Gaulish Gaming Banquet: editor

deathhound246

Tie Fighter, X Wing and Land Speeder

deathhound246

pegperegogaucho

Chew🔙a

pegperegogaucho

What do the nodes look like? Is the 3D model also a reference or just the name that is chosen like that?

deathhound246

Nah just the name thats a reference. The same models are used in other maps but have normal names. From what I've seen, only these nodes in S01 LVL020 have this

deathhound246

Not sure if any other nodes have references aswell. Havent seen any yet

deathhound246

Have any PC versions of some of ELB's games had some executable sections encrypted or something? I'm trying to find CMaterial::deserialize on the Steam build and this should be it

deathhound246

But it is absolutely not it

deathhound246

I'm wondering if .text is encrypted or something, and decrypted at runtime?

pegperegogaucho

Are you sure this is the CMaterial::deserialize?

deathhound246

i followed the class vtable, 13th function in. This should be it Also worth noting, alot of the other "virtual funcs" in the vtable, ghidra think is data rather than functions

pegperegogaucho

What you could do to find out the deserialize function and, at the same time, check if the executable is "encrypted" is to find a CMaterial object in-game in memory, then follow the vtable and access the virtual ::deserialize function through there

deathhound246

true enough! never thought of doing that

pegperegogaucho

You could do this in cheat engine or the IDA debugger

pegperegogaucho

the vtable should be right at the start of the object, the very first member per-se

deathhound246

There is also the exe Adrien found that has RTTI info. It seems to have the functions just fine, but ofc it was built differently, and not sure if it was by the devs

deathhound246

Saying this, I also know the earlier dvdrom builds, do have SecurROM present. Steam build does have strings for it too, but I didn't think it was "active" as such. Potentially looks like it could be?

pegperegogaucho

I don't know about SecuROM, but if the executable is encrypted somehow you will have to write out the decrypted executable once it has been decrypted in RAM

deathhound246

How can I tell where the vtable acc starts in ram :Obelul:

deathhound246

aside from just copy pasting each entry till i find a pointer to it

#editor