TSXClient - DLL Development

[saluege]

Originally Posted by undrog68

If you try the example and get error while debugging or building in line
MessageBox(NULL, "Hello World ", "Test from my DLL" ,NULL);
This error message means that you are trying to pass a multi-byte string (const char [12]) to a function which expects other type.
//Resolution
//You will have to do one of two things:
1.Change your project configuration to use multibyte strings. Press ALT+F7 to open the properties, and navigate to Configuration Properties > General. Look for "Character Set" and Switch to "Use Multi-Byte Character Set".
or
2.Indicate that the string literal, in this case "Hello world!" is of a specific encoding. This can be done through either prefixing it with L, such as L"Hello world!", or surrounding it with the generic _T("Hello world!") macro.
In this example, I prefer the first option.
It changes nothing in the code.
Close settings in our program to those in the program-example.(ie MegaBite's program)

You can see the whole explanation here:

i normally just do MessageBox(null, L"bleh", L"Hello world", MB_OK);

[xenthozismine]

i need wepepro cany chance you can upload it bro and then i would be willing to help i am pretty good with ce but im just learning c++ since i gota teach myself (im still a sophmore in highschool)

[Mega Byte]

google WPE Pro Download

[tri407tiny]

^^

[Mr_Troy22]

Hey, about that speedhack development, have you been able to locate the IAT pointer to QueryPerformanceCounter?

[Mega Byte]

nope im still having troubles with GetTickCount hooking I can hook it but it crashs for some reason.

But the calling convention shouldn't be wrong....

[EDIT]
I tried with QueryPreformanceCounter I couldnt seem to make stuff speed up just yet but I managed to hook it all good just using GetProcAddress(Kernel32,"QueryPerformanceCounter") with MologieDetours
But then again cheat engine does not appear to be speeding up the game with its speed hack either.

[strikeraid]

pictures... awesome. hahaha. i think i'm going to download this page just in case.. keep it for when i learn enough to understand it all. i can read it and understand at around 70% of the stuff. keep going and don't stoppp!! (:

[Mr_Troy22]

Originally Posted by Mega Byte

nope im still having troubles with GetTickCount hooking I can hook it but it crashs for some reason.

But the calling convention shouldn't be wrong....

[EDIT]
I tried with QueryPreformanceCounter I couldnt seem to make stuff speed up just yet but I managed to hook it all good just using GetProcAddress(Kernel32,"QueryPerformanceCounter") with MologieDetours
But then again cheat engine does not appear to be speeding up the game with its speed hack either.

Well my theory is, that QPC isn't used by the game at all. In almost every game I was able to find the IAT pointer in the game's module and hook it except TwelveSky 2, I have tried every way I know and still didn't find it.

[Mega Byte]

Yeah I think your right its only used by nvdvm or something which I think is for my graphics card.

The game has its own timers which manage everything, the game has a few memory addresses that some one found his name escapes me at the moment but he also found out about using the Auto Recovery at npc's

We could breakpoint all the time api's and see whats going on maybe, cheat engine does not speed up the game try MHS prehaps.

The game might even use a pipe and get file info from its last read/write to work out the time?

In any case a api speed hack is not important for this game as we can already attack and movement speed hack. Its just a novetly I was looking into ill test it out on some other games as well as making something that search's the IAT for the functions too.

And thanks for the support guys Ill keep writing this and making it better however its getting to the stage where I have to wait like 3 minutes between edits sometimes. Im thinking of moving it to google docs and just leaving the topic for replys,questions etc.

Google docs also = superior to edit with.

The knowledge you learn from finding the stuff im showing here can be applied to a great deal of hacks and things If anyone finds bits hard that I could explain more on let me know.

Oh also in cheat engine read everything in the help file THERE is some really good stuff in there.

[Mr_Troy22]

I used to know how to edit the game's own speed, I learned that from 12sky1. But since 12sky1 got closed I removed all my notes, and I had tested them all on TS2 as well and I remember speedhack being one of the stuff that still worked. I forgot how I found it lol

[Mega Byte]

Yeah it defiantly exists.
There is infact a DWORD after screen address which gets +1 each game step. i wonder if thats something to do with it as it appears to be used for keep alive packets at login and world.

Anyway I have now reached the character limit of 100000 characters per post. So I will be migrating this document to Google Docs sometime.

I also learnt something new *to me* in ollydbg's CPU window you can press : and type a label.
So like at the top of a game function you can go : ShowInformation or : DisplayChatMessage etc... whatever you want. Then you can go Ctrl+G and type in the same thing to goto it.
You can also easily see when you click on lines of asm in the function the offset from the start. Useful for finding +'s to add onto FindPattern's result when you want to read addresses, or patch bytes.

I also found out about right clicking on a game function then clicking Hit Trace and clicking Add Procedure. Allowing you to see all lines of asm that are triggered. Usefull to find call's to things between jumps when certain conditions are met and you dont want F8 through everything, or when its a time critical thing. Like you dont wanna F8 as you will get disconnected or something.

Theres also right click Copy | Select Procedure Rightclick Copy to clipboard or to file
and you can save backups of memory. Im not too sure what the backing up of memory does I assume you can save changes you make to code sections then load them in when you want. For example when restarting the exe your code changes are removed so you can load them back in.

Hope you guys enjoy what ive written so far and that you can see the potential to be gained from learning this kinda stuff

[strikeraid]

Yea, I think I'm getting used to writing out basic DLL structures now. Thanks again. (:

[Wazapoo]

The games speed is controlled by a float at address 0x00560730, it is 0.03 by default. The bigger it gets the slower game, the smaller the faster everything is. It controls a float that I think is the main time counter, its at address 0x00586B94.

[Mega Byte]

Thanks Wazapoo, Also ive began tracing back the keyboard functions *traced back from send on Sheath Weapon space bar* further traced it back up to game step and game loop.

The goal to find AD and up down left right to change to WASDQE movement similar to other top mmo's.

Here are my labels in ollydbg
HandleKeyboardInput 00454480
UnsheathWeapon 00459130
SheathWeapon 00459250
ManageGameKey 0045EA50
ManageKeyAction 00473620
ManageGUIKey 004B8C20

GameInit 00402A40
GameStep 00403380

DisplayChatMessage 005236F0
ShowNotice 004B9A30

In HandleKeyboardInput there is something to handle A and D its separate to GUI management I believe its closer to the top near all the float functions and stuff. When I find it I will call it ManageCameraKey

I will also further investigate to find the keyboard input array from DirectInput that we can use to simulate any keyboard event and have the game handle it as if it were real. I know theres a pointer to it somewhere too near the window info as we have stumbled upon it before.

[Mr_Troy22]

Originally Posted by Wazapoo

The games speed is controlled by a float at address 0x00560730, it is 0.03 by default. The bigger it gets the slower game, the smaller the faster everything is. It controls a float that I think is the main time counter, its at address 0x00586B94.

Yeah, 0x00586B94 is the main time counter. I have experimented with it though I never had the ability to set breakpoints.