Topic: Hex Editing of Starfleet executables

[TarMinyatur]

The instruction to load the value of a variable from a specific location has been modified. The CPU obeys the new instruction. It will load our new value, let's say 6.0f, at 0x395BF8 instead of the old one, 4.0f, at 0x395BF4. In fact, the CPU cannot load the old value as it creates the Fusion Beam object. It does exactly what it is told to do.

[TarMinyatur]

If you edit the instructions within a specific subroutine to look for, let's say, "fxAdam.bmp" instead of "fx1.bmp", then the system should obey your custom setting. Anything outside of that subroutine should still use "fx1.bmp", so default stuff will still look the same. I don't know if a Phaser can use a Plasma torpedo effect or any effect that shows a HUD speed. Phasers don't seem to have a speed characteristic.

It's possible that all Phasers might have to use the same bitmap. You might be able to alter the specific coordinates within a common bitmap. Good luck.

[JanB]

But if I'm understanding this correctly, then I can do what I want and copy weapons. For instance, if I want to copy the Phaser 1, change the name to Phaser 5, then everything the same in terms of charging, cost etc... Same icons and panels, bc I can just change the letter 5 in the strings folder, then with what you are showing me I can change where it locates the file for texture to another one, let's say fxa instead of fx1. I just need to learn how.

Yes, in principle this is possible, as long as there is unused space left in the exe, you can keep adding copied functions. It's just that weapons could be very deeply rooted, or not; you might have to rewrite a lot of functions or just edit one, we simply don't know. I'm interested in the subject because I want to make Dominion polaron beams (for SFC3), but if it looks ot be too much work I'll have to pass (starting a busy new job in February).

[TarMinyatur]

Slow missiles back to speed 8

You may select any speed from -119 to 135.

I flew a Kzinti Cruiser last night... After all these years with 16 being considered "slow", speed-8 drones are indeed slow. I'm trying to find the hitpoints for missiles so I can make armored drones that would zoom along at a speed of 6.

[TarMinyatur]

When IDA "unpacks" StarfleetOP.exe it organizes it into a text segment and a few data segments. It gives them new addresses that are different from those shown by HexEdit.

IDA adds 400000 to HexEdit's addresses. So 395BF8 becomes 795BF8 as a segment address. Yes, it is confusing!

Segment references have to be made little-endian, thus: 0x00795BF8 -> F8 5B 79 00

So the instruction "D9 05 F8 5B 79 00" loads the value that is referenced by rdata:795BF8 as shown in IDA.

IDA rdata:00795BF8 = HexEdit 00395BF8

[TarMinyatur]

Oh, I think I know what you're asking. The binary file (StarfleetOP.exe) will contain 09 05 79 xx xx xx many times. Not all of them are instructions to load. It can just be a coincidence.

Look at this sequence of bytes: 75 09 05 79 12 34 56 78.

That "09 05" in there may be completely unrelated to the load instruction!

Those numbers could represent three commands:

75 09  (Jump 9 bytes ahead if a condition is met)
05 79 12  (add 12 to a register)
34 56 78  (subtract 78 from a different register)

IDA will show the instructions by highlighting them in its own hex viewer. It is sophisticated, identifying rules written by Intel about the valid sequences of specific bytes to tell the CPU what to do.

HexEdit does not group related bytes. If you search for "09 05 79" it will find them all, maybe hundreds. There is no guarantee that most of them are load commands. But if you search for "09 05 58 5B 79 00", the chances are good that many of the results will be true instructions. Just like searching for "00 00 00 41" will find 8.0f. Not all will be 8.0f. You'll have false positives with HexEdit.

09 05 must be followed by four bytes (as a typical address) to make any sense as a load command.

[TarMinyatur]

I found the HET and Erratic Maneuver costs. They aren't cumulative. If you HET while using Erratics, it doesn't cost anything extra. It's like this in SFC1, EAW, and OP.

In OP, your chances for HET success are not reduced because of Erratics nor do you slow down any. But in CE, the HET% is penalized 16%.

Also found the HET turn rate, which is 6x normal.

These variables need to be segregated before they can be properly modified. I always thought the free-angle HETs in SFC were comical. If I set them to a lower rate, they just seem right to me.  [Edit: HET turn rate has been isolated. 3.0f seems good.]

[JanB]

Adam, earlier you mentioned something about phaser colors, how did you find them?

[TarMinyatur]

Found the function for the range of seeking objects, including Plasma, Drones, Probes, Suicide Shuttles, Scatterpacks, Marine Shuttles, and WW's. Plasma was using 32 (instead of 36) for its range calculation, which accounts for its extended reach in Community Edition. I used 31/36, 26/36, and 21/36 for Plasma-R, S, and G endurance, respectively, conforming to EAW/OP standards. The Plas-F needed 17/36 instead of 16/36 to match its expected range.

Isolated more variables -- many, many more to do. Pretty much all the non-chart data will need new variables...but this work will only need to be done once.

[JanB]

So Tar, have you had any luck in finding out how/where the weapon colors are handled, or how a specific weapon is connected to its texture?

Btw, wasn't there someone on this forum with access to the source code (of SFC2 I believe), can he not give us little hints or answer direct questions about little things such as the location/value of a weapon color, you know little bits that we could feasibly eventually find out ourselves, without help so it wouldn't be the same as giving us the source code, it would just save us a lot of time?

[TarMinyatur]

So Tar, have you had any luck in finding out how/where the weapon colors are handled, or how a specific weapon is connected to its texture?

Honestly, I haven't looked for weapon colors or textures. Eventually, I would like to fix the corrupted sun graphic, which has an incorrect bitmap inserted consistently into every cycle. At the moment, I'm isolating variables to maintain the integrity of the game. If I specifically change the Disruptor-1, it must not affect the damage allocation scheme or the size of planets, for example. The good news is that Taldren frequently put 8-byte pi between groups of related variables, so there's room for two new 4-byte items. 

[JanB]

Ok, I kinda expected those answers but I had to try....

My problem with the phaser colors is that I can't look for them because I don't know their values. Do you reckon the colors we see in game are "unfiltered" (not influenced by ambient lighting settings and such)? If they are I might just be able to get the color values by studying the pixel values of a lossless screenshot.

[TarMinyatur]

Found the Photon/Heavy Photon Overload Limitation.

Still can not locate the Hellbore and Fusion (limitation).

For Fusion Beams, try this section, Adam: .text:004DF200
I extended the OL range to 109.9f to check it out. I can indeed fire from 9.00 to 10.99, but the weapon doesn't seem to do any damage...

The Hellbore range limits are likely in this function: .text:004E102C

[JanB]

Ok, I kinda expected those answers but I had to try....

My problem with the phaser colors is that I can't look for them because I don't know their values. Do you reckon the colors we see in game are "unfiltered" (not influenced by ambient lighting settings and such)? If they are I might just be able to get the color values by studying the pixel values of a lossless screenshot.

Tried that, didnt work.

Did you remove the fx files from the texture folder (they're mixed with the hardcoded colors to produce what you would normally see ingame, I believe)?

[JanB]

So the colors in them don't get mixed with the hardcoded colors from the exe. I once removed them to see what change, and the the federation phaser became more yellowish and less orangish, (this was in sfc3). So the hardcoded color is more yellowish than what you would initially expect it to be, now that I think about it it may actually be "pure" ff ff 00 yellow. Lots of stuff for me to test tomorrow...

[TarMinyatur]

While I was inspecting OP's Fusion Beams, I fixed a significant bug.

Regular OL mode gets a typical Range-8.99 limit, as we would expect. If the mode is different, however, the range is unlimited. This logic puts Suicide OL's in the same class as Normals! So I changed the comparison from JNZ (not equal) to JS (negative sign). The AI should be unable to sacrifice its Fusions in hopeless long-range attacks (9 to 24).

HexEdit 0xDF230: Change one byte (75 -> 78) to enforce a range limit on SOL Fusions.

[TarMinyatur]

This will affect players too (should any of them attempt to fire in futility). Changing that one byte of logic specifically affects the SOL Fusion Beam.

This could have been written as:

if (FusionMode == OL) {
   setFusionMaxRange(89.9f);
} else {                                 
   setFusionMaxRange(249.9f);   // includes Suicides because their mode (SOL) is not the same as OL.
}


My StarfleetOP.exe now has code essentially like this:

if (FusionMode == Normal) {
   setFusionMaxRange(249.9f);
} else {                                     
   setFusionMaxRange(89.9f);
}

[TarMinyatur]

Good idea. That might somehow work. Photons Torpedoes use a specific function to determine range and damage. I wonder if it is possible to selectively call, let's say, the Hellbore's range and damage function instead. I guess it depends on the inputs. If the Photon has the right stuff to send in, maybe the Hellbore instructions would respond usefully. Hmm...I don't know! That's advanced modding. Although, success seems more probable in that example than in importing the behavior of Plasma torpedoes to the ESG or other vastly different systems. Photons and Hellbores are both direct-fire weapons with speed indicators on their projectiles, and they both take two turns to arm.

[Corbomite]

If you mean the speed reduction stats, then you lose five points of (maximum) movement for one turn for every torp that hits. I always wondered what would happen if you got hit by six torps at once, but that is hard to test without help.

[TarMinyatur]

I just struck a Speed-31 target with 6 Plasma Snares. It's highest speed for the next 30 seconds was 11.0. There appears to be a limit of 4 Plas-E that can affect speed simultaneously. This could be modified, Adam. Changing the "04" to a "06" for maximum snare effect is easy, but finding it in the binary might take some time.