gemot encubed

Remember11 .BIP format

DiNeX — Fri, 24 May 2013 17:44:35 GMT

What program can hack .BIP format?

New API hooking tool

Proger — Wed, 22 May 2013 05:07:32 GMT

Hi folks,

Now that it's complete I don't know where to start, it's really huge. Anyway let's try a small example. There's an oldy RPG from 2000s called "Avaton"; I'll use it as a test subject (it's about 120 MiB).

My tool - ApiHook - allows you to execute custom scripts attached to any exported function of a DLL loaded into a process. In other words it's like a debugger where you set breakpoints with conditions but here you can run full-blown scripts instead of some simple conditions. You can dump call stack, dump memory segments, log stuff to console, etc.

Among other things it's very useful in finding initial call points when you're dealing with a new engine.

ApiHook has several strong points and one of them is that it can use both IAT table patching and prologue rewriting (the default) to attach its own handler to subject. IAT is fast but unreliable (e.g. it won't work for dynamic binding with LoadLibrary/GetProcAddress) and it only affects particular module (unless you patch every process module). Prologue patching is unavoidable - first instructions of target function body are overwritten to point to ApiHook's handler so you can't call the hooked function bypassing ApiHook itself. It's a technique used by rootkits and low-level apps like antiviruses.

Let's say we want to see what files does Avaron access via CreateFileA. Here's what you need to do:

Download ApiHook and extract it anywhere
Create hook script - let's call it "avaron.oo" (you can use .txt too if you wish). It's a plain text file, we'll fill it below
Open command prompt at ah.exe (it doesn't matter but usually is more convenient - no typing of long paths)
Now type this command (but don't run it yet): ah.exe launch avaron.oo - or it can be shortened to ah l avaron (l = launch, .exe and .oo/.txt are added automatically)

Now it's set up. We need to fill in the hook script (docs) - it specifies what ApiHook should hook and what to do once a trapped call happens. Script file has a basic INI-like format:

Code:

[CreateFileA]

log :fn

That's it. Now as soon as CreateFileA is called we'll see a line like CreateFileA: save0000.dat in the console, log or both.

Now you can run the command line above. (Note: you should have DEP disabled!) The game title opens and... nothing happens. You will see something like this:

Now that's strange, isn't it? But let's try to Load a saved game (don't close ApiHook) - it's the top clickable menu item. You should immediately see new lines appearing in the console as the game lists empty slots:

Code:

Your choice...

21:44: CreateFileA: save0000.dat

* CreateFileA: save0001.dat

* CreateFileA: save0002.dat

* CreateFileA: save0003.dat

* CreateFileA: save0004.dat

* CreateFileA: save0005.dat

* CreateFileA: save0006.dat

* CreateFileA: save0007.dat

* CreateFileA: save0008.dat

* CreateFileA: save0009.dat

As we see ApiHook works and listens for CreateFileA calls. If so - why we didn't see them, the game at least had to read title image from somewhere?

This is because most of the engine isn't contained in avaron.exe but rather in uty32dll.dll (see it in the game's folder?). By default ApiHook only triggers on calls originating from the process itself (the EXE) but not its modules (DLLs) - since it uses prologue rewriting even calls from system libraries like kernel32.dll will be intercepted and output and believe me that's a huge stream - you'll see it in a moment.

So we need to hook uty32dll.dll instead of/in addition to avaron.exe. Close the game and ApiHook (you can type t in its console and press Enter) and change the command line so it looks like this: ah l avaron --module=uty.

--module can be * to hook everything including system DLLs or it can be full or part module name to which hooks should be attached. We could type path\...\uty32dll.dll, uty32dll or any other unique file name portion like uty, which we did.

Now run it again and this time you will see much more activity:

Code:

...

* CreateFileA: win_up.bmp

* CreateFileA: graphic.md

* CreateFileA: gwaku_up.bmp

* CreateFileA: graphic.md

* CreateFileA: ewaku.bmp

* CreateFileA: graphic.md

* CreateFileA: swaku.bmp

* CreateFileA: graphic.md

* CreateFileA: t.bmp

* CreateFileA: graphic.md

* CreateFileA: t.bmp

* CreateFileA: graphic.md

Aha! graphic.md and others including some non-existent files like t.bmp. Great. Now if you try to Load a game you'll notice that there are no new lines in the console - unless you have used --module=*.

This is very basic usage. You can do a lot more but I'll keep this first post short and if anyone is interested - feel free to drop a comment. ApiHook is yet in early beta stage so there are glitches.

You can find a more appealing teaser script under the spoiler.

Spoiler

That's it for now. Hopefully it is useful. Let me know what you think.

Sword Art Online: Infinity Moment PSP Translation Project

Kahr — Wed, 22 May 2013 00:27:10 GMT

Hey guys, I was interested in translating this and was hoping for a project to start up so that I could help. From what I've read somewhere else, the issue is hacking which seems to work a bit differently in this game. However, the hackers working on it didn't seem to be very good.

So, I'm looking a hacker that knows what he's doing. Someone that could get me the script, and put everything back together in proper, working order. It would be nice to also have a QC or editor to help and even another translator would be great also. Since I've already played the game, I can say that the script is quite easy. I also have plenty of spare time so I think this could go pretty fast.

Where can I download the "Bug Fix"?

Henrique — Tue, 21 May 2013 01:39:21 GMT

When mounting the SEENXXXX in SEEN.TXT appears this error message:

Quote:

Fatal error : exception Sys_error("Permission denied")

Rummaging through old posts, I saw that I need to download this "Bug Fix". Which in this case would be?

Quote:

http://www.haeleth.net/temp/kprl.exe

Could someone give it to me?

Contact: henriquesz@live.com

Thank you!

Weird Graphical Errors in XP3 File for Fate/Stay Night

Soul Reaver — Wed, 08 May 2013 12:52:34 GMT

I've created an XP3 file for Fate/Stay Night, but somewhere along the line, things go wrong... and I'm not sure why.

What I'm trying to do is to replace some of the existing CGs. However, although I can replace them, the some of the replacement images have graphical bugs in-game. See the attachments: the 'no error' picture is what a part of my original bmp file looks like. the 'error' picture is what it looks like in-game.

I read somewhere that this may be related to the XP3 tools not working propely with some pictures, with the compression messing things up.

In any case, here's the process I've been following:

- Open the bmp file in Photoshop CS5
- Go to Channels, create a new (alpha) channel. Set it completely to white.
- Save as a 32bit Windows BMP file, with 'Alpha Channels' ticked
- Go to kr219b15 (kirikiri folder), kirikiri2/tools/ and start krkrtpc.exe
- Ensure that in the first and second columns, the TLG options (3rd options) are selected.
- Drag the image to the window. It converts it to TLG
- Use xp3-repacker.exe from the command line (with the fate_full flag) to pack the TLG file into an .xp3.
- Put the XP3 file into the Fate-Stay Night directory and play.

I also tried creating a alpha channel in gimp, but the same thing happened when I turned that image into a tlg, then an xp3 and tried it out in-game.

I've tried using the tool here: http://tlwiki.org/index.php?title=File:Kikiriki.rar to create the XP3 file too using the command line:
kikiriki.exe -c -i C:\TLG -o patch9.xp3
but the XP3 file I create with that doesn't seem to get picked up in-game at all.

So what's wrong? Is there some other good XP3 packer that will work for Fate/Stay Night? Or can someone advise me what I'm doing wrong with the ones I'm using?

Attached Images

getting around region locks - how?

VN lover — Tue, 30 Apr 2013 19:48:40 GMT

Hello friends, I need advice... I bought the game Rewrite recently, unaware of such a thing as region locks. If I want to start it up I get the message ''Japan Only"... My question: how do you get around this? I have windows 8, if that is useful information. Thanks!

Help with puttext in NScripter

qazmlpok — Tue, 30 Apr 2013 18:33:49 GMT

Hi, I'm trying to use the gettext function to insert entire script lines for a VN that I'm translating. This method is somewhat working, but chokes upon reaching an @ in the script. Strangely, the @ is processed and the game enters clickwait mode, but upon clicking it immediately crashes with an error message stating that EOF was unexpectedly reached. The line number it is giving is 10884, while the script file itself has 10895 lines - so almost, but not quite the end of the file.

I can't find any way to make this symbol work. Nothing I put after it avoids the crash, including nothing at all. Doing a separate puttext "@" doesn't work either; in that case nothing happens at all.

Is there any way to make puttext work with the script token?