0

I'm trying to find the function which is animating a bot ingame (singleplayer). I already figured out the animation state value with Cheat Engine. Freezing that value lets the bot repeat the animation over and over again. Changing that value to the "jump"-value, the bot is jumping. So I guess, I'm already at the right location. Looking at this value by "find out what writes to this address" gets me into a small function (see image below) where some comparisons are done and the animation state value is set. I'm not very good at reversing, that's why I tried understanding the commands by putting some comments to the disassembly.

Image of the function with my comments: enter image description here

There are still some commands I'm not understanding right now. I want to call that function later from a DLL injection to play the animations by myself. So how do I know if I'm really in the right function? How do I get the right parameter values?

If I'm changing the jl to jnl command at line 0x232C3 the game stops playing any animation for the bot. Please help me, I don't know how to continue.

Improve this question

1 Answer 1

Reset to default
2

How about you breakpoint the function start and take a look at the call stack. This way you can easily find out the calling convention and used arguments.

All in all, this function looks like it's mainly looking up an array and then loading/writing some floating point values where the third parameter is an index. The first conditional checks if that index is >= 0, the second one let's me assume that [eax@2] is the length of the array; expressed with the parameters only this would be: [[param1+0x1C]+0x0].

ebp-0C is some kind of structure, whose second member (assuming dword-sized members) is treated as the base of an array (see line above outlined one).

If edx is the third parameter now, that means that it's an index into an array which holds all the animation states. Therefore the floating point stuff seems k inda uninteresting.

Improve this answer
4
  • Thanks for your answer! Very interesting, I would never have seen this. What do you think, what are the arguments meaning and what do I have to do to call that function from external? The only thing I want is to play the animation for myself.
    – Haxx0r
    Commented Jan 1, 2018 at 21:14
  • Well, I guess the first parameter is some player/game structure. That game structure dereferenced at offset +0x1C is another structure holding the array of animation ids beginning at +0x4. The second parameter is the animation index you want to use. The game structure stored in the first parameter also contains the current animation id (+0x8).
    – Andrew Mason
    Commented Jan 3, 2018 at 15:35
  • Now, to reverse engineer the calling convention, I'd first start to collect hints inside of this function: - ecx is not used as first parameter, because it is overwritten right at the beginning => hence neither __thiscall nor __fastcall - function does not deallocate function arguments on the stack => hence not __stdcall So my first guess would be __cdecl, but to further strengthen this assumption you could breakpoint the function (push ebp) and look at how it's called (see callstack).
    – Andrew Mason
    Commented Jan 3, 2018 at 15:46
  • Awesome, thank you andrew! I've called the function with the given player pointer and with the jump-animation-state. When calling ingame, the player only "flickers". Like it's only playing the first frame of the animation. Do you have any idea about this? You really helped me a lot! :-)
    – Haxx0r
    Commented Jan 3, 2018 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.