Dawn of War II Unlockable Content

Sun, 22 Feb 2009 - 10:41pm — Corsix

Dawn of War II has unlockable content; that is certain maps, campaign wargear, army painter colours and so on are locked by default, and have to be unlocked using special codes. People who pre-ordered the game got a code or two, and codes are also available through other promotional sources.

This unlockable content is implemented as follows:

The content.bin file in the Dawn of War 2 folder lists all of the unlockable content, in the form of a compiled Lua file.
Each set of unlockable content has an entry in the content.bin file listing the files/colours/wargear/etc. which it unlocks, and the UnlockMask required to unlock it
Each GFWL account has an UnlockBits field
Registering an unlock code sets the appropriate bit in your UnlockBits field
To decide which content to unlock, the game (DOW2.exe) iterates over each set in turn, tests to see if all the bits in the UnlockMask are set in your UnlockBits (e.g. if UnlockMask bitwise-and UnlockBits equals UnlockMask then), and if so, unlocks the things in that set
content.bin is cryptographically signed by the content.cat security catalogue file
DOW2.exe is cryptographically signed by the DOW2.exe.cat security catalogue file
wintrust.dll is used by DOW2.exe, xlive.dll, and some other DLLs to verify the security catalogues

The standard approaches to unlocking all of the content might include:

Modify content.bin and set every UnlockMask to zero (zero bitwise-and UnlockBits equals zero). This would fail as then content.cat would fail to verify content.bin and DOW2.exe would abort loading
Modify DOW2.exe and patch the code to read zero for every UnlockMask. Again, this would fail as xlive.dll would fail to validate the signature on DOW2.exe and multiplayer wouldn't work

Neither of the above methods would work, due to the cryptographic checks done on the content.bin and DOW2.exe files. The weakpoint of DoW2's system is how these checks are done. As previously stated, wintrust.dll (a Microsoft DLL which lives in C:\Windows\System32) is used to make sure that the security catalogue files are valid and successfully verify DOW2.exe and content.bin, using the WinVerifyTrust[Ex] function. Furthermore, wintrust.dll itself is not cryptographically signed. If wintrust.dll is copied from the system32 directory to the dawn of war directory and then modified so that WinVerifyTrust always returns ERROR_SUCCESS, then the cryptographic checks are sidestepped (ERROR_SUCCESS is conveniently the value zero, so this simply means replacing the first five bytes of WinVerifyTrust with "xor eax, eax; retn 12;" or 33 C0 C2 0C 00 in machine code).

If content.bin is now modified so that the unlock masks are all zero, then when the game is run, it'll load wintrust.dll from the game directory rather than the system32 directory (DLLs in the 'current' directory override those in the system directory by default), and when it comes to verify content.bin, the patched WinVerifyTrust returns ERROR_SUCCESS, and so the game believes that the file is still cryptographically signed. It then comes to see what content the GFWL account has unlocked by doing 'does UnlockMask bitwise-and UnlockBits equal UnlockMask' for each unlock set, and as zero bitwise-and anything does equal zero, it'll unlock all of the content.

For further reading, see part 2.

Corsix's blog

Comments

Wed, 30 Sep 2009 - 10:06am — Serge (not verified)

content.bin

in content.bin there is nothing abou UnlockMask.. need more steps.

Sun, 22 Mar 2009 - 4:42am — Pestilence (not verified)

ss1_sep1.lua

import ("campaignutil.lua")

ss1_sep1 =
{
quest_type = "assassinate",

target_completion_seconds = 960,

loading_screen_file_path = "data:ui/textures/generic/fe/loading/Marine_ForceCommander",

atmosphere_override = "data:maps/atmospheres/SEP_MISSION_01.ATMOSPHEREPRESET",

forced_loading_tip =
{
title = 9107357, -- LOCDB [9107357] 'Commander %1COMMANDERNAME%'
description_text_array =
{
9107358, -- LOCDB [9107358] 'You are %1COMMANDERNAME%, a Space Marine recently promoted to the rank of Force Commander.'
9107359, -- LOCDB [9107359] 'You have been sent to Calderis to help Captain Davian Thule stave off a massive Ork invasion. Such is your reputation, the Chapter expects that you alone will be enough to tip the balance of the fight, and save Calderis.'
9107360, -- LOCDB [9107360] 'A man of few words, you are renowned for keeping calm in high-pressure situations, and finding a path to victory in the face of overwhelming odds.'
--~ 9107361, -- LOCDB [9107361] 'Proficiencies: Hand-to-hand Combat, Leadership'
--~ 9107362, -- LOCDB [9107362] 'Ability: To Victory!'
--~ 9106023, -- LOCDB [9106023] 'Charge to a specified location with the chapter's vigor, smashing through objects and knocking enemies back.'
},
icon =
{
--~ "data:UI/textures/space_marines/icon_abilities/attack/sm_charge",
},
},

scar_data =
{
source = "GatheringStorm",
race = "orks",
startMarkerName = "mkr_Act1_PlayerFirstSpawn",
--isPrimary = true,
folder = "CampaignMissions/",
act = 1,
},

non_human_teams =
{
{
neutral = false,
allied = true,
players =
{
{
name = 9056684, -- LOCDB [9056684] 'Allied Space Marine Squad'
race = "space_marines",
chapter_key_name = "SM_Bloodravens",
},
},
},
{
neutral = false,
allied = false,
players =
{
{
name = 9052975, -- LOCDB [9052975] 'Greenskin Horde'
race = "orks",
chapter_key_name = "Ork_Bad_Moonz_clan",
},
},
},
},

name = 9054896, -- LOCDB [9054896] 'Stand With Your Brothers'
briefing_text_array =
{
9100802, -- LOCDB [9100802] 'Calderis.' - 'Thule'
9100803, -- LOCDB [9100803] 'We Blood Ravens select our initiates from this world's fierce warriors. ' - 'Thule'
9100804, -- LOCDB [9100804] 'Calderis is the cradle and the future of our chapter. ' - 'Thule'
9100805, -- LOCDB [9100805] 'Now, the Orks would take it from us.' - 'Thule'
9100806, -- LOCDB [9100806] 'This, we cannot allow. ' - 'Thule'
},
primary_objectives =
{
9049791, -- LOCDB [9049791] 'Move North'
9049280, -- LOCDB [9049280] 'Stop the Ork Incursion'
},
secondary_objectives =
{
},
rewards =
{
experience = 0, --new xp reward -chrismartin - updated, aug 19/08
wargear =
{
"wargear\\wargear\\campaign\\playable\\race_marine\\sm_wp2_chainsword_improved_0", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_wp1_bolt_pistol_herald_of_the_coming_doom", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_wp2_chainsword_blade_of_ulyus", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_wp1_sniper_rifle_deathtouch_of_the_angel", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_arm_scout_armour_grim_silence", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_wp1_heavy_bolter_purge_of_victory_bay", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_arm_power_armour_armor_of_the_destroyer", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_wp1_bolter_unforgiving_truth", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_arm_power_armour_armor_of_vandea", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_wp2_powerfist_gauntlet_of_blood", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_wp1_bolt_pistol_pistol_of_baal", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_arm_power_armour_cuirass_of_azariah", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_com_iron_halo_laurels_of_hadrian", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_wp1_combat_shotgun_initiates_lesson_of_strength", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_wp1_missile_launcher_unerring_thunderbolt", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_wp1_plasma_gun_fearsome_light_of_faith", "wargear\\wargear\\campaign\\playable\\race_marine\\sm_acc_frag_grenade_packveterans_grenades"
},
},

quest_images =
{
"DATA:UI/Textures/generic/bridge/briefing/slides/sep_orks_01",
"DATA:UI/Textures/generic/bridge/briefing/slides/sep_map_generic_01",
},
briefing_video_file_path = "movies:portraits/speech_marine_thule.lua",
briefing_audio_file_paths =
{
"streamed_speech/sp/space_marine/an1/sa_thu_sin_spman1gengen_nh_s_9100802",
"streamed_speech/sp/space_marine/an1/sa_thu_sin_spman1gengen_nh_s_9100803",
"streamed_speech/sp/space_marine/an1/sa_thu_sin_spman1gengen_nh_s_9100804",
"streamed_speech/sp/space_marine/an1/sa_thu_sin_spman1gengen_nh_s_9100805",
"streamed_speech/sp/space_marine/an1/sa_thu_sin_spman1gengen_nh_s_9100806",
},
animatic_file_path = "movies:sm_intro.lua",
roll_over_thumbnail_file_path = "DATA:UI/Textures/generic/bridge/briefing/slides/sep_ork_01_th",
boss_name_text = 9052975, -- LOCDB [9052975] 'Greenskin Horde'

ignore_in_star_score_calc = true,
}

function ss1_sep1.GetImmediateActivationLocation()
if Campaign_IsMissionComplete("a16_avatar") == false then
return "sep"
else
return nil
end
end

function ss1_sep1.OnComplete()

-- populate the events log
Campaign_TutorialTipsSEP1()
Campaign_AddStatusUpdate ("OrkInvasion")
Campaign_AddStatusUpdate ("SEP2" )

Campaign_SetSquadLocked ("sbps\\campaign\\playable\\race_marine\\troops\\sm_force_commander", false)
Campaign_SetSquadOwner ("sbps\\campaign\\playable\\race_marine\\troops\\sm_force_commander", OwnerHost)

Campaign_SetSquadLocked ("sbps\\campaign\\playable\\race_marine\\troops\\sm_tactical_marine_tarkus", false)
Campaign_SetSquadOwner ("sbps\\campaign\\playable\\race_marine\\troops\\sm_tactical_marine_tarkus", OwnerClient)

-- Remove the UI elements that we don't want the player to see yet
Campaign_SetUIVisibility (UIV_Starmap, false)
Campaign_SetUIVisibility (UIV_TyranidRating, false)
-- Campaign_SetUIVisibility (UIV_SquadTabs, false)
Campaign_PingSquadTab( "sbps\\campaign\\playable\\race_marine\\troops\\sm_force_commander", true )

-- post mission speech
Campaign_PlaySpeech("speech_marine_thule", 9059681) -- LOCDB [9059681] 'Welcome aboard Strike Cruiser Armageddon, Commander.' - 'Thule'
Campaign_PlaySpeech("speech_marine_thule", 9059683) -- LOCDB [9059683] 'Calderis is currently facing a massive Ork invasion that threatens to spill over to the entire sector.' - 'Thule'
Campaign_PlaySpeech("speech_marine_thule", 9101691) -- LOCDB [9101691] 'Urgent distress signals are coming from other nearby sectors, but we must concentrate our efforts here.' - 'Thule'
--~ Campaign_PlaySpeech("speech_marine_thule", 9059686) -- LOCDB [9059686] 'Calderis and Typhon are recruiting worlds for the Blood Ravens. They must remain secure.' - 'Thule'
--~ Campaign_PlaySpeech("speech_marine_thule", 9059687) -- LOCDB [9059687] 'Sergeant Tarkus and his Tactical Squad will remain under your command. ' - 'Thule '
Campaign_PlaySpeech("speech_marine_thule", 9061548) -- LOCDB [9061548] 'I need you to take charge of an assault that's stalled on the surface below.' - 'Thule '
Campaign_PlaySpeech("speech_marine_thule", 9061549) -- LOCDB [9061549] 'Drop to the point marked on the planet map and start pushing into the Ork's flank. ' - 'Thule '

--~ Campaign_PlaySpeech("speech_marine_tarkus", 9101693) -- LOCDB [9101693] 'Before we deploy, Commander, you should review our equipment and training in the bridge squad display.' - 'Tarkus'
--~ Campaign_PlaySpeech("speech_marine_tarkus", 9059690) -- LOCDB [9059690] 'Once you have done so, select the signal marked on the planet view to review our next mission. ' - 'Tarkus'

-- populate sep2
Campaign_ForceImmediateActivation("ss2_sep2", "sep")

--~ -- Triggered after the player opens the squad screen.
--~ Campaign_PlaySpeech("speech_marine_tarkus", 9102480) -- LOCDB [9102480] 'That chainsword would be an improvement over the one you are currently using, Commander.' - 'Tarkus'
--~ Campaign_PlaySpeech("speech_marine_tarkus", 9102481) -- LOCDB [9102481] 'I suggest you equip it.' - 'Tarkus'
--~
--~ -- Triggered after the player equips the chain sword.
--~ Campaign_PlaySpeech("speech_marine_tarkus", 9102482) -- LOCDB [9102482] 'You are also eligible for additional training. ' - 'Tarkus'
--~ Campaign_PlaySpeech("speech_marine_tarkus", 9102483) -- LOCDB [9102483] 'You can train in any of the four disciplines of combat.' - 'Tarkus'
--~
--~ -- Player has closed the squad screen.
--~ Campaign_PlaySpeech("speech_marine_tarkus", 9101694) -- LOCDB [9101694] 'We are ready to deploy, Commander. ' - 'Tarkus'
--~ Campaign_PlaySpeech("speech_marine_tarkus", 9101695) -- LOCDB [9101695] 'Select the signal marked on the planet view to review our next mission.' - 'Tarkus'

end

function ss1_sep1.OnFail()
Campaign_PlaySpeech("speech_marine_gordian", 9064593) -- LOCDB [9064593] 'Your wounds are healed, Commander, and your squads restored.' - 'Gordian'
end

function ss1_sep1.ComputePrecacheEBPFolders()

return {

}

end

function ss1_sep1.ComputePrecacheSBPFolders()

return {

"sbps\\campaign\\playable\\race_marine\\troops\\sm_force_commander",
"sbps\\campaign\\playable\\race_marine\\troops\\sm_tactical_marine_tarkus",
"sbps\\campaign\\npc\\race_marine\\troops\\sm_davian_thule",
"sbps\\campaign\\npc\\race_marine\\troops\\sm_scout_marines_sep",
"sbps\\campaign\\npc\\race_marine\\troops\\sm_tactical_marines",
"sbps\\campaign\\npc\\race_ork\\chaff\\ork_boy_ranged",
"sbps\\campaign\\npc\\race_ork\\chaff\\ork_boy_ranged_noxp",
"sbps\\campaign\\npc\\race_ork\\chaff\\ork_boy_melee",
"sbps\\campaign\\npc\\race_ork\\chaff\\ork_boy_melee_noxp",
"sbps\\campaign\\npc\\race_ork\\chaff\\ork_wartrukk_sep",
"sbps\\campaign\\npc\\race_ork\\chaff\\ork_stikkbommas",
"sbps\\campaign\\npc\\race_ork\\chaff\\ork_tankbusta",
"sbps\\campaign\\npc\\race_ork\\bosses\\ork_mekboy_sep4",

}

end

Sun, 22 Mar 2009 - 4:41am — Pestilence (not verified)

EASIER WAY!!

Well, I didnt look into unlocking the custom colors yet (I'm betting that can be done easier as well) but...
If you make sure the game is in Dev mode (add -dev to the launch options) then you can access the console and add in wargear items, even the special ones from the pre-order packs you didnt get. Also, you can preset the game you give you items and such (as rewards for completeing the 1st mission seemed to be the simple solution). Without fiddleing with a hex editor, we'll use Notepad instead.
C:\Steam\steamapps\common\dawn of war 2\GameAssets\Data\Campaign\space_marines\missions\ss1_sep1.lua
This is the file you need to create (full path, adjusted to your install location YES YOU NEED TO CREATE AFEW FOLDERS, DEV MODE ONLY)
I'll put a comment up with what I believe to be the full custome wargear unlock, then you'll have it after 1st mission. You can add ALL the wargear and you can add as much as you want if you want to cook it off for EXP. I'm currently looking into modifying the files to make my own custom wargear set for my marines to take into battle.

Sat, 28 Feb 2009 - 3:31pm — Anonymous (not verified)

Seriously. Just post the

Seriously. Just post the files already. Once that is done, if Relic wants to patch it, then fine.

Mon, 23 Feb 2009 - 10:13pm — Lauren-Kitten (not verified)

Whoa...

...any chance you could simply e-mail me the modified files? I'm already getting bored of this waste of 50 bucks :(

Mon, 23 Feb 2009 - 7:51pm — Anonymous (not verified)

:l there's so many random

:l there's so many random programs we have to download JUST to edit this and i don't even know how to use each one :l this is really confusing and if it's ok could you post a noob-friendly version and step by step of the EASIEST way to do it?

Mon, 23 Feb 2009 - 7:10pm — Anonymous (not verified)

Doesn't seem to work

This method doesn't seem to work, at least for me. I'm fairly sure I've made the right modifications yet I can't get the game to boot, this is the error it gives.

18:26:31.01 MOD -- Failed to verify content catalog integrity.
Content management system isn't properly initialized.
-- FATAL EXIT --
d:\dow2-patch\src\game\game\src\app\appinit.cpp-1796 !:

It seems to work on my friends but I'm not sure if it's actually working or it's because he's already unlocked some (if not all) through actual content codes.

Mon, 23 Feb 2009 - 6:07pm — Belsameth (not verified)

you are extremely gifted with the machine spirit

Mon, 23 Feb 2009 - 3:05am — Anonymous (not verified)

Corsix.org