Editing Offset Finding Methods

==Tools==

* Process Table Access  (i.e. Win32::Process::List in Perl)
* Memory Access (i.e. Win32::Process::Memory in Perl; ReadProcessMemory in C++)
* Cheat Engine: http://www.cheatengine.org/

==how to identify version==

The PE header timestamp is set each time the executable is compiled and is thus unique for each release. It can be consistently found with a few simple steps and thus is far superior in version identification than any other attribute of the DF executable. The steps are as follows:

* get process table, find DF process
* get executable path from process table
* open DF executable in binary mode, confirm first two bytes are "MZ"
* read long at offset 0x3C, this is the PE header offset
* read 2 bytes at PE header offset, confirm they are "PE"
* read long at PE header offset + 0x08, this is the compilation timestamp

==map offset==

* start on map with boulder in top left corner
* note distance to top and left. offset of this tile in tile type block is ( 2 * ( ( x_dist * 16 ) + y_dist ) )
* find all 2 byte values with 0x0192 in CE
* channel out boulder
* click next scan to find all those that changed to 0x0020, should return 1 result; that is offset of type of tile that was just channeled out
* subtract offset of tile in tile type block from overall offset of tile type; this is offset of tile type in tile data block
* subtract 0x007A from that; this is offset of tile data block (if not, first 4-byte offset before the "FF FF 00 00" block in the tile data header)

!!NOT COMPLETE!!

Next step: Identify start and end of the array of tile data blocks in the chosen vertical column.

==Economy status==
Find the function using the string "Stocks". It should look like that:
<pre>
mov ebx, offset "Stocks"
mov eax, offset
call something
cmp offset_economy, 0
</pre>

[[Category:Guides]] [[Category:Hacking]]