Hi everybody, I'm new here, but don't worry, I did my homework

Thing is, you see, there's this racing game called FlatOut 2, which I would like to make a camera view mod for it. The camera view mod would change the camera direction from straight forward (te default view when you race) to the right or to the left, depends on what key you hold.

The program itself is easy to make, with a trainer kit or something similar. What I need though is to know HOW can I change the camera direction while the game is running a race. Now, I have a sketched idea as to how to do this:

The cameras for each car are specified in a car-specific cameras.ini file, which is loaded at the begining of each race. It's defined as X,Y,Z values for position of the cam, and X,Y,Z values of the camera target. What I need to change is the target. Here's an example:


So, I need to alter the first value of the TargetFrames array, which is the left-to-right spectrum. What I had in mind is that the values are stored in the memory somewhere, but how do I know where to run a trace? Maybe you have other ideas as to how to acomplish this? Please, this is very important for me. Thank you very very much for reading this ultra-long post.

Hi Pilau, welcome to the board.
You mention the name of your target, which is discouraged in the board because legal problems but in the context of your question I think is OK.
It would be helpful if you post the language/environment in which the program is coded, Java? Visaul C? C#?. what graphic framework it uses: DirectX?
so would be easier for one of the gurus in this board to give you a more specific answer.

AFAIK most trainer-kits have a memory searcher, so I would simply search for the values in the ini.
If you need the hex of the numbers you can check out http://babbage.cs.qc.edu/IEEE-754/Decimal.html

Thanks for your replies. I did read the rules, but I didn't think it's a harmful remainder. I will leave it out though.

So, what you're saying, fr33ke, is that the values are stored in hexadicemal format in the memory?

Yes, I think so. They are probably in floating point format but hex is easier for searching.

Of course it is possible that it's more complicated but let's try the easy way first.

Another way is to trace the values from the point they are read from that ini file, to their final destination in memory/code. This way you will also most likely be able to find the functional code that's being used to set the camera position. Depending on how the program is designed, it could be a very hard task to dynamically change the camera during runtime though (but not necessarily, so please continue your efforts ).

That is a very good idea. Very good thanks very much. I just need to put a breakpoint on the place where the camera.ini is called, right? After that, I should run a trace for the value/hexadecimal equivelant of that value, from that breakpoint, am I right?

Well, first pinpoint where the ini file is read, yes (file opening/reading APIs), then step throught this code to see where that exact value from the ini file is read. Then the really fun starts, where you set a memory access breakpoint at the memory location at which it is stored, and for every time this breakpoint is hit (i.e. when the value is read), you must step through and analyze the code to note exactly all places in memory (and all functions) to where it goes, and then repeat the procedure for these (memory access breakpoints, ...). If done right, at some point you will reach the function that sets the camera angle inside the game.

But as I said, this code could be integrated/inlined/messed-up inside some completely other code, or made dependent on the context in infinitely many ways, which could make the whole thing a real pain. But I wish you luck.

Thanks for the directions dELTA. I would want to tpoint you though to the fact the value is only read ONCE, when the race loads, and then the value is stored in the memory, probably, for the camera code. So the read funtion would be ReadFile, but can I point the debugger (in my case OllyDBG, I didn't manage to run SoftICE correctly) to a specific file readinf of the specific ini file? I mean, say it's in C:\folder\camera.ini.

I read about breakpoints in Olly in th help files provided with the app, but I didn't find anything about this.

Just because the value is only read once from the file, it doesn't mean that its subsequent processing inside the program isn't arbitrarily complex.

About ReadFile, it doesn't necessarily have to be this API, the file could be memory mapped etc, but if you're really lucky they use the INI specific APIs, and in that case you could much easier pinpoint exactly where the value is read, yes.

About settings breakpoints, please see more general information that's all over this board and the web. For more OllyDbg specific questions, use the OllyDbg forum on this board, just make sure to do your homework first.

Thanks, dELTA. I will sure go on and read some material now. Then I will your idea. Thanks again.