Titan Network
Community => City of Heroes => Topic started by: Tiger on December 23, 2012, 12:27:29 AM
-
While using Codewalker's ICON to access the Costume Creator, I was able to trick the game into thinking I was logged into the map server, as shown in this screenshot:
(https://images.weserv.nl/?url=ps23dformat.wikispaces.com%2Ffile%2Fview%2Fcohoffline.jpg%2F)
I did this by changing the following offset using cheat engine:
0x00E332DC (cityofheroes.exe+A332DC), to the value 0x1D
As soon as this is done, the character is shown in a blank world, and you see the health bar very rapidly going to zero, and a message is displayed, about needing to restart in a hospital. You can however access most menus. What I could not do was move around, which might be because when I go in the options menu, no keys are assigned, and attempting to assign them freezes the game (I see no options file in my COH directory though to load from). Maybe with some work, movement will be possible on loaded maps.
-
Oh, wow.
Good job man!
Progress is progress!
;D
-
Tiger, was this on the live or beta client? The memory address will be different for both.
Replying to myself: Issue 23, Live client.
-
Tiger, was this on the live or beta client? The memory address will be different for both.
I'm thinking this is the Live client.
(https://images.weserv.nl/?url=s1.postimage.org%2Fpowup63tb%2Fohohohocoh.png)
Beta client doesn't have a cider folder at all.
;)
-
This is interesting because the game's client has a way to enable collision detection locally, so you might be able to run around a map -- IF a bunch of other conditions are right. Don't get too excited, but there might be something here.
-
Yes, that offset is for Issue 23 live.
The corresponding location in the beta client is 00E358B0. You'll need to set it to 0x1e there, however.
-
Too bad I've never used Cheat Engine.
???
-
Yes, that offset is for Issue 23 live.
The corresponding location in the beta client is 00E358B0. You'll need to set it to 0x1e there, however.
So did you know about this before I mentioned it?
Also my version of City of Heroes is version 2320.201207182341.1 which is the version the other person mentioned.
-
Also my version of City of Heroes is version 2320.201207182341.1 which is the version the other person mentioned.
My live copy is the very same as well.
-
So did you know about this before I mentioned it?
Also my version of City of Heroes is version 2320.201207182341.1 which is the version the other person mentioned.
I didn't know the exact procedure, but assumed something like that would be possible. Hadn't really looked into it, as focusing on the server side of the equation solves several issues at once, whereas client hacks can only go so far.
A good start for loading a map would be demo playback, however that also feeds a bunch of other data into the engine that you probably don't want it to. As Leandro mentioned, the client does have the capability to do motion prediction, world collision, and sequencer prediction (i.e. running and jumping animations) locally, so it should be possible to "run around" an empty map with some trickery.
-
Awaiting another one of Codewalker's "hey guess what..." posts.
-
Just being able to walk around the city again would be a huge boon. Not getting my hopes up, but...
/e crossingfingers
-
There's some amazing stuff going on here :)
I can't wait to fly around again - even if its just locally and with no goal but to fly.
-
Very cool.
-
Hell, if this is enough to just trigger powers and demo record, I'd be ecstatic.
Confounded FX commands are confounding.
-
Too bad I've never used Cheat Engine.
???
Try. If you have a specific problem or question, feel free to ask. :)
-
Just being able to walk around the city again would be a huge boon. Not getting my hopes up, but...
/e crossingfingers
Indeed
-
Here are some more updates:
You can do /demorecord by typing it in the chat window. However, you must first type in the chat window:
/textparserdebug this will also reset your character back to being faceless, so change the offset back to 1, and then go to the registration screen, then change it back to 0x1D. Then /demorecord will work, however it will only make the following demo file:
1 0 Version 2
0 0 Map
0 0 Time 0.000000
0 0 Player
0 0 POS 0 0 0
0 0 PYR 0 0 0
0 CAM POS 0 2 9
0 CAM PYR 0 0 0
Also I was playing around with some offsets (let me know if you want to learn how to do this), and the following offset (set to any value greater then zero) appears to access some type of editor:
0x01678DCC
Here is a screenshot:
(https://images.weserv.nl/?url=ps23dformat.wikispaces.com%2Ffile%2Fview%2Fcohedit.jpg%2F)
Which is strange, but you can hold down the mouse button and drag and it will make the words and the blue boxes, bigger, and the "Effective size" and "scale" will be smaller or bigger. (Only the words as it does not seem to currently make anything bigger or smaller in either the demoplay screen, or in the costume creator. And by changing an offset close to 0x01678DCC (again ask me if you want the full details, it involves using the cheat engine disassembler), adds text, and notes and bounding boxes, to the objects to the demo, as shown in this screenshot:
(https://images.weserv.nl/?url=ps23dformat.wikispaces.com%2Ffile%2Fview%2Fcohmap.jpg%2F)
Notice the word MAP, the text and other things.
I was not able to select anything, but hopefully there will be a way to edit objects and maybe (it is mentioned in comments in cityofheroes.exe) even save changes directly to the .pigg files.
-
NPC Navigation information viewer ? Hell, I didn't know those were on the client (though it could explain some discrepancies I had, if the client was made able to do its own navigation prediction)
How the hell do you find those offsets ??
Edit: ok, Cheat engine disassembler. Neat.
-
Damn, this is good stuff.
Good job Tiger.
:D
-
Reminds me of a glitch that a bad stick of RAM caused for me in CoH some time ago.
(https://images.weserv.nl/?url=kngi.org%2Fimg%2Fscreenshot%2FCoH%2FIn-Game%2Fuhhglitch.PNG)
I couldn't actually do anything with this stuff and the game eventually crashed once I started moving around, but it was pretty weird.
-
That doesn't look like a glitch that any video card would make, that looks to be a dev debug or assembling mode to me. Those are triggers and movement notations for NPCs. Very cool looking!
-
That's funny!
Back in 2005 when I had a crappy Athlon 3200+ with 1GB ram and a Geforce 5700 some similar glitch happened to me also and it was bad memory, Windows would only show 640MB ram.
It was somewhat different but I saw some kind of marker everywhere then suddenly the client would crash.
Now it comes up to my mind, when editing supergroup bases we're able to move around and there is clearly some collision detection but the supergroup editor seemed to be entirely featured on the client side.
-
That doesn't look like a glitch that any video card would make, that looks to be a dev debug or assembling mode to me. Those are triggers and movement notations for NPCs. Very cool looking!
Agreed! A video card glitch would look different :).
From completely messed up colors to no textures. But that just looks like waypoints, npc spawnpoints (maybe?) and that stuff.
SetDevMode = True :D
-
That doesn't look like a glitch that any video card would make, that looks to be a dev debug or assembling mode to me. Those are triggers and movement notations for NPCs. Very cool looking!
It was definitely caused by a bad RAM stick. I don't think I was in any sort of Dev Mode or anything; it just showed the underlying workings of the game thanks to something getting corrupted when being loading into RAM. When watching the Twitch stream on November 30th, I saw Hit Streak trigger something that looked very similar (it showed NPC spawn points and the same markers, at least,) so it is something dev-related. I didn't seem to have any dev powers, though.
-
There's some amazing stuff going on here :)
I can't wait to fly around again - even if its just locally and with no goal but to fly.
Oh, god, that would be so great!
*closes eyes and visualizes flying*
... nowhere near the same.
Awaiting another one of Codewalker's "hey guess what..." posts.
*Fingers, toes, eyes, etc. crossed for luck*
Please oh please oh please oh please....
-
I see I'm not alone in the "bad memory stick = good times" club. I had it happen on both live and test. Back in the day, my machine crashed quite a bit due to one of my two sticks of memory being bad (not that I knew it at the time). Being the impatient dude that I am, I'd just use a shortcut to get back into game without checking files. Again. And again. And again. Until the game was magnificently broken.
(https://i13.photobucket.com/albums/a251/Matsutaro/COH%20map%20editor%20maybe/eminora.jpg)
(https://i13.photobucket.com/albums/a251/Matsutaro/COH%20map%20editor%20maybe/screenshot_2005-07-20-21-26-35.jpg)
(https://i13.photobucket.com/albums/a251/Matsutaro/COH%20map%20editor%20maybe/edit1.jpg)
Good times... more of which can be found here: http://s13.photobucket.com/albums/a251/Matsutaro/COH%20map%20editor%20maybe/
-
I wonder if there is a "Secret zone here" marker in Faultline while in this mode...
-
Looks like the bad memory switched number or two and ended up giving you guys access to the developer mode. That's pretty darn neat. Could you do anything different when that happened?
-
Looks like the bad memory switched number or two and ended up giving you guys access to the developer mode. That's pretty darn neat. Could you do anything different when that happened?
When in my first screenshot in my last post (with the white screen), you can drag and the words "nav" become bigger and smaller, and the numbers on the bottom left become bigger or smaller. I assume if this was hooked up with something it would make a an object say a building or a npc, bigger or smaller. Also here is an offset and ones nearby where you get developer information on screen, say a list of rendered objects, and frame rates and stuff, but since you can turn on a lot, it will overlaps each other so much (you could easily cover the whole screen, if you turned them all on) I doubt, all of the information was normally seen by players, for example this and other offsets near it:
0x016776A4
-
I tried the "Blank World Mapserver" thing.
It worked, but you couldn't do any emotes, mouselook, or pull up the powers list, for instance.
What you could do, however:
Read the entire help section for the game
Output game commands to the chat window with /cmdlist
Look at your costume change window
Look at an empty paragon rewards tier screen
Probably other stuff too.
-
I tried the "Blank World Mapserver" thing.
It worked, but you couldn't do any emotes, mouselook, or pull up the powers list, for instance.
What you could do, however:
Read the entire help section for the game
Output game commands to the chat window with /cmdlist
Look at your costume change window
Look at an empty paragon rewards tier screen
Probably other stuff too.
You also might be able to do more commands if you first type in this command first:
/textparserdebug
for example if you do not type that in, and try the command /createHero, it will say it is not a command. But once you type in /textparserdebug then it will not give you an error message when you type in /createHero.
Also once you type in /textparserdebug commands like /console 1 will now display the console window, though I am not able to type anything in the console.
And also by playing around with an offset, I was able to get a glowing thing on the upper right part of the screen thats says I have reached level one, and will keep saying that each time I click that.
-
Interesting.
I have noticed that there is an "execute script' command.
exec charcreate.txt
The above will default any animation that is running on the player model.
Saw it and wondered.
-
I wonder if there is a "Secret zone here" marker in Faultline while in this mode...
Nope:
(https://i.imgur.com/Q4uTi.jpg)
What you're seeing is the map editor. This is normally accessed by 1) being a dev, 2) using the console command "can_edit 1" followed by "edit 1". By editing that memory offset you're kicking the game into editor mode, but without the menus and such.
Before you get too excited, THIS DOES NOT WORK UNLESS YOU ARE CONNECTED TO AN ACTUAL SERVER. Much like everything else in COH, the client just displays things, but without being connected to a server, none of the commands work.
-
>24/12/2012 in the taskbar
So.... you somehow rigged that up to a server, yourself?
:o
AMAZING.
-
>24/12/2012 in the taskbar
So.... you somehow rigged that up to a server, yourself?
:o
AMAZING.
I think I just wet myself.
-
>24/12/2012 in the taskbar
So.... you somehow rigged that up to a server, yourself?
:o
AMAZING.
I think I just wet myself.
Read the stuff underneath the pic ;).
What you're seeing is the map editor. This is normally accessed by 1) being a dev, 2) using the console command "can_edit 1" followed by "edit 1". By editing that memory offset you're kicking the game into editor mode, but without the menus and such.
Before you get too excited, THIS DOES NOT WORK UNLESS YOU ARE CONNECTED TO AN ACTUAL SERVER. Much like everything else in COH, the client just displays things, but without being connected to a server, none of the commands work.
-
So.... you somehow rigged that up to a server, yourself?
No; I should have been more clear. You can display the map edit UI, but without being connected to a server, you can't actually edit the map. all the map edits I've been doing have been by messing with the map files manually. You've not seen most of them, but I hope my Remains video will be completed tonight. I finished the most ridiculously complicated shot last night (about 8 hours for an 8-second shot; you'll know it when you see it) so I'm pretty certain I can be done with it today.
Also, I'm going to ask that, if you find how to fool the client into giving you dev access level and console commands, please don't post it. We are going to have our own servers sooner or later, and we might reuse a lot of the dev interfaces in the game because, hey, they're there, no need to reinvent the wheel. While security though obscurity won't stop someone who's dedicated to finding this stuff, the point is to keep a "casual griefer" from deciding to wreck the server just because they had a fight with the supergroup.
-
If you're not seeing menus, you're probably turning on /seeeverything rather than the map editor. That shows all of the normally hidden geometry for things like spawn points and neighborhood volumes.
The editors turns that on automatically, but it can be toggled independently of that.
-
If you're not seeing menus, you're probably turning on /seeeverything rather than the map editor. That shows all of the normally hidden geometry for things like spawn points and neighborhood volumes.
The editors turns that on automatically, but it can be toggled independently of that.
Psst. Codewalker. Check your PMs.
-
No; I should have been more clear. You can display the map edit UI, but without being connected to a server, you can't actually edit the map. all the map edits I've been doing have been by messing with the map files manually. You've not seen most of them, but I hope my Remains video will be completed tonight. I finished the most ridiculously complicated shot last night (about 8 hours for an 8-second shot; you'll know it when you see it) so I'm pretty certain I can be done with it today.
Is there any chance there is just a secret offset needed to be changed, that will enable map editing, without any type of server? I do not know much about packet editing, but if we did need the server, would it just be a few kilobytes or less in packets, or are you talking about a packet for each and every tiny thing such as say one to enable selecting objects, another to enable you to make the buttons on the menu press down, a set of packets that tells the client what each button does, and then say a packet for each unit/pixel that the selector tool is moved on screen. Might anyone have a beta CD or very early version, that might possibly have things more client-sided. For example in a small budget online game called "Impressive Title", early versions had more things client sided, and was far easier to hack then more recent versions:
http://en.wikifur.com/wiki/Impressive_Title
-
No; I should have been more clear.
*snip*
Hmm.. so then we can view the map edit GUI but not actually use it.... in demorecords?
:P
-
No; I should have been more clear. You can display the map edit UI, but without being connected to a server, you can't actually edit the map. all the map edits I've been doing have been by messing with the map files manually. You've not seen most of them, but I hope my Remains video will be completed tonight. I finished the most ridiculously complicated shot last night (about 8 hours for an 8-second shot; you'll know it when you see it) so I'm pretty certain I can be done with it today.
Also, I'm going to ask that, if you find how to fool the client into giving you dev access level and console commands, please don't post it. We are going to have our own servers sooner or later, and we might reuse a lot of the dev interfaces in the game because, hey, they're there, no need to reinvent the wheel. While security though obscurity won't stop someone who's dedicated to finding this stuff, the point is to keep a "casual griefer" from deciding to wreck the server just because they had a fight with the supergroup.
Without getting too ahead of my self, will you also release some complied things that can be run local host so that you can play around locally with an editor, ie for example the Everquest 2 emulator:
http://eq2emulator.net/phpBB3/index.php
has complied server packs, for local use, even though the login server code is closed source.
Also the Earth Eternal Emulator:
http://planetforevergame.com:81/
is also closed source, but does (on a different website) have a older complied local host server.
I'm just terrified that say a city of heroes server, will be hosted but shut down before any complied/lite localhost servers will be released. I like to have my paws on something, and then put it on an eternal hard-drive, so that even if NCSoft shut down the server, I would still have something on my hard-drive.
-
You also might be able to do more commands if you first type in this command first:
/textparserdebug
Note that /textparserdebug will only do something useful if you used Icon to launch the game. Otherwise it does something completely different, which is to execute a fairly useless test of the .txt and .bin file parser.
Icon overwrites the function call address of that command in order to call an internal function to set up a blank player structure. I needed an easy way to call a normally inaccessible function and just picked that one at random as it was a compatible function signature.
Without doing that, /createHero will not only not work, it will crash the game because the global "player" entity is a NULL pointer.
I have noticed that there is an "execute script' command.
exec charcreate.txt
/exec, as well as /createHero normally require client access level 9 to use, but Icon changes the command processor in memory so that they only need access level 0. That seemed to be the quickest way to get something working.
If you're serious about client hacking, PM me and I'll send a dev_access.key file that grants access level 10. I know what Leandro said, but my thinking is that you guys are going to stumble across where the AL is stored in memory eventually anyway, so having a few people using an access key isn't a huge deal. Especially since the encryption key can be changed in a future client revision if necessary.
Sometimes I wonder if anyone inside PS realized the full extent of just how much of the client we have mapped out. Probably didn't want to know. :D
-
Note that /textparserdebug will only do something useful if you used Icon to launch the game. Otherwise it does something completely different, which is to execute a fairly useless test of the .txt and .bin file parser.
Icon overwrites the function call address of that command in order to call an internal function to set up a blank player structure. I needed an easy way to call a normally inaccessible function and just picked that one at random as it was a compatible function signature.
Without doing that, /createHero will not only not work, it will crash the game because the global "player" entity is a NULL pointer.
/exec, as well as /createHero normally require client access level 9 to use, but Icon changes the command processor in memory so that they only need access level 0. That seemed to be the quickest way to get something working.
If you're serious about client hacking, PM me and I'll send a dev_access.key file that grants access level 10. I know what Leandro said, but my thinking is that you guys are going to stumble across where the AL is stored in memory eventually anyway, so having a few people using an access key isn't a huge deal. Especially since the encryption key can be changed in a future client revision if necessary.
Sometimes I wonder if anyone inside PS realized the full extent of just how much of the client we have mapped out. Probably didn't want to know. :D
This was supposed to be a private message to Codewalker, and not a forum post, sorry, still getting used to this forum (only my 3rd day(
-
Changing client access level in COH is mostly harmless. Unlike a lot of games, the server doesn't trust the client's idea of world state at all, so things like position and run speed can't be overridden -- you'll just rubberband back to where you should be. Even if you turn no clipping on client side, the server does full collision so it won't work. Most of the 'exploits' that have been found and patched over the years are serverside bugs rather than client/server trust issues.
A lot of the clientside dev commands either just display extra debugging info, or send commands to the server, which of course depend on having an elevated server access level to use.
Probably the worst thing you can do with client side access is enable selectanyentity, which lets you target anything, including untargetable things and yourself. Even that couldn't be abused much because the powers system differentiates between 'self' and 'friend', so powers like Clear Mind still wouldn't be usable.
However, that said, I don't want to spread it around too much, because there's always the possibility of bugs that can only be exploited with elevated client-side access.
-
Sometimes I wonder if anyone inside PS realized the full extent of just how much of the client we have mapped out. Probably didn't want to know. :D
Out of sight, out of mind. ;D
-
Probably the worst thing you can do with client side access is enable selectanyentity, which lets you target anything, including untargetable things and yourself. Even that couldn't be abused much because the powers system differentiates between 'self' and 'friend', so powers like Clear Mind still wouldn't be usable.
Thought the target cmd within a zone is not a dev power O.o. Or do you mean within the complete gameworld? This one would be new to me :)
-
How did I miss this thread?
So, once you change the values, it sends you onto a map, but once you do you die instantly?
Watch the values of the health meter upon zoning, then just freeze the values before you die. If it still works, you should be able to freeze your health to keep you from dying so you can then move about the zone.
-
(random thought) this reminds me back when playing CoH, I be alive in a mission I'd DC, people would see me still alive and suddenly when I log back in Id be dead outside the door, possibly the servers thought I was cheating or is it in the code to do that sometimes?
-
Aerial overview of the Kallisti Wharf office tileset, wireframe mode.
(https://images.weserv.nl/?url=s8.postimage.org%2Fl0cd2vmut%2FKW_Office_Wireframe.png)
Because I thought it was interesting :P
-
Aerial overview of the Kallisti Wharf office tileset, wireframe mode.
Why the heck is there a wireframe mode? Makes no real sense to me. This would actually mean you could liveedit the whole worldmap and tiles.
Isn't that normaly done before compiling the client? Or did they made the client THAT powerful?
Theory: There isn't actually any amount of third party dev tools. Wich would mean client = devtool. So our game client was the actual dev tool and we weren't just supposed to know O.o.
Haven't had a real look into the client. The only thing had I once done was to crosscheck the champions online client with the coh client ;).
-
Why the heck is there a wireframe mode? Makes no real sense to me. This would actually mean you could liveedit the whole worldmap and tiles.
Isn't that normaly done before compiling the client? Or did they made the client THAT powerful?
How did you think all the models used in the game were stored as? That's what is in the geom*.pigg files or in this case the mapsmissions.pigg file (I think). Textures are always applied on the fly during the render.
-
How did you think all the models used in the game were stored as? That's what is in the geom*.pigg files or in this case the mapsmissions.pigg file (I think). Textures are always applied on the fly during the render.
Depends on the game/program. That was what I just wondered. Haven't really seen such thing in a MMO. They always just had an wireframe overlay, no actual real wireframe mode (in dev mode).
-
I think that's just a dump of the poly model brought up in another tool and not the game.
-
Well that would explain it to me ;).
-
Aerial overview of the Kallisti Wharf office tileset, wireframe mode.
That pic started the Mission Impossible theme in my head, and now it won't stop. You owe me a new brain.
-
It's not really a "wireframe mode" per se. The map editor just shows the group that you have selected in wireframe when you click on something.
That is part of the client, btw, not an external tool. Unfortunately you can't do any actual editing without the server piece of it.
-
Aerial overview of the Kallisti Wharf office tileset, wireframe mode.
(snip)
Because I thought it was interesting :P
Neat.
I sometimes wonder about sandbox mode & mission architect - a way to jump into there would be amazing.
-
Changing client access level in COH is mostly harmless. Unlike a lot of games, the server doesn't trust the client's idea of world state at all, so things like position and run speed can't be overridden -- you'll just rubberband back to where you should be. Even if you turn no clipping on client side, the server does full collision so it won't work. Most of the 'exploits' that have been found and patched over the years are serverside bugs rather than client/server trust issues.
A lot of the clientside dev commands either just display extra debugging info, or send commands to the server, which of course depend on having an elevated server access level to use.
Probably the worst thing you can do with client side access is enable selectanyentity, which lets you target anything, including untargetable things and yourself. Even that couldn't be abused much because the powers system differentiates between 'self' and 'friend', so powers like Clear Mind still wouldn't be usable.
However, that said, I don't want to spread it around too much, because there's always the possibility of bugs that can only be exploited with elevated client-side access.
Harmless my butt, my first visit to recluse's victory taught me that. had two enemy players approach me and just stand there for a minute so i started blasting them with my blaster, then... my character strated lag jumping and wouldn't attack. then one of them attacked.
so yeah it can be used as a PVP hack, but seeing as PVP wasn't a huge deal like it is in other games it's really more laughable than anything.
OK, I have the answer this thread needs, and no one go halfdonkeying this! we need something that works without bugs;
the goal of this project will be to force a player client to think it's the server client, that can probably be done easily in cheat engine, however if it doesn't have the ability to do the basic battle and record figuring due to a lack of serverside calculations, then;
I came accross a game moding forum recently when trying to do something I probably shouldn't to a game I wanted to play in a certain way (no not cheating)
ok, well, there are game parsers, things that can rip models and all thier libraries out of a game and repackage them back into the game after edits.
so the idea here is to monitor the game's calls for serverside calculations and write scripts that fill those gaps, then repackage them into the original file.
we can probably use codewalker's Icon to begin the hacking to make it work.
Once you have a computer that can reliably mimic the server client's necessary calculations then it is time to set-up an Ethernet address, connect another computer to it via ethernet cable, now edit a version of Icon on the 2nd computer to be a Client and tell it to attach to the ethernet address of the 1st computer.
from where it should be easier to work out any kinks.
once kinks have been worked out load more maps onto your 'server' you might need 1 Computer for each map (atlas park ETC. not mission maps, mission maps can be on thier own computer all at once)
once you have enough of the game on servers, now it's time to go back and set-up IP addresses instead of ethernet addresses, IP addresses will allow others to connect from any computer accessing the internet.
then we have a server!
note; the creation of Savefiles will be necessary for players to create accounts, We can utilize the sentinel extractor outputs and I can write a script to read and write to them from the server client. -so this part is last but easy for me to code.
if anyone is interested in going through with this, then post here, cause I wont be doing it allone lol. I may know a bit about computers and thier interactions and I might know a decent beginners amount of scripting but I don't know enough about cheat engine to do certain portions of this. if codeweaver is on board I'll go get links to the game modding programs.
If pushed I can code the server calculations. but that will be knew for me, though it will be helpful for me to learn at the same time.
-
This may be a stupid question, but I'm going to have to just ask it. (My laptop HDD died about a month ago, so I lost CoH on it. I still have all the files on my desktop, but I'm not near enough to just go look.)
Are there enough assets in the .pigg files to build a "new" game in a different engine? I'm talking about the maps, buildings, walls, NPCs, baddies, all of it. My understanding, from what has been said in other threads, is that all of that stuff is in the .pigg files, and the servers are just telling the client when to throw in what and where, and what it's supposed to do.
Even to my untrained brain, that sounds like a lot of work, but is it doable?
-
This may be a stupid question, but I'm going to have to just ask it. (My laptop HDD died about a month ago, so I lost CoH on it. I still have all the files on my desktop, but I'm not near enough to just go look.)
Are there enough assets in the .pigg files to build a "new" game in a different engine? I'm talking about the maps, buildings, walls, NPCs, baddies, all of it. My understanding, from what has been said in other threads, is that all of that stuff is in the .pigg files, and the servers are just telling the client when to throw in what and where, and what it's supposed to do.
Even to my untrained brain, that sounds like a lot of work, but is it doable?
alot of it is there, Codewalker explained this to me before, alot of it is there but a few small things are missing, such as certain mission texts, those were hosted on the server side.
Yes it's true, for the sake of saving bandwidth the city of heroes .pigg files contain all the graphics and such locally so they don;t ahve to be downloaded every time you begin the game.
Is it possible to make another game out of it?
why of coarse, even in a different engine it's possible, why I could take all the assets and put them together in a blender game and make it act however I want it to, but yeah it would be alot of work.
when you transfer the Graphical elements to another engine chances are you will have to redo all the animations again, and possibly the rigging. and if you are really unlucky you might have to do a UV face layout for the textures.
I did that with the midna model from twilight princess, that was a job and a half but I learned a thing or 2 about how nintendo rigs it's stuff lol.
-
alot of it is there, Codewalker explained this to me before, alot of it is there but a few small things are missing, such as certain mission texts, those were hosted on the server side.
Yes it's true, for the sake of saving bandwidth the city of heroes .pigg files contain all the graphics and such locally so they don;t ahve to be downloaded every time you begin the game.
Is it possible to make another game out of it?
why of coarse, even in a different engine it's possible, why I could take all the assets and put them together in a blender game and make it act however I want it to, but yeah it would be alot of work.
when you transfer the Graphical elements to another engine chances are you will have to redo all the animations again, and possibly the rigging. and if you are really unlucky you might have to do a UV face layout for the textures.
I did that with the midna model from twilight princess, that was a job and a half but I learned a thing or 2 about how nintendo rigs it's stuff lol.
Indeed, it is possible, in theory at least. The main questions would be "how hard is it to redo everything?" and "how long will it take to do?"
I've done a ton of digging through the .pigg files trying to find stuff, and some of it is buried in strange places, other things I can't even find, and I still can't for the life of me figure out what format the .geo files are/what software to view them with (I believe those are the mesh files, but unless I know how to open them, they're basically useless to me)... You could always load up a demo recording and snap a 3D screenshot of everything in the scene, and extract out only what you want from the .obj file (fixing and re-rigging as needed), but the Open GL file that allows this seems to conflict with the Icon file changes (or at least it did for me), so you'll need an unmodified install of the client to do that...
Side note, how did I miss this thread? Interesting stuff here.
-
Side note, how did I miss this thread? Interesting stuff here.
You missed it because before Joshex posted, this thread has been inactive since December 30th 2012.
With that said I am glad it was revived because I missed it initially and I hope it sparks more people looking to get COH up and running again >_>
-
and I still can't for the life of me figure out what format the .geo files are/what software to view them with (I believe those are the mesh files, but unless I know how to open them, they're basically useless to me)...
You won't find software to view them with; they're a custom format unique to the Cryptic/Paragon engine. They contain geometry, UV mapping, and bone information. The .anim files are custom as well.
So there's no off the shelf software to view them. We did some reverse engineering work on it about a year ago and Guy wrote a model viewer that works with some (but not all) of the GEOs:
(https://i727.photobucket.com/albums/ww272/ft5512/atlas/StickFigure_thumb.png) (http://i727.photobucket.com/albums/ww272/ft5512/atlas/StickFigure.png) (https://i727.photobucket.com/albums/ww272/ft5512/atlas/ClayMan_thumb.png) (http://i727.photobucket.com/albums/ww272/ft5512/atlas/ClayMan.png)
(https://i7.photobucket.com/albums/y255/bgng/Textured.png)
(https://i7.photobucket.com/albums/y255/bgng/PaperHouse.png)
(https://i727.photobucket.com/albums/ww272/ft5512/atlas/BedrockMan_thumb.png) (http://i727.photobucket.com/albums/ww272/ft5512/atlas/BedrockMan.png)
-
Are there enough assets in the .pigg files to build a "new" game in a different engine?
Yes - but the current owner of the models and the IP might react to that in an unfavorable way.
-
Yes - but the current owner of the models and the IP might react to that in an unfavorable way.
Yeah, there's the relevant stumbling block! ;)
I'm thinking small, but that still doesn't mean I expect to spend the weekend digging around in my computer and come back Monday with a link to a torrent of a standalone Frostfire mission. For one thing, Iron Man 3 comes out this weekend!
I was kind of afraid of the rigging part. I guess whether the textures are useful depends on if there's a good wire frame (those pesky .geo files?) to put them on? It still sounds daunting, but it at least sounds doable. Thanks.
-
You won't find software to view them with; they're a custom format unique to the Cryptic/Paragon engine. They contain geometry, UV mapping, and bone information. The .anim files are custom as well.
So there's no off the shelf software to view them. We did some reverse engineering work on it about a year ago and Guy wrote a model viewer that works with some (but not all) of the GEOs:
I imagined it was likely something like that.
I was mostly trying to look into it because I was curious if it was possible to add models and textures to the costume creator, not necessarily extract stuff. Despite digging through the .pigg files a metric crap-ton, I still haven't been able to figure it out yet...
-
You won't find software to view them with; they're a custom format unique to the Cryptic/Paragon engine. They contain geometry, UV mapping, and bone information. The .anim files are custom as well.
So there's no off the shelf software to view them. We did some reverse engineering work on it about a year ago and Guy wrote a model viewer that works with some (but not all) of the GEOs:
(https://i727.photobucket.com/albums/ww272/ft5512/atlas/StickFigure_thumb.png) (http://i727.photobucket.com/albums/ww272/ft5512/atlas/StickFigure.png) (https://i727.photobucket.com/albums/ww272/ft5512/atlas/ClayMan_thumb.png) (http://i727.photobucket.com/albums/ww272/ft5512/atlas/ClayMan.png)
(https://i7.photobucket.com/albums/y255/bgng/Textured.png)
(https://i7.photobucket.com/albums/y255/bgng/PaperHouse.png)
(https://i727.photobucket.com/albums/ww272/ft5512/atlas/BedrockMan_thumb.png) (http://i727.photobucket.com/albums/ww272/ft5512/atlas/BedrockMan.png)
Plan ZJ
in event that no company will pick-up city of heroes, in the event that Plan Z gets sued for IP infringement and gets taken down, in event that I sue NCSoft and fail, there is now a plan ZJ in my head but I need to figure out the golden coding of it. hmm... now that could work.. yes that will do nicely thankyou subconscious. as I said in a previous post he's the genius I'm just an idiot who's mouth and fingers like to keep running lol.
Speaking of them running Codewalker did you see my previous post? I was hoping for your input on wheather or not what I eluded to would be plausible? :
Harmless my butt, my first visit to recluse's victory taught me that. had two enemy players approach me and just stand there for a minute so i started blasting them with my blaster, then... my character strated lag jumping and wouldn't attack. then one of them attacked.
so yeah it can be used as a PVP hack, but seeing as PVP wasn't a huge deal like it is in other games it's really more laughable than anything.
OK, I have the answer this thread needs, and no one go halfdonkeying this! we need something that works without bugs;
the goal of this project will be to force a player client to think it's the server client, that can probably be done easily in cheat engine, however if it doesn't have the ability to do the basic battle and record figuring due to a lack of serverside calculations, then;
I came accross a game moding forum recently when trying to do something I probably shouldn't to a game I wanted to play in a certain way (no not cheating)
ok, well, there are game parsers, things that can rip models and all thier libraries out of a game and repackage them back into the game after edits.
so the idea here is to monitor the game's calls for serverside calculations and write scripts that fill those gaps, then repackage them into the original file.
we can probably use codewalker's Icon to begin the hacking to make it work.
Once you have a computer that can reliably mimic the server client's necessary calculations then it is time to set-up an Ethernet address, connect another computer to it via ethernet cable, now edit a version of Icon on the 2nd computer to be a Client and tell it to attach to the ethernet address of the 1st computer.
from where it should be easier to work out any kinks.
once kinks have been worked out load more maps onto your 'server' you might need 1 Computer for each map (atlas park ETC. not mission maps, mission maps can be on thier own computer all at once)
once you have enough of the game on servers, now it's time to go back and set-up IP addresses instead of ethernet addresses, IP addresses will allow others to connect from any computer accessing the internet.
then we have a server!
note; the creation of Savefiles will be necessary for players to create accounts, We can utilize the sentinel extractor outputs and I can write a script to read and write to them from the server client. -so this part is last but easy for me to code.
if anyone is interested in going through with this, then post here, cause I wont be doing it allone lol. I may know a bit about computers and thier interactions and I might know a decent beginners amount of scripting but I don't know enough about cheat engine to do certain portions of this. if codeweaver is on board I'll go get links to the game modding programs.
If pushed I can code the server calculations. but that will be knew for me, though it will be helpful for me to learn at the same time.
-
OK, now I see what you were saying about the .geo files. I don't know how to actually access them, yet, but I can view the .texture files inside the .pigg's. It looks like I have a lot to learn about 3D modelling.
-
Plan ZJ
At first, I read that as Plan JZ, and I was thinking "What's Beyonce's take on MMOs?"
-
At first, I read that as Plan JZ, and I was thinking "What's Beyonce's take on MMOs?"
Well any MMO Beyonce plays would have to be combat heavy, since she's a survivor and she's gonna make it.
It would be rated at least T for Teen, since she's a naughty girl with a bootylicious avatar.
There would be stealth elements, specifically disguises. For example she wouldn't be spotted by the enemy if she were a boy.
And it would have to be heavily gear oriented, since she really wants to put a ring on it.
Except, there must be a glitch in the aiming controls. All her shots keep pulling to the left, to the left.
-
Well any MMO Beyonce plays would have to be combat heavy, since she's a survivor and she's gonna make it.
It would be rated at least T for Teen, since she's a naughty girl with a bootylicious avatar.
There would be stealth elements, specifically disguises. For example she wouldn't be spotted by the enemy if she were a boy.
And it would have to be heavily gear oriented, since she really wants to put a ring on it.
Except, there must be a glitch in the aiming controls. All her shots keep pulling to the left, to the left.
This is probably the most amazing post evar!
-
the goal of this project will be to force a player client to think it's the server client, that can probably be done easily in cheat engine
then repackage them into the original file.
That's a negative, Ghost Rider. We're talking about a MMO - the server is a separate program. The server doesn't need the client's functionalities and vice versa - they're two distinct parts of the system. Trying to make the client to act like the server through memory editing is just not possible. Privileged (or "developer") mode does not equal running it as the server.
Also, no such thing as "player client" and "server client" - just "client" and "server", as in "Client-Server Model" (https://en.wikipedia.org/wiki/Client%E2%80%93server_model).
so the idea here is to monitor the game's calls for serverside calculations and write scripts that fill those gaps,
That is the general idea of what at least two projects are doing already. One of those projects has been doing packet capture for a while before the shutdown to get a solid base of known inputs - that allows (at least in theory) to treat the client mostly as a black box.
You'd be in the same boat as SEGS, though, with no test data that was known to be valid at some point (which isn't "nothing to work with" but pretty damn close). That would require dissecting and documenting the executable piece by piece. Not impossible, just... very, very tedious to do.
I may know a bit about computers and thier interactions and I might know a decent beginners amount of scripting but I don't know enough about cheat engine to do certain portions of this. if codeweaver is on board I'll go get links to the game modding programs.
Cheat Engine serves one purpose only - altering the memory assigned to a process. You should look into disassembly/debugging tools such as IDA or OllyDbg.
Won't get far if you are unfamiliar with assembly language, though (warning: learning ASM may result in permament SAN loss).
-
That's a negative, Ghost Rider. We're talking about a MMO - the server is a separate program. The server doesn't need the client's functionalities and vice versa - they're two distinct parts of the system. Trying to make the client to act like the server through memory editing is just not possible. Privileged (or "developer") mode does not equal running it as the server.
Also, no such thing as "player client" and "server client" - just "client" and "server", as in "Client-Server Model" (https://en.wikipedia.org/wiki/Client%E2%80%93server_model).That is the general idea of what at least two projects are doing already. One of those projects has been doing packet capture for a while before the shutdown to get a solid base of known inputs - that allows (at least in theory) to treat the client mostly as a black box.
You'd be in the same boat as SEGS, though, with no test data that was known to be valid at some point (which isn't "nothing to work with" but pretty damn close). That would require dissecting and documenting the executable piece by piece. Not impossible, just... very, very tedious to do.Cheat Engine serves one purpose only - altering the memory assigned to a process. You should look into disassembly/debugging tools such as IDA or OllyDbg.
Won't get far if you are unfamiliar with assembly language, though (warning: learning ASM may result in permament SAN loss).
I just had a wild idea, If i could get cityofheroes.exe to run without the ncsoft launcher I can do it, i can and will write a server client lol, it would be easy.
All I'd do is write a simple program for the game itself to work with as a server, start simple with identifying the call for a server and what is a valid response then include that into the 'fake server' program and move onto the next step. bassically I'll write a logger;
the game will be redirected to the logger when it looks for a server, when the game makes a call to the logger the call will be recorded in a .txt file.
then we aren't working blind.
but sadly I don't know how to run Cityofheroes without the NCSoft launcher., damn..
-
I just had a wild idea, If i could get cityofheroes.exe to run without the ncsoft launcher I can do it, i can and will write a server client lol, it would be easy.
All I'd do is write a simple program for the game itself to work with as a server, start simple with identifying the call for a server and what is a valid response then include that into the 'fake server' program and move onto the next step. bassically I'll write a logger;
the game will be redirected to the logger when it looks for a server, when the game makes a call to the logger the call will be recorded in a .txt file.
then we aren't working blind.
but sadly I don't know how to run Cityofheroes without the NCSoft launcher., damn..
If you read this thread from SEGS, it shows how to launch cityofheroes.exe w/o the NCSoft launcher:
http://segs.nemerle.eu/forumz/viewtopic.php?f=11&t=8 (http://segs.nemerle.eu/forumz/viewtopic.php?f=11&t=8)
-
Ookayyyy sooo, my computer crashed and I lost my clients etc related to city of heroes (also lost NC Launcher, but I'm not fussed about losing that). I've downloaded the beta client and the SEGS CoX client, but where can I find the i23 client?
Wish I hadn't lost it :gonk:
-
Keep up the good work dudes! :)
-
progress report, I've been talking with my programming buddies and they suggested I get a TCP IP sniffer, with a little bit of scripting I should be able to get it to pose as the server and log the information being sent in packets.
wheeeee, thats one hard part done, now I just need to set-it-up and do it, I will be scripting in python as thats what I'm familiar with.
what it will come down to is: a Test, only on this test I can fill in the answers with nearly anything I want and I wont get points taken off lol.
-
progress report, I've been talking with my programming buddies and they suggested I get a TCP IP sniffer, with a little bit of scripting I should be able to get it to pose as the server and log the information being sent in packets.
wheeeee, thats one hard part done, now I just need to set-it-up and do it, I will be scripting in python as thats what I'm familiar with.
what it will come down to is: a Test, only on this test I can fill in the answers with nearly anything I want and I wont get points taken off lol.
Sounds like you unintentionally left out a few details when you were talking to your programming buddies. With a sniffer you would want to listen to communication between a client and a server, but as we are all painfully aware there is no server anymore. With just the client and a sniffer the difficulty of the task sky rockets.
-
Sounds like you unintentionally left out a few details when you were talking to your programming buddies. With a sniffer you would want to listen to communication between a client and a server, but as we are all painfully aware there is no server anymore. With just the client and a sniffer the difficulty of the task sky rockets.
meh, I'm aware of that, bt it's still easier than trying to rebild the whole game in another GE
yes, if I had used a sniffer while the game was alive it would have given me everything i need, metaphorically I would have both the questions and the answers to the test, without the server I just have questions, most of the battle related answers can be ascertained from mids anyways as they will be calls for calculations of statistics and so on. of coarse there will be some questions like "what is the percent chance that when you pass a foe they will become aggroed?" and naturally I'll have to fill-in the blank(s) with some numbers/calculations and see if I can't get it close to the way it used to be.
it may not be perfect but it will be a quick way to get results, I will be using the output from the sniffer to create a new server file.
the first question on the test is already apparent "what is the IP number I will need my server file to mimic?"
-
Well any MMO Beyonce plays would have to be combat heavy, since she's a survivor and she's gonna make it.
It would be rated at least T for Teen, since she's a naughty girl with a bootylicious avatar.
There would be stealth elements, specifically disguises. For example she wouldn't be spotted by the enemy if she were a boy.
And it would have to be heavily gear oriented, since she really wants to put a ring on it.
Except, there must be a glitch in the aiming controls. All her shots keep pulling to the left, to the left.
Nice
-
meh, I'm aware of that, bt it's still easier than trying to rebild the whole game in another GE
yes, if I had used a sniffer while the game was alive it would have given me everything i need, metaphorically I would have both the questions and the answers to the test, without the server I just have questions, most of the battle related answers can be ascertained from mids anyways as they will be calls for calculations of statistics and so on. of coarse there will be some questions like "what is the percent chance that when you pass a foe they will become aggroed?" and naturally I'll have to fill-in the blank(s) with some numbers/calculations and see if I can't get it close to the way it used to be.
it may not be perfect but it will be a quick way to get results, I will be using the output from the sniffer to create a new server file.
the first question on the test is already apparent "what is the IP number I will need my server file to mimic?"
I believe there were people doing this in the weeks leading up to the shutdown. Sifting back through the September posts should produce names of people who might have data to share.
-
the first question on the test is already apparent "what is the IP number I will need my server file to mimic?"
The authorization server's IP can be supplied through a command line argument when starting the client: -auth X.X.X.X
-
the goal of this project will be to force a player client to think it's the server client, that can probably be done easily in cheat engine, however if it doesn't have the ability to do the basic battle and record figuring due to a lack of serverside calculations, then;
I have no idea what you're trying to say here. "server client" is a contradiction in terms. The stuff that is missing exists only serverside, so there's no way to fool a client in order to do it -- you have to re-implement those things from scratch.
Off the top of my head, most of the powers execution and combat exists only serverside and needs to be rewritten. A few small pieces are on the client in order to display real numbers, but not the part that actually applies those attributes to characters.
Physics and collision also happen on the server and need to be reproduced exactly to match up with the client's prediction code to avoid rubber banding. That of course also means it needs to be able to read and parse map and geometry files.
The client does share some of that with the server (even though the server's calculations 'win') for motion prediction and some limited animation prediction, so it could possibly be gleaned from there as a last resort. It would take some serious reverse engineering with tools like OllyDbg and/or code analysis tools. Poking around with static memory in cheat engine isn't going to make it magically act as a network server.
so the idea here is to monitor the game's calls for serverside calculations and write scripts that fill those gaps, then repackage them into the original file.
Serverside calculations happen well... serverside. So you won't be able to monitor them.
we can probably use codewalker's Icon to begin the hacking to make it work.
Icon is a simple hack and is tangential to a real network server. If done properly no modifications to the client are necessary.
once kinks have been worked out load more maps onto your 'server' you might need 1 Computer for each map (atlas park ETC. not mission maps, mission maps can be on thier own computer all at once)
Not even the official servers used a dedicated machine for each map; the best way to do it is with a watchdog process that dynamically balances and decides which server to start up a new map on (so you might have a dozen or so per server depending on load).
once you have enough of the game on servers, now it's time to go back and set-up IP addresses instead of ethernet addresses, IP addresses will allow others to connect from any computer accessing the internet.
Simply using IP from the start would be approximately 73% less work than implementing a new layer 3 protocol just to replace it with UDP later.
if anyone is interested in going through with this, then post here, cause I wont be doing it allone lol.
I hear that the SEGS crew is working on reproducing a network server and has made some very good progress. Rumor has it there's also a second group that's being unnecessarily secretive about their work, but gathered a large number of packet captures before the game shut down. That's completely unsubstantiated though.
-
yes, if I had used a sniffer while the game was alive it would have given me everything i need, metaphorically I would have both the questions and the answers to the test, without the server I just have questions, most of the battle related answers can be ascertained from mids anyways as they will be calls for calculations of statistics and so on. of coarse there will be some questions like "what is the percent chance that when you pass a foe they will become aggroed?" and naturally I'll have to fill-in the blank(s) with some numbers/calculations and see if I can't get it close to the way it used to be.
If you had used a packet sniffer while it was running, you would have gotten a file filled with unreadable semi-random garbage.
The game protocol is encrypted, and the encryption key is unique to each mapserver connection. The key is agreed on by means of a Diffie-Hellman Key Exchange (http://en.wikipedia.org/wiki/Diffie-Hellman_key_exchange) and never sent in the clear.
In order to decrypt the COH protocol and begin analyzing it, you need one of the following pieces of information in addition to the packet capture:
- The DH private key generated by the client.
- The DH private key generated by the server.
- The blowfish key that was mutually agreed upon and is used to encrypt the traffic.
(1) exists in client memory only briefly (less than a few microseconds) and is wiped and discarded once the DH exchange is over. (2) is the same, but exists only on the server and is impossible to get without having access to the server. (3) exists in client memory during the same small window as (1) and is discarded once the blowfish S-boxes are populated.
If you have detailed knowledge of how the client works, the approach that I would use is to use debugging tools to set breakpoints in the client and capture (1) and (3) during the connection setup phase, then save them in a file to go alongside the packet capture so that it can be decrypted later.
An alternative approach is to man-in-the-middle the connection so that you can be in control of (2) and (3), at least for half the connection. The MITM program would need to establish a separate connection to the real server and relay the traffic, but would have access to the unencrypted data as it passed through. The COH protocol does no endpoint verification so this is trivial *IF* you already know how the outer UDP protocol works.
Both of these of course require a server to connect to.
-
If you had used a packet sniffer while it was running, you would have gotten a file filled with unreadable semi-random garbage.... <<snip, for lots of techy stuff>>
Codewalker showing me once again that, as far as programming is concerned, I'm still at the level of "Fire, Bad! ugh!"
-
Codewalker showing me once again that, as far as programming is concerned, I'm the rest of us are still at the level of "Fire, Bad! ugh!"
Fixed. :)
-
I just wish someone would show us some regular progress in making COH playable again =\
I mean I understand the need some feel to keep quiet but I miss the game so badly. I wish I had the financial resources to just pour into some team or another so they could devote all their time to get it functional again.
-
I just wish someone would show us some regular progress in making COH playable again =\
I mean I understand the need some feel to keep quiet but I miss the game so badly. I wish I had the financial resources to just pour into some team or another so they could devote all their time to get it functional again.
Well, back to the original topic, the game does have a debug mode that basically "decouples" the client from the server as far as position updates go, turns off sending input events to the server, and disables the checks that keep you from going too far on motion prediction alone, effectively running all the physics client side. Back on the live servers I used this to run around Khallisti Wharf by teleport glitching to daveland, copying the KW map and naming it data/geobin/maps/_daveland/daveland.bin, bypassing the game's checks that normally prevent it from loading stuff out of geobin that isn't in a pigg, then using a hacked client accesslevel (a static compiled-in blowfish key? Seriously guys, it's like you're not even trying...) to disable the sync. From the point of view of anyone else, my character would just be hovering stationary in a void while I was seeing the sights of KW.
So, theoretically, a "sandbox mode" is possible, though slightly trickier without an actual mapserver. It hasn't really been pursued because, like Icon, it isn't directly helpful in getting usable servers again, since it works by explicitly disabling client/server comms. So it would be a distraction from that goal rather than a help. That and I didn't think there would be much demand for just running around an empty map, especially with the F2 demo camera.
But if you guys are really just frothing at the mouth, I could probably get you running around Atlas Park with a few hours of solid code time... I mean really barebones -- no powers, no NPCs, no working doors, etc. Maybe a couple days instead to do something more flexibile to load different maps rather than hardcoding it.
-
Well, back to the original topic, the game does have a debug mode that basically "decouples" the client from the server as far as position updates go, turns off sending input events to the server, and disables the checks that keep you from going too far on motion prediction alone, effectively running all the physics client side. Back on the live servers I used this to run around Khallisti Wharf by teleport glitching to daveland, copying the KW map and naming it data/geobin/maps/_daveland/daveland.bin, bypassing the game's checks that normally prevent it from loading stuff out of geobin that isn't in a pigg, then using a hacked client accesslevel (a static compiled-in blowfish key? Seriously guys, it's like you're not even trying...) to disable the sync. From the point of view of anyone else, my character would just be hovering stationary in a void while I was seeing the sights of KW.
So, theoretically, a "sandbox mode" is possible, though slightly trickier without an actual mapserver. It hasn't really been pursued because, like Icon, it isn't directly helpful in getting usable servers again, since it works by explicitly disabling client/server comms. So it would be a distraction from that goal rather than a help. That and I didn't think there would be much demand for just running around an empty map, especially with the F2 demo camera.
But if you guys are really just frothing at the mouth, I could probably get you running around Atlas Park with a few hours of solid code time... I mean really barebones -- no powers, no NPCs, no working doors, etc. Maybe a couple days instead to do something more flexibile to load different maps rather than hardcoding it.
Even letting us run around the city zones without mobs or doors would be welcome... I could at the very least take some screenshots.
-
I believe CW said a lot of this a few months ago. That was why I was thinking more along the lines of just rebuilding "from scratch" in a different engine, using the graphical assets from the .pigg files. In no way do I think it would be less work, and I'm not even sure I could start it on my own, but it at least sounds more straight forward. Some things would have to be figured out, and that would likely entail something akin to reverse-engineering, but, big picture, it sounds like less of a headache.
But, I'm also not pretending to know a tenth of what CW knows about this, so a lot of my work would be figuring out juat what the hell I was doing. :)
-
Well, back to the original topic, the game does have a debug mode that basically "decouples" the client from the server as far as position updates go, turns off sending input events to the server, and disables the checks that keep you from going too far on motion prediction alone, effectively running all the physics client side. Back on the live servers I used this to run around Khallisti Wharf by teleport glitching to daveland, copying the KW map and naming it data/geobin/maps/_daveland/daveland.bin, bypassing the game's checks that normally prevent it from loading stuff out of geobin that isn't in a pigg, then using a hacked client accesslevel (a static compiled-in blowfish key? Seriously guys, it's like you're not even trying...) to disable the sync. From the point of view of anyone else, my character would just be hovering stationary in a void while I was seeing the sights of KW.
So, theoretically, a "sandbox mode" is possible, though slightly trickier without an actual mapserver. It hasn't really been pursued because, like Icon, it isn't directly helpful in getting usable servers again, since it works by explicitly disabling client/server comms. So it would be a distraction from that goal rather than a help. That and I didn't think there would be much demand for just running around an empty map, especially with the F2 demo camera.
But if you guys are really just frothing at the mouth, I could probably get you running around Atlas Park with a few hours of solid code time... I mean really barebones -- no powers, no NPCs, no working doors, etc. Maybe a couple days instead to do something more flexibile to load different maps rather than hardcoding it.
Please do. Because SEGS is so old the costume creator in it is "Jurassic".
-
Running around in a zone again ?? Really ?? SQUEEEEEEEEEEEEEEEEEEEEE !!! (Wipes drool....)
-
Put me in the "Yes, I want to run around the zones!" column. ;D
-
As with any reverse engineering effort, I'll support any and all of it, I just don't want the work to stop until we've got 100% of our game back. So yeah, running around zones would be amazing, but I'm going to be selfish and say I want it all :)
I hope you're right about that rumored i24 project Codewalker, I hope those last few months before the shutdown was time enough for a programmer to get all they needed from the servers.
-
I vaguely recall that one of the early early patches to the game (like maybe between launch and Issue 1?) accidentally included the source code to the client? Another patch was quickly sent out to delete it, but that doesn't mean someone somewhere didn't copy it.
I wish I could verify that story.
-
I vaguely recall that one of the early early patches to the game (like maybe between launch and Issue 1?) accidentally included the source code to the client? Another patch was quickly sent out to delete it, but that doesn't mean someone somewhere didn't copy it.
I wish I could verify that story.
Thats funny because wouldn't the large number of new file types in the extracted patch include lots of extra .C .OBJ .DLL files that would tipoff the person releasing the patch? But then again I have seen Nintendo WII DLLs included on retail PS2 discs. See this post I made on the Xentax Forum:
http://forum.xentax.com/viewtopic.php?f=16&t=10167
-
Thats funny because wouldn't the large number of new file types in the extracted patch include lots of extra .C .OBJ .DLL files that would tipoff the person releasing the patch? But then again I have seen Nintendo WII DLLs included on retail PS2 discs. See this post I made on the Xentax Forum:
http://forum.xentax.com/viewtopic.php?f=16&t=10167
OMG now that's one heck of a blunder, LOL.
I guess everyone should dig out their old old CoH install discs on the off chance that the client source might have been put there by mistake?
EDIT: Or maybe it was the server source that got accidentally included? Curse my failing memory.
-
I can't help thinking that one of the former workers for the now-closed Paragon Studios might 'annonymously' slip a source code.
It's not like NCsoft treated them particularly well with the closing, amiright?
-
Source code for the Issue 1 client would be a huge bonus! Of course, I downloaded the source code for Arena (the first Morrowind) a couple of years ago, and now I don't know what to do with it. I thought it would be informative to see how some of the pieces interact, but I can't even manage to open the pieces. :)
-
The authorization server's IP can be supplied through a command line argument when starting the client: -auth X.X.X.X
wonderful to know! I will definitely use that.
-
If you had used a packet sniffer while it was running, you would have gotten a file filled with unreadable semi-random garbage.
The game protocol is encrypted, and the encryption key is unique to each mapserver connection. The key is agreed on by means of a Diffie-Hellman Key Exchange (http://en.wikipedia.org/wiki/Diffie-Hellman_key_exchange) and never sent in the clear.
In order to decrypt the COH protocol and begin analyzing it, you need one of the following pieces of information in addition to the packet capture:
- The DH private key generated by the client.
- The DH private key generated by the server.
- The blowfish key that was mutually agreed upon and is used to encrypt the traffic.
(1) exists in client memory only briefly (less than a few microseconds) and is wiped and discarded once the DH exchange is over. (2) is the same, but exists only on the server and is impossible to get without having access to the server. (3) exists in client memory during the same small window as (1) and is discarded once the blowfish S-boxes are populated.
If you have detailed knowledge of how the client works, the approach that I would use is to use debugging tools to set breakpoints in the client and capture (1) and (3) during the connection setup phase, then save them in a file to go alongside the packet capture so that it can be decrypted later.
An alternative approach is to man-in-the-middle the connection so that you can be in control of (2) and (3), at least for half the connection. The MITM program would need to establish a separate connection to the real server and relay the traffic, but would have access to the unencrypted data as it passed through. The COH protocol does no endpoint verification so this is trivial *IF* you already know how the outer UDP protocol works.
Both of these of course require a server to connect to.
interesting, seems like it will take quite a bit of work for me to crack it, though now I have an Idea, i'll have to study the way this particular encryption is scripted, aka if I can write my fake server to propose it's own code which makes everything stay normal "A=A a=a B=B ETC." then it would technicaly decrypt itself, from where a packet sniffer will work wonders.
once you have enough of the game on servers, now it's time to go back and set-up IP addresses instead of ethernet addresses, IP addresses will allow others to connect from any computer accessing the internet.
Simply using IP from the start would be approximately 73% less work than implementing a new layer 3 protocol just to replace it with UDP later.
Quote
if anyone is interested in going through with this, then post here, cause I wont be doing it allone lol.
I hear that the SEGS crew is working on reproducing a network server and has made some very good progress. Rumor has it there's also a second group that's being unnecessarily secretive about their work, but gathered a large number of packet captures before the game shut down. That's completely unsubstantiated though.
hmmm ok, seems I'll contact Segs and see what kinda a start they've got, I wish I knew who the other secretive members were though so I could contact them lol.
Anyways myabe I can help out somewhere in that category.
sorry if this meesage is in a jumble, I am at the moment nfit to do anything, I have my head wrapped on the wrong side of my head lol aka very dizzzy.
-
I can't help thinking that one of the former workers for the now-closed Paragon Studios might 'annonymously' slip a source code.
It's not like NCsoft treated them particularly well with the closing, amiright?
It would still likely be a violation of their terms of employment. However, even given that, I would not be surprised if a full set of client and server sources existed offsite from the Paragon Studios offices, and survived the shutdown of the company. Whether -- or how soon -- they would surface, and in what manner, is pure speculation, though.
-
It would still likely be a violation of their terms of employment. However, even given that, I would not be surprised if a full set of client and server sources existed offsite from the Paragon Studios offices, and survived the shutdown of the company. Whether -- or how soon -- they would surface, and in what manner, is pure speculation, though.
maybe we should take the devs out to dinner again, lol *wink wink*
-
Success! (kinda)
It ended up being slightly more complicated than I thought. Loading the map was easy enough, as was pulling in a character.
And why not start with a random costume, just for fun:
(https://i727.photobucket.com/albums/ww272/ft5512/sandbox/th_sbox1_zpsd9ae54d8.jpg) (http://s727.photobucket.com/user/ft5512/media/sandbox/sbox1_zpsd9ae54d8.jpg.html)
You can't see it there because I forgot to turn on screenshotui for that one, but it has the same situation as the opening post: LOST CONNECTION TO MAPSERVER as well as "You have been defeated".
So, first order of business, I changed the hitpoints to 5 to get rid of the hospital box. Out of a max HP of 0, but whatever. Then I modified some of the functions that check for server connectivity and short-circuited them to lie about being connected, which got rid of the annoying lost connection to mapserver text.
Only one problem: Still can't move, even with server sync disabled. Oh, there's no key bindings at all. Set those up, but still unable to move. Making progress, though -- the character ACTS like they're trying to move. Animations play, but they can't get off that spot.
So that's where the majority of tonight's digging was. First avenue was movement speed -- it was 0 like all other attributes. So I changed that, but still couldn't move. Until I tried to jump. I went up. And up. And up. And couldn't stop. Finally hit the zone ceiling after a long, slow rise in zero gravity.
Huh. Weird. I didn't think to grab a screenshot as I was more concerned with figuring out what went wrong. Did some more digging and discovered that properties like friction, gravity, etc. are also sent by the server. But the client keeps them on-hand in order to do motion prediction. With no server, they all defaulted to 0.
Okay, so, using 1.0 for all those for now. May not be completely correct, but RUNNING WORKS!
(https://i727.photobucket.com/albums/ww272/ft5512/sandbox/th_sbox2_zps9afb459b.jpg) (http://s727.photobucket.com/user/ft5512/media/sandbox/sbox2_zps9afb459b.jpg.html) (https://i727.photobucket.com/albums/ww272/ft5512/sandbox/th_sbox3_zpsf7684f9b.jpg) (http://s727.photobucket.com/user/ft5512/media/sandbox/sbox3_zpsf7684f9b.jpg.html)
As expected, some things are missing:
(https://i727.photobucket.com/albums/ww272/ft5512/sandbox/th_sbox4_zpsa43ec0fe.jpg) (http://s727.photobucket.com/user/ft5512/media/sandbox/sbox4_zpsa43ec0fe.jpg.html)
Trying to click on one of those locks the character in place waiting for a server response that never comes.
Poking around with the control state in memory allows access to some of the various movement modes that are simulated by the client -- ninja run, walk (though the speed wasn't slowed so it looked really strange), staggering around stunned, and the one that most people I'm sure want to know about: Flight!
(https://i727.photobucket.com/albums/ww272/ft5512/sandbox/th_sbox5_zpsc7736fce.jpg) (http://s727.photobucket.com/user/ft5512/media/sandbox/sbox5_zpsc7736fce.jpg.html)
Well, sort of flight. The animations play, but I was unable to actually get OFF the ground. So there's another piece that's missing there. Vertical camera rotation wasn't working either, which was kind of weird. The key bindings for it worked, but mouselook could only swing horizontally.
Now, half of this was done manually with a debugger, so it'll still be a bit of time before I can toss something together that you guys can run, but it definitely looks workable. Not sure if it'll have the desired effect though -- it feels really empty and lonely.
-
Could one hack demo mode to accept a steady stream of external data, in effect turning the client into a graphical front end?
-
That was something already mentioned before: The entire demo is loaded at start time.
-
That was something already mentioned before: The entire demo is loaded at start time.
(Note to derail CodeWalker's excellent discovery.)
Well while the demo data is loaded at start time some of it is stored in non volatile plain text Exactly the same as the Demo file itself. For example I could use Cheat Engine to change the ASCII of wolf into lion, and after the demo finishes the current cycle the wolf tail would change into a lion tail.
However most of the demo data is loaded into Binary in volatile locations
-
Could one hack demo mode to accept a steady stream of external data, in effect turning the client into a graphical front end?
It would probably be more trouble than it's worth. The demo file gets read into a binary structure at startup. While that structure could conceivably be changed once it's loaded, you'd have to deal with syncing up an ever increasing time code with the delay values for each event, and rolling that back around at the end of the demo file.
On top of that, demoplay mode uses a simplified game loop that skips a lot of stuff. No UI, no real input processing, and no taking advantage of motion prediction to run player physics. Also you'd need to feed in MOVs directly to do animations, since the sequencers aren't used in in demo playback. The client is more than capable of running the sequencers itself, as evidenced by the power customization menu, as well as the above experiment of running around in Atlas.
So it's possible, but wouldn't be as effective as just injecting the events into the standard game loop. And at that point, for anything more complex than a simple hack, instead of mucking around in memory it would probably be better to pass the events over something like say, a network socket.
-
Codewalker - can you point us to any tools we could use to learn these techniques? I am not stupid - just that I have experience in a completely different field.
-
Codewalker - can you point us to any tools we could use to learn these techniques? I am not stupid - just that I have experience in a completely different field.
Well, my preferred tool for 32-bit programs is OllyDbg (http://www.ollydbg.de/version2.html). It's an analyzing debugger with a clean interface, support for all the usual debugging tools (hardware breakpoints, et al), the ability to save custom labels for addresses, and a very good analyzer that identifies common constructs like switch() statements and adds some comments, as well as showing things like jump targets and loops.
Since this is all at a machine code level, you need a solid understanding of x86 machine code. I like the reference here (http://courses.engr.illinois.edu/ece390/books/labmanual/inst-ref.html), because it includes the encodings for the various instructions in an easy to read format. If you've worked with assembly language before it should make a lot of sense, if not I'd recommend googling some tutorials on it.
If you have a C compiler available, a very good way to get in the right mindset for reverse engineering is to write some programs doing various things, then compile them to assembly (use "gcc -S" to output assembly instead of object code), and read through and see what the compiler decided to generate. Understanding how and why compilers work, especially the optimizations they do, is key to successful reverse engineering. Maybe even open up your test program in a debugger like Olly and step through one instruction at a time. In a reverse engineering project you'll be doing a lot of single stepping.
I'd definitely recommend starting with something simpler than the COH client before jumping into that. It's a complex beast and some of us have been at it for years to get to the point where we are.
-
Success! (kinda)
It ended up being slightly more complicated than I thought. Loading the map was easy enough, as was pulling in a character.
And why not start with a random costume, just for fun:
(https://i727.photobucket.com/albums/ww272/ft5512/sandbox/th_sbox1_zpsd9ae54d8.jpg) (http://s727.photobucket.com/user/ft5512/media/sandbox/sbox1_zpsd9ae54d8.jpg.html)
You can't see it there because I forgot to turn on screenshotui for that one, but it has the same situation as the opening post: LOST CONNECTION TO MAPSERVER as well as "You have been defeated".
So, first order of business, I changed the hitpoints to 5 to get rid of the hospital box. Out of a max HP of 0, but whatever. Then I modified some of the functions that check for server connectivity and short-circuited them to lie about being connected, which got rid of the annoying lost connection to mapserver text.
Only one problem: Still can't move, even with server sync disabled. Oh, there's no key bindings at all. Set those up, but still unable to move. Making progress, though -- the character ACTS like they're trying to move. Animations play, but they can't get off that spot.
So that's where the majority of tonight's digging was. First avenue was movement speed -- it was 0 like all other attributes. So I changed that, but still couldn't move. Until I tried to jump. I went up. And up. And up. And couldn't stop. Finally hit the zone ceiling after a long, slow rise in zero gravity.
Huh. Weird. I didn't think to grab a screenshot as I was more concerned with figuring out what went wrong. Did some more digging and discovered that properties like friction, gravity, etc. are also sent by the server. But the client keeps them on-hand in order to do motion prediction. With no server, they all defaulted to 0.
Okay, so, using 1.0 for all those for now. May not be completely correct, but RUNNING WORKS!
(https://i727.photobucket.com/albums/ww272/ft5512/sandbox/th_sbox2_zps9afb459b.jpg) (http://s727.photobucket.com/user/ft5512/media/sandbox/sbox2_zps9afb459b.jpg.html) (https://i727.photobucket.com/albums/ww272/ft5512/sandbox/th_sbox3_zpsf7684f9b.jpg) (http://s727.photobucket.com/user/ft5512/media/sandbox/sbox3_zpsf7684f9b.jpg.html)
As expected, some things are missing:
(https://i727.photobucket.com/albums/ww272/ft5512/sandbox/th_sbox4_zpsa43ec0fe.jpg) (http://s727.photobucket.com/user/ft5512/media/sandbox/sbox4_zpsa43ec0fe.jpg.html)
Trying to click on one of those locks the character in place waiting for a server response that never comes.
Poking around with the control state in memory allows access to some of the various movement modes that are simulated by the client -- ninja run, walk (though the speed wasn't slowed so it looked really strange), staggering around stunned, and the one that most people I'm sure want to know about: Flight!
(https://i727.photobucket.com/albums/ww272/ft5512/sandbox/th_sbox5_zpsc7736fce.jpg) (http://s727.photobucket.com/user/ft5512/media/sandbox/sbox5_zpsc7736fce.jpg.html)
Well, sort of flight. The animations play, but I was unable to actually get OFF the ground. So there's another piece that's missing there. Vertical camera rotation wasn't working either, which was kind of weird. The key bindings for it worked, but mouselook could only swing horizontally.
Now, half of this was done manually with a debugger, so it'll still be a bit of time before I can toss something together that you guys can run, but it definitely looks workable. Not sure if it'll have the desired effect though -- it feels really empty and lonely.
very nice, however I can tell you whats wrong with the flight,
Ehem, inorder for flight to work in a GE with a constant gravity calculation; there needs to be an invisible cube (usually at the characters feet) Set to 'static' motion meaning it's not effected by gravity or collisions, it is the parent of the main ground based controll cube (also invisible) when flight is toggled on the Flight Cube is then Toggled on via a bool opperation where as the normal movement cube is toggled off via a bool operation.
the integers are True and Flase.
at least thats how I'd do flight in blender.
Also, movement should be a calculation, not a specific number, especially for walk, other things like ninja run and such add +# to the Local speed so they will still work to some extent. infact if I remember correctly ninja run negates your original run values and jump values and replaces them.
The Doors, I never liked that band.. ok on a note of your problem; you will need to set the value to a textual value verses a number value, if the value includes the location of the map that needs to be loaded the game should be able to load said map, however there is still the problem of the server response, I'm talkign to a guy right now who has actually developed a cross platform server application (sadly it can only handle 20 clients) but the performance is through the roof. anyways that will be released on the 23rd of may, yep only a few days away.
It is written in python, but according to his knowledge it can definitely communicate with outside programs no matter what they are written in. especially seeing as C++ comes natively with python pickle handles and python object code processing.
so that might be extremely handy in writing ones own server file.
-
The issue with doors is that they're not actually part of the map. Technically, they're entities spawned by the server, just like Ms. Liberty and your average Hellion. You can see this in demorecords, with all the "Dr" NPCs.
-
The issue with doors is that they're not actually part of the map. Technically, they're entities spawned by the server, just like Ms. Liberty and your average Hellion. You can see this in demorecords, with all the "Dr" NPCs.
I see, a tougher problem. I really think we could make a server program the broadcasts these messages, we just need to know what to broadcast, a door will be broad cast with 2 pieces of information, Which Number of a door it is and where it leads (what map to load If mouseover and left click = True)
so say the door is G1, the server file needs to send Icon.exe a constant message
"G1=C:\Program Files\NCSoft\City of heroes\door.geom (I pulled the name out of my ass sorry if it's incorrect)
Main()
If mouseover + leftclick = True
run C:\Program Files\NCSoft\City of heroes\dooranimfile.anim (again pulling the file name out of my ass as a place keeper)
loadfile C:\Program Files\NCsoft\City of heroes\Cityhall.map (again pulling the file name out of my ass as a place keeper)
Else
goto line 1"
you get me some door numbers and I'll sort out which files do what and script it all together in blender and set it to communicate with Icon.exe
then it will be as simple as starting a blender game before opening Icon.
-
I had a dream last night that I'd figured out how to get this all working. It was bittersweet. Sweet, in that I was playing the game (it's shocking how perfectly my mind recalls gameplay and the storylines), bitter in that I woke up...
-
But if you guys are really just frothing at the mouth, I could probably get you running around Atlas Park with a few hours of solid code time... I mean really barebones -- no powers, no NPCs, no working doors, etc. Maybe a couple days instead to do something more flexibile to load different maps rather than hardcoding it.
My goodness yes. And being able to mess around in the city with my daughter would brighten my year.
-
I think in the short term, most people would be happy with just being able to run around in Atlas with their friends and being able to chat with folks. Powers, NPCs, Missions, inventions, stores/influence, and mapserver loading of other zones can all come later.
But that's just my opinion on the matter...
-
I for one would be thrilled to simply run around Atlas again. With my very limited understanding of coding, this progress is indistinguishable from magic. Please keep up the good work.
-
I think in the short term, most people would be happy with just being able to run around in Atlas with their friends and being able to chat with folks. Powers, NPCs, Missions, inventions, stores/influence, and mapserver loading of other zones can all come later.
But that's just my opinion on the matter...
I think that would do for now, yeah. Plus to the average player it would feel like a major step forward, which wouldn't exactly hurt people's optimism.
-
Keep up the good work!
-
so, codewalker can you get into the map editor via Icon?
if so I can (as I offered) write you a script that broadcasts the information you need unencrypted. I think this would bypass the encryption of the actual client, rather than speaking in encrypted dev words, give it a string of code that associates a certain Editing Name-tag with a set of objects, animations and actions.
in this manner we can probably regraft alot of the functionality and NPCs.
Physics; it would be nice to have say an open source physics engine to do the CoH calculations for us, Oh just so happens blender has Bullet Physics Engine and Cycles Engine in 2.65, both are available in the SVC depositories.
they should be able to read the requests of the client.
btw I was wrong on the flight earlier, there has to be a switch in parenting between the satic movement object and the dynamic movement object when flight is activated. also a track to constriant should be given to the static object so when the dynamic object hits a wall the static object also stops.
Please forgive my typos my keyboard has so many stuck keys it's not funny..
-
People following this might want to check out the Icon thead (http://www.cohtitan.com/forum/index.php/topic,7288.0.html). The latest version posted last night allows for something similar.
I have one more thing I want to look into doing, but this whole thing is a bit of an "in my spare time" side project. While poking around in client memory and rewriting some of its code to do things that were never intended is fun and challenging, it's a bit of a developmental dead end in the long run IMO.
I say that because the client makes a lot of assumptions about having a server available, and while some limited things are doable despite that, many would require massive changes to make work. In the end it would be a very steep curve and not worthwhile compared to other options.
-
People following this might want to check out the Icon thead (http://www.cohtitan.com/forum/index.php/topic,7288.0.html). The latest version posted last night allows for something similar.
I have one more thing I want to look into doing, but this whole thing is a bit of an "in my spare time" side project. While poking around in client memory and rewriting some of its code to do things that were never intended is fun and challenging, it's a bit of a developmental dead end in the long run IMO.
I say that because the client makes a lot of assumptions about having a server available, and while some limited things are doable despite that, many would require massive changes to make work. In the end it would be a very steep curve and not worthwhile compared to other options.
Make a server Codewalker! You can do it! Wrangle Arcanaville to help! She's super smart like you!
-
So who else thought "I'd totally throw money at someone who could make this a stand alone game."
It's not tears dammit, it's the wind in my eyes from FLYING...
-
Tears.
Simply tears.
I got it to work once. now what is it trying to tell me when it says 'server is busy, try again." is it getting confused?
edit: never mind. i think i figured out where i went wrong.
-
THIS really made my day, huge thank YOU for all your efforts trying to rez our beloved game!
-
Ahhh, the feel of the sidewalk under my feet and the clouds through my hair. Bravo CW.
-
;D This is cool! I am happy to be running around some of the city again! Thank you Codewalker! I can't wait to see what other tricks you guys have up your sleeves. Kudos!
-
Awesome can make little shorts again for the kiddios. Thanks for the animations CW.