HITMAN 2 support

[hardware]

Hi @OrfeasZ,

Do you have any plan to support the latest Hitman game ? Is it technically possibe ? if so, how would you proceed ? (I have some basic experience with Qt and C++, if i can help...).

[OrfeasZ]

I looked into Hitman 2016 a while ago, and it is significantly different compared to the previous Hitman games (and the fact that it uses Denuvo makes things slightly more complicated in some cases). I think I started adding support for 64-bit games to Statman at some point but I'm not sure if I ever finished that.

As for how you'd go about doing something like this: the simplest way to begin is by figuring out a reliable path to where the game stores information about the current play session. You can do this either by reverse engineering the game (more accurate, but more specialized, time-consuming and in this case slightly more challenging because of Denuvo) or by using similar techniques to people creating standard game trainers, using tools like Cheat Engine (you can look up trainer tutorials on YouTube).

From there, Statman provides some utilities to automatically hook into a process or read its memory (though some of this functionality may be incomplete for 64-bit). The API isn't the greatest right now, and certainly needs an improvement, but I haven't had the time to deal with it.

[hardware]

Denuvo is gone since june 2017.
https://www.dsogaming.com/news/denuvo-anti-tamper-tech-has-been-removed-from-hitman/

Thanks for taking the time to respond. I do not have the skills to reverse engineer the game unfortunately. Maybe someone will do it someday :)

EDIT: maybe i'll try to do something with C# .NET but without those memory addresses, it will be difficult . Moreover, they seem to change with each game update according to the developer of the Hitman camera tool mod : https://github.com/FransBouma/InjectableGenericCameraSystem/releases/tag/Hitman2016_v110

[OrfeasZ]

Denuvo being gone is good news. Also, updates tend to indeed break tools like these, but there are ways to make them more resilient (not something to be concerned with right now). As for this case, as I mentioned before, the simplest way to locate memory addresses is using something like Cheat Engine, and doesn't really require reverse engineering skills. Search for "game trainer tutorial cheat engine" on YouTube and I'm sure there's gonna be something helpful there.

[OrfeasZ]

I've started making some progress on this in branch engine/hm5. Not much to see yet, but there's some promising stuff.

[hardware]

It looks promising, thank you for taking the time to implement that mate, it will be very useful for the community :) Maybe multiple contributors can help you. Poke @nvillemin @SuiMachine @HHCHunter @swixel @TheKotti

I can help about the SA conditions. I am not a speedrunner but I know the game mechanics pretty well.

[OrfeasZ]

Right now all my research focuses around reverse engineering an engine data structure called ZAIGameState (no legal issues here, allowed under EU laws for interoperability reasons), which has an extensive bitfield, tracking a variety of different game-state related things (see here). This structure is also "synced" to game script (presumably the CppTemplates, whose format I have not looked into) with the help of the type information system you are talking about.

I have not looked into the scripting engine much, but it wouldn't be too difficult to intercept data going back and forth from native land, as Statman already supports injecting native DLLs into the game process. However, for now I'm trying to stick to static in-memory structures, as they look promising and are much easier to work with, much faster to parse, and in many cases more tolerant to game updates.

As for intercepting network traffic, I have no plan on doing that, because that starts getting into sketchy territory. If anything, I'd just hook the underlying subsystem.

[hardware]

@OrfeasZ Did you found this property in the game ?

Statman/StatModules/HM5/Src/HM5/Structs/ZAIGameState.h

Line 174 in a9fd5cb

bool m_bBloodPoolFound : 1; // & 8 (>> 3)

If yes, it is good to know because this feature is requested by the community since day one :D IOI said, 2 years ago, it was too complicated to implement blood pool detection by NPC because the engine was not designed for that.

[OrfeasZ]

@swixel ZAIGameState is statically allocated (and has been at least since the beta, which is the earliest binary I have in my hands), and it hasn't really changed much (except for some stuff being re-arranged or added).

@hardware Everything in there is pulled from the engine (I'm not currently making any naming assumptions), but this specifically has been there since beta too, so I wouldn't get my hopes up too much.

[OrfeasZ]

Some stupid shit:

Already in engine/hm5.

[OrfeasZ]

@swixel thanks for the flags! I already have ZString mapped out so it's fine. Right now I'm working on finishing the reflection stuff so I can move on to entities, at which point I'll have a much clearer picture of what's happening in the scripting engine.

Do you know if there are any resources online about what CppTemplates are and how they work? I assume they represent some kind of node-graph / circuit system, but I don't want to spend too much time looking into them.

[OrfeasZ]

0x578FBCEE is actually dubbed RuntimeResourceID (you were pretty close!) and there's an extra data type that I found:

0x64603664: RuntimeResourceIDAndResourcePtr (haven't looked into how it's actually serialized).

[HHCHunter]

I'm surprised I didn't get the GitHub notification for the tag on this one.

I'm really glad people are putting in effort for HITMAN.
Unfortunately these days I don't really have the time for working on HITMAN due to full-time work.

Looking forward to what engine notes people come out with more work being put in 👍

[OrfeasZ]

Here's a full list of resource types and their corresponding engine typenames for anyone who may find them useful:

AIBB BehaviorTreeEntityBlueprint
AIBX BehaviorTreeEntityType
AIBZ CompiledBehaviorTreeResource
AIRG ReasoningGridResource
ALOC Physics
ASEB AspectEntityBlueprint
ASET AspectEntityType
ASVA AnimSetVariation
ATMD AMD
BMSK BoneMask
BORG AnimationBoneData
CBLU CppEntityBlueprint
CLNG DialogCascadingLanguageDependencies
CPPT CppEntityType
CRMD CrowdMapDataResource
DITL DialogSoundTemplateList
DLGE DialogEvent
ENUM EnumType
ERES EntityResource
FXAC Actor
FXAS AnimSet
GFXF ScaleformGFx
GFXI ScaleformGFx
GFXV ScaleformGfxVideo
HIKC HIKCharacter
JSON JsonResource
LINE TextLine
LOCR Localization
MATB RenderMaterialEntityBlueprint
MATE RenderMaterialEffect
MATI RenderMaterialInstance
MATT RenderMaterialEntityType
MRTN Network
MRTR Rig
NAVP NavpowerNavmesh
ORES OnlineResource
PRIM RenderPrimitive
REPO Repository
RTLV RuntimeLocalizedVideo
SCDA ScatterData
SCTX ScatterTexture
SDEF SoundAmbienceDefs
TBLU TemplateBlueprint
TELI TextList
TEMP Template
TEXD DummyTextureData
TEXT RenderTexture
UICB UIControl
UICT UIControl
VIDB VideoDatabaseResource
VTXD VertexData
WBNK WwiseBank
WSGB AudioStateBlueprint
WSGT AudioStateType
WSWB AudioSwitchBlueprint
WSWT AudioSwitchType
WWEM Wem
WWEV WwiseEvent
WWFX WwiseBankFX
YSHP PhysicsSystem