United Hackprogrammers Front(UHF)-CO2 Memory Tables

06/13/2008 14:38 Jalan_Jalan#301
That's what I've found so far:

At the moment (addresses are dynamic), items that are on the ground are stored in memory as follows:

base address: 0x0056A374
offset 1: 0x0 (if you increase this by 4, you get the 2nd, 3rd and so on item)
offset 2: 0x10 (constant)
offset 3: 0x19C

Concerning offset 3:

at 19c - item ID
at 198 - timer, counting up, stops when item disappears or is picked up
at 1a0 - coordinate y ("absolute system", 5 digits)
at 1a4 - coordinate x
at 1a8 - = 1 if cursor is above item, otherwise 0
at 214 - 4 bytes that change to zero when item is picked up, haven't found out what they mean yet. Maybe they have got something to with the item being free for everyone to pick up or not.
06/14/2008 05:11 UPSman2#302
Quote:
Originally Posted by Jalan_Jalan View Post
That's what I've found so far:

At the moment (addresses are dynamic), items that are on the ground are stored in memory as follows:

base address: 0x0056A374
offset 1: 0x0 (if you increase this by 4, you get the 2nd, 3rd and so on item)
offset 2: 0x10 (constant)
offset 3: 0x19C

Concerning offset 3:

at 19c - item ID
at 198 - timer, counting up, stops when item disappears or is picked up
at 1a0 - coordinate y ("absolute system", 5 digits)
at 1a4 - coordinate x
at 1a8 - = 1 if cursor is above item, otherwise 0
at 214 - 4 bytes that change to zero when item is picked up, haven't found out what they mean yet. Maybe they have got something to with the item being free for everyone to pick up or not.
wow... very nice work
06/14/2008 11:02 tanelipe#303
I'm curious, how did you find these? I tried too and failed, I just wasn't able to find the value (ID ex) of item dropped in ground. :D
06/14/2008 16:17 nTL3fTy#304
Nice work indeed.

Care to explain how you came upon this "absolute system" resolution?

Then, care to explain how you know those two 5 digit numbers are the X and Y coordinates of the item? :)

Thanks.
06/14/2008 23:17 tanelipe#305
Btw, has anyone figured the mana baseaddress and offsets? I can't seem to find them, HP was easy to find it's just mana that is making troubles. If anyone is kind enough to share it i'd apreciate it.
06/15/2008 22:35 ephe#306
@Jalan_Jalan
Your CPU/RAM must have been working really hard lately on offsets/pointers searches :P
I don't really have the motivation even to check your findings because starting CO has become an hassle recently, but my appreciation goes to your hard work
06/16/2008 08:29 Jalan_Jalan#307
Quote:
Originally Posted by tanelipe View Post
I'm curious, how did you find these? I tried too and failed, I just wasn't able to find the value (ID ex) of item dropped in ground. :D
I just dropped something, like 100 silver, and searched for that item ID (1090010 for Sycee) with cheatengine. Than I picked the Sycee up and dropped something else, and looked for the address that had changed to the new value. Sometimes this doesn't work, because the location where the value is stored changes frequently, but after a few trys you should get it.


Quote:
Originally Posted by nTL3fTy View Post
Nice work indeed.

Care to explain how you came upon this "absolute system" resolution?

Then, care to explain how you know those two 5 digit numbers are the X and Y coordinates of the item? :)

Thanks.
I found the "absolute system" by moving around and searching for "changed value" with Cheatengine. Also, if you know the address of your char's coords (those that are also displayed on top in the client) and look in the "neighbourhood" of that addresses, you can also find them.

After I found the address of an item'S ID on the ground, I also looked at the addresses that followed, and noticed that they were the same values as my char's coordinates when he was still standing on the dropped item.

At the moment I'm trying to find a way to calculate control-click coords to pick up an item. I assume that these 5-digit coordinates are equal to pixels. So, if your char is at an x value of 30000, and the item is at 30100, it means that the item is 100 pixels to the right of your char. If you add 100 to the control-click coords of your char (x value is usually 512, these are also stored in memory), you should get the right x-coord to click on to pick the item up.
From my trys so far, this works fine for the y-coordinate, the x coordinate is like 100 to 120 pixels off to the left. But we should be able to calculate the correct coords.

One more thing we'd need for a working pick-up bot is the information if an item is already "free to pick up" or not. This should be stored somewhere near the item ID, but I haven't found it so far.

@ ephe: Thanks alot for your appreciation XD
06/18/2008 00:08 nTL3fTy#308
Code:
CharAction=&H56BD30
Character Action:
Represents an ID that can be referenced to different actions in-game.
My current list:
Code:
0 - None
1 - Dance
2 - Dance 2
3 - Dance 3
4 - Dance 4
5 - Dance 5
6 - Dance 6
7 - Dance 7
8 - Dance 8
150 - Happy
160 - Angry
170 - Sad
190 - Wave
200 - Bow
210 - Kneel
230 - Cool
250 - Sit
270 - Lie
310 - Monster Attack
320 - Monster Hit
903 - Transformation
A few I'm unsure about:
Code:
401 - Happens when I use FastBlade (and sometimes in Cyclone?)
403 - Happens when my Rage activates (someone test something like Phoenix?)
Please post more if you find them! :)
06/18/2008 15:34 Jalan_Jalan#309
New addy: (again 3 pointers)

0x0056F900 + 0x8 + 0x14 + 0x24
06/18/2008 18:28 nTL3fTy#310
Quote:
Originally Posted by Jalan_Jalan View Post
New addy: (again 3 pointers)

0x0056F900 + 0x8 + 0x14 + 0x24
What could this be for? :)

#Edit
Oh, it's lucky time.
06/18/2008 18:34 tanelipe#311
"New address for lucky time after the latest patch"

Look the title of his post. :D
06/19/2008 07:46 cyberside0#312
found this for 5028 patch

CharName=&H56B0cc
06/19/2008 08:27 warriorchamp#313
Some addresses are missing. I was too lazy to search for them:)

Here's the list:
Code:
CharName=0056B0CC
CharLV=0056BBF0
CharVP=0056BC44
CharPot=0056BC78
CharJobID=0056BBE4
CharClass=0056BBE4
CharStam=0056BBE8
CharSpirit=0056B8C8
CharAgility=0056B8C0
CharStrength=0056B8B8
CharVitality=0056B8C4
CharXP=0056BC10 <---- added by Jalan_Jalan
SrvName=0056F634
Spouse=0056B8A8
GuildLeader=0056BC28
Ping=0056F3B8
MoneyInv=0056BE6C
MoneyWH=0056C3E8
XPcnt=0056B8CC
PKpoints=0056BC18
MessageCnt=005692B0
WhisperCnt=005692B0
MapName=00569A48
MapID=00569834 <---- added by tanelipe
OrdX=0056B178
OrdY=0056B17C
ClientZoom=0056988C
ClientRGB-R=0056????
ClientRGB-G=0056????
ClientRGB-B=0056????
Trippyness=0056????
XPKillCnt=0056BC40
AccountID=0056F494
CPS=0056BE70
CharEffects=0056B06C
CharEff1=0056B06C
CharEff2=0056B06C
GuildDonation=0056BC24
GuildFund=0056BC38
GuildMembers=0056BC3C
GuildBulletin=0056CE6C
CharDir=0056B0E8
DoSurvey=0055C12C
06/19/2008 08:32 Jalan_Jalan#314
Nice work, warriorchamp XD

CharExp is at 0x0056BC10
06/19/2008 12:46 tanelipe#315
Can someone test if these work :

Just NOP those address' with olly or something. Both are nopping ShellExecuteA

uint NOPOPUP = 004775B2;
uint NOPOPUP2 = 00477B00;

(Didn't they make that the popup comes once per char?)