- Joined
- Mar 15, 2006
- Messages
- 451
- Reaction score
- 285
Code:
[B]UPDATE 2[/B] contains another method of finding references for TEXINFO array.
if your old DLL works fine, it's not necessary to change it for a new one from [B]UPDATE 2[/B]if you have problem with displaying textures in main with added items, then this thread is for you.
This release supports all mains till S3Ep1(including)
here is what we are talking about, thx Areskoi for screen:
![Gembrid - [Release] Solving textures problem [UPDATE 2] support all mains <= S3Ep1. - RaGEZONE Forums](https://forum.ragezone.com/images/404_image.png "Gembrid - [Release] Solving textures problem [UPDATE 2] support all mains <= S3Ep1. - RaGEZONE Forums")
Once again we will start from theory.
The count of textures in main is limited and this limit is not related to the max possible items loading. And more, each group of items has it's own texture limitation.
i worked with 97v main.exe, and it has 1450 texture limitation
180 limit for textures in Player\
208 limit for textures in Items\
but remember, that item can contain more than 1 texture =)
info about texture is stored in struct, smth like this
In mains < 1.03:
Code:
typedef struct _TEXINFO
{
char info[0x38];
}TEXINFO, *LPTEXINFO;In 1.03 and 1.04:
Code:
typedef struct _TEXINFO
{
char info[0x32];
}TEXINFO, *LPTEXINFO;i wasn't trying to find out what info it has, but first 0x20 bytes is filename
So we have only 1450 TEXINFO structs, an array :
TEXINFO Textures[1450];
Each item(or object) stores keys(or index) of this array, and by this keys it gets texture info.
The point is that starting key for Player textures is a fixed value, so textures are loaded for example starting with 0x12D index. Item textures are loaded after Player. In 'Textures' array after items main loads skill textures, and Skill textures starting key is a fixed number.
Also there is a mob section, an interface setion, and this things has fixed starting key of textures in our big array of textures.
So for example if we load items textures, and if we have more textures then we are allowed to use, all textures that overflowed the key of Skill textures are loaded to Skill texture section, but when skill textures begin to load, main checks if there is already loaded texture, if one exists it deletes it, and loads new.
Let's look on the scheme item references to TEXINFO array:
After loading items:
Code:
...
Item45 -> 0x2BA
Item46 -> 0x2BB
Item47 -> 0x2BC
Item48 -> 0x2BD
Item49 -> 0x2BE
...After Loading skills:
Code:
...
Item45 -> 0x2BA
Item46 -> 0x2BB
Item47 -> [COLOR="Red"]0x2BC[/COLOR] <- Skill1
Item48 -> [COLOR="red"]0x2BD[/COLOR] <- Skill2
Item49 -> [COLOR="red"]0x2BE[/COLOR] <- Skill3
...but now in 0x2BC, 0x2BD, 0x2BE we have skill textures, and items use this textures
Also we can't just change fixed starting keys for each texture section, because there is another problem
not all the textures are loaded by items ID, some of the textures have fixed TextureId (key), and there are a lot of them, and it will be insane to change all of them.
So first of all we have to solve problem of ALL Texture limit.
How we will do it? We will allocate new memory for them, and fix all the references to the old array. We will just force main to load texture info in our memory.
Second, if we have a lot of fixed TexturesId, we can't just inflate texture sections(Player, Items, Mobs). So the first idea that comes to my mind, that we will put the overflowed textures ids to the and of our new array.
Let's look on the scheme:
Code:
...
Item45 -> 0x2BA
Item46 -> 0x2BB
Skill1 -> 0x2BC
Skill2 -> 0x2BD
Skill3 -> 0x2BE
...
Item47 -> 0x5AA
Item48 -> 0x5AB
Item49 -> 0x5AC
...How i check if texure id is overflowed?
I hooked 3 functions LoadPlayerTex, LoadItemTex, TexCheck
By hooking 2 first function i will know what currently main.exe is loading, so i could put flags.
TexCheck - function that checks if loading texture is already loaded(not in 'Textures' array, just loaded), because some items use the same textures
and this TexCheck function is called in function LoadTextureByItemId
after calling TexCheck, if texture doesn't exist, it loads textures and increments the TextureId or Key
so by hooking TexCheck function i can check if TextureId is overflowed, and if it's overflowed i just change it to a new one, so textures won't be overlapped
So what values do we need to make this thing work?
Here they are:
Code:
[B]dwTexCount [/B]- TextureId counter, this value we will change if the id is overflowed
[B]dwLoadPlayerTexCall[/B] - [COLOR="blue"]call from offset[/COLOR] to LoadPlayerTex function
[B]dwLoadItemTexCall[/B] - [COLOR="blue"]call from offset[/COLOR] to LoadItemTex function
[B]dwTexCheckCall[/B] - [COLOR="blue"]call from offset[/COLOR] to TexCheck function
[B]dwStartPlayerTex[/B] - starting key of player textures section
[B]dwLimitPlayerTex[/B] - ending key of player textures section
[B]dwStartItemTex[/B] - startinf key of item textures section
[B]dwLimitItemTex[/B] - ending key of item textures section
[B]dwMaxTex[/B] - max texture limit
[B]dwPlusTex[/B] - how much memory we will add to a new array
[B]dwTextures[/B] - address of TEXINFO Textures[1450] array
[B]dwTexInfoSize[/B] - sizeof TEXINFO structure(0x38 or 0x32)Now i will tell you how to find needed values in main.exe and change them in my DLL.
Remember these things:
Code:
[B]RB[/B] - Right Button click
[B]Search for [binary] string[/B] - RB -> Search for all referenced strings -> In opened window RB -> Search For Text (use CTRL + L for Search Next)
[B]Search for name(label) [/B]- RB -> Search for name(label) in current module; In opened window begin typing specified name, it will help
[B]Go to the beginning of the function/procedure[/B] - RB -> Go to previous procedure
[B]Go to 'call from'[/B] - Go to the beginnig of the function -> RB -> Go to -> CALL from X
[B]Step into[/B] or [B]follow[/B] - press ENTER1. First we will find offset of dwTextures. Search for name(label) in main.exe - glDeleteTextures, in found references follow last CALL.
2 possible situations:
a.
dwTextures(0x88A6FC0)
b.
dwTextures(0x7D76558)
a - TEXINFO struct size is 0x38
b - TEXINFO struct size is 0x32
2. Next Search for String "Sword", until you find exactly this string. Then follow it. It's LoadItemModels function.
Now go to 'call from'. Here we will find dwLoadPlayerTexCall dwLoadItemTexCall
2 possible situations:
a.
dwLoadPlayerTexCall(0x0050BCD6), dwLoadItemTexCall(0x0050BCE0)
b.
dwLoadPlayerTexCall(0x0063DCEF), dwLoadItemTexCall(0x0063DD19)
3. Now step into LoadPlayerTex. First function call and a value pushed before it is our dwStartPlayerTex(0x12D).
4. Scroll down until you find string "Player\Robe01.jpg". There u will find dwLimitPlayerTex (0x1EA)
5. Now go to the beginning of LoadPlayerTex and step into the function we were talking about in step 3.
dwTexCount(0x88A3428).
or
dwTexCount(0x7AFD5E0).
Below there is a TexCheck function. Select the first command of this function and go to 'call from'
and you will see this
it's our dwTexCheckCall(0x00500C9C)
6. Now go to LoadItemTex(see step 2), and step into
Here is our dwStartItemTex(0x1F4)
7. Now go to LoadSkills(see step 2), and step into.
Scroll down until you find smth like on the picture. And it's our dwLimitItemTex(0x2BC)
8. Now search for string "VolumeLevel" and follow it. Now scroll down carefully with attention and check all the loops. There must be only 1 CALL.
Step into function that is called, and if u see function, that we met in step 1 with glDeleteTextures, then you have found dwMaxTex value, it will be in the loop. Check pictures.
or
9. We have all values except references to _TEXINFO array.
How to find them?
You will have to use my ollydbg References plugin (for 1.10 version).
It will save all needed infromation in a binary file. This bin file you will have to add in DLL resources
using Resource Hacker program.
But first we have to find all references to old array of texture information.
In the dump window you will have to select a range of memory occupied by TEXINFO array.
Starting range value is our dwTextures.
Ending range value will be - dwTextures+dwMaxTex*dwTexInfoSize-1
For example:
dwTextures = 0x88A6FC0
dwMaxTex = 0x5AA
dwTexInfoSize = 0x38
Starting range value = 0x88A6FC0
Ending range value = 0x88A6FC0+0x5AA*0x38-1 = 0x88BACEF
Now go in dump window. Then press CTRL+G and type there Starting range value and press ENTER.
Select this first byte at starting range value.
Then do the same with ending value - CTRL+G -> Ending range value -> ENTER.
Then hold SHIFT button and select byte at ending range value.
By doing this you will select a memory range occupied by TEXINFO array.
Now RB-> Find References.
And in references window will be displayed all commands that reference to TEXINFO array.
RB -> Copy to Bin file
After this will be displayed 3 dialog boxes followed one by another.
First - write there Starting range value
Second - write there Ending range value
Third - write there 0, so our value will be treated as address constant
Then save it to any bin file.
Now run ResHacker and open there DLL.
Expand "BIN" branch and all branches in it.
"BIN" - > "103" -> "1049"
Select "1049" -> RB -> Replace Resource
Open there bin file with references.
Type: BIN
Name: 103
Language leace empty
After doing this save DLL. Now it contains info about references to change.
Now we need change default values in DLL to our new values
Once you've found all of the needed values, you have change them in dll.
Load DLL in OllyDbg.
And find there this
To edit commands and values press SPACE.
I think you will understand were to change all needed values if u use these table:
Code:
dwTexCount = 0x88A3428;
dwLoadPlayerTexCall = 0x0050BCD6;
dwLoadItemTexCall = 0x0050BCE0;
dwTexCheckCall = 0x00500C9C;
dwStartPlayerTex = 0x12D;
dwLimitPlayerTex = 0x1EA;
dwStartItemTex = 0x1F4;
dwLimitItemTex = 0x2B0;
dwMaxTex = 0x5AA;
dwPlusTex = 0x200;
dwTextures = 0x88A6FC0;
dwTexInfoSize = 0x38;dwPlusTex - it's your value to choose =)
If smth is not clear tell me, and i will try to explain more clearly =)
You must be registered to see links
You must be registered to see links
You must be registered to see links
You must be registered to see links
hook dll in main and feel the game
Thx to:
Code:
[B][u]hotic3[/u][/B] for server side
[B][u]Areskoi[/u][/B] for image and tests
[B][u]Klivert[/u][/B] for finding mistakes
[B][u]***************[/u][/B] for mirrors
Last edited:
![[hidden]](/data/avatars/m/225/225847.jpg?1680380299){kind=avatar}
