Heroes of Might and Magic Community
visiting hero! Register | Today's Posts | Games | Search! | FAQ/Rules | AvatarList | MemberList | Profile


Age of Heroes Headlines:  
5 Oct 2016: Heroes VII development comes to an end.. - read more
6 Aug 2016: Troubled Heroes VII Expansion Release - read more
26 Apr 2016: Heroes VII XPack - Trial by Fire - Coming out in June! - read more
17 Apr 2016: Global Alternative Creatures MOD for H7 after 1.8 Patch! - read more
7 Mar 2016: Romero launches a Piano Sonata Album Kickstarter! - read more
19 Feb 2016: Heroes 5.5 RC6, Heroes VII patch 1.7 are out! - read more
13 Jan 2016: Horn of the Abyss 1.4 Available for Download! - read more
17 Dec 2015: Heroes 5.5 update, 1.6 out for H7 - read more
23 Nov 2015: H7 1.4 & 1.5 patches Released - read more
31 Oct 2015: First H7 patches are out, End of DoC development - read more
5 Oct 2016: Heroes VII development comes to an end.. - read more
[X] Remove Ads
LOGIN:     Username:     Password:         [ Register ]
New Server | HOMM1: info forum | HOMM2: info forum | HOMM3: info forum | HOMM4: info forum | HOMM5: info forum | MMH6: wiki forum | MMH7: wiki forum
Heroes Community > Heroes 5 - Modders Workshop > Thread: Hex editing guide
Thread: Hex editing guide
dredknight
dredknight


Promising
Supreme Hero
disrupting the moding industry
posted April 12, 2015 12:15 PM bonus applied by Galaad on 02 Aug 2017.
Edited by dredknight at 12:34, 06 Aug 2017.

[Tutorial] Hex editing

Mod note: +QP awarded for good contributions to the forum.

Dear community.

For anyone interested in Hex editing this page will provide information on:

- Learning how to do it
- List of useful tools and external links
- List of Heroes V currently found Hex addresses

Anyone who wants to contribute with articles, tools or know-how you are welcomed to do so!

1. USEFUL SOFTWARE AND LINKS

This is a list of Software that can aid your modding efforts.

1. FlexHex

2. Notepad++ Hex pluggin good for reading and editting hex. Nothing special besides that.

3. Free Hex editor.

4. Cheat Engine! - very good software that gets the HEX values from memory while playing the game. Basically it can be used to get the addresses of certain things while playing. It comes with some handy tutorials as well.

5. IDA v 6.x
Very powerful software for decompiling. Used by enterprise companies. Unfortunately it is paid. There is a freeware version but it lacks many features.

6. List of x86 machine instructions that can be identified in binaries.

2. LEARNING HEX EDITING

   The name 'hex' comes from 'hexadecimal': a standard numerical format for representing binary data. Learn more about meaning and origins.

  Hex editing is the way of manipulating a binary file, which data is stored in hex format (this can be any Might and Magic game .exe file). To expand you knowledge with some basic hex editing theory read this 5-minute article.

  Now when you know what hex code and hex editing operations lets ditch into some practice. Grab and install Cheat Engine. Cheat engine is the software that helps with reading and modifying binary files. The software has a 10-step tutorial which teaches in practice all important skills that you need to know about hex editing. In a matter of fact the tutorial even explains some advanced practices.


3. COMMUNITY KNOWLEDGE

Links to all heroescommunity.com guides that relate to hex editing:

1. HEX editting the level cap by BAD

2. Heroes 3 WOG - Hex editing


4. LIST OF KNOWN HEROES V HEX ADDRESSES (H5_game.exe)

Specific Heroes V addresses and how their values affect the gameplay behaviour.

- 00A5227A - regards diplomacy chance.  (thanks to lotihoti)

- from 00A20860 to 00a20878 - You can see the formula for the calendar of the game  (28*nMonth+7*nWeek+nDay)

- how new objects classes, creatures, artifacts are added to the game.

- Deflactor's hex dump - includes addresses for War Machines -
Tent healing, enlightenment, healing tent specialization, max artifact count, Academy Mini artifacts value offsets, NCF exe offsets, Permanent endless turns offsets, Castles tower damage offsets, ATB start of the battle random variation offsets, Archmage "energychannel" ability value offset, Hero movement and movement abilities offset (pathfinding, Tracker)

 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
lotihoti
lotihoti


Famous Hero
posted April 12, 2015 04:59 PM
Edited by lotihoti at 20:02, 12 Apr 2015.

I love this idea - may some advanced hex editors can give some hints.
I will try this stuff out

Edit:
What i found so far:
On Adress 00A5227A you can change the chance for diplomacy...

Found another adress where you can edit another skill - but i forgot to take a note - have to search it again

I have no intel proz :/ cant get bdvm

 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
dredknight
dredknight


Promising
Supreme Hero
disrupting the moding industry
posted April 13, 2015 09:13 AM
Edited by dredknight at 09:25, 13 Apr 2015.

@lotihoti, great! I will add this to the first post ;]

How did you find it?

 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
lotihoti
lotihoti


Famous Hero
posted April 13, 2015 11:27 AM
Edited by lotihoti at 11:28, 13 Apr 2015.

I used cheat engine - Memory view and scrolled through.

Saw many things there, but then: diplomacy Chance +20.

I changed the value to 99 - saved - restarted the game and got diplomacy ingame. Almost every neutral creature wanted to join my army.

Found it by accident xD

 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
dredknight
dredknight


Promising
Supreme Hero
disrupting the moding industry
posted April 13, 2015 12:15 PM

Great! Adding it to the proposed software!


 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
lotihoti
lotihoti


Famous Hero
posted April 13, 2015 01:09 PM

With cheat engine you can scan files too. Not only process.

It even convertes some of the code into Textform. In some hours i will continue to scan the exe.

 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
magnomagus
magnomagus


Responsible
Legendary Hero
modding wizard
posted April 13, 2015 08:29 PM

Here is a copy of a post from sfidanza in addding creatures to TOE thread, it explains how new objects classes, creatures, artifacts are added to the game.

Quote:
@Gnoll_Mage: I don't know how crazypill found out the first time for the HoF exe, and I mostly looked for about the same bits in ToE. I can explain briefly what you have to look at, but not really why.

First, there are a number of tables which lengths are specified. Look inside data.pak/types.xml for <dbid>: those are the entry points mostly for the tables GameMechanics/RefTables/. Each has a different lengths, and they are of two types: lengths lower than 128 are stored in a signed short (1 byte - for values between -127 and 128), while lengths higher than 128 use a long integer (4 bytes).

Lengths seem to be specified at two places in the .exe, but let's focus on the first one. 1-byte values are given in a block like
"FF 6A xx 8D 44" (where xx is the value)
and 4-bytes values are given in a block like:
"FF 68 xx xx xx xx 8D 44" (where xx xx xx xx is the value in little endian)
As I explained in the first post, "little endian" means the bytes are reversed: 300 is 012C in hexadecimal, and is written "2C 01 00 00" in the exe.

If you looked in types.xml for <dbid>, you have noticed that there are 29 such tables. Now, the "8D 44" suffix in the exe is actually part of a longer block:
"8D 44 24 24 50 8D 4C 24 1C 51 68"
and if you look for it in H5_Game.exe, you'll see that it also appears 29 times. Now that you know how to recognize 1-byte and 4-bytes values, you can match each occurrence to its table.

Of course, that's only half the story. At the second place where the length are specified, all of them are written with 4 bytes, and appear in blocks like:
"B8 xx xx xx xx C3 CC CC"
There might be multiple hits of those. For example, "B8 B4 00 00 00 C3 CC CC" appears 2 times. But the one we're looking should be in an area with other such blocks around for other lengths.

These explanations certainly do not explain the why, only a part of the how. But understanding the why is even more technical, and requires using a disassembler, which is illegal in various countries.

Now, some of you here like to barely read a technical post, obviously do not make the effort of understanding what it means, but believe that it solves everything. It does not.

 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
AlexSpl
AlexSpl


Responsible
Supreme Hero
posted April 13, 2015 08:55 PM
Edited by AlexSpl at 21:22, 13 Apr 2015.

Quote:
Now, the "8D 44" suffix in the exe is actually part of a longer block:
"8D 44 24 24 50 8D 4C 24 1C 51 68"
and if you look for it in H5_Game.exe, you'll see that it also appears 29 times.

Kinda naive interpretation. These - "8D 44 24 24 | 50 | 8D 4C 24 1C | 51 ..." - are called machine, or processor, instructions and can be disassembled as the following assembler commands:

lea     eax, [esp+24h]
push    eax
lea     ecx, [esp+1Ch]
push    ecx
...


It seems they are supposed to pass arguments to some function.

I recommend to play with this freeware tool https://www.hex-rays.com/products/ida/support/download_freeware.shtml for further understanding.

 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
dredknight
dredknight


Promising
Supreme Hero
disrupting the moding industry
posted April 14, 2015 02:34 PM

@Alex that software can get us a lot of answers! I am adding it to the top post.

@magnomagus I will add those as well

 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
lotihoti
lotihoti


Famous Hero
posted April 14, 2015 07:42 PM

Hey there!
Currently working on runic machines.

May someone can explain this? If i only can understand this xD (willing to learn btw! xD )


 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
magnomagus
magnomagus


Responsible
Legendary Hero
modding wizard
posted April 14, 2015 08:29 PM

Runic machines is in defaultstats, no need to use hex editing

 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
lotihoti
lotihoti


Famous Hero
posted April 14, 2015 09:41 PM

OPS xD

Your right - i wanted to edit frency too... and some other stuff - but then i need to understand this stuff first.

Anyone that can explain using some other words what happens during this game text?

 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
dredknight
dredknight


Promising
Supreme Hero
disrupting the moding industry
posted May 24, 2015 08:14 PM

Hi!

I try to modify the formula for creature spell damage.
I took where BAD left. You can find some info the this address

00E48C1C      dd 1.2 //double 64

And I found one indeed.
Here it is



Looking a few dozen rows below 00E48F28 I see this:



I wonder how I can change the 2.777777 modifier. It seems to part of a formula and I want to check which one and how it will change the game.
How can I do that? it seems in this mod of interpretation I cannot do edits. I use IDA dissasembler.

 Send Instant Message | Send E-Mail | View Profile | Quote Reply | Link
Jump To: « Prev Thread . . . Next Thread »
Post New Poll    Post New Topic    Post New Reply

Page compiled in 0.1123 seconds