PWI Eclipse changes

[derleyvolt]

Diagnost, you here, ù.ù, I admire your posts forum zhyk, if you have time left, could enlighten me some questions? my skype is soliderdream96

[DurianMontong]

Originally Posted by jasty

Here is my python script for finding all the function addresses at the top. I havent tried making one for doing all the offsets I use.

 Spoiler

import re
import binascii
addresses = [
		("ADDRESS_BASE", 'A1(.{8})5332DB8B48.{2}'),
		("ADDRESS_SENDPACKET", '6AFF68.{8}64A100000000506489250000000083EC185356578BF96A07'),
		("ADDRESS_AUTOPATH", '6AFF68.{8}64A100000000506489250000000083EC2053568BF18D4C2408E8.{8}8B4C243C8B542440'),
		("ADDRESS_ACTION1", '64A1.{8}6AFF68.{8}508B442410648925.{8}5683F8138BF1'),
		("ADDRESS_ACTION2", '83EC2453558B6C243056578B7C243C8BF133DB896E2C8B07894620'),
		("ADDRESS_ACTION3", '5355568B74241485F6578BD975095F5E5D32C05BC20C00'),
		("ADDRESS_GATHER", '5355578BF98B87.{8}C1E807A8010F85.{8}E8.{8}84C00F85.{8}8B6C2410'),
		("ADDRESS_CASTSKILL", '535556578BF16A04E8.{8}8B8E.{8}83C40485C974076A02'),
		("ADDRESS_REGATTACK", '53558B6C240C56578BF985ED0F84.{8}3BAF.{8}0F84.{8}A1.{8}'),
		("PARTYINV_ADDRESS", '9068.{8}68.{8}6A066A1068(.{8})E8.{8}C390', 0x20),
		("ADDRESS_INSTANCE_BASE", '5F5E5B8BE55DC21000E8....FFFF8B0D(.{8})898D....FFFFE8....FFFF84C07525'),
		("MACRO_ADDRESS_BASE ", '81C4.{8}C21000A0(.{8})8BB424.{8}8B3D.{8}84C074056A0656FFD76A0056FFD781C5', 0x1E),
		("OFFSET_ACTIONBASE ", '8B40..8B0D.{8}3BC1740B837E..027C05C64424..018B8F(.{8})6A006A016A02C64424..00E8.{8}85C0'),
		("GameRun", "5f5e5b8be55dc21000e8....ffff8b0d(.{8})898d....ffffe8....ffff84c075")
		]
		
		
		
def retrieveAddresses(file, addresses):
	for address in addresses:
		pattern = address[1]
		match = re.search(pattern.lower(), ascii)
		if match:
			value = hex(match.start()/2 + 0x400000)
			if len(match.groups()) > 0:
				#print match.groups(0)[0]
				value = revHex(match.groups(0)[0])
				offset = address[2] if len(address) > 2 else 0
				value = hex(int(value, 16)+offset)
			
			print "Global $"+address[0],"=", value
		else:
			print "; Not found: $"+address[0] 



def revHex(string):
	return ''.join([str(string[x:x+2]) for x in range(len(string)-2, -2, -2)])

f = open("C:\Games\PWI_en\element\elementclient.exe", 'rb')
data = f.read()
ascii = binascii.hexlify(data)


retrieveAddresses(ascii, addresses)

Hi jasty, i try the script but

("PARTYINV_ADDRESS", '9068.{8}68.{8}6A066A1068(.{8})E8.{8}C390', 0x20)

is not found can u check it, this is my elementclient

[DurianMontong]

can someone help me guide to find PARTYINV_ADDRESS many guide find hp offset n max hp offset but how to find PARTYINV_ADDRESS

[jasty]

Originally Posted by DurianMontong

can someone help me guide to find PARTYINV_ADDRESS many guide find hp offset n max hp offset but how to find PARTYINV_ADDRESS

In cheat engine do a breakpoint in the sendpacket address when you accept a party inv, (or use a packet listener tool).

That packet is 10 bytes long and looks like
'1C00XXXXXXXXYYYYYYYY'
XXXXXXXX = player ID of the person inviting you (in rev hex)
YYYYYYYY = party inv counter (in rev hex)

In cheat engine do a search for the YYYYYYYY term. (if you do it as a hex search you have to unreverse it).

Do more invites a few more times to get new values to narrow down your search.

Once you find the right location add it to the list of addresses and do "find what accesses this address". Then do a party inv again.

You should see something access that field with an offset of 0x14. You examine that and see what the value in the associated register was that used this offset. Do a search for this value and you'll find a static address.

That static address is PARTYINV_ADDRESS. The party inv counter is at (PARTYINV_ADDRESS) + 0x14.

[Smurfin]

Here is the packet that's used to enter Heavenfall.
$packet = '230005F00087'
$packetSize = 6
sendPacket($packet, $packetSize, $pid)
$packet='25006100000004000000'
$packet&=$stage
$packet&='000000'
$packetSize = 14
sendPacket($packet, $packetSize, $pid)

but the packet I underline and bold above seems to be changing everytime the instance reset, is there any way to read the 'instance ID' or whatever it's called ?

-edit-

Nevermind, got it.

[Stark77]

@: Do you know how to find out, whats the highest room (stage) you can enter? Btw is this first packet you send really important to change a room?

[jasty]

I just enter the tower and the highest room manually. You can figure out the room number from reading the chat buffer where it says "You have entered room #37". The first packet is unique but after that you only need to send the room number. If you really need it it's probably somewhere near the other tower data at 0xf1dc2c.

[Smurfin]

@ Yea, the highest room is the last room we already cleared. Can't add anything more than what jasty already said.

Can only enter using the packet after we've known the instance ID which can only be gotten after we enter any stage once.