How to use "Deep Trainer" debug command

[paraj]

Searching but couldn't find anything.


Concretely I tried in ZeeWolf. Ammo is 500, so I try "Dx !500", resume game, waste some bullets and try "Dx !498" and it says "69156092 addresses found", so I guess that's not how to use it. (Yes I tried a bunch of other stuff).


I know I can search memory for values etc., but my question is: How is the "D" command supposed to be used? A single, understandable example is fine

[Toni Wilen]

Deep trainer does not take value parameter. It works like in AR3 (with some additions) by comparing stored values (same, different, smaller, larger). Any non-matched value gets dropped from possible addresses list.

First "D", then return to game. When ammo changes, enter debugger and tell the debugger that value has changed: "Dz" (or "Dd" if you are sure stored value also decreased). Return back, use one (or more) ammo and "Dz" again until only few possible values remain.

Standard trainer takes a value (C)

[paraj]

Thanks. Never had AR3 which is why I might be confused by it. It does work indeed, but for this case "C" seems easier (which I somehow missed).

For reference, with C command:
"C !500", fire one (or more shots), then "C !499" address is found.

With D I also got it working but seems much worse in this case.

Anyway thanks again!

[Toni Wilen]

Yeah, as long as numeric value is visible: use normal trainer.

"Deep trainer" is meant to be used when numeric value is not available (for example energy bar).

[Rock'n Roll]

Hi paraj, my test in zeewolf:

>Ds
Scanning.. 00000000 - 00200000 (Chip memory)
Scanning.. 00c00000 - 00c80000 (Slow memory)
Deep trainer first pass complete.
;------------------------------------------------------------------------------
>g	; play a little bit and lost some cannons ; then Shift+F12
;------------------------------------------------------------------------------
>Dd
Scanning.. 00000000 - 00200000 (Chip memory)
Scanning.. 00c00000 - 00c80000 (Slow memory)
63496 addresses found
Now continue with 'g' and use 'D' again after you have lost another life
>g	; play a little bit and lost some cannons ; then Shift+F12
;------------------------------------------------------------------------------
>Dd
Scanning.. 00000000 - 00200000 (Chip memory)
Scanning.. 00c00000 - 00c80000 (Slow memory)
2249 addresses found
Now continue with 'g' and use 'D' again after you have lost another life
>g	; play a little bit and lost some cannons ; then Shift+F12
;------------------------------------------------------------------------------
...
>Dd	; 352 addresses found	
>g	; play on this way till: maybe 5 times...
;------------------------------------------------------------------------------
>Dd	; 1 addresses found
...
00C44493=00DA >?$da

; my cannons counter has now 474 in the game

00C44493=00DA >?$da
$000000DA = %00000000`00000000`00000000`11011010 = 218 = 218
>m C44493
00C44493 DA00 0000 0000 0000 0000 0407 0400 0001  ................

>m C44492
00C44492 01DA
>?$1da
$000001DA = %00000000`00000000`00000001`11011010 = 474 = 474	; its correct
>

>W C44492 !999
or
>w 0 C44492 2 frw	; This sets freeze watchpoint 0 on the contents of that address and the following one.

The 'problem' here is, that !500 is a word and not a byte value:

[jotd]

deep trainer analyses bytes increases/decreases, it can't work with words.

So if you have a value that is encoded differently (BCD) on 2 bytes it's going to be harder to find the value.

I often go with "same" / "different". After enough tries you find what has changed. Like an A.I. learning the memory

[WayneK]

Originally Posted by Rock'n Roll

[/CODE]The 'problem' here is, that !500 is a word and not a byte value:

In this case I would just run the ammo down to a number < 256 and then search, remembering that the "real" value I'm looking for is stored in a word but I'm only going to find the low byte during trainer search...

[Rock'n Roll]

https://eab.abime.net/showpost.php?p...6&postcount=20
(old suggestion: https://eab.abime.net/showpost.php?p=268855&postcount=1 ; not implemented)

- debugger deep trainer improved. "D[<s><dix> <[max diff]>]" Di = value must increase, Dd = decrease, abs(new value minus old value)
must be smaller than "max diff". s = 1 = byte, 2 = word. long words not supported. (defaults to byte) Signed integers used in comparison.
NOTE: not really tested, I was not interested

questions:
1. How about to use this s = 1 = byte, 2 = word ?
>Ds 1 or Ds 2 no answer, no change

2. actual >h-information about command is:
D[idxzs <[max diff]>] Deep trainer. i=new value must be larger, d=smaller, x = must be same, z = must be different, s = restart.

where: [idxzs] is:
D ; Deep trainer
Di ; i=new value must be larger (value must increase)
Dd ; d=new value must be smaller
Dx ; x=must be same
Dz ; z=must be different
Ds ; s=restart

D is used when you don't know the value. A health bar might not be an obvious
value so you could use D to find it. It works by eliminating addresses that
have or haven't changed. The commands are
Ds (start/reset deep trainer),
D (find any addresses that have changed since last D command),
Dx (find any addresses that haven't changed since last D command).

But what about the part <[max diff]>?
if the searching value !500 ($01F4), then the search form would be:
>Ds ; restart on byte values
>g ; -2 cannons

>Dd 2 ; bytevalue now $f2 is max diff=2
621228 addresses found ?
or
>Dx $f2 ; for the value f2 (x=must be same)
or
>Dz 5 ; for a value in range $F4-5 or $F4+5 (z=must be different)

3.
also a multiple check in combination is not possible, like:
>Dd
29069 addresses found
Now continue with 'g' and use 'D' again after you have lost another life
>Dd
0 addresses found ; normally I would get the 29069 addresses found again

For the moment only the part: D[idxzs] works. (only Ds and Dd tested)

4. suggestion, please insert a formating, if result output:
After a group of 4 start at new line.

00007BFD=0008 0000E94A=0058 0000F795=0058 00087BFD=0008 ; its easier for the eyes!
0008E94A=0058 0008F795=0058 00107BFD=0008 0010E94A=0058

[paraj]

Thanks that good info! I know how it works now, but I'll surely forget for next time