SannyBuilder.com Forums

Mkay.. I realise now it's invisible when not logged in

@John_Bryant

And did you read the topic of answered questions about this?

Read this topic. Read step 2. Same rules apply to CLEO 4.

Thanks for that.

After finding out IDA has a "pseudocode" feature I noticed it uses strtok first. By the looks of the C++ Reference, this is something else I need (since it can automatically separate strings by spaces/tabs). I've often thought sscanf was the only way of doing something like this.

 for ( i = CFileMgr_getConfigLine(v3); i; i = CFileMgr_getConfigLine(v2) )
  {
    if ( *(_BYTE *)i != '#' )
    {
      if ( *(_BYTE *)i )
      {
        v5 = strtok((char *)i, " ,\t");
        v4 = strtok(0, " ,\t");
        if ( stricmp(v5, "memory") || v1 )
        {
          if ( stricmp(v5, "devkit_memory") )
          {
            [...]
          }
          else
          {
            dword_8A5A80 = atoi(v4) << 10;
            v1 = 1;
          }
        }
        else
        {
          dword_8A5A80 = atoi(v4) << 10;
        }
      }
    }
  }

It's much easier to keep track of the variables this way.

Working Code

{$CLEO}
wait 2
0A9A:   0@ = openfile "stream.ini" mode 0x72
else_jump @End
0AC6: 3@ = label @aFrameDelay offset
0AC7: 4@ = var 5@ offset

:ScanFile
while true
    wait 0
    0AA7: call_function 0x536F80 num_params 1 pop 1 0@ 1@
    8039:   not 1@ == 0
    jf break
    0A8D: 2@ = read_memory 1@ size 1 virtual_protect 0
    8039:   not 2@ == 0x23
    jf break
    0AA7: call_function 0x82244B num_params 2 pop 2 0x86A8C8 1@ 1@
    0AA7: call_function 0x82244B num_params 2 pop 2 0x86A8C8 0 4@
    0AA7: call_function 0x8229B6 num_params 2 pop 2 1@ 3@ 2@
    0039:   2@ == 0
    else_jump @ScanFile
    0AA7: call_function 0x82258E num_params 1 pop 1 4@ 2@
    0A8C: write_memory 0x53E94C size 1 value 2@ virtual_protect 1
    break
end
0A9B: closefile 0@
:End
0A93: end_custom_thread

:aFrameDelay
hex
"framedelay" 00
end

Now I'll work on adding all sorts of settings to this file. Probably to do with optimisation and graphics in order to keep the stream.ini's original purpose. Since I don't know of too many memory locations of this stuff yet, I better start digging... Thanks for the help.

RewriteRule ^mypage/([A-Za-z]+)/([0-9]+).php$ page.php?act=$1&page=$2 [L,QSA]

Try taking a look at these, also: http://httpd.apache.org/docs/2.0/mod/mo … writeflags

And I've finally got a simple, working example of that array crash:

Crashes

{$CLEO}
0006: 0@ = -1
0A8E: 2@(0@,1i) = 2 + 3
0ACE: show_formatted_text_box "%d" 1@
0A93: end_custom_thread

Survives

{$CLEO}
0006: 0@ = -1
0006: 2@(0@,1i) = 5
0ACE: show_formatted_text_box "%d" 1@
0A93: end_custom_thread

Crash is at about 0x4644C7, as ever..

Try installing CLEO 4 without the .asi loader installed.

Hmm.. not sure if this was intentional, but I find the experience of using 0ADE very suprising.

0ADF: add_dynamic_GXT_entry "_TEST" text "Test string"
0AC8: 0@ = allocate_memory_size 260
0085: 1@ = 0@
0ADE: 0@ = text_by_gxt_entry "_TEST"
0ACE: show_formatted_text_box "Before: %X~n~After: %X" 1@ 0@

The example given for 0ADE shows a normal variable being used, which I assumed meant that CLEO 4 would write the GXT text to the pointer. Instead, a pointer to the GXT entry address is given. This is okay if it's supposed to be this way, but the example is a bit misleading. I'll update the Opcode Database if this is the way the opcode works.

However, with this code:

0ADF: add_dynamic_GXT_entry "_TEST" text "Test string"
0AC8: 0@ = allocate_memory_size 260
0085: 1@ = 0@
0ADE: 0@ = text_by_gxt_entry "EU38PLM"  // random, inexistant GXT Entry
0ACE: show_formatted_text_box "Before: %X~n~After: %X" 1@ 0@

A memory address is still returned, which points to part of the loaded CLEO.asi itself. Here's the 32 bytes at the address returned:

00 00 00 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E 67 20 70 6C 75 67 69 6E 20 25 73 00 72 62 00 00

����Error loading plugin %s�rb��

I expected 0 or nothing to be returned, so it sent me down a lot of wrong paths. It'd be nice for some light to be shed on this opcode.

EDIT

And 0ADE doesn't seem to support pointers on the input parameter, which has left me completely stuck.

Yes, I know how the sub works, but what is the logic behind this...

A1D5865300      // mov eax, [0x005386D5]        // Offset 0x008220ED
05D9865300      // add eax, 0x005386D9          //
FFD0            // call eax
81C4A8000000    // add esp, 0x000000A8h
C3              // ret

From Ryosukes source. 0x5386D5 contains an offset from one function to the sscanf function, then the add operation increases that value to get the exact address.

Which is why I assumed the exact value could not be copied.

0A9A: 32@ = openfile "cleo\missile.dat" mode 0x6272  // IF and SET
for 33@ = 0 to 29
    0AA7: call_function 0x536F80 num_params 1 pop 1 32@ 11@
    0A8D: 12@ = read_memory 11@ size 1 virtual_protect 0
    if
    0039:   12@ == 0
    then
        break
    end 
    if
    0039:   12@ == 0x3B
    then
        000E: 33@ -= 1 
        continue
    end
    0AA5: call 3@(3@,1i) num_params 3 pop 3 11@ 13@ 14@
    000A: 14@ += 0xA0
    wait 5000  // for debugging.
end
0A9B: closefile 32@

In Ryosukes script first iteration works perfectly (returns to memory correctly) but crashes on 2nd iteration (cleo.asi+154C).

However, if there's a wait before the for loop (even with the wait 5000), it crashes on the first iteration (ntdll.dll+1B21A).

Missile Source

Yes. I think the problem with calling these string functions directly might be down to how the data is passed.

Perhaps ASM would work if the bytes were passed one-by-one... But I still have troubles when it comes to handling registers.

while 0AB1: call_scm_func @GetConfigLine 1 0@ 1@
    0AC6: 2@ = label @TempMemory offset
    0AD3: 2@ = format "%d %s %s"
    0AC6: 3@ = label @FUNC_sscanf offset
    0AA7: call_function 3@ num_params 2 pop 2 1@ 2@ 4@ 5@ 6@
    0ACE: show_formatted_text_box "%d %s %s" 4@ 5@ 6@
end

:FUNC_sscanf
8B4C2404        // mov ecx, [esp+0x04]
51              // push ecx
8B4C2408        // mov ecx, [esp+0x08] ?
51              // push ecx 
8B4C240C        // mov ecx, [esp+0x0C] ?
51              // push ecx
9AAD208200      // call 0x8220AD - 9A is the right one for a direct address?
// get return?
C3              // ret

I doubt this will even call right, since this is probably similar to what 0AA5 does... I think the bytes at the first address need to be read, and maybe the second.

Still, I don't understand the functions not working or why the opcode doesn't support aDMA.

0x726D2B - call createBulletTrail

0AC6: 0@ = label @CreateLaserParticle offset
0A8C: write_memory 0x726D2C size 4 value 0@ virtual_protect 1

:CreateLaserParticle
hex
{
06BC: create_M4_shoot_from 0@ 1@ 2@ target 3@ 4@ 5@ energy 6@
}
end

:DisableCrosshair
0A8C: write_memory 0x58FBBF size 5 value 0x90 virtual_protect 1

I was goning to do this, but I don't have the required ASM skills. Planned to grab the parameters passed to :CreateLaserParticle and create either another thread (passing the params) or a corona, if possible.