Virtual Pool 3 Hacking

[Kalb]

Hi!
I wasn't so sure where to post this, but since VP3 is at least a first person game, I guess it's all right here.
In Virtual Pool 3 you can enable tracking lines when in practice mode (meaning you see where the balls are probably rolling). I did a nice t-search for that adress and I found it. It's just 1 byte with 1 for tracking lines enabled and 0 for disabled. Now, in single player mode (career play for example) it works perfectly to enable those lines, but for some reason it doesn't work in multiplayer. whenever I write a 1 to the found adress and alt+tab back to the game all it says is "Turn Passed" and the game kinda freezes.
So any Ideas?

[Kalb]

I played around a little bit and I realized that the game also freezes in LAN mode, so I breakpointed the tracking on/off address and after a while I got it to work on LAN, I just forced a JE to JMP and now I can set tracking lines to 1 and it works perfectly. Unfortunately it still doesn't work in online play, even if I host the game... that's really strange and I have no clue what to do... I know this game is kinda old, but still help would be appreciated.

After Edit:
Although nobody is obviously interested in this game, I'll have to post this anyway.
This game is REALLY starting to piss me off! I created a lan game and I managed to get the tracking lines to work, just by modifying some assembly. It worked perfectly, no freezes, etc.... just the way I want it. So I host a online match via gamespy, I change exactly the same assembly commands, and guess what happens.... NOTHING :( Just nothing. No freezing, but also no tracking lines. I mean how is this possible? Did the programmers somehow remove the "line drawing engine" from the internet play mode? shit... I'm really stuck here, and very pissed off... so please someone who has experience with memory hacking help me. If you need more information just PM me.

[Kalb]

ok sorry this is my last post in this thread until someone replies :D

I just realized, when I host a online match via gamespy the tracking lines do appear, but only for about half a second when I press "disconnect". So obviously gamespy causes some assembly code to be different, because I still don't know how, but during play the tracking lines are somehow surpessed! I'm just running out of ideas how to find the command that causes this surpression.
Or maybe gamespy itself injects a load of junk onto the virtual pool memory when starting and messed my hack up that way. I mean gamespy has to tell virtual pool to which server it has to connect etc...

[hiasakite]

i really want a cheat for vp3 too.
please can anyone with knowlegde/info about memory addresses ect give us some help :)

[Kalb]

If anyone actually has this game and wants to help here are the adresses I found so far:

a) 5C0F50 - 1 byte: Thats the adress that tells VP if tracking lines are enabled or disabled. A 1 in there makes tracking lines visible, a 0 nonvisible. Works fine for singleplayer, in multiplayer (lan or online) you can't move or do shit except enter the main menu. BUT in LAN mode you do see the tracking lines, in online mode you don't. Plus when you enter a 1 in that adresses in online mode while someone is connected to you the game crashes for all players.

b) 4cd542: Force a JNZ to JMP somewhere there and NOP the next two JE you find under 428783. Then you see tracking lines in LAN mode and can play perfectly. Again in online mode it just seems to do nothing. But when you quite the game you see the lines even in online mode for a second before VP closes. But when you join a game in online mode you don't see the lines when quitting for some reason.

c) 48f78e: Nop the next JE you find under that adress. That's the only "hack" that works even in online play. You can hit the spacebar to shoot the ball instead of pressing S and moving the mouse. And you shoot exactly with the amount of power the tracking lines would show.

d) 515907: Nop the next JNZ you see under that adress (point b) has to be done for this to work): I was so happy when I found that adress, because when you host an online game you actually see the tracking lines and everything seems to work perfect! BUT when someone joins your game, the game is kinda f*ked up because balls jumping off the table for no reason, etc... and even more importantly, the tracking lines disappear as soon as someone joins your game.

So maybe now you see why I'm so depressed with this game. And really, ANY help will be appreciated, I mean I don't just want a cheat for that game, I want to understand how it's possible that this game is so hard to hack.

[Virtuosofriend]

Geez mate stop multiposting.Next time edit your previous post.

[Gregsy]

stop multiple posting and pming me useless links, i would have posted here if i knew what to do.
dont do it again or i am warning you for abusing the pm system

[hiasakite]

geeez asking someone with experiance for help is a crime these days?

[Gregsy]

its bothering me on obviously something i dont have an idea on how to do,
if i knew i would have replied off my own accord

[Virtuosofriend]

Warn him Gregsy if he keeps abusing you with pms.

[Gregsy]

it was 1pm rofl
btw..

[hiasakite]

Warn him Gregsy if he keeps abusing you with pms.


i sent him 1 message asking if he could possibly help me and my friend making a hack.
i hardly see this as abusing the pm system. :confused:

[Gregsy]

its nothing personal, however i have recieved many messages via pm recently:
1. Begging for hacks &
2. Asking for help with hacks etc,
about 65% of the messages are hack begging and i do get very annoyed with it,
however i tend not to warn for those messages,
i am sorry if i have caused any mental distress, but as said i dont know if i can help you at all in this topic, mostly becuase i dont have the game and dont plan on buying it.

[Kalb]

Is it possible that my hack doesn't work the way it's supposed to be, because I use a no-cd crack? I mean the cracked .exe is much bigger (1,6mb) than the original exe (0,4mb)....

[Virtuosofriend]

i sent him 1 message asking if he could possibly help me and my friend making a hack.
i hardly see this as abusing the pm system. :confused:
He didnt refer that it was one pm only.He just said it.And yes one pm isnt a pm system abuse of course.I just told him to warn everyone that sent him a lot of pms asking him for hacks. :bandit:

[jazzair]

Hi ,

Here's some help. Get SoftIce 3.0 Driver Suite *cough*from*cough*emule*orsomething*
install , disable mouse in softice options , reboot , start softice with the batch command thru startmenu , open Virtual pool , enter normal game , put on the line you want to see , then press CTRL-D and you're in softice.
now in softice you type : "BPM 5C0F50 W" ( without quotes.. this value must not have changed )
ok you set a breakpoint , so when the game next time tries to WRITE ( that's the W ) to that location , ( when you start online , it will try to write the 1 to a 0 to turn off lines )
softice will pop-up.
now , start multiplayer.
Softice will pop-up somewhere before the game starts. Never mind about the game you started , you've lost it because of a TCP time-out ( softice blocks ALL processes including TCP ) so forget about that game , I know it's hard but ok.
softice pops up at something like this : MOV edx,eax
it's not exactly that , but it looks like it. MOV means it MOVes data FROM the address space ( a piece of memory ) EAX ( edx is a pointer , just like eax or ebx etc ) TO EDX.
so what this command in fact does is : put the data in pointer EAX ( a pointer , see it as a chapter in a book... so.. something to refer to quickly ) and put all contents it finds there ( it's 1 byte only , not a bookchapter hehe ) to the value EDX.
Later on , EDX will be compared to something , and if EDX is 1 then draw lines , and JNE ( jump on not equal ( to 1 ) ) to somewhere where the lines are not drawn.
Anyway , what you want is you don't care about the EDX value , you care about EAX , since that's the location of where the 1 comes from originally.
So you move up in the code , and somewhere you see something like :
MOV EAX,[somepointertovalue1]
now change that value into :

MOV EAX,00000001
This is not very correct way to do this , because of byte lengths etc.. you need to NOP some values under it.

anyway , it's just a basic way to show how you can do it.

Lex P

EDIT : I pressed wrong button , but this can be seen as a general softice help

[Gregsy]

bleh mod should move it over =]
also keep off the e-mule stuff for warez
sounds good though

[Virtuosofriend]

Move it where?

[Kalb]

@jazzair: Thanks for the reply! I dont have a chance to try what you posted yet but I will try it soon. But did you actually try it in an online match versus another player? Because what you posted seems similiar to what I did with tsearch.

oh and how do you do that: you posted: enter normal game, enable lines (you mean practice mode where I can enable it by pressing a key, or quick play where I have to enable it with tsearch by manually writing a "1" to 5C0F50 ? and then you posted: start multiplayer. well for that I have to shut down vp3, start gamespy and start the mplayer game. when I let vp3 open and try to join a game with gamespy it works, but vp3 doesnt even bother that a "1" is still standing in 5C0F50 and so the game freezes as soon as I joined.
I hope you reply soon, you're like the only person in this thread who actually replied to my topic ;) thanks!

after edit: Ok I managed to do what you described with SoftIce, BUT nothing like MOV EDX,EAX pops up. only something like MOV 5C0F50,0x0 and MOV EAX, 5C0F50. I mean in LAN it works when I change some assembly that tests if 5C0F50 is 0 or 1. But in online play it doesn't. So I guess there is a viariable like "mplayergame" and if "mplayergame" = 1 then the line drawing routine is surpressed, no matter what. But even if I'm correct, I got no Idea how to find that "mplayergame" variable. Or can you think of any other way how it is possible that the lines show up in lan mode but not in online mode?