113d Dropping maximum amount of items regardless of /players

[FearedBliss]

Hello folks,

Over the past few years I've been developing my mod (1.13d) on and off called Vanilla Frosting. For one of the things in my mod, I wanted to basically be able to let the monsters drop the maximum amount of items that they can (specifically the same amount of items that drops when a person is in an 8 player game, and also still get the 450% increase experience of an 8 player game, but without the consequences of increase monster HP which would increase kill time, and without the increase dmg and attack rating to monsters).

I do have programming experience and have used OllyDbg for some basic code edits that I made to Diablo II, but I'm not that experience nor familiar with the way Diablo II's stuff is structured, let alone with how to actually _find_ stuff that I want. Debugging code that isn't dissembled is obviously easier to do (and find what you want to do) than dissembled code. So basically now that I'm starting to get back into the D2 grove, I wanted to properly implement this.

What I released in my last version of the mod to achieve this affect was to basically divide the HP of the monsters in MonStats.txt by 8 so that when the player sets /players 8, the HP would roughly be back to normal but the code that actually activates the additional item drops would kick into affect.

My idea for the solution is as follows:

When the game starts and sets the item drop amount depending on w/e the player setting is, we can change it so that this "ItemDrops" is a constant equivalent to /players 8. Any player setting that the user does afterwards would have no affect since this variable would no longer depend on /players. I'm not sure if this is actually the way the code is structured so if it isn't then maybe when the code that determines the amount of items to drop gets run, we can remove the check that takes the player amount into consideration and make it so that it always drops an 8 player equivalent amount.

So overall, what I want to do achieve ultimately is disconnect the /players command from the following values:

- Item drop amounts
- Monster HP increase
- Monster Damage and Attack rating increase

but still keep it for the experience.

Players 1 AND 8 values would be:
- Item Drop for Monsters: 8 player default
- HP: * 100% (1 player default)
- Monster Experience: * 450% (8 player default)
- Monster Attack Rating and Damage: + 00.00%

Some resources:
http://diablo2.diablowiki.net/Player_Se ... Hit_Points

Thanks,
Jonathan

EDIT:

Also, if you guys have any good tutorials on reverse engineering, asm, etc, and or anything else that would directly help me with D2 stuff, please pass it along. I've read some stuff before but the more reading the better.

[devurandom]

Hi Jonathan,

This is one possible place to start looking, not sure.

Code: Select all

d2game.dll
6FCB92D0    85C9          TEST ECX,ECX
6FCB92D2    7C 0B         JL SHORT 6FCB92DF
6FCB92D4    83F9 08       CMP ECX,8
6FCB92D7    7F 06         JG SHORT 6FCB92DF
6FCB92D9    890D 441CD36F MOV DWORD PTR DS:[6FD31C44],ECX
6FCB92DF    C3            RETN

6FD31C44 is the global pointer where players /x value is stored for [1.13d]
So you'd need to search the code for all constants that match 6FD31C44 in Olly to find which code segments are comparing players /x to.

Cheers

[lolet]

For life increase. You can just edit values of gLifeIncreaseTbl to fixed size:
D2Game.6FC9DCF0

Code: Select all

int __usercall EXP_GetLifeInc<eax>(signed int nUnits<eax>)
{
  int result; // eax@2

  if ( nUnits>= 9 )
    result = 50 * (nUnits- 2);
  else
    result = gLifeIncreaseTbl[nUnits];
  return result;
}

.rdata:6FD1BC50     ; int gLifeIncreaseTbl[9]
.rdata:6FD1BC50     gLifeIncreaseTbl dd 0, 0, 50, 100, 150, 200, 250, 300, 350;

Very similar function is for the exp increase:
D2Game.6FC9DCD0

Code: Select all

int __usercall EXP_GetExpInc<eax>(signed int nUnits<eax>)
{
  int result; // eax@2

  if ( nUnits>= 9 )
    result = 2 * (5 * nUnits + 130);
  else
    result = gExpIncreaseTbl[nUnits];
  return result;
}

.rdata:6FD1BC2C     ; int gExpIncreaseTbl[9]
.rdata:6FD1BC2C     gExpIncreaseTbl dd 0, 0, 50, 100, 150, 200, 250, 300, 350; 0

For the item drop is more complicated, and most simple solution is to spoof a player count to 8:
D2Game.6FCB9810

Code: Select all

.text:6FCB9810       ; int __usercall GAME_GetPlayersNo_6FCB9810<eax>(Game *pGame<eax>)
.text:6FCB9810       GAME_GetPlayersNo_6FCB9810 proc near    ; CODE XREF: MONSTERS_SetupExpLifeBoost_6FC9DF40+3Bp
.text:6FCB9810                                               ; TC_CalculateTreasureClassEx_6FD04010+177p
.text:6FCB9810
.text:6FCB9810       count           = dword ptr -4
.text:6FCB9810
.text:6FCB9810   000                 push    ecx
.text:6FCB9811   004                 push    ebx
.text:6FCB9812   008                 push    edi
.text:6FCB9813   00C                 mov     edi, eax        ; pGame
//...
replace with
mov eax, 8
ret

[FearedBliss]

Thanks devurandom and lolet, this was extremely helpful.

I was researching and attempting to modify the array itself, but it seems I'm unable to (Don't really know how).

I was logically assuming that it would be something like this given a linear constant array:

Dll: D2Game.dll
Calling Function: 6FC9DCF0

If players is not greater than or equal to 9 then get the value from that specific array's index = to the # of players:

6FC9DCF5 |. 8B0485 50BCD1>MOV EAX,DWORD PTR DS:[EAX*4+6FD1BC50]

Start of array: 6FD1BC50

Given that EAX is the number of players at the time of the (CMP EAX,9) step:

Index and their values (All added in a hex calculator in hex):

Code: Select all

0 (0 * 4 + 6FD1BC50) = Offset 0 + 6FD1BC50 = 6FD1BC50
1 (1 * 4 + 6FD1BC50) = Offset 4 + 6FD1BC50 = 6FD1BC54
2 (2 * 4 + 6FD1BC50) = Offset 8 + 6FD1BC50 = 6FD1BC58
3 (3 * 4 + 6FD1BC50) = Offset C + 6FD1BC50 = 6FD1BC5C
4 (4 * 4 + 6FD1BC50) = Offset 10 + 6FD1BC50 = 6FD1BC60 [ Not in the list ]
5 (5 * 4 + 6FD1BC50) = Offset 14 + 6FD1BC50 = 6FD1BC64 [ Not in the list ]
6 (6 * 4 + 6FD1BC50) = Offset 18 + 6FD1BC50 = 6FD1BC68 [ Not in the list ]
7 (7 * 4 + 6FD1BC50) = Offset 1C + 6FD1BC50 = 6FD1BC6C
8 (8 * 4 + 6FD1BC50) = Offset 20 + 6FD1BC50 = 6FD1BC70

Contents of those locations:

Code: Select all

6FD1BC50    0000            ADD BYTE PTR DS:[EAX],AL               < Array[0] (First element of array) ?
6FD1BC52    0000            ADD BYTE PTR DS:[EAX],AL
6FD1BC54    0000            ADD BYTE PTR DS:[EAX],AL               < Array[1]
6FD1BC56    0000            ADD BYTE PTR DS:[EAX],AL
6FD1BC58    3200            XOR AL,BYTE PTR DS:[EAX]               < Array[2]
6FD1BC5A    0000            ADD BYTE PTR DS:[EAX],AL
6FD1BC5C    64:0000         ADD BYTE PTR FS:[EAX],AL               < Array[3]
6FD1BC5F    0096 000000C8   ADD BYTE PTR DS:[ESI+C8000000],DL
6FD1BC65    0000            ADD BYTE PTR DS:[EAX],AL
6FD1BC67    00FA            ADD DL,BH
6FD1BC69    0000            ADD BYTE PTR DS:[EAX],AL
6FD1BC6B    002C01          ADD BYTE PTR DS:[ECX+EAX],CH
6FD1BC6E    0000            ADD BYTE PTR DS:[EAX],AL
6FD1BC70    5E              POP ESI                                < Array[8] ? (Last element of array) - This one doesn't seem right though.

However, the values that I see in those addresses are not modifiable (At least not by subsituting them by the values we have in our array:
0, 0, 50, 100, 150, 200, 250, 300, 350

Which I'm guessing are the values represented here by differently: http://diablo2.diablowiki.net/Player_Se ... Hit_Points

I also don't understand why we have an array of size 9 rather than of size 8 [0-7] should be all that is needed for an 8 player game. Why the extra 0?

So I'm definitely doing something wrong since none of this information (assumptions of how the array is organized looks right).

On another note, I noticed that if I go to address 6FD1BC50 in D2Game.dll and then I scroll up once in the Olly window, address 6FD1BC50 will dissapear
and instead I will have the following two lines selected:

Code: Select all

6FD1BC4F    0000            ADD BYTE PTR DS:[EAX],AL
6FD1BC51    0000            ADD BYTE PTR DS:[EAX],AL

---------

Regarding your "item drop is more complicated" code snippet,
I'm not sure if you mean that I should replace just the mov edi, eax line with mox eax, 8, or if I should replace everything below address 6FCB9813
with mov eax, 8, ret. It seems we need the code after mov edi, eax though.

Code: Select all

6FCB9810  /$  51            PUSH ECX
6FCB9811  |.  53            PUSH EBX
6FCB9812  |.  57            PUSH EDI
6FCB9813  |.  8BF8          MOV EDI,EAX
6FCB9815  |.  8D4424 08     LEA EAX,DWORD PTR SS:[ESP+8]
6FCB9819  |.  50            PUSH EAX
6FCB981A  |.  BB D095CB6F   MOV EBX,D2Game.6FCB95D0
6FCB981F  |.  C74424 0C 000>MOV DWORD PTR SS:[ESP+C],0
6FCB9827  |.  E8 643DFDFF   CALL D2Game.6FC8D590
6FCB982C  |.  8A4F 6A       MOV CL,BYTE PTR DS:[EDI+6A]
6FCB982F  |.  84C9          TEST CL,CL
6FCB9831  |.  8B5424 08     MOV EDX,DWORD PTR SS:[ESP+8]
6FCB9835  |.  5F            POP EDI
6FCB9836  |.  5B            POP EBX
6FCB9837  |.  76 0E         JBE SHORT D2Game.6FCB9847
6FCB9839  |.  80F9 03       CMP CL,3
6FCB983C  |.  77 09         JA SHORT D2Game.6FCB9847
6FCB983E  |.  A1 441CD36F   MOV EAX,DWORD PTR DS:[6FD31C44]
6FCB9843  |.  3BC2          CMP EAX,EDX
6FCB9845  |.  7F 02         JG SHORT D2Game.6FCB9849
6FCB9847  |>  8BC2          MOV EAX,EDX
6FCB9849  |>  59            POP ECX
6FCB984A  \.  C3            RETN

---------

Do you know what is the address for the monster attack rating/dmg increase. I'm assuming it is a similar function as well.
Coicentially, the Life increase and exp code were very close to each other in Olly.

----------

Also regarding the experience code, since I didn't know how to change the array, I was playing around with the function and I decided to do the following:

Code: Select all

6FC9DCD0  /$  83F8 09       CMP EAX,9
6FC9DCD3  |.  7D 08         JGE SHORT D2Game.6FC9DCDD
6FC9DCD5  |.  8B0485 2CBCD1>MOV EAX,DWORD PTR DS:[EAX*4+6FD1BC2C]
6FC9DCDC  |.  C3            RETN
6FC9DCDD  |>  8D8480 820000>LEA EAX,DWORD PTR DS:[EAX+EAX*4+82]
6FC9DCE4  |.  D1E0          SHL EAX,1
6FC9DCE6  \.  C3            RETN

to

Code: Select all

6FC9DCD0  /$  83F8 09       CMP EAX,9
6FC9DCD3      EB 08         JMP SHORT D2Game.6FC9DCDD
6FC9DCD5  |.  8B0485 2CBCD1>MOV EAX,DWORD PTR DS:[EAX*4+6FD1BC2C]
6FC9DCDC  |.  C3            RETN
6FC9DCDD      B8 50030000   MOV EAX,350
6FC9DCE2      90            NOP
6FC9DCE3      90            NOP
6FC9DCE4      90            NOP
6FC9DCE5      90            NOP
6FC9DCE6  \.  C3            RETN

Basically the value of the experience will be the same as /players 8 regardless of the players level. So technically we don't need to get it from an array.
However, I would definitely want to change it at the array level since that way any other code paths that are referencing the array will also us the new values,
and also it doesn't change existing functions.

Depending on some other changes in logic that I wanted to do to achieve the same result, olly would complain about "Fixups" and potential problems if I decided
to save the new D2Game.dll with those modifications.

The above modification seemed to work in game in the sense that the monsters now give more experience. However, they were given more experience than a player 8 amount.

If I kill a zombie, these are the values I expect and these are the values I'm getting with the above change:

Zombie - Players 1 = 33 Exp
Zombie - Players 8 = 148 Exp
Zombie - w/ modification = 312 Exp

Thanks for the help, highly appreciated.

Jonathan

[devurandom]

I also don't understand why we have an array of size 9 rather than of size 8 [0-7] should be all that is needed for an 8 player game. Why the extra 0?

Its just padding for the array...

On another note, I noticed that if I go to address 6FD1BC50 in D2Game.dll and then I scroll up once in the Olly window, address 6FD1BC50 will dissapear
and instead I will have the following two lines selected:

Ollydbg's code analysis doesn't interpret things correctly inside .text section

Possibly you have a small error in your code

Code: Select all

6FC9DCDD      B8 50030000   MOV EAX,350

I think you want the hex value of 015E instead of 350

[FearedBliss]

Thanks devurandom. This helped. I was able to modify the experience, hp increase, and the player spoofing with this second attempt.
Looks like my assumption that the code running inside the spoofing code was needed. It wasn't. It seems most of the code is just attempting to calculate
what the players value should be. So basically making the function act as:

Code: Select all

GAME_GetPlayersNo() {
 return 8;
}

Works fine. And it also doesn't modify the life of the monster nor the experience. So at players 1, every time a monster is killed or a chest is opened,
the value of how many items should drop for the portion of the drop calculation will always return 8 from the above function.

I ran a nice map I found for testing the item drop count:

Code: Select all

1.13d Map Seed - SuperChest? in Cabin in Middle over Cold Plains = 954220158

p1 p8 Custom p1

1 4 2
1 1 4
2 4 3
1 4 2
1 3 3
2 2 3
3 2 3
1 3 3
1 3 3 
1 4 3

So you can clearly see that making it return 8 definitely affected the number of items dropped from the chest on average (regardless of players count).

Below are the changes I made to the Experience and Life change functions. They ignored the array completely, however, for my own knowledge, I would still like to understand
how the array is layed our and how we can modify it. We can do this as an exercise .

Old Experience Code

Code: Select all

6FC9DCD0  /$  83F8 09       CMP EAX,9
6FC9DCD3  |.  7D 08         JGE SHORT D2Game.6FC9DCDD
6FC9DCD5  |.  8B0485 2CBCD1>MOV EAX,DWORD PTR DS:[EAX*4+6FD1BC2C]
6FC9DCDC  |.  C3            RETN
6FC9DCDD  |>  8D8480 820000>LEA EAX,DWORD PTR DS:[EAX+EAX*4+82]
6FC9DCE4  |.  D1E0          SHL EAX,1
6FC9DCE6  \.  C3            RETN

New Experience Code

Code: Select all

6FC9DCD0    90              NOP
6FC9DCD1    90              NOP
6FC9DCD2    90              NOP
6FC9DCD3    EB 08           JMP SHORT D2Game.6FC9DCDD
6FC9DCD5    8B0485 2CBCD16F MOV EAX,DWORD PTR DS:[EAX*4+6FD1BC2C]
6FC9DCDC    C3              RETN
6FC9DCDD    B8 5E010000     MOV EAX,15E
6FC9DCE2    90              NOP
6FC9DCE3    90              NOP
6FC9DCE4    90              NOP
6FC9DCE5    90              NOP
6FC9DCE6    C3              RETN

Old Life Changes Code

Code: Select all

6FC9DCF0  /$  83F8 09       CMP EAX,9
6FC9DCF3  |.  7D 08         JGE SHORT D2Game.6FC9DCFD
6FC9DCF5  |.  8B0485 50BCD1>MOV EAX,DWORD PTR DS:[EAX*4+6FD1BC50]
6FC9DCFC  |.  C3            RETN
6FC9DCFD  |>  83C0 FE       ADD EAX,-2
6FC9DD00  |.  6BC0 32       IMUL EAX,EAX,32
6FC9DD03  \.  C3            RETN

New Life Changes Code

Code: Select all

6FC9DCF0    90              NOP
6FC9DCF1    90              NOP
6FC9DCF2    90              NOP
6FC9DCF3    EB 08           JMP SHORT D2Game.6FC9DCFD
6FC9DCF5    8B0485 50BCD16F MOV EAX,DWORD PTR DS:[EAX*4+6FD1BC50]
6FC9DCFC    C3              RETN
6FC9DCFD    B8 00000000     MOV EAX,0
6FC9DD02    90              NOP
6FC9DD03    C3              RETN

Sequence of Commands Pattern search for the above:

Code: Select all

CMP EAX,9
JGE SHORT const
MOV EAX,[EAX*4+const]

Seems only three places have this block. The first two are the ones we want, the third one doesn't seem to be used for what I'm interested in.
I initially thought the third code block was related to the "Damage & Attack Rating" portion that I'm still looking for, but the breakpoint I place
on their didn't seem to get hit when a monster was generated or when a monster attacked me. So it must be somewhere else.

Old Players Amount Code [For Spoofing, doesn't actually change the /players value but rather affects amount of items in drop rate calculations]:

Code: Select all

6FCB9810    51              PUSH ECX
6FCB9811    53              PUSH EBX
6FCB9812    57              PUSH EDI
6FCB9813    8BF8            MOV EDI,EAX
6FCB9815    8D4424 08       LEA EAX,DWORD PTR SS:[ESP+8]
6FCB9819    50              PUSH EAX
6FCB981A    BB D095CB6F     MOV EBX,D2Game.6FCB95D0
6FCB981F    C74424 0C 00000>MOV DWORD PTR SS:[ESP+C],0
6FCB9827    E8 643DFDFF     CALL D2Game.6FC8D590
6FCB982C    8A4F 6A         MOV CL,BYTE PTR DS:[EDI+6A]
6FCB982F    84C9            TEST CL,CL
6FCB9831    8B5424 08       MOV EDX,DWORD PTR SS:[ESP+8]
6FCB9835    5F              POP EDI
6FCB9836    5B              POP EBX
6FCB9837    76 0E           JBE SHORT D2Game.6FCB9847
6FCB9839    80F9 03         CMP CL,3
6FCB983C    77 09           JA SHORT D2Game.6FCB9847
6FCB983E    A1 441CD36F     MOV EAX,DWORD PTR DS:[6FD31C44]
6FCB9843    3BC2            CMP EAX,EDX
6FCB9845    7F 02           JG SHORT D2Game.6FCB9849
6FCB9847    8BC2            MOV EAX,EDX
6FCB9849    59              POP ECX
6FCB984A    C3              RETN
6FCB984B    CC              INT3
6FCB984C    CC              INT3
6FCB984D    CC              INT3
6FCB984E    CC              INT3
6FCB984F    CC              INT3
6FCB9850    83EC 08         SUB ESP,8

New Players Amount Code

Code: Select all

6FCB9810    B8 08000000     MOV EAX,8
6FCB9815    C3              RETN                       - Returns players 8 equivalent value immediately
6FCB9816    90              NOP
6FCB9817    90              NOP
6FCB9818    90              NOP
6FCB9819    50              PUSH EAX
6FCB981A    BB D095CB6F     MOV EBX,D2Game.6FCB95D0
6FCB981F    C74424 0C 00000>MOV DWORD PTR SS:[ESP+C],0
6FCB9827    E8 643DFDFF     CALL D2Game.6FC8D590
6FCB982C    8A4F 6A         MOV CL,BYTE PTR DS:[EDI+6A]
6FCB982F    84C9            TEST CL,CL
6FCB9831    8B5424 08       MOV EDX,DWORD PTR SS:[ESP+8]
6FCB9835    5F              POP EDI
6FCB9836    5B              POP EBX
6FCB9837    76 0E           JBE SHORT D2Game.6FCB9847
6FCB9839    80F9 03         CMP CL,3
6FCB983C    77 09           JA SHORT D2Game.6FCB9847
6FCB983E    A1 441CD36F     MOV EAX,DWORD PTR DS:[6FD31C44]
6FCB9843    3BC2            CMP EAX,EDX
6FCB9845    7F 02           JG SHORT D2Game.6FCB9849
6FCB9847    8BC2            MOV EAX,EDX
6FCB9849    59              POP ECX
6FCB984A    C3              RETN

Overall this achieves the following:

As /players 1:
- Players 1 equivalent HP, Damage, Attack Rating
- Players 8 equivalent exp
- Players 8 equivalent drop amounts

-
So basically the /players 8 command is useless. At the moment /players 8 will only increase the monsters dmg/atk rating. Other stuff remains the same.

I would like to figure out the dmg/attack rating stuff for learning purposes, but I might not actually use it in my mod since there wouldn't be any harm
in leaving that stuff there considering /players 1 already has everything I want. Plus I suppose if one of my mod users wants to get hit harder by monsters,
they are welcome to do so hah.. but I kinda do want to make /players command completely useless ;D.

Thanks for the help .

- Jonathan

[devurandom]

Sequence of Commands Pattern search for the above:

Code: Select all

CMP EAX,9
JGE SHORT const
MOV EAX,[EAX*4+const]

Yup that's good, but it doesn't have to be in EAX. it can be in any register. Better to search like this:

CMP R32,9
JGE SHORT const
MOV R32,[R32*4+const] (points to a virtual table)


Changing the array depends on if its generated at runtime, or if the array data is static.
Probably a good idea to be careful, and only save the data you changed, not the whole .text section.

Glad you've got it working.

Cheers,

[FearedBliss]

Ah yes you are right.. the register can change between versions

[Vladan899]

How do you spoof those values? I mean to edit health, players x , attack rating? I can't seems to find anything

[JayBrainDead]

I initially thought the third code block was related to the "Damage & Attack Rating" portion that I'm still looking for, but the breakpoint I place
on their didn't seem to get hit when a monster was generated or when a monster attacked me. So it must be somewhere else.

Very interesting post FearedBliss, I definetely included a lot of these changes in my own mod . I know this thread has been dead for almost two years at this point but I would like to add a little something I found regarding /Player Setting for 1.13d for anyone else that might go through the same proccess I did.

For those who want to have increased monster damage in their mods, the fomula starts at Offset 0009C9F0 in the D2Game.dll and looks like this

Code: Select all

Address   Hex dump             Command                                  Comments
0009C9F0    8A51 6D            MOV DL,BYTE PTR DS:[ECX+6D]    
0009C9F3    84D2               TEST DL,DL                                    
0009C9F5    76 05              JBE SHORT 0009C9FC                     
0009C9F7    83F8 02            CMP EAX,2
0009C9FA    7D 03              JGE SHORT 0009C9FF
0009C9FC    33C0               XOR EAX,EAX
0009C9FE    C3                 RETN
0009C9FF    83F8 09            CMP EAX,9
0009CA02    7D 08              JGE SHORT 0009CA0C
0009CA04    8B0485 78B7D16F    MOV EAX,DWORD PTR DS:[EAX*4+6FD1B778]
0009CA0B    C3                 RETN
0009CA0C    8D04C5 F0FFFFFF    LEA EAX,[EAX*8-10]
0009CA13    C3                 RETN

Note that any change made here would only take effect when launching the game WITHOUT -direct -txt parameters during my tests so keep that in mind