WIP - PROJECTX
Posted 01 September 2004 - 07:24 AM
This is the first time posting about projectx on the forums.. but certainly not the last.
This project was born from the curiosity and success of 2 days reverse engineering.
The fruit of our works (there are 2 of us) developed into something beyond our meager expectations.
Our initial findings were related to the scripting engine itself, after looking through the asm disassembly for about 20 minutes we managed to obtain a good understanding of how the parser was handling and dealing with the functions (opcodes).
(for anyone thats interested.. though I'm sure this has probably been documented before..) the parser takes the initial 2 bytes of any of the main.scm opcodes and uses them as a reference, firstly to determine which jump table it uses and secondly to formulate the function the jump table finally arrives at. It sounds complex but is actually pretty strait forward if you have a good knowledge of asm.
what does this mean?
ok, once we had reached this point we realized that a HOOK of the parser was very possible, with this achieved we could run very versatile arbitrary scripts along side any .scm script running at the time.
An hour later and the first version of our asm core hook was in place.. running simple opcodes to test its functionality such as 0315h which simply took 0 params and incremented the amount of passengers dropped off in ur stats display.. getting this to run was a clear statement that bigger and better things could easily be achieved with the asm core in place.
next we modified the asm core so that we could run a collection of opcodes instead of just 1, this enables us to do some pretty cool stuff that you will be able to see a little later today when we release a small demo of our 2 day achievements..
so now we had our HOOK in place running selected scripts inside the game alongside the games own script.. we dedicated day 2 to the coding of the directx hooking functions so that people actually have something to enable and utilize the asm core from inside the game..
by the end of day 2 we had a directx console interfaced with the asm core running scripts by console commands..
as you can see the work has progressed very quickly and to be honest more quickly than we both anticipated.. we called it projectx because we really dont know where it will end.. we are both fully versed in network coding and have had success in the network experiments carried out so far with gta:vc.. so i suppose a realistic goal would be to make some kind of online co-op mission creator.. this of course could be a long way away.. but then again.. 2 days ago we had nothing )
look out later today for a little demo of our work so far.. ill re post here when its complete..
tnx for reading...
Posted 01 September 2004 - 07:26 AM
Reckon you could find a way to get a debugger into it, so mission coders can know exactly where their scripts crash?
Posted 01 September 2004 - 07:41 AM
Posted 01 September 2004 - 07:49 AM
I wouldn't mind seeing that version of the debugger in the first release, so if you could add it...
Posted 01 September 2004 - 07:37 PM
i wanted to know if they were planning coop mode for multiplayer
guess they were worried youd take over as top mp mod!!!
what is the demo going to be?
Posted 01 September 2004 - 09:07 PM
I really hope this is going to work out to be a great tool.
Posted 02 September 2004 - 06:53 AM
|hmm posted a link to this when i saw it on mta forums but it got deleted after 2mins|
Y'know, i'm just.....not suprised.
[sheep] - good work, great time. I can't wait to see what else you cna accomplish.
Posted 02 September 2004 - 07:25 PM
Sorry for the slight delay.. real life intrudes as usual
Progress halted for a while
Back on track now.. we WILL have a demo for you guys very soon..
Both myself and spookie noticed the real bad attitude some people have around these forums, the lack of knowledge sharing is almost unbelievable.
Handing over your source code is VERY different to helping a few guys along with memory addresses that in the end could be obtained by anyone with enough time and patience.
Well, we do not intend to keep knowledge from people that would benefit from it.
Saying this brings me onto my final comment, the last thing we did was to reverse the actor building routines. Ill try and explain in simple terms the more important aspects of what happens when you create an actor internally.
CREATE ACTOR REVERSED...
Firstly, all the floats (x,y,z) positions are converted from the script, forumalting the REAL 32bit values into the EAX register.
There is a function that does this and is used for all conversions from SCRIPT to FLOAT, oddly enough they dont just read them directly out of the script, they read it byte by byte using a collection of BIT SHIFTS to formulate the final float..
Once formulate the x,y,z floats are saved for later to be inserted into the newly created actor structure..
Next, the function needs to determine where to allocate the new ACTOR structure, this is done by checking an array to find the next available slot of memory.. every loop, a LOOP COUNTER variable is increased and when it finds the first available slot it marks it as USED! so that its not used by the next generated actor, and then jumps out of the loop onto the next step..
Next, the actor ID is taken from the script (this is the last param) and is basically added to the MAIN.SCRIPT.BASE.VARIABLE.MEMORY for example:
base script address = 456789 (hex)
id = 000c (hex)
NEW_CREATED_ACTOR_ID_ADDRESS = 456795 (hex)
So those 2 values are added together which formulates the final address to store away that LOOP COUNTER variable, this is how the ID system works.. it just looks at its MAIN.SCRIPT.BASE.VARIABLE.MEMORY + ID and it gets the
loop counter then multiplies it by the PLAYER_STRUCT_SIZE (6d8 hex) and it has its start address of the the ID specified.
The counter variable used for the array check is now multiplied by 6d8(hex), this is the size of the player structure as explained above.. it then takes the base address of all actor structures (the base address is actually our MAIN PLAYER!! structure) and adds the result of the multiplication to this value, this points to a blank actor structure which is then initialized with all the data from the character model you specified along with the x,y,z floats saved earlier..
well.. thats basically how it is.. it sounds a little more complex than it really is.. dont know if it helps anyone, i hope so..
neways.. expect demo soon..
Posted 02 September 2004 - 08:40 PM
This might help... got this from CyQ a while back. Proved very useful.
ok, first some interesting mission script related addresses (names mostly copied from gta3 ps2 exe, which still had symbols; it might be worth getting because of similarities with the vc exe):
007D7438 ScriptParams dd 20h dup(?)
00821280 ScriptSpace db 260512 dup(?)
to find out the address of opcode 0407h, here's what you do:
convert to decimal: 1031.
find the appropriate function: ProcessCommands1000to1099.
there, you'll find some code like this:
lea eax, [esi-1002]
mov ebx, ecx
cmp eax, 61h ; switch 98 cases
ja loc_609633 ; default
jmp off_6D750C[eax*4]; switch jump
so you do: 1031-1002=29.
this means you have to get the 30th address in the list at off_6D750C, which happens to be loc_6089EA.
Posted 02 September 2004 - 10:29 PM Edited by Kryptos, 02 September 2004 - 10:35 PM.
Posted 03 September 2004 - 02:10 AM
It is definitely interesting to see others venture in this sort of territory, which is often left unventured in these sorts of games. The amount of power that can come out of hooking directly into this game is immense and you guys are definitely heading in the right direction.
Keep us all posted here, and some of my other team members and I will try to drop some ideas and help where we can.
Posted 03 September 2004 - 03:56 AM
It's always nice to find out your work is appreciated by others.. I hope we all learn a little something from all this.. knowledge is power.. and some people seem to love to horde it.. my intention is only to spread the knowledge so we can all get a little further in our endeavors... tnx again..
Now, you may find this reply a little harsh.. but from what ive seen around this place i think its a) long overdue.. and b) most definitely deserved.
Ive noticed in many posts where the posting parties have either revealed something rather interesting or .. they have shown knowledge of a given subject you reply with the EXACT same trash that you just used in this thread.. you make it sound like you have done all this before.. now!! dont get me wrong.. im not one to band around insults without having a little something to back them up..
If I believed for 1 second that you had any knowledge on the reversing or hooking of gta then i wouldnt be typing this reply to you.. but before i started all this with my good friend spookie we decided to just have a looksee at what was already around.. and when we had stopped laughing.. we knew that it was our duty to bring an actual playable MP mod that wasnt coded by complete f*cking idiots.
btw.. i use the term CODED very loosely here..
your team (which seems to have about 10 lead programmers) and if they dont lead programming they lead something else.. bang on about how you cant possibly let out any secrets because it would aid cheaters in their quest.. ive got a little news for you.. your code is so poorly protected its almost like you want people to cheat anyway!!! from your pathetic trainer detection which HOLY sh*t!!! checks every window name for the word TRAINER!! f*cking hell lads.. must have taken you all night to think that one up!! to your laughable 2.. count them!!! 2 crc file checks... i mean!! you put the message box for the CRC ERROR directly under the check.. why dont you just include an inbuilt trainer? it would save anyone with half a brain 10 seconds work..
how about I point YOU!!! in the right direction... why not use the crc check of the files later on in the loading of the program as part of a decryption key?? that way its very difficult to find.. sh*t.. even putting the messagebox further away from the actual check would be a 100% improvement on your current attempts..
if on the other hand im completely wrong.. and mta was written by a bunch of hardcore reversing maniacs.. why on gods earth do u ignore the immense power of what a hook into the scripting engine can do? MTA looks like it was coded by a bunch of visual basic monkey spasms on a f*cking ego trip..
btw.. ive checked the website.. i do apologize to anyone that is actually normal on the MTA team.. im sure there must be at least 1 or 2.. this is not directed at you in any way.. just the idiots that come to these forums holding their extreme lack of knowledge over others..
IN THE LAND OF THE BLIND!! THE ONE EYED MAN IS KING!! that sums up MTA.
its not often I lash back.. but i try and make sure i get the message across when i do..
Posted 03 September 2004 - 06:27 AM
It's resized, the console doesn't look that tiny in 640x480
Reminds me of Thriller.
Posted 03 September 2004 - 08:56 AM
This release doesn't have the opcode logger as we've modified the asm core this morning for the above mentioned actor behaviour protocols.
Simply drop the executable file into your vice root directory and execute it.
It spawns cars and actors, either random or specified -
Press F11 to be able to type into the console, and then the available commands are
This will spawn a vehicle beside you (despite the name, this works on all vehicles). To view a list of valid vehicle ids press F9. If you do not specify an id a random car will be spawned.
This will spawn an actor beside you. [model] is an optional string specifying the model the actor will have. To view a list of valid model strings press F10. If you do not specify a model it'll be random.
This saves the game's front buffer to file in bitmap format. Files will be named vice00.bmp to vice99.bmp and saved in the game's root directory.
Toggles the in-game GUI transparency.
Quits the game without going through the menus
This is nothing spectacular yet it does demonstrait the flexibility and power of the approach we've taken in producing this mod.
After playing about with our dynamic scripting engine a bit more (we're making it even more flexible would you believe) it'll be time to move onto the network coding. Once the basics are setup (multiple players interacting in the same world) we'll move onto cooperative missions .
Don't expect miracles in the terms of the timescale of this project as we're only a two man team with other commitments, but rest assured we'll have it done in about 1/100th of the time it's taken certain other mp mods.
[EDIT] If you downloaded this right after posting grab it again We've been working with v1.1, and forgot to add the v1.0 check. It's been added now and works with both versions.
Posted 03 September 2004 - 09:39 AM Edited by Stretchnutter, 03 September 2004 - 09:45 AM.
This is fun, keep it up guys
Posted 03 September 2004 - 09:40 AM
If only you had a minigun
(p.s. you can cycle the models using /actor dbg)
Posted 03 September 2004 - 09:55 AM
So about project x will it be turned into a mp mod i mean if u can do this in a few days i would love to see what kind of mp mod u guys could make
Posted 03 September 2004 - 10:18 AM
So what are your [spooky, sheep] intentions? Maybe an MP mod or a supercharged console?
Just this demo is very useful.... ever try to spawn a PCJ with any other trainer?
Posted 03 September 2004 - 10:54 AM Edited by TwoZero, 03 September 2004 - 10:58 AM.
This looks awesome and that only in a few days work....
btw Sheep, I looked up some tutorials you wrote, about memory editing, DMA and DirectX hooking. I was looking for such tutorials, very well written, thank you very much
p.s LMAO @ MTA dedicated post
EDIT: Holy sh*t, I just tested it... all I can say is awesome
Posted 03 September 2004 - 11:27 AM Edited by Cray, 03 September 2004 - 11:42 AM.
Btw, I am personally so tired of fighting with other teams which are all heading towards a similar goal. I was sincerely offering our assistance where we can, and the offer will still be held here. We are obviously going in two different directions (your coop, and us dm/etc...), so I don't see why we can't help one another through this process so we can get to an end result faster. Either way, the ball is in your court.
I will leave you with the following image, to show our "inexperience" as well:
Posted 03 September 2004 - 12:00 PM
so.. let me tell you how its going to be..
WE!! will give people the help they need.. because you are no longer needed or wanted.. there is very little aspect that i wont or cant help people with.. and if this aids them to get the upper hand on power hungry muppets like you then its a pleasure to see.
Posted 03 September 2004 - 12:36 PM
Also, It doesn't really show much without an explanation.. Enlighten us.
Posted 03 September 2004 - 01:00 PM
Actors and Vehicles created on command fully in game. In this test mode, you specify the type of Actor / Vehicle (similar to your program I presume), and it creates the object at the Player Position, plus an offset.
You also see our chat, which is done through DirectX, also similar to yours. You will also notice some text in the middle of the screen, which identifies the object which you are currently looking at. So, the object I am pointing to now is an actor, so it says Actor, some related info, and the pointer it holds.
The image is probably similar to what you may have seen in our latest Teaser video, or potentially some screens we have tossed about. The airport is our "test area", and the commands to do this sort of thing have been completed for quite some time now.
But, I don't want to take away from your guys work, but I also don't like being threatened.
This thread is for your mod, and NOT ours. I am more than happy to discuss ANY part of MTA with either of you, but out of respect for everyone here I will not flood this thread unless I can help in specific areas. Contact me at [email protected] if you want, but otherwise I will just be an observant in this thread.
Posted 03 September 2004 - 02:18 PM Edited by Kryptos, 03 September 2004 - 02:21 PM.
I had to edit my original post because I'd completely overlooked the DirectX GUI.
Posted 03 September 2004 - 03:20 PM Edited by Cowpat, 06 September 2004 - 08:03 AM.
This is great. Will you be able to assign paths to spawned peds and vehicles? I'm sure my machine can handle a lot more traffic than is currently spawned by the game.
Posted 03 September 2004 - 05:46 PM
Although my knowledge I feel like a baby here....
while reading this I get so many questions but I think Kryptos would be the better person than me to speak to you....and may be get some answers...I hope. :-)
keep on going!!!!!
1 user(s) are reading this topic
0 members, 1 guests, 0 anonymous users