Hacking the editor II and III

07-15-2006, 12:43 PM	#1
Vexorian	I need someone to find what memory address should I change to what value in order to stop WE from disabling triggers when it finds syntax errors! I am tired of that and it causes a lot of problems.

07-15-2006, 04:12 PM	#2
Punisher_x	Ask Pitzer Also did u get Tygers Email Vex?

07-15-2006, 07:44 PM	#3
PipeDream	Oddly I can't manage to get a trigger to disable when saving. However, trigger disabling seems to be handled by function 0x5c8820, if you overwrite that byte with 0xC3 (ret), you can work around it. If someone gives me precise instructions for getting a trigger to disable while saving, I can probably find something less hackish.

07-15-2006, 08:13 PM	#4
Vexorian	any syntax error in any trigger causes the editor disable it for me

07-15-2006, 08:19 PM	#5
PipeDream	not for me =) I just get error with no disable.

07-15-2006, 08:52 PM	#6
Vexorian	Doh, it seems to be going to an infinite loop of trigger disabling instead of not disabling the trigger, it just won't end

07-15-2006, 11:03 PM	#7
Vexorian	Grab a trigger, convert to custom text, replace the contents with L and save. It will disable the trigger

07-15-2006, 11:54 PM

PipeDream

Thanks. In 1.20e, patch over 0x005CF013 with 5 bytes of 0x90 (nop). That address is what calls the disable. If they recompiled the worldedit and that address changed, scan for: E8 68 FD F4 FF 85 C0 75 09 8B 4D FC 53 E8 7B CF and replace the first 5 bytes with 0x90.

ref:

Code:

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

/*
 * PipeDream 2006
 */

/*
 * This loader prevents triggers from disabling on game save
 */

#define EXECUTABLE "worldedit.exe"
#define EXESTRING "worldedit.exe"

#define WAR3_DISABLE 0x005CF013
char newtext[] = "\x90\x90\x90\x90\x90";


void Inject(HANDLE hProcess, int address, char *newcode, int len) {
	int ret = WriteProcessMemory(hProcess,(void *)address,(void *)newcode,len,NULL);
	if(ret) {
		printf("Successfully patched %x with %d bytes\n",address,len);
	}
	else {
		printf("Could not patch %x with %d bytes\n",address,len);
	}
}

void main()
{
     STARTUPINFO si;
     ZeroMemory(&si,sizeof(si)); // Clean
     si.cb = sizeof(si); // Set size
     PROCESS_INFORMATION pi; // Info
     ZeroMemory(&pi,sizeof(pi)); // Clean
     CreateProcess(EXECUTABLE,EXESTRING,NULL,NULL,false,0,NULL,NULL,&si,&pi); // Call program
//	Sleep(15000);

	Inject(pi.hProcess,WAR3_DISABLE,newtext,5);
}

07-16-2006, 01:30 AM	#9
Vexorian	Kickass, that sure makes my development better

07-16-2006, 09:13 AM	#10
PitzerMike	Great PipeDream! Here's another address for everyone: The 4 bytes starting at 0x7DAAA8 hold the string udg_ Set them all to 0x00 to remove the udg_ from global variables. Or set them to something else if you want a different preset.

07-16-2006, 09:45 AM	#11
PipeDream	If you want something longer than udg_ (global_, perhaps, or to let user input anything), you'll have to overwrite 0x5CAEC8 and 0x5C6798 with the address of the new prefix.

07-16-2006, 01:56 PM	#12
Vexorian	Can someone find the addresses to change to make WE unable to check for syntax errors when enabling a trigger that was disabled, this should save another hassle

07-16-2006, 02:01 PM	#13
Vexorian	Also the addresses to disable the message that says "This map is using the default name of "Just another map..." And we would like you to waste your time renaming the map regardless you are just testing stuff. And if you decide not to change the name I am gonna piss you off with this message everytime you try to save!"

07-16-2006, 11:25 PM	#14
PipeDream	To always allow enable: change byte at 0x005C8915 to 0xEB (conditional to unconditional jump). It still gives a syntax error message if you're missing the init trig box, but enables. Also only does the trick for TFT, apparently RoC maps are saved slightly differently. For the dialog, 0x0055D6C3 byte change to 0xEB