Blood Omen 2 - Hidden Developer Menu??

[Baaleos]

Yes, I realise this is a nwn/nwnx forum, but I promiss, this is sorta on point.

Alot of the guys here at nwnx know more about programming than other websites (subtle compliment)

Anyway..

Im an avid fan of the Legacy of Kain series, and found that all of the legacy of kain series games have a secret developer debug menu, except Blood Omen 2.

No one has released a Developer Debug Menu accessing trainer/program as of yet.


I was hunting around the Blood Omen executable in IDA, and found some strings which suggest there is infact a debug menu hidden in there after all.

[Baaleos]

Its not often that the developers of a game, leave the source code packaged with it.

I've found a bunch of unencrypted source code in some of the data files in the data folder of blood omen 2.

It details the structure of the game classes etc.

for instance, Kain, the protagonists, and the gameplay, seems to be linked to a class/struct called

[peachykeen]

You can, sometimes (depending on the functions) find out a little bit about the declaration. The first step would be to load the whole thing up in IDA and let it decompile. Save the database. Now start the game in the debugger.

Next, I'd actually grab a copy of Cheat Engine and hook it up, hopefully both debugger work together. Get one of the values you're interested in to a known value, scan for that, change the value, rescan, etc. Pick it out that way. That will provide you with a memory offset.

Now go to IDA's window and find the memory offset, add a breakpoint for when it's modified. Wait till the breakpoint triggers, then follow the call stack and you'll know some of the functions.

[Baaleos]

My first attempt was with cheat engine (btw, only one debugger can be active on the exe at a time... unfortunately, cause cheat engine has a 'find out what accesses this' function, which updates in real time as the event plays out.


My first attempt was along the lines of
select dark gift mist.
scan for unknown value
change to fury
scan for changed value

repeated this for a bit,

In the end I managed to find about 12 memory locations which were 4 bytes long each, which updated when I changed dark gift.

Im guessing these values which changed were to do with the gui, and/or back end settings such as targetting reticles for the dark gifts.

Because when I modified or nop'd them or the functions that accessed them, it resulted in
1. Kain turning pink - the pansy!!
2. Kain Couldnt jump higher than 1 mm of the ground
3. Targetting reticle for jump dark gift moved diagonally instead of where u tell it to go.
4. Kain walks in a similar manner to the targetting reticle.

Also, freezing the values which were associated with the dark gifts did not prevent me from changing dark gift either.

The values I managed to determine, or at least observed being present at the time of each dark gift was as seen below.

C2 00 00 48 - MIST
C2 00 00 2A - IMMOLATE
C2 00 00 16 - JUMP
C2 00 00 02 - BERSERK
C2 00 00 DC - CHARM
C2 00 00 B4 - FURY
C2 00 00 8C - TELEKINESIS


In regards to your suggestion, the only method I can really check the difference between having dark gift, and not having dark gift, is to go back and forth between save games or instances where I have no dark gift, and then when I do have the dark gift.

The variations I can achieve with this is limited, and it entails alot more work.

But I will give it a quick test, to see if it proves productive.

[Baaleos]

I've been doing as I said.

Loading a save game from chapter 1 - with only 2 default dark gifts.
and then loading the bonus mode one, where it gives u all the dark gifts (the bad thing about bonus mode, is it only lasts for one level)

Ive noticed something rather odd.
A repeating pattern.

Im on Chapter 1 at the minute, and I am seeing alot of the memory addresses repeating the same values.
4/5 bytes long.

00 00 00 05

or perhaps the most repeating one that needs mentioning is the 3 byte length one which repeats over 2000 times.
2000 memory bytes with same 3 length repeating pattern.

Which gives 00 00 05

However, in some cases, these 3 length patterns are actually 6 in length, which would be 00 00 05 68 00 00 - not sure how... but thats what cheatmachine says.



The same 6 long array of bytes in bonus mode Kain, is
00 00 88 68 00 00


Im about to perform a single test that 'may' help lower the amout of addresses.

Because Ive only been going back and forth between 2 saves, to two levels, some of those values may relate to level data, so I will take bonus kain, onto the same level as level 1 save is, and scan for something changed, opposed to something same as first scan.

[Baaleos]

I cant get the address list below 2000

[Baaleos]

K, This is what freezing one of those 2000+ addresses did. Lol

[Baaleos]

I've managed to make sprites appear all over the screen, turn steam into xbox controller buttons, and make my dark gift glow, reveal secret messages....well... really just gibberish...

[peachykeen]

My first guess, when you say repeating patterns, is a struct. Some kind of struct with similar data being repeated in memory, possibly for multiple objects or instances of an object. I'm not familiar with the game or engine, but it's a thought.

My next suggestion is to use the cheat engine to find the code modifying some of your mystery patterns, or better yet, the code that changes the data when the gift changes. Write down the addresses, all of them (I literally have a hundred sheets of notebook paper with RVAs, offsets, function addresses and such scattered around my room).

Now open the game in IDA and go to each of those addresses. Search up till you find the function they belong to, then set breakpoints at the start of each function. That'll give you some idea of what's going on. If a function contains any render calls (what system does the game use, OpenGL or DirectX?), you can probably discount it (or set it off into a second group for now).

At this point, the more you know the better, doesn't matter what it happens to be.

[Baaleos]

I just had an idea, and this idea would not have come to me, had I not seen the source code for the game.

struct kainTune { } This contains alot of structs inside it,
The ones I wana alter, is the Healthparams one which tells the game if each of the dark gifts is available.

I've been trying to go straight to the dark gift values or locations etc, to get them.
What I should be doing, is finding something which is easier to locate, like a health value, and then using the information from the source code, to aproximate the location of the dark gifts.

eg

[peachykeen]

I would still do a scan, personally, but going by the KainHealthParams struct, scan for this:

[Baaleos]

certainly a tricky one.

I havent been able to find

00 00 48 42 00 00 08 F3 CC CC CC 3D anywhere in the exe.

Odd.

I did however, see a comment/static data in the program, which referers to a file path for the games kain.big file (where I found all those structs)

But this big file, isnt in my data folder, at least not that I can tell.

It appears to be accessing this file path, in a virtual directory of some sort.

Like the file directory exists in dat files, on the pc cd disc.
(Virtual Disc.... not that I condone piracy..... I assure you... I own the game.... just not on the pc.....)

Im just wondering if it loads the structs into memory, and disposes of them when no longer needed.

In theory, it could just load the struct when needed - as far as I know, it loads the kain.big file when I start a new level, or load a game.

So, it is very likely it accesses the classes and structs from the big file at this time, loads data into ram, then disposes of the structs.

Where is wonder hacker when u need him!

[peachykeen]