PWI Eclipse changes

Page 4 of 17 « First 23 4 5614 Last »
02/07/2015 09:46 denzjh#46
I don't use FollowPlayer Function since mine's a herbs-farmer bot but here it is anyways...


Already posted earlier about these Action Function Addresses in [Only registered and activated users can see links. Click Here To Register...]

Address Action 1 = Start Action Function (At the moment this is 0x49FF80)
Address Action 2 = Perform Action Function (Varies. Depends on the action)
Address Action 3 = Finish Action Function (At the moment this is 0x4A0590)

To trace the [Address Action 2], I check all the addresses that calls the [Address Action 1] and make break point to each. I perform some actions in the game client and wait for the breakpoint. In the breakpoint, the [Address Action 2] is called a few lines after the [Address Action 1].

For CastSkill and RegAttack functions, I did some further tracing (before and after the [Address Action 1]) to get some addresses for functions that will simplify the OpCodes.

These are the Current Addresses that is calling [Address Action 1]:


The PUSH Column determines the type of Action. You will find them before the Address Action 1 is called.

Also if you trace down MoveTo Function through KEYBOARD MOVE, you will notice the 'Switch function' in the code which will give you this list of Case Index and corresponding Directions:

This is how I repeatedly crash the PW Client.
So far I am getting results so I think my theory is somewhat correct :D

And yes ollydbg is a cool debugging tool!
02/10/2015 18:39 jasty#47
This thread is ridiculously useful! I'm finally getting around to automating all these damn dailies.

So far I'm able to accept quests, move around, dig items, and kill mobs. Does anyone have some code that is able to examine the quest list? I want to be able to check to see which quests / subquests are still active and how many additional mobs / items are required to complete the quest. I want to be able to check my current quest directly rather than trying to track quest completion on my own due to how many things can go wrong with that (like it's not guaranteed you're going to be credited with a kill). It would be nice to add some error handling should quests not be completed as expected.

The only reference I've been able to find on examining quests is the offset

PlayerQuestList=0x13F4

Also what's the clean way to close NPC dialogs?
02/11/2015 08:21 denzjh#48
Quote:
Originally Posted by jasty View Post
Also what's the clean way to close NPC dialogs?
I don't know about clean ways to close but I there's a way to start npc talks without dialogs.

Before using this function:

Code:
Func startNpcDialogue($npcId)
  local $packet, $packetSize

  $packet = '2300'
  $packet &= _hex($npcId)
  $packetSize = 6

  sendPacket($packet, $packetSize, $pid)
EndFunc
Make sure that the slope distance between your bot and the NPC has a floor value of 5. I mean Distance value like 5.1 to 5.9 units.

That's what I did in my auto world quest bot. :cool:
02/11/2015 16:55 Remmm#49
close NPC dialog

Code:
Procedure WinStruct(WinName.s)
  hProcess=OpenProcess_(#PROCESS_ALL_ACCESS, #False, Fid(GetGadgetText(#ComboBox_NamePers)))
  ReadProcessMemory_(hProcess,(#GA),@ibuf,SizeOf(ibuf),NoB)
  ReadProcessMemory_(hProcess,(ibuf+$10),@ibuf,SizeOf(ibuf),NoB)
  ReadProcessMemory_(hProcess,(ibuf+$08),@Gui,SizeOf(gui),NoB)
  ReadProcessMemory_(hProcess,(Gui+$AC),@WinDown,SizeOf(WinDown),NoB)
  While WinDown<>0
    ReadProcessMemory_(hProcess,(WinDown),@NextWin,SizeOf(NextWin),NoB)
    ReadProcessMemory_(hProcess,(WinDown+$8),@WinStr,SizeOf(WinStr),NoB)
    ReadProcessMemory_(hProcess,(WinStr+$4c),@WinNameadr,SizeOf(WinNameadr),NoB)
    ReadProcessMemory_(hProcess,(WinNameadr+0),@Name,20,NoB)
    If name = WinName
      CloseHandle_(hProcess)
      ProcedureReturn WinStr
    EndIf
    WinDown=NextWin 
  Wend
  
  ReadProcessMemory_(hProcess,(Gui+$8C),@WinDown,SizeOf(WinDown),NoB)
  While WinDown<>0
    ReadProcessMemory_(hProcess,(WinDown),@NextWin,SizeOf(NextWin),NoB)
    ReadProcessMemory_(hProcess,(WinDown+$8),@WinStr,SizeOf(WinStr),NoB)
    ReadProcessMemory_(hProcess,(WinStr+$4c),@WinNameadr,SizeOf(WinNameadr),NoB)
    ReadProcessMemory_(hProcess,(WinNameadr+0),@Name,20,NoB)
    If name = WinName
      CloseHandle_(hProcess)
      FreeMemory(*mem)
      ProcedureReturn WinStr
    EndIf
    WinDown=NextWin
  Wend
  CloseHandle_(hProcess)
  ProcedureReturn #False
EndProcedure
Code:
Procedure CloseWin(winname.s,)
  GUIFunkt=$97A3C0
  Param1= WinStruct(winname)
  Param2 = $cb115c
  If param1<>#False
    opcode.s="60"+"B9"+Reverse(Param1)+"68"+Reverse($cb115c)+"BA"+Reverse(GUIFunkt)+"FFD2"+"61"+"C3"
    Inject(opcode) 
  EndIf
EndProcedure
Code:
CloseWin("Win_NPC")
02/12/2015 18:02 WhoMoi#50
I'm trying to figure out the buff list. I found the buff counter at 0x398. According to [Only registered and activated users can see links. Click Here To Register...] and [Only registered and activated users can see links. Click Here To Register...], I believe the buff list is at 0x3A0 but I'm not making any sense of it. I did try both 2 bytes and 4 bytes.

Is the buff list like the worlditemlist? I know the worlditemlist is not sorted and have to go through all 768 entries.

Also, I did find the buff ids in config.pck and tried to do search for id with CE but I get nothing.

I'm at a lost here. Any help please?
02/12/2015 19:19 denzjh#51
Quote:
Originally Posted by WhoMoi View Post
I'm trying to figure out the buff list. I found the buff counter at 0x398. According to [Only registered and activated users can see links. Click Here To Register...] and [Only registered and activated users can see links. Click Here To Register...], I believe the buff list is at 0x3A0 but I'm not making any sense of it. I did try both 2 bytes and 4 bytes.

Is the buff list like the worlditemlist? I know the worlditemlist is not sorted and have to go through all 768 entries.

Also, I did find the buff ids in config.pck and tried to do search for id with CE but I get nothing.

I'm at a lost here. Any help please?
Try this:


buffs_str.ini

buffs_str.ini is updated.

And please press the thanks button if this helped you. I would appreciate it.
02/12/2015 20:12 WhoMoi#52
The 0x390 got me closer. Only difference is the counter (or $i) is in multiples of 12. Thanks.

Also, here is my buff list. I noticed both yours and mine is missing 217 and 228.:confused:
02/13/2015 00:00 Smurfin#53
Quote:
Originally Posted by Stark77 View Post
i do it exactly like this:
[Only registered and activated users can see links. Click Here To Register...]

follow has no packet... it will just create a sequence of move packets so dont even try. easy way is just make a loop that reads your mains (x,y) and use the autopath every 1 (or 2) seconds to it.
wow another method for sniffing packets, dumbfck is really a lot of things, despite the name :D

Btw I already did that, the 'autofollow' by scripting, it's very useful and even more useful with the vertical movement using flytoZ function you gave earlier, I use a hotkey to toggle it on or off and another hotkeys for manual 'go here' operations, but still..the ingame autofollow is useful in its own way. Like when I solo FSP and at the slopes going to Toad Boss, using autofollow by scripting sometimes read my main's x,y exactly at the pit coordinate between the slopes as my main passes by and cause one or two of the other chars to die falling in the pit.

Quote:
Originally Posted by Remmm View Post
sniff packets - "PW PacketListener"
[Only registered and activated users can see links. Click Here To Register...]
Thanks, I'll put this into my notes as well for backup.

Quote:
Originally Posted by denzjh View Post
I don't use FollowPlayer Function since mine's a herbs-farmer bot but here it is anyways...

...snip...

This is how I repeatedly crash the PW Client.
So far I am getting results so I think my theory is somewhat correct :D

And yes ollydbg is a cool debugging tool!
Thanks another ton for it, and someone who shares everything is as cool as the debugging tool he's using :D

====
I won't be able to try all of these until a few more months when we have the Eclipse patch, but thanks in advance for any discovery for fixing whatever we once had before eclipse :handsdown:
02/13/2015 01:52 WhoMoi#54
I tried Ollydbg since I'd like to learn how to find what to send and such. But client keeps saying username and password is incorrect every single time I try to login with Ollydbg attached. How do ya'll get pass that?
02/14/2015 05:50 WhoMoi#55
Here is CastSkill in C# if anybody wants.
02/15/2015 16:49 jasty#56
So I'm trying to port this checkQuestPreset function from the WQ bot to autoit.
Here's what I have:

All it does is crash :mad::mad:
This is the OPcode it generates...
60B840E089008B0D742CD2008B491C8B49288B89F41368DD67 FFD0A30000C90861C3
and while I'm no ASM expert it looks pretty similar to the sample provided in the source
60B8804566008B0D7C6598008B491C8B49308B89DC0D68DD06 FFD0A33254769861C3

Anyone can see where I am screwing up? Been stuck at this for a while. Also if anyone has any Quest related knowledge to drop here I'd be grateful. I'm trying to make a bot to take care of Morai / Primal / Faction Base dailies. While I can talk to NPCs fine I don't know how to examine quests yet.

EDIT:
OK I rewrote the ASM it and can now get back a value... but all it seems to do is give me a pointer to the quest struct.. I guess that's kinda useful but it doesn't have any progress or availability info it. maybe this can be of use to someone smarter than me.

Maybe this is the wrong function :( I got the 0x89E040 offset from the Jawq thread.
Again if anyone has questing knowledge feel free to point me at somewhere. Thanks.
02/20/2015 21:56 WhoMoi#57
My client keeps getting crashing with CastSkill. Sometimes few minutes, sometimes few hours.

I'm wondering if I'm using the correct thing for SkillPointer. I used 0x1418 that points to my skill structure. Then I tried 0x1418+skillindex.

I'm surprised they both worked but both will eventually crash the client.

Help?

I keep getting this if I debug it.
02/21/2015 03:31 jasty#58
Here's my cast skill function that also checks cooldown before calling the version takes a pointer. I've had no problems with it.

Anyone has the opcode to inject for jump? Some instances require a little jumping in spots to get through.
02/27/2015 22:01 Asprin#59
Hi guys. Can anyone tell me offsets for friend list structure? Thanks
02/27/2015 22:27 jasty#60
I finally figured out how to read quests!

QuestList = [[[[BA+0x1C]+0x28]+0x13F4]+0x8]
Quest Count = QuestList+0x0 (1 Byte) includes invisible quests
Visible Quest Count = QuestList+0x4 (1 Byte)
QuestID = QuestList + 0x8 + 0x20*i (2 bytes, i = 0 to Count)
Monster Kill Count = QuestList + 0x8 + 0x20*i + 0x15

I'm sure there are more fields inside the 32 byte quest struct but I really needed Mob kill count for my daily bot.
Page 4 of 17 « First 23 4 5614 Last »