MP medals

[kornman00]

In which tag group or tag definition are the MP medals referenced? The multiplayer_globals (mulg) provide the definitions of events for things which have medals (eg, double kill) but that tag group only defines the display names and sound references for those events. I can't seem to find anything that sets up the definition for medals and their HUD representation. Eg, I would expect a tag block which has a string_id field for the medal name (eg, multiple_kill_2), then a tag reference to the bitmap of that medal's icon. However, I'm not finding anything like this when browsing all the related tag groups where one might expect to find them (globals, multiplayer_globals, etc) in H2Guerilla

Does anyone know where exactly are the bitmap(s) for the medals referenced? I'm hoping this will help me backtrack to where the medals are defined. Unless it's entirely hardcoded, in which case there should still be a list of references to the bitmaps somewhere, or a reference to a bitmap if the medals are all contained in a single bitmap group.

This is in reference for some OpenSauce work for CE.

[Click16]

I'ts a unicode string, and the medal image is part of the custom fonts that Halo uses. I might be wrong though...

[XZodia]

Click is correct.
The medals are referenced as a character in a unicode eg.
For example, if @ was the medal's unicode character then:
Then unicode string "@ Message" would display the medal's image followed by Message

I hope that makes sense...
Several people have tried locating the medal bitmaps in the font files, but none have been successful.

[kornman00]

Ah, yes I've come across the definitions for the special unicode characters specific to game before while browsing the code. Completely forgot about them. Some of the unicode character definitions have a function pointer to the code which handles the translation of a runtime value (eg, who last delayed the countdown) or insertion of images, so I'll have to look them up again

[kornman00]

Hmmm, nope, doesn't seem to use the text-to-icon replacement stuff

[CaptainPoopface]

I have wanted to be able to change the conditions that trigger medals and the announcer color commentary (Triple Kill, Killtacular, etc.) for a long time. If you come up with something useful for H2, I'd like to know.

[kornman00]

You'd want to refer to the general/flavor events blocks (and each game type's individual events block) in the multiplayer_globals' runtime block

[CaptainPoopface]

Are you referring to the xbe? If so, I would love to know more, or where to find out more (in accessible/noob-legible fashion). The mulg tag in the map file associates multiplayer events with HUD strings and announcer sound effects. But I want to edit the triggering events, which I do not think are defined in the map file (If you happen to know they are defined in the map, then this is a plugin issue, but I think the mulg tag has been completely mapped for H2).

For example, there is an event called "20_in_a_row" which causes the announcer to say "Untouchable." I would like to make this happen at a threshold I define, such as 7 kills in a row. So wherever the kill counter is compared to 20, I would like to change that to 7. I expect someone (i.e., you, xbox7887) has a reverse-assembled xbe where this equivalent of a case statement is pretty well mapped out in assembly language, or at least not hard to find, especially if you have the ability to set breakpoints in the xbe, or even just the ability to take snapshots of the registers/game state between a few frames.

[troymac1ure]

"20_in_a_row" must be referrenced somewhere else and contain the 20 kills (Maybe in a Shared resource).

[Grimdoomer]

Code: Select all

multiple_kill_2
multiple_kill_3
multiple_kill_4
multiple_kill_5
multiple_kill_6
multiple_kill_7
sniper_kill
collision_kill
bash_kill
stealth_kill
killed_vehicle
boarded_vehicle
plase_stick
5_kills_in_a_row
10_kills_in_a_row
15_kills_in_a_row
20_kills_in_a_row
25_kills_in_a_row

Etc, etc, are all built in string_id's. Which I believe the engine has code to handle them accordingly.

[CaptainPoopface]

OK, so you think it's in "the engine," which must reside in the xbe. What kind of undertaking would it be to find and modify it? How can I do it? It would be cool to insert/modify code so that there are announcer events for things like getting stuck with a plasma grenade or splattered or headshotted. For starters though, I would like to just change the kill count for flavor events. That's what I would like to know.

For a long time, I've had the impression (right or wrong?) that a small number of people have gathered some useful documentation about the xbe, but for reasons that are now obsolete to the point of being foolish, it is kept secret. The game is 8 years old and cannot be played on XBL servers. I am among the last of people who would use this information, which probably took dozens or hundreds of hours to accumulate, but I don't have it. Why? /rant.

[XZodia]

Most if not all information known about the xbe can be found in open sauce, unfortunately it is rather difficult to decipher...
Unfortunately, I don't think what you want to do is realistically achievable...

[Grimdoomer]

OK, so you think it's in "the engine," which must reside in the xbe. What kind of undertaking would it be to find and modify it? How can I do it? It would be cool to insert/modify code so that there are announcer events for things like getting stuck with a plasma grenade or splattered or headshotted. For starters though, I would like to just change the kill count for flavor events. That's what I would like to know.

For a long time, I've had the impression (right or wrong?) that a small number of people have gathered some useful documentation about the xbe, but for reasons that are now obsolete to the point of being foolish, it is kept secret. The game is 8 years old and cannot be played on XBL servers. I am among the last of people who would use this information, which probably took dozens or hundreds of hours to accumulate, but I don't have it. Why? /rant.

It isn't kept secret, it is more or less useless to anyone who can't already figure it out themselves. Analyzing, modifying, and adding code to the xbe is all done in pure x86 assembly for the most part, and is not that trivial of a task. I don't suppose you happen to be familiar with it, now, are you? Because if you are then you are just asking to be spoon fed information. And for the record I had posted all of my findings and such in the xbe in a topic called "Community Project: Xbe Research", but it was lost in the last forum crash. If you really want to look into it yourself, open the stock xbe in IDA, here are two addresses that will help you. 0x00122870 is the address of a function that validates some basic info in a maps header. 0x004E3B44 is the address of a 32bit address that is the tag list cache. Have fun. We are expecting results.

[troymac1ure]

It isn't kept secret, it is more or less useless to anyone who can't already figure it out themselves. Analyzing, modifying, and adding code to the xbe is all done in pure x86 assembly for the most part, and is not that trivial of a task. I don't suppose you happen to be familiar with it, now, are you? Because if you are then you are just asking to be spoon fed information.

What?!? I didn't realize that it was just running pure x86. lol. Geez, I grew up on that stuff. Never bothered trying to look at the XBE at all.

[CaptainPoopface]

I actually have a fair amount of experience programming in assembly on multiple platforms, including a lot of code insertion. I'm familiar with the process of pushing registers to memory, jumping to a section of unused memory to execute new routine(s), restoring registers and returning to the insertion point. That's more involved than finding what is probably one opcode and operand, something like CMP #14 for the 20 kills event. Which would mean there is only one byte to change. I don't expect to be told how to manipulate assembly; I just want the roadmaps that have been built over the years for this particular xbe, the most thoroughly studied of all xbox executables. You posted your idb file awhile ago, at a time when I was not active. I would be grateful if you reupload it. I have not used IDA but I'll give it a shot.

[Grimdoomer]

Searching the entire game executable for "cmp xxx 0x14" is not going to find you what you want.

[troymac1ure]

Being I don't see 20_kills_in_a_row referencing anything in the maps, this would possibly be a better search point

EDIT: Looking at those same StringIDs in MainMenu, they reference an encoded Unicode string (Usually used for Player names, medals, weapon pickup icons, etc) so they may help you along too:

Code: Select all

238 129 165 = 5 Kills in a row
238 129 166 = 10 Kills in a row
238 129 167 = 15 Kills in a row
238 129 168 = 20 Kills in a row
238 129 169 = 25 Kills in a row

[kornman00]

Only place where the medal string_ids are reference in the engine (v1.0)

Code: Select all

.text:0023491B                 mov     [ebp+var_70], 0F000741h ; multiple_kill_2
.text:00234922                 mov     [ebp+var_70+4], 0F000742h
.text:00234929                 mov     [ebp+var_70+8], 0F000743h
.text:00234930                 mov     [ebp+var_70+0Ch], 0F000744h
.text:00234937                 mov     [ebp+var_70+10h], 0F000745h
.text:0023493E                 mov     [ebp+var_70+14h], 0F000746h
.text:00234945                 mov     [ebp+var_70+18h], 0B000747h
.text:0023494C                 mov     [ebp+var_70+1Ch], 0E000748h
.text:00234953                 mov     [ebp+var_70+20h], 9000749h
.text:0023495A                 mov     [ebp+var_70+24h], 0C00074Ah
.text:00234961                 mov     [ebp+var_70+28h], 0E00074Bh
.text:00234968                 mov     [ebp+var_70+2Ch], 0F00074Ch
.text:0023496F                 mov     [ebp+var_70+30h], 0B00074Dh
.text:00234976                 mov     [ebp+var_70+34h], 1000074Eh
.text:0023497D                 mov     [ebp+var_70+38h], 1100074Fh
.text:00234984                 mov     [ebp+var_70+3Ch], 11000750h
.text:0023498B                 mov     [ebp+var_70+40h], 11000751h ; 20_kills_in_a_row
.text:00234992                 mov     [ebp+var_70+44h], 11000752h
.text:00234999                 mov     [ebp+var_70+48h], 9000753h
.text:002349A0                 mov     [ebp+var_70+4Ch], 11000754h
.text:002349A7                 mov     [ebp+var_70+50h], 0B000755h
.text:002349AE                 mov     [ebp+var_70+54h], 0A000756h
.text:002349B5                 mov     [ebp+var_70+58h], 11000757h
.text:002349BC                 mov     [ebp+var_70+5Ch], 0D000758h
.text:002349C3                 pop     edi
.text:002349C4
.text:002349C4 loc_2349C4:                             ; CODE XREF: pcr_medals_widget_exchange_data+202j
.text:002349C4                 cmp     [ebp+arg_0], 8
.text:002349C8                 jge     short loc_234A30
.text:002349CA                 xor     edx, edx
.text:002349CC                 inc     edx
.text:002349CD                 mov     ecx, edi
.text:002349CF                 shl     edx, cl
.text:002349D1                 test    [eax], edx
.text:002349D3                 jz      short loc_234A2D
.text:002349D5                 cmp     [ebp+arg_0], ebx
.text:002349D8                 jz      short loc_2349F3
.text:002349DA                 mov     ecx, 100h
.text:002349DF                 mov     edx, offset asc_42D494 ; " "
.text:002349E4                 lea     eax, [ebp+var_270]
.text:002349EA                 call    _ustrncat
.text:002349EF                 mov     [ebp+var_270+1FEh], bx
.text:002349F3
.text:002349F3 loc_2349F3:                             ; CODE XREF: pcr_medals_widget_exchange_data+1ACj
.text:002349F3                 mov     edx, [ebp+var_C]
.text:002349F6                 call    get_parent_screen
.text:002349FB                 mov     ecx, [ebp+edi*4+var_70]
.text:002349FF                 lea     esi, [ebp+var_470]
.text:00234A05                 call    sub_230134
.text:00234A0A                 mov     ecx, 100h
.text:00234A0F                 lea     edx, [ebp+var_470]
.text:00234A15                 lea     eax, [ebp+var_270]
.text:00234A1B                 call    _ustrncat
.text:00234A20                 inc     [ebp+arg_0]
.text:00234A23                 mov     esi, [ebp+best_medal_widget]
.text:00234A26                 mov     eax, [ebp+arg_4]
.text:00234A29                 mov     [ebp+var_270+1FEh], bx
.text:00234A2D
.text:00234A2D loc_234A2D:                             ; CODE XREF: pcr_medals_widget_exchange_data+1A7j
.text:00234A2D                 dec     edi
.text:00234A2E                 jns     short loc_2349C4

And they're only used in getting the localized strings for those medals.

The function at 0x1970A0 increments the number of medals (type specified in eax) the player (specified by ecx) has got. I believe the 20_kills_in_a_row medal enumeration is 16, so you'd have to find the address which calls this function with 17 as the type and reverse the logic from there.

Now stop complaining. And the game can still be played on XBL via Halo 2 PC.

[CaptainPoopface]

Thank you for posting this information. It gives me more to work with than just having some addresses thrown at me.

I do not mean to whine; it's just that I know the xbe has been pored over for a long time, and I would like to see what has been learned. Is there anywhere you have posted whatever file you've quoted, or anywhere you would post it?

[JacksonCougar]

That's just the assembly of the xbe...

[CaptainPoopface]

Hmmm... I would not expect the retail xbe to have named subroutines, symbolic names in some of the indirect addresses and code cross references marked in it. These are the kinds of things that can save a lot of time (for subsequent users). But I'll admit I haven't looked at it yet, lacking proper tools at the moment.

[kornman00]

The retail xbe doesn't have any debugging information. That name was given by mean a long, long time ago when I actively RE'd Halo2 and figured out which vftable entry for the engine's widget classes essentially performed the data exchange logic

And no, there's no place where I would have posted this. And since IDA keeps license information in the IDB, I would never just give them out.