Warmist's illustrated guide to memory hacking.
(yup that is my 'real' name)Part 1: static offset (site vector)
First of all I'm using a tool called "L'Spiros Memory hacking software" or MHS for short. You can find it by using google:
like this.
Usually the job to find some offset is:
- file->open process->dwarf fortress.exe
- search-> (one of choices...) e.g data-type search (for simple stuff, like position an similar)
- change something in DF
- find again (second button below "found adrresses" bar)
- rinse repeat till there are not a lot of addresses left
But this is not the best way for things like vectors (they use pointers, which are slow to find and sometimes they act differently). But for that i made a helper function: offsets.getvectors(). Returns tables with most vectors (static i.e. global) and times it is used in code. Simplest way to use it would be like this:
for k,v in pairs(offsets.getvectors()) do -- for each entry (here k is address of vector, v is times used)
vec=engine.peek(k,ptr_vector) -- load vector
print("Looking into:"..string.format("%x used:%d size=%d",k,v,vec:size())) --print all info...
end
Pasted that into research\plugin.lua and ran when DF was in legends mode (excerpt):
Now seeing DF:
You probably can guess which one is the correct vector... (hint both are 55 in size). Now because memory tend to move in computers (in some not but better safe than sorry) lets modify research\plugin.lua a bit more:
for k,v in pairs(offsets.getvectors()) do
vec=engine.peek(k,ptr_vector)
if vec:size()==55 then -- look only for vector with 55 as size
print("Looking into:"..string.format("%x used:%d size=%d",k-offsets.base(),v,vec:size())) -- note the k-offsets.base()
end
end
Now there is only one hit and its:
Looking into:131de24 used:8 size=55
Lets test it. In tools\plugins.lua there is function "tools.getsite(names)". In that function update the offsites line:
local offsites=0x131DE24+offsets.base() --todo make normal offset
and test tools->change site.
Next time: maybe actually using the MHS...
If you want to see how site looks like in memory:
- open MHS, open DF , open process (DF), goto legends in DF
- in MHS tools->Hex editor
- now type in the value that was first found (244de24 for me) in the left upper box
now you should be in something like this:
Here:
- Selected byte
- first dword (4 byte value), in this case where the data starts
- second dword , in this case where the data ends
now select first non gray byte with mouse and right-click on 4. In that place MHS shows dword converted into pointer (vector consists of 3 pointers). Select "Copy second cell", Paste it into the box in left upper corner. Now the view shows alot of pink data (those are pointers to sites). Select first non-gray byte again and "Copy second cell" again, and paste into the box. Now it shows data of first site, it could look like this:
Hope that this helps somebody and maybe makes something more clear...
Author
Topic: DFusion - a lua based plugin system (integrated into DFHack) (Read 151998 times)