[MOD Torchlight.exe] enchant limit, heirloom item bug fixes

[Torched]

Hey all,

I'd like to begin with a short story as to why I made this mod...

I love Torchlight. Runic Games did a great job with the hack 'n slash concept. However, I'm also disappointed that Runic Games isn't taking the responsibility of fixing bugs that should have been fixed a long time ago. I'm talking about being able to enchant over the limits set in globals.dat and the incorrect scaling of item affix values on heirloom items. Seeing how Torchlight II is almost out, I'm afraid those bug fixes will never see the light of day. The modding tools we got from Runic Games unfortunately aren't able to correct these bugs. The fact is that Runic Games did a rush job and released a playable but unbalanced game riddled with bugs. In my opinion the community has been used as a glorified paying beta tester. Brilliant move by Runic Games. They got money for a rushed beta version in order to develop a sequel and we're left with a game still in beta state.

We, the community, reported the bugs mentioned and got ignored by Runic Games. Sure a lot of improvements are made with Torchlight II, but what about Torchlight? Isn't Torchlight important too? When you pay money for a new product, no matter how much, you'd expect some support. I don't expect much because the modding tools allow for much fixes and balancing. But come on! At least fix these enchant and item heirloom bugs! Then the X-Box 360 port got out. Releasing patches for different platforms would now take even more time and resources, so Runic Games simply decides to skip it. Thanks Runic Games! Thanks for showing that you don't care about the hardcore fans who still play Torchlight I'm even playing Torchlight over Diablo III right now. What proof do you need to know we're still playing? This is where it comes to, a fan doing for free what you're supposed to be doing! I'm seriously contemplating weather I will buy Torchlight II seeing the poor support Torchlight got. Runic Games, please get your act together when it comes to Torchlight II support! The fans are counting on you!

Well enough about the good and the bad... Below are the changes and some additional information.

Bug fixes

• ENCHANTER_MAX_ENCHANTS now correctly limits the enchants you can get from the enchanter
• ENCHANTSHRINE_MAX_ENCHANTS now correctly limits the enchants you can get from an enchant shrine
• Incorrect scaling affix values on new heirloom items are now correctly scaled (not retroactive)

Improvement

• Disabled the code that tags your character as a cheater when using certain console commands

The patched binary can be downloaded here. This modded binary will ONLY work with Torchlight 1.15 downloaded from Runic Games. I don't have access to other versions. If any of you do and are familiar with assembly, debugging and hex editing, I can provide the things to look for so you can apply the changes yourself. Testing has been done by myself. I didn't come across any problems while using the modded binary. As I don't have the time to thoroughly test the heirloom item bug fix I kindly ask people to try different items and look at how the affix values scale after several generations. Report any findings/issues you might come across in this thread. Thank you

Install instructions

• Make a backup copy of Torchlight.exe in the folder where you installed Torchlight
• Make a backup copy of your character and stash files in the save folder of Torchlight
• Replace the original Torchlight.exe with the downloaded Torchlight.exe
• Run Torchlight
• No further actions are needed, changes are immediate

For the people interested I will conclude with why certain affixes caused monstrous values on heirloom items. Let's take the bonus HP affix. The affix uses the Health_Player_Destroyer.dat graph. Let's pick the set item Justice Enshrined from the Justice's Convocation set. The item gives a +126 health bonus. The item level of the item is 31. If we lookup X in Health_Player_Destroyer.dat we get 2100 as Y value. The affix value is a min/max percentage of 2100. The item level and scaling value of 2100 remain constant. Now let's examine how the game calculates the affix value and how the game calculates the heirloom affix bonus.

We start with a 6% affix value of 2100. 126 out of 2100 is 6%
The game stores a min/max percentage of 2100, but for fixed affix values both are set to the same value. In this case both are 6%.
Let's retire and heirloom the item and see what happens to the health affix value.
The item affix values get a 10% increase. You would expect to see a 10% increase of 6% and 126.
So the min/max percentage of the affix scale would become 1.1 * 6 = 6.6 %
the affix value would become 1.1 * 126 = 138.6
At first everything seems fine and the 139 increase is shown after retiring.

When you level up the affix value changes to 2911...
How is this possible? It doesn't make sense.
The reason it displays the correct initial increase is because it actually stores the correct affix value besides the wrong min/max percentages.
When you level up the code recalculates the affix values which are now based on the the wrong scaled min/max percentages.
Instead of doing the proper increase on the min/max percentages like I said, the code is using the newly calculated affix value as the new min/max scaling percentages
So both min/max percentages become 138.6% instead of 6.6%

1.386 * 2100 = 2910.6 which is rounded up to 2911.
You can guess what happens when you heirloom the item again...
The new affix value is calculated as 2910.6 * 1.1 = 3201.66.
Initially 3202 is displayed and the min/max percentages are set to 3201.66%.
When you level up 32.0166 * 2100 = 67234.86 and 67235 is displayed.
Below is an overview of what happens after six generations.

Base values

• HP scaling value: 2100
• Min/max affix scaling percentage: 6%
• Displayed: 126

Heirloom 1

• Min/max affix scaling percentage: ~139%
• Displayed: 139
• Displayed after level up: 2911

Heirloom 2

• Min/max affix scaling percentage: ~3202%
• Displayed: 3202
• Displayed after level up: 67235

Heirloom 3

• Min/max affix scaling percentage: ~73959%
• Displayed: 73959
• Displayed after level up: 1553126

Heirloom 4

• Min/max affix scaling percentage: ~1708438%
• Displayed: 1708438
• Displayed after level up: 35877192

Heirloom 5

• Min/max affix scaling percentage: ~39464912%
• Displayed: 39464912
• Displayed after level up: 828763136

Heirloom 6

• Min/max affix scaling percentage: ~911639488%
• Displayed: 911639488
• Displayed after level up: -2147483648

The game uses single precision floating point numbers for calculating values, but converts them to 32 bit signed integer values for display on screen.
As you can see the affix value eventually exceeds the largest positive 32 bits integer number (2^31) - 1 = 2147483647
It even exceeds the full range of a 32 bits signed integer, range being -2147483648 to 2147483647 so it just displays the maximum negative number possible, which would be 4294967295 if it were unsigned.

[yaheshua]

wow, this is cool. I was never bothered by the heirloom bug because i never used those (with the bug it felt like "cheating"... i feel dirty i feel dirty!jajaja), but is great to see you managed to clear this bug out. Maybe i'll test it sometime.

Just a question... you said that you built this upon the runic 1.15 version... i ask you, would this work on the steam version? if not, how hard is it to get this fix working on that? Anyway, thanks for your effort on bugfixing this game (i read your rant on the original post about runic not fixing the game and... well kinda agree with you there).

Sobrex

[Torched]

wow, this is cool. I was never bothered by the heirloom bug because i never used those (with the bug it felt like "cheating"... i feel dirty i feel dirty!jajaja), but is great to see you managed to clear this bug out. Maybe i'll test it sometime.

Just a question... you said that you built this upon the runic 1.15 version... i ask you, would this work on the steam version? if not, how hard is it to get this fix working on that? Anyway, thanks for your effort on bugfixing this game (i read your rant on the original post about runic not fixing the game and... well kinda agree with you there).

Sobrex

Thanks for your interest. Unfortunately I don't have the Steam version and I'm not that keen on spending 14,99€ on another copy of Torchlight. I'm positive though that the same changes can me made to the Steam version. It might work, but seeing that Torchlight synchronizes save games with Steam I don't think it'll work. The non steam version from Runic Games does have a Steam API DLL included though. You can check the file size and MD5 hash of the Steam Torchlight.exe v1.15 and compare below. Keep in mind though that by using a modded binary you lose support from Runic Games and Steam, no matter how much good a new binary does.

Torchlight.exe v1.15
Size: 13,110,000 bytes
MD5: B250BF60BFCB1AD6B8AB31BBD8771202

[yaheshua]

Hey. Just to report that, indeed, the binary didn´t work with the steam version. Such a shame. It asks me for my license file. Anyway, thanks for the upload, i´m sure the people with runic´s version will enjoy a lot this mod

Sobrex

[ember]

Btw, what tools did you use for editing the binary?

Also are there any tutorials i can refer to?

[Torched]

Btw, what tools did you use for editing the binary?

Also are there any tutorials i can refer to?

I used WinHex to edit the binary. Any hex editor will do fine.
Concerning tutorials it depends on what exactly you want to learn.

[ArrowOfAces]

I have always wondered how anyone can decipher anything about a code base considering the complexities involved. I have performed hex editing before, but only under the instruction of someone who could understand what the information meant. I would love to learn more about the subject, and I would like to test whether this will work on the Encore boxed edition of Torchlight (which I have).

Encore Physically Purchased Torchlight Information:

• File: Torchlight.exe
• Size: 10,910,352 bytes (I am not writing the "Size on Disk" because it is inaccurate from computer to computer based on hard drive file formatting.)
• MD5: b18309c197fa58fbb879f1f603618b80 (At Torched's request.)
• SHA-1: 37c57d69d9dbde015270b547b16368353d1d6dbd (Secure Hash Algorithm is a more secure and accurate method of file integrity matching especially with version 3 being released soon.)

According to the above information, I would assume that the Encore Retail version isn't even similar in structuring as the Runic Games downloaded copy. When buying Torchlight II, I'm getting the game straight from the manufacturer so I can avoid issues with modding compatibility.
I'm going to risk installing this executable modification, and I will post my findings (11:46 PM CDT)
I got the same inquiry as yaheshua (11:57 PM CDT):

... It asks me for my license file ..."

To top that surprise off, I don't even have the steam version. Steam is not involved with my edition. (What is great about my edition though is that I can install it onto as many computers as I desire. It comes in handy when I have multiple computers in one house.)
Torched, please PM or reply here about the possibility of adapting your method of a solution to the Encore Retail version players. Hopefully, I will learn more about Hexadecimal editing in the process of modifying your method to the Encore version!

-♠

[heron]

nice fixes, hopefully we can get the steam version as well.

[ember]

Btw, what tools did you use for editing the binary?

Also are there any tutorials i can refer to?

I used WinHex to edit the binary. Any hex editor will do fine.
Concerning tutorials it depends on what exactly you want to learn.

Well more or less to do what you did. As arrorofaces asked how did you know which of the data was for what (i mean for example you found how the heifloom is done etc). Also I have no experience what so ever in that department.

[Torched]

Thank you all for the enthusiastic responses
I would gladly patch all available versions if I had access to them. Like I said, I only have the version I bought directly from Runic Games.
If someone is willing to give me private access to the Steam or Encore version, I will be more than happy to patch the binaries.

As far as deciphering the code goes, it's not as impressive as it may look. I'm not sitting at my computer sifting through the hexadecimal numbers in a hex editor finding the stuff to patch. All those hexadecimal numbers look like gibberish at first, but when you understand how compilers translate source code into machine code (assembly), it becomes much more clear. You'll need a basic understanding of assembly, binary and hexadecimal for those hexadecimal numbers to mean anything. You also need to understand what is code and what is not. That's where the PE header format comes into play for Windows executables. The header describes what kind of sections the binary contains, what libraries the binary needs and if it exports any functions for other binaries to use.

However you're still not going to find what you're looking for by just browsing with a hex editor. You'll need a disassembler at the least, but preferably a debugger. A debugger contains a disassembler which translates the machine code to assembly mnemonics. A CPU has an instruction set. This instruction set is coded in binary. In computer architecture electronic circuits contain complex I/O circuitry and different pieces of hardware that work together. The CPU hardware features and communication with other hardware determines what the instruction set will look like. When the CPU reads a binary instruction from memory the CPU performs a specific task based on the electronic logic in the hardware. Binary values are displayed as hexadecimal in hex editors. What a disassembler does is decode instructions from binary to a mnemonic that can be easily interpreted by a human. The code section below shows what I mean.

Address shows the address in memory.
Hex dump is exactly what it says, the hex dump is what you see in a hex editor. It's basically the binary code that the CPU interprets.
Command is the translated binary code by the disassembler. As you can see it's much easier to read then just the binary code.

Code: Select all

CPU Disasm
[b]Address[/b]   [b]Hex dump[/b]          [b]Command[/b]                                  Comments
0056B480    51              PUSH ECX
0056B481    56              PUSH ESI
0056B482    8BF1            MOV ESI,ECX
0056B484    80BE D1060000 D CMP BYTE PTR DS:[ESI+6D1],0D6
0056B48B    74 26           JE SHORT 0056B4B3
0056B48D    83EC 1C         SUB ESP,1C
0056B490    8BC4            MOV EAX,ESP
0056B492    896424 20       MOV DWORD PTR SS:[ESP+20],ESP
0056B496    68 A45CAB00     PUSH OFFSET 00AB5CA4                     ; UNICODE " the Cheat"
0056B49B    8D8E 20040000   LEA ECX,[ESI+420]
0056B4A1    51              PUSH ECX
0056B4A2    50              PUSH EAX
0056B4A3    FF15 0C84A800   CALL DWORD PTR DS:[0A8840C]
0056B4A9    83C4 0C         ADD ESP,0C
0056B4AC    8BCE            MOV ECX,ESI
0056B4AE    E8 ED11EAFF     CALL 0040C6A0
0056B4B3    C686 D1060000 D MOV BYTE PTR DS:[ESI+6D1],0D6
0056B4BA    5E              POP ESI
0056B4BB    59              POP ECX
0056B4BC    C3              RETN


I strongly recommend learning a programming language and learn about how Window programs work. Things like controls (buttons, combo boxes, lists, etc) and how applications deal with events. for a programming language I recommend C++. It's important to learn OOP (Object-Oriented Programming). When you're reverse engineering it's really important that you know how objects are placed in memory and how they're referenced. Furthermore it's important to know how functions are called and how parameters are passed in assembly. Therefore it's important to first understand the concepts of OOP and then learn how a compiler compiles source code into a binary. I recommend using the free Visual Studio C++ Express edition to practice coding and debugging C++ source applications. It also has a debugger that allows you to see the disassembled code. It's a great way to learn whats going on.

Lena's reverse engineering tutorials
OllyDbg debugger tutorials
Great and very noob friendly C++ forum
C++ Tutorial - Absolute n00b Spoonfeed

ps. Some people might think a reverse engineer is equal to a cracker, but that's not the case. Some of the tutorials above use protection mechanisms of example programs to show you how they work and how you're able to find them in a program. Those programs are out of date and not actual anymore. It's merely intended to be educational. Like with everything knowledge is power, and you can use it for good and bad. Learning how to reverse engineer software can be a great asset. For example it allows you to become a great bug hunter.

Well this is it in a nutshell. Feel free to ask questions if something is not clear.

[ember]

I have some beginners knowledge in oop and programming in general (mostly from java, some C# and some oop for PHP but not much) but for the most I never bothered with the binary and assembler level parts, because quite frankly I didn't know where to start. I know how the objects are stored in memory (somewhat) but that is only in "need-to-know" theory, rather than practice.

But I think that this makes a good introductionry post so a will in time look more into it, for now I don't have anymore meaningful questions.

Anyway thank you very much for setting the time aside for writing this educational post. I also didn't seek this for some crack purposes but just because i want to learn more about how all that works.

Currently for example I am having problem of making a gem with a % to shock/burn/slow that actually works since it seems that i can't make the game add those effects via the gem on the sword (or any weapon for that matter) even though some unique weapons already had those defined affixes. I even noticed that when I want to make a 100% to shock instead of 10% it still doesn't work as intended even without the gem the sword I modified." So in someway in time I hope to learn how to look into an exe and see how ti handles those things, because there is something very odd about it, or it was just my lack of knowledge in general torchlight modding.

The sword i tried to modify to 100% to shock instead of 10%, I mean it shows on the modified weapon that it has a 100% chance but still behaves like it has 10% chance:

[ArrowOfAces]

I only took the time to learn BASIC (Beginner's All-purpose Symbolic Instruction Code). To which I still don't know many of the things within the programming language. I mean I can build looping functions, if and then statements, passwords and opening programs, creating LAN oriented programs that can be used across a home or business network, etc.

Most of the things I have seen or learned is by examples.

-♠

[Torched]

Good news for Steam users. I've patched the binary for the Torchlight Steam version.
Below is the download link and the necessary information to check if you have the proper version to use the patched binary.

Torchlight.exe Steam v1.15
Size: 10,717,328 bytes
MD5: A0C7DE3B6439DB018A4AC6E4E1E353F5

If people using Torchlight from another vendor than Runic Games or Steam want these bug fixes too, then please provide me with the Torchlight.exe v1.15 you're using.
I think the libraries used are the same and that the Torchlight.exe is dependent on the vendor. To be sure I need the Torchlight.exe file.

[Torched]

I have some beginners knowledge in oop and programming in general (mostly from java, some C# and some oop for PHP but not much) but for the most I never bothered with the binary and assembler level parts, because quite frankly I didn't know where to start. I know how the objects are stored in memory (somewhat) but that is only in "need-to-know" theory, rather than practice.

But I think that this makes a good introductionry post so a will in time look more into it, for now I don't have anymore meaningful questions.

Anyway thank you very much for setting the time aside for writing this educational post. I also didn't seek this for some crack purposes but just because i want to learn more about how all that works.

Currently for example I am having problem of making a gem with a % to shock/burn/slow that actually works since it seems that i can't make the game add those effects via the gem on the sword (or any weapon for that matter) even though some unique weapons already had those defined affixes. I even noticed that when I want to make a 100% to shock instead of 10% it still doesn't work as intended even without the gem the sword I modified." So in someway in time I hope to learn how to look into an exe and see how ti handles those things, because there is something very odd about it, or it was just my lack of knowledge in general torchlight modding.

The sword i tried to modify to 100% to shock instead of 10%, I mean it shows on the modified weapon that it has a 100% chance but still behaves like it has 10% chance:

Interesting...
I found the code that triggers the chance to shock but it doesn't have a guaranteed chance to trigger that's for sure. Over the weekend I'll examine the code in more detail to figure out what is happening.

[ember]

That would be very great.

[heron]

If people using Torchlight from another vendor than Runic Games or Steam want these bug fixes too, then please provide me with the Torchlight.exe v1.15 you're using.
I think the libraries used are the same and that the Torchlight.exe is dependent on the vendor. To be sure I need the Torchlight.exe file.

Retail boxed version sent, check your PM.

[Torched]

The patched binary for the Encore build is up! Thanks to Heron for providing the binary. Please compare the file details below with your build of Torchlight.exe. Only use this file when they match.

Torchlight.exe Encore v1.15
Size: 10,910,352 bytes
MD5: B18309C197FA58FBB879F1F603618B80

You can calculate the MD5 hash by using a MD5 hashing tool

I encountered no ill side effects from using any (Runic games, Steam and Encore) of the patched binaries.
Just to make this clear, the heirloom fix involves any affix that scaled incorrectly. You should be able to heirloom any item safely now.
As always make a backup copy of the original Torchlight.exe file, your character save files and your softcore/hardcore stashes.

Remember that the different vendors do not support modded binaries. You won't get support with this patched version.
If you encounter any issues, please report them in this thread. Thank you!

ps. No full working versions of the game were provided and no DRM or other forms of protection are modified in any way. You still need to purchase a valid license for this game first. These changes were merely to fix bugs in the game that are ignored by Runic Games. Just to make this clear, these patched binaries do not circumvent implemented protection and I will ignore any requests to remove protection from software.

[ember]

I was fascinated before but now I am even more fascinated, how in heavens name can you see the odd and ends in there I opened torchlight.exe in ollydbg 2.0 and just stared in the screen. How where you able to find the parts connected to anything there is far beyond me.

It seems that ollydbg isn't functioning the same as in the tutorials (lena's) since i'm using a win7 64bit (i tried using both 1.10 and 2.00 versions) a pitty really, but as this seems to go way over my head I'll try to learn this again on the later date, it seems like a pointless struggle now...

[Torched]

I was fascinated before but now I am even more fascinated, how in heavens name can you see the odd and ends in there I opened torchlight.exe in ollydbg 2.0 and just stared in the screen. How where you able to find the parts connected to anything there is far beyond me.

It seems that ollydbg isn't functioning the same as in the tutorials (lena's) since i'm using a win7 64bit (i tried using both 1.10 and 2.00 versions) a pitty really, but as this seems to go way over my head I'll try to learn this again on the later date, it seems like a pointless struggle now...

Keep following Lena's tutorials. Eventually things become more clear. Lena's tutorials use OllyDbg v1.10, so use that version instead of v2.01 alpha 4.
OllyDbg v1.10 works fine in Windows 7 64 bit and it's best to use that version to make following the tutorials easier.

[ember]

I used the 1.10 version but it doesn't work for me.

When i start doing the "step over" (F8) it behaives totally differently than in the video and if I continue with the F8.

This is "before and after" I press F8, if I continue to press F8 program complains that he can't find the address.

http://i50.tinypic.com/x1x3c1.jpg

Also I am not pressing "step into" by accident.

Also the api doesn't work in win7