Comprehensive Quest Code and Quest Reward Code Listing

[Joel]

Ok, here's a list of code location for quest , quest reward and reward related code for most quests. I still lack some, so if any have info, let post

ACT 1 QUEST REWARD CODE LOCATION :
**********************************

A1Q1 - Den of Evil Skill Reward :

Code: Select all

6FC97CF4   53               PUSH EBX
6FC97CF5   6A 01            PUSH 1
6FC97CF7   6A 05            PUSH 5
6FC97CF9   51               PUSH ECX 
6FC97CFA   E8 BB3B0800      CALL <JMP.&D2Common.#10518>

A1Q2 - Kashya Free Rogue Hireling :

Code: Select all

 - Not found yet

A1Q3 - Deciphered Scroll Spawn at Akara :

Code: Select all

6FC9B394   6A 01            PUSH 1
6FC9B396   6A 02            PUSH 2
6FC9B398   6A 00            PUSH 0
6FC9B39A   68 626B6420      PUSH 20646B62
6FC9B39F   E8 4CAAFFFF      CALL D2Game.6FC95DF0

A1Q3 - Ring Reward at Akara for Rescuing Cain :

Code: Select all

6FC9B48B   BA 1E000000      MOV EDX,1E
6FC9B490   B8 06000000      MOV EAX,6
6FC9B495   6A 01            PUSH 1 
6FC9B497   50               PUSH EAX 
6FC9B498   52               PUSH EDX 
6FC9B499   8B56 0C          MOV EDX,DWORD PTR DS:[ESI+C]
6FC9B49C   68 72696E20      PUSH 206E6972
6FC9B4A1   8BCD             MOV ECX,EBP
6FC9B4A3   E8 48A9FFFF      CALL D2Game.6FC95DF0

A1Q3 - Cow King stamina potions "reward"

Code: Select all

6FC9C2CA   |.  8B4E 08                   MOV ECX,DWORD PTR DS:[ESI+8]
6FC9C2CD   |.  BF [color=#6400ff]08[/color]000000               MOV EDI,8 <--- quantity of potions
6FC9C2D2   |.  C781 B8000000 [color=#6400ff]76707320[/color]    MOV DWORD PTR DS:[ECX+B8],20737076 <--- pot code
6FC9C2DC   |>  8B0E                      /MOV ECX,DWORD PTR DS:[ESI]
6FC9C2DE   |.  6A 00                     |PUSH 0
6FC9C2E0   |.  6A FF                     |PUSH -1
6FC9C2E2   |.  8D5424 14                 |LEA EDX,DWORD PTR SS:[ESP+14]
6FC9C2E6   |.  6A 00                     |PUSH 0
6FC9C2E8   |.  52                        |PUSH EDX
6FC9C2E9   |.  8B56 08                   |MOV EDX,DWORD PTR DS:[ESI+8]
6FC9C2EC   |.  6A 00                     |PUSH 0                                           ; |Arg1 = 00000000
6FC9C2EE   |.  E8 CD3BFBFF               |CALL D2Game.6FC4FEC0
6FC9C2F3   |.  4F                        |DEC EDI
6FC9C2F4   |.^ 75 E6                     \JNZ SHORT D2Game.6FC9C2DC

A1Q3 - Ignore whether Cow King has been killed to open Cow Level portals

Code: Select all

6FC9C5D9   |.  6A 0A                     PUSH 0A
6FC9C5DB   |.  6A 04                     PUSH 4
6FC9C5DD   |.  8B4488 10                 MOV EAX,DWORD PTR DS:[EAX+ECX*4+10]
6FC9C5E7   |.  85C0                      TEST EAX,EAX
6FC9C5E9   |.  [color=#6400ff]0F85 D5000000[/color]             JNZ D2Game.6FC9C6C4
               ^^^^^^^^^^ NOP these bytes to disable check

A1Q5 - Charsi Imbue Reward :

Code: Select all

6FCCA295      BB [color=#6400ff]06[/color]000000   MOV EBX,6

4 = magic item, 5 = set item, 6 = rare item, 7 = uniques item

A1Q6 - Andariel gem drop

Code: Select all

6FC9E9D7   |.  C74424 10 [color=#6400ff]02[/color]000000        MOV DWORD PTR SS:[ESP+10],2 <--- number of chipped gems
6FC9E9DF   |>  8B4E 04                   /MOV ECX,DWORD PTR DS:[ESI+4]
6FC9E9E2   |.  E8 9956FFFF               |CALL D2Game.6FC94080
6FC9E9E7   |.  8BC8                      |MOV ECX,EAX
6FC9E9E9   |.  BA C590C66A               |MOV EDX,6AC690C5
6FC9E9EE   |.  33ED                      |XOR EBP,EBP
6FC9E9F0   |.  8B01                      |MOV EAX,DWORD PTR DS:[ECX]
6FC9E9F2   |.  8B59 04                   |MOV EBX,DWORD PTR DS:[ECX+4]
6FC9E9F5   |.  F7E2                      |MUL EDX
6FC9E9F7   |.  03C3                      |ADD EAX,EBX
6FC9E9F9   |.  55                        |PUSH EBP
6FC9E9FA   |.  13D5                      |ADC EDX,EBP
6FC9E9FC   |.  8901                      |MOV DWORD PTR DS:[ECX],EAX
6FC9E9FE   |.  8951 04                   |MOV DWORD PTR DS:[ECX+4],EDX
6FC9EA01   |.  33D2                      |XOR EDX,EDX
6FC9EA03   |.  B9 07000000               |MOV ECX,7
6FC9EA08   |.  6A FF                     |PUSH -1
6FC9EA0A   |.  F7F1                      |DIV ECX
6FC9EA0C   |.  8B47 08                   |MOV EAX,DWORD PTR DS:[EDI+8]
6FC9EA0F   |.  55                        |PUSH EBP
6FC9EA10   |.  8B0C95 [color=#6400ff]0040D36F[/color]           |MOV ECX,DWORD PTR DS:[EDX*4+6FD34000] <--- chippie table
6FC9EA17   |.  8D5424 20                 |LEA EDX,DWORD PTR SS:[ESP+20]
6FC9EA1B   |.  8988 B8000000             |MOV DWORD PTR DS:[EAX+B8],ECX
6FC9EA21   |.  8B4E 04                   |MOV ECX,DWORD PTR DS:[ESI+4]
6FC9EA24   |.  52                        |PUSH EDX
6FC9EA25   |.  8B57 08                   |MOV EDX,DWORD PTR DS:[EDI+8]
6FC9EA28   |.  6A 02                     |PUSH 2
6FC9EA2A   |.  E8 9114FBFF               |CALL D2Game.6FC4FEC0
6FC9EA2F   |.  8B4424 10                 |MOV EAX,DWORD PTR SS:[ESP+10]
6FC9EA33   |.  48                        |DEC EAX
6FC9EA34   |.  894424 10                 |MOV DWORD PTR SS:[ESP+10],EAX
6FC9EA38   |.^ 75 A5                     \JNZ SHORT D2Game.6FC9E9DF
6FC9EA3A   |.  8B4E 04                   MOV ECX,DWORD PTR DS:[ESI+4]
6FC9EA3D   |.  E8 3E56FFFF               CALL D2Game.6FC94080
6FC9EA42   |.  8BC8                      MOV ECX,EAX
6FC9EA44   |.  BA C590C66A               MOV EDX,6AC690C5
6FC9EA49   |.  55                        PUSH EBP 
6FC9EA4A   |.  6A FF                     PUSH -1
6FC9EA4C   |.  8B01                      MOV EAX,DWORD PTR DS:[ECX]
6FC9EA4E   |.  8B59 04                   MOV EBX,DWORD PTR DS:[ECX+4]
6FC9EA51   |.  F7E2                      MUL EDX
6FC9EA53   |.  03C3                      ADD EAX,EBX
6FC9EA55   |.  55                        PUSH EBP
6FC9EA56   |.  13D5                      ADC EDX,EBP
6FC9EA58   |.  8901                      MOV DWORD PTR DS:[ECX],EAX
6FC9EA5A   |.  8951 04                   MOV DWORD PTR DS:[ECX+4],EDX
6FC9EA5D   |.  33D2                      XOR EDX,EDX
6FC9EA5F   |.  B9 07000000               MOV ECX,7
6FC9EA64   |.  F7F1                      DIV ECX
6FC9EA66   |.  8B47 08                   MOV EAX,DWORD PTR DS:[EDI+8]
6FC9EA69   |.  8B0C95 [color=#6400ff]1C40D36F[/color]           MOV ECX,DWORD PTR DS:[EDX*4+6FD3401C] <--- std gem table
6FC9EA70   |.  8D5424 20                 LEA EDX,DWORD PTR SS:[ESP+20]
6FC9EA74   |.  8988 B8000000             MOV DWORD PTR DS:[EAX+B8],ECX
6FC9EA7A   |.  8B4E 04                   MOV ECX,DWORD PTR DS:[ESI+4]
6FC9EA7D   |.  52                        PUSH EDX
6FC9EA7E   |.  8B57 08                   MOV EDX,DWORD PTR DS:[EDI+8]
6FC9EA81   |.  6A 02                     PUSH 2
6FC9EA83   |.  E8 3814FBFF               CALL D2Game.6FC4FEC0

ACT 2 QUEST REWARD CODE LOCATION :
**********************************

A2Q1 - Book of Skill Spawn :

Code: Select all

6FCA0049   8B57 0C          MOV EDX,DWORD PTR DS:[EDI+C]
6FCA004C   8B0F             MOV ECX,DWORD PTR DS:[EDI]
6FCA004E   68 61737320      PUSH 20737361
6FCA0053   E8 B803FBFF      CALL D2Game.6FC50410

A2Q1 - Book of Skill Usage :

Code: Select all

6FC48248   6A 00            PUSH 0
6FC4824A   6A 01            PUSH 1
6FC4824C   6A 05            PUSH 5
6FC4824E   56               PUSH ESI
6FC4824F   E8 66360D00      CALL <JMP.&D2Common.#10518>

ACT 3 QUEST REWARD CODE LOCATION :
**********************************

A3Q1 - Potion of life Spawn :

Code: Select all

6FCAA7A3   8B56 0C          MOV EDX,DWORD PTR DS:[ESI+C]
6FCAA7A6   8B0E             MOV ECX,DWORD PTR DS:[ESI]
6FCAA7A8   6A 01            PUSH 1
6FCAA7AA   6A 02            PUSH 2
6FCAA7AC   6A 00            PUSH 0
6FCAA7AE   68 78797A20      PUSH 207A7978
6FCAA7B3   E8 38B6FEFF      CALL D2Game.6FC95DF0

A3Q4 - Potion of life Usage :

Code: Select all

6FC48356   6A 00            PUSH 0
6FC48358   68 00140000      PUSH 1400
6FC4835D   6A 07            PUSH 7
6FC4835F   56               PUSH ESI
6FC48360   E8 55350D00      CALL <JMP.&D2Common.#10518>

A3Q2 - Ring of Ormus Spawn:

Code: Select all

6FCA96F7   6A 01            PUSH 1
6FCA96F9   6A 06            PUSH 6 // rare type
6FCA96FB   52               PUSH EDX
6FCA96FC   8B56 0C          MOV EDX,DWORD PTR DS:[ESI+C]
6FCA96FF   68 72696E20      PUSH 206E6972 // ring
6FCA9704   E8 E7C6FEFF      CALL D2Game.6FC95DF0

A3Q1 - Lam Esen Tome spawn :

Code: Select all

6FCA6EB9   8B5424 0C        MOV EDX,DWORD PTR SS:[ESP+C]
6FCA6EBD   8B4F 04          MOV ECX,DWORD PTR DS:[EDI+4]
6FCA6EC0   68 62626220      PUSH 20626262
6FCA6EC5   E8 4695FAFF      CALL D2Game.6FC50410

A3Q1 - Lam Esen Tome Usage :

Code: Select all

6FCA74C4   |.  6A 00                     PUSH 0
6FCA74C6   |.  6A 05                     PUSH 5
6FCA74C8   |.  6A 04                     PUSH 4
6FCA74CA   |.  56                        PUSH ESI
6FCA74CB   |.  E8 EA430700               CALL <JMP.&D2Common.#10518>

ACT 4 QUEST REWARD CODE LOCATION :
**********************************

A4Q1 - Izual Quest Skill Point Bonus :

Code: Select all

6FCADBDF   53               PUSH EBX
6FCADBE0   6A 02            PUSH 2
6FCADBE2   6A 05            PUSH 5
6FCADBE4   51               PUSH ECX
6FCADBE5   E8 D0DC0600      CALL <JMP.&D2Common.#10518>

A4Q2 - Hellforge Rune Drop :

Code: Select all

6FCB0DA0   C74424 14 54B7D3 MOV DWORD PTR SS:[ESP+14],D2Game.6FD3B754>
6FCB0DA8   8A41 6D          MOV AL,BYTE PTR DS:[ECX+6D]
6FCB0DAB   48               DEC EAX
6FCB0DAC   74 0D            JE SHORT D2Game.6FCB0DBB
6FCB0DAE   48               DEC EAX
6FCB0DAF   75 12            JNZ SHORT D2Game.6FCB0DC3
6FCB0DB1   C74424 14 ACB7D3 MOV DWORD PTR SS:[ESP+14],6FD3B7AC
6FCB0DB9   EB 08            JMP SHORT D2Game.6FCB0DC3
6FCB0DBB   C74424 14 80B7D3 MOV DWORD PTR SS:[ESP+14],6FD3B780
6FCB0DC3   E8 B832FEFF      CALL D2Game.6FC94080

A4Q2 - Hellforge Rune Table :

Code: Select all

6FD3B754  72 30 31 20 72 30 32 20 72 30 33 20 72 30 34 20  r01 r02 r03 r04
6FD3B764  72 30 35 20 72 30 36 20 72 30 37 20 72 30 38 20  r05 r06 r07 r08
6FD3B774  72 30 39 20 72 31 30 20 72 31 31 20 72 31 32 20  r09 r10 r11 r12
6FD3B784  72 31 33 20 72 31 34 20 72 31 35 20 72 31 36 20  r13 r14 r15 r16
6FD3B794  72 31 37 20 72 31 38 20 72 31 39 20 72 32 30 20  r17 r18 r19 r20
6FD3B7A4  72 32 31 20 72 32 32 20 72 31 35 20 72 31 36 20  r21 r22 r15 r16
6FD3B7B4  72 31 37 20 72 31 38 20 72 31 39 20 72 32 30 20  r17 r18 r19 r20
6FD3B7C4  72 32 31 20 72 32 32 20 72 32 33 20 72 32 34 20  r21 r22 r23 r24
6FD3B7D4  72 32 35 20 67 70 76 20 67 70 72 20 67 70 62 20  r25 gpv gpr gpb
6FD3B7E4  67 70 79 20 67 70 67 20 67 70 77 20 73 6B 7A 20  gpy gpg gpw skz
6FD3B7F4  67 7A 76 20 67 6C 72 20 67 6C 62 20 67 6C 79 20  gzv glr glb gly
6FD3B804  67 6C 67 20 67 6C 77 20 73 6B 6C 20 67 73 76 20  glg glw skl gsv
6FD3B814  67 73 72 20 67 73 62 20 67 73 79 20 67 73 67 20  gsr gsb gsy gsg
6FD3B824  67 73 77 20 73 6B 75 20                          gsw sku

ACT 5 QUEST REWARD CODE LOCATION :
**********************************

A5Q1 : item socket by Larzuk

d2game.dll

Code: Select all

6FCCA4CA  CMP EAX,4      ; EAX has item grade
6FCCA4CD  JE SHORT D2Game.6FCCA4E6
6FCCA4CF  JLE D2Game.6FCCA556   ; low, normal, superior
6FCCA4D5  CMP EAX,9
6FCCA4D8  JG SHORT D2Game.6FCCA556
6FCCA4DA  CMP EBP,1                 ; set, rare, unique, crafted, tempered
6FCCA4DD  JL SHORT D2Game.6FCCA556
6FCCA4DF  MOV EBP,1
6FCCA4E4  JMP SHORT D2Game.6FCCA556
6FCCA4E6  CMP EBP,2                 ; magical
6FCCA4E9  JL SHORT D2Game.6FCCA4F4
6FCCA4EB  MOV EBP,2

d2common.dll

Code: Select all

03E6D68C  CMP EBP,1                       ;  set, unique
03E6D68F  JL SHORT D2Common.03E6D6BA
03E6D691  MOV EBP,1
03E6D696  JMP SHORT D2Common.03E6D6BA
03E6D698  CMP EBP,2                       ;  rare
03E6D69B  JL SHORT D2Common.03E6D6BA
03E6D69D  MOV EBP,2
03E6D6A2  JMP SHORT D2Common.03E6D6BA
03E6D6A4  CMP EBP,4                       ;  magical
03E6D6A7  JL SHORT D2Common.03E6D6BA
03E6D6A9  MOV EBP,4
03E6D6AE  JMP SHORT D2Common.03E6D6BA
03E6D6B0  CMP EBP,3                       ;  crafted, tempered
03E6D6B3  JL SHORT D2Common.03E6D6BA
03E6D6B5  MOV EBP,3
03E6D6BA  MOV EAX,DWORD PTR [EDI]         ; low, normal, superior

A5Q2 - Rune Drop by Qual-Kehk :

Code: Select all

6FCB2357   PUSH 6
6FCB2359   PUSH 24
6FCB235B   PUSH EBP
6FCB235C   MOV DWORD PTR SS:[ESP+20],3              ;  number of runes granted
6FCB2364   CALL <JMP.&D2Common.#11107>
6FCB2369   TEST EAX,EAX
6FCB236B   JE SHORT D2Game.6FCB2377
6FCB236D   MOV DWORD PTR SS:[ESP+14],2
6FCB2375   JMP SHORT D2Game.6FCB238D
6FCB2377   PUSH 7
6FCB2379   PUSH 24
6FCB237B   PUSH EBP
6FCB237C   CALL <JMP.&D2Common.#11107>
6FCB2381   TEST EAX,EAX
6FCB2383   JE SHORT D2Game.6FCB238D
6FCB2385   MOV DWORD PTR SS:[ESP+14],1
6FCB238D   MOV EAX,DWORD PTR SS:[ESP+14]
6FCB2391   XOR EBX,EBX
6FCB2393   TEST EAX,EAX
6FCB2395   JLE D2Game.6FCB2448
6FCB239B   /MOV ECX,DWORD PTR DS:[EBX*4+6FD3CD78]   ;  reward rune list pointer
6FCB23A2   |MOV EDX,DWORD PTR DS:[EDI+C]
6FCB23A5   |PUSH 1                                  ; /Arg4 = 00000001
6FCB23A7   |PUSH 2                                  ; |Arg3 = 00000002
6FCB23A9   |PUSH 0                                  ; |Arg2 = 00000000
6FCB23AB   |PUSH ECX                                ; |Arg1
6FCB23AC   |MOV ECX,DWORD PTR DS:[EDI]              ; |
6FCB23AE   |CALL D2Game.6FC95DF0                    ; \D2Game.6FC95DF0
6FCB23B3   |TEST EAX,EAX
6FCB23B5   |JE SHORT D2Game.6FCB23BC
6FCB23B7   |MOV BYTE PTR SS:[ESP+13],1
6FCB23BC   |MOV EAX,DWORD PTR SS:[ESP+14]
6FCB23C0   |INC EBX
6FCB23C1   |CMP EBX,EAX
6FCB23C3   \JL SHORT D2Game.6FCB239B

A5Q2 - Rune Drop Table :

Code: Select all

6FD3CD78 72 30 37 20 72 30 38 20 72 30 39 20      r07 r08 r09

A5Q3 : Rescue Anya reward discussion / item quality

Code: Select all

6FCB3F24   |.  6A [color=#6400ff]06[/color]                     PUSH [color=#6400ff]6[/color]

4 = magic item, 5 = set item, 6 = rare item, 7 = uniques item

A5Q4 : name on item by Anya

Code: Select all

 - Not Found Yet

A5Q5 : some XP and level by Ancients

Code: Select all

6FCB6C36   |.  BB C05C1500               MOV EBX,155CC0                 ; (1,400,000 - Normal)
6FCB6C3B   |.  8A47 6D                   MOV AL,BYTE PTR DS:[EDI+6D]
6FCB6C3E   |.  48                        DEC EAX
6FCB6C3F   |.  74 0A                     JE SHORT D2Game.6FCB6C4B
6FCB6C41   |.  48                        DEC EAX
6FCB6C42   |.  75 0C                     JNZ SHORT D2Game.6FCB6C50
6FCB6C44   |.  BB 005A6202               MOV EBX,2625A00                ; (Hell - 40,000,000)
6FCB6C49   |.  EB 05                     JMP SHORT D2Game.6FCB6C50
6FCB6C4B   |>  BB 002D3101               MOV EBX,1312D00                ; (Nightmare - 20,000,000)
•••
6FCB6CAA   |.  3BDD                      CMP EBX,EBP                            ; award limited to +1 level
6FCB6CAC   |.  7E 02                     JLE SHORT D2Game.6FCB6CB0
6FCB6CAE   |.  8BDD                      MOV EBX,EBP

[RicFaith]

would you have nice notes on the quest handler that you could share a bit of? I figure Havvoric and I could trace some of these offsets to find it, but if you have them on hand we would be most appreciative! Merci beaucoup!

[Joel]

no i just have those references ...

[Myhrginoc]

SVR has a sticky in this forum on quest code. The real problem is each quest is largely made up of dedicated procedures. They can be found in d2game.dll if you feel spunky, approximately between 6FC93B60 and 6FCB9A30 (yes, that's quite a spread).

[CorniI]

Today i've digged into the 1.11b stuff, here are the results
a1q1 (Den of Evil) Quest Reward:

Code: Select all

6FC7BE92   . 6A 00          PUSH 0;layer
6FC7BE94   . 6A 01          PUSH 1;number of skill points
6FC7BE96   . 6A 05          PUSH 5;[acronym="ItemStatCost"]ISC[/acronym] for skills
6FC7BE98   . 50             PUSH EAX
6FC7BE99   . E8 16E5FAFF    CALL <JMP.&D2Common.#10627>

a1q3 (Cain)
spawn scroll

Code: Select all

6FC7C26D   . 8B45 08        MOV EAX,DWORD PTR SS:[EBP+8]
6FC7C270   . 8B5D 00        MOV EBX,DWORD PTR SS:[EBP]
6FC7C273   . 68 626B6420    PUSH 20646B62
6FC7C278   . E8 53210700    CALL D2Game.6FCEE3D0  

a1q5 (Imbue) reward

Code: Select all

6FCB3033     C74424 68 0700>MOV DWORD PTR SS:[ESP+68],6; Itemtype, look at the corresponding 1.10 for more infos)

a2q1 (Radament) spawn Book of Skills

Code: Select all

6FCD6B04   > 68 61737320    PUSH 20737361                            ;  spawn book of skills
6FCD6B09   . 8BC7           MOV EAX,EDI
6FCD6B0B   . E8 C0780100    CALL D2Game.6FCEE3D0

use Book of Skills

Code: Select all

6FC6BCA8  |. 6A 00          PUSH 0                                   ;  same like DoE code
6FC6BCAA  |. 6A 01          PUSH 1
6FC6BCAC  |. 6A 05          PUSH 5
6FC6BCAE  |. 57             PUSH EDI
6FC6BCAF  |. E8 00E7FBFF    CALL <JMP.&D2Common.#10627>

a3q1 spawn Potion of Life

Code: Select all

6FC3E23B   . 6A 01          PUSH 1                                   ; /Arg3 = 00000001
6FC3E23D   . 6A 02          PUSH 2                                   ; |Arg2 = 00000002
6FC3E23F   . 52             PUSH EDX                                 ; |Arg1
6FC3E240   . 8B57 0C        MOV EDX,DWORD PTR DS:[EDI+C]             ; |
6FC3E243   . 33C0           XOR EAX,EAX                              ; |
6FC3E245   . B9 78797A20    MOV ECX,207A7978                         ; |spawn potion of life
6FC3E24A   . E8 316B0500    CALL D2Game.6FC94D80    

use potion of life

Code: Select all

6FC6BCF7  |. 6A 00          PUSH 0                                   ;  potion of life usage
6FC6BCF9  |. 68 00140000    PUSH 1400;1400 in dez are 5120, 5120/156=20 ;)
6FC6BCFE  |. 6A 07          PUSH 7
6FC6BD00  |. 57             PUSH EDI
6FC6BD01  |. E8 AEE6FBFF    CALL <JMP.&D2Common.#10627>

a3q2 (ormus) Ring spawn

Code: Select all

6FC3F8AD   . 6A 01          PUSH 1                                   ; /Arg3 = 00000001
6FC3F8AF     6A 06          PUSH 6;ItemType
6FC3F8B1   . 51             PUSH ECX                                 ; |Arg1
6FC3F8B2   . B9 72696E20    MOV ECX,206E6972                         ; ormus
6FC3F8B7   . E8 C4540500    CALL D2Game.6FC94D80   

a3q4 (Lam Esen) Foliant Spawn

Code: Select all

6FC3E8C8   . 6A 00          PUSH 0                                   ; /Arg6 = 00000000
6FC3E8CA   . 6A FF          PUSH -1                                  ; |Arg5 = FFFFFFFF
6FC3E8CC   . 6A 00          PUSH 0                                   ; |Arg4 = 00000000
6FC3E8CE   . 8D4424 18      LEA EAX,DWORD PTR SS:[ESP+18]            ; |
6FC3E8D2   . 50             PUSH EAX                                 ; |Arg3
6FC3E8D3   . C782 B8000000 >MOV DWORD PTR DS:[EDX+B8],20626262       ; |
6FC3E8DD   . 8B4F 04        MOV ECX,DWORD PTR DS:[EDI+4]             ; |
6FC3E8E0   . 8B1F           MOV EBX,DWORD PTR DS:[EDI]               ; |
6FC3E8E2   . 6A 02          PUSH 2                                   ; |Arg2 = 00000002
6FC3E8E4   . 51             PUSH ECX                                 ; |Arg1
6FC3E8E5   . E8 B62D0B00    CALL D2Game.6FCF16A0      

reward

Code: Select all

6FC3BC83   . 6A 00          PUSH 0
6FC3BC85   . 6A 05          PUSH 5
6FC3BC87   . 6A 04          PUSH 4
6FC3BC89   . 56             PUSH ESI
6FC3BC8A   . E8 25E7FEFF    CALL <JMP.&D2Common.#10627>

a4q1 (Izual) reward

Code: Select all

6FCCE98F   . 6A 00          PUSH 0
6FCCE991     6A 02          PUSH 2
6FCCE993   . 6A 05          PUSH 5
6FCCE995   . 51             PUSH ECX
6FCCE996   . E8 19BAF5FF    CALL <JMP.&D2Common.#10627>

a5q5 (Ancients) (untested, but this is it )
exp

Code: Select all

6FC73BC8  |. BB C05C1500    MOV EBX,155CC0
6FC73BCD  |. 74 0A          JE SHORT D2Game.6FC73BD9
6FC73BCF  |. 48             DEC EAX
6FC73BD0  |. 75 0C          JNZ SHORT D2Game.6FC73BDE
6FC73BD2  |. BB 005A6202    MOV EBX,2625A00                          ;  Case 2 of switch 6FC73BC7
6FC73BD7  |. EB 05          JMP SHORT D2Game.6FC73BDE
6FC73BD9  |> BB 002D3101    MOV EBX,1312D00                          ;  Case 1 of switch 6FC73BC7

level limit:

Code: Select all

6FC73C38  |. 3BDD           CMP EBX,EBP
6FC73C3A  |. 7E 04          JLE SHORT D2Game.6FC73C40
6FC73C3C  |. 8BDD           MOV EBX,EBP

again, that's untested, but to remove the level limit you should try to change JLE into JMP

that's the stuff I found the last 1-2hours, additions are welcome
Corni

[Nefarius]

All the quest code is handled through the central quest init that builds the quest controller inside pGame, with the exception fo a few graphical effects + quest log on the client (npc quest speech is server controlled, but has a fixup table on the client, that is unknown messages will show up as "invalid quest").

The rest of the code, including all the rewards are controlled via the same structure as in v1.10.

First there is the init structure:

Code: Select all

6FC791B0 00000000 00000064 00000001 00000000 00000000
6FC7C000 00000000 00000064 00000000 00000001 00000001
6FC7F860 00000000 00000064 00000000 00000002 00000002
6FC7D870 00000000 00000064 00000000 00000003 00000003
6FC7F580 00000000 00000064 00000000 00000004 00000004
6FC7EE30 00000000 00000064 00000000 00000005 00000005
6FC7E6C0 00000000 00000064 00000000 00000006 00000006
6FCD6B80 00000001 00000064 00000001 00000007 00000008
6FCD9570 00000001 00000064 00000000 00000008 00000009
6FCD9900 00000001 00000064 00000001 00000009 0000000A
6FCD8EB0 00000001 00000064 00000000 0000000A 0000000B
6FCDBCF0 00000001 00000064 00000000 0000000B 0000000C
6FCD8AB0 00000001 00000064 00000000 0000000C 0000000D
6FCDB690 00000001 00000064 00000000 0000000D 0000000E
6FCD6C80 00000001 00000064 00000001 0000001A 0000001E
6FCD5900 00000001 00000064 00000001 0000001B 0000001F
6FC3A970 00000002 00000064 00000001 0000000E 00000010
6FC3E740 00000002 00000064 00000000 0000000F 00000011
6FC3D060 00000002 00000064 00000000 00000010 00000012
6FC3F9C0 00000002 00000064 00000000 00000011 00000013
6FC3E650 00000002 00000064 00000000 00000012 00000014
6FC3E580 00000002 00000064 00000000 00000013 00000015
6FC3F3D0 00000002 00000064 00000000 00000014 00000016
6FC39180 00000002 00000064 00000000 0000001C 00000020
6FCCDCE0 00000003 00000064 00000001 00000015 00000018
6FCCF090 00000003 00000000 00000000 00000016 00000019
6FCD0840 00000003 00000000 00000000 00000017 0000001A
6FCCEE40 00000003 00000000 00000000 00000018 0000001B
6FC79270 00000000 00000064 00000001 00000019 0000001D
6FCCD880 00000003 00000064 00000001 0000001D 00000021
6FC72260 00000004 00000000 00000000 0000001F 00000023
6FC72DB0 00000004 00000000 00000000 00000020 00000024
6FC75F50 00000004 00000000 00000000 00000021 00000025
6FC73700 00000004 00000000 00000000 00000022 00000026
6FC74BE0 00000004 00000000 00000000 00000023 00000027
6FC76440 00000004 00000000 00000000 00000024 00000028

Code: Select all

struct QuestInit
{
	void* fpInit;			// +00
	int actNo;				// +04
	int version;			// +08
	BOOL b;				// +0C
	int questNo;			// +10
	int questNo2;			// +14
};

Each of those init functions looks like this, but most of the more complex ones ofc also create their own data structures:

Code: Select all

6FC791B0   .  8BD1          MOV EDX,ECX
6FC791B2   .  56            PUSH ESI
6FC791B3   .  57            PUSH EDI
6FC791B4   .  8DB2 A0000000 LEA ESI,DWORD PTR DS:[EDX+A0]
6FC791BA   .  33C0          XOR EAX,EAX
6FC791BC   .  8BFE          MOV EDI,ESI
6FC791BE   .  B9 0F000000   MOV ECX,0F
6FC791C3   .  F3:AB         REP STOS DWORD PTR ES:[EDI]
6FC791C5   .  5F            POP EDI
6FC791C6   .  C706 E084C76F MOV DWORD PTR DS:[ESI],D2Game.6FC784E0					event0 - npc init
6FC791CC   .  C782 CC000000>MOV DWORD PTR DS:[EDX+CC],D2Game.6FC78560					event11 - npc msg end

6FC791D6   .  C782 DC000000>MOV DWORD PTR DS:[EDX+DC],D2Game.6FD25950					speech bank
6FC791E0   .  C642 0A 01    MOV BYTE PTR DS:[EDX+A],1
6FC791E4   .  8842 0C       MOV BYTE PTR DS:[EDX+C],AL
6FC791E7   .  8842 0B       MOV BYTE PTR DS:[EDX+B],AL
6FC791EA   .  8942 18       MOV DWORD PTR DS:[EDX+18],EAX
6FC791ED   .  8982 E0000000 MOV DWORD PTR DS:[EDX+E0],EAX
6FC791F3   .  C782 E4000000>MOV DWORD PTR DS:[EDX+E4],D2Game.6FC76B70					return 0
6FC791FD   .  C782 E8000000>MOV DWORD PTR DS:[EDX+E8],D2Game.6FC76B40					check if the quest is active

6FC79207   .  5E            POP ESI
6FC79208   .  C3            RETN

Here is an example of Act1Quest1 entirely in C++ (the act intro from warriv)

Code: Select all

bool __fastcall A1Q1_CallbackFunc(QuestData* pQuest, int npcNo, D2UnitStrc* pPlayer, D2QuestStrc* pQuestRecord, D2UnitStrc* pNpc)
{
	return false;
}

bool __fastcall A1Q1_QuestActive(QuestData* pQuest, int npcNo, D2UnitStrc* pPlayer, D2QuestStrc* pQuestRecord, D2UnitStrc* pNpc)
{
	if (npcNo != MONSTER_WARRIV1)
		return false;

	if (Common10753(pQuestRecord,VQUEST_ACT1_INTRODUCTION,VFLAG_REWARD_GRANTED))
		return false;

	return true;
}

void __fastcall A1Q1_NpcActivate(QuestData* pQuest, QuestArg* pArgs)
{
	if (pArgs->pTarget->nIndex != MONSTER_WARRIV1)
		return;

	if (Common10753(COMMON_GetQuestStructure(pArgs->pPlayer,pArgs->pGame->gDiff),VQUEST_ACT1_INTRODUCTION,VFLAG_REWARD_GRANTED))
		return;

	int str = 0;
	if (pArgs->pPlayer->nIndex == CLASS_PALADIN)
		str = 1;

	Common10288(pArgs->hText,str,0);
}

void __fastcall A1Q1_NpcEndMsg(QuestData* pQuest, QuestArg* pArgs)
{
	if (pArgs->npcNo != MONSTER_WARRIV1)
		return;

	if (pArgs->wBool1 > 1)
		return;

	Common10930(COMMON_GetQuestStructure(pArgs->pPlayer,pArgs->pGame->gDiff),VQUEST_ACT1_INTRODUCTION,VFLAG_REWARD_GRANTED);
}

void __fastcall A1Q1_InitQuest(QuestData* pQuest)
{
	pQuest->bBool2 = true;
	pQuest->fpCallback[0] = A1Q1_NpcActivate;
	pQuest->fpCallback[11] = A1Q1_NpcEndMsg;
	pQuest->fpCallback2[0] = A1Q1_CallbackFunc;
	pQuest->fpCallback2[1] = A1Q1_QuestActive;
}

...

You can find the reward code for every single quest by looking at the init functions, and the functions it puts in the callback members of the main quest data structure.

There is some other extra quest code related to super uniques, quest bosses which is tied into the monster init, superunique init and ai code, but this is mostly just quest activation when specific units spawn, and triggering an event when the unit dies.

[weapon-x]

[1.10] A5Q2 Minor Stuff

First of all, please pardon my newbness in CE

Code: Select all

6FCB2357   PUSH 6
6FCB2359   PUSH 24
6FCB235B   PUSH EBP
6FCB235C   MOV DWORD PTR SS:[ESP+20],3              ;  number of runes granted
6FCB2364   CALL <JMP.&D2Common.#11107>
6FCB2369   TEST EAX,EAX
6FCB236B   JE SHORT D2Game.6FCB2377
6FCB236D   MOV DWORD PTR SS:[ESP+14],2
6FCB2375   JMP SHORT D2Game.6FCB238D
6FCB2377   PUSH 7
6FCB2379   PUSH 24
6FCB237B   PUSH EBP
6FCB237C   CALL <JMP.&D2Common.#11107>
6FCB2381   TEST EAX,EAX
6FCB2383   JE SHORT D2Game.6FCB238D
6FCB2385   MOV DWORD PTR SS:[ESP+14],1
6FCB238D   MOV EAX,DWORD PTR SS:[ESP+14]
6FCB2391   XOR EBX,EBX
6FCB2393   TEST EAX,EAX
6FCB2395   JLE D2Game.6FCB2448
6FCB239B   /MOV ECX,DWORD PTR DS:[EBX*4+6FD3CD78]   ;  reward rune list pointer
6FCB23A2   |MOV EDX,DWORD PTR DS:[EDI+C]
6FCB23A5   |PUSH 1                                  ; /Arg4 = 00000001
6FCB23A7   |PUSH 2                                  ; |Arg3 = 00000002
6FCB23A9   |PUSH 0                                  ; |Arg2 = 00000000
6FCB23AB   |PUSH ECX                                ; |Arg1
6FCB23AC   |MOV ECX,DWORD PTR DS:[EDI]              ; |
6FCB23AE   |CALL D2Game.6FC95DF0                    ; \D2Game.6FC95DF0
6FCB23B3   |TEST EAX,EAX
6FCB23B5   |JE SHORT D2Game.6FCB23BC
6FCB23B7   |MOV BYTE PTR SS:[ESP+13],1
6FCB23BC   |MOV EAX,DWORD PTR SS:[ESP+14]
6FCB23C0   |INC EBX
6FCB23C1   |CMP EBX,EAX
6FCB23C3   \JL SHORT D2Game.6FCB239B

seems wrong tagged

Code: Select all

6FCB236D   MOV DWORD PTR SS:[ESP+14],2

this one holds the number of runes granted...
which is odd...

i replaced r07 from the rune table used by this quest
to my item-code... turns out the reward was reduced to 2 items,
my custom item and r08...

out of curiousity i changed the code @6FCB236D to 3...
and the game gave me 3 items...
my new item, r08 and r09...

since i only needed 1 item for the reward, i went on changing
6FCB236D code to MOV DWORD PTR SS:[ESP+14],1

and everything seems perfect

cheers

[MrOzturq]

i replaced r07 from the rune table used by this quest

Im JUST started to learning CE. I dont know how to do this part (At quote)
Where i must write the code to change the reward?

[kidpaddle94]

i replaced r07 from the rune table used by this quest

Im JUST started to learning CE. I dont know how to do this part (At quote)
Where i must write the code to change the reward?

Please stop resurrecting old threads like this, you've done it more than three times yet.
Also, the rune rewards are stored in memory tables, which you can either reallocate, or just modify itemcodes stored in there.

[kingpin]

i replaced r07 from the rune table used by this quest

Im JUST started to learning CE. I dont know how to do this part (At quote)
Where i must write the code to change the reward?

Please stop resurrecting old threads like this, you've done it more than three times yet.
Also, the rune rewards are stored in memory tables, which you can either reallocate, or just modify itemcodes stored in there.

He is asking a question, so it's relevant ask it in this thread or he could made new one and linked to this.

It's not relevant to act a moderator then you aren't. so plz stop tell others what to do.

[MrOzturq]

I just asked question, no problem with it, i think...

[weapon-x]

Update !!

A1Q2 Hireling Reward

Code: Select all

 
6FC988C9   68 96000000      PUSH 96                                 ;Seller      *see hireling.txt
6FC988CE   E8 4D2C0300      CALL D2Game.6FCCB520            ;Spawn Hireling

wasn't able to practice ce this whole week, my fvking job gets on the way

surprisingly, it only takes 3 params, correct me if i am wrong... i haven't messed with this code yet...

*you can nope 6FC988C9 and 6FC988CE to remove hireling reward...

i already replaced the reward and make it grant some stats instead

cheers

[Necrolis]

surprisingly, it only takes 3 params, correct me if i am wrong... i haven't messed with this code yet...

viewtopic.php?p=452927#p452927

[weapon-x]

so the code has been posted all along

i thought i am the one who found it first tehehehe

thank you sir, now the params are crystal clear

cheers

[kidpaddle94]

so the code has been posted all along

i thought i am the one who found it first tehehehe

Some like Necrolis have replaced a damn good part of the game code and analyzed in depth even more. I would be really surprised if you were to find something first

On a side note, the function referenced is what spawns an hireling and "attach" it to the player? Sounds interesting.
Will have to find and look into that on 1.13c

[weapon-x]

Some like Necrolis have replaced a damn good part of the game code and analyzed in depth even more. I would be really surprised if you were to find something first

well, it doesn't matter who finds em first, for as long as i am learning something, and able to find stuff on my own... i am cool with that


anyhow, i'll mess with this code some other time

good luck

[weapon-x]

may i humbly request the admin to please sticky /update this awesome thread

for future references of those who will walk the CE path

thankz

[kingpin]

most topics got their sticky removed as we can't have everyone, there is a sticky index with links to relevant threads. This is in it, so is easy find it from there.

[Sampson]

Does anyone know where the Nihlathak portal code is?
I want to make it so the Red Portal stays open if you complete Nihlathak Quest and you already have the waypoint to him

[Necrolis]

Does anyone know where the Nihlathak portal code is?
I want to make it so the Red Portal stays open if you complete Nihlathak Quest and you already have the waypoint to him

This is the code in D2Game responsible for it:

Code: Select all

6FC7D577                                               > \8A85 87000000                                           MOV AL,BYTE PTR SS:[EBP+87]
6FC7D57D                                               .  84C0                                                    TEST AL,AL
6FC7D57F                                               .  74 13                                                   JE SHORT D2Game.6FC7D594
6FC7D581                                               .  8A85 88000000                                           MOV AL,BYTE PTR SS:[EBP+88]
6FC7D587                                               .  84C0                                                    TEST AL,AL
6FC7D589                                               .  75 09                                                   JNZ SHORT D2Game.6FC7D594

I can't really test anything, so its up to you just fiddle with the jumps (nopping both should do the trick).

[Sampson]

This works! thanks!

What happens if after you kill nihlathak and close the game and then reopen it, the portal is gone, but if you talk to anya for whatever reason she opens it again. noping out the first jump is enough to get her to do it.

location for 1.13c is 5D574 and the second jump is 5D589