Hacking DMII Continued...

purple1 · Post by **purple1** » Wed Jul 13, 2005 3:56 am

Using the Mac version of DMII on a Mac and the cheating utility Pandora's Box, I have found some more interesting stuff.

First: Located the offset for the Numenstaff's magical capacity.
Second: Located the offset for the health of a Barrel in Skullkeep.
Third: Located offsets for horizontal and vertical party positions.
Forth: Located offset of door status (open/closed) of the locked door in the Ancestral Home (beginning)

The third was the most interesting. By selecting an item for purchase, I was able to teleport ON TOP of the merchant and take the item from HIS side of the table. I also pushed his button that shoots fireballs. Neither he nor his guard become angry nor does his guard unless you attack him.

On top of that, I was able to teleport BEHIND Dragoth's portal in the final stage. There are three walkable tiles, but nothing else. The area behind the ZO gate, like on the maps at DMWeb, are just empty rooms.

Areas which require a scene change (change of tileset or have an arch to divide - shops, etc.) can't be accessed from a different area via teleporting. The shops are on different map areas, and places on the Skullkeep area are divided into many parts. Jumping into an area that is normally accessed by a scene change or arch results in becoming "stuck", and the only things visible are the walls and floor using the previous tileset.

The unaccessable area in the boiler room requires a scene change, so you cannot go behind the ore buckets. Nothing is visible except for the naked walls.

beowuuf · Post by **beowuuf** » Wed Jul 13, 2005 9:24 am

Interestng work, have fun keeping it up!

purple1 · Post by **purple1** » Wed Jul 13, 2005 5:57 pm

Fifth: Located offset of reference pointer of Torham's right hand.

He was holding a Vorax, with a value of 5120. Increasing this value changed the weapon to become a duplicate of items (weapons) in the other heroes' right hands, then left hands, then belts. The duplicate retained the same magical charge as the original. Could lead to cloning problems, but the game crashed while I was testing something else. Decreasing the value changed the item to an odd sprite with a name that resembled a serial number, and a description picture that looked like a Glop. I'm guesssing that the item reference table for party member's hands (weapons) follows a non-item table and the game is incorrectly reading the table information as an item.

This is a breakthrough that I was looking forward to for a long time. Imagine having 3 unlimited-magic Numenstaffs.

purple1 · Post by **purple1** » Wed Jul 13, 2005 6:00 pm

Oh, and BTW, all of these variables and offsets are stored in non-global memory, and a are highly subject to change. What IS imporatant is that they can be found and changed (like I have done with all of the hero stats) and saved. Most of the changes cause no ill effects (except for the items maybe... and setting the door status to an invalid number). No harm seems to be done to game saves yet.

beowuuf · Post by **beowuuf** » Wed Jul 13, 2005 6:31 pm

What you would need to do is find where these items are associated with a location then alter the location pointer so you could actually move the vorax to his hand, for exampe, not just clone it with bad results : )

purple1 · Post by **purple1** » Fri Jul 15, 2005 6:19 pm

Well, I found the offset of a tile object reference. Using the dungeon.dat reference, I found that the items are indeed stored the same way. I wrote a TI-Basic program on my calculator to convert a Big Endian word into a readable description. My Knife in one corner came up as 5142, whch is:
TOP LEFT
WEAPON
OBJECT NUMBER 22

Moving the Knife produced 21526, which is:
TOP RIGHT
WEAPON
OBJECT NUMBER 22

This is good news! The file formats are similar enough that I can use them to find the correct values. I plan to find the values of 2 different objects and switch them.

purple1 · Post by **purple1** » Sat Jul 16, 2005 9:34 pm

MAJOR BREAKTHROUGH!

I have successfully transformed Anders' Torch into a Numenstaff with no ill effects. When he is in the cryochamber, I believe that the Torch Item Description is preceeded by (in the Mac version, it looks like the linking data follows) the Object ID of his Fine Robe Top (they are linked because they are on the same square in the cryochamber). When he is taken out, the Torch Item Description is followed by FFFE, denoting no objects linked to it because it is in his hand, not on a square. I changed the Item Description so that what used to be Item Number 2 (Torch) became Item Number 42 (Numenstaff). Since they are both weapons, both "important", and both use magical charges, there are no errors. Except that it didn't add the 40 Mana to Anders (he didn't equip it... it was already equipped) and removing it causes his Mana to actually go in to the negative. Nothing that a few wizard and priest levels can't cure. :P

purple1 · Post by **purple1** » Mon Jul 18, 2005 2:34 am

More fun stuff:

The standard Magic Map is a Chest-type object (???), the 0th (1st) in the list. I replaced it with the advanced Magic Map and was cruising around the town area with the monster detector on. The Glops apparently spawn INSIDE the walls. Or at least one does. I stood by the alcove that has the Magic Marker inside it and the Glop was IN the wall. It could attack me, but I couldn't attack it.

beowuuf · Post by **beowuuf** » Mon Jul 18, 2005 8:31 am

Interesting...I'm sure Sphenx said somethign once about the generators being attached to the wals, or at least the minion ones - you can ZO their portals shut for a while to stop them bugging you...

Tom Hatfield · Post by **Tom Hatfield** » Wed Jul 20, 2005 6:10 am

All of them? That's interesting. So, in theory, you could keep any monster from respawning just by zapping a wall, or surround it with MON guard minions. Might be useful in the thieves glade.

beowuuf · Post by **beowuuf** » Wed Jul 20, 2005 9:27 am

I believe the ZO trick only worked on the portals, which were for minions....but who knows if it would work if you knew the invisible locations of generators...

Post by **Paul Stevens** » Wed Jul 20, 2005 3:39 pm

would work if you knew the invisible locations of generators...

Just for fun . . .
I posted a CSBuildDUNGEON.DAT which is the DM2 dungeon
that CSBuild can examine. Perhaps the generator
locations are visible.

http://www.dianneandpaul.net/CSBwin/CSBuildDUNGEON.DAT

beowuuf · Post by **beowuuf** » Wed Jul 20, 2005 4:10 pm

There certainly seems to be a shortage of generator floor pads and alot of wall objects....jsut thye are read 'zalalalalalalalaal' so can'#t tell which is which without playing DM2 and comparing levels like that : )

Cool that it opens though!

purple1 · Post by **purple1** » Wed Jul 20, 2005 9:28 pm

Maybe with some comparing, we can find out what format DMII uses for text. The first steps are always small!

Post by **ChristopheF** » Wed Jul 20, 2005 9:59 pm

Just to remind you that kentaro already did a wonderful job and released two excellent programs to open and edit the graphics.dat and dungeon.dat files of DM2. They are both available on here: http://dmweb.free.fr/DMIIDownloads.htm (Tools section).

Look for "DMDC2" (the dungeon editor), and for the "Dungeon Master II Graphics.dat Editor". Source code is available for both of them.

The format of the DM2 dungeon file is very similar to the one of DM and CSB (only small differences), most of them documented here: http://dmweb.free.fr/FFDungeon.htm

beowuuf · Post by **beowuuf** » Wed Jul 20, 2005 10:34 pm

Oops...didn't remember how far he had gone to tell you the truth - I rememebered it was mroe an item editor for some reason!

kentaro-k.21 · Post by **kentaro-k.21** » Fri Jul 22, 2005 2:35 pm

text object in DM2 is for various usage...

and the "text message" is not in dungeon.dat. it is in graphics.dat now. (this should be disadvantage to distribute your own dungeon. DM/CSB dungeon contain text message in their own dungeon.)

why text object for other purpose?
because ftl might have noticed that they ran out of maximum number of actuators... (it is 1024).
as Christophe mentioned, DM/CSB/DM2 shares same dungeon format. so, DM2 also has limitation for the issue maximum number of objects. in special case, Paul modified CSBwin and dungeon format. as a result, now it (CSBwin/CSBuild) supports up to over 65000 objects rather than 1024 objects.

you'll know dungeon already occupies 1020 actuators if you open DM2 PC dungeon.dat. (to display them in DMDC2, [View]menu -> [Object tree], [Browse All-]from tool button -> [All ACTU])
it is clear they have run out of maximum count of actuators. so, ftl should have converted some kind of actuators (like generator) into the text objects...

kentaro-k.21 · Post by **kentaro-k.21** » Sat Jul 23, 2005 4:02 am

purple1:
very wonderful work and results! i'm fun to see your new discovery from your research.

you are trying to find out about text object?
although i have few info about it, i'll help you as possible as i can!

at least, text object is used for:
- message text board (on wall)
- creature generator (on floor)
- minion transformation info (on floor)
- wall/floor ornate, climbable/unclimbable ladders

also there are unknown usage of text object...