/select item issues?

[Vexix]

Since the latest patch, I've been having troubles with /selectitem and $selecteditem(). I have both mq2data and mq2parms enabled. I've been writing some bazaar macros using both parms and the new mq2data commands, and they've worked fine with both commands up until this most recent patch. I'm using the latest zip from April 15 2004 15:50:35, compiled after doing a clean.

Issue #1
After using /selectitem, $selecteditem doesn't work. After opening the merchant window, or clicking on any item, /echo $selecteditem() returns the name of the item without problem. If I use /selectitem slot 2 merchant, the appropriate item will be selected, but now /echo $selecteditem() returns "$selecteditem()" back to me instead of the item name. Also, if I play around with /selectitem and real mouse clicks, I can get 2 items selected (highlighted in yellow) simultaneously. Not a good sign.

Issue #2
Using /selectitem four or five times causes CTD. Thanks to Lax's supercool new explanation on how to trap access violations exceptions, I have the debug on the crash. Here is the call stack:

MQ2MAIN! 01338743() (Yellow arrow here)
MQ2MAIN! 01334f25()
EQGAME! 004e2c5e()
EQGAME! 005821a7() (Green triangle here)

I'm using these commands for testing from in game command line, but here is the tail of the debug:

[MQ2]CCommandHook::Detour(/echo $selecteditem(itemslot2))
[MQ2]Echo - [MQ2] 367
[MQ2]WriteChatColor([MQ2] 367)
[MQ2]CCommandHook::Detour(/selectitem slot 4 merchant)
[MQ2]/selectitem : yes the command works at least to this point
[MQ2]CChatHook::Detour(Stable Hand Brack tells you, 'That'll be 8399 platinum 9 gold 9 silver 9 copper for the Brown Rope Bridle.')
[MQ2]CCommandHook::Detour(/selectitem slot 4 merchant)
[MQ2]/selectitem : yes the command works at least to this point

Here is the disassembly around the yellow arrow:

01338691 je 013386FA
01338693 mov edx,dword ptr [ebp-214Ch]
01338699 mov eax,dword ptr [ebp-1030h]
0133869F mov ecx,dword ptr [eax+edx*4+4]
013386A3 mov dword ptr [ebp-101Ch],ecx
013386A9 mov edx,dword ptr [ebp-101Ch]
013386AF mov eax,dword ptr [edx+4]
013386B2 mov dword ptr [ebp-1010h],eax
013386B8 mov ecx,dword ptr [ebp-1010h]
013386BE mov edx,dword ptr [ecx+118h]
013386C4 cmp edx,dword ptr [ebp-1014h]
013386CA jne 013386FA
013386CC mov eax,dword ptr [ebp-101Ch]
013386D2 mov dword ptr [ebp-1008h],eax
013386D8 mov ecx,dword ptr [ebp-1010h]
013386DE mov dword ptr [ebp-2040h],ecx
013386E4 mov dword ptr [ebp-804h],1
013386EE mov dword ptr [ebp-100Ch],1
013386F8 jmp 013386FF
013386FA jmp 01338668
013386FF mov dword ptr [ebp-102Ch],0
01338709 cmp dword ptr [ebp-100Ch],1
01338710 jne 013388A6
01338716 mov edx,dword ptr [ebp-102Ch]
0133871C mov eax,dword ptr [ebp-1020h]
01338722 cmp dword ptr [eax+edx*4+158h],0
0133872A je 013388A6
01338730 cmp dword ptr [ebp-804h],0
01338737 jne 013387E2
0133873D mov ecx,dword ptr [ebp-1024h]
01338743 mov edx,dword ptr [ecx+4] (Yellow arrow here)
01338746 mov dword ptr [ebp-1034h],edx
0133874C mov eax,dword ptr [ebp-1034h]
01338752 mov dword ptr [eax+12Ch],0
0133875C mov ecx,dword ptr [ebp-102Ch]
01338762 mov edx,dword ptr [ebp-1020h]
01338768 cmp dword ptr [edx+ecx*4+2B4h],0
01338770 jne 01338777
01338772 jmp 013388A6
01338777 mov eax,dword ptr [ebp-102Ch]
0133877D mov ecx,dword ptr [ebp-1020h]
01338783 mov edx,dword ptr [ecx+eax*4+2B4h]
0133878A mov dword ptr [ebp-1018h],edx
01338790 mov eax,dword ptr [ebp-1018h]
01338796 mov dword ptr [eax+12Ch],1
013387A0 mov ecx,dword ptr ds:[13AC368h]
013387A6 mov edx,dword ptr [ebp-1018h]
013387AC mov eax,dword ptr [edx+130h]
013387B2 mov dword ptr [ecx],eax
013387B4 mov ecx,dword ptr [ebp-1018h]
013387BA mov edx,dword ptr [ecx+124h]
013387C0 mov dword ptr [ebp-2150h],edx
013387C6 cmp dword ptr [ebp-2150h],0
013387CD jne 013387D4
013387CF jmp 013388A6
013387D4 cmp dword ptr [ebp-1014h],0
013387DB jne 013387E2
013387DD jmp 013388A6
013387E2 cmp dword ptr [ebp-804h],1
013387E9 jne 0133888B
013387EF mov eax,dword ptr [ebp-1024h]
013387F5 mov ecx,dword ptr [eax+4]
013387F8 mov dword ptr [ebp-1034h],ecx
013387FE mov edx,dword ptr [ebp-1034h]
01338804 mov dword ptr [edx+12Ch],0
0133880E cmp dword ptr [ebp-1008h],0
01338815 jne 0133881C
01338817 jmp 013388A6
0133881C cmp dword ptr [ebp-2040h],0
01338823 jne 01338827
01338825 jmp 013388A6
01338827 mov eax,dword ptr [ebp-2040h]
0133882D mov dword ptr [ebp-1018h],eax
01338833 mov ecx,dword ptr [ebp-1018h]

Don't know if it's relevant, but the new ${merchant} commands don't seem to be working for me either. I just get NULL in response to anything.

Let me know if you need anything else.

And thanks!

--Vexix

[Lax]

While that does help, you forgot 3 of the 5 things we asked for in the crash

The crash is in MQ2, so we should have the source line causing the problem. The address and disassembly are pretty useless since neither are likely to match the address or disassembly in my copy. Anyway the crash is in the command itself, but its a relatively big command so I cant just look at it and identify the crash without the source line.

We also dont have the error as shown in the output window, etc

[Vexix]

Damn. Ok, here's seeing if I can get a few more out of the 5 you ask for. . .

1. Actual error message on little pop up window:
First chance exception in eqgame.exe (MQ2MAIN.DLL):0xC0000005: Access Violation

2. Is error in EQ or MQ? I guess MQ, from your response, but I don't know how I would tell. Because error above happened in mq2main.dll? You mention that VS should automagically show where in the code the error occured, but I don't see this. Looking. . . Nope, still no idea how to get the error line in the MQ source code beyond "MQ2MAIN01338743()" Any idea how to bring this up if it doesn't appear?

There is no macro code to refer back to, since this error isn't coming from a .mac file. I'm testing it, so I'm just typing /selectitem slot 4 merchant into the EQ window.

Here's the last line of the output, which I see only after I stop debugging:
The program 'C:\PROGRA~1\EVERQU~1\eqgame.exe' has exited with code 0 (0x0).

Did I get any more of the 5?

--Vexix

[Lax]

Yes the first chance exception was the message we'd need. The (MQ2MAIN.DLL) part indeed shows that it was in MQ.

From talking to Vexix in IRC I've determined that the .PDB files are not being created by our VC6 projects, this is the reason for not finding the source lines. I'm looking into this now.

[Vexix]

Thanks for the *.pbd goodness in the new zip, Lax. I now have some more (helpful) information on the crash.

It seems to happen when I have an item already selected, and then use /selectitem to select it again, so just typing "/selectitem slot 4 merchant" twice will probably do it.

Here's the call stack:

MQ2MAIN! SelectItem + 2299 bytes <------ Yellow arrow here.
MQ2MAIN! CCommandHook::Detour(struct EQData::_SPAWNINFO *,char *) + 693 bytes
EQGAME! 004e2c5e()
EQGAME! 005821a7()

And here's the disassembly:

01338559 call SelectFind (013378a6)
0133855E add esp,8
01338561 mov dword ptr [ebp-102Ch],eax
01338567 cmp dword ptr [ebp-102Ch],0EA5Fh
01338571 jne _SelectItem+726h (01338578)
01338573 jmp _SelectItem+0A5Eh (013388b0)
01338578 cmp dword ptr [ebp-102Ch],1Eh
0133857F jl _SelectItem+7FEh (01338650)
01338585 mov dword ptr [ebp-2148h],0
0133858F mov eax,dword ptr [ebp-102Ch]
01338595 mov dword ptr [ebp-1014h],eax
0133859B mov dword ptr [ebp-2148h],119h
013385A5 jmp _SelectItem+764h (013385b6)
013385A7 mov ecx,dword ptr [ebp-2148h]
013385AD add ecx,1
013385B0 mov dword ptr [ebp-2148h],ecx
013385B6 cmp dword ptr [ebp-2148h],16Ah
013385C0 jge _SelectItem+7EFh (01338641)
013385C2 mov edx,dword ptr [ebp-2148h]
013385C8 mov eax,dword ptr [ebp-1030h]
013385CE cmp dword ptr [eax+edx*4+4],0
013385D3 je _SelectItem+7EAh (0133863c)
013385D5 mov ecx,dword ptr [ebp-2148h]
013385DB mov edx,dword ptr [ebp-1030h]
013385E1 mov eax,dword ptr [edx+ecx*4+4]
013385E5 mov dword ptr [ebp-101Ch],eax
013385EB mov ecx,dword ptr [ebp-101Ch]
013385F1 mov edx,dword ptr [ecx+4]
013385F4 mov dword ptr [ebp-1010h],edx
013385FA mov eax,dword ptr [ebp-1010h]
01338600 mov ecx,dword ptr [eax+118h]
01338606 cmp ecx,dword ptr [ebp-1014h]
0133860C jne _SelectItem+7EAh (0133863c)
0133860E mov edx,dword ptr [ebp-101Ch]
01338614 mov dword ptr [ebp-1008h],edx
0133861A mov eax,dword ptr [ebp-1010h]
01338620 mov dword ptr [ebp-2040h],eax
01338626 mov dword ptr [ebp-804h],1
01338630 mov dword ptr [ebp-100Ch],1
0133863A jmp _SelectItem+7EFh (01338641)
0133863C jmp _SelectItem+755h (013385a7)
01338641 mov dword ptr [ebp-102Ch],0
0133864B jmp _SelectItem+8C1h (01338713)
01338650 mov dword ptr [ebp-214Ch],0
0133865A mov ecx,dword ptr [ebp-102Ch]
01338660 mov dword ptr [ebp-1014h],ecx
01338666 mov dword ptr [ebp-214Ch],0
01338670 jmp _SelectItem+82Fh (01338681)
01338672 mov edx,dword ptr [ebp-214Ch]
01338678 add edx,1
0133867B mov dword ptr [ebp-214Ch],edx
01338681 cmp dword ptr [ebp-214Ch],1Eh
01338688 jge _SelectItem+8B7h (01338709)
0133868A mov eax,dword ptr [ebp-214Ch]
01338690 mov ecx,dword ptr [ebp-1030h]
01338696 cmp dword ptr [ecx+eax*4+4],0
0133869B je _SelectItem+8B2h (01338704)
0133869D mov edx,dword ptr [ebp-214Ch]
013386A3 mov eax,dword ptr [ebp-1030h]
013386A9 mov ecx,dword ptr [eax+edx*4+4]
013386AD mov dword ptr [ebp-101Ch],ecx
013386B3 mov edx,dword ptr [ebp-101Ch]
013386B9 mov eax,dword ptr [edx+4]
013386BC mov dword ptr [ebp-1010h],eax
013386C2 mov ecx,dword ptr [ebp-1010h]
013386C8 mov edx,dword ptr [ecx+118h]
013386CE cmp edx,dword ptr [ebp-1014h]
013386D4 jne _SelectItem+8B2h (01338704)
013386D6 mov eax,dword ptr [ebp-101Ch]
013386DC mov dword ptr [ebp-1008h],eax
013386E2 mov ecx,dword ptr [ebp-1010h]
013386E8 mov dword ptr [ebp-2040h],ecx
013386EE mov dword ptr [ebp-804h],1
013386F8 mov dword ptr [ebp-100Ch],1
01338702 jmp _SelectItem+8B7h (01338709)
01338704 jmp _SelectItem+820h (01338672)
01338709 mov dword ptr [ebp-102Ch],0
01338713 cmp dword ptr [ebp-100Ch],1
0133871A jne _SelectItem+0A5Eh (013388b0)
01338720 mov edx,dword ptr [ebp-102Ch]
01338726 mov eax,dword ptr [ebp-1020h]
0133872C cmp dword ptr [eax+edx*4+158h],0
01338734 je _SelectItem+0A5Eh (013388b0)
0133873A cmp dword ptr [ebp-804h],0
01338741 jne _SelectItem+99Ah (013387ec)
01338747 mov ecx,dword ptr [ebp-1024h]
0133874D mov edx,dword ptr [ecx+4] <--------- Yellow arrow here
01338750 mov dword ptr [ebp-1034h],edx
01338756 mov eax,dword ptr [ebp-1034h]
0133875C mov dword ptr [eax+12Ch],0
01338766 mov ecx,dword ptr [ebp-102Ch]
0133876C mov edx,dword ptr [ebp-1020h]
01338772 cmp dword ptr [edx+ecx*4+2B4h],0
0133877A jne _SelectItem+92Fh (01338781)
0133877C jmp _SelectItem+0A5Eh (013388b0)
01338781 mov eax,dword ptr [ebp-102Ch]
01338787 mov ecx,dword ptr [ebp-1020h]
0133878D mov edx,dword ptr [ecx+eax*4+2B4h]
01338794 mov dword ptr [ebp-1018h],edx
0133879A mov eax,dword ptr [ebp-1018h]
013387A0 mov dword ptr [eax+12Ch],1
013387AA mov ecx,dword ptr [_ppSelectedItem (013ad3d0)]
013387B0 mov edx,dword ptr [ebp-1018h]
013387B6 mov eax,dword ptr [edx+130h]
013387BC mov dword ptr [ecx],eax
013387BE mov ecx,dword ptr [ebp-1018h]
013387C4 mov edx,dword ptr [ecx+124h]
013387CA mov dword ptr [ebp-2150h],edx
013387D0 cmp dword ptr [ebp-2150h],0
013387D7 jne _SelectItem+98Ch (013387de)
013387D9 jmp _SelectItem+0A5Eh (013388b0)
013387DE cmp dword ptr [ebp-1014h],0
013387E5 jne _SelectItem+99Ah (013387ec)
013387E7 jmp _SelectItem+0A5Eh (013388b0)
013387EC cmp dword ptr [ebp-804h],1
013387F3 jne _SelectItem+0A43h (01338895)
013387F9 mov eax,dword ptr [ebp-1024h]
013387FF mov ecx,dword ptr [eax+4]
01338802 mov dword ptr [ebp-1034h],ecx
01338808 mov edx,dword ptr [ebp-1034h]
0133880E mov dword ptr [edx+12Ch],0
01338818 cmp dword ptr [ebp-1008h],0
0133881F jne _SelectItem+9D4h (01338826)
01338821 jmp _SelectItem+0A5Eh (013388b0)
01338826 cmp dword ptr [ebp-2040h],0
0133882D jne _SelectItem+9DFh (01338831)
0133882F jmp _SelectItem+0A5Eh (013388b0)
01338831 mov eax,dword ptr [ebp-2040h]
01338837 mov dword ptr [ebp-1018h],eax
0133883D mov ecx,dword ptr [ebp-1018h]
01338843 mov dword ptr [ecx+12Ch],1
0133884D mov edx,dword ptr [_ppSelectedItem (013ad3d0)]
01338853 mov eax,dword ptr [ebp-1008h]
01338859 mov dword ptr [edx],eax
0133885B mov ecx,dword ptr [ebp-1018h]
01338861 mov edx,dword ptr [ecx+124h]
01338867 mov dword ptr [ebp-2150h],edx
0133886D mov eax,dword ptr [ebp-2040h]
01338873 mov ecx,dword ptr [eax+118h]
01338879 mov dword ptr [ebp-1014h],ecx
0133887F cmp dword ptr [ebp-2150h],0
01338886 jne _SelectItem+0A38h (0133888a)
01338888 jmp _SelectItem+0A5Eh (013388b0)
0133888A cmp dword ptr [ebp-1014h],0
01338891 jne _SelectItem+0A43h (01338895)
01338893 jmp _SelectItem+0A5Eh (013388b0)
01338895 mov edx,dword ptr [ebp-2150h]
0133889B push edx
0133889C mov eax,dword ptr [ebp-1014h]
013388A2 push eax
013388A3 mov ecx,dword ptr [_ppMerchantWnd (013ad4b8)]
013388A9 mov ecx,dword ptr [ecx]
013388AB call EQClasses::CMerchantWnd::SelectBuySellSlot (01331153)

Frequency has posted about the same weird /selectitem -> ${SelectedItem} bug I mentioned before.

If you need more information, just gimme a pointer on how to get it for you.

Many thanks!

--Vexix

[Lax]

It's in MQ2 so we actually wanted the source line, and when posting the disassembly we only need like 5-10 lines

But, might be able to figure it out from this now.