[Release] GR Autolooter

Page 19 of 27

06/08/2014 10:33 kellerkind123456#271

Quote:

Originally Posted by buFFy!

A working solution is posted, its your job to undertand it

I want to create it on my own, but I'm not a good programmer.
I understand only a little vb and that's 20 years ago. :)

If I use:

Code:

$finaladdr=_memoryread(_memoryscan($open,"FF 50 1C 85 C0 74 1B")-4,$open,"dword")+0x67

I get 103 as finaladdr. Think this is wrong isn�t it?

[Only registered and activated users can see links. Click Here To Register...]

06/09/2014 14:40 xoraxax#272

Assume that _memoryread works properly and our pattern is right - that means _memoryscan returns you the wrong result (pretty obvious right?) How to fix it?

Let's take a look at the function signature:

Code:

Func _memoryscan($ah_handle, $pattern, $after = False, $iv_addrstart = 01000000, $iv_addrend = 0x02000000, $step = 51200)

The interesting thing is scan range (addrstart to addrend)

06/09/2014 16:51 kellerkind123456#273

Quote:
Originally Posted by xoraxax
Assume that _memoryread works properly and our pattern is right - that means _memoryscan returns you the wrong result (pretty obvious right?) How to fix it?

Let's take a look at the function signature:
Code:
Func _memoryscan($ah_handle, $pattern, $after = False, $iv_addrstart = 01000000, $iv_addrend = 0x02000000, $step = 51200)
The interesting thing is scan range (addrstart to addrend)

Yes, that was my thought too.
I�ve made a debug msgbox to see the values of the vars, the function "_MemoryScan" returns -3 and no address.

Again, one step further ;)

Update:
Got it! Thank you.
"addrstart" to "addrend" in func _memoryscan was the key. :D

06/13/2014 19:38 sifkal#274

so one nub question anyone got working script ?

06/14/2014 18:19 xoraxax#275

There is everything you need to make it by yourself. Even with comments.

06/16/2014 15:44 kellerkind123456#276

Quote:

Originally Posted by sifkal

so one nub question anyone got working script ?

Quote:

Originally Posted by xoraxax

There is everything you need to make it by yourself. Even with comments.

Yes, it�s all here. I�m using [Only registered and activated users can see links. Click Here To Register...] since 10 days.
With the help of Buffy and Xoraxas I have created a running autolooter with Autoit.

This is the base program from Xoraxas:

Quote:

Originally Posted by xoraxax

AutoIt

Spoiler

Code:

#RequireAdmin
#Region
	#AutoIt3Wrapper_Icon=1.ico
	#AutoIt3Wrapper_OutFile=autolooter.exe
	#AutoIt3Wrapper_UseUpx=n
#EndRegion
Global Const $gui_event_close = -3
Global Const $ws_minimizebox = 131072
Global Const $ws_sysmenu = 524288
Global Const $ws_caption = 12582912
Global Const $ws_popup = -2147483648
Global Const $gui_ss_default_gui = BitOR($ws_minimizebox, $ws_caption, $ws_popup, $ws_sysmenu)

Func _memoryopen($iv_pid, $iv_desiredaccess = 2035711, $iv_inherithandle = 1)
	If NOT ProcessExists($iv_pid) Then
		SetError(1)
		Return 0
	EndIf
	Local $ah_handle[2] = [DllOpen("kernel32.dll")]
	If @error Then
		SetError(2)
		Return 0
	EndIf
	Local $av_openprocess = DllCall($ah_handle[0], "int", "OpenProcess", "int", $iv_desiredaccess, "int", $iv_inherithandle, "int", $iv_pid)
	If @error Then
		DllClose($ah_handle[0])
		SetError(3)
		Return 0
	EndIf
	$ah_handle[1] = $av_openprocess[0]
	Return $ah_handle
EndFunc

Func _memoryread($iv_address, $ah_handle, $sv_type = "dword")
	If NOT IsArray($ah_handle) Then
		SetError(1)
		Return 0
	EndIf
	Local $v_buffer = DllStructCreate($sv_type)
	If @error Then
		SetError(@error + 1)
		Return 0
	EndIf
	DllCall($ah_handle[0], "int", "ReadProcessMemory", "int", $ah_handle[1], "int", $iv_address, "ptr", DllStructGetPtr($v_buffer), "int", DllStructGetSize($v_buffer), "int", "")
	If NOT @error Then
		Local $v_value = DllStructGetData($v_buffer, 1)
		Return $v_value
	Else
		SetError(6)
		Return 0
	EndIf
EndFunc

Func _memoryclose($ah_handle)
	If NOT IsArray($ah_handle) Then
		SetError(1)
		Return 0
	EndIf
	DllCall($ah_handle[0], "int", "CloseHandle", "int", $ah_handle[1])
	If NOT @error Then
		DllClose($ah_handle[0])
		Return 1
	Else
		DllClose($ah_handle[0])
		SetError(2)
		Return 0
	EndIf
EndFunc

Func setprivilege($privilege, $benable)
	Const $token_adjust_privileges = 32
	Const $token_query = 8
	Const $se_privilege_enabled = 2
	Local $htoken, $sp_auxret, $sp_ret, $hcurrprocess, $ntokens, $ntokenindex, $priv
	$ntokens = 1
	$luid = DllStructCreate("dword;int")
	If IsArray($privilege) Then $ntokens = UBound($privilege)
	$token_privileges = DllStructCreate("dword;dword[" & (3 * $ntokens) & "]")
	$newtoken_privileges = DllStructCreate("dword;dword[" & (3 * $ntokens) & "]")
	$hcurrprocess = DllCall("kernel32.dll", "hwnd", "GetCurrentProcess")
	$sp_auxret = DllCall("advapi32.dll", "int", "OpenProcessToken", "hwnd", $hcurrprocess[0], "int", BitOR($token_adjust_privileges, $token_query), "int*", 0)
	If $sp_auxret[0] Then
		$htoken = $sp_auxret[3]
		DllStructSetData($token_privileges, 1, 1)
		$ntokenindex = 1
		While $ntokenindex <= $ntokens
			If IsArray($privilege) Then
				$priv = $privilege[$ntokenindex - 1]
			Else
				$priv = $privilege
			EndIf
			$ret = DllCall("advapi32.dll", "int", "LookupPrivilegeValue", "str", "", "str", $priv, "ptr", DllStructGetPtr($luid))
			If $ret[0] Then
				If $benable Then
					DllStructSetData($token_privileges, 2, $se_privilege_enabled, (3 * $ntokenindex))
				Else
					DllStructSetData($token_privileges, 2, 0, (3 * $ntokenindex))
				EndIf
				DllStructSetData($token_privileges, 2, DllStructGetData($luid, 1), (3 * ($ntokenindex - 1)) + 1)
				DllStructSetData($token_privileges, 2, DllStructGetData($luid, 2), (3 * ($ntokenindex - 1)) + 2)
				DllStructSetData($luid, 1, 0)
				DllStructSetData($luid, 2, 0)
			EndIf
			$ntokenindex += 1
		WEnd
		$ret = DllCall("advapi32.dll", "int", "AdjustTokenPrivileges", "hwnd", $htoken, "int", 0, "ptr", DllStructGetPtr($token_privileges), "int", DllStructGetSize($newtoken_privileges), "ptr", DllStructGetPtr($newtoken_privileges), "int*", 0)
		$f = DllCall("kernel32.dll", "int", "GetLastError")
	EndIf
	$newtoken_privileges = 0
	$token_privileges = 0
	$luid = 0
	If $sp_auxret[0] = 0 Then Return 0
	$sp_auxret = DllCall("kernel32.dll", "int", "CloseHandle", "hwnd", $htoken)
	If NOT $ret[0] AND NOT $sp_auxret[0] Then Return 0
	Return $ret[0]
EndFunc

$autolooter = GUICreate("Autolooter", 200, 80, 254, 266, $gui_ss_default_gui)
$btn = GUICtrlCreateButton("Turn Off", 40, 8, 113, 33)
$l1 = GUICtrlCreateLabel("0", 20, 45)
$l2 = GUICtrlCreateLabel("0", 50, 45)
$state = GUICtrlCreateLabel("Waiting Process", 100, 45)
$clicker_enabled_l = GUICtrlCreateLabel("Clicker Enabled", 20, 65)
$clicker_key_l = GUICtrlCreateLabel("Key:                                   ", 100, 65)
GUISetState(@SW_SHOW)
setprivilege("SeDebugPrivilege", 1)
$k = IniRead("autolooter.ini", "main", "key", "f")
$clicker_enabled = IniRead("autolooter.ini", "main", "clicker_enabled", "1")
If $clicker_enabled <> 1 Then GUICtrlSetData($clicker_enabled_l, "Clicker Disabled")
$clicker_key = IniRead("autolooter.ini", "main", "clicker_key", "{NUMPAD0}")
GUICtrlSetData($clicker_key_l, "Key: " & $clicker_key)
$pid = 0
While $pid = 0
	$nmsg = GUIGetMsg()
	Switch $nmsg
		Case $gui_event_close
			Exit
	EndSwitch
	$pid = ProcessExists("Gw2.exe")
WEnd

Func _memoryscan($ah_handle, $pattern, $after = False, $iv_addrstart = 4194304, $iv_addrend = 16777215, $step = 51200)
	If NOT IsArray($ah_handle) Then
		SetError(1)
		Return -1
	EndIf
	$pattern = StringRegExpReplace($pattern, "[^0123456789ABCDEFabcdef.]", "")
	If StringLen($pattern) = 0 Then
		SetError(2)
		Return -2
	EndIf
	For $addr = $iv_addrstart To $iv_addrend Step $step-(StringLen($pattern) / 2)
		StringRegExp(_memoryread($addr, $ah_handle, "byte[" & $step & "]"), $pattern, 1, 2)
		If NOT @error Then
			If $after Then
				Return StringFormat("0x%.8X", $addr + ((@extended - 2) / 2))
			Else
				Return StringFormat("0x%.8X", $addr + ((@extended - StringLen($pattern) - 2) / 2))
			EndIf
		EndIf
	Next
	Return -3
EndFunc

GUICtrlSetData($state, "Process Found")
$open = _memoryopen($pid)
$enabled = True
$ffa = _memoryread(2 + _memoryscan($open, "C7 05 .. .. .. .. 01 00 00 00 C3 A1"), $open, "dword")
$t1 = 11 + _memoryscan($open, "85 C0 74 05 E8 .. .. .. .. 57 E8 .. .. .. .. 8B 10")
$t2 = _memoryread($t1, $open, "dword")
$t1 = $t1 + 4
$t1 = $t1 + $t2
$ttt = _memoryread(1 + $t1, $open, "dword")
$ttt = $ttt + 103
$finaladdr = $ttt
HotKeySet("{f9}", "flip")

Func flip()
	$enabled = NOT $enabled
	If $enabled Then
		GUICtrlSetData($btn, "Turn Off")
	Else
		GUICtrlSetData($btn, "Turn On")
	EndIf
EndFunc

HotKeySet($clicker_key, "mc")

Func mc()
	If $clicker_enabled = 1 Then MouseClick("left")
EndFunc

While 1
	If $enabled Then
		$r=WinActive("[CLASS:ArenaNet_Dx_Window_Class]")
		if not $r then 	GUICtrlSetBkColor($state, 0xFF0000)
		If $r Then
			GUICtrlSetBkColor($state, 0x00FF00)
			$r = _memoryread($finaladdr, $open)
			GUICtrlSetData($l1, $r)
			If $r = 64 Then
				$r = _memoryread($ffa, $open)
				GUICtrlSetData($l2, $r)
				If $r = 0 Then
					Send($k)
					Sleep(50)
				EndIf
			EndIf
		EndIf
	EndIf
	$nmsg = GUIGetMsg()
	Switch $nmsg
		Case $gui_event_close
			ExitLoop
		Case $btn
			flip()
	EndSwitch
	$pid = ProcessExists("Gw2.exe")
	If $pid = 0 Then ExitLoop
WEnd
_memoryclose($open)

... and his last autolooter update before the last GW2 patch

Quote:

Originally Posted by xoraxax

Spoiler

this stuff works for me now (assemble it with my last program)

Buffy gave this tip:

Quote:
Originally Posted by buFFy!
Just do the following..
Code:
byte sigAsContext[] = { 0xFF, 0x50, 0x1C, 0x85, 0xC0, 0x74, 0x1B };

Xoraxax adapted it:

Quote:
Originally Posted by xoraxax
This is what Buffy said:
Code:
$finaladdr=_memoryread(_memoryscan($open,"FF 50 1C 85 C0 74 1B")-4,$open,"dword")+0x67
Thank you, very usefull.

... and and gave me the last hint:

Quote:
Originally Posted by xoraxax
Assume that _memoryread works properly and our pattern is right - that means _memoryscan returns you the wrong result (pretty obvious right?) How to fix it?

Let's take a look at the function signature:
Code:
Func _memoryscan($ah_handle, $pattern, $after = False, $iv_addrstart = 01000000, $iv_addrend = 0x02000000, $step = 51200)
--> The interesting thing is scan range (addrstart to addrend) <--

;)

06/16/2014 20:27 torresmo01#277

awesome thx ;)

07/05/2014 21:15 Majin PaiN#278

+++

07/06/2014 00:36 longtianchi#279

thk

07/10/2014 14:09 kellerkind123456#280

As a thank you for the help here in the forum, I present you a working Autolooter.
If the lootaddress changes after an update, it can be adjusted in the GW2_Autoloot.ini.
The GW2_Autoloot.ini is created automatically after the first start of the program.

You can find the autoloot address with [Only registered and activated users can see links. Click Here To Register...].
- Just kill a NPC, if it dropped loot search for the value BYTE 64 in Cheat Engine.
- Go away and search again for DECREASED VALUE.
- Go closer again to the loot and search again vor the EXACT VALUE 64
- Do the steps above again till you got a unique lootaddress
- Edit GW2_Autoloot.ini and change the "lootadress"

... have fun ;)

Spoiler

Code:

#RequireAdmin
#Region
#AutoIt3Wrapper_Icon=gw2.ico
#AutoIt3Wrapper_Outfile=GW2_Autoloot.exe
#AutoIt3Wrapper_UseUpx=y
#AutoIt3Wrapper_UseX64=n
#AutoIt3Wrapper_Res_Description=Guild Wars 2 Autoloot
#AutoIt3Wrapper_Res_Fileversion=1.0.0.0
#EndRegion
Global $GUI_EVENT_CLOSE=-3, $pid = 0, $open=0, $loot = 0
$Admin = IsAdmin()
If $Admin <> 1 Then
	MsgBox(0x30, "ERROR", "You must run this app as Administrator!")
	Exit
EndIf

Opt("TrayMenuMode", 3)
$Exit = TrayCreateItem("Exit")

If Not FileExists("GW2_Autoloot.ini") Then
	IniWrite("GW2_Autoloot.ini", "main", "lootkey", "f")
	IniWrite("GW2_Autoloot.ini", "main", "lootadress", "0x0151FF47")
Else
	$lootkey = IniRead("GW2_Autoloot.ini", "main", "lootkey", "f")
	$lootaddr_ini = IniRead("GW2_Autoloot.ini", "main", "lootadress", "")
EndIf

$GW2Tool = GUICreate("Autoloot", 180, 40, -1, -1)
$Checkbox1 = GUICtrlCreateCheckbox(" Autoloot", 10, 10)
	GUICtrlSetTip(-1, "Automatically collects bags, boxes, etc.")
GUICtrlSetState($Checkbox1, 128)
GUISetState(@SW_SHOW)

While $pid = 0
	Switch GUIGetMsg()
		Case $GUI_EVENT_CLOSE
			CleanUp()
	EndSwitch
	Switch TrayGetMsg()
		Case $Exit
			CleanUp()
	EndSwitch
	$pid = ProcessExists("Gw2.exe")
WEnd

GUICtrlSetState($Checkbox1, 64)
SetPrivilege("SeDebugPrivilege", 1)
$open = _MemoryOpen($pid)
$baseAddr = _MemoryModuleGetBaseAddress($pid, "Gw2.exe")
$lootaddr = $baseAddr + $lootaddr_ini

While 1
	If GUICtrlRead($Checkbox1) = 1 Then
		If WinActive("[CLASS:ArenaNet_Dx_Window_Class]") Then
			$loot = _MemoryRead($lootaddr, $open)
			If $loot = 64 Then
				ControlSend("","",0,$lootkey)
				Sleep(20)
			EndIf
		EndIf
	EndIf
	Switch GUIGetMsg()
		Case $GUI_EVENT_CLOSE
			CleanUp()
	EndSwitch
	Switch TrayGetMsg()
		Case $Exit
			CleanUp()
	EndSwitch
	$pid = ProcessExists("Gw2.exe")
	If $pid = 0 Then CleanUp()
WEnd

Func _MemoryOpen($iv_Pid, $iv_DesiredAccess = 0x1F0FFF, $if_InheritHandle = 1)
	If Not ProcessExists($iv_Pid) Then
		SetError(1)
        Return 0
	EndIf
	Local $ah_Handle[2] = [DllOpen('kernel32.dll')]
	If @Error Then
        SetError(2)
        Return 0
    EndIf
	Local $av_OpenProcess = DllCall($ah_Handle[0], 'int', 'OpenProcess', 'int', $iv_DesiredAccess, 'int', $if_InheritHandle, 'int', $iv_Pid)
	If @Error Then
        DllClose($ah_Handle[0])
        SetError(3)
        Return 0
    EndIf
	$ah_Handle[1] = $av_OpenProcess[0]
	Return $ah_Handle
EndFunc

Func _MemoryRead($iv_Address, $ah_Handle, $sv_Type = 'dword')
	If Not IsArray($ah_Handle) Then
		SetError(1)
        Return 0
	EndIf
	Local $v_Buffer = DllStructCreate($sv_Type)
	If @Error Then
		SetError(@Error + 1)
		Return 0
	EndIf
	DllCall($ah_Handle[0], 'int', 'ReadProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
	If Not @Error Then
		Local $v_Value = DllStructGetData($v_Buffer, 1)
		Return $v_Value
	Else
		SetError(6)
        Return 0
	EndIf
EndFunc

Func _MemoryClose($ah_Handle)
	If Not IsArray($ah_Handle) Then
		SetError(1)
        Return 0
	EndIf
	DllCall($ah_Handle[0], 'int', 'CloseHandle', 'int', $ah_Handle[1])
	If Not @Error Then
		DllClose($ah_Handle[0])
		Return 1
	Else
		DllClose($ah_Handle[0])
		SetError(2)
        Return 0
	EndIf
EndFunc

Func SetPrivilege( $privilege, $bEnable )
    Const $TOKEN_ADJUST_PRIVILEGES = 0x0020
    Const $TOKEN_QUERY = 0x0008
    Const $SE_PRIVILEGE_ENABLED = 0x0002
    Local $hToken, $SP_auxret, $SP_ret, $hCurrProcess, $nTokens, $nTokenIndex, $priv
    $nTokens = 1
    $LUID = DLLStructCreate("dword;int")
    If IsArray($privilege) Then    $nTokens = UBound($privilege)
    $TOKEN_PRIVILEGES = DLLStructCreate("dword;dword[" & (3 * $nTokens) & "]")
    $NEWTOKEN_PRIVILEGES = DLLStructCreate("dword;dword[" & (3 * $nTokens) & "]")
    $hCurrProcess = DLLCall("kernel32.dll","hwnd","GetCurrentProcess")
    $SP_auxret = DLLCall("advapi32.dll","int","OpenProcessToken","hwnd",$hCurrProcess[0],   _
            "int",BitOR($TOKEN_ADJUST_PRIVILEGES,$TOKEN_QUERY),"int*",0)
    If $SP_auxret[0] Then
        $hToken = $SP_auxret[3]
        DLLStructSetData($TOKEN_PRIVILEGES,1,1)
        $nTokenIndex = 1
        While $nTokenIndex <= $nTokens
            If IsArray($privilege) Then
                $priv = $privilege[$nTokenIndex-1]
            Else
                $priv = $privilege
            EndIf
            $ret = DLLCall("advapi32.dll","int","LookupPrivilegeValue","str","","str",$priv,   _
                    "ptr",DLLStructGetPtr($LUID))
            If $ret[0] Then
                If $bEnable Then
                    DLLStructSetData($TOKEN_PRIVILEGES,2,$SE_PRIVILEGE_ENABLED,(3 * $nTokenIndex))
                Else
                    DLLStructSetData($TOKEN_PRIVILEGES,2,0,(3 * $nTokenIndex))
                EndIf
                DLLStructSetData($TOKEN_PRIVILEGES,2,DllStructGetData($LUID,1),(3 * ($nTokenIndex-1)) + 1)
                DLLStructSetData($TOKEN_PRIVILEGES,2,DllStructGetData($LUID,2),(3 * ($nTokenIndex-1)) + 2)
                DLLStructSetData($LUID,1,0)
                DLLStructSetData($LUID,2,0)
            EndIf
            $nTokenIndex += 1
        WEnd
        $ret = DLLCall("advapi32.dll","int","AdjustTokenPrivileges","hwnd",$hToken,"int",0,   _
                "ptr",DllStructGetPtr($TOKEN_PRIVILEGES),"int",DllStructGetSize($NEWTOKEN_PRIVILEGES),   _
                "ptr",DllStructGetPtr($NEWTOKEN_PRIVILEGES),"int*",0)
        $f = DLLCall("kernel32.dll","int","GetLastError")
    EndIf
    $NEWTOKEN_PRIVILEGES=0
    $TOKEN_PRIVILEGES=0
    $LUID=0
    If $SP_auxret[0] = 0 Then Return 0
    $SP_auxret = DLLCall("kernel32.dll","int","CloseHandle","hwnd",$hToken)
    If Not $ret[0] And Not $SP_auxret[0] Then Return 0
    return $ret[0]
EndFunc

Func _MemoryModuleGetBaseAddress($iPID, $sModule)
    If Not ProcessExists($iPID) Then Return SetError(1, 0, 0)
    If Not IsString($sModule) Then Return SetError(2, 0, 0)
    Local   $PSAPI = DllOpen("psapi.dll")
    Local   $hProcess
    Local   $PERMISSION = BitOR(0x0002, 0x0400, 0x0008, 0x0010, 0x0020)
    If $iPID > 0 Then
        Local $hProcess = DllCall("kernel32.dll", "ptr", "OpenProcess", "dword", $PERMISSION, "int", 0, "dword", $iPID)
        If $hProcess[0] Then
            $hProcess = $hProcess[0]
        EndIf
    EndIf
    Local   $Modules = DllStructCreate("ptr[1024]")
    Local   $aCall = DllCall($PSAPI, "int", "EnumProcessModules", "ptr", $hProcess, "ptr", DllStructGetPtr($Modules), "dword", DllStructGetSize($Modules), "dword*", 0)
    If $aCall[4] > 0 Then
        Local   $iModnum = $aCall[4] / 4
        Local   $aTemp
        For $i = 1 To $iModnum
            $aTemp =  DllCall($PSAPI, "dword", "GetModuleBaseNameW", "ptr", $hProcess, "ptr", Ptr(DllStructGetData($Modules, 1, $i)), "wstr", "", "dword", 260)
            If $aTemp[3] = $sModule Then
                DllClose($PSAPI)
                Return Ptr(DllStructGetData($Modules, 1, $i))
            EndIf
        Next
    EndIf
    DllClose($PSAPI)
    Return SetError(-1, 0, 0)
EndFunc

Func CleanUp()
	_MemoryClose($open)
	Exit
EndFunc

Updated: 16.7.2014

07/11/2014 09:57 xoraxax#281

FF 51 20 C7 05 .. .. .. .. 00 00 00 00

This is a pattern for a chat flag (1 if chat is active, 0 otherwise)

07/12/2014 16:37 T�maaaa#282

does it work ?

07/12/2014 20:31 xoraxax#283

it does

07/16/2014 19:47 kellerkind123456#284

New Lootaddress: 0x0151FF47

07/16/2014 19:50 sifkal#285

Page 19 of 27

« First

Last »