[Release] Structs and Misc Bot functions

strikeraid · 06/28/2011, 01:43

I think its done differently in the game I'm playing. I'll give it a shot though.

iktov2 · 06/28/2011, 21:30

Quote:

Originally Posted by strikeraid

I think its done differently in the game I'm playing. I'll give it a shot though.

Everythings done different in other games, I think my comments the other day about 12sky2 being a learning experience may be slight bit flawed. While it did allow some learning about using a games stucts in C++ and such, I think maybe 12Sky2 is just too easy sometimes. When I try to do things in RIFT for example, I am completely thrown off.

Mega Byte · 06/29/2011, 00:25

then practice in other games till you can do stuff in rift its a new mmorpg thats probably alot more secure find out if anyone else has managed to make hacks for it

.

strikeraid · 06/29/2011, 17:45

Yea. I feel the same about 12sky and other games. Just means I need to learn some more. :P

Mr_Troy22 · 06/30/2011, 21:01

Quote:

Originally Posted by steleg

hello,
I am a player 12sky2 FR, I played with DABNOJ (developers as MegaToolBox ...), you can not contact him for three weeks, it disappeared. Would you heard of him? the latest version of software does not work and a lot of players are not having fun more ...
Thank you very much for your help.
soon

You should try alternative cheat tools, for example : Map Fun, Afterburn's cheats(tho you have to pay for them), 12Sky2 Hack by Wazapoo etc.

iktov2 · 06/30/2011, 21:38

Quote:

Originally Posted by Mr_Troy22

You should try alternative cheat tools, for example : Map Fun, Afterburn's cheats(tho you have to pay for them), 12Sky2 Hack by Wazapoo etc.

He's needing some for French version apparently.

But ****, this really isn't the direction I had hoped for this thread to take. I really wanted to see improvments, additions of more structs, more complete info for the structs I posted, releases, more additions of code ect.. ect.... ect......

Not much of anything coming from this thread I suppose.

Has anybody that did find this stuff useful managed to make anything interesting out of it?

Mr_Troy22 · 06/30/2011, 21:51

Quote:

Originally Posted by iktov2

He's needing some for French version apparently.

But ****, this really isn't the direction I had hoped for this thread to take. I really wanted to see improvments, additions of more structs, more complete info for the structs I posted, releases, more additions of code ect.. ect.... ect......

Not much of anything coming from this thread I suppose.

Has anybody that did find this stuff useful managed to make anything interesting out of it?

I did for sure, it helped me with some stuff I couldn't find out what the **** it was. lol

and got me into developing a loot filter as well

iktov2 · 06/30/2011, 22:05

Quote:

Originally Posted by Mr_Troy22

I did for sure, it helped me with some stuff I couldn't find out what the damn it was. lol

and got me into developing a loot filter as well

Cool good to hear. Maybe we will some public releases later?

Below is what I found for my Auto-Loot function. I believe all I did was "call" the first line of this function in my bot, but I never actually looked any further at the function. Who knows, you may be able to filter your loot with this alone.

Code:

_____________
\\Loot\\\\\\\
_____________

004749F0   /$  55                      PUSH EBP
004749F1   |.  8BEC                    MOV EBP,ESP
004749F3   |.  83EC 2C                 SUB ESP,2C
004749F6   |.  894D D4                 MOV DWORD PTR SS:[EBP-2C],ECX
004749F9   |.  C745 F0 00000000        MOV DWORD PTR SS:[EBP-10],0
00474A00   |.  C745 F4 00000000        MOV DWORD PTR SS:[EBP-C],0
00474A07   |.  C745 EC 00000000        MOV DWORD PTR SS:[EBP-14],0
00474A0E   |.  EB 09                   JMP SHORT TwelveSk.00474A19
00474A10   |>  8B45 EC                 /MOV EAX,DWORD PTR SS:[EBP-14]
00474A13   |.  83C0 01                 |ADD EAX,1
00474A16   |.  8945 EC                 |MOV DWORD PTR SS:[EBP-14],EAX
00474A19   |>  8B4D EC                  MOV ECX,DWORD PTR SS:[EBP-14]
00474A1C   |.  3B0D EC6A1801           |CMP ECX,DWORD PTR DS:[1186AEC]
00474A22   |.  0F8D 49010000           |JGE TwelveSk.00474B71
00474A28   |.  8B55 EC                 |MOV EDX,DWORD PTR SS:[EBP-14]
00474A2B   |.  6BD2 7C                 |IMUL EDX,EDX,7C
00474A2E   |.  83BA 34C42501 00        |CMP DWORD PTR DS:[EDX+125C434],0
00474A35   |.  75 02                   |JNZ SHORT TwelveSk.00474A39
00474A37   |.^ EB D7                   |JMP SHORT TwelveSk.00474A10
00474A39   |>  68 B36B1801             |PUSH TwelveSk.01186BB3              ; /Arg2 = 01186BB3
00474A3E   |.  8B45 EC                 |MOV EAX,DWORD PTR SS:[EBP-14]       ; |
00474A41   |.  6BC0 7C                 |IMUL EAX,EAX,7C                     ; |
00474A44   |.  05 98C42501             |ADD EAX,TwelveSk.0125C498           ; |
00474A49   |.  50                      |PUSH EAX                            ; |Arg1
00474A4A   |.  B9 005B1801             |MOV ECX,TwelveSk.01185B00           ; |
00474A4F   |.  E8 0C3C0000             |CALL TwelveSk.00478660              ; \TwelveSk.00478660
00474A54   |.  D81D 28BB5500           |FCOMP DWORD PTR DS:[55BB28]
00474A5A   |.  DFE0                    |FSTSW AX
00474A5C   |.  F6C4 41                 |TEST AH,41
00474A5F   |.  75 02                   |JNZ SHORT TwelveSk.00474A63
00474A61   |.^ EB AD                   |JMP SHORT TwelveSk.00474A10
00474A63   |>  8B4D EC                 |MOV ECX,DWORD PTR SS:[EBP-14]
00474A66   |.  6BC9 7C                 |IMUL ECX,ECX,7C
00474A69   |.  81C1 34C42501           |ADD ECX,TwelveSk.0125C434
00474A6F   |.  E8 DC360200             |CALL TwelveSk.00498150
00474A74   |.  85C0                    |TEST EAX,EAX
00474A76   |.  75 02                   |JNZ SHORT TwelveSk.00474A7A
00474A78   |.^ EB 96                   |JMP SHORT TwelveSk.00474A10
00474A7A   |>  8B4D EC                 |MOV ECX,DWORD PTR SS:[EBP-14]
00474A7D   |.  6BC9 7C                 |IMUL ECX,ECX,7C
00474A80   |.  8B91 7CC42501           |MOV EDX,DWORD PTR DS:[ECX+125C47C]
00474A86   |.  83BA BC000000 01        |CMP DWORD PTR DS:[EDX+BC],1
00474A8D   |.  75 71                   |JNZ SHORT TwelveSk.00474B00
00474A8F   |.  8B45 EC                 |MOV EAX,DWORD PTR SS:[EBP-14]
00474A92   |.  6BC0 7C                 |IMUL EAX,EAX,7C
00474A95   |.  8B88 48C42501           |MOV ECX,DWORD PTR DS:[EAX+125C448]
00474A9B   |.  51                      |PUSH ECX                            ; /Arg2
00474A9C   |.  8B15 88F81501           |MOV EDX,DWORD PTR DS:[115F888]      ; |
00474AA2   |.  52                      |PUSH EDX                            ; |Arg1 => 2D700107
00474AA3   |.  B9 005B1801             |MOV ECX,TwelveSk.01185B00           ; |
00474AA8   |.  E8 33380000             |CALL TwelveSk.004782E0              ; \TwelveSk.004782E0
00474AAD   |.  85C0                    |TEST EAX,EAX
00474AAF   |.  74 0C                   |JE SHORT TwelveSk.00474ABD
00474AB1   |.  C745 F0 01000000        |MOV DWORD PTR SS:[EBP-10],1
00474AB8   |.^ E9 53FFFFFF             |JMP TwelveSk.00474A10
00474ABD   |>  8B45 EC                 |MOV EAX,DWORD PTR SS:[EBP-14]
00474AC0   |.  6BC0 7C                 |IMUL EAX,EAX,7C
00474AC3   |.  8B88 38C42501           |MOV ECX,DWORD PTR DS:[EAX+125C438]
00474AC9   |.  894D FC                 |MOV DWORD PTR SS:[EBP-4],ECX
00474ACC   |.  8B55 EC                 |MOV EDX,DWORD PTR SS:[EBP-14]
00474ACF   |.  6BD2 7C                 |IMUL EDX,EDX,7C
00474AD2   |.  8B82 3CC42501           |MOV EAX,DWORD PTR DS:[EDX+125C43C]
00474AD8   |.  8945 E8                 |MOV DWORD PTR SS:[EBP-18],EAX
00474ADB   |.  C745 D8 00000000        |MOV DWORD PTR SS:[EBP-28],0
00474AE2   |.  C745 DC 00000000        |MOV DWORD PTR SS:[EBP-24],0
00474AE9   |.  C745 E4 00000000        |MOV DWORD PTR SS:[EBP-1C],0
00474AF0   |.  C745 E0 00000000        |MOV DWORD PTR SS:[EBP-20],0
00474AF7   |.  C745 F8 00000000        |MOV DWORD PTR SS:[EBP-8],0
00474AFE   |.  EB 71                   |JMP SHORT TwelveSk.00474B71
00474B00   |>  8B4D EC                 |MOV ECX,DWORD PTR SS:[EBP-14]
00474B03   |.  6BC9 7C                 |IMUL ECX,ECX,7C
00474B06   |.  8B91 38C42501           |MOV EDX,DWORD PTR DS:[ECX+125C438]
00474B0C   |.  8955 FC                 |MOV DWORD PTR SS:[EBP-4],EDX
00474B0F   |.  8B45 EC                 |MOV EAX,DWORD PTR SS:[EBP-14]
00474B12   |.  6BC0 7C                 |IMUL EAX,EAX,7C
00474B15   |.  8B88 3CC42501           |MOV ECX,DWORD PTR DS:[EAX+125C43C]
00474B1B   |.  894D E8                 |MOV DWORD PTR SS:[EBP-18],ECX
00474B1E   |.  C745 D8 00000000        |MOV DWORD PTR SS:[EBP-28],0
00474B25   |.  6A FF                   |PUSH -1                             ; /Arg9 = FFFFFFFF
00474B27   |.  8D55 F8                 |LEA EDX,DWORD PTR SS:[EBP-8]        ; |
00474B2A   |.  52                      |PUSH EDX                            ; |Arg8
00474B2B   |.  8D45 E0                 |LEA EAX,DWORD PTR SS:[EBP-20]       ; |
00474B2E   |.  50                      |PUSH EAX                            ; |Arg7
00474B2F   |.  8D4D E4                 |LEA ECX,DWORD PTR SS:[EBP-1C]       ; |
00474B32   |.  51                      |PUSH ECX                            ; |Arg6
00474B33   |.  8D55 DC                 |LEA EDX,DWORD PTR SS:[EBP-24]       ; |
00474B36   |.  52                      |PUSH EDX                            ; |Arg5
00474B37   |.  8B45 EC                 |MOV EAX,DWORD PTR SS:[EBP-14]       ; |
00474B3A   |.  6BC0 7C                 |IMUL EAX,EAX,7C                     ; |
00474B3D   |.  8B88 48C42501           |MOV ECX,DWORD PTR DS:[EAX+125C448]  ; |
00474B43   |.  51                      |PUSH ECX                            ; |Arg4
00474B44   |.  8B55 EC                 |MOV EDX,DWORD PTR SS:[EBP-14]       ; |
00474B47   |.  6BD2 7C                 |IMUL EDX,EDX,7C                     ; |
00474B4A   |.  8B82 44C42501           |MOV EAX,DWORD PTR DS:[EDX+125C444]  ; |
00474B50   |.  50                      |PUSH EAX                            ; |Arg3
00474B51   |.  6A FF                   |PUSH -1                             ; |Arg2 = FFFFFFFF
00474B53   |.  6A FF                   |PUSH -1                             ; |Arg1 = FFFFFFFF
00474B55   |.  B9 D0C92C01             |MOV ECX,TwelveSk.012CC9D0           ; |
00474B5A   |.  E8 610B0800             |CALL TwelveSk.004F56C0              ; \TwelveSk.004F56C0
00474B5F   |.  837D DC FF              |CMP DWORD PTR SS:[EBP-24],-1
00474B63   |.  75 0C                   |JNZ SHORT TwelveSk.00474B71
00474B65   |.  C745 F4 01000000        |MOV DWORD PTR SS:[EBP-C],1
00474B6C   |.^ E9 9FFEFFFF             \JMP TwelveSk.00474A10
00474B71   |>  8B4D EC                 MOV ECX,DWORD PTR SS:[EBP-14]
00474B74   |.  3B0D EC6A1801           CMP ECX,DWORD PTR DS:[1186AEC]
00474B7A   |.  75 78                   JNZ SHORT TwelveSk.00474BF4
00474B7C   |.  837D F0 01              CMP DWORD PTR SS:[EBP-10],1
00474B80   |.  74 06                   JE SHORT TwelveSk.00474B88
00474B82   |.  837D F4 01              CMP DWORD PTR SS:[EBP-C],1
00474B86   |.  75 49                   JNZ SHORT TwelveSk.00474BD1
00474B88   |>  837D F0 01              CMP DWORD PTR SS:[EBP-10],1
00474B8C   |.  75 1E                   JNZ SHORT TwelveSk.00474BAC
00474B8E   |.  8B15 44316000           MOV EDX,DWORD PTR DS:[603144]
00474B94   |.  52                      PUSH EDX                             ; /Arg2
00474B95   |.  6A 74                   PUSH 74                              ; |/Arg1 = 00000074
00474B97   |.  B9 C85C5B00             MOV ECX,TwelveSk.005B5CC8            ; ||
00474B9C   |.  E8 4F68FBFF             CALL TwelveSk.0042B3F0               ; |\TwelveSk.0042B3F0
00474BA1   |.  50                      PUSH EAX                             ; |Arg1
00474BA2   |.  B9 38F82D01             MOV ECX,TwelveSk.012DF838            ; |
00474BA7   |.  E8 849A0A00             CALL TwelveSk.0051E630               ; \TwelveSk.0051E630
00474BAC   |>  837D F4 01              CMP DWORD PTR SS:[EBP-C],1
00474BB0   |.  75 1D                   JNZ SHORT TwelveSk.00474BCF
00474BB2   |.  A1 44316000             MOV EAX,DWORD PTR DS:[603144]
00474BB7   |.  50                      PUSH EAX                             ; /Arg2
00474BB8   |.  6A 75                   PUSH 75                              ; |/Arg1 = 00000075
00474BBA   |.  B9 C85C5B00             MOV ECX,TwelveSk.005B5CC8            ; ||
00474BBF   |.  E8 2C68FBFF             CALL TwelveSk.0042B3F0               ; |\TwelveSk.0042B3F0
00474BC4   |.  50                      PUSH EAX                             ; |Arg1
00474BC5   |.  B9 38F82D01             MOV ECX,TwelveSk.012DF838            ; |
00474BCA   |.  E8 619A0A00             CALL TwelveSk.0051E630               ; \TwelveSk.0051E630
00474BCF   |>  EB 21                   JMP SHORT TwelveSk.00474BF2
00474BD1   |>  8B0D 44316000           MOV ECX,DWORD PTR DS:[603144]
00474BD7   |.  51                      PUSH ECX                             ; /Arg2
00474BD8   |.  68 78020000             PUSH 278                             ; |/Arg1 = 00000278
00474BDD   |.  B9 C85C5B00             MOV ECX,TwelveSk.005B5CC8            ; ||
00474BE2   |.  E8 0968FBFF             CALL TwelveSk.0042B3F0               ; |\TwelveSk.0042B3F0
00474BE7   |.  50                      PUSH EAX                             ; |Arg1
00474BE8   |.  B9 38F82D01             MOV ECX,TwelveSk.012DF838            ; |
00474BED   |.  E8 3E9A0A00             CALL TwelveSk.0051E630               ; \TwelveSk.0051E630
00474BF2   |>  EB 50                   JMP SHORT TwelveSk.00474C44
00474BF4   |>  833D 28101601 01        CMP DWORD PTR DS:[1161028],1
00474BFB   |.  75 02                   JNZ SHORT TwelveSk.00474BFF
00474BFD   |.  EB 45                   JMP SHORT TwelveSk.00474C44
00474BFF   |>  833D 90101601 00        CMP DWORD PTR DS:[1161090],0
00474C06   |.  74 02                   JE SHORT TwelveSk.00474C0A
00474C08   |.  EB 3A                   JMP SHORT TwelveSk.00474C44
00474C0A   |>  8B55 F8                 MOV EDX,DWORD PTR SS:[EBP-8]
00474C0D   |.  52                      PUSH EDX                             ; /Arg7
00474C0E   |.  8B45 E0                 MOV EAX,DWORD PTR SS:[EBP-20]        ; |
00474C11   |.  50                      PUSH EAX                             ; |Arg6
00474C12   |.  8B4D E4                 MOV ECX,DWORD PTR SS:[EBP-1C]        ; |
00474C15   |.  51                      PUSH ECX                             ; |Arg5
00474C16   |.  8B55 DC                 MOV EDX,DWORD PTR SS:[EBP-24]        ; |
00474C19   |.  52                      PUSH EDX                             ; |Arg4
00474C1A   |.  8B45 D8                 MOV EAX,DWORD PTR SS:[EBP-28]        ; |
00474C1D   |.  50                      PUSH EAX                             ; |Arg3
00474C1E   |.  8B4D E8                 MOV ECX,DWORD PTR SS:[EBP-18]        ; |
00474C21   |.  51                      PUSH ECX                             ; |Arg2
00474C22   |.  8B55 FC                 MOV EDX,DWORD PTR SS:[EBP-4]         ; |
00474C25   |.  52                      PUSH EDX                             ; |Arg1
00474C26   |.  B9 085B1801             MOV ECX,TwelveSk.01185B08            ; |
00474C2B   |.  E8 20C00200             CALL TwelveSk.004A0C50               ; \TwelveSk.004A0C50
00474C30   |.  C705 90101601 01000000  MOV DWORD PTR DS:[1161090],1
00474C3A   |.  A1 88175800             MOV EAX,DWORD PTR DS:[581788]
00474C3F   |.  A3 94101601             MOV DWORD PTR DS:[1161094],EAX
00474C44   |>  8BE5                    MOV ESP,EBP
00474C46   |.  5D                      POP EBP
00474C47   \.  C3                      RETN

You can find the updated address for this function by searching "Sequence of Commands" in ollydebug:

Code:

PUSH EBP
MOV EBP,ESP
SUB ESP,2C
MOV DWORD PTR SS:[EBP-2C],ECX
MOV DWORD PTR SS:[EBP-10],0
MOV DWORD PTR SS:[EBP-C],0
MOV DWORD PTR SS:[EBP-14],0

And the C++ function to Auto-Loot was:

Code:

void Loot()
{
	UINT_PTR adr = 0xUPDATEDADDRESS;
	__asm
	{
		 CALL adr
	}
}

strikeraid · 06/30/2011, 22:59

hmm interesting. so that function is within the game client and all you do is call it to loot?

iktov2 · 06/30/2011, 23:10

Quote:

Originally Posted by strikeraid

hmm interesting. so that function is within the game client and all you do is call it to loot?

Yep.

The filtering though was reading from the ItemList struct and Dropped items, comparing the item on the ground to its entry in the ItemList struct to see if its Rare or elite or see what item it is(lucky tickets, silver ect..) and then it matched have it looted, it it didn't match a "wanted" item then Push it away or change its exist flag to 0.

strikeraid · 07/01/2011, 07:15

wow. thats genius! i'm speechless right now haha.

how did you find the address that triggers skills? I don't know where to start searching for that kind of function. i'm applying this to different games so it's harder to search for certain things.

iktov2 · 07/01/2011, 08:39

Quote:

Originally Posted by strikeraid

wow. thats genius! i'm speechless right now haha.

how did you find the address that triggers skills? I don't know where to start searching for that kind of function. i'm applying this to different games so it's harder to search for certain things.

Check that tutorial that Tri posted about packets. You don't need to know how to do anything with packets, but it briefly explains tracing functions from the Send() api.

Basically all I did was BP send() and do something in-game, then trace it back from there and recorded all functions I went through. Then went back and looked at each function as I repeated the action in-game. If it triggered a BP from the action I did in-game I would look at the arguments being passed through the function and try to make sense of them.

Then just slap them into the .dll and give it a shot.

I've found it to be a bit difficult with games like RIFT though. I just get sent around in a loop and never end up on the source of the action that triggered the call to Send(), since 12sky2 was the first time i've ever done this kind of thing its a bit more difficult tying to apply it to other games.

Mr_Troy22 · 07/01/2011, 10:57

Quote:

Originally Posted by iktov2

Check that tutorial that Tri posted about packets. You don't need to know how to do anything with packets, but it briefly explains tracing functions from the Send() api.

Basically all I did was BP send() and do something in-game, then trace it back from there and recorded all functions I went through. Then went back and looked at each function as I repeated the action in-game. If it triggered a BP from the action I did in-game I would look at the arguments being passed through the function and try to make sense of them.

Then just slap them into the .dll and give it a shot.

I've found it to be a bit difficult with games like RIFT though. I just get sent around in a loop and never end up on the source of the action that triggered the call to Send(), since 12sky2 was the first time i've ever done this kind of thing its a bit more difficult tying to apply it to other games.

I still can't figure out how to breakpoint thanks to the **** themida anti-debugging systems.

strikeraid · 07/01/2011, 11:43

alright cool. i'll give it a shot. let's hope i get somewhere. i still haven't been able to do signature scanning yet or working with addresses using DLLs because the client keeeps crashing, but i'll get there. XD

Mr_Troy22 · 07/01/2011, 14:57

Quote:

Originally Posted by strikeraid

alright cool. i'll give it a shot. let's hope i get somewhere. i still haven't been able to do signature scanning yet or working with addresses using DLLs because the client keeeps crashing, but i'll get there. XD

I had that exact same problem, it's the injection method that's causing it. I do not know how but it does

Hey Iktov any idea how to find the pointers for the ItemList and DroppedItem structures? and sizes, cause I cba to find em lol