Does anyone know how EUD's actually work?

Does anyone know how EUD's actually work?

This made my day.

This made my day.

Players after 12 are known as extended players, and their deaths are beyond the range marked for death counts, so you get EUDs, extended unit deaths, so by using conditions to look at their deaths, you can see sections of memory in the game not normally accessable, since the conditions still ATTEMPT to look at their deaths, but actually end up looking at something else.

Players after 12 are known as extended players, and their deaths are beyond the range marked for death counts, so you get EUDs, extended unit deaths, so by using conditions to look at their deaths, you can see sections of memory in the game not normally accessable, since the conditions still ATTEMPT to look at their deaths, but actually end up looking at something else.

[url=http://en.wikipedia.org/wiki/Buffer_overflow]This[/url] (note that the article talks about [i]writing[/i] to the overflow, the situations it describes are why EUD Actions were patched.) It can be done with players or units. Adding one to a unit ID reads 48 bytes ahead, add one to a player reads one byte ahead. Max unit ID is 65535, max player ID is 255 (0-based.) You can read 3146700 bytes, starting with Player 1 Marine. The data format is like this, but then EUDs extend past the bounds (read the article I linked to): [collapse]+0x00 - Player 1 Marine +0x04 - Player 2 Marine +0x08 - Player 3 Marine +0x0C - Player 4 Marine +0x10 - Player 5 Marine +0x14 - Player 6 Marine +0x18 - Player 7 Marine +0x1C - Player 8 Marine +0x20 - Player 9 Marine +0x24 - Player 10 Marine +0x28 - Player 11 Marine +0x2C - Player 12 Marine +0x30 - Player 1 Ghost +0x34 - Player 2 Ghost +0x38 - Player 3 Ghost +0x3C - Player 4 Ghost +0x40 - Player 5 Ghost +0x44 - Player 6 Ghost +0x48 - Player 7 Ghost +0x4C - Player 8 Ghost +0x50 - Player 9 Ghost +0x54 - Player 10 Ghost +0x58 - Player 11 Ghost +0x5C - Player 12 Ghost etc.…[/collapse]

This (note that the article talks about writing to the overflow, the situations it describes are why EUD Actions were patched.) It can be done with players or units. Adding one to a unit ID reads 48 bytes ahead, add one to a player reads one byte ahead. Max unit ID is 65535, max player ID is 255 (0-based.) You can read 3146700 bytes, starting with Player 1 Marine.

The data format is like this, but then EUDs extend past the bounds (read the article I linked to):

[quote=name:FaRTy1billion]add one to a player reads one byte ahead[/quote] You mean 4 bytes ahead?

Quote from O)FaRTy1billion[MM]

add one to a player reads one byte ahead

You mean 4 bytes ahead?

Oops. Yeah.

Oops. Yeah.

Ahh, now I get it. Thanks a bunch =)

Ahh, now I get it.

Thanks a bunch =)

So that's how they work. Is there any [b]other [/b]way to cause a buffer overflow in starcraft?

So that's how they work. Is there any other way to cause a buffer overflow in starcraft?

Place units for extended players :P

Place units for extended players

Use units and sprite-units with IDs over 227. Disabling some units will also cause them.

Use units and sprite-units with IDs over 227.
Disabling some units will also cause them.

Disabling just gives them stupid iscripts, as far as I know. >.>

Disabling just gives them stupid iscripts, as far as I know. >.>

[quote=name:FaRTy1billion]Disabling just gives them stupid iscripts, as far as I know. >.>[/quote] Which play wrong frames, which overflow the GRP. Among other effects...

Quote from O)FaRTy1billion[MM]

Disabling just gives them stupid iscripts, as far as I know. >.>

Which play wrong frames, which overflow the GRP. Among other effects...

Eh. Playing an invalid frame results in a crash. It doesn't play "wrong" frames, it just uses stupid scripts.. like the idtoattack animation over and over. The cloaking I believe to be a result of things normally becoming invisible. Protoss buildings can disable nicely because they are meant to (but not in the same method.) Actually it is an [i]iscript[/i] overflow, now that I am thinking about it. If you mod iscript.bin, they do different things.

Eh. Playing an invalid frame results in a crash. It doesn't play "wrong" frames, it just uses stupid scripts.. like the idtoattack animation over and over. The cloaking I believe to be a result of things normally becoming invisible. Protoss buildings can disable nicely because they are meant to (but not in the same method.)

Actually it is an iscript overflow, now that I am thinking about it. If you mod iscript.bin, they do different things.

[quote=name:FaRTy1billion]Eh. Playing an invalid frame results in a crash. It doesn't play "wrong" frames, it just uses stupid scripts.. like the idtoattack animation over and over. The cloaking I believe to be a result of things normally becoming invisible. Protoss buildings can disable nicely because they are meant to (but not in the same method.) Actually it is an [i]iscript[/i] overflow, now that I am thinking about it. If you mod iscript.bin, they do different things.[/quote] Of course, but if the game crashes is because it also overflows somewhere else. As a result of playing a wrong script....

Quote from O)FaRTy1billion[MM]

Eh. Playing an invalid frame results in a crash. It doesn't play "wrong" frames, it just uses stupid scripts.. like the idtoattack animation over and over. The cloaking I believe to be a result of things normally becoming invisible. Protoss buildings can disable nicely because they are meant to (but not in the same method.)

Actually it is an iscript overflow, now that I am thinking about it. If you mod iscript.bin, they do different things.

Of course, but if the game crashes is because it also overflows somewhere else. As a result of playing a wrong script....

wait... so in theory, you can read how much HP a unit has, with SOME EUD?

wait... so in theory, you can read how much HP a unit has, with SOME EUD?

Seeing as how there are only a limited number of EUD's and there are thousands of data value's and variables and crap, maybe.

Seeing as how there are only a limited number of EUD's and there are thousands of data value's and variables and crap, maybe.

[quote=name:Pyro682]wait... so in theory, you can read how much HP a unit has, with SOME EUD?[/quote] [url=http://www.staredit.net/topic/3616/]Why only in theory? It's been done.[/url] The data structure has been rearranged a little from when I started doing this, so you can't read supply values anymore with EUDs... but you can with extended othertriggers. :shifty: (I still need to play with those...)

Quote from Pyro682

wait... so in theory, you can read how much HP a unit has, with SOME EUD?

Why only in theory? It's been done.

The data structure has been rearranged a little from when I started doing this, so you can't read supply values anymore with EUDs... but you can with extended othertriggers. (I still need to play with those...)

[color=#b5b5ff]And to pre-empt questions, the "extended other triggers" just plays with the fact that there are many other triggers that take integer arguments for non byte-delimited things (like unit or player IDs), and Blizzard does not sanitize trigger input (beginning with patch 1.13b they sanitized trigger actions to prevent the malicious writing to RAM outside of Starcraft's allocation.[/color]

And to pre-empt questions, the "extended other triggers" just plays with the fact that there are many other triggers that take integer arguments for non byte-delimited things (like unit or player IDs), and Blizzard does not sanitize trigger input (beginning with patch 1.13b they sanitized trigger actions to prevent the malicious writing to RAM outside of Starcraft's allocation.

I'm wondering, is it possible that EUD actions may still work? I mean, let's say you preplaced the units you needed to get deaths of for the proper players, and then use other units to manually kill them to add the death, instead of modifying it directly using actions?

I'm wondering, is it possible that EUD actions may still work? I mean, let's say you preplaced the units you needed to get deaths of for the proper players, and then use other units to manually kill them to add the death, instead of modifying it directly using actions?

Problem is that most extended units crash. Feel free to try it. :P

Problem is that most extended units crash. Feel free to try it.