Beyond DefaultGameCore.ini - Analyzing the Game Scripts

[Solver]

I could use a bit of workflow help here due to my unfamiliarity with Unreal.

 

I'm trying to modify a script to get it loaded through XSHAPE. Assuming I can get the bytecode right, what is it exactly that I should modify? Bytecode in the decompressed UPK file itself, or the .*property files after extracting the UPK? If the latter, how do I get them back into the UPK?

[dreadylein]

just change the bytecode in the decompressed upk if unpacking and repacking makes a problem

it will have the same result at the end :)

[Solver]

Interesting that the bytecode is extremely verbose. I want a function just returning a constant value, and that's about 70 bytes of bytecode. Well, experimentation is warranted.

[parkanos]

Hey people.I want ask something:How i can add a Officer Training school at the start of the game on Impossible difficulty?Or made it to build at the start of the game on Impossible? Edited October 20, 2012 by parkanos

[kanet32]

In this post, DaemonJax basically goes over the whole process in broad strokes. If you missed it, it might help.

 

And yeah, UnrealScripts don't seem to be compiled so much as they're compressed. The "compiler" just seems to tokenise everything and replace the tokens with indices into various tables. There's one for native operators and library functions, one for variable and class names, one for exported functions, and one for imported functions. The most complex thing it seems to do is generate jumps for conditionals (but not for the ternary operator :?, which is actually a single three-"operand" instruction)

[Solver]

OK, with the tips here, I succeeded in modifying the scripts so that any weapon is considered to be free-fireable. It shows that very dirty modifications of scripts work, and invalid code is ignored if the function terminates earlier with valid code.

 

On the downside, while it says "free aim" in the game, that modification alone doesn't help the UI - it still highlights the aliens and won't let you choose an arbitrary spot to fire at. Let's see if I can get around that.

[dreadylein]

anyone tried 0x0b token yet ?

Seems like a nop :D

[Solver]

Note: if modifying a function that does not call any other function, invalid code is okay. That is, if you have a function like

 

bool somefunc()

{

statement;

anotherStatement;

}

 

and change it to

 

bool somefunc()

{

return true;

nowInvalidStatement;

}

 

it works.

 

But, if you have a function that calls another function, you have to take care to remove the extra parameters, space for return values, etc., or the game crashes.

[dreadylein]

huh ? of course, thats because the invalide code is nerver reached :D

Or do i missunderstood you ?

[kanet32]

Yeah, that's the expected result, but I believe Solver is saying that it actually DOESN'T work like that when you're calling a function. Even if execution will never reach a function call, the interpreter will check that call in advance to make sure its parameters are correct. So while execution never reaches that line, it will still cause a crash because it's being checked for correctness before execution even begins.