THPS Proto/Beta thread - THPS1 DC Beta

Post your hi-scores, videos, questions, talk about Tony Hawk games.
Forum rules
No talking about modding in this forum.
Morten1337
Posts: 132
Joined: Tue Jun 08, 2010 11:11 pm
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby Morten1337 » Sat Oct 15, 2016 10:12 pm

sairuk wrote:Seems there might be a new thug pc beta knocking about

http://assemblergames.com/l/threads/pot ... 00s.63571/


Update: Having looked at it quickly, i'd be more so inclined to call it a Demo than a Proto, i've currently named it

Tony Hawk's Underground (Pinecone Research Study #31312) Demo.iso

in my set


I've been trying to bypass the backend / server report thing but i havent had any success so far.
Just disabling the "Waiting for content..." function just gives more error messages.

It looks like its initializing more stuff in WinMain. Ive tried to nop it, but it either causes the game to crash on startup, when loading a level, or returning more errors.

Code: Select all

//----- (004BF3F0) --------------------------------------------------------
BOOL sub_4BF3F0()
{
  sub_4019D0("Waiting for content...\n");
  WaitForSingleObject(hEvent, 0x1D4C0u);
  sub_4019D0("Done waiting for content\n");
  return SetEvent(hEvent);
}


Code: Select all

        MessageBoxA(
          0,
          "There was an error connecting to the server.\r\n"
          "Please check your Internet connection and try again.\r\n"
          "\r\n"
          "Press [ENTER] to exit the game.",
          "Communications Error",
          0x1000u);


Code: Select all

//----- (004C02A0) --------------------------------------------------------
int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
//.....
  v4 = 0;
  v5 = sub_6206F0((int *)&unk_683EF8);
  hEvent = CreateEventA(0, 1, 0, 0);
  sub_61FD80((int)sub_4BF3C0);
  if ( v5 )
    sub_4019D0("radStart(): ERROR %d\n", v5);
  sub_4C00D0();
  sub_5C82B0("thps5pc");
  for ( i = sub_5C8460(); !i; i = sub_5C8460() )
    sub_5C7D80(5u);
  if ( i != 1 )
    sub_4019D0("The backend is not available\n");


I noticed that it will always try to load the Slam City Jam level, no matter what level you select.

I also found some interesting stuff in the disassembly, it looks like the game takes the following startup parameters: "-export", "-ads" and "-label"
Other findings:

Code: Select all

// ...
v36 = fopen("default_ad.bmp", "r");
// ...
sub_4019D0("DYNAMIC REPLACEMENT: texture %X cell: %d\n", *(_DWORD *)v92, v93);
// ...
CHAR aSoftwareIga[] = "Software\\IGA"; // idb
char asc_6967CC[] = "\r\n\r\n"; // idb
char asc_6967D4[] = "\r\n\r\n"; // idb
char aPostHttp1_0Con[74] = "POST / HTTP/1.0\r\nContent-Type: application/octet-stream\r\nContent-Length: "; // weak
char aD_D_D_D_0[] = "%d.%d.%d.%d"; // idb
char aD_D_D_D_1[] = "%d.%d.%d.%d"; // idb
char aD_D_D_D_2[] = "%d.%d.%d.%d"; // idb
CHAR aUserid_1[] = "userid"; // idb
char aCellid[] = "cellid"; // idb
char aContentid[] = "contentId"; // idb
char aI64d[] = "%I64d"; // idb
char aWeight[] = "weight"; // idb
char aD_1[] = "%d"; // idb
char aMinsize[] = "minsize"; // idb
char asc_696888[] = "%f"; // idb
char aMaxsize[] = "maxsize"; // idb
char asc_696894[] = "%f"; // idb
char aMintime[] = "mintime"; // idb
char aD_2[] = "%d"; // idb
char aDeflection[] = "deflection"; // idb
char aD_3[] = "%d"; // idb
char aSize[] = "size"; // idb
int dword_6968E4[] = { 0 }; // weak
char aS_9[6] = "ß°\b™\\"; // weak
char aRadial_cdb[11] = "radial.cdb"; // weak
char aRadial_cdb_0[] = "radial.cdb"; // idb
char aA9b8c7d6ee55ff[17] = "a9b8c7d6ee55ff44"; // weak
int dword_69691C = 945961313; // weak
int dword_696920 = 912537443; // weak
int dword_696924 = 892691813; // weak
int dword_696928 = 875849318; // weak
char aRadtrackcellRe[] = "radTrackCell(): [report impression] cell %d content %I64u angle: %0.2f size: %0.2f duration: %d\n"; // idb
char aRadtrackcell_0[] = "radTrackCell(): [reject impression] cell %d content %I64u angle: %0.2f/%u size: %0.2f/%0.2f duration: %u/%u (\n"; // idb
char asc_696A08[2] = "\\"; // weak
char aRadial_idb[11] = "radial.idb"; // weak
char aRadial_idb_0[] = "radial.idb"; // idb
char aRadstopResWa_0[32] = "radStop(): res == WAIT_TIMEOUT\n"; // weak
CHAR aRadstopResWait[] = "radStop(): res == WAIT_FAILED\n"; // idb
char aRadgetcontentR[] = "radGetContent(): RAD_ERROR_NOTINITIALIZED\n"; // idb
char aRadgetcontentC[] = "radGetContent(): cell %d content %d\n"; // idb
char aRadgetcontent_[] = "radGetContent() @disabled: RAD_ERROR_NOCONTENT\n"; // idb
char aRadgetcontentE[] = "radGetContent(): empty list (cellmap %p/active_count %d/active_weights %p/active_resources %p)\n"; // idb
char aRadgetconten_1[] = "radGetContent() @active weights / resources: RAD_ERROR_NOCONTENT\n"; // idb
char aRadgetcontentT[] = "radGetContent(): total_active_weight == 0\n"; // idb
char aRadgetconten_0[] = "radGetContent(): total_active_weight == %d, r == %d\n"; // idb
char aRadgetconten_2[] = "radGetContent() @no resource: RAD_ERROR_NOCONTENT\n"; // idb
char aRadgetconten_3[] = "radGetContent() @no resource ptr: RAD_ERROR_NOCONTENT\n"; // idb
char aRadgetconten_4[] = "radGetContent() content->id: %I64u content->size: %d return: %d\n"; // idb
char a72_3_184_153[13] = "72.3.184.153"; // weak
__int16 word_696CB4 = 17475; // weak
char aFinal2_0_0_0[14] = "FINAL 2.0.0.0"; // weak
CHAR aUserid_0[] = "userid"; // idb
char aThreadstartses[] = "threadStartSession(): %s\n"; // idb
char aD_D_D_D[] = "%d.%d.%d.%d"; // idb
char aThreadstarts_0[] = "threadStartSession(): dcpStartSesssion success: (%s) %s\n"; // idb
char aCellid_0[] = "cellid"; // idb
char aContentid_0[] = "contentid"; // idb
char aContenttype[] = "contenttype"; // idb
char aSize_0[] = "size"; // idb
char aD_4[] = "%d"; // idb
char aVersion[] = "version"; // idb
char aD_5[] = "%d"; // idb
char aWeight_0[] = "weight"; // idb
char aD_6[] = "%d"; // idb
char aActivate[] = "activate"; // idb
char aD_7[] = "%d"; // idb
char aExpire[] = "expire"; // idb
char aD_8[] = "%d"; // idb
char aDayparts[] = "dayparts"; // idb
char aD_9[] = "%d"; // idb
char aPeruserlimit[] = "peruserlimit"; // idb
char aD_10[] = "%d"; // idb
char aDisplayafter[] = "displayafter"; // idb
char aI64d_0[] = "%I64d"; // idb
char aThreadhandleco[] = "threadHandleContentList(): REF content %d\n"; // idb
char aThreadhandle_2[] = "threadHandleContentList(): NEW content %d\n"; // idb
char aThreadhandlece[] = "threadHandleCellList(): app_id %d cellCount %d\n"; // idb
char aThreadhandle_0[] = "threadHandleCellList(): REF cell %d ref: %d\n"; // idb
char aThreadhandle_1[] = "threadHandleCellList(): NEW cell: %d\n"; // idb
char aThreadhandle_3[] = "threadHandleCellList(): shutdown_event\n"; // idb
char aThreadhandle_4[] = "threadHandleCellList(): UNREF cell %d\n"; // idb
char aThreadhandle_5[] = "threadHandleCellList(): UNREF resource %d\n"; // idb
char aThreadupdateco[] = "threadUpdateContent()\n"; // idb
char aThreaddownload[] = "threadDownloadContent(): START content %d\n"; // idb
char aThreaddownlo_0[] = "threadDownloadContent(): error content %d\n"; // idb
char aThreaddownlo_1[] = "threadDownloadContent(): COMPLETE content %d\n"; // idb
char aThreadrunDownl[] = "threadRun(): download complete\n"; // idb
sairuk
Posts: 50
Joined: Sat May 12, 2012 4:45 am
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby sairuk » Sat Oct 15, 2016 10:31 pm

Yeh also spent the better part of yesterday trying to bypass that check to no avail, I zero'd out the ip in the call home first then started digging further into the exe, sounds like you managed to get much more done than me, ta for the info.

I'm trying to remember old tools (w32dasm) from thps2 days and windows in general o_0, managed to break loading so was on a track at one point.

If nothing else it runs under wine (to the same point) at least I suppose.
thps,info | thpsdump
mameau - My random bits | Wah!Ki - A Wah!Cade wiki
Morten1337
Posts: 132
Joined: Tue Jun 08, 2010 11:11 pm
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby Morten1337 » Sat Oct 15, 2016 11:00 pm

Actually, i just got it to work! ...kinda

It seems like the function that loads the levels will change the "load script" to Load_SJ if the requested level isnt Load_Skateshop(mainmenu) or Load_SJ.

Code: Select all

//----- (004F86D0) --------------------------------------------------------
char sub_4F86D0()
{
  int v0; // eax@1

  v0 = *(_DWORD *)(dword_76A788 + 916);
  if ( v0 == /*-1624526921*/"load_skateshop" && !byte_686220 )
  {
    sub_6206B0((int)&unk_683EF8);
    exit(0);
  }
  byte_686220 = 0;
  if ( v0 != /*-1624526921*/"load_skateshop" && v0 != /*161763016*/"Load_SJ" )
    v0 = /*161763016*/"Load_SJ";
  sub_4F8190((_BYTE *)dword_76A788, v0);
  return 1;
}


I removed this part by replacing the bytes between 000F86DC and 000F871A with 0x90 in THUG.exe

This allows you to load all the other levels like normal. BUT Slam City Jam still wont load.
sairuk
Posts: 50
Joined: Sat May 12, 2012 4:45 am
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby sairuk » Sat Oct 15, 2016 11:07 pm

Awesome, I'll have to have a go later on today when I'm back at the PC. There are a couple of test levels in the tree stuct but not being familiar with the thug series I can't say if they are normal
thps,info | thpsdump
mameau - My random bits | Wah!Ki - A Wah!Cade wiki
Morten1337
Posts: 132
Joined: Tue Jun 08, 2010 11:11 pm
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby Morten1337 » Sun Oct 16, 2016 9:38 pm

I'm just going to quote what i posted in that other thread.
http://assemblergames.com/l/threads/pot ... 00s.63571/
morten wrote:After some debugging, and patching, i've been able to get past the loading screen.
And i discovered some interesting things about this build.

It seems like this build was only supposed to load one level (Slam City Jam).
And it looks like it was some kind of test for dynamic advertisements.
Something that was later seen in Tony Hawk's American Wasteland on pc... Could be relevant, maybe??

The game executable has references to a few scene material ids.
When the game loads a level, and there is a match for one of these materials, it replaces it with a blank/invisible material.

However it also creates a few duplicates of two different meshes that use one of these special materials. And these the meshes are then given a new position, orientation and material.

My guess is that the game is supposed to download bitmap data from a server, and then replace some of these materials/textures with ads?
There is a fallback routine in the code, since there's a reference for "default_ad.bmp", but i haven't been able to get that to work.

The game data files looks to be the same as the retail version, and the creation dates vary between 2003 and 2004.
The THUG.exe and Launcher.exe however, seems to be updated sometime in 2007 ???

screenshots:
http://imgur.com/a/4WkPf

Here's the patch offsets/bytes:

Code: Select all

// allow loading of other levels.
// nop 62 bytes
@ 000F86DC
OLD: 3D B7 AF 2B 9F 75 1D 80 3D 20 62 68 00 00 75 14 68 F8 3E 68 00 E8 BA 7F 12 00 83 C4 04 6A 00 E8 E3 20 10 00 3D B7 AF 2B 9F C6 05 20 62 68 00 00 74 0C 3D C8 4E A4 09 74 05 B8 C8 4E A4 09
NEW: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90

// fix scj crash / hang
@ 000BF374
OLD: 3D E9 33 90 FD 75 06
NEW: 90 90 90 90 90 90 90

@ 000BF37B
OLD: B8 8F 01 00 00
NEW: B8 00 00 00 00

sairuk
Posts: 50
Joined: Sat May 12, 2012 4:45 am
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby sairuk » Sun Oct 16, 2016 10:11 pm

hrrrm yeh that would make some sense, i'd planned to run a hash check against the file in this build to retail (which I need to get) at some point but if anyone hast thug retail then they could do so relatively easily.
thps,info | thpsdump
mameau - My random bits | Wah!Ki - A Wah!Cade wiki
sairuk
Posts: 50
Joined: Sat May 12, 2012 4:45 am
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby sairuk » Tue Oct 25, 2016 11:02 am

thps,info | thpsdump
mameau - My random bits | Wah!Ki - A Wah!Cade wiki
quazz
Posts: 185
Joined: Sat May 01, 2010 5:57 pm
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby quazz » Wed Oct 26, 2016 2:00 am

Thanks Sairuk!
sairuk
Posts: 50
Joined: Sat May 12, 2012 4:45 am
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby sairuk » Sat Nov 05, 2016 1:49 pm

Today I was given a pressed THPS disc I'd never seen the likes of before (looks like a HK Silver pirate) which was found a thrift store. I had expected it to contain the retail THPS which it did not.

Updating it all here ---> https://www.mameau.com/thps/thpsSK707/
Attachments
sk707_disc.jpg
sk707_disc.jpg (52.82 KiB) Viewed 19575 times
Last edited by sairuk on Sun Nov 06, 2016 4:47 pm, edited 6 times in total.
thps,info | thpsdump
mameau - My random bits | Wah!Ki - A Wah!Cade wiki
quazz
Posts: 185
Joined: Sat May 01, 2010 5:57 pm
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby quazz » Sun Nov 06, 2016 6:22 am

Cool - Feel free to give the Wad extraction a shot with Demo's tool:

https://www.thmods.com/forum/viewtopic.php?f=5&t=247
Samarasz
Posts: 72
Joined: Sat Mar 20, 2010 6:24 pm
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby Samarasz » Sun Dec 04, 2016 6:20 pm

Just found this: http://assemblergames.com/l/threads/pot ... 00s.63571/


However to get this booting you need to follow the steps as followed (you can find the exact steps in the thread as well):

1. manually copy folder "Activision" from ISO to c:/program files (x86)/
2. run Launcher.exe
3. Patch the exe, by default the EXE just crashes:

// allow loading of other levels.
// nop 62 bytes
@ 000F86DC
OLD: 3D B7 AF 2B 9F 75 1D 80 3D 20 62 68 00 00 75 14 68 F8 3E 68 00 E8 BA 7F 12 00 83 C4 04 6A 00 E8 E3 20 10 00 3D B7 AF 2B 9F C6 05 20 62 68 00 00 74 0C 3D C8 4E A4 09 74 05 B8 C8 4E A4 09
NEW: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90

// fix scj crash / hang
@ 000BF374
OLD: 3D E9 33 90 FD 75 06
NEW: 90 90 90 90 90 90 90

@ 000BF37B
OLD: B8 8F 01 00 00
NEW: B8 00 00 00 00


Thanks to Morten for the instructions regarding on how to patch the EXE and thanks to SILENT_Pavel for the instructions on how to actually install the game.

I tried to patch the EXE but no luck. Can anyone else try?
_ENunn_
Posts: 109
Joined: Fri Apr 04, 2014 12:21 am
Location: Henderson, KY, USA
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby _ENunn_ » Sun Dec 04, 2016 6:49 pm

Samarasz wrote:I tried to patch the EXE but no luck. Can anyone else try?


I've patched the EXE with all the levels loading but not SSJ or that other one since I can't find the hex codes for them. Oh well.

Here's the EXE:
https://mega.nz/#!MEZF2QzY!bPMheH9ZvNFQ ... D5eQtzSn2k
lol hi
Samarasz
Posts: 72
Joined: Sat Mar 20, 2010 6:24 pm
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby Samarasz » Sun Dec 04, 2016 6:56 pm

@_ENunn_ Thanks for your patched EXE :)
_ENunn_
Posts: 109
Joined: Fri Apr 04, 2014 12:21 am
Location: Henderson, KY, USA
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby _ENunn_ » Sun Dec 04, 2016 6:59 pm

Samarasz wrote:@_ENunn_ Thanks for your patched EXE :)


No problem.
lol hi
Morten1337
Posts: 132
Joined: Tue Jun 08, 2010 11:11 pm
Contact:

Re: THPS Proto/Beta thread - THPS1 DC Beta

Postby Morten1337 » Mon Dec 05, 2016 7:44 pm

Heres the patch that allows you to play other game-modes. Not just freeskate.

Code: Select all

@ 000F83EA
OLD: C7 46 74 5C 8B A3 1C
NEW: 8B 4C 24 04 89 4E 74


You should also make sure the game dosnt try to connect to that ip address.
You can either redirect it in your "hosts" file, or you can use this patch.

Code: Select all

@ 00296CA4
OLD: 37 32 2E 33 2E 31 38 34 2E 31 35 33 // 72.3.184.153
NEW: 31 32 37 2E 30 2E 30 2E 31 00 00 00 // 127.0.0.1...

Return to “General thps talk”

Who is online

Users browsing this forum: No registered users and 31 guests