Maurice said:

---

OxFEA said:

---

If we say about HotA then bug with Elementalists was fixed (also for Navigator's purposes, yes). At the game start hook with additional check will be placed at mem:004DAFE4.

---

That's good to know! I haven't yet explored the HotA hook, though, so thanks for that pointer . Even though I am currently exploring the H3HotA.exe, I am still rummaging through the H3 SoD section, so whatever HotA then changes to that is something I haven't explored yet.

And by the way, if I haven't said so already, thanks for providing the download of the Hex Rays decompiled Heroes 3 exe. It's been a tremendous help for me to understand just how the game works. The translated variables and data structures within that decompilation enhance that even further. I did see some sections weren't properly decompiled, unfortunately. Next to that, I am running IDA Pro 5.0, the freeware version, which had very little problems disassembling the H3HotA.exe file, but it fails to properly recognize jump tables, messing up the function buildup . Still, I think I got it mostly cleaned up by manually telling IDA to build the missing functions. Comparing the disassembled code with the decompiled code has allowed me to trace stuff pretty nice .

That being said, a bit more info:

0x00047CE1h: 06h, the Spell Power with which Master Genies cast their Spells.
0x00047CE3h: 02h, the School Skill Level with which they cast it (02 is Advanced Level).
The game checks the target for the Master Genie's spell, then loops through all Combat Spells and picks one spell at random (all at a weight of 1) out of the spells available to be cast on that target.

0x00047F66h: 03h, the Spell Power with which Enchanters cast their Spells.
0x00047F68h: 03h, the School Skill Level with which they cast it (03 is Expert Level).

Like with the Faerie Dragons, Enchanters also have a data range within the .exe which determines which spells they can cast and at what weight for each. Starting from address 0x002608B8h, the following byte string exists:
35 00 00 00 0F 00 00 00 1C 00 00 00 0A 00 00 00 36 00 00 00 0A 00 00 00 2E 00 00 00 0F 00 00 00 2B 00 00 00 05 00 00 00 29 00 00 00 0F 00 00 00 25 00 00 00 0A 00 00 00 2D 00 00 00 04 00 00 00 FF FF FF FF

Separating them, we get:
35 00 00 00 0F 00 00 00
1C 00 00 00 0A 00 00 00
36 00 00 00 0A 00 00 00
2E 00 00 00 0F 00 00 00
2B 00 00 00 05 00 00 00
29 00 00 00 0F 00 00 00
25 00 00 00 0A 00 00 00
2D 00 00 00 04 00 00 00
FF FF FF FF

The FF FF FF FF entry acts as a stopper when the game is adding the various weights together. The total weight sum is 84 in this case, which means that the chances for each Spell aren't the values as listed above, but rather as (Spell weight)*100/84. Translating the above spell ID's and calculating the chances, we get:
Haste: 17.86% chance
Air Shield: 11.90% chance
Slow: 11.90% chance
Stone Skin: 17.86% chance
Bloodlust: 5.95% chance
Bless: 17.86% chance
Cure: 11.90% chance
Weakness: 4.76% chance
By manipulating the Spell ID's and the weights, you can change what the Enchanters are casting.

Update:
Some more spell casting info on creatures.

Faerie Dragons
Spell Power is 5 * the number of Dragons in the stack. Unfortunately, the number '5' isn't embedded as a value, but rather handled through an OPCODE. At address 0x00048370h - 0x00048372h, you'll find the OPCODE 8D 04 80. This tells the CPU to fill the register EAX with the value [ EAX + EAX * 4 ], essentially multiplying the value in the register by 5. As the multiplier of 4 is implicit through the OPCODE, it can't be manipulated straight away. However, two other options exist: 8D0440 and 8D04C0. The first OPCODE does [ EAX + EAX * 2 ], essentially multiplying stack size by 3. The second does [ EAX + EAX * 8 ], essentially multiplying stack size by 9.
0x00048375h: 02h, the School Skill at which the spell is cast; 2 is Advanced Skill.

The four upgraded Elementals can cast the Protection spell belonging to their Element. They have a Spell Power and School Level defined as well.

Storm Elementals:
0x00048388h: 06h is the Spell Power
0x0004838Ah: 02h is the Spell School Level
0x00048391h: 1Eh is the ID for the spell in question. Value 1Eh is 30, the ID for Protection from Air.

Ice Elementals:
0x00048398h: 06h is the Spell Power
0x0004839Ah: 02h is the Spell School Level
0x000483A1h: 20h is the ID for the spell in question. Value 20h is 32, the ID for Protection from Water.

Energy Elementals:
0x000483A8h: 06h is the Spell Power
0x000483AAh: 02h is the Spell School Level
0x000483B1h: 1Fh is the ID for the spell in question. Value 1Fh is 31, the ID for Protection from Fire.

Magma Elementals:
0x000483B8h: 06h is the Spell Power
0x000483BAh: 02h is the Spell School Level
0x000483C1h: 21h is the ID for the spell in question. Value 21h is 33, the ID for Protection from Earth.

Something similar exists for Ogre Mages:
0x000483C8h: 06h is the Spell Power
0x000483CAh: 02h is the Spell School Level
0x000483D1h: 2Bh is the ID for the spell in question. Value 2Bh is 43, the ID for Bloodlust.

---

FfuzzyLogik said:

---

Hello,

I searched using informations given to erase plague time :
Its written : 0C8C53 to 90 90 90 90 90 (default: 83 F8 09 7F 1B). So in there we have many things to help in case of "not finding" or doubts. Adress and what must normally be written.

First of all, "are you using the same version" ?
If the person who gave you adress was using some other exe, adress may be little different ! Here, not sure ?

I searched at the location 0c8c53 and didn't find what you're supposed to (according to the informations) ! Damned we're doooooomed ! Or maybe not ?

Two solutions then (the third is to give up but NO better die than surrend to make a great mod !) :
- Or the adress is correct and the indications are wrong (it may happen if you type quite fast) ;
- Or the adress isn't correct because the localisation isn't the same in the version used (HoTA instead of SoD maybe ?).

Solution there : Search for 83 F8 09 7F 1B if its the right thing to change. Care of finding something "near" the right adress (in the exe it may be more than one time this 83 F8 09 7F 1B but fortunately, its long enough to hope there isn't too many of them.)
I found it at adress 0c8f93 in my standard SoD game exe.
After saving the exe, you can change as written by 90 90 90 90 90 and test if plague happens...

Tell us if it worked !
Good evening.

---

SilverG said:

---

So aparently in the tutorial supplied at http://btb2.free.fr/misc/h3_hacking.txt is applicable for HotA, I'm using SoD. That's why the huge headaches and time loss.. Darn.

---

Quote:

---

The HD+ fan mod (NOT to be confused with the official HD mod, which should never, under any cirsumstances, ever be used) upgrades the game's graphics as well as its interface. It's important from a modding perspective since the new .exe file that it generates will restructure some of the internal code, making several of the hex edits discussed in this file possible. The unofficial "Horn of the Abyss" patch is based on the structure of HD+ and so will also work... sort of.

---

BTB said:

---

@SilverG

You're looking at the vanilla executable. I added an ALL CAPS DISCLAIMER in the last update to my guide that you need to use HD+ mod for a lot of the addresses I provide to be accurate.

---

SilverG said:

---

BTB said:

---

@SilverG

You're looking at the vanilla executable. I added an ALL CAPS DISCLAIMER in the last update to my guide that you need to use HD+ mod for a lot of the addresses I provide to be accurate.

---

OK, sorry. Didn't mean to disrespect you in any way.

---

SilverG said:

---

BTW, do we know how the treasure chest works?

---

Phoenix4ever said:

---

Treasure Chests does'nt give minor or major artifacts, only treasure artifacts.
What did you wanna change here?

---

Quote:

---

that there could be a meager chance to get either 1 minor or 1 major artifact.

---

AlexSpl said:

---

Quote:

---

that there could be a meager chance to get either 1 minor or 1 major artifact.

---

You can change the level of artifacts in treasure chests by editing C1B02 (0x02 by default). The chance to not get an artifact from a chest is at C1AEB (0x5F, or 95% by default). You can set this value to any number from 64 (36% to get an aftifact) to 99 (1% to get an arfifact). Values higher than 99 will stop artifacts from being generated in treasure chests.

Actually, you can change this probability to whatever number you like, but it will require editing of the other probabilities (for 1000/1500/2000 gold). Here they are - C1AC3 (0x20 by default), and C1AD9 (0x40 by default).

So, we have 0..31 out of 100 = 32% (1000 Gold/500 Exp), 32..63 out of 100 = 32% (1500 Gold/1000 Exp), 64..94 out of 100 = 31% (2000 Gold/1500 Exp), and 95..99 out of 100 = 5% (Artifact, Treasure) by default.

* * *
Hint
0x02 = Treasure, 0x04 = Minor, 0x08 = Major, 0x10 = Relic.
You even can OR (or, simply, add) them. For example, if you want to get Treasure or Minor artifacts from treasure chests, write 0x02 + 0x04 = 0x06 (06) at C1B02.
Minor or Major? 0x04 + 0x08 = 0x0C (0C), and so on.

---

BTB said:

---

Good find, Alex. Makes me curious where the GP/XP values are stored.

---