Tracking in AC Explorer

Tracking in AC Explorer Pro is accomplished via a remote server.  AC Explorer Pro (ACX) contacts a server running on a particular IP address and port.  When that server receives the request from ACX, it then starts sending ACX the player's location data at regular intervals.

The provided ACX Server program can be used to extract the player location data from the running AC client and send it to ACX via the above protocol.  However, any program that adheres to the required protocol can be used in place of ACX Server to supply tracking location data to ACX.

ACX Server Details

ACX Server is set up to automatically locate the player location data in the AC client memory.  Monthly updates to the AC Client can change this location.  There are two modes of operation: Direct and InDirect

Direct operation

In Direct operation, the Location memory address points directly to a Loc memory structure in the AC Client.  In older versions of the AC Client, the Loc structure looked like this:

LocRec = record
  Block: DWord;
  X: Single;
  Y: Single;
  Z: Single;
end;

Starting with the April 2004 patch, Turbine changed the internal structure of this record, adding a bunch of new data whose purpose has not been determined.  The new memory structure, used by ACX v1.30 and later, looks like this:

LocRec = record
  Block: DWord;
  Unused1, Unused2, Unused3, Unused4, Unused5, Unused6,
    Unused7, Unused8, Unused9, Unused10, Unused11, Unused12,
    Unused13: Single;
  X: Single;
  Y: Single;
  Z: Single;
end;

The 13 "unused" values look like sin and cos values since they are always between -1 and 1.

InDirect operation

In Indirect operation, the memory location of the Loc structure is determine by an address and two offsets.  This is a complex indirect pointer structure that was used in versions of AC prior to the April 2004 patch and should no longer be used.

Heading

The Heading is stored in the AC Client as an integer of the Angle*10.  So, a Heading of 210.1 is stored as the integer 2101.  The Heading location in ACX Server points directly to this memory location.

The Client/Server protocol

When the AC Explorer client contacts the ACX Server, it sends data in the following format:

Cmd-Byte Data

There are only 2 commands recognized by the server:

Cmd-Byte = 0
This command turns on the server.  The data consists of two bytes: the first byte is the version of the ACX Client and is ignored by the server.  The second byte is the Interval to send data back to the client in increments of 200ms.  So, a value of 0 or 1 will cause the server to send data back to the client every 200 ms.  A value of 5 would send the location data every second.
Cmd-Byte = 1
This command turns off the server and prevents further data from being sent to the client.  There is no data for this command.

The data sent from the ACX Server back to the client is a modified location record with the following structure:

LocDataRec = record
  Block: DWord;
  X: Single;
  Y: Single;
  Z: Single;
  H: Single;
end;

where H is the floating point value of the heading angle in degrees, and Block,X,Y,Z are the same values captured from the AC client memory.

So, the flow of control is this:

  1. The AC Explorer Client sends a Cmd-Byte=0 command to the ACX Server running on a particular IP address and port (default is port 4060)
  2. The ACX Server sends LocDataRec data back to the client every N*200ms where N is the specified interval given in the previous command.
  3. When the Client no longer wants tracking data or when the client exits, it sends the Cmd-Byte=1 command to the server to disable it.

Any program that used the Cmd=0 to enable itself and the Cmd=1 to disable itself and sends the required LocDataRec data structure back to the client will work to provide tracking data to AC Explorer.  This is a very simply protocol and should be easy to implement.

Manual calibration of the ACX Server

If for some reason the calibration of the ACX Server no longer works, an external program can modify the ACXSERV.INI file to override the calibration addresses.  In this INI file is a section called [Memory] that contains the following strings:

Loc=xxxx
The Location memory address of the LocRec structure in DECIMAL
Head=xxxx
The Heading memory address in DECIMAL
ACVers=a.b.c.d
The AC Client version number that the current calibration applies to.  Update this to the current AC Client version to trick ACX Server to think it has already been calibrated
Direct=0|1
Set the Direct parameter to 0 for Indirect more, or to 1 for Direct mode.
Offset=xxxx
The first offset used in Indirect mode
Offset2=xxxx
The second offset used in Indirect mode

Other values may be calculated from the above values and stored in this file, but the above parameters are the main values used to calibrate the ACX Server program.

Conclusion

Because Turbine can change the AC Client at any time, the algorithms used for tracking and calibration can be rendered invalid at any time.  There is no support from Zugg Software for changes to the AC Client.  This information has been provided to allow 3rd parties to control the tracking in AC Explorer in case Zugg Software can no longer update this free server program.

Also, keep in mind that using a program such as ACX Server which captures data directly from the memory image of the running AC client may be considered a breach of the End-User-License-Agreement from Turbine.  Use this program at your own risk.