Illustration of Breeze in action
See number search number and we find Mp easy.
Thanks to Klass information we also found Hp
JumpBack from where Mp is and turn on labels to see what access the previous Klass.
Trim (optional, you can just leave those that don't look promising, you just end up with extra, some of the time you get surprise present from those extra)
Next depth comes 1473 nodes and 26 labels. You don't need to look at them unless you want to at this stage. Normally I just let it go to main then see which one survive over time and examine them then.
You can use the "Analyse this label" button to navigate to any of the node and examine it.
Unity game tend to cross link a lot, not all 1473 nodes found are live, maybe only just a hand full are still live, abandoned nodes don't get removed immediately and they still have links that are good, hacking the node that is dead may not yield any result. Also Klass is like a standard form someone make for you to use. You don't have to use everything available in the form. What you see may not be used by the game at all. The reason is a team make the game. Team member that create Klass normally are not the one who choose to use it.
The best way to find a live Klass is by the method that access them. Unity also have a lot of methods which are not used by the one who decides which to use. Same with fields, methods were created by people who normally never got to decide which get use. Their job is to make not use and they always make extra.
Because the Klass is in the chain we know that the Klass is in use. Normally (not always, people decide to use method, sometime update is never used and you just have to keep looking for one that is useful) if we hook "update" we can find all the live instance of the Klass.
When desperate you do the hunt. Otherwise just do the brute force method of pointer search or gen2 watch.
I did until I accumulated enough candidates (BM 802). Then let the game eliminated those that are no good. Restarting the game is the fastest way to get rid of no good pointers. For pointer search you can just skip the trim and analyze and go straight to this brute force work flow. I did the above just to illustrate the tool.
Jumpback node data is only good when the game state is preserved. Since the usefulness don't live long it is not auto saved. Once you exit breeze it is all gone. You can manually use the save button to save it if you want to go back to the game but not change the game state you are doing this pointer search for. Say you hack a value and want to see if it do anything.
Play the game a bit and check the bookmark
Some bookmark are already no good. The "Perform Clean up" will clear all those that does not resolve to any memory address.
None give the mp value. So this shows that pointer chain for battle is not the same as walking which is not uncommon.
When you perform clean up be aware of the game state. There is a chance you wasted good pointer but bear in mind that game developer sometime(often) don't use persistent field during battle.
Placing a gen2 watch on mp quickly yield this method. The letter PC may stand for Player Character, if it does (can be tested by watching this asm to see if it only access PC). The function name is normally indicative of how the chain is going to come down from "Save". "Save" is quite often a global that we can get a pointer chain from main. Why we did not find one earlier is a mystery, I will do that pointer chain search later.
I am going to just play and do random things with this game for a while. Will come back to making this walkthrough later.
Redo the pointer search shown above. This time do the clearing while in battle and I found this one.
View the upstream Klass and here we see where the path split between Friend and Foe.
Change the offset to 0x30 and we have one of the enemy HP
Watch what access enemy hp and do function up to find the start of that function. Look at the name of this method. This is where you can perhaps make a one hit kill, by making the subtraction a big value. I make a cheat what subtract -5000 instead of the original.
To be continued
See number search number and we find Mp easy.
Thanks to Klass information we also found Hp
JumpBack from where Mp is and turn on labels to see what access the previous Klass.
Trim (optional, you can just leave those that don't look promising, you just end up with extra, some of the time you get surprise present from those extra)
Next depth comes 1473 nodes and 26 labels. You don't need to look at them unless you want to at this stage. Normally I just let it go to main then see which one survive over time and examine them then.
You can use the "Analyse this label" button to navigate to any of the node and examine it.
Unity game tend to cross link a lot, not all 1473 nodes found are live, maybe only just a hand full are still live, abandoned nodes don't get removed immediately and they still have links that are good, hacking the node that is dead may not yield any result. Also Klass is like a standard form someone make for you to use. You don't have to use everything available in the form. What you see may not be used by the game at all. The reason is a team make the game. Team member that create Klass normally are not the one who choose to use it.
The best way to find a live Klass is by the method that access them. Unity also have a lot of methods which are not used by the one who decides which to use. Same with fields, methods were created by people who normally never got to decide which get use. Their job is to make not use and they always make extra.
Because the Klass is in the chain we know that the Klass is in use. Normally (not always, people decide to use method, sometime update is never used and you just have to keep looking for one that is useful) if we hook "update" we can find all the live instance of the Klass.
When desperate you do the hunt. Otherwise just do the brute force method of pointer search or gen2 watch.
I did until I accumulated enough candidates (BM 802). Then let the game eliminated those that are no good. Restarting the game is the fastest way to get rid of no good pointers. For pointer search you can just skip the trim and analyze and go straight to this brute force work flow. I did the above just to illustrate the tool.
Jumpback node data is only good when the game state is preserved. Since the usefulness don't live long it is not auto saved. Once you exit breeze it is all gone. You can manually use the save button to save it if you want to go back to the game but not change the game state you are doing this pointer search for. Say you hack a value and want to see if it do anything.
Play the game a bit and check the bookmark
Some bookmark are already no good. The "Perform Clean up" will clear all those that does not resolve to any memory address.
None give the mp value. So this shows that pointer chain for battle is not the same as walking which is not uncommon.
When you perform clean up be aware of the game state. There is a chance you wasted good pointer but bear in mind that game developer sometime(often) don't use persistent field during battle.
Placing a gen2 watch on mp quickly yield this method. The letter PC may stand for Player Character, if it does (can be tested by watching this asm to see if it only access PC). The function name is normally indicative of how the chain is going to come down from "Save". "Save" is quite often a global that we can get a pointer chain from main. Why we did not find one earlier is a mystery, I will do that pointer chain search later.
I am going to just play and do random things with this game for a while. Will come back to making this walkthrough later.
Redo the pointer search shown above. This time do the clearing while in battle and I found this one.
View the upstream Klass and here we see where the path split between Friend and Foe.
Change the offset to 0x30 and we have one of the enemy HP
Watch what access enemy hp and do function up to find the start of that function. Look at the name of this method. This is where you can perhaps make a one hit kill, by making the subtraction a big value. I make a cheat what subtract -5000 instead of the original.
To be continued
Last edited by TomSwitch,
