more savegames

[thunderchero]

So either rename and/or mov to new path? And same name twice to same directory = crash?

don't think windows would allow that...

So Delete_file_EAX prevents issues if same name is already in the directory and has no issues if no file there to delete.

in saw in de-bug it throws a silent error at 0051D894 (I saw error thrown, but no crash)

Best would be importing CopyFile to ASM pointer:

I asked that a week ago lol

Edit; have you seen code for "copy file" only thing I have seen is "move file"

[Spocks-cuddly-tribble]

don't think windows would allow that...

Just contemplating limitations of the imported functions. E.g. MoveFileA cannot replace another file, hence BotF must use DeleteFileA for last.sav.

I asked that a week ago lol

Yes, but I don't know how to edit/extend the import table. And Flocke is sick so I don't want to bother him right now.

57448C Imports from KERNEL32.dll
Trek.exe 0x173122 KERNEL32.dll / 0x17349A list of imported functions (list number + function name) but IDA doesn't show code to edit the ImportTable.

CFF Explorer -> 'Import Adder' looks interesting: viewtopic.php?p=53847#p53847

[thunderchero]

I hope Flocke get's feeling better soon.

CFF Explorer -> 'Import Adder' looks interesting: viewtopic.php?p=53847#p53847

I was able to get it imported to trek, but messed up trek.exe size and would not load (CFF Explorer said it was rebuilt properly lol)

import.jpg (135.08 KiB) Viewed 583 times

I used kernel32.dll from syswow64 folder to import copyfileA

edit
Right now patch works great just folder is 2 turns behind, but you still have auto and last for the missing turns.

I am still looking at moving game%d.sav files to saves folder, I have narrowed down issue to;

004F0184 E8 47 89 F4 FF                                  call    sub_438AD0

this sub is called 3 time but this call crashes game if it has folder offset "saves/game%d.sav"
if "saves//game%d.sav" game does not crash but load/save screens don't display saves

but I am still looking into issue now.

Note; sub 438AD0 is where it adds file name/descriptions to the load/save screens. it does this by inc ecx each time it loops though until it his limit at;

00438B34 66 83 F9 0C             cmp     cx, 0Ch

[Tethys]

Just a thought, try renaming the folder "saves/" to see if it will read them ??? (adjusting previous saving locations to "saves/" if they DO read)

It's a longshot but it's an easy shot.

Waste of time, you cannot use / in a folder or filename

Second thought, maybe it needs to be split up to first load the folder "saves" then the filename "game%.sav" rather than all at once? I don't know where I would find such example, closest thing I can think is loading a double float with 10 bytes. Something akin to "change working directory" or something ??

[Spocks-cuddly-tribble]

I was able to get it imported to trek, but messed up trek.exe size and would not load

Then let's try something sneaky. We removed sub_401080 DISK_CD_Version_check: viewtopic.php?p=57654#p57654

So 5744F8 GetDriveTypeA Import from KERNEL32.dll should be unused, unless this thunk has any meaning (might be used for movies?):

005734A6    jmp     ds:GetDriveTypeA

With sub_401080 removed this should work: (call cs:5744F8 new CopyFileA) https://learn.microsoft.com/en-us/windo ... -copyfilea

Code: Select all

NAME: GetDriveTypeA -> CopyFileA

>> 0x17368C 47 65 74 44 72 69 76 65 54 79 70 65 41
<< 0x17368C 43 6F 70 79 46 69 6C 65 41 00 00 00 00

No issues in BotF. Even movies work and OllyDbg loves it:

2E:FF15 F8445700   CALL DWORD PTR CS:[<&KERNEL32.CopyFileA>]    ;  KERNEL32.CopyFileA

Now you can:

438711 jmp loc_relocation

loc_relocation

copy updated! auto.sav -> your new name/location

add     esp, 80h
jmp 438717

But will copy auto.sav even when saving regular slots (i.e. overwrite updated file again).

To prevent this just check again.

cmp     ecx, 0FFFFFFF3h

If you want to copy/update from regular slots too just read file name string specified at 43868D instead of static auto.sav.

And new extra sub (or code) for CopyFileA is needed.

I am still looking at moving game%d.sav files to saves folder, I have narrowed down issue to;

004F0184 E8 47 89 F4 FF                                  call    sub_438AD0

this sub is called 3 time but this call crashes game if it has folder offset "saves/game%d.sav"
if "saves//game%d.sav" game does not crash but load/save screens don't display saves

If this is an issue with the string size limit for file names this might work (+X bytes each):

sub_438AD0 

00438ADD         mov     ebx, 0Dh

00438B0F         imul    edi, 0Dh

00438AD6         sub     esp, 10h
00438B3A         add     esp, 10h


sub_4F0170

004F01A4         add     ebx, 0Dh

12 * string limit

004F0174         sub     esp, 9Ch
004F01AB         add     esp, 9Ch


same for the other two calls of sub_438AD0

But sub_4F0250 is a bit tricky wrt ESP pointers

[thunderchero]

But sub_4F0250 is a bit tricky wrt ESP pointers

I can think of a few other words I could use....

it is a bit tricky on all registries mainly these...
AUTO:004F0291 83 C5 0D add ebp, 0Dh
AUTO:004F0294 83 C0 32 add eax, 32h
AUTO:004F0297 83 C3 18 add ebx, 18h

yeah started messing with this tonight, looks like with values I am using;
00438ADD mov ebx, 0Dh -> 1F
004F0174 sub esp, 9Ch -> 74 01 (+216)

all the values in sub_4F0250 like;
004F0256 sub esp, 0E60h -> 0D88h (so many and variations)
need to be decreased by (-216)
and
004F0291 add ebp, 0Dh -> 1F (only one so far in this sub)

with just doing 004F0256 and 004F02A9 code can loop though until game5.sav before I started seeing file name string getting overwritten by misplaced other code.

so I expect all similar values to 0E60h need to be decrease by -216 in sub_4F0250?
these 2 and a few others worry me (if when reading gameinfo from arc it may be good)
004F02C4 8D 44 24 0D lea eax, [esp+0E60h+str1]
004F02EA 8D 74 24 0D lea esi, [esp+0E60h+str1]

note; keep getting "File: arc.c, Line: 971, Can't find file" error lol (I know why now)

note; if I noop the 2 call's for sub_4F0250, save screen and load screen will load and I can even save game to correct location. but no files in load screen (like they are empty when they are not) and description text is all missing as expected.
funny thing is when I select a slot to save file name and description is correct. (reading from loaded gaminfo?)

will see what I can do tomorrow.

[thunderchero]

I am sorry to say with the saved game storing the file name in "gameinfo" file as 12 byte limit, It is making this project not worth the effort.
Plus I did a quick test moving saves to folder without changing limit using shorter folder/file name and was unable to load file from load screen even though they displayed file names and descriptions.

Here is my patch for turn by turn saving to folder with format of "race name"_"turn#".sav
Warning!!
Relocation patch is required before installing if not all ready installed.
"Saves" folder must be present or file will write as archive.tmp to install path
Notes;
these saves must be renamed and moved to install path to be loaded into game.
these files are small but will add up (200 files = 35mb)
if file present with same name and turn in saves folder it is deleted before new file is moved
checks turn 1 and 2 (turn 1 vanilla last.sav bug)
if turn 1 jump to 0043865A (create auto.sav, on turn 1 last.sav would be from different game)
if turn 2 jump to 0068C48A (auto.sav -> last.sav, create auto.sav)
else (last.sav -> new.sav, auto.sav -> last.sav, create auto.sav)
so current turn (auto) and turn before (last) would be in install path as before

saves folder.patch

(1.58 KiB) Downloaded 11 times

Code: Select all

NAME: Add "Saves" folder and saves each turn by race and turn #
AUTHOR: thunderchero
DESC: This patch uses the last.sav and renames and moves to new folder "Saves"
DESC: with the race and turn number as file name.  
DESC: Warning!! "Saves" folder must be present or file will write as archive.tmp to install path  
DESC: patch file name: saves folder.patch
URL: https://www.armadafleetcommand.com/onscreen/botf/viewtopic.php?p=60473#p60473
TAG: 

# >>  = vanilla/original value

# <<  = new value



>> 0x00037a41 b8 00 83 57
>> 0x0003c30e 89 e0
>> 0x0003c334 00 00 00 00 00 00 00 00 00 00 00 00
>> 0x0019f7a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>> 0x001a1850 00 00 00 00
>> 0x001a1855 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>> 0x001a186b 00
>> 0x001a186d 00 00 00 00 00 00 00 00
>> 0x001a1876 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>> 0x001a1891 00 00
>> 0x001a1894 00 00 00 00 00 00 00 00 00
>> 0x001a189f 00 00 00
>> 0x001a18a3 00 00
>> 0x001a18a6 00 00 00 00 00

<< 0x00037a41 e9 0a 3e 25
<< 0x0003c30e eb 24
<< 0x0003c334 8b c4 89 10 89 50 04 89 50 08 eb d0
<< 0x0019f7a0 53 61 76 65 73 2f 25 73 5f 25 64 2e 73 61 76
<< 0x001a1850 a1 18 29 5a
<< 0x001a1855 83 f8 01 0f 84 fc c1 da ff 83 f8 02 74 3e 48 50 36 a0 2a 2b 5a
<< 0x001a186b e8
<< 0x001a186d e9 da ff 50 68 a0 a3 68
<< 0x001a1876 8d 44 24 0c 50 e8 19 79 e8 ff 83 c4 10 8b f4 56 8b c6 8b d6 e8 dc 13 e9 ff b8
<< 0x001a1891 83 57
<< 0x001a1894 90 e8 ec 13 e9 ff ba 02 01
<< 0x001a189f 8b e6 b8
<< 0x001a18a3 83 57
<< 0x001a18a6 e9 9b c1 da ff

here is assembly notes

00438641 E9 0A 3E 25 00                          jmp     loc_68C450 //jump point to new code

0068C450                         loc_68C450:                             ; CODE XREF: sub_438630+11j
0068C450 A1 18 29 5A 00                          mov     eax, ds:dword_5A2918 //get current turn
0068C455 83 F8 01                                cmp     eax, 1 //if turn 1 jmp 43865A
0068C458 0F 84 FC C1 DA FF                       jz      loc_43865A
0068C45E 83 F8 02                                cmp     eax, 2 //if turn 2 jmp 68C4A1  
0068C461 74 3E                                   jz      short loc_68C4A1
0068C463 48                                      dec     eax //decrease turn by 1 to match in-game display
0068C464 50                                      push    eax
0068C465 36 A0 2A 2B 5A 00                       mov     al, ss:byte_5A2B2A // get player race id
0068C46B E8 00 E9 DA FF                          call    sub_43AD70 // call jump_lex_monster_majors
0068C470 50                                      push    eax
0068C471 68 A0 A3 68 00                          push    offset aSavesS_D_sav ; "Saves/%s_%d.sav"
0068C476 8D 44 24 0C                             lea     eax, [esp+9Ch+var_90]
0068C47A 50                                      push    eax
0068C47B E8 19 79 E8 FF                          call    sprintf_ //call sprintf__compose_string
0068C480 83 C4 10                                add     esp, 10h //align esp to string start
0068C483 8B F4                                   mov     esi, esp //move string to ESI
0068C485 56                                      push    esi
0068C486 8B C6                                   mov     eax, esi //move (esi) string to EAX
0068C488 8B D6                                   mov     edx, esi //move (esi) string to EDX
0068C48A E8 DC 13 E9 FF                          call    sub_51D86B //call delete_file_eax__last_sav
0068C48F B8 00 83 57 00                          mov     eax, offset aLast_sav ; "last.sav"
0068C494 90                                      nop
0068C495 E8 EC 13 E9 FF                          call    sub_51D886 //call move_file_eax__last_sav
0068C49A BA 02 01 00 00                          mov     edx, 102h //reset edx
0068C49F 8B E6                                   mov     esp, esi //reset esp
0068C4A1
0068C4A1                         loc_68C4A1:                             ; CODE XREF: sub_438630+253E31j
0068C4A1 B8 00 83 57 00                          mov     eax, offset aLast_sav ; "last.sav" //over written jump code
0068C4A6 E9 9B C1 DA FF                          jmp     loc_438646 //return to start point 438646

0068A3A0 53 61 76 65 73 2F 25 73 5F 25 64 2E 73 61 76 00 aSavesS_D_sav   db 'Saves/%s_%d.sav',0 //new string offset

//first 0xC bytes in gameInfo set to 0 when saving
0043CF0E     EB 24             JMP SHORT 43CF34

0043CF34     8BC4              MOV EAX,ESP
0043CF36     8910              MOV [EAX],EDX
0043CF38     8950 04           MOV [EAX+4],EDX
0043CF3B     8950 08           MOV [EAX+8],EDX
0043CF3E    ^EB D0             JMP SHORT 43CF10