How to trigger auto save or save menu?

[TheByteSize]

AWvsSAO has auto save each time you change zone or can save manually at a location in town. How would I approach to find these triggers?

[seikur0]

For the auto save try looking at what reads from the health address. That should be saved too, right?

For manual save, look for a changed value, when you enter a save location.

[TheByteSize]

no luck so far. well, I found the the sub procedure section where it calls for the logo that depict Autosave but don't know how to track to the parent except for putting a break at ret and use F7 to step.
If anyone got an insight, please let me know.

[seikur0]

Use the break and trace feature, maybe a trace count of 500 and step over. That should help you.

[TheByteSize]

Is it possible to trace until a register become certain number?

[FreeER]

Is it possible to trace until a register become certain number?

Sure, just set the stop condition

[TheByteSize]

Sure, just set the stop condition

thanks. I was able to trace it to where RDX becomes 0x65 but I don't understand why.
it stopped at 2nd online below and that's when RDX has 0x65 value.

Code: Select all

call qword ptr[xxxxxxx]
mov rbx,[rbx]

Btw, I'm trying to manipulate the next dungeon floor number. The game has something call Infinite Dungeon which goes from Floor 1 to 1000. The last check point it would provide in game is Floor 100 which allow you to start at Floor 101. I want to override that selection to the Floor number that given by user. All I was able to trace back to place holder for current floor number but it's for display value only. I can change it and see it get changed back to correct value by something like mov [rsi+30],edx. That's why I'm trying to trace back on RDX but that line before the change, I never seen that before. Is it an encryption? Also, would be the actual Floor number tracking store as another data type? like 2x or 2x+1?

[FreeER]

Code: Select all

call qword ptr[xxxxxxx]

is just calling a function using a 64 bit address. Most likely you had "step over" checked so CE didn't actually trace through all the instructions in that function, just ran it and then checked the stop condition, since it was true it stopped. So it was something in that function which set RDX to 0x65/101

[TheByteSize]

Code: Select all

call qword ptr[xxxxxxx]

is just calling a function using a 64 bit address. Most likely you had "step over" checked so CE didn't actually trace through all the instructions in that function, just ran it and then checked the stop condition, since it was true it stopped. So it was something in that function which set RDX to 0x65/101

I did a Trace at that call line last night without step over but couldn't find a 0x65. How do I use the Find feature to find where edx or rdx is getting new value? I remember I did trace with Max Tracecount of 10K and got not a too long list(still hundreds of lines).

[TheByteSize]

okay, I did two trace. one with step over and one without step over. The step over stopped when RDX is 0x65 but without stepover, I cannot get that same result

[FreeER]

Make sure you're clicking the + next to the call and looking at the last instructions there, I imagine just having the call selected shows the registers at the time of the call (though I'm not certain). It's also possible that it simply reached the max instruction count before reaching the instruction that changes RDX to 0x65 and you need to increase the max steps you allow so it can finish and/or start closer to the call.

[TheByteSize]

no luck, tried even with 1 million count and no result

[TheByteSize]

thanks guys. I was able to find the floor place holder. It was a Double type