posted 03-08-14 11:56 AM CT (US)
just found this while i was adding new triggers into the game
the AI Signal and AI Script Goal triggers read/write from/to some buffers in the game memory, but the game developers forgot to add a basic check to make sure the value is not< 0 or > 255 which allows a buffer overflow
so basically, you can read or write '01 00 00 00' anywhere in the game memory (must be a multiplier of 4). and using invert condition trick you can check if a value is different than '01 00 00 00'
you only need some tool or a modified aokts that allows to specify any amount< 0 or > 255
Condition 'AI Signal' (set with: set-signal) reads from 0x006B45B8
Effect 'AI Script Goal' (check with: event-detected; reset with: acknowledge-event) writes to 0x006B39A0
# examples:
1. if you want to write to address 0x0066B000: (66B000 - 6B39A0) / 4 = FFFEDD98 (-74344 in decimal) so you just need to type: AI Script Goal '-74344'
2. here is an useful example to detect if the map is being played in singleplayer or in multiplayer:http://www.mediafire.com/download/d3qtk1w4dg6jlrk/AI_Signal_Exploit_Example.scx
3. detecting player 1 taunts (1 to 44):
http://www.mediafire.com/download/iu8y1yyg7dcjvld/Detect_Taunts_Example.scx
# known values for condition AI Signal:
- detect AI Script Goal: -774 + ID
- detect single-player game: -1034
- detect taunts: -518 + ((PLAYER - 1) * 64) + (TAUNT - 1) / 4
- detect Starting Resources - Standard: -1036
# known values for effect AI Script Goal:
- set AI Signal: 774 + ID
- set AI Shared Goal: -258 + ID
the AI Signal and AI Script Goal triggers read/write from/to some buffers in the game memory, but the game developers forgot to add a basic check to make sure the value is not
so basically, you can read or write '01 00 00 00' anywhere in the game memory (must be a multiplier of 4). and using invert condition trick you can check if a value is different than '01 00 00 00'
you only need some tool or a modified aokts that allows to specify any amount
Condition 'AI Signal' (set with: set-signal) reads from 0x006B45B8
Effect 'AI Script Goal' (check with: event-detected; reset with: acknowledge-event) writes to 0x006B39A0
# examples:
1. if you want to write to address 0x0066B000: (66B000 - 6B39A0) / 4 = FFFEDD98 (-74344 in decimal) so you just need to type: AI Script Goal '-74344'
2. here is an useful example to detect if the map is being played in singleplayer or in multiplayer:
3. detecting player 1 taunts (1 to 44):
# known values for condition AI Signal:
- detect AI Script Goal: -774 + ID
- detect single-player game: -1034
- detect taunts: -518 + ((PLAYER - 1) * 64) + (TAUNT - 1) / 4
- detect Starting Resources - Standard: -1036
# known values for effect AI Script Goal:
- set AI Signal: 774 + ID
- set AI Shared Goal: -258 + ID
[This message has been edited by JustTesting1234 (edited 05-26-2014 @ 12:16 PM).]
