Finding eqgame.exe version with windbg

shea851 · Post by **shea851** » Fri Apr 23, 2010 6:44 am

Hello,

I'm attempting to get MQ2 up and running with Seeds of Destruction (for an eqemu server). I keep getting "Incorrect Client Version". According to the Wiki, I need to look at the binary of eqgame.exe to find the version, then download the corresponding archive version of MQ2. I have WinDBG, and downloaded the windows 7 RTM (7600) symbols for it, and it seems to work correctly. On a side note, I've searched google and these forums for hours trying to find a walk thru on how to find eqgame.exe client version with windbg. Hopefully this isn't a total newb post.

http://www.macroquest2.com/wiki/index.p ... nt_Version

Wiki wrote:windbg -Q eqgame.exe patchme
Then in the command window:
da 0x614CC4
da 0x614CD0

To me, these instructions are vague. What I have tried to do is open windows CLI, change directory to the windbg folder and run the command "windbg -Q eqgame.exe patchme" which opens a windbg window and gives me this output in a "command" window"

WinDBG command window wrote:Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: eqgame.exe patchme
Symbol search path is: C:\symbols
Executable search path is:
ModLoad: 00000000`00400000 00000000`00b44000 testeqgame.exe
ModLoad: 00000000`77660000 00000000`7780b000 ntdll.dll
ModLoad: 00000000`77840000 00000000`779c0000 ntdll32.dll
ModLoad: 00000000`752b0000 00000000`752ef000 C:\Windows\SYSTEM32\wow64.dll
ModLoad: 00000000`75250000 00000000`752ac000 C:\Windows\SYSTEM32\wow64win.dll
ModLoad: 00000000`75240000 00000000`75248000 C:\Windows\SYSTEM32\wow64cpu.dll
(12c.b08): Break instruction exception - code 80000003 (first chance)
ntdll!LdrpDoDebuggerBreak+0x30:
00000000`77711220 cc int 3

Next, the wiki tells me to enter "da " + the #define __ActualVersionDate // #define __ActualVersionTime number in the command window.

Here's my eqgame.h relevent file information:

eqgame.h wrote:#define __ActualVersionDate 0x75FAA4
#define __ActualVersionTime 0x75FAB0

So, I enter "da 0x75FAA4" in the command window and get this:

0:000> da 0x75FAA4
00000000`0075faa4 ""

Doesn't tell me anything useful, so it makes me think I'm doing something wrong.

What is it that I am doing wrong? Looks to me like I'm following the Wiki exactly. Thanks for taking the time to read this.

dont_know_at_all · Post by **dont_know_at_all** » Fri Apr 23, 2010 12:46 pm

#define __ActualVersionDate 0x75FAA4
#define __ActualVersionTime 0x75FAB0

These values are wrong. Where did you get them?

shea851 · Post by **shea851** » Fri Apr 23, 2010 2:06 pm

MQ2-20081021b\MQ2Main\eqgame.h

Was trying random versions around the time I *think* this was released.. but so far no luck.

dont_know_at_all · Post by **dont_know_at_all** » Fri Apr 23, 2010 4:42 pm

Are you sure SoD stands for Seeds of Destruction?

dont_know_at_all · Post by **dont_know_at_all** » Fri Apr 23, 2010 4:56 pm

Code: Select all

0:000:x86> s 00400000 00797000 '2' '0' '0'
005b914f  32 30 30 00 00 9a 99 19-3f 9a 99 99 3e 0a 28 00  200.....?...>.(.
005c510b  32 30 30 33 00 31 36 3a-30 33 3a 32 31 00 00 00  2003.16:03:21...
005dc6b8  32 30 30 61 00 00 00 00-14 c9 5d 00 45 53 56 00  200a......].ESV.
0:000:x86> dc 005c510b-20
005c50eb  696c4300 20746e65 73726556 3a6e6f69  .Client Version:
005c50fb  20732520 00007325 766f4e00 20332020   %s %s...Nov  3 
005c510b  33303032 3a363100 323a3330 00000031  2003.16:03:21...
005c511b  74614600 65206c61 726f7272 206e6920  .Fatal error in 
005c512b  6e69616d 65726874 20216461 6c655228  mainthread! (Rel
005c513b  65736165 696c4320 20746e65 30333623  ease Client #630
005c514b  00000a29 74614600 65206c61 726f7272  )....Fatal error
005c515b  63636f20 65727275 6e692064 69616d20   occurred in mai

1. windbg -Q eqgame.exe
2. s 00400000 00797000 '2' '0' '0'
3. Find the line that looks like a timestamp with the year "2003.16:03:21"
4. Back up 0x20 bytes from the address and dump it.

shea851 · Post by **shea851** » Sat Apr 24, 2010 1:17 am

Appreciate your help. Yeah i'm sure it stands for Seeds of Destruction (not shards of dalaya or whatever).

I've tried both 32 and 64 bit versions of WinDbg. Nothing happens after I try to search for the information you told me to. I'm following your directions exactly. Perhaps there is some sort of setting or configuration I need to set in order to be able to search like you can? I don't really know, WinDbg is totally new to me. Going to look into some tutorials for it I guess.

Code: Select all

windbg -Q "C:\program files (x86)\Everquest_SoD\eqgame.exe"

Then WinDbg opens up and shows me this:

Code: Select all

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: "C:\program files (x86)\Everquest_SoD\eqgame.exe"
Symbol search path is: C:\symbols
Executable search path is: 
ModLoad: 00400000 00b44000   testeqgame.exe
ModLoad: 76f00000 77080000   ntdll.dll
ModLoad: 74f60000 75060000   C:\Windows\syswow64\kernel32.dll
ModLoad: 75340000 75386000   C:\Windows\syswow64\KERNELBASE.dll
ModLoad: 21100000 2115f000   C:\program files (x86)\Everquest_SoD\mss32.dll
ModLoad: 75130000 75230000   C:\Windows\syswow64\USER32.dll
ModLoad: 75390000 75420000   C:\Windows\syswow64\GDI32.dll
ModLoad: 74bc0000 74bca000   C:\Windows\syswow64\LPK.dll
ModLoad: 763d0000 7646d000   C:\Windows\syswow64\USP10.dll
ModLoad: 76950000 769fc000   C:\Windows\syswow64\msvcrt.dll
ModLoad: 76210000 762b0000   C:\Windows\syswow64\ADVAPI32.dll
ModLoad: 75230000 75249000   C:\Windows\SysWOW64\sechost.dll
ModLoad: 74bd0000 74cc0000   C:\Windows\syswow64\RPCRT4.dll
ModLoad: 74a70000 74ad0000   C:\Windows\syswow64\SspiCli.dll
ModLoad: 74a60000 74a6c000   C:\Windows\syswow64\CRYPTBASE.dll
ModLoad: 73200000 73232000   C:\Windows\SysWOW64\WINMM.dll
ModLoad: 74910000 74917000   C:\Windows\SysWOW64\WSOCK32.dll
ModLoad: 76a30000 76a65000   C:\Windows\syswow64\WS2_32.dll
ModLoad: 75060000 75066000   C:\Windows\syswow64\NSI.dll
ModLoad: 744f0000 74520000   C:\Windows\SysWOW64\DINPUT8.dll
ModLoad: 00e00000 01060000   C:\Windows\SysWOW64\d3dx9_30.dll
ModLoad: 76470000 76564000   C:\Windows\syswow64\WININET.dll
ModLoad: 752e0000 75337000   C:\Windows\syswow64\SHLWAPI.dll
ModLoad: 74cc0000 74cc3000   C:\Windows\syswow64\Normaliz.dll
ModLoad: 76570000 766a5000   C:\Windows\syswow64\urlmon.dll
ModLoad: 74d50000 74eac000   C:\Windows\syswow64\ole32.dll
ModLoad: 76a70000 76aff000   C:\Windows\syswow64\OLEAUT32.dll
ModLoad: 762b0000 763cc000   C:\Windows\syswow64\CRYPT32.dll
ModLoad: 76ed0000 76edc000   C:\Windows\syswow64\MSASN1.dll
ModLoad: 766b0000 768a9000   C:\Windows\syswow64\iertutil.dll
ModLoad: 10000000 1063b000   C:\program files (x86)\Everquest_SoD\xul.dll
ModLoad: 00220000 00288000   C:\program files (x86)\Everquest_SoD\js3250.dll
ModLoad: 30000000 30028000   C:\program files (x86)\Everquest_SoD\nspr4.dll
ModLoad: 7c340000 7c396000   C:\program files (x86)\Everquest_SoD\MSVCR71.dll
ModLoad: 00020000 00028000   C:\program files (x86)\Everquest_SoD\plc4.dll
ModLoad: 00030000 00036000   C:\program files (x86)\Everquest_SoD\plds4.dll
ModLoad: 755c0000 76209000   C:\Windows\syswow64\SHELL32.dll
ModLoad: 74980000 74989000   C:\Windows\SysWOW64\VERSION.dll
ModLoad: 73eb0000 73f01000   C:\Windows\SysWOW64\WINSPOOL.DRV
ModLoad: 74cd0000 74d4b000   C:\Windows\syswow64\comdlg32.dll
ModLoad: 75250000 752d4000   C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16385_none_ebf82fc36c758ad5\COMCTL32.dll
ModLoad: 768f0000 76950000   C:\Windows\syswow64\IMM32.dll
ModLoad: 74ad0000 74b9c000   C:\Windows\syswow64\MSCTF.dll
(d38.ab0): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=7c4e0000 edx=0008e3b8 esi=fffffffe edi=76f23b1c
eip=76fa09bd esp=0018fb0c ebp=0018fb38 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!LdrpDoDebuggerBreak+0x2c:
76fa09bd cc              int     3

On the command window within WinDbg, I enter this:

Code: Select all

s 00400000 00797000 '2' '0' '0'

And I see this, and nothing else, like it doesn't recognize my searchh:

Code: Select all

0:000> s 00400000 00797000 '2' '0' '0'

shea851 · Post by **shea851** » Sat Apr 24, 2010 2:57 am

Got it, thanks for your help.

bookers · Post by **bookers** » Fri May 07, 2010 8:39 am

So now you get it which version of mq2 are you using for SOD ?

shea851 · Post by **shea851** » Tue May 25, 2010 10:55 pm

You should be able to find the version using the information posted in this thread. Sorry, I had to go through this process to find the version, so shall you!

Here's a hint: s 00400000 00797000 '2' '0' '0' posted by dont_know_at_all is only partially right. The version information may actually lie outside of the range of 00400000 00797000. Try s 00000000 00797000 '2' '0' '0' or something. Good luck!

dont_know_at_all · Post by **dont_know_at_all** » Tue May 25, 2010 11:12 pm

#define __ExpectedVersionDate "Dec 19 2008"
#define __ExpectedVersionTime "15:22:49"

shea851 wrote:Here's a hint: s 00400000 00797000 '2' '0' '0' posted by dont_know_at_all is only partially right. The version information may actually lie outside of the range of 00400000 00797000. Try s 00000000 00797000 '2' '0' '0' or something. Good luck!

That's useless, the correct date strings are not before the address where the program is loaded.

shea851 · Post by **shea851** » Wed May 26, 2010 5:34 pm

Oops sorry. Thought that was what I changed within my search string. I checked it and here's what I actually did:

00400000 00800000

searching between 00400000 00797000 doesn't work

ATMGeek · Post by **ATMGeek** » Sun May 08, 2011 12:24 am

I'm running into the same thing as what shea851 was running into.

I've tried both 32 and 64 bit versions of WinDbg. Nothing happens after I try to search for the information you told me to. I'm following your directions exactly. Perhaps there is some sort of setting or configuration I need to set in order to be able to search like you can? I don't really know, WinDbg is totally new to me. Going to look into some tutorials for it I guess.

Right after that, he said that he got it. Was there something special that was said?

On a side note, I cannot get the "symbols" package to work at all. I've downloaded and installed all of them. I've even tried making them all my "symbols" source, but to no avail. I've used the website that the msdn site spoke of to pull down the symbols...but I don't get to see things that what dkaa posted.

Code: Select all

0:000:x86> s 00400000 00797000 '2' '0' '0'
005b914f  32 30 30 00 00 9a 99 19-3f 9a 99 99 3e 0a 28 00  200.....?...>.(.
005c510b  32 30 30 33 00 31 36 3a-30 33 3a 32 31 00 00 00  2003.16:03:21...
005dc6b8  32 30 30 61 00 00 00 00-14 c9 5d 00 45 53 56 00  200a......].ESV.
0:000:x86> dc 005c510b-20
005c50eb  696c4300 20746e65 73726556 3a6e6f69  .Client Version:
005c50fb  20732520 00007325 766f4e00 20332020   %s %s...Nov  3
005c510b  33303032 3a363100 323a3330 00000031  2003.16:03:21...
005c511b  74614600 65206c61 726f7272 206e6920  .Fatal error in
005c512b  6e69616d 65726874 20216461 6c655228  mainthread! (Rel
005c513b  65736165 696c4320 20746e65 30333623  ease Client #630
005c514b  00000a29 74614600 65206c61 726f7272  )....Fatal error
005c515b  63636f20 65727275 6e692064 69616d20   occurred in mai

Any assistance would be greatly appreciated.

My version of EQ is Underfoot. I've presently tried using 20081223a.zip as the MQ2 build and was getting the incorrect client version message. I presently have both 32 and 64 versions of Windbg installed as well as all of the symbols flavors (32 RTM, 32 RC, 64 RTM and 64 RC).

Here is what I get when I run the command windbg -Q eqgame.exe patchme

Code: Select all

WARNING: Inaccessible path: 'D:\Symbols\ntdll.pdb\F0164DA71FAF4765B8F3DB4F2D7650EA2\'
CommandLine: "d:\games\steam\steamapps\common\everquest\eqgame.exe" patchme
WARNING: Inaccessible path: 'D:\Symbols\ntdll.pdb\F0164DA71FAF4765B8F3DB4F2D7650EA2\'
Symbol search path is: D:\Symbols;D:\SymbolsRC32;D:\SymbolsRC64;D:\SymbolsRTM32;http://msdl.microsoft.com/download/symbols;D:\Symbols\ntdll.pdb\F0164DA71FAF4765B8F3DB4F2D7650EA2\;D:\Symbols\ntdll.pdb
Executable search path is: 
ModLoad: 00400000 00b85000   testeqgame.exe
ModLoad: 76f10000 77090000   ntdll.dll
ModLoad: 76550000 76660000   C:\Windows\syswow64\kernel32.dll
ModLoad: 74b00000 74b46000   C:\Windows\syswow64\KERNELBASE.dll
ModLoad: 21100000 2115f000   d:\games\steam\steamapps\common\everquest\mss32.dll
ModLoad: 74bf0000 74cf0000   C:\Windows\syswow64\USER32.dll
ModLoad: 76a10000 76aa0000   C:\Windows\syswow64\GDI32.dll
ModLoad: 76ee0000 76eea000   C:\Windows\syswow64\LPK.dll
ModLoad: 74b50000 74bed000   C:\Windows\syswow64\USP10.dll
ModLoad: 750d0000 7517c000   C:\Windows\syswow64\msvcrt.dll
ModLoad: 74e40000 74ee0000   C:\Windows\syswow64\ADVAPI32.dll
ModLoad: 753e0000 753f9000   C:\Windows\SysWOW64\sechost.dll
ModLoad: 752f0000 753e0000   C:\Windows\syswow64\RPCRT4.dll
ModLoad: 74a70000 74ad0000   C:\Windows\syswow64\SspiCli.dll
ModLoad: 74a60000 74a6c000   C:\Windows\syswow64\CRYPTBASE.dll
ModLoad: 74010000 74042000   C:\Windows\SysWOW64\WINMM.dll
ModLoad: 73f90000 73f97000   C:\Windows\SysWOW64\WSOCK32.dll
ModLoad: 75490000 754c5000   C:\Windows\syswow64\WS2_32.dll
ModLoad: 74cf0000 74cf6000   C:\Windows\syswow64\NSI.dll
ModLoad: 72330000 72360000   C:\Windows\SysWOW64\DINPUT8.dll
ModLoad: 00e60000 010c0000   C:\Windows\SysWOW64\d3dx9_30.dll
ModLoad: 754d0000 755c5000   C:\Windows\syswow64\WININET.dll
ModLoad: 76420000 76477000   C:\Windows\syswow64\SHLWAPI.dll
ModLoad: 74d00000 74e36000   C:\Windows\syswow64\urlmon.dll
ModLoad: 74f70000 750cc000   C:\Windows\syswow64\ole32.dll
ModLoad: 75400000 7548f000   C:\Windows\syswow64\OLEAUT32.dll
ModLoad: 76890000 769ad000   C:\Windows\syswow64\CRYPT32.dll
ModLoad: 74ad0000 74adc000   C:\Windows\syswow64\MSASN1.dll
ModLoad: 76220000 7641b000   C:\Windows\syswow64\iertutil.dll
ModLoad: 10000000 1063b000   d:\games\steam\steamapps\common\everquest\xul.dll
ModLoad: 00220000 00288000   d:\games\steam\steamapps\common\everquest\js3250.dll
ModLoad: 30000000 30028000   d:\games\steam\steamapps\common\everquest\nspr4.dll
ModLoad: 7c340000 7c396000   d:\games\steam\steamapps\common\everquest\MSVCR71.dll
ModLoad: 00020000 00028000   d:\games\steam\steamapps\common\everquest\plc4.dll
ModLoad: 00030000 00036000   d:\games\steam\steamapps\common\everquest\plds4.dll
ModLoad: 755d0000 7621a000   C:\Windows\syswow64\SHELL32.dll
ModLoad: 74530000 74539000   C:\Windows\SysWOW64\VERSION.dll
ModLoad: 742c0000 74311000   C:\Windows\SysWOW64\WINSPOOL.DRV
ModLoad: 75180000 751fb000   C:\Windows\syswow64\comdlg32.dll
ModLoad: 71120000 711a4000   C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll
ModLoad: 769b0000 76a10000   C:\Windows\syswow64\IMM32.dll
ModLoad: 76480000 7654c000   C:\Windows\syswow64\MSCTF.dll
(e94.438): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=a2e90000 edx=0008e3c8 esi=fffffffe edi=00000000
eip=76fb0f3b esp=0018fb08 ebp=0018fb34 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!LdrpDoDebuggerBreak+0x2c:
76fb0f3b cc              int     3

The following returns no results or actions

Code: Select all

0:000> s 00400000 00797000 '2' '0' '0'

I'm thinking that I'm missing something simple or obvious. Any guidance that you may be able to provide would be greatly appreciated.

James

ieatacid · Post by **ieatacid** » Sun May 08, 2011 2:09 am

Try '2' '0' '1' '0' or '2' '0' '1' '1'

htw · Post by **htw** » Sun May 08, 2011 4:50 am

ATMGeek: Underfoot wasn't even out in Dec 2008. For underfoot release exe, you should have:

Code: Select all

#define __ExpectedVersionDate                                     "Jun  8 2010"
#define __ExpectedVersionTime                                     "16:44:32"

So you would grab MQ2-20100609.zip

The zip you said you are using is for SOD (Seeds of Destruction), which was Dec 2008. In that case though, you would want to use MQ2-20081225.zip.

Not trying to derail you getting help with windbg though, sorry!

htw

Edit: Correction MQ2-20101225.zip -> MQ2-20081225.zip

ATMGeek · Post by **ATMGeek** » Sun May 08, 2011 2:02 pm

Thanks ieatacid. I did try this and was still getting no return on the search string.

ieatacid wrote:Try '2' '0' '1' '0' or '2' '0' '1' '1'

htw wrote:ATMGeek: Underfoot wasn't even out in Dec 2008. For underfoot release exe, you should have:
Code: Select all
#define __ExpectedVersionDate                                     "Jun  8 2010"
#define __ExpectedVersionTime                                     "16:44:32"
So you would grab MQ2-20100609.zip

The zip you said you are using is for SOD (Seeds of Destruction), which was Dec 2008. In that case though, you would want to use MQ2-20101225.zip.

Not trying to derail you getting help with windbg though, sorry!

htw

So I did take htw up on his "alternate approach". That did fix my woes of not having the correct version. I really appreciate your responses. I'm still going to try to get that damn windbg to work though. It bothers me to no end when I'm unable to do something. Thanks again!

The only issue that I'm getting now is from my version of MQ2Cast. I'm going to see if there isn't some information out there about it.

James

Finding eqgame.exe version with windbg

Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg

Re: Finding eqgame.exe version with windbg