Can someone explain how the "function locations" offsets work and how they are found/determined?
I had really not paid any attention to these until tonight when I was trying to determine why the new LDoN races aren't coming up correctly on superwho.
Understand "Function Locations" offsets in eqgame.
Moderator: MacroQuest Developers
That's funny, I wondered the same thing. I've been able to find all the other offsets within the eqgame.exe file, except for the function locations... So this is my GUESS:
the function locations section refers to the address in memory where a certain function starts. I guess there are a million ways to find these offsets, but I prefer brute force over disassembly and whatnot. If you already know what the current offset is, I *think* you can do it like this, for example...
0xB8 , 0x60 , 0x04 , 0x59, 0x00 , 0xE8 , 0xC4, 0x92.
Then later on, when you don't know the offset, you just search for the above pattern. Assuming they never changed the beginning of the function around, it should still match, and be located at the NEW offset.
Of course this is just a stab in the dark, but it sorta makes sense when I read it back to myself
and it's also the method I use for finding the -other- offsets in eqgame.exe, except in that case im searching the file itself, not the RAM.
the function locations section refers to the address in memory where a certain function starts. I guess there are a million ways to find these offsets, but I prefer brute force over disassembly and whatnot. If you already know what the current offset is, I *think* you can do it like this, for example...
Start up EQ, and go to 0x490E9A in eqgame.exe's memory.. Assuming that I know what the hell I'm talking about, you should be looking at the very first instructions of the WriteChatColor function, which in my case the first 8 bytes were...[Function Locations]
WriteChatColor=00490E9A
0xB8 , 0x60 , 0x04 , 0x59, 0x00 , 0xE8 , 0xC4, 0x92.
Then later on, when you don't know the offset, you just search for the above pattern. Assuming they never changed the beginning of the function around, it should still match, and be located at the NEW offset.
Of course this is just a stab in the dark, but it sorta makes sense when I read it back to myself
and it's also the method I use for finding the -other- offsets in eqgame.exe, except in that case im searching the file itself, not the RAM.That method works to an extent, but for a lot of functions, the first few lines are the same or refer to an offset that changes between versions. Quite some time ago I had written a program that looks for the type of pattern you mention, but could be any size and could grab the offset from a call, and ignore offsets that could change between versions. This isn't perfect either, but it has a higher accuracy rate.
Your best bet in reality is to grab a good disassembler like IDA and learn what the function actually looks like and does, what other functions it calls and what known offsets it uses. Then if you can't find your pattern, you know basically what to look for. I actually would look for WriteChatColor by watching for a string being grabbed from the string table by number -- you can find this without knowing the string table functions, look for push 3023h etc --and then being sent to a function directly after... which would normally be CEverQuest::dsp_chat or WriteChatColor :)
What I'm working on with the leaked .map info will have great accuracy and label thousands of the known functions and offsets, and when that happens you might not need to do either of the above :)
Your best bet in reality is to grab a good disassembler like IDA and learn what the function actually looks like and does, what other functions it calls and what known offsets it uses. Then if you can't find your pattern, you know basically what to look for. I actually would look for WriteChatColor by watching for a string being grabbed from the string table by number -- you can find this without knowing the string table functions, look for push 3023h etc --and then being sent to a function directly after... which would normally be CEverQuest::dsp_chat or WriteChatColor :)
What I'm working on with the leaked .map info will have great accuracy and label thousands of the known functions and offsets, and when that happens you might not need to do either of the above :)
Lax Lacks
Master of MQ2 Disaster
Purveyor of premium, EULA-safe MMORPG Multiboxing Software
* Multiboxing with ISBoxer: Quick Start Video
* EQPlayNice, WinEQ 2.0
Master of MQ2 Disaster
Purveyor of premium, EULA-safe MMORPG Multiboxing Software
* Multiboxing with ISBoxer: Quick Start Video
* EQPlayNice, WinEQ 2.0
Use XVI32 which allows you to do "wildcard" searches on Hex. Dissassemble old eqgame.exe, goto the offset mentioned in the eqgame.ini, look at the hex there. What i usually do is then go into XVI32, press CTRL-F, make sure wildcard search is enabled (default wildcard char is 2E), then type the first hex value of each line of the dissassembled eqgame.exe in there, padding with 2e's. I'd normally do this for maybe ten lines, but basically just keep on adding lines until to returns just one location is the search results.
Probably doesnt make any sense, i'm somewhat crap at explaining things!
MOTD
Probably doesnt make any sense, i'm somewhat crap at explaining things!
MOTD
-
FrankJScott
- naggy
- Posts: 2385
- Joined: Sun Feb 19, 2023 7:11 am
Top Rated Updated Product Blog Tips
Please use Google before posting Top Rated Top Product Site Website dec9a89
-
FrankJScott
- naggy
- Posts: 2385
- Joined: Sun Feb 19, 2023 7:11 am
-
FrankJScott
- naggy
- Posts: 2385
- Joined: Sun Feb 19, 2023 7:11 am
Top Rated Djarumtoto Blog
In reply to the guy asking about bonanza 138 login link alternatif, rtp slot pragmatic gacor hari ini, rtp live slot sultan77, link alternatif bca77, rtp pragmatic gacor hari ini, cara cek rtp slot pragmatic live, I highly suggest this great djarumtoto site or rtp slot big777, rtp live arena369, livejudi rtp, musimqq login, agen878 rtp, rtp hari ini pragmatic play, not to mention this top rated djarumtoto forum and don't forget rp369 rtp, rtp live gacor hari ini, hoki99 rtp live, rtp wwg hari ini, agenqq login, rtp live master138, on top of this web site for djarumtoto link which is also great. Also, have a look at this more helpful hints about djarumtoto details not to mention 77dragon live, jonitogel login, link babe138, rtp live rasa4d, rtp live habanero hari ini, rtp slot 89, not to mention this my explanation for djarumtoto advice alongside all rtp hari ini live, rtp pragmatic update, rtp live prada 188, rtp slot977 hari ini, elanggame rtp live, rtp live 4d, as well as recommended site for djarumtoto blog which is also worth a look. I also suggest this my latest blog post for djarumtoto blog as well as rtp live stars77, rtp pragmatic tertinggi, rtp live panda88, rtp pgsoft hari ini, masterpoker88 pkv, gacor77 rtp live, not to mention this i was reading this about djarumtoto url and don't forget link vip4dp, taipan77 rtp, rtp live victory88, rtp live jet77, rtp game slot live, rtp slot hari ini pragmatic, alongside all recommended djarumtoto forum and don't forget rtp live bitcasino, rtp slot gacor hari ini live pragmatic play, 88cash slot login, rtp live game slot online, rtp live sikat88, mikigaming login, which is also great. Finally, have a look at this top rated djarumtoto tips with livechat mpo1221, mgo55 rtp, rtp slot633, big777 rtp, masterpoker88 login, agen asia118, for good measure. Check more @ High Rated Djarumtoto Info a61d1ac