Red Alert 2 modifier principle Encyclopedia (v)

The fifth article, good long, this is a pit, not many people see why to write this, I will be for the tribe ... What else hasn't been written? Selected units 3 stars, built everywhere (elegant), science and technology, transfer units belong to (elegant), immediate victory (this is not a very shy hair, I did not find). There are also maps of other player data, and of course, I have not yet been able to write the sale of the building call, automatic repair, enumerate all the units on the map (and then can be used to sell the building, sell all does not belong to) also have to write a few to end it. There is also psychic detection (never want to achieve, build a psychic detector will die), cow president and other special classes ( Red Police almighty King Millet Cat Green Collection version of the custom function is good long and complex, Red Alert 2 modified Master seems to be a timer constantly modify memory data, Looking for a more elegant way), the demand is not too high to build the queue limit, the number of construction limit, as well as the legend I have not tried the online switch camp, skirmish parameter modification. The pit is digging bigger and deeper.

Come on, keep pits with me, this one will say select Unit 3 Star Bar.

(11) Select the unit up to 3 stars-three step 1. Find the unit's blood--the first step, open the refrigerator door

First find the amount of blood in a unit, and then according to WHO modified the value, you can find the starting address of the Unit object.

Get ready to build an Allied chariot factory A, a grizzly bear tank. Exact Search 4 byte value 1000, let the grizzly tank go for a fight, just hit it, and then search for 958--, the grizzly tank hit the Allied chariot factory damage is 42. Repeat two or three times, you can get 3 or so address, then try to modify it in turn. Then find out who modified the value, but don't destroy the building. Get instruction 005d3e65-mov [Esi+6c],eax, but that's not important, ESI's value is important for the next step, and +6c is the offset of the unit HP. Note the value of ESI, the starting address of the Chariot factory object, which is recorded as address a=0c5d7648.

Build another Allied chariot factory B, repeat the above steps to find its start address b=0745ff70.

2. Look for the selected unit pointer-the second step, put the elephant in the refrigerator

You should now have 4 addresses in your CT chart:

Then the game selected Allied Chariot factory A, new search for exact numeric address a (0c5d7648), then select Allied Chariot Factory B, search for the exact numeric address B (0745ff70). There should be only one result left, remember as the pointer a=0d7b44d0, add it to the CT table, no, repeat the above steps.

Choose Grizzly Tank, the value of pointer a will become another, remember the address C=07781cd8, and then +6c=07781d44,07781d44 this address is the grizzly tank HP address. Lock it up and build another tank to attack it, if it keeps beating, the correct pointer A is pointing to the currently selected unit.

Then search for the address of pointer a 0d7b44d0, you can get the base address of the currently selected unit [GAME.EXE+640C64], and then find the number of selected units base Game.exe+640c70.

3. Complete modification 3 Stars--step three, close the refrigerator door.

The unit class offset is +11c, modified to 0x40000000 is 3 stars. The simplest implementation selects 3 stars and completes with a timer: 1. First get the number of units selected. 2. From the selected unit base, read the start address of the first selected unit, base +4 is the starting address of the second unit, +8 is the third selected unit ... 3. Modify the rating of all selected units.

Here is a general description of the game unit object, these things are analyzed and contrasted (CE has a function called analysis data/structure):

Class Gameunit:public Basea, public baseb, public basec{//    from the memory structure, the first 4 DWORD of the starting address is the function table pointer    //detail Baidu C + + Object memory structure    ...    DWORDDWTRIGGER;//+34, associated triggers (known with the map Editor), linked list    intngroup;//+1ac, 0~9    intnhp;//+6c    intnx;//+1a0,x coordinates    intny;//+1a4    dworddwgrade;//+11c, Rank    player*powner;//+1b4, owner    ....    The object of this class is very large, because it inherits 3 classes, the above may be a base class of content    //details Baidu C + + multiple inheritance Memory layout}

However, the implementation of the above given the 3 star has 2 questions, one is not to determine whether the player's unit, accidentally point the computer's soldiers, also become 3 stars ..., the solution: to determine whether the Powner pointer is pointing to the player, and the second is that the building can become 3 stars ... The solution is to determine the unit type based on the first DWORD, which is the first function table pointer. I really didn't find any variables that indicate the type, only the function table pointer.

(12) The graceful transfer unit belongs to--the murder caused by 3 stars

Above see a powner point to the owner of the unit, if the computer unit, modified to point to the player it. After testing, modifications can indeed be controlled or sold. But there are some problems:

1. If you forcibly modify the base of the computer and sell it, then destroy all the remaining units of the computer and find that it is not possible to win . This is because the game data record is chaotic-the computer in some cases think he has a base, but can not use the base to build things, want to sell surrender, and found no building to sell. The supernatural incident occurred, do not know how to deal with, had to embarrass you can not let you win.

2. If you take possession of the computer barracks, you will find that you cannot create the other's classes. This means that there are still some operations that are not completed, such as adding construction options.

3. If you change a non-occupied oilfield to yourself, you find that the oil field does not work at all. This means there is also a series of operations to activate the well.

The easiest solution is to modify the associated data at the same time, and then call the relevant function to complete the operation, the difficulty factor of 4 stars and a half. It is quite difficult to parse out the complete data structure, and to write complex scripts to complete the operation of the aftermath. However, in a different perspective, the game should have a corresponding complete function. Because when playing the task mode, it often triggers the event, and the other person's building becomes our building.

Initially find who modified the owning, then use the engineer to occupy the building, find a change belongs to call, related location:

However, the use of the above call is still the problem of the oil well does not work (the author note: In fact, the above call back to the second layer, can still find similar to the following code to solve the problem, but it was too obsessed with the map editor, but there are additional gains).

So I went to create a custom map, and when I was building a garage, I transferred the bomb-firing well on the map. The first level returns, or the same function address above call:

Continue to return to the second level and come here:

Analyze the code here: the number of units on the map (enemy, our and neutral buildings, infantry and tanks, etc.) (GAME.EXE+640C30), An array of pointers to all units on the map (GAME.EXE+640C24), The +34 offset of the game unit is the trigger association tag, and the trigger object is a linked list. This allows you to traverse all the units on the map.

Finally write the script that the transfer belongs to:

Transfer unit belongs to, can win Pushadpush 0    //prompt voice mov eax,[00a35db4]  //current player Data base push EAX//  transfer to who mov EAX,[00A40C64]  // Currently selected the first unit base address mov Ecx,[eax]  //unit base Address MOV Ebx,[ecx]call [ebx+378]//Change the owning function Popadret

You can also draw a question, call [ebx+378],ebx points to the first function table of the game unit, the 0x378 offset description is the No. 222 function ... A good big one class, still can maintain, good for it worry.

To be Continued ...

Reprint please indicate source, http://www.cnblogs.com/viewll/p/4770378.html

Red Alert 2 modifier principle Encyclopedia (v)