Fog

[Spontaneous]

Ok we dont have any threads talking about fog hacks yet.

Has anyone tried messing with fog yet? Any luck?

I know that vietnam dont have a viewdistance bar to move in options. I dont know where to start but I am going to be doing some checking now. I really hope we can get this because the fog is bad on some levels.

[Lasix]

I agree...waht kind of value are you searching for...let me know and mybe i can tackle it as well. I may stumble over it

[NOPing for Food]

I'm more interested in just turning off the fog... game.vertexfogenable is the console-var that controls it, but it won't let you use it because it is locked...

[DrKenneth]

It shouldn't be too hard to unlock. Just disassemble it with something like IDA (Best disassembler IMO) and find the code that processes the string. (Not to hard with a good disassembler) Then just find the jump over it. (or the group of commands around it.) Have fun :D

It's probably a monitored CVAR though...

[chilli]

i unlocked the command but it has no effect.

[Lasix]

Originally posted by DrKenneth on 20th March 2004 at 13:42
It shouldn't be too hard to unlock. Just disassemble it with something like IDA (Best disassembler IMO) and find the code that processes the string. (Not to hard with a good disassembler) Then just find the jump over it. (or the group of commands around it.) Have fun :D

It's probably a monitored CVAR though...

Dr K, can you post a link to IDR..thanks

[DrKenneth]

Here ya go:
http://www.datarescue.com/idabase/idadown.htm

Originally posted by chilli on 20th March 2004 at 08:53
i unlocked the command but it has no effect.

Well, then are you sure you unlocked it?

[Lasix]

Dr K thank so uch.. i will give it a go...

i just went there and i see that the pro demo is not available unless you email them, I emailed them.. i hoep that is the right one.let m know

[Spontaneous]

even unlocked, would you be able to do a call from a trainer to do a console command once onlocked.

[DrKenneth]

Yes, but difficult... But, if you can actually alter the value manually, then you will be able to search for it in memory. Then find the DMA and
:cow:haxzorize:cow:
it.

^^ OOOOOooooo so pretty! :D ^^

[Spontaneous]

hmm damn didnt think of that. Well time to go onto that then.

[NOPing for Food]

If you can't, just find the code that handles it and change the jump...

I was able to get it to not display the "unauthed method" but it didn't actually do anything...

[Lasix]

Noping, did you find the value..if so Can you PM me so i can search for it in t search

[Spontaneous]

Hey DrK, would this version work as good as the v4.6 for doing this?

IDA.PRO.v4.5.0.762

[Spontaneous]

Would I be searching for the unauth code or vertexfogenable

[chilli]

unauth

[Spontaneous]

Using IDA I find 2 spots for vertexfogenable but nothing for unauthorized

[NOPing for Food]

Using ollydebug you can find 3 places (all close together) in the memory...I changed jump commands for the "error: " and was able to stop it from giving me the error, but it didn't do anything...

[stomperz]

I taught maybe after getting the Viewdistance from the rfa files I could Tsearch them .... no go @every map change the DNA moves the values


QUANG_TRI Settings - all maps are differnt

QUANG_TRI\AI.CON
aiSettings.setViewDistance 75
QUANG_TRI\INIT.CON
Game.ViewDistance 85
QUANG_TRI\OVERGROWTH.WST
viewDistance = "400"
QUANG_TRI\UNDERGROWTH.WST
viewdistance="55"

[Spontaneous]

I am going to tackle fog today. I have a couple ideas of getting down the addresses in tsearch to try finding the DMA. I will let everyone know what I find out later today.

If anyone else wants to help on this, think of ways to narrow down the addresses.

Search for unknown.
Range 0 to 10,000(I figure there should be no way the value is above 10,000 but what are your thoughts on this)

Play for a while, changing teams, weapons, getting in and out of vehicles, killing people, all along keep going back to tsearch and searching for Has not changed.

What other ways can we narrow it down?

I read something, not sure if true and needs more testing, that changing your resolution also has different fog values. If so, we could use has changed to narrow it down some more. I figured if you play long enough, just about every value will change except for certain ones.

While in 1942, what are the value ranges you noticed for the DMA of fog?

[Lasix]

Originally posted by Spontaneous on 22nd March 2004 at 11:54

While in 1942, what are the value ranges you noticed for the DMA of fog?

I did the fog in 1942, if i am right the highest value was 100. Remeber you can control the fog with the slider bar. Thta is why we are having probs here. no slider

lasix

[caliber1942]

someone needs to successfully unlock all the command console commands. so let me get this right, there is no fog hack that has been created by someone yet? curious if someone at least successfully done.

peace-
caliber

[Spontaneous]

I think the console command is going to be too much work. Harder then finding the DMA. Hey does any of them basic trainers release have no-fog?

[Lasix]

Originally posted by caliber1942 on 22nd March 2004 at 14:00
someone needs to successfully unlock all the command console commands. so let me get this right, there is no fog hack that has been created by someone yet? curious if someone at least successfully done.

peace-
caliber

we hae been trying but cant seem to find the value to search for...Since there is no slider bar it is hard to search for the fog.. let us know if you come up with something


Spont, i will look a those trainers brb...nope they dont have it

[Spontaneous]

Well doing some testing I got it down to 2 million addresses. Thats quickly anyways. Time to do some other things I thought of at work.

[Spontaneous]

I really could use some help. I did range 25 to 100. Been playing, searching, playing searching, playing, searching. I keep knocking off some each time. I dont know how far I could get down doing this but it would take like forever, I am down to 1,989,550. I want to do another range but I am afraid of knocking off the correct address. There has to be a better way to find this DMA. Resolution does not change any fog values. I know I could work on the console command thing but I am just lost where to go. I am tryying with what I know.

[test0r]

spontaneaous: i bet the fog value is 100, so why do you search for 25-100?
but you are right, there is nearly no way to find it...(logical? :D)

[caliber1942]

you have to be able to change it to find it, spon. not sure why we aren't getting more feedback from chilli who apparently has already done it. at any rate, we have to be able to change the fog somehow in the game. i thought about trying different maps and then detecting the change in fog (has increased, has decreased, etc) but the game.exe resets each time you load a new map so the addresses would change. another method might be to change the .rfa files or the map files themselves or something or maybe creating your own map with it's own fog value. just some ideas. seems like the console crack would be the best. can't remember who made the original console cracks for 1942v1.5 but that person might can help-

peace-
caliber

[NOPing for Food]

look at the values in the rfa files...load a map and scan for the value, change maps and narrow it down more, and keep on going like that...it should be psuedo-static so the address shouldn't change on each map change...

[stomperz]

Originally posted by NOPing for Food
look at the values in the rfa files...load a map and scan for the value, change maps and narrow it down more, and keep on going like that...it should be psuedo-static so the address shouldn't change on each map change...

If u edit the values in the RFA in BFV will not load ( will not be shown in choices ) crc chk probly

[NOPing for Food]

I didn't say to edit them! Just look in them to find the value for each map. Load the map and search for that value in tsearch. Then do it to another map narrowing it down each time.

[SNAFUBAR]

Maybe you can change all the fog in the .rfa files and run it as a "mod" like we did in Desert Combat. Then search for those values. Dunno if it will work, just an idea after all, they did supply that "MOD" toolkit......

[NOPing for Food]

I just did some digging around in the rfa's for the maps and found some interesting things...I'm going to go play around with it now...

[stomperz]

Originally posted by SNAFUBAR
Maybe you can change all the fog in the .rfa files and run it as a "mod" like we did in Desert Combat. Then search for those values. Dunno if it will work, just an idea after all, they did supply that "MOD" toolkit......

good idea
this is feasible... will give it a try


Originally posted by NOPing for Food
I didn't say to edit them! Just look in them to find the value for each map. Load the map and search for that value in tsearch. Then do it to another map narrowing it down each time.

sorry...didn't mean to infer that u did

I tried it and that is what I found out to be the case... no more no less

[NOPing for Food]

Well, bad news for me...the address is DMA and changes when you load a new map...so looking for the viewdistance from each map won't work out all that well... :( Does the game do a crc check for single player?

[NOPing for Food]

How can I make a "mod" that is the same as BFV but lets me moddify rfa files?

[Hufman]

well, after 4 hours i only found the color fog address:disappoin . (with the help of battlecraft(bfv cd)). Its a static address.
If anyone want to try :

1) create a new level with battlecraft
2) tools->random terrain generator
3) ctrl+shift+f (change the fog color) -- red 255 green 153 blue 255
4) i dont think it's important but i set fog begin to 0 and fog end to 200
5) save level
6) create lan with this map
7) search with t search 16751103 (decimal value of the color) http://html-color-codes.com/, i only got 27 addresses with this color. Then change address to 0.

(changing the fog value and reload the map did nothing):(

[stomperz]

Originally posted by NOPing for Food
Well, bad news for me...the address is DMA and changes when you load a new map...so looking for the viewdistance from each map won't work out all that well... :( Does the game do a crc check for single player?

I made a mod changed the

"renderer.fogstart 555
renderer.fogend 666"

it works in the mod but it is dma

got to look @ code
mov dword ptr [esi+0Ch], offset aFogstart ; "fogStart"
looks like it needs some code cave work

btw:Viewdistance has nothing to do with fog it means exactly what it says

[caliber1942]

it's laughably simple to find the fog address with a debugger once you know how to change it. i am working on it. i will tell all how i did it when i get it complete if i can and if i think it will be ok to do so. spon, PM me about this...

peace-
caliber

[NOPing for Food]

Once you know how to change what?

[chilli]

caliber how do you change the fog settings?

[Spontaneous]

Not yet. Caliber and I are working on this. We will let you guys know what we find, if we find out anything.

[tommyw]

I was dumb enough to sit there, find all values at 100 (I Looked in .rfa file and saw one maps fog value was 100) and play in game for a bit and search 100 again to get rid of all the other values that werent permenant at 100. After Hours of Playing, Searching Again and Such, I Brought it down to 1600 Values of 100. Couldn't get any smaller.

So In Groups of 10, I changed the 100s to 1s. About 90% through the list I found one that made the fog right up to my nose. Sure enough, it was the fog value. It was a Dynamic address, and theres not much I could do with it because the AutoHack wouldn't work (nothing was modifying it.)

[caliber1942]

my method gets you down to 10 or less and then you simply modify them in memory to see which controls it. i won't say more than this---> you need to find a way to manipulate the fog value (float) into a value that you know so that you can search for in your memsearcher. i want to be able to tell everyone the way to do it without probs and so it is clear. i still think an elegant way would be using the console commands but nobody has hacked that yet-

peace-
caliber

[Lasix]

Did you use console comands to change the value or did you edit the RFA file. Well, i hope you can tell us soon
lasix

[test0r]

FOG DONE.

ok it is so very easy...

open one map RFA and there change the "begin fog" (where the fog starts) and the "end fog" (where the fog ends) (NOTE: end fog must be bigger than begin fog) to values like 539 or 643 (but not 300 or so) and then save this modified map to a new file (or backup the old one).
Start BF and load the new map and T-Search for both of these values. You will find (for both) about 500 adresses. Now do something ingame, change sides etc... Then you will get about < 10 addresses. Try to modify any of them and you will find the right one.

The rest "How to find the DMA address" (yes, it is not static, also it seems like, but e.g. after a bf restart - mapchange - the address changes) is your turn now (I know how to, but hey you arent noobs..:))


HF

[Spontaneous]

LOL yea thats pretty much what we did. One thing we made both beginning and end the same thing and searched for just that value as a point. 18 right off the bat. I found the DMA. The trick is getting the static from it as there is only 1 way to change it ingame and thats the console command. You can breakpoint away but unless something reads or writes that value ingame(cant be done using tsearch), your not going to get anything. BUT I think I might have got lucky and found a way. I need to talk to caliber about this to confirm.

[test0r]

I get (both times) one asm that reads from the address, you not? :P :D

[Spontaneous]

I didnt get any. Maybe I didnt play long enough. But I caught 1 address when I went to console and typed "exit" as that is of I often quit my game. When I did, it seemed to pick it up. It only came up because I had the DMA breakpointed. So hmm. See my problem is I only messed around with the DMA of fog in bf1942. I worked on other things 1st. Then by time it was coming to do fog, I had vietnam

[test0r]

it works like a dream ;) you did something the wrong way...

it should popup (the BP) as soon as you go back ingame (when fog is rendered)

[Spontaneous]

went back to bf1942, see what you mean. Tryying again.

Ok now I found something. This time out of the addresses, I could change 1 and there was another that when I went in and out of the game would change to what I changed the one. The one I changed effected the fog. Now I breakpointed that one and it got the address right away, 1 address just like in bf1942. NOW, I breakpointed the other one just for kicks. Went in and out of the game. GOT 4 ADDRESSES. Now didnt I read a post that had 4 values for the maps value distance? Checking now.

Yep

QUANG_TRI\AI.CON
aiSettings.setViewDistance 75
QUANG_TRI\INIT.CON
Game.ViewDistance 85
QUANG_TRI\OVERGROWTH.WST
viewDistance = "400"
QUANG_TRI\UNDERGROWTH.WST
viewdistance="55"

Could the 4 possibly have anything to do with these settings? Look I am new to the setting fog type settings myself so I got this stuff but dont know where to go myself. I been mainly working on bypassing coding, not inserting a value.

[test0r]

I also didnt have done fog before :D

But the only thing is: there are 2 DMAs which you can change, you must breakoint those 2 (and not the other one which represents it, as you said changes when you go back into game).
Those two (begin fog, end fog) are both handled the same way and one asm code (not the same) reads from them - hey thats logical, if there is nothing, than where would the game know the fog from? ;)

[NOPing for Food]

I found 4 addresses that access the viewdistance address, they all point to something+0x2C...

[test0r]

ok, guys how do you find those lines in the RFAs? With a mod development tool?

[NOPing for Food]

Install the mod toolkit (it's like 8mb) and then load the map rfa into winRFA

[test0r]

yeah alreadsy did it. you are right, beside the fog begin & end values, there is a view distance in the init.con. will see if I can change it too ;)

PS: The AI.con is for the bots, so the view distance there ranges their "sniper skill" :D

[NOPing for Food]

It's a few lines below...for ia drang (init.con)

renderer.vertexFogEnable 1
renderer.fogColorVec .83/.83/.91
renderer.fogstart 100
renderer.fogend 400


Game.ViewDistance 500

[Spontaneous]

If someone could master the console hack, we could get vertexFogEnable 0

But now I also wonder if them 4 addresses have to do with them 4 commands. See I have no clue what these 4 addresses do yet.

[NOPing for Food]

Modifying the fogEnd to a really high value does almost the same thing as turning off the fog completely... I have been able to find the address of the fog end at runtime with my hack, but the problem is I don't know how to read/write floats with API (the fog is a float, isn't it?)

[Spontaneous]

yep fog is a float

[NOPing for Food]

What size is a float?

byte = 1
int = 2
long = 4
float = 8??


Edit: Ok, it is 8 (use a Single in vb...) My fog hack is done now :)

[Spontaneous]

ok please explain to me how to change the value when you already got the asm code.

[caliber1942]

well damn, you guys got to it before i could post it... all work and no play makes caliber too late to post the way..... oh well. did someone write that they found the viewdistance offset? would be a great addition to the nofog.

peace-
caliber

[NOPing for Food]

I have the viewdistnce offset :)
Edit: Hrrm, when I modify the value in Tsearch it works fine -- but changing it in VB makes the screen go black...

1 To find the offsets: (works for both fogEnd and viewdistance)
2 change the value in the rfa to something "rare"
3 load the map and search for a float of that value
4 you will get a few, just change the values in tsearch to something like 10
5 alt-tab back into BFV and see if it made a big difference
6 you know have your dma
7 resolve the pointer (http://www.hex.gifgraphix.com/tutorials/Resolving%20DMA's%20-%20An%20Easier%20Method.txt)
8 do the magic in vb
8a read the value in the pointer (long)
8b add the value you need to change to get the fog/viewdistance addy
8c poke the value you want to use (use a single in vb, it's "size" is 8)
9 you're done

[test0r]

Food you also have to take the begin fog, and change it very near to the end fog, for getting a "clear sight" on the battlefield. Otherwise there is still fog in front of you (less but there is..)

yeah that is it; spont read that tutorial and you get your static fog address ;)

[NOPing for Food]

Yeah, but it's not hard to find...i spent a few minutes and found the address (turns out to be extremely simular to the fog end ;))

Just read the viewdistance, and set both fog start and end values to that and you are golden...

[caliber1942]

i got both fog and viewdistance working. not sure how often we will get to snipe since the game is more intense and close quarter battles with foilage, etc. anyways, it works-

peace-
caliber

[NOPing for Food]

Viewdistance is weird...I can read it just fine, and I can change it in tsearch, but when I change it with vb it makes the view go crazy in the game... I would assume it's a problem with how I'm writing to th memory, but it's the same function I am using to successfully change the fogStart and fogEnd... :(

[DrKenneth]

Originally posted by NOPing for Food on 23rd March 2004 at 16:05
What size is a float?

byte = 1
int = 2
long = 4
float = 8??


Edit: Ok, it is 8 (use a Single in vb...) My fog hack is done now :)


The sizes depend on the language. What you have there is true for VB, but not for C/C++.

In C++:
byte = 1 (ie. char, BYTE in windows.h lib)
int = 16
long = 32
float = 32
WORD = 2 (windows.h lib)
DWORD = 4 (windows.h lib)

These are the typical definitions in other languages too. If you use pretty much any memory searcher, these values are typically used.

[Hufman]

woot! that was so simple?
:lam:
well done all!:alc:

[NOPing for Food]

something is whack...I can change it in tsearch but not in vb?!? I use the same function for the fog poking and it works then...This is getting on my nerves! Someone care to help me out?

[Lasix]

ok, when i change the values to let say 400 (beginning)and 405 ( end) then i save the map and i try ot run a dedicated server with that map it crashes the server...what am i doing wrong

[NOPing for Food]

Run as single player...

[caliber1942]

food-
when you write to the dynamic address holding the setting for fog or for viewdistance, it should take up exactly four spaces: for instance:

if address is 14A7510, then in Hex editor you would see:

14A7510 | XX XX XX XX 01 99 A7 00 25 1F

whereas XX XX XX XX is the four spaces taken up, and represents your number as a FLOAT. remember that values are stored in reverse within the code. maybe your code is writing more spaces than this or something and overrunning into another variable in the game or not writing the proper bytes into the proper spaces?

Lets say that 00 3C 64 00 is the FLOAT for the value 1000. i realize that it isn't but i don't have a converter handy so just assume that it is. then you need to make your code write into the address like so:

14A7510 | XX XX XX XX 00 99 A7 00 25 1F (notice the XX's and that's where it goes_

14A7510 | 00 64 3C 00 01 99 A7 00 25 1F (notice the hex gets placed in reverse)

anyways, maybe your code is writing over more area than intended?

14A7510 | XX XX XX XX XX XX A7 00 25 1F

or not reversed?

14A7510 | 00 3C 64 00 01 99 A7 00 25 1F

like i said, perhaps your fog got written wrong but it did it in such a way where it didn't bother another variable and also the values written to the address changed the fog in the way you wanted.

hope this helps-

peace-
caliber

[NOPing for Food]

I'm not having a problem with that...like I said: It works in other instances. I am writing the fogstart and fog end with the same function. I've tried writing it with a size of 1,2,4,8,16,and 32 and none of them work!

[bf194lover]

The sizes depend on the language. What you have there is true for VB, but not for C/C++.

In C++:
byte = 1 (ie. char, BYTE in windows.h lib)
int = 16
long = 32
float = 32
WORD = 2 (windows.h lib)
DWORD = 4 (windows.h lib)


I think you are mixing size (in bytes) with bit width here ;)

Lets ask our friend, the compiler:
Me: Hello Mr. Compiler
Co: Greetings, what can i do for you?
Me: Eat this!


#include <windows.h>
#include <iostream>

using namespace std;

int _tmain(int argc, _TCHAR* argv[])
{
cout << "sizeof(char) = " << sizeof(char) << endl;
cout << "sizeof(BYTE) = " << sizeof(BYTE) << endl;
cout << "sizeof(short) = " << sizeof(short) << endl;
cout << "sizeof(WORD) = " << sizeof(WORD) << endl;
cout << "sizeof(int) = " << sizeof(int) << endl;
cout << "sizeof(DWORD) = " << sizeof(DWORD) << endl;
cout << "sizeof(long) = " << sizeof(long) << endl;
cout << "sizeof(float) = " << sizeof(float) << endl;
cout << "sizeof(long long) = " << sizeof(long long) << endl;
cout << "sizeof(double) = " << sizeof(double) << endl;
cout << "sizeof(long double) = " << sizeof(long double) << endl;

return 0;
}


Output:

sizeof(char) = 1
sizeof(BYTE) = 1
sizeof(short) = 2
sizeof(WORD) = 2
sizeof(int) = 4
sizeof(DWORD) = 4
sizeof(long) = 4
sizeof(float) = 4
sizeof(long long) = 8
sizeof(double) = 8
sizeof(long double) = 8

(results were taken off my x86 (AMD) machine, VC++ 7.1)

For the float vs. double case...
They have different precision and range.
In a typical implementation, double is equivalent to the IEEE 754 "Double Precision" format, a 64bit number with 53 bits of significand (precision), in the range 1e+-308 (for normalised values).
Float is equivalent to the IEEE 754 "Single Precision" format, a 32bit number with 24 bits of significand, in the range 1e+-38.
The difference in size between float and double (assuming there
is one) typically exists to support representation of floating
point values of greater precision (larger range of values
of floating point mantissa), greater range (larger range of
values of floating point exponent), or both.

Regards

[NOPing for Food]

Well I got it now...I was using 8 instead of 4 for the "size" of the value being put in..I didn't think to change it to 4 because it worked for the fogStart and fogEnd without creating any negative results...

[bf194lover]

To verify which floating point types are used, look at the operand size of the memnonics:

Example:

Load a value into FPU (saved at top of FPU stack, conversion to extended float format -> 80 bit registers, if required)

FLD DWORD PTR [...] ; float (4 byte) type
FLD QWORD PTR [...] ; double (8 byte) type
FLD TWORD PTR [...] ; extended precision format (80 bits, native FPU format)

Regards

[caliber1942]

thanks bf194lover. i think we were both saying the same thing, in that the space used to store the value in memory takes up 4 spaces (or 4 bytes). glad you got it working NOP-

peace-
caliber

[CaptainCox]

Originally posted by NOPing for Food
I have the viewdistnce offset :)
Edit: Hrrm, when I modify the value in Tsearch it works fine -- but changing it in VB makes the screen go black...

1 To find the offsets: (works for both fogEnd and viewdistance)
2 change the value in the rfa to something "rare"
3 load the map and search for a float of that value
4 you will get a few, just change the values in tsearch to something like 10
5 alt-tab back into BFV and see if it made a big difference
6 you know have your dma
7 resolve the pointer (http://www.hex.gifgraphix.com/tutorials/Resolving%20DMA's%20-%20An%20Easier%20Method.txt)
8 do the magic in vb
8a read the value in the pointer (long)
8b add the value you need to change to get the fog/viewdistance addy
8c poke the value you want to use (use a single in vb, it's "size" is 8)
9 you're done


Got until step:6, I am stuck on that, dont know what to do next.
Tried to look at Max tut for fog
http://www.hex.gifgraphix.com/tutorials/Making%20A%20Fog%20Removal%20Trainer.txt

I dont know if this aplies here.

Played around with adding a value to the adress but I get varoius results like, milky white or game chrashes etc.

Maybe somebody could give me a hint here please?
Cheers

[test0r]

for view distance it doesnt work, I tried it that way - the result was error on PCs of other users.

[NOPing for Food]

There is a correction to my info...the size of a float is 4, using 8 can give you weird results...like messed up fog or a crashed game.

[caliber1942]

test0r, not sure why you can't get the viewdistance to work, the method is EXACTLY the same as the fog-

[test0r]

I also thought that, but did you test it on other machines? You will see...

[chilli]

why ppl bother with this stuff i just enabled console commands and i can set whatever fog level i want on each level

[Spontaneous]

Cause no1 else figured out how to enable the console commands, let alone code in to a hack to send a command to console.

[chilli]

well i dont code it i just type it in console each time a map is loaded lol granted i use an alias so its easier :)

[Spontaneous]

well some of us would not even want to do that, but hey got any tips on unlocking the console?

[test0r]

yeah OK, but enabling the cheats with the console isnt very comfortable. Also the real hacks cant be enabled with this (think about minimap, 3dmap, nametags, accuracy) :D

[caliber1942]

yeah, chilli keeps talking about this but he won't give us the "secret"... hehe. how about a console command tutorial chilli?

[chilli]

i already posted how to hack it caliber. just search thru threads. and no it does not require uber asm skillz..

[MarlonB]

Originally posted by NOPing for Food
I have the viewdistnce offset :)
Edit: Hrrm, when I modify the value in Tsearch it works fine -- but changing it in VB makes the screen go black...

1 To find the offsets: (works for both fogEnd and viewdistance)
2 change the value in the rfa to something "rare"
3 load the map and search for a float of that value
4 you will get a few, just change the values in tsearch to something like 10
5 alt-tab back into BFV and see if it made a big difference
6 you know have your dma
7 resolve the pointer (http://www.hex.gifgraphix.com/tutorials/Resolving%20DMA's%20-%20An%20Easier%20Method.txt)
8 do the magic in vb
8a read the value in the pointer (long)
8b add the value you need to change to get the fog/viewdistance addy
8c poke the value you want to use (use a single in vb, it's "size" is 8)
9 you're done

If you have it, why didn't you tell anyone it is quite useless :D I have the feeling you are talking about fog here, and not viewdistance....as fog can be changed directly through memory, viewdistance requires an "activation" from console...



I used a different method for viewdistance though:

1. Make console hack work
2. Set viewdistance to an easy to find value (1623 or something)
3. Find it with t-search(float)
4. Breakpoint it, you will find 1 line
5. Ahhh....the code does a check of your found value to another value (retrieved from rfa), to see if it is bigger then allowed.....imagine what happens if you disable that check ;)
6. after that, you are able to control the viewdistance through console....

Good luck....

[chilli]

i followed your method marlonb long ago, but i didnt find the mentioned check so i gave up quickly..maybe i should give it a try again--

[MarlonB]

Originally posted by chilli
i followed your method marlonb long ago, but i didnt find the mentioned check so i gave up quickly..maybe i should give it a try again--

I use olly to let bfnam break on the line where he reads my viewdistance.....from there on i step (F7) through the code to see what happens.....if you do this , you will see it quite fast...

[test0r]

how do you do that in OllyDbg? When I breakpoint something BFV then pauses and hangs (and I cant go back to windows), so I often have to restart my PC...

[MarlonB]

Originally posted by test0r
how do you do that in OllyDbg? When I breakpoint something BFV then pauses and hangs (and I cant go back to windows), so I often have to restart my PC... '

Olly should pause bfv when it breaks :) .... then use F7 to step through the code, or F9 to unpause bfv...

It is indeed quite unstable, and i've heard more peeps complain about having problems with olly and bfv.....try running bfv in a window....

[Spontaneous]

test0r, you can use CTRL+ALT+DEL and end the program from the processes tab. End Olly. This way you dont have to reboot. I have too had your problem before.

[test0r]

yes but that isnt possible the most time.
Often I cant go back to windows or any other window...

[MarlonB]

Originally posted by test0r
yes but that isnt possible the most time.
Often I cant go back to windows or any other window...

You prob loose your mouse....happens to me too occasionally.

Do a ctr+alt+del and use your keyboard to kill the bfv process....practice it first, it takes some skill ;)
Or use alt-tab to go to the taskmanager, if you already have it running.

[CaptainCox]

Yo Marl How to you minimize BF to a window? Sounds realy practical when you use Tsearch or any prog.

Thanks Spont!!!!

[Spontaneous]

yep. You should be able to atleast get it up even if at wrong resolution and you can see anything but the game and taskmanager.

Cox, Program Files\EA GAMES\Battlefield Vietnam\Mods\BfVietnam\settings\VideoDefault.con

Change renderer.FullScreen 1 to renderer.FullScreen 0

[MarlonB]

Using two screens helps too :) I run BF in one, and all other stuff on the second monitor....

[CaptainCox]

Maybee I should nick that nice Sony SDM-P232W we have at work, I bet you the boss would not notice=).

[chilli]

thx marlonb it werkz another pwn-s-rus hack to my trainer :)

[test0r]

no marlonb,
when I am ingame and OllyDbg breakpoints, then often everything hangs - that means I even can not go to taskmanager etc. - its not a problem of losing the cursor.

[chilli]

test0r make sure youre breakpointing in the right module (eheh we never know) press alt+e and choose bf module.

[test0r]

lol - if I breakpoint something I have to look at the code..
so, yes the module is correct. ;)

I think it is because of my graphics driver or so. Sometimes I can open the taskmanager, but often I only have a frozen screen..

[bf194lover]

when I am ingame and OllyDbg breakpoints, then often everything hangs - that means I even can not go to taskmanager etc. - its not a problem of losing the cursor.


As mentioned by others, a good way to debug DirectX apps is to setup/force it into windowed mode
That way it cant get exclusive access to direct3d device.
(there exist possiblities to force fullscreen-only apps to windowed mode but that requires hooking of D3D layer)

For input devices, Directx apps can setup "cooperative levels" like:

DISCL_FOREGROUND = device will only recieve input when the application is in focus.
DISCL_BACKGROUND = device will recieve input at all times, wheteher it is in focus or not.
DISCL_EXCLUSIVE = no other instance can have exclusive access to the device while it is acquired.
DISCL_NONEXCLUSIVE = access to the device does not interfere with any other applications

I often "cascade" the debugger and the target apps windows.
If the mouse is lost while switching (ALT+TAB), try to right click (like show context menu) into non-client area of directx app (desktop, debugger window...).
Most times the mouse focus is gained and the cursor will show up then.
Most switches (due to breakpoints) even preserve the transition of the mouse cursor making it easy to single step.

There are rare cases where mouse is locked out.. use keyboard shortcuts then ;)

Regards

[n00bie_gamer]

a lot easier method kudo's to Max Power wherever he may be........

go into options into where the View Distance option thing is
tsearch------search for 100

go back to BFV or BF move the slider for the View to 75 or 74
then tsearch for 75 or 74 which ever one u used, then you should have just one addy that being the fog one.... this takes less than 3 minutes to do

cheers, and my compliments to Max_Power

btw..... where is he lately???????

[caliber1942]

except that there is no slider in bfv, so you can't do it this way. bfv is different than bf1942, that option is not available in the options screen-

[test0r]

yes, BFV has no general view distance value like BF in the options screen. View Distance and Fog are both handled by the map's RFA now..

[CaptainCox]

OK GUYS here is another BIG!!!!! one to test0r.
You are the best teacher I ever had, treat this guy with respect folks he deserves it.

Got the fog working nice and smooth here thanks to him :).

Again thanks man, if there was a pulitzer for hacks I would vote for you.

[test0r]

thanks CaptainCox ;)

[Spontaneous]

I am still debating if I want to make a fog hack for my hack or not. Since there is no easy way to defeat viewdistance other then by changing it in console, its not really worth coding a fog hack, is it?

[CaptainCox]

Well...I tried to do it due to the chalange ( with the big suport from test0r;) )
I guess depends how you see it, in BFV it helps on some maps and some not.
Looks abit wierd I adimit when you see buildings and trees choped of by the viwedistance clipping plane, so I guess a fog without the viewdistance looks kind of strange.
I will unlock that console next anyway (I know how, but did not get around to do it yet ;)

[Spontaneous]

Yea unlocking the console is so simple so I kept with just the console hack for now.

[stomperz]

the consol is Hacked in bfv!
(kind of)

if u write a "xxx.con file the fog-viewdistance- and others are avable

put the con file in your bfv root dir hit the ~ and type include yourfile.con

make as many as u want
1.con
2.con

renderer.fogstart 4900
renderer.fogend 5000
game.viewdistance 4800
renderer.fieldOfView .03

see ShangTZ -DMA
http://mpcheatz.de/mpc/forum/showthread.php?s=&threadid=38063

looks like they left the door wide open lol
now everyone has a free undetected pb hack
all u need is con files to hack
boy i can't believe this was left open
can pb detect it? ss maby thats all
is bfv a bata or something? j/k
makeing hacks seems kinda dumb rite now
hope they fix this soon........
i like a chalange


(this doesn't work in bf1942)

[n00bie_gamer]

hey speaking of console hack.... i tried to make one for just BF1942... but when i do "search text" and type in "Unauthorized Method" i get nil for results... i did untick that box where its case sensitive, and made the other one ticked... in OLLYDBG of course!

Yes... for some strange reason i cannot find those 3 unauthorized methods i need to get a hold of to make the console hack for 1942.... weird!

Any suggestions??

[xollox]

it's "unauthorised" not "unauthorized"

[Spontaneous]

thats why I just searched for unauth with case off.

[caliber1942]

just a note, if you are making your own hack, i am reminding everyone that apparently the viewdistance can still be hacked to work for just your computer, although it won't work on others' computers. i use my own hack on just the notebook computer here and so it works every time, but with the computer at home i compiled a different version to work there using a different address for the viewdistance and it works fine every time. so in a way, you can still make it work with a trainer, it just has to be used every time with that one computer. it works everytime (the viewdistance) but only on this one computer. just a thought-

[Spontaneous]

yea but see I am not the only one that uses my hack so that wont work for me, but as caliber said, its great if you are making the hack just for yourself on a single computer.