[Release] Solving textures problem [UPDATE 2] support all mains <= S3Ep1.

[Gembrid]

UPDATE 2 contains another method of finding references for TEXINFO array.
if your old DLL works fine, it's not necessary to change it for a new one from UPDATE 2

if you have problem with displaying textures in main with added items, then this thread is for you.

This release supports all mains till S3Ep1(including)

here is what we are talking about, thx Areskoi for screen:



Once again we will start from theory.

The count of textures in main is limited and this limit is not related to the max possible items loading. And more, each group of items has it's own texture limitation.

i worked with 97v main.exe, and it has 1450 texture limitation

180 limit for textures in Player\
208 limit for textures in Items\

but remember, that item can contain more than 1 texture =)

info about texture is stored in struct, smth like this

In mains < 1.03:

typedef struct _TEXINFO
{
    char info[0x38];
}TEXINFO, *LPTEXINFO;

In 1.03 and 1.04:

typedef struct _TEXINFO
{
    char info[0x32];
}TEXINFO, *LPTEXINFO;

In 1.03 and 1.04 2 DWORDs are reduced to BYTEs =)


i wasn't trying to find out what info it has, but first 0x20 bytes is filename

So we have only 1450 TEXINFO structs, an array :
TEXINFO Textures[1450];

Each item(or object) stores keys(or index) of this array, and by this keys it gets texture info.

The point is that starting key for Player textures is a fixed value, so textures are loaded for example starting with 0x12D index. Item textures are loaded after Player. In 'Textures' array after items main loads skill textures, and Skill textures starting key is a fixed number.

Also there is a mob section, an interface setion, and this things has fixed starting key of textures in our big array of textures.

So for example if we load items textures, and if we have more textures then we are allowed to use, all textures that overflowed the key of Skill textures are loaded to Skill texture section, but when skill textures begin to load, main checks if there is already loaded texture, if one exists it deletes it, and loads new.

Let's look on the scheme item references to TEXINFO array:

After loading items:

...
Item45 -> 0x2BA
Item46 -> 0x2BB
Item47 -> 0x2BC
Item48 -> 0x2BD
Item49 -> 0x2BE
...

After Loading skills:

...
Item45 -> 0x2BA
Item46 -> 0x2BB
Item47 -> 0x2BC <- Skill1
Item48 -> 0x2BD <- Skill2
Item49 -> 0x2BE <- Skill3
...

but now in 0x2BC, 0x2BD, 0x2BE we have skill textures, and items use this textures

Also we can't just change fixed starting keys for each texture section, because there is another problem

not all the textures are loaded by items ID, some of the textures have fixed TextureId (key), and there are a lot of them, and it will be insane to change all of them.


So first of all we have to solve problem of ALL Texture limit.

How we will do it? We will allocate new memory for them, and fix all the references to the old array. We will just force main to load texture info in our memory.

Second, if we have a lot of fixed TexturesId, we can't just inflate texture sections(Player, Items, Mobs). So the first idea that comes to my mind, that we will put the overflowed textures ids to the and of our new array.

Let's look on the scheme:

...
Item45 -> 0x2BA
Item46 -> 0x2BB
Skill1 -> 0x2BC
Skill2 -> 0x2BD
Skill3 -> 0x2BE
...
Item47 -> 0x5AA
Item48 -> 0x5AB
Item49 -> 0x5AC
...

and no problems with texture displaying

How i check if texure id is overflowed?
I hooked 3 functions LoadPlayerTex, LoadItemTex, TexCheck

By hooking 2 first function i will know what currently main.exe is loading, so i could put flags.

TexCheck - function that checks if loading texture is already loaded(not in 'Textures' array, just loaded), because some items use the same textures

and this TexCheck function is called in function LoadTextureByItemId
after calling TexCheck, if texture doesn't exist, it loads textures and increments the TextureId or Key

so by hooking TexCheck function i can check if TextureId is overflowed, and if it's overflowed i just change it to a new one, so textures won't be overlapped

So what values do we need to make this thing work?
Here they are:

dwTexCount - TextureId counter, this value we will change if the id is overflowed

dwLoadPlayerTexCall - call from offset to LoadPlayerTex function
dwLoadItemTexCall - call from offset to LoadItemTex function
dwTexCheckCall - call from offset to TexCheck function

dwStartPlayerTex - starting key of player textures section
dwLimitPlayerTex - ending key of player textures section

dwStartItemTex - startinf key of item textures section
dwLimitItemTex - ending key of item textures section

dwMaxTex - max texture limit
dwPlusTex - how much memory we will add to a new array
dwTextures - address of TEXINFO Textures[1450] array

dwTexInfoSize - sizeof TEXINFO structure(0x38 or 0x32)

Now i will tell you how to find needed values in main.exe and change them in my DLL.

Remember these things:

RB - Right Button click
Search for [binary] string - RB -> Search for all referenced strings -> In opened window RB -> Search For Text (use CTRL + L for Search Next)
Search for name(label) - RB -> Search for name(label) in current module; In opened window begin typing specified name, it will help
Go to the beginning of the function/procedure - RB -> Go to previous procedure
Go to 'call from' - Go to the beginnig of the function -> RB -> Go to -> CALL from X
Step into or follow - press ENTER

1. First we will find offset of dwTextures. Search for name(label) in main.exe - glDeleteTextures, in found references follow last CALL.
2 possible situations:


a. 404 Not Found
dwTextures(0x88A6FC0)

b. 404 Not Found
dwTextures(0x7D76558)

a - TEXINFO struct size is 0x38
b - TEXINFO struct size is 0x32

2. Next Search for String "Sword", until you find exactly this string. Then follow it. It's LoadItemModels function.
404 Not Found

Now go to 'call from'. Here we will find dwLoadPlayerTexCall dwLoadItemTexCall

2 possible situations:
a. 404 Not Found
dwLoadPlayerTexCall(0x0050BCD6), dwLoadItemTexCall(0x0050BCE0)

b. 404 Not Found
dwLoadPlayerTexCall(0x0063DCEF), dwLoadItemTexCall(0x0063DD19)


3. Now step into LoadPlayerTex. First function call and a value pushed before it is our dwStartPlayerTex(0x12D).


4. Scroll down until you find string "Player\Robe01.jpg". There u will find dwLimitPlayerTex (0x1EA)


5. Now go to the beginning of LoadPlayerTex and step into the function we were talking about in step 3.

dwTexCount(0x88A3428).
or

dwTexCount(0x7AFD5E0).

Below there is a TexCheck function. Select the first command of this function and go to 'call from'

and you will see this

it's our dwTexCheckCall(0x00500C9C)

6. Now go to LoadItemTex(see step 2), and step into
Here is our dwStartItemTex(0x1F4)


7. Now go to LoadSkills(see step 2), and step into.
Scroll down until you find smth like on the picture. And it's our dwLimitItemTex(0x2BC)


8. Now search for string "VolumeLevel" and follow it. Now scroll down carefully with attention and check all the loops. There must be only 1 CALL.
Step into function that is called, and if u see function, that we met in step 1 with glDeleteTextures, then you have found dwMaxTex value, it will be in the loop. Check pictures.

or


9. We have all values except references to _TEXINFO array.
How to find them?

You will have to use my ollydbg References plugin (for 1.10 version).
It will save all needed infromation in a binary file. This bin file you will have to add in DLL resources
using Resource Hacker program.

But first we have to find all references to old array of texture information.
In the dump window you will have to select a range of memory occupied by TEXINFO array.

Starting range value is our dwTextures.
Ending range value will be - dwTextures+dwMaxTex*dwTexInfoSize-1

For example:
dwTextures = 0x88A6FC0
dwMaxTex = 0x5AA
dwTexInfoSize = 0x38

Starting range value = 0x88A6FC0
Ending range value = 0x88A6FC0+0x5AA*0x38-1 = 0x88BACEF

Now go in dump window. Then press CTRL+G and type there Starting range value and press ENTER.
Select this first byte at starting range value.
http://img356.imageshack.us/img356/6...rtrangehe5.jpg

Then do the same with ending value - CTRL+G -> Ending range value -> ENTER.
Then hold SHIFT button and select byte at ending range value.
http://img364.imageshack.us/img364/1804/endrangewd4.jpg


By doing this you will select a memory range occupied by TEXINFO array.
Now RB-> Find References.
And in references window will be displayed all commands that reference to TEXINFO array.
http://img229.imageshack.us/img229/3...erencesjw5.jpg


RB -> Copy to Bin file
After this will be displayed 3 dialog boxes followed one by another.

First - write there Starting range value
Second - write there Ending range value
Third - write there 0, so our value will be treated as address constant

Then save it to any bin file.

Now run ResHacker and open there DLL.
Expand "BIN" branch and all branches in it.
"BIN" - > "103" -> "1049"

Select "1049" -> RB -> Replace Resource
Open there bin file with references.
Type: BIN
Name: 103
Language leace empty

After doing this save DLL. Now it contains info about references to change.

Now we need change default values in DLL to our new values

Once you've found all of the needed values, you have change them in dll.
Load DLL in OllyDbg.

And find there this
http://img65.imageshack.us/img65/171/dlltg4.jpg

To edit commands and values press SPACE.

I think you will understand were to change all needed values if u use these table:

	
	dwTexCount = 0x88A3428;

	dwLoadPlayerTexCall = 0x0050BCD6;
	dwLoadItemTexCall = 0x0050BCE0;
	dwTexCheckCall = 0x00500C9C;


	dwStartPlayerTex = 0x12D;
	dwLimitPlayerTex = 0x1EA;

	dwStartItemTex = 0x1F4;
	dwLimitItemTex = 0x2B0;

	dwMaxTex = 0x5AA;
	dwPlusTex = 0x200;
	dwTextures = 0x88A6FC0;

	dwTexInfoSize = 0x38;

dwPlusTex - it's your value to choose =)


If smth is not clear tell me, and i will try to explain more clearly =)

Here is DLL
Source

OllyDbg plugin


Here you will find Resource Hacker


hook dll in main and feel the game

Thx to:

hotic3 for server side
Areskoi for image and tests
Klivert for finding mistakes
*************** for mirrors

[MentaL]

[iBimbo]

Approved :)

[K2NetworK]

wow thx

[DOGWARMAN]

Thanks you! Gembrid! WoW... This it's an excellent release!

[Klivert]

Hi Gembrid, thank you so much.

Your update 2 now is really close to my problem fix. In fact, I

[Gembrid]

but try it load without dll :) you will get same result, when you change smth in main, make a back up or remember what are you changing =)

the id of that texture is 0x71E but in your main this value is 0x6E6, but may be it wasn't you changed it, but anyway make it 0x71E

search for "lo_back" string or 0x6e6 constat and you will see what you need to change =)

[Klivert]

:music_toot:

Jyaaaa..... Finally!! Thank you so much for your help and patience Gembrid. It really works quite well right now for 1.02F main. Impressive job man, congrats! :thumb_yel

[[hidden]]

report on 1.04X, new ( added) wings have visual (not texture) problems. I'm not sure if it is a server to client issue or / and if hooking this dll could change that.

different wing upon login, and going ingame, and after trading (this is the common bug that we all experienced before)

pls advise.

[Hacke]

the dll wont change the visual bug cuz the dll works on client side and as far as i know the visual bug is server side

[mel9]

can any one give me link from update 1 ?

[mel9]

anyone can help me ??
i need 1 update ..... or dll from it.
please help =)

[mayojung]

thank good work

[Hacke]

mel why dont you just use update 2? :scratch:its the same as update 1 just improved !

[SABLE]

excellent release thx

[mayojung]

mel why dont you just use update 2? :scratch:its the same as update 1 just improved !

me add update2 in main 1.04d original webzen

Gembird he help me

i say thank him good work