• Code hacking in Falcon 4.0
• Data structures hack (Falcon 3.03)
• Code hack (X-wing / Tie fighter)

Second, you gotta know where to look. If it`s a code it would probably be in an EXE (or OVL in older programs) file, but you can check other files too. If it`s data it can be packed as constants inside an EXE file or in a outside data structures. You just get yourself a HEX editor, you can use Microsoft Developer Studio as debugger also, but much better is kernel debugger NuMega SoftIce.

Then you have to search inside a file for a teeny tiny string where all that is written. You can write your own programs to do the job. If you`re not sure if you found the right thing, the best way to figure that out is to corrupt that part. If program freezes, then you`re wrong (or right in some cases). If you get expected results, then you`ve hit with the hammer on a nail.

Modify that string ... and voila!

ADS was designed for modular integration of its subparts to avoid future changes when new additions are made.
 

Instructions on EXE hacking and explanation of my work.

To be able to do some exe hacking you must first understand 8086 32bit assembly language very well. You will obtain this knowledge only by vast ammounts of programming in this low level computer language.

Next thing you need is some kernel debugger, I for example used Softice. Kernel debugger will allow you to break into Windows or any other program routines on instruction, memory R/W or hardware breakpoint.

The thing that made cockpit switching (2D cockpit switching) in Falcon4 possible is that 2D pannels graphics files are zipped in an archive (CPdata.zip) and this file is unzipped every time before player enters cockpit. Unzipping doesn`t take place if there are allready files unzipped in directory \art\ckptart\.
Exploitation of this last fact was used by some manual switchers. To manually switch cockpit, you had to exit the game, this manual switcher then deleted the contents of art\ckptart\ folder and copied new cockpit files into it.

My basic idea was, if all possible cockpits exist each in its own directory (named by aircraft type) instead of copying files into target directory, why not order Falcon4 to search for a different target directory depending on aircraft being flown.

=========
Now a little bit on exe files.
EXE file has a header, where it is written to which address in memory it should be read. Normally exe files are read into adress 0x400000. How does then exe file look like when in computer memory (RAM)? Exactly like when in file on disk. Bytes that are for example at file offset 1234 will be found in memory at adress 0x401234.
Next thing are segments. Falcon4 has three segments defined in its header.
.text segment is part of this exe, where hexadecimal numbers are interpreted as CPU instructions (code). This starts at 0x400000.
.rdata segment is rawdata area. Here CONSTANTS are baked into exe. At 0x788000 in Falcon4.
.data is third segment, the data segment. Here STATIC VARIABLES are stored. 0x7B0000 or something in Falcon4.

The area that is directly overwritten by exe file contents ends at offset 0x400000+filelength, that is 0x8xxxxx. Beyond this offset there is free memory which will be used for dynamic memory allocation (calling "new" operator or malloc function will return memory offset where enough free space has been allocated for your storage request).

Since .text and .rdata segments aren`t supposed to be changed, these memory pages are marked be the operating system as ReadOnly. If you accidently start writing over this data, OS will not allow you to proceed and program will terminate with Access Violation (Page Fault). This can of course be overriden by switching a few bits in exe file header telling OS .text and .rdata are RW (not RO). If you know what you`re doing this is OK (you can change program code on the fly) if not, you will dig your own grave.

For example, if you write a program and inside it you use a text string which defines a filename "myfile.txt", then this string "myfile.txt" will be hardcoded into exe as a constant. If you then want to use this name in fopen("myfile.txt","r") procedure, what compiler/linker does is it pushes offset of your constant on stack (in our case it should push offset of string "r\0" and then offset of "myfile.txt\0" - say they reside at 0x790000 and 0x790008) and then it calls function fopen (which is also baked into your exe, say it is at memory offset 0x412340).
Your call to
FP = fopen("myfile.txt", "r");
will be compiled and linked into
PUSH 00790000
PUSH 00790008
CALL 00412340
With this you pass locations where fopen procedure can find your zero-terminated strings.
Since fopen returns a value (return values are allways passed in EAX register) and since you want to use it (you store it into variable FP, otherwise contents of EAX would be discarded) this will follow:
MOV [007B0000], EAX
This line will store contents of EAX onto memory cells at offset 0x7B0000. Linker knows there is your STATIC VARIABLE "FP". If you initialize this FP to be NULL (i.e. 0x00000000) then four bytes at file offset 0x3B0000 will be zeroed, thus when exe is loaded into memory bytes at offset 0x7B0000 will be 0.
=========

The third thing that made 2D cockpit switching possible is that strings defining file locations (locations of unzipped cockpit files) were STATIC VARIABLES and not constants. If names were constants, then by attempting to change them, you would cause a page fault. But since they were a part of .data segment, they were allowed R/W.

If we take a look at directory where cockpit files should be:
\art\ckptart\

We see that we can easily sieze 5 characters to define our aircraft name. We change hardcoded directory names into
\art\c\xxxxx\
where "xxxxx" define a default subdirectory in \art\c\ folder. Inside this xxxxx directory default cockpit files will be stored, and used by all aircraft that do not have thir own cockpit files. If aircraft has its own cockpit files, then a new subdirectory will be created and pointed to.

How exactly to do this.
There is a Falcon4.VCD (vehicle class data) file. Inside it there is some data on vehicles (ground, air and naval). When user selects a flight s/he wants to fly, Falcon4 also determines a pointer to its VCD data record. With other words, if you choose to fly a MiG-29, when you select this flight, a pointer to memory location holding MiG-29 VCD data record will be calculated in a process.
If we capture, intercept this pointer, then we know what aircraft we`ll be flying. And furthermore, inside VCD data record there are 20 bytes long strings holding the name of this vehicle type. If we shorten these names to be max 15 characters long, then we have 5 bytes for each vehicle where we can define the directory name this vehicle`s cockpit files.

So, when user changes flight, VCD pointer is intercepted. We then look at relative offset 0x17 where our cockpit namestring shoud be. If namestring is 5 characters long (all chars are within range 0x20-0x7F) then name is assumed as valid. If not, then first four characters are checked. If still not OK, then default name "xxxxx" is assumed.
We then go through memory and overwrite all strings that have something to do with cockpit directory names. We change them from "art\c\xxxxx" into say "art\c\MG29A".

With this we effectively forced Falcon4 to automatically look for cockpit files in directories specified inside VCD data file, instead of hardcoded directory.

Why 5-letter 4-letter check?
Because Hoola and Marco Formato needed 4 characters to implement NCTR identification for F-16. I gave them first 4 characters, which define NCTR IDs (like F16, MG29, MG21, F5, TPT...). If fifth character is not zero, then cockpit exists for this aircraft. This also helps me, because there is no need to have one cockpit installed two times (for F-4E and F-4G for instance) if we leave the fifth character zero (both F-4s will use cockpit installed inside "art\c\F4__")
 
 

IMPLEMENTATION
 

void
Load_C3D_MFD_HUD_File (void)
{
// LIMIT 786100
/*
Arg
	[EBP+8]		int		Type (00000000=MFD/C3D, POINTER=HUD/RWR/MFD)
	[EBP+C]		char	*Ext
Var
	[EBP-4]		int		RecNo
	[EBP-8]		int		Size
	[EBP-C]		int		Dest
	[EBP-10]	int		FHANDLE
	[EBP-14]	char	*PtrMidName
	[EBP-210]	char	*TempStr
*/
	__asm{
			xor		eax, eax
			xor		eax, eax
			xor		eax, eax
			xor		eax, eax
			nop
			nop
			nop
			nop
			nop
	}
	__asm{
		PUSH	EBP
		MOV		EBP, ESP
		SUB		ESP, 0x210

	// Dealloc first
		MOV		EAX, [EBP+8]
		TEST	EAX, EAX
		JZ		DEALLOC_END
		MOV		EAX, [EAX]
		TEST	EAX, EAX
		JZ		DEALLOC_END
		PUSH	EAX
		MOV		EDX, 0x40E390
		CALL	EDX
		ADD		ESP, 4
		MOV		EAX, [EBP+8]
		MOV		dword ptr [EAX], 0
DEALLOC_END:

	// Setup filename
		LEA		EDI, [EBP-0x210]
		// "F:\Falcon4"
		MOV		ESI, 0x7DAD7C
FL_Falc:
		LODSB
		STOSB
		CMP		AL, 0
		JNZ		FL_Falc
		DEC		EDI
		// "\art\c\"
		MOV		ESI, 0x798D60
		MOVSD
		MOVSD
		DEC		EDI
		MOV		[EBP-0x14], EDI
FL_CC:
	// Try open Current Cocokpit Name
		MOV		ESI, 0x798D98
		LODSD
		CMP		EAX, 0x78787878
		JE		FL_VCD
		STOSD
		MOVSB
		MOV		ESI, [EBP+0x0C]
		MOVSD
		MOV		byte ptr [EDI], 0

		PUSH	0x8000
		LEA		EAX, [EBP-0x210]
		PUSH	EAX
		MOV		EDX, 0x415C11
		CALL	EDX
		ADD		ESP,8
		MOV		[EBP-0x10], EAX
		CMP		EAX, 0xFFFFFFFF
		JNE		FL_LOAD

FL_VCD:
		MOV		EDI, [EBP-0x14]
	// Try open VCD Name
		MOV		ESI, 0x798D94
		MOV		ESI, [ESI]
		TEST	ESI, ESI
		JZ		FL_Default
		ADD		ESI, 0x17
		MOV		EDX, 4
FL_VCDR:
		LODSB
		STOSB
		CMP		AL, ' '
		JZ		FL_VCDE1
		DEC		EDX
		CMP		EDX, 0
		JNZ		FL_VCDR
		JMP		FL_VCDE
FL_VCDE1:
		DEC		EDI
FL_VCDE:
		MOV		ESI, [EBP+0x0C]
		MOVSD
		MOV		byte ptr [EDI], 0

		PUSH	0x8000
		LEA		EAX, [EBP-0x210]
		PUSH	EAX
		MOV		EDX, 0x415C11
		CALL	EDX
		ADD		ESP,8
		MOV		[EBP-0x10], EAX
		CMP		EAX, 0xFFFFFFFF
		JNE		FL_LOAD

FL_Default:
		MOV		EDI, [EBP-0x14]
	// Try open XXXXX Name
		MOV		EAX, 0x78787878
		STOSD
		STOSB
		MOV		ESI, [EBP+0x0C]
		MOVSD
		MOV		byte ptr [EDI], 0

		PUSH	0x8000
		LEA		EAX, [EBP-0x210]
		PUSH	EAX
		MOV		EDX, 0x415C11
		CALL	EDX
		ADD		ESP,8
		MOV		[EBP-0x10], EAX
		CMP		EAX, 0xFFFFFFFF
		JE		FL_End

FL_LOAD:
		PUSH	4
		LEA		EAX, [EBP-4]
		PUSH	EAX
		MOV		EAX, [EBP-0x10]
		PUSH	EAX
		MOV		EDX, 0x41594E
		CALL	EDX
		ADD		ESP,0x0C
		CMP		EAX, 0
		JE		FL_Close

		CMP		dword ptr [EBP+8], 0x00000000
		JNE		FL_TYP_HUD

FL_TYP_C3D_MFD:
	// If we have C3D/MFD type of file
		CMP		dword ptr [EBP-4], 0
		JE		FL_Close
FL_Repeat:
		MOV		dword ptr [EBP-0x0C], 0
		LEA		EAX, [EBP-0x0C]
		PUSH	8
		PUSH	EAX
		MOV		EAX, [EBP-0x10]
		PUSH	EAX
		MOV		EDX, 0x41594E
		CALL	EDX
		ADD		ESP,0x0C
		CMP		EAX, 0
		JE		FL_Close
		MOV		ECX, [EBP-8]
		MOV		EBX, [EBP-0x0C]
		ADD		EBX, 0x400000
		//CMP		EBX, 0x798000
		//JB		FL_Break				// SKIP, causes a CTD
		LEA		EDX, [EBX+ECX]
		CMP		EDX, 0x8A0000
		JA		FL_Break
		PUSH	ECX
		PUSH	EBX
		MOV		EAX, [EBP-0x10]
		PUSH	EAX
		MOV		EDX, 0x41594E
		CALL	EDX
		ADD		ESP,0x0C
		DEC		dword ptr [EBP-4]
		JNZ		FL_Repeat
FL_Break:
		JMP		FL_Close

FL_TYP_HUD:
	// If we have HUD type of file
FL_ALLOC:
		MOV		EAX, [EBP-4]
		PUSH	EAX
		MOV		EDX, 0x40E370
		CALL	EDX
		ADD		ESP, 4
		MOV		EDX, [EBP+8]
		MOV		[EDX], EAX
		TEST	EAX, EAX
		JZ		FL_Close

		MOV		EDX, [EBP-4]
		PUSH	EDX
		PUSH	EAX
		MOV		EAX, [EBP-0x10]
		PUSH	EAX
		MOV		EDX, 0x41594E
		CALL	EDX
		ADD		ESP,0x0C
	// Correct internal pointers
		MOV		EAX, [EBP+8]
		MOV		EAX, [EAX]
		MOV		ECX, 0x40
		MOV		EDX, EAX
FL_Check:
		CMP		dword ptr [EDX], 0x400000
		JGE		FL_Skip
		ADD		dword ptr [EDX], EAX
FL_Skip:
		ADD		EDX, 4
		DEC		ECX
		JNZ		FL_Check

FL_Close:
		MOV		ECX, [EBP-0x10]
		PUSH	ECX
		MOV		EDX, 0x41572B
		CALL	EDX
		ADD		ESP,4
FL_End:
		MOV		ESP, EBP
		POP		EBP
		RET
	}
	__asm{
			xor		eax, eax
			xor		eax, eax
			xor		eax, eax
			xor		eax, eax
			nop
			nop
			nop
			nop
			nop
	}
}

////////////////////////////////////////////////////////////////////////////////////////////////////
/*
void
Calculate_VCD_vehicle_index (void)
{
	Load VCD pointer to our record
	Load VCD pointer to the start of VCD structure
	Divide the difference with the size of record to determine VCD index
	Store VCD index.
}
*/void
Calculate_VCD_vehicle_index (void)
{
// LIMIT 4044F0
	__asm{
		// Load VCD pointer
		MOV		EAX, [VarD]//[94 8D 79 00]
		SUB		EAX, [VarD]//[1C AB 7D 00]
		XOR		EDX, EDX
		MOV		EBX, 0xA0
		DIV		EBX
		// Store VCD index
		MOV		[VarD], EAX//[90 8D 79 00]
		RET
// LIMIT 40450C
	}
}

////////////////////////////////////////////////////////////////////////////////////////////////////
/*
void
Validate_Directory_Name_and_store(void)
{
	Grab the 5-byte name at the end of the VCD record
	Check it if it contains characters between ' ' and 'z'.
	If not, assume default name "xxxxx".
	If ' ' character is encountered, change it to '_'.

	Store new 5-byte name to [98 8D 79 00]
}
*/
void
Validate_Directory_Name_and_store(void)
{
// LIMIT 404510
	__asm{
		// VCD Pointer
		MOV		ESI, [VarD]//[94 8D 79 00]
		// NCTR+ADS String
		ADD		ESI, 0x17
		// Currnet Cockpit
		MOV		EDI, 0x00798D98
		MOV		EDX, 5
VDN_Loop:
		// Compare if all characters can be used in Windows OS directory names
		LODSB
		CMP		AL, 'z'
		JG		VDN_Break
		CMP		AL, ' '
		JL		VDN_Break
		CMP		AL, ' '
		JA		VDN_Copy
		// If Space is encountered, convert it to an underscore
		MOV		AL, '_'
VDN_Copy:
		STOSB
		DEC		EDX
		JNZ		VDN_Loop
		MOV		EDI, 0x798D98
		RET
VDN_Break:
		MOV		EDI, 0x798D98
		MOV		EAX, 0
		MOV		[VarD], 0x78787878//[98 8D 79 00]
		MOV		[VarB], 0x78//[9C 8D 79 00]
		RET
// LIMIT 404570 
	}
}

////////////////////////////////////////////////////////////////////////////////////////////////////
/*
void
SwitcherManager (void)
{
	//	Intercept it in SinglePlayer or MultiPlayer mode
	//	Intercept pointer to something ... I don`t know what
	//	Run this pointer through two functions and you get out a pointer 
	//	to VCD structure loaded into memory
	//	Pointer now points to the start of the record of the type of aircraft you wanna fly
	
	//	Store VCD pointer
	[94 8D 79 00] = VCDPtr

	//	Calltable slots
	Calculate_VCD_vehicle_index ();
	Validate_Directory_Name_and_store ();
	-- Empty --
	-- Empty --
	-- Empty --
	-- Empty --
	-- Empty --
	-- Empty --
	-- Empty --
	-- Empty --
	-- Empty --
	-- Empty --
	-- Empty --
	-- Empty --
	-- Empty --
	-- Empty --
}
*/void
SwitcherManager (void)
{
// LIMIT 404570
	__asm{
	// Single player and Servers - Entry point
	// Old code we need to execute
		POP		EDI
		POP		ESI
		PUSHAD
	// Get our chosen flight data
	// flight = FalconLocalSession->GetPlayerFlight();
		MOV		EDI, [VarD]//[DC CD 84 00]
		TEST	EDI, EDI
		JZ		SM_End
		ADD		EDI, 0x000001D4
		MOV		EDI, [EDI]
		MOV		ECX, EDI
		CMP		ECX, 0x400000 
		JL		SM_End
		JMP		SM_Code
	// Slave machines - Entry point
		POP		ESI
		POP		EBX
		PUSHAD
	// flight = FalconLocalSession->GetPlayerFlight();
		MOV		EDI, [VarD]//[DC CD 84 00]
		TEST	EDI, EDI
		JZ		SM_End
		ADD		EDI, 0x000001A4
		MOV		EDI, [EDI]
		MOV		ECX, EDI
		CMP		ECX, 0x400000
		JL		SM_End
SM_Code:
		PUSH	0
		MOV		EDX, 0x4AA440
		CALL	EDX
		MOVSX	EAX, AX
		MOV		EDX, 0x4BB6F0
		PUSH	EAX
		CALL	EDX
		ADD		ESP, 4
		// Store VCD pointer
		MOV		[VarD], EAX//[94 8D 79 00]
SM_CallTable:
SM_Slot00:
		MOV		EDX, 0x404510
		CALL	EDX
SM_Slot01:
		MOV		EDX, 0x4044F0
		CALL	EDX
SM_Slot02:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot03:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot04:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot05:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot06:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot07:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot08:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot09:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot0A:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot0B:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot0C:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot0D:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot0E:
		MOV		EDX, 0x0
		NOP
		NOP
SM_Slot0F:
		MOV		EDX, 0x0
		NOP
		NOP
SM_End:
		POPAD
		RET		4
// LIMIT 404650
	}
}