:
2k! Ill go to my friend named pirate.  Oh yer, the VB and VH files in the pc version are NOT openable by any playstation sound viewer but you can open the VB an VH files in the Playstation version of the game. i really wanna replace sounds in the game. Badly! And go here: http://www.oddworldforums.net/showthread.php?p=364796
i posted some sounds i ripped from ao ps version.
Edit: Ok i have the freeware version. All i want to know is how do you force actions. Example: Force ddcheat menu to pop up. |
You look at the functions and trace through them, eventually you will find one early on in the games start up thats comparing command line argument strings, hence you will see a "its_me_your_father" string some where. Thus the best plan of action is:
1. Find this string in the "strings" view
2. Find all XREFS to it, there is likely only one in the command line argument parsing function
3. Study the code and figure out what its doing with it, you'll find its looking for the string you found the XREF to and then doing a few more things (it will call a function, reverse what this is doing and you'll see its reading the keyboard, you'll see the constant it passes to the keyboard reading function is VK_ENTER or something)
For anything else that cant be found by tracing references to a string requires a lot more work. I found corrupting a file format I'm trying to reverse so that it crashes the game is the best way. When it crashes you can set break points in the call stack and then replace the file with a good version and check what some of the functions are doing, one of the MUST deal with the file that you screwed up.
Can you post a VB and VH file from both the PC and PSX version from the same lvl archive so we can see what is different between them?
Edit: Oh by the way for the "forcing on bit" that can only really be done at run time by editing the register contents with IDA when you hit your breakpoints. For patching an exe OllyDbg is better so you should do this:
1. Find the instruction(s) location using Ida after you've figured everything out
2. Use OllyDbg to patch those instructions and save a patched exe (Or write your own patching Util since you know the hex for the instructions you want to insert, and the offset of where they start in the binary)
Final edit: Unless you know x86 asm, C, and C++ this is going to be very hard or impossible for you to do most things since you won't know whats going on. When looking at some x86 code you need to know if it was a C function or a C++ function. This means you need to know how the compiler implements vtables and how vtables work and a ton of other stuff. You are effectively trying to get c or c++ representation of what the x86 code is doing. So if you can't read the higher level language you will be screwed.
E.g
:
.text:0048EF50 ; int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
.text:0048EF50 _WinMain@16 proc near
.text:0048EF50
.text:0048EF50 hInstance= dword ptr 4
.text:0048EF50 hPrevInstance= dword ptr 8
.text:0048EF50 lpCmdLine= dword ptr 0Ch
.text:0048EF50 nShowCmd= dword ptr 10h
.text:0048EF50
.text:0048EF50 mov eax, [esp+hInstance]
.text:0048EF54 mov ecx, [esp+hPrevInstance]
.text:0048EF58 mov edx, [esp+nShowCmd]
.text:0048EF5C mov gInstance, eax
.text:0048EF61 mov eax, [esp+lpCmdLine]
.text:0048EF65 mov dword ptr gPrevInstance, ecx
.text:0048EF6B mov gShowCmd, edx
.text:0048EF71 mov gcmdLinePtr, eax
.text:0048EF76 call game_init
.text:0048EF7B mov eax, gExitCode
.text:0048EF80 retn 10h
.text:0048EF80 _WinMain@16
|
You can see I've renamed everything to what it is, such as gInstance which is a global that stores the app instance. I know this because I know that WinMain() is the entry point (you could figure this out from looking at MSDN though)
But you also need to know that when it was C code it would have looked like this:
:
int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, char* lpCmdLine, int nShowCmd)
{
gInstance = hInstance;
gPrevInstance = hPrevInstance;
gShowCmd = lpCmdLine;
gcmdLinePtr = pCmdLine;
game_init();
return gExitCode;
}
|
we have the same goal it would seem. 
