Go Back   FileForums > Game Backup > PC Games > PC Games - CD/DVD Conversions > Conversion Tutorials

Reply
 
Thread Tools Display Modes
  #1  
Old 06-02-2022, 01:34
Masquerade's Avatar
Masquerade Masquerade is offline
Registered User
 
Join Date: Jan 2020
Location: Monte d'Or
Posts: 729
Thanks: 159
Thanked 760 Times in 381 Posts
Masquerade is on a distinguished road
TTMagic | TTGames Universal Anti-Anti-DAT Check Patch

TTMagic | TTGames Universal Anti-Anti-DAT Check Patch

All findings below are part of an investigation by acidicoala, so thank you very much for your time!

In order to make repacks of LEGO games made by TTGames, you need to unpack the DAT archives because the developers use proprietary compression algorithms such as LZ2K in their archives. It is necessary to unpack and decompress these files in order to compress them smaller with tools like LOLZ.

There is also another purpose for unpacking the DAT archives, and this is modding purposes. TTGames developers decided that they did not like this and implemented a function in their game code which checks if the game is running in an unpacked state and if it is, then a FatalExit function is triggered (game crash).

The developer m0xf first figured out how to patch around this check and this is how FitGirl was able to receive patched executables for her repacks which were unpacked and decompressed.

By speaking to acidicoala, we took a look into those patched executables and determined what was changed. There were two bytes changed in the executable header, but we believe this was a watermark more than anything else since this did not affect code execution but would be a great way to check anyone using "FitGirl's" executables in their own repacks.

The next patched byte is most interesting, which was a change from a "74" byte to an "EB" at a seemingly random point in the game's code.

This byte change is significant because "EB" is hexadecimal for JMP opcode (unconditional jump), while 74 is hexadecimal for JE opcode (jump if equal).

So, it can be determined that at some point in the game code, it will jump if something is equal to something else and allow the game to run, but if the game is unpacked and no DAT archives are present, it will not jump and the FatalExit will be triggered. Now, by switching this to an unconditional jump, the game will always jump at this specific point and will always run.

What exactly the game is checking for here we are unsure about, which is why that above paragraph is ever so slightly vague.

The developers used the same function in all of the games that require an EXE patch, as can be seen by the below screenshot:



Because of this, we can construct a pattern.

ALL of the TTGames that have this DAT check will have the same pattern at some point in the EXE file visible in HxD:

Code:
74 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC
The "??" bytes are different across each executable, but the B9, E8 and CC bytes are always in the same position after the 74.

This makes it rather easy to determine whereabouts your game executable needs patching!

However, an even better solution has emerged thanks to acidicoala - Koalyptus framework.

Composed of two binaries, Koalyptus is a framework that can be used to dynamically patch executables in memory. Such runtime patches have the advantage of keeping executables unmodified. The first binary is Koaloader, which hooks into the game process, and Lyptus binary is responsible for patching the executable at runtime.

Project pages:
https://github.com/acidicoala/Koaloader
https://github.com/acidicoala/Lyptus

All of the games load xinput9_1_0.dll, so we'll use this build of Koaloader as our proxy library. This means that all functions that the game would need from the actual xinput9_1_0.dll will still work since Koaloader can pass them to the actual DLL inside System32.

Next, we need to configure Koaloader to load Lyptus64.dll, so we paste this config into Koaloader.json:

Code:
{
  "logging": false,
  "modules": [
    {
      "path": "Lyptus64.dll"
    }
  ]
}
Next, we configure Lyptus64.dll library with the following patch information:

Code:
{
  "logging": false,
  "patches": [
    {
      "name": "TTMagic",
      "pattern": "74 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC",
      "offset": 0,
      "replacement": "EB"
    }
  ]
}
This instructs Lyptus to find that specific pattern and swap the 74 byte for an EB, which will allow our game to run.

Now, you should have four files:
  • xinput9_1_0.dll
  • Koaloader.json
  • Lyptus64.dll
  • Lyptus.json

And these four files go into your unpacked LEGO game folder. Run the DX11 executable and be amazed that the game now loads just fine! Please note that the DX9 executables present in some LEGO games are NOT patched via this method as they are in a different architecture compared to the DX11 executables.

I have included a ready-made zip file below which has everything you need ready to drop into the game folder.

To unpack the games, you will need to use QuickBMS and then one of the below scripts:

[Script 1] - By Aluigi, use this one first.

[Script 2] - Modified script, use this if you get errors with the first script.

Credits
  • m0xf - for the original method for patching the LEGO game executables
  • acidicoala - for spending their time working to make the Koaloader + Lyptus solution and seeing what made the original patches work
  • Aluigi - QuickBMS and script to decompress TTGames proprietary algorithms
Attached Files
File Type: 7z TTMagic.7z (273.6 KB, 34 views)

Last edited by Masquerade; 06-02-2022 at 06:52. Reason: "Lytpus" typo fixed
Reply With Quote
The Following 7 Users Say Thank You to Masquerade For This Useful Post:
:( Sad8669 (06-02-2022), FIFA_LOVER (06-02-2022), Gehrman (06-02-2022), L0v3craft (06-02-2022), Razor12911 (06-02-2022), ScOOt3r (06-02-2022), Wanterlude (06-02-2022)
Sponsored Links
  #2  
Old 06-02-2022, 05:57
FIFA_LOVER FIFA_LOVER is offline
Registered User
 
Join Date: Jul 2021
Location: Los Santos
Posts: 17
Thanks: 54
Thanked 5 Times in 5 Posts
FIFA_LOVER is on a distinguished road
@joe
Although you fixes the Lytpus typo but still this remains

Reply With Quote
  #3  
Old 06-02-2022, 06:52
Masquerade's Avatar
Masquerade Masquerade is offline
Registered User
 
Join Date: Jan 2020
Location: Monte d'Or
Posts: 729
Thanks: 159
Thanked 760 Times in 381 Posts
Masquerade is on a distinguished road
Sorry for the typos, I wrote this one pretty quickly and didn't fully proof read before clicking submit
Reply With Quote
  #4  
Old 06-02-2022, 08:57
FIFA_LOVER FIFA_LOVER is offline
Registered User
 
Join Date: Jul 2021
Location: Los Santos
Posts: 17
Thanks: 54
Thanked 5 Times in 5 Posts
FIFA_LOVER is on a distinguished road
no worries
instead thank u for such amazing post
Reply With Quote
  #5  
Old 02-03-2022, 07:38
dixen dixen is offline
Registered User
 
Join Date: Sep 2014
Location: Russia
Posts: 286
Thanks: 350
Thanked 327 Times in 148 Posts
dixen is on a distinguished road
LEGO Jurassic World - this guide no work(((
UPD
With bms v2 - all work fine)

Last edited by dixen; 02-03-2022 at 10:35.
Reply With Quote
  #6  
Old 02-03-2022, 10:51
Masquerade's Avatar
Masquerade Masquerade is offline
Registered User
 
Join Date: Jan 2020
Location: Monte d'Or
Posts: 729
Thanks: 159
Thanked 760 Times in 381 Posts
Masquerade is on a distinguished road
Quote:
Originally Posted by dixen View Post
LEGO Jurassic World - this guide no work(((
UPD
With bms v2 - all work fine)
Jurassic World does not need a patched EXE.
Reply With Quote
  #7  
Old 02-03-2022, 11:27
dixen dixen is offline
Registered User
 
Join Date: Sep 2014
Location: Russia
Posts: 286
Thanks: 350
Thanked 327 Times in 148 Posts
dixen is on a distinguished road
Quote:
Originally Posted by Masquerade View Post
Jurassic World does not need a patched EXE.
I just used default bms script for unpack.. with him - crashes on start.
Reply With Quote
  #8  
Old 02-03-2022, 12:24
Masquerade's Avatar
Masquerade Masquerade is offline
Registered User
 
Join Date: Jan 2020
Location: Monte d'Or
Posts: 729
Thanks: 159
Thanked 760 Times in 381 Posts
Masquerade is on a distinguished road
Quote:
Originally Posted by dixen View Post
I just used default bms script for unpack.. with him - crashes on start.
Are you using the DX11 or DX9 game executable? I used the DX9 in my repack and it loaded just fine.

If you are using the DX11, then you may need to apply the lyptus patch.
Reply With Quote
  #9  
Old 04-03-2022, 06:16
L33THAK0R's Avatar
L33THAK0R L33THAK0R is offline
Registered User
 
Join Date: Feb 2021
Location: Saudi Arabia
Posts: 228
Thanks: 78
Thanked 19 Times in 15 Posts
L33THAK0R is on a distinguished road
Wow, what a fascinating read! It's great to see someone finally figured out a consistent methodology to patch these titles! I never even thought to look for a hexadecimal pattern with wildcards outside of the modified bytes. It's great that its now possible for users to finally be able to now release properly updated repacks, heres hoping TT don't make life trickier and switch things up again down the line!
Reply With Quote
  #10  
Old 23-04-2022, 11:19
Scorp- Scorp- is offline
Registered User
 
Join Date: Apr 2022
Location: us
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts
Scorp- is on a distinguished road
will this work with the LEGO Star Wars: The Skywalker Saga?
Reply With Quote
  #11  
Old 24-04-2022, 01:55
Masquerade's Avatar
Masquerade Masquerade is offline
Registered User
 
Join Date: Jan 2020
Location: Monte d'Or
Posts: 729
Thanks: 159
Thanked 760 Times in 381 Posts
Masquerade is on a distinguished road
Quote:
Originally Posted by Scorp- View Post
will this work with the LEGO Star Wars: The Skywalker Saga?
You can check, if it doesn't work, I could see if acidicoala is interested in checking the game out.
Reply With Quote
  #12  
Old 25-04-2022, 07:32
Scorp- Scorp- is offline
Registered User
 
Join Date: Apr 2022
Location: us
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts
Scorp- is on a distinguished road
Quote:
Originally Posted by Masquerade View Post
You can check, if it doesn't work, I could see if acidicoala is interested in checking the game out.
that would be great if you guys got it working
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
patchwiz Universal Patch wizard Heruktiang PS2 Games 0 27-01-2003 20:51
does the old pal/ntsc boot disc work or is there a universal pal2ntsc patch? sternrulez PS2 Games 0 20-11-2002 09:48
universal patch domn8ter PSX Games 0 01-04-2002 16:16
B&W's no-cd patch and the ip security check question bishop007 PC Games 1 04-04-2001 09:34
Patch Help Anyway to check if the game is copied properly sixtwo PSX Games 1 21-02-2001 00:15



All times are GMT -7. The time now is 07:43.


Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2022, vBulletin Solutions Inc.
Copyright 2000-2020, FileForums @ https://fileforums.com