Register for your free account! | Forgot your password?

Go Back   elitepvpers > MMORPGs > 12Sky2 > 12Sky2 Hacks, Bots, Cheats & Exploits
You last visited: Today at 19:02

  • Please register to post and access all features, it's quick, easy and FREE!

Advertisement



[Release] Structs and Misc Bot functions

Discussion on [Release] Structs and Misc Bot functions within the 12Sky2 Hacks, Bots, Cheats & Exploits forum part of the 12Sky2 category.

Reply
 
Old   #1
 
elite*gold: 0
Join Date: Jul 2010
Posts: 623
Received Thanks: 175
[Release] Structs and Misc Bot functions

Just posting some of the old information from my bot for all you people still actively working on TwelveSky2 that may want to start to work on a memory based botting system.

To start with here are some of the structs I used for making my bot. This is the first time I had ever done something like this, so they are nowhere near professional or fully completed, but there fully working for main bot functions you may need(unless the game client changed drastically at some point):

Code:
struct SkillBar{
    DWORD Slot1ID; //0000
	DWORD Slot1Count; //0004
	DWORD Slot1Type; //0008
	DWORD Slot2ID; //000C
	DWORD Slot2Count; //0010
	DWORD Slot2Type; //0014
	DWORD Slot3ID; //0018
	DWORD Slot3Count; //001C
	DWORD Slot3Type; //0020
	DWORD Slot4ID; //0024
	DWORD Slot4Count; //0028
	DWORD Slot4Type; //002C
	DWORD Slot5ID; //0030
	DWORD Slot5Count; //0034
	DWORD Slot5Type; //0038
	DWORD Slot6ID; //003C
	DWORD Slot6Count; //0040
	DWORD Slot6Type; //0044
	DWORD Slot7ID; //0048
	DWORD Slot7Count; //004C
	DWORD Slot7Type; //0050
	DWORD Slot8ID; //0054
	DWORD Slot8Count; //0058
	DWORD Slot8Type; //005C
	DWORD Slot9ID; //0060
	DWORD Slot9Count; //0064
	DWORD Slot9Type; //0068
	DWORD Slot10ID; //006C
	DWORD Slot10Count; //0070
	DWORD Slot10Type; //0074
	DWORD Slot11ID; //0078
	DWORD Slot11Count; //007C
	DWORD Slot11Type; //0080
	DWORD Slot12ID; //0084
	DWORD Slot12Count; //0088
	DWORD Slot12Type; //008C
	DWORD Slot13ID; //0090
	DWORD Slot13Count; //0094
	DWORD Slot13Type; //0098
	DWORD Slot14ID; //009C
	DWORD Slot14Count; //00A0
	DWORD Slot14Type; //00A4
};

#pragma pack(1)
struct MyCharacter{        
    BYTE Exists; //0000
	BYTE Unknown0; //0001
	BYTE Unknown1; //0002
	BYTE Unknown2; //0003
	char unknown3[16];
	DWORD Contribution; //0014
	char unknown4[20];
	BYTE Unknown5; //002C
	BYTE Unknown6; //002D
	char CharName[13]; //002E
	char unknown8[108];
	BYTE AnimFreeze; //00A7
	BYTE Animation; //00A8
	BYTE AnimID; //00A9
	BYTE MoveSpeed; //00AA
	float AnimationFloat; //00AB
	float CharX; //00AF
	float CharZ; //00B3
	float CharY; //00B7
	float CharXLock; //00BB
	float CharZLock; //00BF
	float CharYLock; //00C3
	float FaceDirection; //00C7
	float RotateDirection; //00CB
	char unknown9[12];
	DWORD MaxHP; //00DB
	DWORD CurHP; //00DF
	DWORD MaxMP; //00E3
	DWORD CurMP; //00E7
	DWORD SkillEffect1; //00EB
	DWORD SkillEffect2; //00EF
	DWORD SkillEffect3; //00F3
	DWORD SkillEffect4; //00F7
	DWORD SkillEffect5; //00FB
	DWORD SkillEffect6; //00FF
	DWORD SkillEffect7; //0103
	DWORD SkillEffect8; //0107
	DWORD SkillEffect9; //010B
	DWORD SkillEffect10; //010F
	DWORD SkillEffect11; //0113
	DWORD SkillEffect12; //0117
	DWORD SkillEffect13; //011B
	DWORD SkillEffect14; //011F
	DWORD SkillEffect15; //0123
	DWORD SkillEffect16; //0127
	char unknown10[68];
	BYTE Unknown11; //016F
	DWORD CanAttack1; //0170
	DWORD CanAttack2; //0174
	DWORD CanAttack3; //0178
	char unknown12[204];
	DWORD Unknown13; //0248
};

struct Monsters{
    DWORD Exists; //0000
	char unknown0[8];
	float AttackFloat; //000C
	DWORD MobID; //0010
	BYTE Unknown1; //0014
	BYTE Animation; //0015
	BYTE Unknown2; //0016
	BYTE Unknown3; //0017
	char unknown4[4];
	float MobX; //001C
	float MobZ; //0020
	float MobY; //0024
	float MobXLock; //0028
	float MobZLock; //002C
	float MobYLock; //0030
	float Rotation; //0034
	char unknown5[16];
	DWORD MobHP; //0048
	char unknown6[12];
	DWORD Attacking; //0058
	DWORD CanAttack1; //005C
	DWORD CanAttack2; //0060
	DWORD Hit; //0064
	char unknown7[148];
	DWORD Unknown8; //00FC
};

 struct  DroppedItems{
	DWORD Exists; //0000
	char unknown0[12];
	DWORD ItemID; //0010
	char unknown1[80];
	float ItemX; //0064
	float ItemZ; //0068
	float ItemY; //006C
	char unknown2[8];
	DWORD Unknown3; //0078
};

struct ItemList{
	DWORD ItemID; //0000
	char unknown0[180];
	DWORD Rarity; //00B8
	DWORD Type; //00BC
	char unknown1[232];
	DWORD Unknown2; //01A8
};

struct Faction{
	int faction;
};

struct CurFood{
	int curfood;
};
extern SkillBar * Skillbar1;
extern MyCharacter * MyChar;
extern Monsters * Mobs;
extern DroppedItems * GroundItems;
extern ItemList * List;
extern Faction * MyFaction;
extern CurFood * CurFeed;
Up to date Addresses:
MyCharacter Struct: 0x118BF14

Using the above:

Code:
SkillBar *Skillbar1 = (SkillBar *)0xSkillBarADDR;
Monsters *Mobs = (Monsters *)0xMobStructADDR;
MyCharacter *MyChar = (MyCharacter *)CharStructADDR;
DroppedItems *GroundItems = (DroppedItems*)DroppedItemsADDR;
Faction *MyFaction = (Faction*)FactionADDR;
CurFood *CurFeed = (CurFood*)PetFoodADDR;
Now if you want to access a piece of information from your character struct you can do it like this, using this example would be a speedhack:

Code:
MyChar->MoveSpeed = 200;
List of Functions to trigger in the game client:

Code:
void UseSkill(int Arg1, int Arg2, int Arg3, int Arg4)
	   {
			UINT_PTR adr = 0x00476600;
			__asm
			{
			PUSH Arg1                               
			PUSH Arg2                            
			PUSH Arg3                           
			MOV EDX,[EBP-8]         
			PUSH Arg4                           
			MOV ECX,[EBP-10]       
			CALL adr              
			}
		}

	    void UseConsole(int Arg1, const char* Arg2)
		{
		   UINT_PTR adr = 0x00522C80;
		   __asm
		   {
			   PUSH Arg1                             
			   PUSH Arg2              
			   MOV ECX,0x012E3900         
			   CALL adr              
		   }
		}

        void UseFruit(int Arg1, int Arg2)
		{
			 UINT_PTR adr = 0x00422D40;
			 __asm
			 {
				 PUSH Arg1;                          
				 MOV ECX,[0x116519C]      
				 PUSH Arg2                             
				 MOV ECX,0x0059EAA0           
				 CALL adr            
			 }
		}

        void FullRecover()
		{
			UINT_PTR adr = 0x004A5570;
			__asm
			{
				CALL adr    
			}
		}

		void Loot()
		{
			UINT_PTR adr = 0x004763A0;
			__asm
			{
				 CALL adr
			}
		}

The skillbar struct I used to read whatever skill was on the skillbar slot, so that the bot would automatically know where the skill was that needed to be used, so the user would not have to designate a Key for the skill. Here is my nooby C++ function that made for this. I could defiantly be a lot better for any of you C++ pros out there that may read this but with my limited coding skills this what I came up with:

Code:
int GetIDFromSB(int ID)
		{
			int ReturnSlot;
			if(Skillbar1->Slot1ID == ID)
			{
				return ReturnSlot = 0;
			}
			else if(Skillbar1->Slot2ID == ID)
			{
				return ReturnSlot = 1;
			}
			else if(Skillbar1->Slot3ID == ID)
			{
				return ReturnSlot = 2;
			}
			else if(Skillbar1->Slot4ID == ID)
			{
				return ReturnSlot = 3;
			}
			else if(Skillbar1->Slot5ID == ID)
			{
				return ReturnSlot = 4;
			}
			else if(Skillbar1->Slot6ID == ID)
			{
				return ReturnSlot = 5;
			}
			else if(Skillbar1->Slot7ID == ID)
			{
				return ReturnSlot = 6;
			}
			else if(Skillbar1->Slot8ID == ID)
			{
				return ReturnSlot = 7;
			}
			else if(Skillbar1->Slot9ID == ID)
			{
				return ReturnSlot = 8;
			}
			else if(Skillbar1->Slot10ID == ID)
			{
				return ReturnSlot = 9;
			}
			else if(Skillbar1->Slot11ID == ID)
			{
				return ReturnSlot = 0xA;
			}
			else if(Skillbar1->Slot12ID == ID)
			{
				return ReturnSlot = 0xB;
			}
			else if(Skillbar1->Slot13ID == ID)
			{
				return ReturnSlot = 0xC;
			}
			else if(Skillbar1->Slot14ID == ID)
			{
				return ReturnSlot = 0xD;
			}
}
Usage of the above function went something like this:

Code:
int CharFaction = MyFaction->faction;
int AOEID = GetAOEID(CharFaction);
int AOESlot = IMBClass.GetIDFromSB(AOEID);

int GetAOEID(int faction)
{
	int aoeID;
	if(faction == 0)
	{
		aoeID = IMBClass.SWIRLINGPHOENIX;
	}
	else if(faction == 1)
	{
		aoeID = IMBClass.DEADLYAVALANCHE;
	}
	else if(faction == 2)
	{
		aoeID = IMBClass.BATTLESONG;
	}
	return aoeID;
}
Using all of the above it has determined what faction your current character belongs to, associated your character with that factions AOE skill(no def weapons included, but could be added), and scans the skillbar for the ID of the associated AOE skill.

At this point you can make a bot to auto execute the AOE skill without having to designate a key for the slot the skill is located on:


Code:
UseSkill(0, 0, 0, AOESlot); // First Arg is Skillbar# and last is SkillbarSLot#,  can't remember what the other 2 args are,  don't need to be used anyhow.

Possibly more to come, I just posted this in hopes maybe I can get my interest in these things sparked back up again, maybe spark up some interest in other people here to dabble with it a bit and possibly get a bit of credit for once(na, doesn't matter).

Anyways, I have limited knowledge in these matters and just dabble with stuff here and there, reading info I find on gamehacking/coding forums and going from there.

Yet again big thanks to Megabyte for helping understand how to use structs in a bot. I read so many source codes for Source Engine games and COD games in the past trying to understand how they did it, but I never understood how to make use of the start address for the struct in C++ before this.

I may post some info on locating new addresses for the structs and a small sample project for an Auto-AOE bot with updated addresses.

Hopefully somebody will enjoy reading this(for purposes regarding bot making and not other reasons) and hopefully I can stop being lazy/distracted and further my knowledge in these areas as I really enjoy doing it when everything clicks.

Good luck.

Tools that I used:

Cheat Engine 6: You know where to find this.
Reclass: New version can be on UknownCheats.com
Ollydebug
iktov2 is offline  
Thanks
4 Users
Old 06/22/2011, 22:25   #2
 
elite*gold: 0
Join Date: Jul 2010
Posts: 623
Received Thanks: 175
List of functions from OllyDebug:

Code:
_________________________________
\\Execute Skillz from SkillBar\\
_________________________________

00471C01   |> \E9 2F060000             JMP TwelveSk.00472235
00471C06   |>  6A 01                   PUSH 1                               ; /Arg4 = 00000001
00471C08   |.  6A 00                   PUSH 0                               ; |Arg3 = 00000000
00471C0A   |.  6A 00                   PUSH 0                               ; |Arg2 = 00000000
00471C0C   |.  8B55 F8                 MOV EDX,DWORD PTR SS:[EBP-8]         ; |
00471C0F   |.  52                      PUSH EDX                             ; |Arg1  // Skill slots from 0-9(0 = 1, 1= 2 ect...)
00471C10   |.  8B4D F0                 MOV ECX,DWORD PTR SS:[EBP-10]        ; |
00471C13   |.  E8 38300000             CALL TwelveSk.00474C50               ; \TwelveSk.00474C50
00471C18   |.  E9 18060000             JMP TwelveSk.00472235


___________________________
\\Full Recover execution \\
___________________________

004A2291   |.  50                      PUSH EAX                             ; /Arg2
004A2292   |.  8B4D 8C                 MOV ECX,DWORD PTR SS:[EBP-74]        ; |
004A2295   |.  51                      PUSH ECX                             ; |Arg1
004A2296   |.  B9 A0AA5900             MOV ECX,TwelveSk.0059AAA0            ; |
004A229B   |.  E8 00FBF7FF             CALL TwelveSk.00421DA0               ; \TwelveSk.00421DA0
004A22A0   |.  5F                      POP EDI                              ;  0012FD30

____________
\\Send Chat\\
____________

0051CDFE   |.  51                      PUSH ECX                             ; /Arg1
0051CDFF   |.  B9 A0AA5900             MOV ECX,TwelveSk.0059AAA0            ; |
0051CE04   |.  E8 E76FF0FF             CALL TwelveSk.00423DF0               ; \TwelveSk.00423DF0

____________________________
\\Console Output window\\\\\
_____________________________

OutPut Console:
004A0A65   |.  6A 02                   PUSH 2                               ; /Arg2 = 00000002
004A0A67   |.  68 D4CC5500             PUSH TwelveSk.0055CCD4               ; |Arg1 = 0055CCD4 ASCII "GM Command OK!!!"
004A0A6C   |.  B9 38F82D01             MOV ECX,TwelveSk.012DF838            ; |
004A0A71   |.  E8 BADB0700             CALL TwelveSk.0051E630               ; \TwelveSk.0051E630

_____________
\\Loot\\\\\\\
_____________

004749F0   /$  55                      PUSH EBP
004749F1   |.  8BEC                    MOV EBP,ESP
004749F3   |.  83EC 2C                 SUB ESP,2C
004749F6   |.  894D D4                 MOV DWORD PTR SS:[EBP-2C],ECX
004749F9   |.  C745 F0 00000000        MOV DWORD PTR SS:[EBP-10],0
00474A00   |.  C745 F4 00000000        MOV DWORD PTR SS:[EBP-C],0
00474A07   |.  C745 EC 00000000        MOV DWORD PTR SS:[EBP-14],0
00474A0E   |.  EB 09                   JMP SHORT TwelveSk.00474A19
00474A10   |>  8B45 EC                 /MOV EAX,DWORD PTR SS:[EBP-14]
00474A13   |.  83C0 01                 |ADD EAX,1
00474A16   |.  8945 EC                 |MOV DWORD PTR SS:[EBP-14],EAX
00474A19   |>  8B4D EC                  MOV ECX,DWORD PTR SS:[EBP-14]
00474A1C   |.  3B0D EC6A1801           |CMP ECX,DWORD PTR DS:[1186AEC]
00474A22   |.  0F8D 49010000           |JGE TwelveSk.00474B71
00474A28   |.  8B55 EC                 |MOV EDX,DWORD PTR SS:[EBP-14]
00474A2B   |.  6BD2 7C                 |IMUL EDX,EDX,7C
00474A2E   |.  83BA 34C42501 00        |CMP DWORD PTR DS:[EDX+125C434],0
00474A35   |.  75 02                   |JNZ SHORT TwelveSk.00474A39
00474A37   |.^ EB D7                   |JMP SHORT TwelveSk.00474A10
00474A39   |>  68 B36B1801             |PUSH TwelveSk.01186BB3              ; /Arg2 = 01186BB3
00474A3E   |.  8B45 EC                 |MOV EAX,DWORD PTR SS:[EBP-14]       ; |
00474A41   |.  6BC0 7C                 |IMUL EAX,EAX,7C                     ; |
00474A44   |.  05 98C42501             |ADD EAX,TwelveSk.0125C498           ; |
00474A49   |.  50                      |PUSH EAX                            ; |Arg1
00474A4A   |.  B9 005B1801             |MOV ECX,TwelveSk.01185B00           ; |
00474A4F   |.  E8 0C3C0000             |CALL TwelveSk.00478660              ; \TwelveSk.00478660
00474A54   |.  D81D 28BB5500           |FCOMP DWORD PTR DS:[55BB28]
00474A5A   |.  DFE0                    |FSTSW AX
00474A5C   |.  F6C4 41                 |TEST AH,41
00474A5F   |.  75 02                   |JNZ SHORT TwelveSk.00474A63
00474A61   |.^ EB AD                   |JMP SHORT TwelveSk.00474A10
00474A63   |>  8B4D EC                 |MOV ECX,DWORD PTR SS:[EBP-14]
00474A66   |.  6BC9 7C                 |IMUL ECX,ECX,7C
00474A69   |.  81C1 34C42501           |ADD ECX,TwelveSk.0125C434
00474A6F   |.  E8 DC360200             |CALL TwelveSk.00498150
00474A74   |.  85C0                    |TEST EAX,EAX
00474A76   |.  75 02                   |JNZ SHORT TwelveSk.00474A7A
00474A78   |.^ EB 96                   |JMP SHORT TwelveSk.00474A10
00474A7A   |>  8B4D EC                 |MOV ECX,DWORD PTR SS:[EBP-14]
00474A7D   |.  6BC9 7C                 |IMUL ECX,ECX,7C
00474A80   |.  8B91 7CC42501           |MOV EDX,DWORD PTR DS:[ECX+125C47C]
00474A86   |.  83BA BC000000 01        |CMP DWORD PTR DS:[EDX+BC],1
00474A8D   |.  75 71                   |JNZ SHORT TwelveSk.00474B00
00474A8F   |.  8B45 EC                 |MOV EAX,DWORD PTR SS:[EBP-14]
00474A92   |.  6BC0 7C                 |IMUL EAX,EAX,7C
00474A95   |.  8B88 48C42501           |MOV ECX,DWORD PTR DS:[EAX+125C448]
00474A9B   |.  51                      |PUSH ECX                            ; /Arg2
00474A9C   |.  8B15 88F81501           |MOV EDX,DWORD PTR DS:[115F888]      ; |
00474AA2   |.  52                      |PUSH EDX                            ; |Arg1 => 2D700107
00474AA3   |.  B9 005B1801             |MOV ECX,TwelveSk.01185B00           ; |
00474AA8   |.  E8 33380000             |CALL TwelveSk.004782E0              ; \TwelveSk.004782E0
00474AAD   |.  85C0                    |TEST EAX,EAX
00474AAF   |.  74 0C                   |JE SHORT TwelveSk.00474ABD
00474AB1   |.  C745 F0 01000000        |MOV DWORD PTR SS:[EBP-10],1
00474AB8   |.^ E9 53FFFFFF             |JMP TwelveSk.00474A10
00474ABD   |>  8B45 EC                 |MOV EAX,DWORD PTR SS:[EBP-14]
00474AC0   |.  6BC0 7C                 |IMUL EAX,EAX,7C
00474AC3   |.  8B88 38C42501           |MOV ECX,DWORD PTR DS:[EAX+125C438]
00474AC9   |.  894D FC                 |MOV DWORD PTR SS:[EBP-4],ECX
00474ACC   |.  8B55 EC                 |MOV EDX,DWORD PTR SS:[EBP-14]
00474ACF   |.  6BD2 7C                 |IMUL EDX,EDX,7C
00474AD2   |.  8B82 3CC42501           |MOV EAX,DWORD PTR DS:[EDX+125C43C]
00474AD8   |.  8945 E8                 |MOV DWORD PTR SS:[EBP-18],EAX
00474ADB   |.  C745 D8 00000000        |MOV DWORD PTR SS:[EBP-28],0
00474AE2   |.  C745 DC 00000000        |MOV DWORD PTR SS:[EBP-24],0
00474AE9   |.  C745 E4 00000000        |MOV DWORD PTR SS:[EBP-1C],0
00474AF0   |.  C745 E0 00000000        |MOV DWORD PTR SS:[EBP-20],0
00474AF7   |.  C745 F8 00000000        |MOV DWORD PTR SS:[EBP-8],0
00474AFE   |.  EB 71                   |JMP SHORT TwelveSk.00474B71
00474B00   |>  8B4D EC                 |MOV ECX,DWORD PTR SS:[EBP-14]
00474B03   |.  6BC9 7C                 |IMUL ECX,ECX,7C
00474B06   |.  8B91 38C42501           |MOV EDX,DWORD PTR DS:[ECX+125C438]
00474B0C   |.  8955 FC                 |MOV DWORD PTR SS:[EBP-4],EDX
00474B0F   |.  8B45 EC                 |MOV EAX,DWORD PTR SS:[EBP-14]
00474B12   |.  6BC0 7C                 |IMUL EAX,EAX,7C
00474B15   |.  8B88 3CC42501           |MOV ECX,DWORD PTR DS:[EAX+125C43C]
00474B1B   |.  894D E8                 |MOV DWORD PTR SS:[EBP-18],ECX
00474B1E   |.  C745 D8 00000000        |MOV DWORD PTR SS:[EBP-28],0
00474B25   |.  6A FF                   |PUSH -1                             ; /Arg9 = FFFFFFFF
00474B27   |.  8D55 F8                 |LEA EDX,DWORD PTR SS:[EBP-8]        ; |
00474B2A   |.  52                      |PUSH EDX                            ; |Arg8
00474B2B   |.  8D45 E0                 |LEA EAX,DWORD PTR SS:[EBP-20]       ; |
00474B2E   |.  50                      |PUSH EAX                            ; |Arg7
00474B2F   |.  8D4D E4                 |LEA ECX,DWORD PTR SS:[EBP-1C]       ; |
00474B32   |.  51                      |PUSH ECX                            ; |Arg6
00474B33   |.  8D55 DC                 |LEA EDX,DWORD PTR SS:[EBP-24]       ; |
00474B36   |.  52                      |PUSH EDX                            ; |Arg5
00474B37   |.  8B45 EC                 |MOV EAX,DWORD PTR SS:[EBP-14]       ; |
00474B3A   |.  6BC0 7C                 |IMUL EAX,EAX,7C                     ; |
00474B3D   |.  8B88 48C42501           |MOV ECX,DWORD PTR DS:[EAX+125C448]  ; |
00474B43   |.  51                      |PUSH ECX                            ; |Arg4
00474B44   |.  8B55 EC                 |MOV EDX,DWORD PTR SS:[EBP-14]       ; |
00474B47   |.  6BD2 7C                 |IMUL EDX,EDX,7C                     ; |
00474B4A   |.  8B82 44C42501           |MOV EAX,DWORD PTR DS:[EDX+125C444]  ; |
00474B50   |.  50                      |PUSH EAX                            ; |Arg3
00474B51   |.  6A FF                   |PUSH -1                             ; |Arg2 = FFFFFFFF
00474B53   |.  6A FF                   |PUSH -1                             ; |Arg1 = FFFFFFFF
00474B55   |.  B9 D0C92C01             |MOV ECX,TwelveSk.012CC9D0           ; |
00474B5A   |.  E8 610B0800             |CALL TwelveSk.004F56C0              ; \TwelveSk.004F56C0
00474B5F   |.  837D DC FF              |CMP DWORD PTR SS:[EBP-24],-1
00474B63   |.  75 0C                   |JNZ SHORT TwelveSk.00474B71
00474B65   |.  C745 F4 01000000        |MOV DWORD PTR SS:[EBP-C],1
00474B6C   |.^ E9 9FFEFFFF             \JMP TwelveSk.00474A10
00474B71   |>  8B4D EC                 MOV ECX,DWORD PTR SS:[EBP-14]
00474B74   |.  3B0D EC6A1801           CMP ECX,DWORD PTR DS:[1186AEC]
00474B7A   |.  75 78                   JNZ SHORT TwelveSk.00474BF4
00474B7C   |.  837D F0 01              CMP DWORD PTR SS:[EBP-10],1
00474B80   |.  74 06                   JE SHORT TwelveSk.00474B88
00474B82   |.  837D F4 01              CMP DWORD PTR SS:[EBP-C],1
00474B86   |.  75 49                   JNZ SHORT TwelveSk.00474BD1
00474B88   |>  837D F0 01              CMP DWORD PTR SS:[EBP-10],1
00474B8C   |.  75 1E                   JNZ SHORT TwelveSk.00474BAC
00474B8E   |.  8B15 44316000           MOV EDX,DWORD PTR DS:[603144]
00474B94   |.  52                      PUSH EDX                             ; /Arg2
00474B95   |.  6A 74                   PUSH 74                              ; |/Arg1 = 00000074
00474B97   |.  B9 C85C5B00             MOV ECX,TwelveSk.005B5CC8            ; ||
00474B9C   |.  E8 4F68FBFF             CALL TwelveSk.0042B3F0               ; |\TwelveSk.0042B3F0
00474BA1   |.  50                      PUSH EAX                             ; |Arg1
00474BA2   |.  B9 38F82D01             MOV ECX,TwelveSk.012DF838            ; |
00474BA7   |.  E8 849A0A00             CALL TwelveSk.0051E630               ; \TwelveSk.0051E630
00474BAC   |>  837D F4 01              CMP DWORD PTR SS:[EBP-C],1
00474BB0   |.  75 1D                   JNZ SHORT TwelveSk.00474BCF
00474BB2   |.  A1 44316000             MOV EAX,DWORD PTR DS:[603144]
00474BB7   |.  50                      PUSH EAX                             ; /Arg2
00474BB8   |.  6A 75                   PUSH 75                              ; |/Arg1 = 00000075
00474BBA   |.  B9 C85C5B00             MOV ECX,TwelveSk.005B5CC8            ; ||
00474BBF   |.  E8 2C68FBFF             CALL TwelveSk.0042B3F0               ; |\TwelveSk.0042B3F0
00474BC4   |.  50                      PUSH EAX                             ; |Arg1
00474BC5   |.  B9 38F82D01             MOV ECX,TwelveSk.012DF838            ; |
00474BCA   |.  E8 619A0A00             CALL TwelveSk.0051E630               ; \TwelveSk.0051E630
00474BCF   |>  EB 21                   JMP SHORT TwelveSk.00474BF2
00474BD1   |>  8B0D 44316000           MOV ECX,DWORD PTR DS:[603144]
00474BD7   |.  51                      PUSH ECX                             ; /Arg2
00474BD8   |.  68 78020000             PUSH 278                             ; |/Arg1 = 00000278
00474BDD   |.  B9 C85C5B00             MOV ECX,TwelveSk.005B5CC8            ; ||
00474BE2   |.  E8 0968FBFF             CALL TwelveSk.0042B3F0               ; |\TwelveSk.0042B3F0
00474BE7   |.  50                      PUSH EAX                             ; |Arg1
00474BE8   |.  B9 38F82D01             MOV ECX,TwelveSk.012DF838            ; |
00474BED   |.  E8 3E9A0A00             CALL TwelveSk.0051E630               ; \TwelveSk.0051E630
00474BF2   |>  EB 50                   JMP SHORT TwelveSk.00474C44
00474BF4   |>  833D 28101601 01        CMP DWORD PTR DS:[1161028],1
00474BFB   |.  75 02                   JNZ SHORT TwelveSk.00474BFF
00474BFD   |.  EB 45                   JMP SHORT TwelveSk.00474C44
00474BFF   |>  833D 90101601 00        CMP DWORD PTR DS:[1161090],0
00474C06   |.  74 02                   JE SHORT TwelveSk.00474C0A
00474C08   |.  EB 3A                   JMP SHORT TwelveSk.00474C44
00474C0A   |>  8B55 F8                 MOV EDX,DWORD PTR SS:[EBP-8]
00474C0D   |.  52                      PUSH EDX                             ; /Arg7
00474C0E   |.  8B45 E0                 MOV EAX,DWORD PTR SS:[EBP-20]        ; |
00474C11   |.  50                      PUSH EAX                             ; |Arg6
00474C12   |.  8B4D E4                 MOV ECX,DWORD PTR SS:[EBP-1C]        ; |
00474C15   |.  51                      PUSH ECX                             ; |Arg5
00474C16   |.  8B55 DC                 MOV EDX,DWORD PTR SS:[EBP-24]        ; |
00474C19   |.  52                      PUSH EDX                             ; |Arg4
00474C1A   |.  8B45 D8                 MOV EAX,DWORD PTR SS:[EBP-28]        ; |
00474C1D   |.  50                      PUSH EAX                             ; |Arg3
00474C1E   |.  8B4D E8                 MOV ECX,DWORD PTR SS:[EBP-18]        ; |
00474C21   |.  51                      PUSH ECX                             ; |Arg2
00474C22   |.  8B55 FC                 MOV EDX,DWORD PTR SS:[EBP-4]         ; |
00474C25   |.  52                      PUSH EDX                             ; |Arg1
00474C26   |.  B9 085B1801             MOV ECX,TwelveSk.01185B08            ; |
00474C2B   |.  E8 20C00200             CALL TwelveSk.004A0C50               ; \TwelveSk.004A0C50
00474C30   |.  C705 90101601 01000000  MOV DWORD PTR DS:[1161090],1
00474C3A   |.  A1 88175800             MOV EAX,DWORD PTR DS:[581788]
00474C3F   |.  A3 94101601             MOV DWORD PTR DS:[1161094],EAX
00474C44   |>  8BE5                    MOV ESP,EBP
00474C46   |.  5D                      POP EBP
00474C47   \.  C3                      RETN
iktov2 is offline  
Thanks
3 Users
Old 06/22/2011, 23:31   #3
 
elite*gold: 0
Join Date: Jul 2010
Posts: 623
Received Thanks: 175
Full Recovery Sample Project.

Sample project posted. Just a simple dll that includes the updated Character and Skillbar structs and a small struct just for player faction.

I would add the AOE bot function to it, but I don't have a character with skills and don't feel like leveling so whatever.

For some reason the FullRecovery function is causing the client to crash, I haven't looked into it much but whos knows if they patched or something or I just forgot something.

There is also a compiled working copy included with the loaded that I used for the bot.


Features included:

MoveSpeed hack
Revive hack on keypress
Auto revive hack

Code:
void Hacks()
{
     if(speed)
	 {
		 MyChar->MoveSpeed = speedset; //Variable set to 20,  can change to whatever.
	 }
	 else
	 {
		 MyChar->MoveSpeed = normspeed; //Normal speed value 0.
	 }
	 if(GetAsyncKeyState(VK_NUMPAD3)) //Use revive if key is pressed,  change to whatever.
	 {
		 if(MyChar->Animation = 12) //12 is the death animation value,  set back to default of 1 and your good to go
		 {
			 MyChar->Animation = 1;
		 }
	 }
	 if(autorev) //Autorevive bool is set to true
	 {
		 if(MyChar->Animation = 12) //If char is dead then revive.
		 {
			 MyChar->Animation = 1;
		 }
	 }
}

Also everything in this is updated to use skills/items from the skillbar. You could make an Autobuffer or Autopet feeder with just a little bit of work if you really wanted to.

Using the these from the character struct, you can read when a particular buff is enabled or disabled:

Code:
DWORD SkillEffect1; //00EB
	DWORD SkillEffect2; //00EF
	DWORD SkillEffect3; //00F3
	DWORD SkillEffect4; //00F7
	DWORD SkillEffect5; //00FB
	DWORD SkillEffect6; //00FF
	DWORD SkillEffect7; //0103
	DWORD SkillEffect8; //0107
	DWORD SkillEffect9; //010B
	DWORD SkillEffect10; //010F
	DWORD SkillEffect11; //0113
	DWORD SkillEffect12; //0117
	DWORD SkillEffect13; //011B
	DWORD SkillEffect14; //011F
	DWORD SkillEffect15; //0123
	DWORD SkillEffect16; //0127
Damage Weapon buff: SkillEffect1 //Blade, Spear, Kat buffs
Faction Buff: SkillEffect2 //Your factions specific buff
Garuda's Prayer: SkillEffect12
Heaven's Shield: SkillEffect10

For the rest of the buffs you'll just have to look at the struct in Ollydebug or Re-Class and use the buff you want to find, the value will be 0 to start with and change to something > 0 after you buff.

So for an Autobuffer you would:

Code:
if(MyChar->SkillEffect1 == 0)
{
     UseSkill(0, 0, 0, DMGBUFFKEY);
}
For autopetfeeder you just need to find your pets current food amount address, read from that with a pointer like below:

Code:
int* currentpetfood = (int*)CURRENTPETFOOD_ADDRESS;
Now you can read how much food your pet currently has active with currentpetfood.

Code:
if(*currentpetfood == 0)
{ 
     yourpetfeedfunctionhere; // its a different function from the Useskill(0,0,0,key) function,  I just remembered I had to find a separate function for this while I was typing it up.
}
Will tell if your pet has no food.

You can just bind a key for pet food to be used from or use the SkillBar struct to read if you have petfood on the skillbar somewhere, it will then use the first stack of petfood found on the skillbar. Just make a function the same as the one I made for reading skills.
Attached Files
File Type: rar Epvpers ts2 rec.rar (1.94 MB, 171 views)
iktov2 is offline  
Thanks
1 User
Old 06/23/2011, 01:35   #4

 
Mega Byte's Avatar
 
elite*gold: 0
Join Date: Dec 2009
Posts: 1,777
Received Thanks: 1,003
Nice work iktov!
Mega Byte is offline  
Old 06/23/2011, 03:19   #5
 
elite*gold: 20
Join Date: Aug 2007
Posts: 1,357
Received Thanks: 1,263
Can't wait to try it out for fun. :P
strikeraid is offline  
Old 06/24/2011, 01:24   #6
 
elite*gold: 0
Join Date: Jul 2010
Posts: 623
Received Thanks: 175
Added sample project with a few small features to 3rd post.
iktov2 is offline  
Old 06/25/2011, 06:03   #7
 
elite*gold: 0
Join Date: Jul 2010
Posts: 623
Received Thanks: 175
Junk? Useful? Would anybody care to have any info on finding the functions, updating addresses ect..?
iktov2 is offline  
Old 06/25/2011, 06:43   #8

 
Mega Byte's Avatar
 
elite*gold: 0
Join Date: Dec 2009
Posts: 1,777
Received Thanks: 1,003
Its useful indeed Remember theres only a few people here that actually understand what all this stuff is lol.

The people who don't should learn. :P
Mega Byte is offline  
Old 06/25/2011, 07:17   #9
 
elite*gold: 20
Join Date: Aug 2007
Posts: 1,357
Received Thanks: 1,263
i think its useful. when you're starting out like I am, it's great to have code like this to see. especially when its code that pertains to the things i want to do. most code or examples in c++ tutorials don't cover things like this.

thanks again for contributing. :P


to be honest, i'm trying to apply this to one of my projects, but pointers are giving me a headache. i figured if i could learn how you and mega are able to find addresses through bytes then i wouldn't have to use pointers anymore. still can't figure it out, but its a work in progress. my physics teacher in high school says learning is in the struggle. i'm struggling like crazy, but its worth it.
strikeraid is offline  
Old 06/25/2011, 16:57   #10

 
Mega Byte's Avatar
 
elite*gold: 0
Join Date: Dec 2009
Posts: 1,777
Received Thanks: 1,003
Heres a couple of address ive found at character select/create
0118AEDC Selected Character
0118AEE4 Pose 0 Standing 1 Unsheath ready to attack 2 3 sword down defensive stance 4

1 3 5 7 are attacking like things
0 2 4 6 are standing still things

0118AEE8 Action Can be set to trigger Game Start
0118AEEC Frame
0118AF00 Direction
0118AEE0 Character Create selected weapon
0118AED8 Sub screen eg char select char create

0118AED4 Character Select Background

2377 = Gyunin Loader
2378 = Madin Loader
2379 = Fujin Loader
2380 = Login Screen
2381 = Server Page 2?
2382 = Server Page 3? or just alterntive login screens.. hmm
2383 = Gyunyuin
2384 = Fujin
2385 = Jinong

With these memory address Things above this by Iktov and the username and password setting in my TSXClient thread a bot can be made that logs in to server selects char and logs into world. Using a dll with no packet sending*by our dll*, only memory modifications and calling game functions YAY

Also I deal with pointers *when coding* a lot like daily.

A pointer is just 4 bytes that point to an address in memory read it as unsigned int look at that in hex and bam thats the address. Or if its in code +EIP + 5 i think or +4 or we depending on size of opcode + paramaters to get address. *for things like CALL and JMP etc*

As for finding things as bytes just find a memory value you want find what reads or writes it. Make a signature from the code and read the memory address from it. Providing the code is simple like MOV EAX,[ADDRESS] you can read between the [] and do some maths to work out the address.

In the case of multi level pointers you just gotta keep going up till you find nothing else referencing it. The cheat engine tutorial covers them :P

good luck :P
Mega Byte is offline  
Old 06/25/2011, 18:45   #11
 
elite*gold: 20
Join Date: Aug 2007
Posts: 1,357
Received Thanks: 1,263
Pointers aren't that big of a deal to me. It's just this 1 address that has been elusive. I can find all other pointers just fine except for this one hahaha. I'm gonna try something different with it today though.
strikeraid is offline  
Old 06/25/2011, 23:58   #12
 
elite*gold: 0
Join Date: Jun 2009
Posts: 42
Received Thanks: 6
Quote:
Originally Posted by iktov2 View Post
Junk? Useful? Would anybody care to have any info on finding the functions, updating addresses ect..?
r u kidding me? for those how want to learn this is like a kid going to a toy store and allows to take out anything he likes for free. well, at least that's how i feel.
andrewfam is offline  
Old 06/26/2011, 00:50   #13

 
Mega Byte's Avatar
 
elite*gold: 0
Join Date: Dec 2009
Posts: 1,777
Received Thanks: 1,003
Ah well it might be in a class and accessed through class pointers. Wazapoo told me that ECX is usually used as a class pointer.

So you can look at the code and work it out by the maths done.
Another thing you can try is find what writes or accesses the variable then look in the window in CE for what accessed it click the line of code you want then click more information then you can see the registers at the time the line was executed so you can work out the pointer that way. It even tells you the pointer it may be.
Mega Byte is offline  
Old 06/26/2011, 01:28   #14
 
elite*gold: 20
Join Date: Aug 2007
Posts: 1,357
Received Thanks: 1,263
Well from what I've analyzed I can see it might not be the pointers being my problem. I think the game stores the information in many different places in the game's memory and each location is pretty much random from the last. I have a couple different level 4 pointers and every time I load the game the information would show up in a couple of those pointers, but it's still random.

I gave up on it. hahah. It wasn't important anyway. It was just the name of the monster, npc, or other player that I click on. Thought it would come in handy for a simple bot that attacks based on names since the IDs were generated randomly.
strikeraid is offline  
Old 06/27/2011, 13:59   #15

 
Mega Byte's Avatar
 
elite*gold: 0
Join Date: Dec 2009
Posts: 1,777
Received Thanks: 1,003
Oh Blax found that a while back so did iktov and me and maybe afterburn im not sure.

Small character struct contains TargetID's after your X Z Y stuff theres like FF FF FF FF TARGETID1 TARGETID2

You can get a pointer to the small char/player update/action/world whatever struct/class easily ^_^ find the 01 00 00 00 for exists its above player name say -25? or -30 i forget got it written down somewhere. Then find what references that by searching its address as 4byte hex ^_^

Its monster and player targets. Theres also values for can attack or is attacking.

You can loop through the data of where monster spawns and item spawns are getting its pointer is much the same. Find the top of the struct/data its an exists 4 byte int 01 00 00 00 if monster or item is there 00 00 00 00 if it is not.

The ItemID or MonsterID is stored in the data theres also 2 unique ID's for these game objects. ive yet to find a relation.
Mega Byte is offline  
Reply


Similar Threads Similar Threads
[RELEASE] TwelveSky 2 - Trainer with various functions
01/09/2013 - 12Sky2 Hacks, Bots, Cheats & Exploits - 99 Replies
http://img142.imageshack.us/img142/2389/capturelaf .jpg http://img20.imageshack.us/img20/2365/capture2ndd. jpg Here is my first release of a simple trainer coded in VB.net (so you need .NET Framework to launch it). Nothing really new, but I coded it for me and I wanted the share it. Use it at your own risk !! use town mode when in town or crowded area. Features: Autopotion Moving speed hack with custom speed and teleport
[Release] Memory based auto functions
01/07/2011 - 12Sky2 Hacks, Bots, Cheats & Exploits - 6 Replies
Hello, Here is my attempt at making some functions witch I hope to eventually make a full Memory based bot out of. Anyways below are the functions I have found so far for Sending Chat and Automating Skill Usage without the need for key presses or a complicated packet based system. With these functions you could make a bot that can work with the game client minimized. With the SkillUse func you could easily make it use AOE based on any factor that you can read from memory, such as...
Tausche ESP + Structs gegen Zombie OPK
11/29/2010 - WarRock - 5 Replies
closed ganz schnell -.-
[Request] Packet Structs
10/14/2008 - CO2 Private Server - 9 Replies
So, has anyone structured the packets for patch 5017? If so, any change you could either post them here or PM them to me? I'm looking for complete structures so I don't need the actual code.



All times are GMT +1. The time now is 19:02.


Powered by vBulletin®
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.
SEO by vBSEO ©2011, Crawlability, Inc.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Support | Contact Us | FAQ | Advertising | Privacy Policy | Terms of Service | Abuse
Copyright ©2025 elitepvpers All Rights Reserved.