Solved offsets for eqgame.exe 09-09-2003 import to IDA

Lax · Post by **Lax** » Mon Oct 06, 2003 6:11 pm

Er. ok after looking back through it after fixing some problems in the algorithm, the ecx+194h is right. 154h was the offset in the testeqgame.exe from june, 194h is the new AFK offset in the struct (and MQ's info is right :) )

Amadeus · Post by **Amadeus** » Mon Oct 06, 2003 6:41 pm

hmmm...but AFK seems to work as it is ...perhaps it's being called from CHARINFO ...I'll check tonight.

Amadeus · Post by **Amadeus** » Mon Oct 06, 2003 10:08 pm

I am honestly doing ok with this! I just wish I knew what some of these other variables are usually ...like 'ebx', 'esi', 'esp' and 'edi' ......could someone help me out a little understanding the difference between all these or else point me to a good reference on these?

I found a fairly decent reference on the actual commands and especially the jump commands, but not the registers (that's the correct term, right?)

Here's an example using some of those things I dont' know

Code: Select all

.text:00462E17 EQPlayer__SetSounds
.text:00462E17 
.text:00462E17 var_4           = dword ptr -4
.text:00462E17 
.text:00462E17                 push    ecx  
.text:00462E18                 push    ebx
.text:00462E19                 push    ebp
.text:00462E1A                 push    esi
.text:00462E1B                 mov     esi, ecx
.text:00462E1D                 mov     eax, [esi+188h]
.text:00462E23                 xor     ebx, ebx
.text:00462E25                 cmp     eax, 51h
.text:00462E28                 push    edi
.text:00462E29                 mov     [esp+14h+var_4], eax
.text:00462E2D                 mov     edx, 82h

Also (and another topic altogether), is everything correct now? I was just wanting to work on some struct stuff and don't want to do anything if it's still a little off. For example, I was going through the mount/dismount functions and think I can fill out a bout 2 or 3 more spots in the SPAWNINFO struct with data if I know that what we have right now is correct.

Lax · Post by **Lax** » Mon Oct 06, 2003 10:45 pm

This is how computers work. You have a limited set of "registers", which are basically the fastest RAM possible, built into the chip. EAX, EBX, ECX, EDX, etc are 32-bit registers. These are also separated into AX, AH, AL, BX BH BL, etc. AX would be 16-bit, AH and AL are the 8 bit pair that makes AX. Some operations use specific registers (like DIV, REP) and some accept registers as operands. To keep down the number of operations the CPU has to handle and other reasons, the operations generally work only with registers. Stuff from RAM or disk has to be moved into a register. Push puts something on the stack, pop pops it back off into the given register. It's last in first out, so if you push 1 then pop eax, that's eax=1 (sometimes you'll see that in the EQ assembly). If you push 1, then pop 2, then pop eax, you get eax=2. then if you pop ecx, you get ecx=1.

The stack is used to store variables for later, and pass parameters.

So here's whats going on

push ecx (and subsequent) keeps the value of those registers for later, because they need to be the same when the function returns (you'll see them popped again at the end). EAX is different, it's used for returning values. if you see xor eax,eax at the end and no pop eax, it's returning 0.

mov esi,ecx is setting esi = EQPlayer. I know this because the function is in the class EQPlayer, and ecx is holding the instance data for the class.

mov eax, [esi+188h] is setting eax=EQPlayer+188h
xor ebx, ebx is setting ebx=0
cmp eax, 51h is comparing EAX against 51h. This sets flags (carry flag, equal/zero flag, above flag, below flag, etc. you can look those up)
push edi is putting edi on the stack
etc

dont_know_at_all · Post by **dont_know_at_all** » Mon Oct 06, 2003 10:45 pm

Code: Select all

.text:00462E17 EQPlayer__SetSounds
.text:00462E17 
.text:00462E17 var_4           = dword ptr -4
.text:00462E17 
.text:00462E17                 push    ecx                           ; save off 
.text:00462E18                 push    ebx                           ; registers
.text:00462E19                 push    ebp
.text:00462E1A                 push    esi
.text:00462E1B                 mov     esi, ecx                     ; esi <- this
.text:00462E1D                 mov     eax, [esi+188h]        ; eax <- this->field
.text:00462E23                 xor     ebx, ebx                      ; ebx <- 0
.text:00462E25                 cmp     eax, 51h                     ; if (eax==0x51)
.text:00462E28                 push    edi
.text:00462E29                 mov     [esp+14h+var_4], eax  ;*Param0=eax
.text:00462E2D                 mov     edx, 82h                      ; edx <- 0x82

The if statement really isn't true. The processor flags are set by that cmp (compare) instruction but there is branch instruction shown to take advantage of it and actually implement the if statement.

A called function must maintain all the registers except for eax. There will be a reverse order series of pop instructions before the ret (return).

Lax · Post by **Lax** » Mon Oct 06, 2003 10:46 pm

and no it's not 100% correct yet, I won't have an update to the offsets for another day or two

Amadeus · Post by **Amadeus** » Mon Oct 06, 2003 11:56 pm

ok...I'll wait for the next update then. Hopefully some of the struct offsets will line up (ie, ecx+afk == SPAWNINFO->afk) ...then I can go to town!

[40oz] · Post by **[40oz]** » Tue Oct 07, 2003 3:40 am

Nevermind I'm a noob and fixed my own problem.

Lax · Post by **Lax** » Tue Oct 07, 2003 5:16 pm

I will put off sending a new list to EQMule until the patch coming on the 9th