[GUIDE] How to find offsets with Cheat Engine

Page 2 of 3

07/08/2013 00:58 dumbfck#16

Quote:

Originally Posted by ntldr32

ty for magic word "static" XD, I found a lot of static addresses that can be used as a reference to determine the connection game. However, by using a value of 1 as a reference to the current connection and 0 for disconnection, I think maybe this is 00C1D758 exact address. I'm not sure either, but so far it works fine, .. thank muah ... XD, :handsdown::handsdown::handsdown:

0xC1D758 is the correct static offset, but since you asked, here is the 'disconnect from server' window offset and how to find it. The static offset will definitely change when elementclient is updated. This offset chain has a better chance of remaining intact (although GUI stuff does sometimes change with bigger updates)

Code:

[[[[[[[baseCall]+0x1C]+0x18]+0x8]+0xC4]+0x798]+0x90]
(1 byte)

0x798 is the base for the window object, 0x90 is the flag that says if the dialogue is active.

Also you are correct that my GUI mapper didn't work for this. I need to look into why that is. (Although the GUI mapper does mostly work with updated base address... and child objects work if you replace all instances of 0x1C4 with 0x1C8).

But for easy future reference if for some reason this offset changes, here's how to find it.

Possibly the two most useful GUI system offsets are:

Code:

[[[[[baseCall]+0x1C]+0x18]+0x8]+0x254]
and
[[[[[baseCall]+0x1C]+0x18]+0x8]+0x258]

They show which GUI dialogue window you are hovering over and the child control of that object (respectively).
Load those offsets into Cheat Engine and then pull out your ethernet cable or otherwise disable your internet so the game disco's.
Now hover over the "Disconnected from server" window and write down the value in the first (0x254) offset.
In CE, add this address manually, then right click it and 'Find out what accesses this address'.
Just click on the first one (or any of them really) and click 'More information'.
It'll look something like this:

[Only registered and activated users can see links. Click Here To Register...]

Look at the instruction above the red one (with the edi*4 in it) which is the one that references the dialogue object from the dialogue list - So just take the value of EDI and multiply it by 4.
In this case, that's 0x1E6 * 4 = 0x798
Then just take my word for it (or see some of my other GUI posts) that 0x90 is the flag that indicates if a dialogue is 'open'.
The list of dialogue objects is at (and has been for a long time)

Code:

[[[[[baseCall]+0x1C]+0x18]+0x8]+0xC4]

So just add the window offset at the 'visible' flag and that gives us:

Code:

[[[[[[[baseCall]+0x1C]+0x18]+0x8]+0xC4]+0x798]+0x90]

Magic :D

07/08/2013 18:39 ntldr32#17

i have another question guys,..
i made(or maybe translate) BuildInventoryArray function into VB.net,

PHP Code:


			
Imports Perfect_World.NomadMemory

Imports Perfect_World.offset

Public Class global_function

    Public Shared Sub BuildInventoryArray()

        Dim pointer_address = _MemoryRead(CHAR_DATA_BASE + OFFSET_INVENTORYBASE(1), PROCESS_INFORMATION) + 12

        Dim pointer = _MemoryRead(pointer_address, PROCESS_INFORMATION)

        Dim inventory_base

        For i As Integer = 0 To inventorysize() - 1

            On Error Resume Next

            inventory_base = _MemoryRead(pointer + i * 4, PROCESS_INFORMATION)

            Dim itm As ListViewItem

            Dim l_item(7) As String

            l_item(0) = _MemoryRead(inventory_base, PROCESS_INFORMATION)

            l_item(1) = _MemoryRead(inventory_base + OFFSET_INVENTORYSTACKAMOUNT, PROCESS_INFORMATION)

            l_item(2) = _MemoryRead(inventory_base + OFFSET_INVENTORYMAXSTACKAMOUNT, PROCESS_INFORMATION)

            l_item(3) = _MemoryRead(inventory_base + OFFSET_INVENTORYSELLPRICE, PROCESS_INFORMATION)

            l_item(4) = _MemoryRead(inventory_base + OFFSET_INVENTORYBUYPRICE, PROCESS_INFORMATION)

            l_item(5) = _MemoryRead(inventory_base + OFFSET_INVENTORYID, PROCESS_INFORMATION)

            Dim item_string As String

            Dim item_name As String

            item_string = _MemoryRead_Unicode(_MemoryRead(inventory_base + OFFSET_INVENTORYDESCRIPTION, PROCESS_INFORMATION), PROCESS_INFORMATION, 500, 500)

            If item_string.Length = 0 Then

                item_name = ""

            Else

                item_name = item_string.Split("\r")(0).Remove(0, 7)

            End If

            l_item(6) = item_name

            itm = New ListViewItem(l_item)

            Form1.list_inventory.Items.Add(itm)

        Next

    End Sub

    Public Shared Function inventorysize() As Integer

        Dim inventorysize_address As Integer = _MemoryRead(CHAR_DATA_BASE + OFFSET_INVENTORYBASE(1), PROCESS_INFORMATION) + 16

        Dim I_size As Integer = _MemoryRead(inventorysize_address, PROCESS_INFORMATION)

        Return I_size

    End Function



End Class

all works fine, but i need something, that missing, i need offset for subtype,. so i can filter only the potion to be show.
for example healing potion have subtype 1795, i just want want to show item with subtype 1795(healing potion) that exist in inventory, idk ow to find it with CE, so i try my luck by loop read

PHP Code:


			
Dim sub_tipe As Integer

Dim OFFSET_INVENTORY_SUBTYPE_ID As Integer = 0

While sub_tipe <> 1795

    OFFSET_INVENTORY_SUBTYPE_ID = OFFSET_INVENTORYID + 1

    sub_tipe = _MemoryRead(inventory_base + OFFSET_INVENTORY_SUBTYPE_ID, PROCESS_INFORMATION)

End While

the loop stop when OFFSET_INVENTORY_SUBTYPE_ID = 2394420
so i think that value could be the offset for item sub type. but after relog, it show another value,.. qq. i give up, and i come here and ask for the exact item subtype offset XD,..

07/08/2013 23:34 dumbfck#18

Your loop search code doesn't seem to actually be doing much:

Code:

[COLOR=#000000][COLOR=#007700]While [/COLOR][COLOR=#0000BB]sub_tipe [/COLOR][COLOR=#007700]<> [/COLOR][COLOR=#0000BB]1795 
    OFFSET_INVENTORY_SUBTYPE_ID [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]OFFSET_INVENTORYID [/COLOR][COLOR=#007700]+ [/COLOR][COLOR=#0000BB]1 
    sub_tipe [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]_MemoryRead[/COLOR][COLOR=#007700]([/COLOR][COLOR=#0000BB]inventory_base [/COLOR][COLOR=#007700]+ [/COLOR][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID[/COLOR][COLOR=#007700], [/COLOR][COLOR=#0000BB]PROCESS_INFORMATION[/COLOR][COLOR=#007700]) 
[/COLOR][COLOR=#0000BB]End [/COLOR][COLOR=#007700]While 
[/COLOR][/COLOR]

because you're not actually incrementing anything. If you know the base address for a struct (for example, an item), you'd want to do something like this:
(By the way, I am assuming that what you are calling inventory_base is actually an item base within the inventory? I didn't check the whole code and my VB is a bit rusty)

Code:

[COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID [/COLOR][COLOR=#007700]= inventory_base
[/COLOR][/COLOR]While [/COLOR][COLOR=#0000BB]sub_tipe [/COLOR][COLOR=#007700]<> [/COLOR][COLOR=#0000BB]1795 
    [/COLOR][/COLOR][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID = [/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID + 4[/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][COLOR=#0000BB]
    sub_tipe [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]_MemoryRead[/COLOR][COLOR=#007700]([/COLOR][COLOR=#0000BB]inventory_base [/COLOR][COLOR=#007700]+ [/COLOR][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID[/COLOR][COLOR=#007700], [/COLOR][COLOR=#0000BB]PROCESS_INFORMATION[/COLOR][COLOR=#007700]) 
[/COLOR][COLOR=#0000BB]End [/COLOR][COLOR=#007700]While 
[/COLOR]

And you'd probably want a condition in there so that it won't search forever if it doesn't find it, e.g., a set amount of memory to search.

Code:

[COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID [/COLOR][COLOR=#007700]= inventory_base
[/COLOR][/COLOR]While [/COLOR][COLOR=#0000BB]sub_tipe [/COLOR][COLOR=#007700]<> [/COLOR][COLOR=#0000BB]1795 _
And [/COLOR][/COLOR][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID < (inventory_base + 0x1000[/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR])
[/COLOR][/COLOR][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID = [/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID + 4[/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][COLOR=#0000BB]
    sub_tipe [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]_MemoryRead[/COLOR][COLOR=#007700]([/COLOR][COLOR=#0000BB]inventory_base [/COLOR][COLOR=#007700]+ [/COLOR][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID[/COLOR][COLOR=#007700], [/COLOR][COLOR=#0000BB]PROCESS_INFORMATION[/COLOR][COLOR=#007700]) 
[/COLOR][COLOR=#0000BB]End [/COLOR][COLOR=#007700]While 
[/COLOR]

However - You're better off searching in CE first then coding the correct offset into your program lol.
If you know the base address of an item, then do a normal search in CE but set the start address as the base of the item and set the end address at, say, 0x1000 above that. So if the item base address is 0x02345678 and the value you are searching for is 1795 (decimal) then:
Search for 1795 (hex box UNchecked)
Start address 0x02345678
End address 0x02346678

Those offsets are not static so they will change after a relog - That's why we reference offsets using chains starting from the base address.

Sorry, I don't have my hax computer on at the moment and it takes forever to warm up otherwise I would have just found the offset. But hey, teach a man to fish and all that ;)

07/09/2013 12:05 ntldr32#19

Quote:

Originally Posted by dumbfck

Your loop search code doesn't seem to actually be doing much

hehehe, i call that loop as 'LUCKY LOOP' but the relust isnt luck at all, only get the fisrt condition,.. ill try use CE now XD

no luck, still cant find that offset for subtype, the value from address range {inventory_base} to {inventory_base + Xnumber} not given a satisfactory results,.
i think maybe the value for subtype not stored on inventory base range address, but maybe stored in somewhere else where the client call that value by linking it with the item id on inventory. Anyway to find where gm put info abt all item? so i can link it with the item id on my inventory?. ofc without reading the element.data file XD,

07/10/2013 10:09 dumbfck#20

Take a look at the Prophet bot offset:

Code:

ItemBase_Offset=28
ItemID_Offset=272
ItemSN_Offset=276
ItemName_Offset=360
ItemType_Offset=336

(Bear in mind that those are in decimal).
So you should be able to find something around there. It's been a while since I did any inventory stuff...

And as for linking all data, the only way to really do that is from elements.data. I don't know if Ronny still maintains his selEdit data files, but that's how I used to get the data. I just made a C# version of his extraction code and used his data files then stored everything into a database. I'd love to know how he originally created those offset files though.

07/10/2013 10:19 Sᴡoosh#21

Initially the element structs where reversed, and still are by a huge part of community. I can pass you completely described structs if you want them dumbfck - as long as you keep them to yourself as they aren't public, and that's good. Since I stopped caring for the server dev part of PW, last one I have is v69 (PWI 1.4.5). If you need, I can get v80+ also though. Same goes for tasks.data btw.

07/10/2013 10:26 dumbfck#22

I would be quite interested in seeing those actually, just out of curiosity! Cheers :D

07/10/2013 10:37 Sᴡoosh#23

Check your PM.

07/10/2013 15:59 Interest07#24

I would've been interested in those a year or so ago, pretty cool that. My 'hacking' days are over :p I still enjoy reading these forums though from time to time to see what's developing.

07/10/2013 17:53 ntldr32#25

Quote:
Originally Posted by dumbfck
Take a look at the Prophet bot offset:
Code:
ItemBase_Offset=28
ItemID_Offset=272
ItemSN_Offset=276
ItemName_Offset=360
ItemType_Offset=336

no subtype in there,
the ItemType_Offset contain the main type of an item on our inventory, eg 11385488 for all kinds of Hp/Mp potion, but not filter the Mp or the Hp. ItemName_Offset contain the item name on bag, but only after mouse hover that item, its mean on bot, ItemName_Offset will allways return empty string. I think only the ItemID_Offset that usefull. But since cant find any info abt subtype, so i decide to filter by main type only(ItemType_Offset) :/, not filter hp/mp pot but at least filter all pots.
also, bcos the ItemName_Offset always return empty string before the mouse hover it, i used the [Only registered and activated users can see links. Click Here To Register...] posted by Sᴡoosh.
For my first contribution on this forum, i made a function based on that file to return file name by item_type. i just try to avoid reading big file XD (i think, reading memory is lighter than reading large files heheheh). But still need to find out how to get itemsubtype, XD, and for Ronny sTolls, its look like the sEldit isnt work anymore for PWI :(
__________
For Sᴡoosh, I have a suggestion for you pGrind. Make the pGrind can be purchased by a guild / faction. In other words, all the players from the guild / faction who bought pGrind can use, or they can be bought with money from the guild / faction XD. You know it, "restaurant patrons" do not need to buy a plate to eat there :). hahahahaha
Also, do some action if game disconected like what i do on my bot XD, eg close the game client(free computer from unused job), turn off the computer or relog the game,.

07/10/2013 18:52 Sᴡoosh#26

Quote:

Originally Posted by ntldr32

For Sᴡoosh, I have a suggestion for you pGrind. Make the pGrind can be purchased by a guild / faction. In other words, all the players from the guild / faction who bought pGrind can use, or they can be bought with money from the guild / faction XD. You know it, "restaurant patrons" do not need to buy a plate to eat there :). hahahahaha
Also, do some action if game disconected like what i do on my bot XD, eg close the game client(free computer from unused job), turn off the computer or relog the game,.

I won't add any more features to it, only bugfixes and maintainance. I don't really care about PW anymore, [Only registered and activated users can see links. Click Here To Register...].

07/10/2013 20:47 Murmuring#27

Quote:

Originally Posted by ntldr32

no subtype in there,
the ItemType_Offset contain the main type of an item on our inventory, eg 11385488 for all kinds of Hp/Mp potion, but not filter the Mp or the Hp. ItemName_Offset contain the item name on bag, but only after mouse hover that item, its mean on bot, ItemName_Offset will allways return empty string. I think only the ItemID_Offset that usefull. But since cant find any info abt subtype, so i decide to filter by main type only(ItemType_Offset) :/, not filter hp/mp pot but at least filter all pots.
also, bcos the ItemName_Offset always return empty string before the mouse hover it, i used the [Only registered and activated users can see links. Click Here To Register...] posted by Sᴡoosh.
For my first contribution on this forum, i made a function based on that file to return file name by item_type. i just try to avoid reading big file XD (i think, reading memory is lighter than reading large files heheheh). But still need to find out how to get itemsubtype, XD, and for Ronny sTolls, its look like the sEldit isnt work anymore for PWI :(
__________
For Sᴡoosh, I have a suggestion for you pGrind. Make the pGrind can be purchased by a guild / faction. In other words, all the players from the guild / faction who bought pGrind can use, or they can be bought with money from the guild / faction XD. You know it, "restaurant patrons" do not need to buy a plate to eat there :). hahahahaha
Also, do some action if game disconected like what i do on my bot XD, eg close the game client(free computer from unused job), turn off the computer or relog the game,.

did you know that in the time you used for searching the "subId", it would be more clever to make just a little sort function by using the itemID ?
pro: function now finished, 1 offset more you dont need to find after a update, no time consuming...

just remember, thats a simple bot and not a complex rocket steering software :cool:

to the name offset:
Interest07 posted, i mean some years ago, a way to get the item name like you hover with the mouse over it.
dumbfck postet some months ago also a working function for that.

to "your" bot:
it sound all time cool to mess with other working bots or dream about functions, if there is no finished bot yet from you...but 1000 newbie questions, especially for bot source codes :rolleyes:

07/11/2013 21:49 ntldr32#28

Quote:

Originally Posted by Murmuring

it sound all time cool to mess with other working bots or dream about functions, if there is no finished bot yet from you...but 1000 newbie questions, especially for bot source codes :rolleyes:

i never ask for source code,
why i come here and ask for code? use ready-made bot is more easy than come and ask for code.
i already have a function that can return item info(name, subtype, etc) by id, but it is a 'database like' function, and what i need is memory based where i dont need to change item info for every server,

07/11/2013 22:58 Murmuring#29

Quote:

Originally Posted by ntldr32

i never ask for source code,
why i come here and ask for code? use ready-made bot is more easy than come and ask for code.

^^sure ?

Quote:

Originally Posted by ntldr32

nice job.!!! but I dont believe the "exe", I just believe "source code". so can u post the source code.?, :D:D

^^ ups :D

as i say before...if its just for pots, simply sort them by the itemID.
there not much different hp/mp pots to sort out.

07/12/2013 14:36 ntldr32#30

Quote:

Originally Posted by Murmuring

^^sure ?

^^ ups :D

as i say before...if its just for pots, simply sort them by the itemID.
there not much different hp/mp pots to sort out.

yes i was asking u to post for [Only registered and activated users can see links. Click Here To Register...] code
not mean ill use that code bcos, its still prophet bot(the function all same, with only different on windows) that i already have.
but its make me wonder why you "CLOSE THE CODE THAT WAS OPEN SOURCE" and u are not the owner of prophet bot :), u sould make new bot and and close the source of your own bot, not edit Prophet Bot and use that name like u are the owner,
Thats why i ask for the code.
if the code were closed since its made, ill wont ask for code, but still prophet bot was open, who know what you add on it :),
any changes on Open Source project that you want to go public have to provide, if not, you better use it for private :),

Page 2 of 3