1. Do not share user accounts! Any account that is shared by another person will be blocked and closed. This means: we will close not only the account that is shared, but also the main account of the user who uses another person's account. We have the ability to detect account sharing, so please do not try to cheat the system. This action will take place on 04/18/2023. Read all forum rules.
    Dismiss Notice
  2. For downloading SimTools plugins you need a Download Package. Get it with virtual coins that you receive for forum activity or Buy Download Package - We have a zero Spam tolerance so read our forum rules first.

    Buy Now a Download Plan!
  3. Do not try to cheat our system and do not post an unnecessary amount of useless posts only to earn credits here. We have a zero spam tolerance policy and this will cause a ban of your user account. Otherwise we wish you a pleasant stay here! Read the forum rules
  4. We have a few rules which you need to read and accept before posting anything here! Following these rules will keep the forum clean and your stay pleasant. Do not follow these rules can lead to permanent exclusion from this website: Read the forum rules.
    Are you a company? Read our company rules
Shared accounts will be removed Plugin Downloads Zero spam policy Forum Rules

Wings of Prey Plugin assist

Discussion in 'SimTools DIY Version' started by sgtjay5, Dec 23, 2013.

Page 1 of 3
  1. sgtjay5

    sgtjay5 Member

    Joined:
    Dec 21, 2013
    Messages:
    39
    Balance:
    674Coins
    Ratings:
    +19 / 0 / -0
    My Motion Simulator:
    2DOF, DC motor, Arduino
    Hello everyone,
    Wings of Prey is an older game, circa 2009, but it is still a blast to play. The version I have is with their latest update, 1.0.5.1, and with the Wings of the Luftwaffe expansion. I would love to see this game supported by SimTools. For this game, telemetry data is given through memory hooks. Here are some of the addresses I found using Cheat Engine 6.2. Please forgive my ignorance in some areas, because I haven't done this in about a year or more and I've forgotten what in the world I'm doing. If this is not the information needed, let me know and I'll get it. Any help is very much appreciated.

    000028cc-acess.exe

    Pitch: 00C931CC

    005E293D - 57 - push edi
    005E293E - 8D 79 68 - lea edi,[ecx+68]
    005E2941 - B9 F2000000 - mov ecx,000000F2 <<
    005E2946 - F3 A5 - repe movsd
    005E2948 - 5F - pop edi

    EAX=0010F2F8
    EBX=139E66C0
    ECX=00000096
    EDX=005E2930
    ESI=0010F468
    EDI=00C931E0
    ESP=0010F208
    EBP=0010F210
    EIP=005E2946


    Roll: 00C931D0

    005E293D - 57 - push edi
    005E293E - 8D 79 68 - lea edi,[ecx+68]
    005E2941 - B9 F2000000 - mov ecx,000000F2 <<
    005E2946 - F3 A5 - repe movsd
    005E2948 - 5F - pop edi

    EAX=0010F2F8
    EBX=139E66C0
    ECX=00000096
    EDX=005E2930
    ESI=0010F468
    EDI=00C931E0
    ESP=0010F208
    EBP=0010F210
    EIP=005E2946


    Here are some other values I found, but not too important just yet, I think. Yaw, IAS, Thrust, Heading, Horizon, and Vertical G-forces. Thanks everyone.
    • Like Like x 4
    Last edited: Dec 23, 2013
    sgtjay5, Dec 23, 2013
    #1
  2. eaorobbie

    eaorobbie Well-Known Member SimTools Developer Gold Contributor

    Joined:
    May 26, 2009
    Messages:
    2,574
    Occupation:
    CAD Detailer
    Location:
    Ellenbrook, Western Australia
    Balance:
    20,398Coins
    Ratings:
    +1,683 / 23 / -2
    My Motion Simulator:
    2DOF, DC motor, JRK, SimforceGT, 6DOF
    mmm now we just need to turn this into a plugin, waiting for my download to finish then I can play have a demo but I feel need the same to take a look at what you have found, Thanks.
    eaorobbie, Dec 23, 2013
    #2
  3. sgtjay5

    sgtjay5 Member

    Joined:
    Dec 21, 2013
    Messages:
    39
    Balance:
    674Coins
    Ratings:
    +19 / 0 / -0
    My Motion Simulator:
    2DOF, DC motor, Arduino
    You're going to love the game. Again, if the data I provided is not the correct one needed, let me know and I'll do my best to get it to you. I have found some static addresses, but I believe these addresses I've located are not static. Over the course of two or three years, the addresses have changed, which brings me to believe that these addresses will not work with your PC. I hope it does though.
    sgtjay5, Dec 23, 2013
    #3
  4. yobuddy

    yobuddy Well-Known Member Staff Member Moderator SimAxe Beta Tester SimTools Developer Gold Contributor

    Joined:
    Feb 9, 2007
    Messages:
    5,162
    Occupation:
    Computer Technician
    Location:
    Portland, Oregon - USA
    Balance:
    48,171Coins
    Ratings:
    +5,036 / 16 / -0
    Nice Work!! @sgtjay5

    although I have to admit, I only understand the offsets for Roll and Pitch with what you have posted. I'm not sure what I would use for heave, yaw, sway, surge.

    the offsets you have found should only change when the game get's updated.
    otherwise they should stay the same.

    again, nice work!
    yobuddy
    yobuddy, Dec 23, 2013
    #4
  5. value1

    value1 Nerd SimAxe Beta Tester SimTools Developer Gold Contributor

    Joined:
    Jan 9, 2011
    Messages:
    2,184
    Location:
    Zug, Switzerland
    Balance:
    14,497Coins
    Ratings:
    +3,319 / 11 / -1
    My Motion Simulator:
    2DOF, DC motor, JRK, Joyrider
    Yaw, Heading and Vertical G-forces will for sure be interesting too
    value1, Dec 23, 2013
    #5
  6. sgtjay5

    sgtjay5 Member

    Joined:
    Dec 21, 2013
    Messages:
    39
    Balance:
    674Coins
    Ratings:
    +19 / 0 / -0
    My Motion Simulator:
    2DOF, DC motor, Arduino
    Here are the other addresses I found.

    Yaw: 00C931B8

    005E293D - 57 - push edi
    005E293E - 8D 79 68 - lea edi,[ecx+68]
    005E2941 - B9 F2000000 - mov ecx,000000F2 <<
    005E2946 - F3 A5 - repe movsd
    005E2948 - 5F - pop edi

    EAX=0010F2F8
    EBX=139E66C0
    ECX=00000096
    EDX=005E2930
    ESI=0010F468
    EDI=00C931E0
    ESP=0010F208
    EBP=0010F210
    EIP=005E2946


    Thrust: 00C9326C (As displayed on the in-game HUD)

    005E293D - 57 - push edi
    005E293E - 8D 79 68 - lea edi,[ecx+68]
    005E2941 - B9 F2000000 - mov ecx,000000F2 <<
    005E2946 - F3 A5 - repe movsd
    005E2948 - 5F - pop edi

    EAX=0010F2F8
    EBX=139E66C0
    ECX=00000066
    EDX=005E2930
    ESI=0010F528
    EDI=00C932A0
    ESP=0010F208
    EBP=0010F210
    EIP=005E2946


    IAS (Indicated Air Speed): 00C931B0 (As displayed on the in-game HUD. Converted from MPH to Meters/Sec, I think)

    005E293D - 57 - push edi
    005E293E - 8D 79 68 - lea edi,[ecx+68]
    005E2941 - B9 F2000000 - mov ecx,000000F2 <<
    005E2946 - F3 A5 - repe movsd
    005E2948 - 5F - pop edi

    EAX=0010F2F8
    EBX=139E66C0
    ECX=00000096
    EDX=005E2930
    ESI=0010F468
    EDI=00C931E0
    ESP=0010F208
    EBP=0010F210
    EIP=005E2946


    Heading: 104EB448 (As displayed on the in-game HUD)

    00599256 - E8 8584F2FF - call acess.exe+C16E0
    0059925B - 8B 8B D8030000 - mov ecx,[ebx+000003D8]
    00599261 - F3 0F11 04 B9 - movss [ecx+edi*4],xmm0 <<
    00599266 - 47 - inc edi
    00599267 - 83 FF 69 - cmp edi,69

    EAX=00008000
    EBX=104EAF40
    ECX=104EB3E0
    EDX=000000E4
    ESI=10528B54
    EDI=0000001A
    ESP=0010F910
    EBP=0010F96C
    EIP=00599266


    Horizon: 00C93058 (Differs from pitch, where pitch is centered on reticle. I think Horizon is centered on nose of aircraft)

    005E4C77 - F3 0F11 54 24 3C - movss [esp+3C],xmm2
    005E4C7D - 8B 44 24 3C - mov eax,[esp+3C]
    005E4C81 - 66 0FD6 43 4C - movq [ebx+4C],xmm0 <<
    005E4C86 - 89 43 54 - mov [ebx+54],eax
    005E4C89 - 8B 44 24 48 - mov eax,[esp+48]

    EAX=3E80D000
    EBX=00C93008
    ECX=00000040
    EDX=BE476000
    ESI=0010F46C
    EDI=00C9355C
    ESP=0010F3B0
    EBP=0010F4E0
    EIP=005E4C86


    Pitch G-forces: 00C93070 (When pitch is applied, the value changes positively when upward pitch is applied and negatively when downward pitch is applied)

    005E293D - 57 - push edi
    005E293E - 8D 79 68 - lea edi,[ecx+68]
    005E2941 - B9 F2000000 - mov ecx,000000F2 <<
    005E2946 - F3 A5 - repe movsd
    005E2948 - 5F - pop edi

    EAX=0010F2F8
    EBX=139E66C0
    ECX=000000F1
    EDX=005E2930
    ESI=0010F2FC
    EDI=00C93074
    ESP=0010F208
    EBP=0010F210
    EIP=005E2946
    • Like Like x 1
    Last edited: Dec 23, 2013
    sgtjay5, Dec 23, 2013
    #6
  7. sgtjay5

    sgtjay5 Member

    Joined:
    Dec 21, 2013
    Messages:
    39
    Balance:
    674Coins
    Ratings:
    +19 / 0 / -0
    My Motion Simulator:
    2DOF, DC motor, Arduino
    And another...

    Yaw G-forces: 00C93078 (When lateral motion is applied during yaw movement to the right, value changes positively along the yaw axis. During yaw movement to the left, value changes negatively along the yaw axis. Like the Vertical G-force value, once the aircraft settles, value changes back to zero)

    005E293D - 57 - push edi
    005E293E - 8D 79 68 - lea edi,[ecx+68]
    005E2941 - B9 F2000000 - mov ecx,000000F2 <<
    005E2946 - F3 A5 - repe movsd
    005E2948 - 5F - pop edi

    EAX=0010F2F8
    EBX=139E66C0
    ECX=000000EF
    EDX=005E2930
    ESI=0010F304
    EDI=00C9307C
    ESP=0010F208
    EBP=0010F210
    EIP=005E2946
    • Like Like x 1
    Last edited: Dec 23, 2013
    sgtjay5, Dec 23, 2013
    #7
  8. sgtjay5

    sgtjay5 Member

    Joined:
    Dec 21, 2013
    Messages:
    39
    Balance:
    674Coins
    Ratings:
    +19 / 0 / -0
    My Motion Simulator:
    2DOF, DC motor, Arduino
    Roll G-force: 00C93074 (When a right roll is applied, value changes positively. When a left roll is applied, value changes negatively. Once no more force is applied, value changes back to zero, even though aircraft may not be level with the horizon.)

    005E293D - 57 - push edi
    005E293E - 8D 79 68 - lea edi,[ecx+68]
    005E2941 - B9 F2000000 - mov ecx,000000F2 <<
    005E2946 - F3 A5 - repe movsd
    005E2948 - 5F - pop edi

    EAX=0010F2F8
    EBX=139E66C0
    ECX=000000F0
    EDX=005E2930
    ESI=0010F300
    EDI=00C93078
    ESP=0010F208
    EBP=0010F210
    EIP=005E2946
    • Like Like x 1
    sgtjay5, Dec 23, 2013
    #8
  9. yobuddy

    yobuddy Well-Known Member Staff Member Moderator SimAxe Beta Tester SimTools Developer Gold Contributor

    Joined:
    Feb 9, 2007
    Messages:
    5,162
    Occupation:
    Computer Technician
    Location:
    Portland, Oregon - USA
    Balance:
    48,171Coins
    Ratings:
    +5,036 / 16 / -0
    Degrees - simply output the current degree of tip or turn.
    G-forces - return to zero.

    This is what we are looking for:
    Roll - in degrees
    Pitch- in degrees
    Heave- in Gforces
    Yaw- in degrees
    Sway - in Gforces
    Surge - in Gforces


    Looks like we have:
    Roll - in degrees = Pitch: 00C931CC
    Pitch- in degrees = Roll: 00C931D0
    Heave- in Gforces = Vertical G-force (you mention this force - but I don't see it listed?)
    Yaw- in degrees = (don't think we have this one yet?)
    Sway - in Gforces = Roll G-force - (don't think we have this one yet?)
    Surge - in Gforces = Pitch G-forces: 00C93070
    Extra1 - in Gforces = Yaw: 00C931B8

    but I might have missed one, lol
    Dustin
    yobuddy, Dec 23, 2013
    #9
  10. sgtjay5

    sgtjay5 Member

    Joined:
    Dec 21, 2013
    Messages:
    39
    Balance:
    674Coins
    Ratings:
    +19 / 0 / -0
    My Motion Simulator:
    2DOF, DC motor, Arduino
    My bad. I changed the name of vertical g-force to pitch g-force in an effort to not confuse myself even more. Looks like you are correct about the yaw. I may have targeted the wrong one. Looks like it moves from -102 to 102 during yaw movement, but doesn't look right. I'll give it another go.
    • Like Like x 1
    sgtjay5, Dec 23, 2013
    #10
  11. sgtjay5

    sgtjay5 Member

    Joined:
    Dec 21, 2013
    Messages:
    39
    Balance:
    674Coins
    Ratings:
    +19 / 0 / -0
    My Motion Simulator:
    2DOF, DC motor, Arduino
    This might be the yaw. It goes from -0.92 to 0.92 in float and seems to move accordingly with yaw movement, I think. Here is the data:

    Yaw?: 00C93048

    005E4BFB - F3 0F5C E3 - subss xmm4,xmm3
    005E4BFF - F3 0F7E 5C 24 34 - movq xmm3,[esp+34]
    005E4C05 - 66 0FD6 5B 40 - movq [ebx+40],xmm3 <<
    005E4C0A - F3 0F10 9C 24 D4000000 - movss xmm3,[esp+000000D4]
    005E4C13 - F3 0F11 64 24 3C - movss [esp+3C],xmm4

    EAX=009E71C0
    EBX=00C93008
    ECX=00000040
    EDX=32B2A5F1
    ESI=0010F46C
    EDI=00C9355C
    ESP=0010F3B0
    EBP=0010F4E0
    EIP=005E4C0A
    • Like Like x 1
    sgtjay5, Dec 24, 2013
    #11
  12. RufusDufus

    RufusDufus Well-Known Member

    Joined:
    Jul 21, 2013
    Messages:
    681
    Location:
    Adelaide Australia
    Balance:
    15,644Coins
    Ratings:
    +1,009 / 8 / -1
    Great work... How do you find this info? I assume it is slow work but is it straight forward? :think
    RufusDufus, Dec 24, 2013
    #12
  13. sgtjay5

    sgtjay5 Member

    Joined:
    Dec 21, 2013
    Messages:
    39
    Balance:
    674Coins
    Ratings:
    +19 / 0 / -0
    My Motion Simulator:
    2DOF, DC motor, Arduino
    It can sometimes be slow. I use cheat engines to view the memory locations within the process of the game to look for specific values or conversions thereof. For an easy example, if my throttle is at 52%, I look for values similar to 52, like 5.2 or 0.52 or 52.00. In the case of Wings of Prey, I found the static float value of throttle to be 5.2xxxxxx. But these guys here are like magicians and know more about how to get the data than I ever could. Also, the other site has good tutorials on how to find them.
    sgtjay5, Dec 24, 2013
    #13
  14. eaorobbie

    eaorobbie Well-Known Member SimTools Developer Gold Contributor

    Joined:
    May 26, 2009
    Messages:
    2,574
    Occupation:
    CAD Detailer
    Location:
    Ellenbrook, Western Australia
    Balance:
    20,398Coins
    Ratings:
    +1,683 / 23 / -2
    My Motion Simulator:
    2DOF, DC motor, JRK, SimforceGT, 6DOF
    Maybe we need one here two, this is the same method I use too, but been a while since i searched a game for values.
    Thanks again @sgtjay5
    eaorobbie, Dec 24, 2013
    #14
  15. sgtjay5

    sgtjay5 Member

    Joined:
    Dec 21, 2013
    Messages:
    39
    Balance:
    674Coins
    Ratings:
    +19 / 0 / -0
    My Motion Simulator:
    2DOF, DC motor, Arduino
    No problem. My pleasure. Perhaps I can try to make a tutorial. Well, with the values I found, I attempted to create the plugin via the tutorial, unsuccessfully. I attempted to follow the tutorial, but it seems that the examples in the tutorial is different from the example plugins. I think I fouled up because of how I inputted the offsets. What format are they supposed to be in, hex, dec, etc.? It seems that it has to be dec, correct? Or use the UI prefix &H in hex form? Do I input the offset value or the actual address? I also probably fouled up the area "Used by GameManager to Process a MemoryHook". Is there another example .sln file I can follow? I have managed to make everything look right, minus the fact that I cannot see any motion in SimTools. Well, you guys have been awesome. Hope you guys are having a very Merry Christmas.
    sgtjay5, Dec 24, 2013
    #15
  16. prilad

    prilad Well-Known Member SimAxe Beta Tester SimTools Developer

    Joined:
    Apr 29, 2012
    Messages:
    380
    Location:
    Dubna, Russia
    Balance:
    9,614Coins
    Ratings:
    +512 / 1 / -0
    My Motion Simulator:
    3DOF, DC motor, Arduino, 4DOF
    Excuse my stupid, buddy, but I can't understand your information. For example you write:

    Yaw?: 00C93048 // as I see - this is Address in process memory space? And "Yaw" value is on this address? But which format? 4-byte float or 8-byte float?

    005E4BFB - F3 0F5C E3 - subss xmm4,xmm3 // what mean these instructions and how they relate to the address of a variable?
    005E4BFF - F3 0F7E 5C 24 34 - movq xmm3,[esp+34]
    005E4C05 - 66 0FD6 5B 40 - movq [ebx+40],xmm3 <<
    005E4C0A - F3 0F10 9C 24 D4000000 - movss xmm3,[esp+000000D4]
    005E4C13 - F3 0F11 64 24 3C - movss [esp+3C],xmm4

    EAX=009E71C0 // And absolutely do not understand why you bring the contents of registers
    EBX=00C93008
    ECX=00000040
    EDX=32B2A5F1
    ESI=0010F46C
    EDI=00C9355C
    ESP=0010F3B0
    EBP=0010F4E0
    EIP=005E4C0A
    prilad, Dec 24, 2013
    #16
  17. sgtjay5

    sgtjay5 Member

    Joined:
    Dec 21, 2013
    Messages:
    39
    Balance:
    674Coins
    Ratings:
    +19 / 0 / -0
    My Motion Simulator:
    2DOF, DC motor, Arduino
    Hi prilad,
    I apologize for my garbled mess of information, but I wanted to provide as much information as possible. All the data you see comes from Cheat Engine's printout of what writes to that specific address. For your specific question about which format the Yaw value was in, it is in float. Seems like 99% of the found values for Wings of Prey is float. If there is a specific format I need to provide the information in, please advise. Thanks.
    sgtjay5, Dec 24, 2013
    #17
  18. yobuddy

    yobuddy Well-Known Member Staff Member Moderator SimAxe Beta Tester SimTools Developer Gold Contributor

    Joined:
    Feb 9, 2007
    Messages:
    5,162
    Occupation:
    Computer Technician
    Location:
    Portland, Oregon - USA
    Balance:
    48,171Coins
    Ratings:
    +5,036 / 16 / -0
    I will help put this together for you.

    Question?
    What is the games process name while running???
    (look in task manager when the game is running)

    yobuddy
    • Like Like x 1
    yobuddy, Dec 24, 2013
    #18
  19. sgtjay5

    sgtjay5 Member

    Joined:
    Dec 21, 2013
    Messages:
    39
    Balance:
    674Coins
    Ratings:
    +19 / 0 / -0
    My Motion Simulator:
    2DOF, DC motor, Arduino
    Thanks yobuddy. The process is acess (acess.exe more specifically).
    sgtjay5, Dec 24, 2013
    #19
  20. yobuddy

    yobuddy Well-Known Member Staff Member Moderator SimAxe Beta Tester SimTools Developer Gold Contributor

    Joined:
    Feb 9, 2007
    Messages:
    5,162
    Occupation:
    Computer Technician
    Location:
    Portland, Oregon - USA
    Balance:
    48,171Coins
    Ratings:
    +5,036 / 16 / -0
    This is what I have right now for try#1

    _MemHook_Roll AsUInteger = &HC931D0 'This is the memory offset
    _MemHook_Pitch AsUInteger = &HC931CC 'This is the memory offset
    _MemHook_Heave AsUInteger = &H 'This is the memory offset
    _MemHook_Yaw AsUInteger = &HC93048 'This is the memory offset
    _MemHook_Sway AsUInteger = &H 'This is the memory offset
    _MemHook_Surge AsUInteger = &HC93070 'This is the memory offset
    _MemHook_Extra1 AsUInteger = &HC93078 'This is the memory offset

    We need a sway and a heave to test with (I did not see them?).
    And we have 3 yaws or more posted to test out.
    What offsets would you like to try for sway and heave?
    And if I got one wrong please let me know.

    yobuddy
    yobuddy, Dec 24, 2013
    #20
Page 1 of 3