Reverse engineering Diablo v1.09b (last patch)

[TheKillerVortex]

In regards to "items" (inventory + what you're wearing are the "same" as far as I can see):

Code:

00686D7C - 00 00 00 00 00 00 00 00 D1 38 52 11 01 01 00 00

I assume this is somehow tied to the monster (or NPC?) that spawned the item.

Code:

00686D8C - 03 00 00 00

This represents the graphic image to load for your character (00 = no weapon, 01 = sword, 02 = axe, 03 = bow, 04 = mace; I guess?).

Code:

00686D90 - 2D 00 00 00 2D 00 00 00

This describes the X/Y map that you picked up the item from (I do not see why this is stored with the item data); This is apart of preventing duplicate items?

There's also some sort of fail-safe for 'morphed' items(?) that are defaulted into an icon of a blue Potion of Full Mana (without any text to display, no effects when consumed).

EDIT: The actual item X/Y from the map is changed every time you drop the item and pick it up (it only changes when dropped again).

The item's "current" durability (X / 255) is here:

Code:

00686E70

The item's "maximum" durability (255 / X) is here:

Code:

00686E74

I should use the player base structure + offset to describe this, but for now: This will work.
This is for the item that is currently in the "weapon slot" of the player's character.

When both variables are set to 0xFF: The item is listed as "indestructible."

If the item's current durability is set to "0": When the item loses a durability, it wraps around to -1 (0xFF 0xFF 0xFF 0xFF). The item no longer 'disappears.'
The maximum negative value: 0x00 0x00 0x00 0xFF.

A screen shot:


Item minimum damage (255):

Code:

00686E50 - FF 00 00 00

Item maximum damage (255):

Code:

00686E54 - FF 00 00 00

Item maximum charges (255):

Code:

00686E68 - 0xFF

Item charges type (???):

Code:

00686E5C - 17 00 00 00 02 00 00 00

Item STR / MAG / DEX requirement:

Code:

00686EE4 - 17 11 13 00

It appears the last byte is unused.

Unusable item flag (set when identifying a previously used item, that you no longer match the requirements with/for? Shrines?); 01 = Usable, 00 = Unusable:

Code:

00686EE8 - 01

Item graphics index:

Code:

00686E44 - 01

This graphics index appears to modify how the item graphics are drawn when the item is thrown on the floor; It also directly effects the item size.

Item flag denoting it is a "2-handed weapon?" (Graphics routine draws a ghosted image on the shield slot and other modifications via the game); 01 = 1-handed, 02 = 2-handed:

Code:

00686E41 - 01

Item string reference index?

Code:

00686E60 - 02

Item charge item (01 = Firebolt; Seems to use another spell index than the usual one for "book based spells"):

Code:

00686E64 - 01

Current experience:

Code:

00686604 - 0xAD 0xEF 0x00 0x00

First item in your character's file:

Code:

0x00686448 + 0x374

This is the very first! Byte in the item. It describes the item's individual ID (and should be 'unique' to prevent duplication).
The total item size is: 0x170 (368) bytes long.

The actual item itself can be described as a structure, I believe. There are too many potential variables and flags to say it is composed of raw integer/C-string declarations.
How books are generated are odd. That may be uniquely hacked together by the Blizzard team (as are many things in Diablo, that I've seen so far).

Scrolls, Potions, Staves and other items, though, look quite commonly similar in structure.

It should go something like:

Code:

006867C4 (8 bytes) unique item ID - F4 E6 D9 65 12 08 00 00
006867CC (4 bytes) item graphics / item equipped flag (FF FF FF FF = no item found) - 07 00 00 00
006867D0 (4 bytes) item Y coordinate (where you picked it up at) - 39 00 00 00
006867D4 (4 bytes) item X coordinate (where you picked it up at) - 41 00 00 00
006867D8 (4 bytes) ???? (all 00) - 00 00 00 00
006867DC (4 bytes) ???? (does not affect duplicating items) - BC 93 E7 05
006867E0 (4 bytes) ???? (when picking up a dropped item: This rewrites itself) - 0D 00 00 00
006867E4 (4 bytes) ???? (when picking up a dropped item: This rewrites itself) - 0D 00 00 00
006867E8 (4 bytes) ???? (when picking up a dropped item: This rewrites itself) - 60 00 00 00
006867EC (8 bytes) ???? (when picking up a dropped item: This rewrites itself) - 10 00 00 00 00 00 00 00
006867F4 (8 bytes) ???? (when picking up a dropped item: This rewrites itself) - 01 00 00 00 00 00 00 00
006867FC (4 bytes) magic item identified (01 = identified, 00 = unidentified) - 01 00 00 00
00686800 (1 byte) (flag depicting item type) - 01
00686801 (?? bytes) (item title ("Crown," "Dagger," etc)
00686841 (?? bytes) (item name)
00686880 (4 bytes) (item placement) - 00 04 02 00 (Helm)
00686884 (4 bytes) (item graphics) - 5D 00 00 00 (Helm "skull cap")
00686888 (4 bytes) ???? (item does not rewrite value) - 19 00 00 00
0068688C (4 bytes) ???? (item does not rewrite value) - 19 00 00 00
00686890 (8 bytes) ???? (reserved for special attributes?) - 00 00 00 00 00 00 00 00
00686898 (4 bytes) ("armor" attribute added) - FF 00 00 00
0068689C (20 bytes) ???? (reserved for special attributes?) - 00
006868B0 (4 bytes) (item current durability) - FF 00 00 00
006868B4 (4 bytes)  (item maximum durability) - FF 00 00 00
006868B8 (48 bytes) ???? (reserved for special attributes?) - 00
006868F4 (4 bytes) ???? (when picking up a dropped item: This rewrites itself) - 00 01 00 00
006868F8 (24 bytes) ???? (reserved for special attributes?) - 00
00686910 (4 bytes) ???? (item flags for modifiers?) - FF FF 00 00
00686914 (16 bytes) ???? (reserved for special attributes?) - 00
00686928 (4 bytes) (invalid item flag) - 01 00 00 00
0068692C (4 bytes) ???? (item does not rewrite value) - 31 00 00 00

Item held by the mouse(?):

Code:

0068B700

repe movsd uses ECX as the counter, EDI as the base entry mark and ESI as the stop copying marker.
Translation: "repe movsd" copies X amount of bytes (ECX) starting from EDI to ESI.

This is the beginning offset of the item (0068B700) that the item data is written to. repe movsd copies the item's exact data to the location (Helm, Armor, Weapon, Shield, Jewelry).

This seems important as it pertains to 'item morphing.'

If you directly modify an item's armor (EG: Helm). Upon saving the game (or possibly when you load it): The item's armor is changed back, miraculously!
The instruction "repe movsd" is the culprit. I am about to start digging deeper into it, to find out where this is loading it's information from.

... I can definitely see why a lot of the old hacks simply left it as: "Item morphing will/may occur." Although I am still confused as to why item drops from monsters will/do morph.

I am thoroughly confused now! There is one segment of Diablo.exe that writes the magical/unique properties to items (including any modifiers they may contain).
0068B700 is the beginning address. It is 92 bytes in size. I've seen repe movsd "add" more than 5C (from the push 0x5C statement). It added 0x1C after 0x5C was there initially.

Beginning of user belt?

Code:

0068AB66