A test about injecting animations from outside

[moiennepe]

Here is a test about replacing VV's 25 ( bone? animation? ) matrices with a external program.
We use the motion recorded from gacha showering scene ( something you see through the frosted glass, not those wmv videos ) for this example.

 

 

Spoiler

 

 

 

 

Few reasons we use calculated matrices for the injection instead of other easy-to-understand rotation/translation forms, or modifying real mpms:

 

1. Modifying mpm is not so handy unless you use decompressed assets, and apparently some of you don't like that ( worry about getting banned, not compatible with KT's stupid update patches .etc ).
( Although I think you really have better to make other vertices/texture mods directly to the assets, instead of doing that in drawcall hooks )
Also there's no automation tool for vv's mpm now, at least in the public.

 

2. These 25 matrices ( MOT00_Hips ... MOT20_RightToe + 4 dummies ) are stored in some even-monkeys-can-manipulate static global variables.
It will be convenient for adopting this to those drawcall hook libs which you are familiar with.

 

3. Modifying / creating new animations with matrices may be a bit harder, but not totally impossible, only if you are familiar with 3D animation matrix manipulations like this:

( D3D uses transposed mat )
Also matrices can do not only rotating and translating, but also scaling and shearing, those may be useful in special cases.

 

 

If you want to run this test, first you have to patch the executable with something like CFF Explorer:

Or hex edit 0x166 to 23:

( Because the WriteProcessMemory-way injection in this test is just a temporary solution, I don't waste time on dealing with those ASLR stuffs )

 

 

Launch the game, write down its PID, which shows in some process manager:

 

 

Compile and run motinj.exe, enter the PID you got from previous step.

 

If you see now your character disappeared, click the photoshoot mode button, switch the background to studio or bathroom, then you can see the test result we show above.

 

 

 

Now close motinj.exe, you will see the girl freezes into some pose like in "timestop" mode.
Something different is, you can still harass her, she still will get blush .etc, and her lips/brow,  ie. OPT_* bones (facial, fingers), can still move.

 

Restart the game if you want to do anything else.

 

motinj.7z

 

 

Things inside the 7z pack is:
motinj.cs : injector source.
memutil.dll : some worthless WriteProcessMemory stuff.
mot.mtx : dumped animation, bath animation in the pack.

==============

See comments in motinj.cs if you want to apply it to girl 2 / non-main-girl ( any non main girl uses girl 2 slot, even there's only one girl on the screen ) or control its speed.

 

Some details about those 25 matrices:

 

It's 4x4 mat in 32bit float, so 0x640 a frame total.

 

When all 25 matrices are Identity mat, you will get something like this:

 

 

(a dick monster)

 

Spoiler

 

 

Tweaking them by hand will only produce some disturbing results like this, you have to do real math for real pose/animation editing.

 

 

Here's also a mot dumped from tamaki 8th gravure:

 

 

tmk8th.7z

 

mot.mtx_orig is the untouched dump.
mot.mtx move the coordinate to 0,?,0.

 

Again, this shouldn't be the permanent solution. The real one should hook into those mpm calc funcs, and that will be less resources waste and thread-safe.

 

[minazuki]

Is it hard to record a motion by myself?

[moiennepe]

22 minutes ago, minazuki said:

Is it hard to record a motion by myself?

Thanks for the bump.
I've explained that awkward method ( for mat recording ) I currently use in the club post.
And that is useless for them if they are even afraid to remove that ASLR byte in executable...

[Dragonplayеr62]

2 hours ago, moiennepe said:

Thanks for the bump.
I've explained that awkward method ( for mat recording ) I currently use in the club post.
And that is useless for them if they are even afraid to remove that ASLR byte in executable...

Buddy, what about the creation of an offline version DOAX VV? And why did you delete your thread about this? It was very helpful.

Thank you.

[moiennepe]

33 minutes ago, Dragonplayеr62 said:

Buddy, what about the creation of an offline version DOAX VV? And why did you delete your thread about this? It was very helpful.

Thank you.

Not me, ask the God ( or plural, Elohim ) on this forum.
Also you can run those things in this thread no matter using emu or not.

[Dark7543]

5 hours ago, Dragonplayеr62 said:

Buddy, what about the creation of an offline version DOAX VV? And why did you delete your thread about this? It was very helpful.

Thank you.

This thread was deleted by moderators.  

 

4 hours ago, moiennepe said:

Not me, ask the God ( or plural, Elohim ) on this forum.
Also you can run those things in this thread no matter using emu or not.

Please give us a link to your project. Many didnt have time to download it. I remember that there was a link to Mega.
Offline version is very promising  Keep up the great work!

 

[daydreamer250]

That's promising, can you create a blender plugin for the animation dump file? I am thinking to import MMD animations.

[moiennepe]

3 hours ago, daydreamer250 said:

That's promising, can you create a blender plugin for the animation dump file? I am thinking to import MMD animations.

I'm not so familiar with 3d modeling softwares.
And in my ignorance, I haven't seen a plugin or something that export animations in matrices yet...

[daydreamer250]

Hi, is that possible I can create an animation dump from DOA5LR and migrate it to DOAXVV. The bones should be the same. I am going to try this one first.

 

 

 

 

[itasou]

On 5/9/2019 at 10:31 PM, moiennepe said:

Thanks for the bump.
I've explained that awkward method ( for mat recording ) I currently use in the club post.
And that is useless for them if they are even afraid to remove that ASLR byte in executable...

what is club???

[KingKu59]

40 minutes ago, itasou said:

what is club???

 

a secret society like the masonic lodge (only for modders).

 

[moiennepe]

7 hours ago, daydreamer250 said:

Hi, is that possible I can create an animation dump from DOA5LR and migrate it to DOAXVV. The bones should be the same. I am going to try this one first.

 

 

 

 

Dumped some mots from doa5
motdoa5.7z

( Coordinates not modified, open the odekake panel if you can't find / can't follow your character )

You are right their bone structure are the same.

But I don't know what that in your video is, I install doa5 today and never play it before.

 

53 minutes ago, itasou said:

what is club???

Ask minazuki about the club.
Only those had emu setted up are allowed.
And mostly technical things there, not much for leechers.

[daydreamer250]

Wow, that awesome. The dancing animation is my WIP and I will give it a try to create a dump file from it. Do you have a little bit more details about how to create dumps?

[moiennepe]

On 5/12/2019 at 11:57 PM, daydreamer250 said:

Wow, that awesome. The dancing animation is my WIP and I will give it a try to create a dump file from it. Do you have a little bit more details about how to create dumps?

I spent some time on considering a easier way to do the dump.

Dump itself is relatively easy, just put BP like the picture on 700dd9 or 700E86

the "command text" box is savedata m\{u:$breakpointcounter}, 0x13C92E0,0x600 .
m is a folder under x32dbg root directory.
Sometimes 700dd9 can get data, sometimes 700E86 can. All addresses above base on game.exe v1.10c final.

After you get matrices dumps, delete all the duplicates in them ( with eg. Duplicate Cleaner 2.1 ), and concat them with some prog
( becasue doa5 mats length is 0x600, not 0x640 in VV, so you have to fill that 0x40 gap by some means )

 

Not sure if it will work when some hooks ( dinput8.dll, d3d9.dll .etc ) exist.

 

The thing annoying is, game.exe is on steam and has a steam-drm packer, and also has ASLR.

It may be not so easy for amateurs to remove that....

 

What I am using now is a heavily modified one, it uses assets under Z\*.b instead of *.lnk

Spoiler

 

https://mega.nz/#!vygUSCxK!nFWnrIfKt5kt5N0WB9cega5lPa5Bp-I0hyzLQZ4ZScM

Don't know if it can be some help for you to modify the executable for yourself...

[daydreamer250]

Thank you so much for this tutorial. I am not a computer programmer, so it's going to take me a while to fully understand the concept of injection and hook of the process inside memory layer. But I will definitely give it a try. 

[sugarheaven]

Emmmm......that's too complicated for me

[moiennepe]

Porting doa5 mpm to VV is much simpler than I expected.

Spoiler

Ported from _Movie\ParvateParadise\DOAHDM\AYANE_0440\AYANE\AYANE.MPM

 

 

Though I am completely ignorant about the data structures in char_dat 2nd~6th segments...
( Try searching around internet, all I can find are some script-kiddie's "tutorials", none of them has explanations on the data fields... )

 

Here's some code to split doa5 4-parts mpm to 3 individual mpms ( body + facial +2 hands ) for vv,
and convert the anim indices, timeline indices (?)  in char_dat 1st segment from int32 to int64.

mpmlr2vv.rar

[daydreamer250]

That's very good news. I am still struggling to make this working. Here is another WIP

 

 

[FinalStrike]

Sounds promising i like the concept a  lot 

[Church of Kokoro]

OMG, the ONE thing that VV is missing is pole dances. ?

Very promising work!