CG8516
commented
3 months ago Hi! I'm happy to hear you're interested in this project :) Sorry the code's such a mess, I was planning on moving all of the pointerchains/offsets to the Pointer.cs file, but never got around to it.
I'm not sure how much you know about reverse engineering or programming in general, let me know if there's anything I haven't explained in enough detail.
I primarily used cheat engine to find memory addresses, pointerchains, etc... If you haven't spent much time reverse engineering, I would highly recommend completing cheat-engine's built-in tutorial.
I also use ghidra for reverse-engineering, but I think I spent most of my time in cheat engine for this project, as I find it easier to just mess around with values and see what happens within the game.
Both supported versions use "lawnApp,878,a8" for the pointerchain to the 'next level' button. Structs don't typically have drastic changes, so if that pointerchain doesn't work for you, it'd probably be something similar like "lawnApp,87c,b0"
You should mainly be looking for where the classes/structs are stored in the game's memory. There's some very large classes like lawnapp, which is sort of like a manager for the entire game. Then there's other big classes like the board, which contains the state of all the plants/zombies on the board, etc..
But you can trace almost everything back up to the lawnapp class, as it contains references to most of the game components, so finding a stable pointerchain to lawnapp should be your #1 priority.
Once you find a decent lawnapp pointerchain, you can access almost everything in the game with just offsets from that memory address. For example, the board state will typically be stored at "lawnapp,868", which is a pointer that is located 0x868 bytes into the lawnapp class.
If I recall correctly, I think I used the player's sun value to find the board pointer. You can scan for the sun's value in memory, place a plant, rescan, collect sun, rescan, etc.. until you find the exact address.
Once you find the sun's value in memory, you can use the "find out what accesses this address" function in cheat engine, and it will show you what offset the sun value is within the board pointer. eg, it might have an instruction that accesses 'eax+5578' (might look different, but should be similar).
From that, you can assume that 'eax' is a big struct that contains a lot of values (at least up to 0x5578). In this case, eax would be the address where the current board information is stored.
Then you can copy whatever address eax was set to, and found out what writes to that address. You might see an instruction that accesses something like 'ecx+868' In that case, ecx will be the lawnapp struct. And the value at offset 0x868 is a pointer to the board.
So your lawnapp class would look like this: 0x00 - 0x867 : Unknown Data 0x868 : BoardPointer
Then your board struct would be 0x00 - 0x5577 : Unknown Data 0x5578 : Sun value
Cheat engine has a "dissect data/structure" tool, which is really useful for exploring classes/structs. If you open the 'lawnapp' address in the structure dissect tool, you should see some version info / copyright text somewhere near the start of the class.
From the structure dissect tool, you can navigate through pointer chains, and see what each class/struct contains. Sometimes cheat engine will be wrong with its guesses, so you might have to explicitly set an address type to a float for example. But in general, it does a pretty decent job. Sometimes cheat engine will also be able to automatically detect class names within the structure dissect tool, which is very helpful when you're first exploring.
To find things like the current widget, you just want to keep the structure dissector open on the lawnapp address, and look for changes as you open/close menus. Then you can expand those address which change when you open/close menus, and look for values that change when you drag the in-game menus around, they'll probably be for your menu position. Try changing those values from within cheat engine and see if it makes the menu move.
The whole process takes a lot of time and experimentation. It can be hard when you're first starting, but it gets a lot easier with time.
I hope that helps :) Let me know if you have any specific questions, and I'll try to answer them as best as I can.
dellbeat
Hello, I saw this module developed by you on a webpage, and I would like to try to extend its support for version 1.0.0.1051. I have been searching for some information in the past few days, which can help me implement the features needed in the module. However, I haven't found some scenarios yet, such as the basic information (like handle, width, height, etc.) of the "NEXT LEVEL" button within the scene after passing the level.
Since I don't have much experience in reverse engineering, I would like to inquire whether the offset information you previously summarized was obtained through your own reverse engineering. If so, I would like to know how to obtain the button information within the scene. I hope you can provide a general idea, and I will try to explore it myself. Thank you!