Hex Editing savegames

beowuuf · Post by **beowuuf** » Tue Jul 20, 2004 7:42 pm

lo, looking for 00 will give you alot of hits since it also means 'wall' for al lthe dungeon maps, etc

I do think that EE7 you were talking about will be the second part of the stamina though

purple1 · Post by **purple1** » Tue Jul 20, 2004 7:45 pm

Well, well, well. Torham's stamina is actually 770. 770 in hex is 0302. I started this effort looking for 77, which is 4D in hex. If I'd only known that real stamina was 10 times what was displayed...

purple1 · Post by **purple1** » Tue Jul 20, 2004 7:47 pm

Okay. To find stamina, just look for 10 times what you see! I wonder why they did that? Why did they have to make things difficult for me? WHY?

beowuuf · Post by **beowuuf** » Tue Jul 20, 2004 7:52 pm

lol, because they hate us all : )
I thought someone had said that stamina was 10 time,s sorry I jumped on the decimanl bandwagon too soon!

purple1 · Post by **purple1** » Tue Jul 20, 2004 7:56 pm

It's not your fault. My nex effort is to find a memory address for Torham's inventory, like his hand, and then figure out what numbers correspond to what item, if possible.

purple1 · Post by **purple1** » Thu Jul 22, 2004 1:05 am

Well, I'm not making any progress yet. The Dungeon Master 2 Editor that is able to edit stats included a readme file (with a non-working link to the makers) that said that item modification was possible, but adding items would require changing the filesize (not yet implemented into editor). I think that given the proper values, it should be possible to CHANGE any item in inventory while the program is running with no adverse effects. I would appreciate some insight/research/help in finding item values stored in game memory and their relation to their IDs in the graphics.dat file (using the extractors).

beowuuf · Post by **beowuuf** » Thu Jul 22, 2004 8:37 am

You mean adding completely new items to the game engine? Then yes, that's the graphics.dat file alone
Or just adding another tech mace to an inventory? Then that is just the save file. There is no reason to do it while the game is running - any changes to the save.dat won't affect the game, and you would need to SERIOUSLY hack the game engine to just generate an item - and you may aswell just alter a dungeon.dat to have a generator from the start of something!
.You can simply kill yourself, edit, and restart.

Post by **Gambit37** » Thu Jul 22, 2004 8:52 am

Remember also that purple is using a real Mac -- messing with memory adresses won't help anyone using another system. File based hacking is a lot better (although there is still the byte order to worry about).

purple1 · Post by **purple1** » Fri Jul 23, 2004 1:30 am

Well, I don't want to mess with the dungeon, unless someone can do that for me really easily. I don't want custom items, just copies of really rare stuff (Example: 2 or 4 Numenstaffs? Numenstaves?) I know if you are using a hacking program (GameShark, emulators with built-in things, etc.), you can search the memory and change variables (that's what I am doing-I want to know, for example, what values would code for a Knife, so I can change it). I DONT want to mess with savefiles, because I can't program for beans and the Mac version is probable different than the PC version (and I don't think anyone wants to make a savegame hacking program for Mac games (but not necessarily for Mac)). I think that hacking active memory is easier.

I just need to know what numbers represent items. I'll find the corresponding inventory slots myself, once I know WHAT item is in it, and hopefully, I will b able to find the item order (machete is after knife, so it is [knife value]+1) and make any item from anything else.

beowuuf · Post by **beowuuf** » Fri Jul 23, 2004 8:07 am

In DM a dagger, for example, was listed as xx 14 88 00, where xx was the ID number, 14 was the 'weapon' category, and could increase to 54, 94 or A4 if it was in the dungeon and facing west, south or east , the third number meant 'dagger' and the fourth was for charges (which went up in steps of four). If the code for that hasn't changed, then searching for the 14s is your best bet.

beowuuf · Post by **beowuuf** » Fri Jul 23, 2004 8:11 am

Also, the save/dungeon file does stay constant, i believe - or else atari and PC games couldn;'t be swapped as easily (it's a little to big endian switch)
So any of your findings for the saved file might work for other platforms too, and vice versa

purple1 · Post by **purple1** » Fri Jul 23, 2004 10:28 pm

That makes sense to me. But with the dagger's ID, where did those numbers come from? Were they the identifiers in the graphics.dat? I know that 10 is the category for weapons in DM2's graphics.dat, but I don't know if that's just a picture-to-item association or if 10 is the main number for weapons in the game. It probably is. I should get an extracted graphics.dat from DM and see if that will help me.

beowuuf · Post by **beowuuf** » Fri Jul 23, 2004 10:58 pm

oops, maybe i meant 10 for weapons...as i said, download my hextut, it has lots of the numbers derived from DMute that apply to DM, and shoudl apply to DM 2
The graphics do follow in line, so item graphics position should correspond to the shift in number.

purple1 · Post by **purple1** » Fri Jul 23, 2004 11:07 pm

Well, in DM2 graphics.dat, weapons are 10 and knife is 08. If I searched for the decimal equivalent (because I can't search in hex) of 1008, I should be getting hits that correspond to knives throughout the dungeon? Is this what goes on in DM1?

beowuuf · Post by **beowuuf** » Fri Jul 23, 2004 11:15 pm

yup
Only the unique number at the very start differentiates between the first knife that maybe torham has, and new ones say dropped by a theif

purple1 · Post by **purple1** » Fri Jul 23, 2004 11:22 pm

DM2's weapons are 10, DM1's are 14. Your guide says that items are identified by a 4-byte number. That's long. I'm not sure how long of a number my program can search for. Most of this is going to be guess and check and blind stabbing.

So, the unique item identifier is 2 bits? If I understand correctly, each item in the dungeon's characteristics are divided into 2-bit pieces. Unique is 2-bit, Category is 2-bit, Item is 2-bit, Charge is 2-bit, etc.?

purple1 · Post by **purple1** » Fri Jul 23, 2004 11:38 pm

Well, I'm in luck! My program searches for 4 bytes at maximum.
I can search for:
1 byte decimal (+255)
2 byte decimal, signed (+/- 32,768)
4 byte decimal, signed (+/- 2,147,483,658)

beowuuf · Post by **beowuuf** » Sat Jul 24, 2004 8:47 am

hmm, unfortunate that things don't correspond exactly, glad my memory isn't terrible as i thought!

Yup, everything seems to be in 2 hex-bits (1 byte) - though usually those couplets can be through of a a two byte word aswell ...i always break it down like DMute did

purple1 · Post by **purple1** » Sat Jul 24, 2004 7:14 pm

What order are the values stored in DM1? It might be the same for DM2. I it ordered like this, or do you think it might be reversed? I have found 172 hits for 1008(hex) in DM2 (knife), but when I move the knife, I would expect the memory address to change, causing some of the values I had to go to zero, but I couldn't find any that did this.
_ _ (Unique number) _ _ (ID) _ _ (Item) _ _ (Charges, Potion strength, etc.)

beowuuf · Post by **beowuuf** » Sat Jul 24, 2004 9:24 pm

The link to the encyclopaedia page should say which endian it is, and also the general outline

I'm sudden;y thinking i've lead you slightly astray - I dont' think the weapon format is quite as i've given it. It's because everything in the dungeon is stored in linked lists.

Items are stored in lists near the start (look for the sphenx/zyx dungeon.dat format if it's not clear in the encyclopaedia link) so for example every weapon is stored one after the other in a 'table'. I think the four bytes there are, infact, weapon type, charge, then the last two bytes are the id reference of the NEXT item in the same pile as the weapon. If there is no other item, then this number is 'fe ff'

So the ID number is only used in the inventory, the dungeon tile contents, and in the item lists - sorry!

For example, a potion and knife are lying on a floor tile

The floor tile list (i think it's seperate from the normal map, and is just a table saying 'tile clear' or 'tile has this first item) will reference the potion - say 03 20. This simply means 'go to the fourth potion in the potion table'
Then the potion list would have the fourth entry (13 bytes in) as soemthing like 'potion byte' 'potion power byte' knife unique ID (say 08) and item type (weapon, 10)
So then it knows 'next item on the tile after the potion is the ninth weapon in the table
Then in the weapon table, all you would see is 'byte saying knige' 'byte 00 for no charges' then 'fe ff' meaning 'no item is after this one

Sorry! It's been a while since i've been into this, and i'm going from memory cause my hard drive is unordered.

Unfortunately 08 10 probably can have a few meanings - but there you go. If you want to alter, say, the knife in torham's possession, you need to alter the entry in the weapons list, which won't use the id reference
If you look at the encyclopaedia structure, or if you find the dungeon.day format file, you will see that the first entries say how many of each item category there are - so this information will give the length of each table

purple1 · Post by **purple1** » Sat Jul 24, 2004 10:13 pm

Wow. Thanks to FTL for making this game so difficult to alter. So, if I can find (in memory?) the location of the table which records items, and then I can find which one is the knife in Torham's hand, then I only need to change the ID and Item values, and my knife will be changed. Now, I just need to find out which of the values I get (if they are the ones stored in memory that I see) is the right one, by guess-and-check.

purple1 · Post by **purple1** » Sat Jul 24, 2004 10:30 pm

I really don't know what I'm doing. When searching for stats, you search for the number, level up, and see which ones still match. But I can't do that to alter weapons. The weapons don't change. Only their references. want to change knives or some cheap unlimited thing into powerful weapons, rare items, and other stuff.

Does the converter for dungeon formats work for DM2? If so, someone with more experience could edit a dungeon file for me and convert it so I can use it.

Post by **Paul Stevens** » Sat Jul 24, 2004 11:29 pm

This discussion prompted me to do something really stupid. I tried
opening the DMII dungeon.dat with CSBuild. It worked. That is unbelieveable!
I had to press 'Enter' about a zillion times to get past some text oddities.
But the maps work.

I mention this because it means that the format is so much like DM and CSB
that you could use CSBuild and a hex editor to find daggers in the dungeon.dat
file and then look for the same data in memory. Those sections of the file are
copied into memory verbatim. And the file formats are laid out very nicely
on dmweb.free.fr. Technical Documentation/File Formats. If the files have no
checksums then you could edit the file itself with a hex editor.

The weapons don't change

You can cause the weapon record to changed very easily. If it is the only
thing in a cell then its first two bytes will be feff (little-endian on PC). Put
an additional object in the same room and the first two bytes will change
to point to the second object.

beowuuf · Post by **beowuuf** » Sat Jul 24, 2004 11:47 pm

GREAT news that the file is readable : )
I think there is an extra floor tile type in DM2, and the occasional glitch in type numbers, but otherwise they were very similar.

About the weapon - you can either a) if you find the pointer from torham's hand to a weapon, you can alter that pointer and scan through all the weapons existing unitl you find a better one, or b) if you can luck finding the weapon itself, then you could change it to whatever you wanted
Weapon table search - i'm not sure how well this will hold, but ALOT of torches used 3C for full charge and torches count as weapons - if you look for this, you should find the area for weapons, perhaps?

purple1 · Post by **purple1** » Sun Jul 25, 2004 12:38 am

For torches, as far as searching, I need to know EXACTLY what to look for. Is it 10 (torch#) 3C? Or would it be stored as 3C (torch#) 10? These are all radically different in decimal.

purple1 · Post by **purple1** » Sun Jul 25, 2004 12:47 am

Okay, torches are 02. 10 02 3C would code for a full torch. But what is different between little and big endian? It's been too long since I learned about computers. I was not really paying attention when my dad explained it to me.

Also, wouldn't there be a problem if Torham's hand pointed to the Numenstaff, but the Vexirk King did too? It would be like cloning problems in DM and CSB.

Post by **Paul Stevens** » Sun Jul 25, 2004 1:23 am

The data in those records (like the weapons records) are commonly
referenced two bytes at a time; as a 'word'. A single data reference
gets two bytes. The question is: is the first byt the least significant
or is the second? Little-endian (PC) means the first byte is least
significant (little part first). Big-endian (macintosh, atari) means the
most significant (big part) comes first.

Yep. The advice to duplicate a pointer will result in clones. And
ugliness later in the game in all probability.

purple1 · Post by **purple1** » Sun Jul 25, 2004 4:09 am

Would the data in the PC version weapon table be 10 02 3C? Meaning the Mac would be 3C 02 10?

I guess my question is, what should I be looking for in the Mac version, stores in memory?

kentaro-k.21 · Post by **kentaro-k.21** » Mon Jan 10, 2005 9:32 am

hmm.

Would the data in the PC version weapon table be 10 02 3C? Meaning the Mac would be 3C 02 10?

it is about record link and database (which stores all of records).

about record link format:
every record link has 2 bytes (1 word). binary format is : RRTTTTIIIIIIIIII
where,
RR means room (from 0 to 3). 0 is North, 1 is East, 2 is South, 3 is West.
TTTT means db number (from 0 to 15). 0 is door db, 1 is teleporter db, 2 is text db, 3 is actuator db, 4 is creature db, 5 is weapon db, 6 is cloth/armor/boots/... db, 7 is scroll db, 8 is potion db, 9 is chest/minion map db, 10 is misc item db, 14 is missile db, all others seem to be unused.
IIIIIIIIII means record number for selected db number (from 0 to 1023).

i recommend you check the file format section by Christophe for more understanding. it helps you to understand format of dungeon.dat.

about your torch item:

torch is in weapon db, so any record link to torch should point to a record in weapon db.

RR may be 0, probably possessed item doesn't have direction and set it to 0.
TTTT may be 5.
IIIIIIIIII may be one of from 0 to 1023.

because record link doesn't know whether linked item is torch or not, there may be at least 1024 possibilities (where max item count in db is 1024).

if RR=0, TTTT=5, IIIIIIIIII=0, binary value is 0010010000000000, the word value is 0x2400.
if RR=0, TTTT=5, IIIIIIIIII=1023, binary value is 0010011111111111, the word value is 0x27FF.

if you use big endian CPU,
0x2400's representation should be "24 00" in the memory.
also 0x27FF should be "27 FF" in order.

and about weapon db:
this is about how dungeon.dat stores the db in byte oriented format. probably running DM2 may hold the db in same format.

all weapon records are stored in continuous memory block.
1 weapon record costs 4 bytes. if there are 173 records, continuous 692 bytes (4*173) will be occupied by weapon db.

format is:
1 word: link to next item
1 word: nibble1

binary format of nibble1: ??CCCC??MTTTTTTT

CCCC: charge count.
M: permanent flag.
TTTTTTT: weapon type. (0x02 for torch)

link in item? if there are items more than 2 at a tile, link is used to connect following item. and last record has no link and points end of record mark (0xFFFE).

for example, a torch representation in item shop.
the torch has a link to next item "daggar". it is in weapon db (TTTT=5). it is at west position (RR=3). index of weapon db is IIIIIIIIII=16. so, the record link value is 0xD410.
the torch itself. it is permanent (M=1), charge count is 15 (CCCC=15), item # is 2 (TTTTTTT=2). so the nibble1 is: 0x3C82

in the memory, it should be "D4 10 3C 82" for big endian env.

purple1 · Post by **purple1** » Wed Jan 12, 2005 4:16 am

Wow. I understood about half of that. I really wish that some smarter people (like yourself) would solve the riddle of the DM2 dungeon files and write some neat programs to hack it easily OR write a new program that uses them to emulate DM2.