[CO2]Fuctions List

*M* · 09/14/2008, 08:04

Here im trying to compile a list for many functions in CO. I will add more as I find them.
It has been tried before but it lost interest, now that we have a dev focused section it might just work, feel free to contribute and please do, but only if you know what your talking about, try and keep it informative or the thread will fail as all the useful stuff gets lost.

Jump Function:
0046B627 - I think this is "Is Ctrl held down?"
0046B62B - If so Jump, If not walk
0046B62D - X
0046B632 - Y
0046B635 - Call Jump function

Code:

0046B627    > F645 08 08               TEST BYTE PTR SS:[EBP+8],8
0046B62B    .  74 0F                    JE SHORT Conquer.0046B63C
0046B62D    .  FF75 E8                  PUSH DWORD PTR SS:[EBP-18]                                ; /Arg2 = 0017FE3C
0046B630    .  8BCE                     MOV ECX,ESI                                               ; |
0046B632    .  FF75 EC                  PUSH DWORD PTR SS:[EBP-14]                                ; |Arg1 = 00000000
0046B635    .  E8 BCAB0300              CALL Conquer.004A61F6                                     ; Conquer.004A61F6

Attack Function:
0046AFB4 - Target
0046AFB7 - Call Attack Function

Code:

0046AFB4     53                         PUSH EBX
0046AFB5     8BCE                       MOV ECX,ESI
0046AFB7     E8 98C00300                CALL Conquer.004A7054

Equip Function
00474C34 - Call Equip Function

Code:

00474AD4   /$  53                      PUSH EBX
00474AD5   |.  55                      PUSH EBP
00474AD6   |.  56                      PUSH ESI
00474AD7   |.  57                      PUSH EDI
00474AD8   |.  FF7424 14               PUSH DWORD PTR SS:[ESP+14]                                ; /Arg1 = 00516BD4
00474ADC   |.  8BF9                    MOV EDI,ECX                                               ; |
00474ADE   |.  BB B0D05600             MOV EBX,Conquer.0056D0B0                                  ; |ASCII " IS"
00474AE3   |.  8BCB                    MOV ECX,EBX                                               ; |
00474AE5   |.  E8 5CBA0300             CALL Conquer.004B0546                                     ; Conquer.004B0546
00474AEA   |.  8BF0                    MOV ESI,EAX
00474AEC   |.  33ED                    XOR EBP,EBP
00474AEE   |.  3BF5                    CMP ESI,EBP
00474AF0   |.  0F84 F5010000           JE Conquer.00474CEB
00474AF6   |.  39AF 445B0500           CMP DWORD PTR DS:[EDI+55B44],EBP
00474AFC   |.  74 16                   JE SHORT Conquer.00474B14
00474AFE   |.  8B87 485B0500           MOV EAX,DWORD PTR DS:[EDI+55B48]
00474B04   |.  3B46 04                 CMP EAX,DWORD PTR DS:[ESI+4]
00474B07   |.  75 0B                   JNZ SHORT Conquer.00474B14
00474B09   |.  8D8F D85A0500           LEA ECX,DWORD PTR DS:[EDI+55AD8]
00474B0F   |.  E8 232EFAFF             CALL Conquer.00417937
00474B14   |>  8B46 0C                 MOV EAX,DWORD PTR DS:[ESI+C]
00474B17   |.  3D E3C81000             CMP EAX,10C8E3
00474B1C   |.  0F84 1C010000           JE Conquer.00474C3E
00474B22   |.  3D E6C81000             CMP EAX,10C8E6
00474B27   |.  0F84 11010000           JE Conquer.00474C3E
00474B2D   |.  3D E9C81000             CMP EAX,10C8E9
00474B32   |.  0F84 06010000           JE Conquer.00474C3E
00474B38   |.  8BCE                    MOV ECX,ESI
00474B3A   |.  E8 82DC0300             CALL Conquer.004B27C1
00474B3F   |.  83F8 01                 CMP EAX,1
00474B42   |.  74 54                   JE SHORT Conquer.00474B98
00474B44   |.  8BCE                    MOV ECX,ESI
00474B46   |.  E8 76DC0300             CALL Conquer.004B27C1
00474B4B   |.  83F8 02                 CMP EAX,2
00474B4E   |.  74 48                   JE SHORT Conquer.00474B98
00474B50   |.  8BCE                    MOV ECX,ESI
00474B52   |.  E8 6ADC0300             CALL Conquer.004B27C1
00474B57   |.  83F8 03                 CMP EAX,3
00474B5A   |.  74 3C                   JE SHORT Conquer.00474B98
00474B5C   |.  8BCE                    MOV ECX,ESI
00474B5E   |.  E8 5EDC0300             CALL Conquer.004B27C1
00474B63   |.  83F8 04                 CMP EAX,4
00474B66   |.  74 30                   JE SHORT Conquer.00474B98
00474B68   |.  8BCE                    MOV ECX,ESI
00474B6A   |.  E8 52DC0300             CALL Conquer.004B27C1
00474B6F   |.  83F8 05                 CMP EAX,5
00474B72   |.  74 24                   JE SHORT Conquer.00474B98
00474B74   |.  8BCE                    MOV ECX,ESI
00474B76   |.  E8 46DC0300             CALL Conquer.004B27C1
00474B7B   |.  83F8 06                 CMP EAX,6
00474B7E   |.  74 18                   JE SHORT Conquer.00474B98
00474B80   |.  8BCE                    MOV ECX,ESI
00474B82   |.  E8 3ADC0300             CALL Conquer.004B27C1
00474B87   |.  83F8 07                 CMP EAX,7
00474B8A   |.  74 0C                   JE SHORT Conquer.00474B98
00474B8C   |.  8BCE                    MOV ECX,ESI
00474B8E   |.  E8 2EDC0300             CALL Conquer.004B27C1
00474B93   |.  83F8 08                 CMP EAX,8
00474B96   |.  75 11                   JNZ SHORT Conquer.00474BA9
00474B98   |>  6A 64                   PUSH 64                                                   ; /Arg6 = 00000064
00474B9A   |.  55                      PUSH EBP                                                  ; |Arg5 = 0017F314 ASCII "ÔkQ"
00474B9B   |.  55                      PUSH EBP                                                  ; |Arg4 = 0017F314 ASCII "ÔkQ"
00474B9C   |.  55                      PUSH EBP                                                  ; |Arg3 = 0017F314 ASCII "ÔkQ"
00474B9D   |.  55                      PUSH EBP                                                  ; |Arg2 = 0017F314 ASCII "ÔkQ"
00474B9E   |.  68 D4D05500             PUSH Conquer.0055D0D4                                     ; |Arg1 = 0055D0D4 ASCII "Sound/Equip.wav"
00474BA3   |.  FF15 24565200           CALL DWORD PTR DS:[<&NDSound.DSound._DXP>]                ; DXPlaySound
00474BA9   |>  817E 0C F40A0B00        CMP DWORD PTR DS:[ESI+C],0B0AF4
00474BB0   |.  75 7D                   JNZ SHORT Conquer.00474C2F
00474BB2   |.  F605 BCD05600 20        TEST BYTE PTR DS:[56D0BC],20
00474BB9   |.  74 1B                   JE SHORT Conquer.00474BD6
00474BBB   |.  FF15 54505200           CALL DWORD PTR DS:[<&GraphicData.GameDataSetQuery>]       ;  GraphicD.GameDataSetQuery
00474BC1   |.  8B10                    MOV EDX,DWORD PTR DS:[EAX]
00474BC3   |.  55                      PUSH EBP
00474BC4   |.  55                      PUSH EBP
00474BC5   |.  68 0000FF00             PUSH 0FF0000
00474BCA   |.  68 D5070000             PUSH 7D5
00474BCF   |.  68 FC280000             PUSH 28FC
00474BD4   |.  EB 25                   JMP SHORT Conquer.00474BFB
00474BD6   |>  8BCB                    MOV ECX,EBX
00474BD8   |.  E8 89490300             CALL Conquer.004A9566
00474BDD   |.  83F8 09                 CMP EAX,9
00474BE0   |.  7C 2E                   JL SHORT Conquer.00474C10
00474BE2   |.  FF15 54505200           CALL DWORD PTR DS:[<&GraphicData.GameDataSetQuery>]       ;  GraphicD.GameDataSetQuery
00474BE8   |.  8B10                    MOV EDX,DWORD PTR DS:[EAX]
00474BEA   |.  55                      PUSH EBP
00474BEB   |.  55                      PUSH EBP
00474BEC   |.  68 0000FF00             PUSH 0FF0000
00474BF1   |.  68 D5070000             PUSH 7D5
00474BF6   |.  68 FB280000             PUSH 28FB
00474BFB   |>  8BC8                    MOV ECX,EAX
00474BFD   |.  FF52 3C                 CALL DWORD PTR DS:[EDX+3C]
00474C00   |.  50                      PUSH EAX
00474C01   |.  B9 60AF5600             MOV ECX,Conquer.0056AF60
00474C06   |.  E8 B8850000             CALL Conquer.0047D1C3
00474C0B   |.  E9 DB000000             JMP Conquer.00474CEB
00474C10   |>  FF76 04                 PUSH DWORD PTR DS:[ESI+4]
00474C13   |.  83F8 04                 CMP EAX,4
00474C16   |.  55                      PUSH EBP
00474C17   |.  7C 04                   JL SHORT Conquer.00474C1D
00474C19   |.  6A 19                   PUSH 19
00474C1B   |.  EB 02                   JMP SHORT Conquer.00474C1F
00474C1D   |>  6A 1A                   PUSH 1A
00474C1F   |>  8D8F 68EC0600           LEA ECX,DWORD PTR DS:[EDI+6EC68]                          ; |
00474C25   |.  E8 CF7FFAFF             CALL Conquer.0041CBF9                                     ; Conquer.0041CBF9
00474C2A   |.  E9 BC000000             JMP Conquer.00474CEB
00474C2F   |>  FF76 04                 PUSH DWORD PTR DS:[ESI+4]
00474C32   |.  8BCB                    MOV ECX,EBX
00474C34   |.  E8 41C10300             CALL Conquer.004B0D7A
00474C39   |.  E9 AD000000             JMP Conquer.00474CEB
00474C3E   |>  B9 B80D5700             MOV ECX,Conquer.00570DB8                                  ;  ASCII "HPS"
00474C43   |.  E8 40EA0400             CALL Conquer.004C3688
00474C48   |.  85C0                    TEST EAX,EAX
00474C4A   |.  74 1B                   JE SHORT Conquer.00474C67
00474C4C   |.  FF15 54505200           CALL DWORD PTR DS:[<&GraphicData.GameDataSetQuery>]       ;  GraphicD.GameDataSetQuery
00474C52   |.  8B10                    MOV EDX,DWORD PTR DS:[EAX]
00474C54   |.  55                      PUSH EBP
00474C55   |.  55                      PUSH EBP
00474C56   |.  68 0000FF00             PUSH 0FF0000
00474C5B   |.  68 D5070000             PUSH 7D5
00474C60   |.  68 CD280000             PUSH 28CD
00474C65   |.^ EB 94                   JMP SHORT Conquer.00474BFB
00474C67   |>  39AF D0DA0100           CMP DWORD PTR DS:[EDI+1DAD0],EBP
00474C6D   |.  74 1E                   JE SHORT Conquer.00474C8D
00474C6F   |.  FF15 54505200           CALL DWORD PTR DS:[<&GraphicData.GameDataSetQuery>]       ;  GraphicD.GameDataSetQuery
00474C75   |.  8B10                    MOV EDX,DWORD PTR DS:[EAX]
00474C77   |.  55                      PUSH EBP
00474C78   |.  55                      PUSH EBP
00474C79   |.  68 0000FF00             PUSH 0FF0000
00474C7E   |.  68 D5070000             PUSH 7D5
00474C83   |.  68 CE280000             PUSH 28CE
00474C88   |.^ E9 6EFFFFFF             JMP Conquer.00474BFB
00474C8D   |>  39AF 74500200           CMP DWORD PTR DS:[EDI+<&MSVCRT.__CxxFrameHandler>],EBP
00474C93   |.  74 0C                   JE SHORT Conquer.00474CA1
00474C95   |.  55                      PUSH EBP
00474C96   |.  8D8F 14500200           LEA ECX,DWORD PTR DS:[EDI+<&KERNEL32.DisableThreadLibrary>
00474C9C   |.  E8 F1AE0700             CALL <JMP.&MFC42.#6215>
00474CA1   |>  39AF C8BA0200           CMP DWORD PTR DS:[EDI+2BAC8],EBP
00474CA7   |.  74 0C                   JE SHORT Conquer.00474CB5
00474CA9   |.  55                      PUSH EBP
00474CAA   |.  8D8F 68BA0200           LEA ECX,DWORD PTR DS:[EDI+2BA68]
00474CB0   |.  E8 DDAE0700             CALL <JMP.&MFC42.#6215>
00474CB5   |>  8B46 0C                 MOV EAX,DWORD PTR DS:[ESI+C]
00474CB8   |.  6A 0A                   PUSH 0A
00474CBA   |.  33D2                    XOR EDX,EDX
00474CBC   |.  59                      POP ECX                                                   ;  Conquer.004098B8
00474CBD   |.  F7F1                    DIV ECX
00474CBF   |.  6A 03                   PUSH 3
00474CC1   |.  81C7 48600200           ADD EDI,26048
00474CC7   |.  59                      POP ECX                                                   ;  Conquer.004098B8
00474CC8   |.  8BC2                    MOV EAX,EDX
00474CCA   |.  33D2                    XOR EDX,EDX
00474CCC   |.  F7F1                    DIV ECX
00474CCE   |.  8BCF                    MOV ECX,EDI
00474CD0   |.  50                      PUSH EAX
00474CD1   |.  E8 66EAF9FF             CALL Conquer.0041373C
00474CD6   |.  6A 05                   PUSH 5
00474CD8   |.  8BCF                    MOV ECX,EDI
00474CDA   |.  E8 B3AE0700             CALL <JMP.&MFC42.#6215>
00474CDF   |.  6A 1E                   PUSH 1E                                                   ; /Arg2 = 0000001E
00474CE1   |.  8BCB                    MOV ECX,EBX                                               ; |
00474CE3   |.  FF76 04                 PUSH DWORD PTR DS:[ESI+4]                                 ; |Arg1
00474CE6   |.  E8 7BF50300             CALL Conquer.004B4266                                     ; Conquer.004B4266
00474CEB   |>  5F                      POP EDI                                                   ;  Conquer.004098B8
00474CEC   |.  5E                      POP ESI                                                   ;  Conquer.004098B8
00474CED   |.  5D                      POP EBP                                                   ;  Conquer.004098B8
00474CEE   |.  5B                      POP EBX                                                   ;  Conquer.004098B8
00474CEF   .  C2 0400                 RETN 4

Un-equip
Unlike equip(1 function for all) above in this segment there is an un-equip function for each slot

Code:

0044D3EE    .  33C0                    XOR EAX,EAX
0044D3F0    .  3941 78                 CMP DWORD PTR DS:[ECX+78],EAX
0044D3F3    .  75 1D                   JNZ SHORT Conquer.0044D412
0044D3F5    .  6A 64                   PUSH 64                                                   ; /Arg6 = 00000064
0044D3F7    .  50                      PUSH EAX                                                  ; |Arg5 = 00000000
0044D3F8    .  50                      PUSH EAX                                                  ; |Arg4 = 00000000
0044D3F9    .  50                      PUSH EAX                                                  ; |Arg3 = 00000000
0044D3FA    .  50                      PUSH EAX                                                  ; |Arg2 = 00000000
0044D3FB    .  68 78D15500             PUSH Conquer.0055D178                                     ; |Arg1 = 0055D178 ASCII "Sound/Unequip.wav"
0044D400    .  FF15 24565200           CALL DWORD PTR DS:[<&NDSound.DSound._DXP>]                ; DXPlaySound
0044D406    .  6A 01                   PUSH 1
0044D408    .  B9 B0D05600             MOV ECX,Conquer.0056D0B0                                  ;  ASCII " IS"
0044D40D    .  E8 09420600             CALL Conquer.004B161B
0044D412    >  C3                      RETN
0044D413    .  33C0                    XOR EAX,EAX
0044D415    .  3941 78                 CMP DWORD PTR DS:[ECX+78],EAX
0044D418    .  75 1D                   JNZ SHORT Conquer.0044D437
0044D41A    .  6A 64                   PUSH 64                                                   ; /Arg6 = 00000064
0044D41C    .  50                      PUSH EAX                                                  ; |Arg5 = 00000000
0044D41D    .  50                      PUSH EAX                                                  ; |Arg4 = 00000000
0044D41E    .  50                      PUSH EAX                                                  ; |Arg3 = 00000000
0044D41F    .  50                      PUSH EAX                                                  ; |Arg2 = 00000000
0044D420    .  68 78D15500             PUSH Conquer.0055D178                                     ; |Arg1 = 0055D178 ASCII "Sound/Unequip.wav"
0044D425    .  FF15 24565200           CALL DWORD PTR DS:[<&NDSound.DSound._DXP>]                ; DXPlaySound
0044D42B    .  6A 05                   PUSH 5
0044D42D    .  B9 B0D05600             MOV ECX,Conquer.0056D0B0                                  ;  ASCII " IS"
0044D432    .  E8 E4410600             CALL Conquer.004B161B
0044D437    >  C3                      RETN
0044D438    .  33C0                    XOR EAX,EAX
0044D43A    .  3941 78                 CMP DWORD PTR DS:[ECX+78],EAX
0044D43D    .  75 1D                   JNZ SHORT Conquer.0044D45C
0044D43F    .  6A 64                   PUSH 64                                                   ; /Arg6 = 00000064
0044D441    .  50                      PUSH EAX                                                  ; |Arg5 = 00000000
0044D442    .  50                      PUSH EAX                                                  ; |Arg4 = 00000000
0044D443    .  50                      PUSH EAX                                                  ; |Arg3 = 00000000
0044D444    .  50                      PUSH EAX                                                  ; |Arg2 = 00000000
0044D445    .  68 78D15500             PUSH Conquer.0055D178                                     ; |Arg1 = 0055D178 ASCII "Sound/Unequip.wav"
0044D44A    .  FF15 24565200           CALL DWORD PTR DS:[<&NDSound.DSound._DXP>]                ; DXPlaySound
0044D450    .  6A 02                   PUSH 2
0044D452    .  B9 B0D05600             MOV ECX,Conquer.0056D0B0                                  ;  ASCII " IS"
0044D457    .  E8 BF410600             CALL Conquer.004B161B
0044D45C    >  C3                      RETN
0044D45D    .  33C0                    XOR EAX,EAX
0044D45F    .  3941 78                 CMP DWORD PTR DS:[ECX+78],EAX
0044D462    .  75 1D                   JNZ SHORT Conquer.0044D481
0044D464    .  6A 64                   PUSH 64                                                   ; /Arg6 = 00000064
0044D466    .  50                      PUSH EAX                                                  ; |Arg5 = 00000000
0044D467    .  50                      PUSH EAX                                                  ; |Arg4 = 00000000
0044D468    .  50                      PUSH EAX                                                  ; |Arg3 = 00000000
0044D469    .  50                      PUSH EAX                                                  ; |Arg2 = 00000000
0044D46A    .  68 78D15500             PUSH Conquer.0055D178                                     ; |Arg1 = 0055D178 ASCII "Sound/Unequip.wav"
0044D46F    .  FF15 24565200           CALL DWORD PTR DS:[<&NDSound.DSound._DXP>]                ; DXPlaySound
0044D475    .  6A 03                   PUSH 3
0044D477    .  B9 B0D05600             MOV ECX,Conquer.0056D0B0                                  ;  ASCII " IS"
0044D47C    .  E8 9A410600             CALL Conquer.004B161B
0044D481    >  C3                      RETN
0044D482    .  33C0                    XOR EAX,EAX
0044D484    .  3941 78                 CMP DWORD PTR DS:[ECX+78],EAX
0044D487    .  75 1D                   JNZ SHORT Conquer.0044D4A6
0044D489    .  6A 64                   PUSH 64                                                   ; /Arg6 = 00000064
0044D48B    .  50                      PUSH EAX                                                  ; |Arg5 = 00000000
0044D48C    .  50                      PUSH EAX                                                  ; |Arg4 = 00000000
0044D48D    .  50                      PUSH EAX                                                  ; |Arg3 = 00000000
0044D48E    .  50                      PUSH EAX                                                  ; |Arg2 = 00000000
0044D48F    .  68 78D15500             PUSH Conquer.0055D178                                     ; |Arg1 = 0055D178 ASCII "Sound/Unequip.wav"
0044D494    .  FF15 24565200           CALL DWORD PTR DS:[<&NDSound.DSound._DXP>]                ; DXPlaySound
0044D49A    .  6A 08                   PUSH 8
0044D49C    .  B9 B0D05600             MOV ECX,Conquer.0056D0B0                                  ;  ASCII " IS"
0044D4A1    .  E8 75410600             CALL Conquer.004B161B
0044D4A6    >  C3                      RETN
0044D4A7    .  33C0                    XOR EAX,EAX
0044D4A9    .  3941 78                 CMP DWORD PTR DS:[ECX+78],EAX
0044D4AC    .  75 1D                   JNZ SHORT Conquer.0044D4CB
0044D4AE    .  6A 64                   PUSH 64                                                   ; /Arg6 = 00000064
0044D4B0    .  50                      PUSH EAX                                                  ; |Arg5 = 00000000
0044D4B1    .  50                      PUSH EAX                                                  ; |Arg4 = 00000000
0044D4B2    .  50                      PUSH EAX                                                  ; |Arg3 = 00000000
0044D4B3    .  50                      PUSH EAX                                                  ; |Arg2 = 00000000
0044D4B4    .  68 78D15500             PUSH Conquer.0055D178                                     ; |Arg1 = 0055D178 ASCII "Sound/Unequip.wav"
0044D4B9    .  FF15 24565200           CALL DWORD PTR DS:[<&NDSound.DSound._DXP>]                ; DXPlaySound
0044D4BF    .  6A 06                   PUSH 6
0044D4C1    .  B9 B0D05600             MOV ECX,Conquer.0056D0B0                                  ;  ASCII " IS"
0044D4C6    .  E8 50410600             CALL Conquer.004B161B
0044D4CB    >  C3                      RETN
0044D4CC    .  33C0                    XOR EAX,EAX
0044D4CE    .  3941 78                 CMP DWORD PTR DS:[ECX+78],EAX
0044D4D1    .  75 1D                   JNZ SHORT Conquer.0044D4F0
0044D4D3    .  6A 64                   PUSH 64                                                   ; /Arg6 = 00000064
0044D4D5    .  50                      PUSH EAX                                                  ; |Arg5 = 00000000
0044D4D6    .  50                      PUSH EAX                                                  ; |Arg4 = 00000000
0044D4D7    .  50                      PUSH EAX                                                  ; |Arg3 = 00000000
0044D4D8    .  50                      PUSH EAX                                                  ; |Arg2 = 00000000
0044D4D9    .  68 78D15500             PUSH Conquer.0055D178                                     ; |Arg1 = 0055D178 ASCII "Sound/Unequip.wav"
0044D4DE    .  FF15 24565200           CALL DWORD PTR DS:[<&NDSound.DSound._DXP>]                ; DXPlaySound
0044D4E4    .  6A 04                   PUSH 4
0044D4E6    .  B9 B0D05600             MOV ECX,Conquer.0056D0B0                                  ;  ASCII " IS"
0044D4EB    .  E8 2B410600             CALL Conquer.004B161B
0044D4F0    >  C3                      RETN

*M* · 09/14/2008, 08:04

* Reserved for space

MC_Alex · 09/14/2008, 11:44

hi i dunno if this is wrong section but i just wanted to ask if you could make a cracked conquer.exe again.Which contains the unlocked fps function.
thanks for your time and +k

purplehaze · 09/14/2008, 16:37

this looks promising really i wonder what nice things will come out of this, is that jump for sure yet? because that means u can simulate a jump within the memory right? and do you know how this could be used in VB?
Like for example read the XY and jump to other coordinates should be possible with this right? then determine the target and attack.

~~IAmHawtness~~ · 09/14/2008, 20:10

This is ******* awesome, keep 'em coming

Real~Death · 09/14/2008, 20:39

this is just what I was asking about the outher day^^
Everything you do is original
you got some real talent

*M* · 09/15/2008, 09:03

Quote:

Originally Posted by purplehaze

this looks promising really i wonder what nice things will come out of this, is that jump for sure yet? because that means u can simulate a jump within the memory right? and do you know how this could be used in VB?
Like for example read the XY and jump to other coordinates should be possible with this right? then determine the target and attack.

With some creative programming you can do anything, if you can find a way to push x,y onto the stack before its called your set.

For example with vb if I cant achieve something in asm, I will find some free bytes in the exe, write the code manually and use vb to control parts of that code. Evan is good at this if you see what he can do with AHK/ELSE.

My hope is that if enough people get interested we can start a basic attack bot but what I need right now is the spawn monster function, If I can hook that it will tell me what monster spawned where & when, and then move its name to the attack functions target.

Maybe if I find this we could build a bot into the client itself with enough help, I will ask my asm buddies for help with the spawn function.

ChingChong23 · 09/15/2008, 15:02

Sounds great, just wondering.. how was Script vessel made? was it done like this?

emmanication · 09/15/2008, 17:00

i sense good use for this *rubs hands*

*M* · 09/15/2008, 22:01

Quote:

Originally Posted by ChingChong23

Sounds great, just wondering.. how was Script vessel made? was it done like this?

Yeah sv runs along similar lines

tanelipe · 09/16/2008, 16:30

@ *M* : For the jump function thing, you're right about the Ctrl down thingy, you bypass the jump and you can jump in game without holding ctrl :P

Edit* If someone is intrested this is jump function for older clients (Qonquer client)

Code:

0045E3FE   83E2 08        AND EDX,8
0045E401   85D2           TEST EDX,EDX
0045E403   74 14          JE SHORT Conquer.0045E419
0045E405   8B45 BC        MOV EAX,DWORD PTR SS:[EBP-44]
0045E408   50             PUSH EAX                             
0045E409   8B4D C0        MOV ECX,DWORD PTR SS:[EBP-40]        
0045E40C   51             PUSH ECX                             
0045E40D   B9 08525500    MOV ECX,Conquer.00555208                 
0045E412 . E8 E2700100    CALL Conquer.004754F9

ChingChong23 · 09/16/2008, 19:50

Isnt there a way you can like print out everything that's getting processed in the code while running? so when a monster spawns, it pretty much prints the code thats getting run.

Sorry i hate sounding like a noob when it comes to assembler as i've never used anything other than OOP languages.

Also how did you know that those other functions are really for equipping and stuff, i'm interested in this stuff cause i've always had a softspot for gamehacking making packet bots etc, but this advanced stuff is interesting.

*M* · 09/16/2008, 22:45

Quote:

Originally Posted by ChingChong23

Isnt there a way you can like print out everything that's getting processed in the code while running? so when a monster spawns, it pretty much prints the code thats getting run.

Sorry i hate sounding like a noob when it comes to assembler as i've never used anything other than OOP languages.

That would have millions of things printing out

Quote:

Originally Posted by ChingChong23

Also how did you know that those other functions are really for equipping and stuff, i'm interested in this stuff cause i've always had a softspot for gamehacking making packet bots etc, but this advanced stuff is interesting.

Setting breakpoints on them then equipping something, the code hits the breakpoint and pauses execution.

Ian* · 09/16/2008, 23:39

Quote:

Originally Posted by *M*

That would have millions of things printing out

Setting breakpoints on them then equipping something, the code hits the breakpoint and pauses execution.

and it has the unequip sound made on the side

Spawnlord6 · 09/19/2008, 21:01

Hey, i am thinking about a cheat to show you the name of the meteor dove that drops 5 mets.... it has higher defens so the file monster.dat should be modified and to that monster given another name. Pls pls pls answer it would be a realy profitable hack.

Thanks all!!!