. There is a different index/id for players than there is for objects so dont confuse them... unless you want to change other players stuff, stick with local player.

@Con you can multiply the size of the structure by the index number plus the address of the first element


Thanks so much +Rep

I found the temporary addresses of the local players XYZ and made some shortcut keys to increase that value. This resulted in a somewhat working concept. However since X, Y, and Z are fixed relative to the BSP and not the player (that would be ridiculous game design anyway), Z is the only axis I used since It's hard to know for sure which way is +X and +Y. ( I ported outta the map alot) This will be solved later on with some basic trig,I hope to calculate the players moving direction and port them forward a certian amount in that direction only using one button. But for now I'm figuring out the basics of this stuff. Here is a vid of me using the Z teleport. (No this is not super jump lol superjump doesn't go through ceilings)

http://video.xfire.com/326e7a-4.jpg (http://www.xfire.com/video/326e7a/)

not bad for having no idea what a memory address even was 36 hours ago:realsmug:.

All this reminded me of another project I once thought of. I have an ardiuino and a few 4-digit 7 segment displays. Wouldn't it be cool to right an app that outputs info read from memory (score, timeleft, or even altitude!) over serial to the arduino which drives the display duct-taped to my monitor. No more hitting F1!!

[Skarma]

Only way to solve out of map issues is collision detection. I'm wondering about something, if you call the engine function that moves a player, it probably does all the collision for you so you won't even have to mess with it. I dunno though just a thought

[Vicky]

All this reminded me of another project I once thought of. I have an ardiuino and a few 4-digit 7 segment displays. Wouldn't it be cool to right an app that outputs info read from memory (score, timeleft, or even altitude!) over serial to the arduino which drives the display duct-taped to my monitor. No more hitting F1!!

That's another thing you could use it for.. lol

[staticchanger]

Only way to solve out of map issues is collision detection. I'm wondering about something, if you call the engine function that moves a player, it probably does all the collision for you so you won't even have to mess with it. I dunno though just a thought

Yeah maybe, but then I wouldn't we able to go though walls which is kind of the selling point of this mod. I'll probably just forget about this problem and leave it to the user to decide if he/she can make the jump. I'll also record the departure point for the last jump and make an oops button that takes you back. Just in case someone accidentally ports to the vacuum of space from The Pillar of Autumn.

[CrAsHOvErRide]

Even though Skarma's structs are not complete they should be more than sufficient (otherwise OS). Since you are better off not mapping structs in C# or VB.NET anyway, you can just extract the information you need. I would write a wrapper to handle this kind of stuff e.g.



public string getName(Int32 pIndex)
{ return VAM.ReadStringUnicode(((IntPtr)(VAM.ReadInt32(MM.g etMemoryList().PlayerListPtr) + 0x200 * pIndex + 0x04)), 22); }
Though it's not optimized it does the trick.

[staticchanger]

Well I'm back, and am putting the teleapp on the backburner for a bit to work on my previous physical score display idea. I'd like to do it first because its easier, and I need to work my way up because Skarmas and Patricks posts blew my mind away lol. I realized I need to learn a bit more before I continue, though I can't wait to do the trig involved. Anyway my 7 seg score counter should be a pretty easy app to write. Basically its just gonna poll a memory address and store the value as a integer and stream it over a COM to my arduino which is set to recieve data in 4byte packets. I have the display end of things worked out, but I can't figure out how to read a memory value and dim it to a variable. I know its probably a simple thing to write, but I'm unfamiliar with messing with memory in VB.net (or any language for that matter). Any of you guys mind lending a bit of help? Thanks Here's a pic of the setup (non working as of now)

http://barrettrouton.com/images/cescore3.jpg

Edit: Sorry for the Jumbo pic earlier, I was writing this on my android, and it looked mine in the mobile browser.

http://sshttp://asdfasdf
http://barrettrouton.com%5Cimages%5Ccescore.jpg

[CrAsHOvErRide]

Switch to C# now before it is too late. I wrote a memory class to handle these kind of things for memory 'newbies'.

http://www.vivid-abstractions.net/forum/viewtopic.php?f=17&t=199&start=0

After you set everything up it is really easy.



VAMemory VAM = new VAMemory("processname e.g. haloce");
int pulledValue = VAM.ReadInteger((IntPtr)0xAddress);


You can also do this in VB.NET obviously but it would be a good habit to write in C#. We can help you port the code if you want because I think your idea is awesome and I would like to see it work =)

[Vicky]

Switching to C# would be like taking one step up, it's based on pascal, go for C or C++ right away and take 2 or 3 steps (like the arduino).

[CrAsHOvErRide]

Yeah just read it on Wiki that it is C++. Go do what Vicky says :P

[staticchanger]

Switching to C#.........Done! Thanks guys I'm gonna work on this for a bit, appreciate the encouragement and help!

[Vicky]

*** Palm to face *** ... good for starters anyway, let us know if the arduino plan worked out...

[Kornman00]

If you were experienced in C++, I'd recommend using OpenSauce for this. Would certainly cut out most of the overhead you'll be experiencing and adding plus you won't have to worry about using a managed serial interface for the ardunio

[Amit]

If you were experienced in C++, I'd recommend using OpenSauce for this. Would certainly cut out most of the overhead you'll be experiencing and adding plus you won't have to worry about using a managed serial interface for the ardunio

I was wondering if OS would work for this type of thing.

[staticchanger]

@ Kornman Hmm.. I don't really know any C++ (or C#) besides the basic coding on the arduino which is somewhat C++ based.

I was planning on going out and buying the dummies guide to C#, but if y'all think I should learn C++ I will do that instead. What would be my best bet for these two projects? I'm starting to lean towards C++ even though I hear it's harder and more error prone. (I know it sounds like I have no idea, but I learn pretty fast) Meh, I may just stick with C# Patrick gave me an example, and theres a tutorial.

[CrAsHOvErRide]

IMO to grasp the basics it is good to learn C# and later switch to C++. It is always good to have both languages because C++ is not the solution to everything.

[Vicky]

They both have their pros and cons.. but, who doesn't like speed.. Wouldn't C/C++ be useful for your arduino right away as well? Guess you don't write anything yourself for it yet.

[staticchanger]

Alright then D♭ it is. (lol music joke D♭ = C#) I'll get it reading the memory value first, then get it talking to the ATmega.

[CrAsHOvErRide]

Can you post in return some tutorials or guides on how to do this ATmega stuff etc? I would really like to know.

[staticchanger]

Sure can, I don't know to much, but ill definatly do a guide as to what i'm doing here. Its pretty easy, I plan on cutting out the arduino altogether in favor of a smaller serial 7 segment driver already made up. It uses a smd atmega328 which is the same chip the arduino runs.

[CrAsHOvErRide]

Would be nice if you could provide a total overview of the components in your project. Thanks :D

[staticchanger]

Will do, I'll do a whole writeup as this is a simple project to recreate. The most expensive component is only $12.99.

[staticchanger]

http://barrettrouton.com/images/cescore4.jpghttp://barrettrouton.com/images/cescore4.jpeg

Got it somewhat working. All I have to do is figure out how to do an auto refresh interval, and figure out how to determine the correct address when you change games ( different player indexes have different score addresses). I figure not bad for my first day of C# :realsmug:http://barrettrouton.com/images/cescore.jpeg

[CrAsHOvErRide]

Looks pretty cool! Post your code so we can help if you want.

[staticchanger]

OK here's my full code. I have a button and a readonly text box set up in the designer. I know its sloppy and I'm probably doing most things the worst possible way, but please bare with me. I also know my variable names suck. Sorry lol



using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.IO.Ports;


namespace WindowsFormsApplication1
{
public partial class Form1 : Form
{
public Form1()
{
InitializeComponent();
}

private void Form1_Load(object sender, EventArgs e)
{


}

private void button1_Click(object sender, EventArgs e)
{
//Reads the score address and stores it as an integer
VAMemory VAM = new VAMemory("haloce");
int pulledValue = VAM.ReadInteger((IntPtr)0x402AB868);

//Stores pulled score as a string
string numberDisplay = pulledValue.ToString();

//Displays the score in the textbox on main form
valueDisplay.Text = numberDisplay;

//Adds 2 spaces before the score to fix formatting on the display
//Just a quick fix will be replaced display specific reset commands later
string writeout = " " + numberDisplay;

// Sets up the serial port with basic settings
SerialPort port = new SerialPort(
"COM11", 9600, Parity.None, 8, StopBits.One);

//Opens the serial port
port.Open();

//Writes the score to the display
port.Write(writeout);

//Closes the serial port
port.Close();
}
}
}


As of now it only updates the display when I click the button. Whats the best way to keep this thing updating all the time without any user input? Thanks for all the help everyone, also any ideas for other things that would be helpful to display like this? These displays can be added together, and come in lots of colors. One thing I thought of was to make the program calculate and display your K/D. Another thought was altitude, which could maybe be helpful for people playing coldsnap.

[CrAsHOvErRide]

Do you have MSN? There are some things in your code that could be optimized.

[staticchanger]

Well I have the Score Display app working just about perfect now. Major kudos to Patrickssj6 for showing me what to do, and then correcting my mistakes after I did it. Here's a video showing the display in action, It may be hard to make it out, but that's the best I can do. Enjoy. (http://barrettrouton.com/videos/ScoreDisplay.wmv)


http://www.youtube.com/watch?v=9ZM_g_LZ4hE

[Sean Aero]

Nice, seems fast. How often does the program read the memory value?

[CrAsHOvErRide]

Every 1/4 of a second.

[Limited]

Haha sick, great work +rep :D

[staticchanger]

Nice, seems fast. How often does the program read the memory value?

Every 250ms, it connects and updates the display only when needed. I'm going to spruce up the app and release it with a tutorial in a couple of days.
(http://www.sparkfun.com/commerce/product_info.php?products_id=9767)

[Vicky]

You could make it alternate between kills and deaths (or score), using different intervals or if you have a led to spare use that.. funny project! :)

[Limited]

I like that idea, although it would be hard to keep track of which figure is the kills/deaths etc on the board. The display can only do numbers right? Maybe like have it display a number on the far left, like 1....11 = 11 kills, and 2.....3 = 3 deaths.

[CrAsHOvErRide]

Well he can have 4 digits...he can make a space between 2 and make the left side kills and the right side deaths. The problem right now is that we need a better way to format the data which is send to the device. I am working on that.

[staticchanger]

You could make it alternate between kills and deaths (or score), using different intervals or if you have a led to spare use that.. funny project! :) I could get another one, they can also interface SLI so I can have a master and slave, but I've never tried that before. I think cramming two figures on 1 display would be confusing. I posted the source as well as a mini writeup on my new site check it out.
(http://staticchanger.com)

[Vicky]

You can control every digit of that display, you could use the 3 horizontal digits of the left segment to indicate what it shows. Just an idea...

[Sean Aero]

Just a suggestion:
If you have a bit of a budget to spare and really want to get into building your own score board.
I would recommend looking at the Home Flight Simulator business, they should have circuit boards with multiple 7-segment LED displays, solves the whole problem of switching digits.

[Vicky]

Or... if he happens to have a spare monitor, dual+ video output, just connect a 2nd monitor and show all he wants.. or something even easier, just show those numbers, like ingame chat, onscreen..