PWI - Guide for finding chat message offsets - C# code included

Page 5 of 12 « First 34 5 67 Last »
04/24/2011 11:50 omarranimado#61
dumbfck: you won the wet tshirt contest :D
very nice, see chat message from time you dont where ingame.

thx for the info to the ah refresh.
so i better check for changed 1 item id in list, before i read next page out.
what tools from me do u exactly mean ?
so i can send some sources, if its not virus releated :D

maybe i found the time to finish my personal hp with the stuff i release public.
at the moment no free time, much work and i went to another city next month.
so not sending packets ingame, fill packets in reallife with my stuff :o

from what i read...u sound like some one who long time code and reverse.
im allways happy to read from you ;)

Interest07:
hmmm for me it takes some hours to make the grafical stuff, butt sometime days to code my stuff for pwi.
theres a lot new and i never worked on how to get offsets.
so this time, i can only code...for what i found offsets.

the packet sending struct in autoit makes me problems at this time.
your sample is in c# and i try to convert it to autoit.
but i know not enough about this for the moment, so i think i send mouseclick on page refresh ingame meanwhile *erm*

i not answer here the rest of ur posting.
the reason is: ich spreche besser deutsch als englisch :p
so i pm u.

meanwhile some look on my ah listener in flash.
very easy to insert flash as autoit gui and it looks much better.
some nice style, mouse over and i realy like the iphone styled countdown i code yesterday :D
take me 2-3 hours to make the gfx in photoshop and code the function in actionscript.
the red agent, is the mouse over.
the item description background moves from top to bottom on page reload and some stuff u wont see on a screenshot.

at the moment im on the filters functions...so what u see is not all finished.
[Only registered and activated users can see links. Click Here To Register...]

as u, i code most stuff for me....but i like the cool looking and feel prolly when i use my tools :D
04/24/2011 22:16 dumbfck#62
Quote:
Originally Posted by omarranimado View Post
dumbfck: you won the wet tshirt contest :D
:eek: I did? Woohooo! :D

Quote:
Originally Posted by omarranimado View Post
what tools from me do u exactly mean ?
so i can send some sources, if its not virus releated
Well, I'm not sure how useful they'd be to me, as I can normally manage to find mp3s and stuff, but they just sound like some nice little gadgets =]
Wish I knew how to fix viruses though lol - That's pretty impressive.

Quote:
Originally Posted by omarranimado View Post
from what i read...u sound like some one who long time code and reverse.
Well, I'm not a master at any of it lol. Just done a little bit of a lot of programming languages hehe. All started with embedded ASM / C programming (i.e., microcontrollers etc).
As for reversing - I've only really discovered it in the last 5-6 months. I have a LOT to learn before I can call myself a reverser / hacker, but I'm finding it really interesting at the moment and getting some great tips and ideas from this forum.

Quote:
Originally Posted by omarranimado View Post
the packet sending struct in autoit makes me problems at this time.
your sample is in c# and i try to convert it to autoit.
I figure it's time I start looking at AutoIt lol... So here's the AutoIt equivalent, in the format used in [Only registered and activated users can see links. Click Here To Register...]

Code:
Func refreshAhPage($pid, $playerId)
	local $packet, $packetSize
	$packet = '25001A00'
	$packet &= '00001700'
	$packet &= '00002403'
	$packet &= '0000'
	$packet &= _hex($playerId)
	$packet &= '0000'
	$packet &= '00000000'
	$packet &= '00000000'
	$packet &= '00000001'
	$packet &= '14'

    $packetSize = 33
	sendPacket($packet, $packetSize, $pid)
EndFunc
Seems that the _hex function reverses the bytes, so if your ID was 0x00123456, you'd need to call the function like this:
Code:
refreshAhPage($pid, 0x56341200)
I was too lazy to dig any deeper, or read the playerId from the client memory ^_^

Your flash AH stuff is looking awesome by the way. You're really working fast on it hehe.

@Interest07 - Holy shit, you built that list yourself? What offsets are those values found in relation to the item object / structures? I can't find anything in the elements.data file that seems to correlate with your values there. I'm wondering if there might be something near those values though.

@Smurfin - Not sure if I have many other tricks up my sleeve now hehe. If I find any, I'll probably gradually post them here.
And as for that sELedit program, I can take no credit for that. That's from
[Only registered and activated users can see links. Click Here To Register...]
Download the pwTools SVN-Downloader.zip file from that page, unzip it and run the pwtools-binaries.bat file - It will automatically download everything from the SVN =]
There are a lot of cool looking tools in there. They spark a lot of ideas ^^
04/24/2011 23:20 Interest07#63
I assume you know the offsets to get to items, then within items it is +0x90 for socket list (not that important, 0x94 for nr of sockets) and 0xA4 for addon list (0xA8 for nr of addons)

then in that list
Code:
                        newItemMod.modId = MemFunctions.MemReadInt(pr_processHandle, values.addOnList + i * 0x1C);
                        newItemMod.modValue = MemFunctions.MemReadInt(pr_processHandle, values.addOnList + i * 0x1C + 0xC);
I'm not quite sure why those values aren't matching the ones you can find in the seledit program (I've tried it as well). But these are working for me. So yeah it goes wrong occasionally cos it's reading the item description and it takes some trouble to figure out which id corresponds to which line of text :p (automatically ofc, if i were to manually look for it, it would be easy but time consuming)

I'm considering just changing the addonId in memory and keep reading the description for the changed line. But I'm thinking it would kinda depend on which item type you are using whether you get an actual valid description. If not you get Unknown (value)
04/25/2011 00:05 msxgames#64
Quote:
Originally Posted by dumbfck View Post
Code:
Func refreshAhPage($pid, $playerId)
	local $packet, $packetSize
	$packet = '25001A00'
	$packet &= '00001700'
	$packet &= '00002403'
	$packet &= '0000'
	$packet &= _hex($playerId)
	$packet &= '0000'
	$packet &= '00000000'
	$packet &= '00000000'
	$packet &= '00000001'
	$packet &= '14'

    $packetSize = 33
	sendPacket($packet, $packetSize, $pid)
EndFunc
I don't get the last 2 lines of the packet "00-00-00-01-14". I get different numbers here, but I don't have a clue what they are. A few examples are "00-43-4A-A4-30" or "00-4D-AA-AC-70". They look like random numbers to me. Anyone has a clue what this is?
Quote:
Originally Posted by dumbfck View Post
I was too lazy to dig any deeper, or read the playerId from the client memory ^_^
The PlayerId can be found as follows: [[[[baseCall] + 0x1C] + 0x34] + 0x46C]
04/25/2011 01:00 dumbfck#65
Some of the stuff near the end of the packet string is to do with the current item offset / filters etc, as far as I can tell. refer to my original C# post - I forgot to add the comment in my AutoIt example.
Code:
        private byte[] refreshAhPagePkt = new byte[] 
        { 
            //Header
            0x25, 0x00, 0x1A, 0x00,
            0x00, 0x00, 0x17, 0x00,
            0x00, 0x00, 0x24, 0x03,
            0x00, 0x00,
            0x00, 0x00, 0x00, 0x00,     // Player ID
            0x00, 0x00,
            0x00, 0x00, 0x00, 0x00,     
            0x00, 0x00, 0x00, 0x00,     // Start item offset
            0x00, 0x00, 0x00, 0x01,
            0x14
        };
I didn't investigate the filters much further, but I think the very last two bytes on the line commented // start item offset are the current item offset... I.e., there are 16 items per page, so an offset of 0x10 would be page 2. You'd only need this if you're planning to read through a bunch of pages. If you just want to stay on the first page, set this to 0. If you want to refresh the current page you're on, I posted an offset to extract the current AH page a few pages back in this thread.

Have you tried sending with this value as 0? When I tested it earlier, it seemed to work ok for refreshing the first page.



Interest07 - Thanks for the offsets =]
Well.... I dunno if it's just coincidence, but the first two items I checked seem to have values that correlate to sELedit!
Example:
[Only registered and activated users can see links. Click Here To Register...]

From the item base, +0x1C we can see the value 0x4E1 = 1249 decimal
If we look at property ID 1249 in sELedit, I think the first int32 after the wstring means the number of possible values that this addon can have. This is perhaps a bad example lol, as both options are 118 - However, that 118 correlates to the value at itemBase + (1*0x1C) + 0xC
(0x76 = 118) which matches the +118 Phys. Res. on the item.

Then at itemBase + (2*0x1C) + 0xC we can see
0x45D = 1117 decimal. Take a look in sELedit and this is item property A_H004, with two possible values: 6 or 7. Look just below the 0x45D value in CE and we can see mine has a value of 7, which correlates to the Magic+7 addon of the weap =]
The 6-7 correspond to the item's possible Magic addon outcomes when manufacturing.

I tested on a piece of armour too and got the same results. They all had hits in sELedit.

I need to test some more, but if this is consistent, all we need to do is find out how to automagically convert A_DEF5 to "Phys. Res. +" etc.

Unfortunately, with sELedit, the guy who made it has only released config files for PWI and CN versions. I don't know if he has some magical way of getting the file structures, but as far as I can tell, (at some point at least) it was all done manually and he's had to figure out what all the lists correspond to. That's pretty painstaking, having taken a look at the file structure myself.
I found that list 69 is recipes for items =]... I should prolly tell him so he can update his configs hehe.
04/25/2011 01:50 msxgames#66
Yes, it works with that packet. But I am scared that PWI will find out by checking the packets that they receive. All these packets contain the same "error". My character will be banned like that, so I prefer to send correct packets.
04/25/2011 02:22 dumbfck#67
Just did some more testing - Seems the filter values are the bytes directly after the playerID. As for the last:
0x00, 0x00, 0x00, 0x00
0x00, 0x00, 0x00, 0x00 <-- Item offset
0x00, 0x00, 0x00, 0x01
0x14

I can't seem to do anything to get different values in there, except for the item offset. Refreshing page 0 always yeilds 0x00s for those bytes for me. Kinda makes me wonder where and how you're seeing these values?

The way I check... Set a breakpoint in Olly at the first instruction inside the sendPackets function (address 0x64FB50 in PWI v510)
Then click the refresh page, or next / previous page buttons in AH. When Olly breaks, right click the second value in the stack -> show in dump.
This will show the packet string that is being sent. The third value in the stack is the byte count for the packet.

Is this what you're doing too?
04/25/2011 05:35 SunB#68
Hi guys,
Could you please post a guide for extract the item data form the Data files?
I am stuck when finding the real name of an item in inventory but I got the rendered text whenever your mouse is hover this item... :(
04/25/2011 07:58 Interest07#69
Yes, this example corresponds to the values in my list as well. But not all of them do? Maybe when I looked the last time I just got unlucky :p


Would be really nice to have the complete list of this lol
04/25/2011 10:22 omarranimado#70
Quote:
Originally Posted by dumbfck View Post
Well, I'm not sure how useful they'd be to me, as I can normally manage to find mp3s and stuff, but they just sound like some nice little gadgets =]
Wish I knew how to fix viruses though lol - That's pretty impressive.
virus studie are much impressive.
they way some god work is not so impressed as the work will be.
everytime it used the lazyness of the user.

here some example:
hide ur tool from user views....hows that going ?
just easy...set ur tool between user gui and system.
if user use stuff like windows file search, taskmanager: the gui send a comand to system: gui -> system

now our tool is between: gui-> tool -> system
got from gui the comand to search for xyz.
he check if in the search is maybe the filename of virus.
if so...he wait for system result: system -> tool XXX Gui

now virus delete from search result his own name, send the result now back to user gui: tool -> Gui
user see "patched" result: no virusname found

u can use this way for a lot, like registry, files...
think about it.

more hard work is, hide functions from antivirus soft..like injection.

Quote:
Originally Posted by dumbfck View Post
Well, I'm not a master at any of it lol. Just done a little bit of a lot of programming languages hehe. All started with embedded ASM / C programming (i.e., microcontrollers etc).
As for reversing - I've only really discovered it in the last 5-6 months. I have a LOT to learn before I can call myself a reverser / hacker, but I'm finding it really interesting at the moment and getting some great tips and ideas from this forum.
yeah reversing is fun.
its hard work and from the beginnings...wen u only change a byte to patch registration process...to today, some interesting ways and impressions.
im also no real man for that, just learn on every problem.
in my last case, i need to convert some tousend sound samples from ejay music maker.

there hardcoded in a pack file.
so first find out how they stored, next code a tool to extract them.
then found out files are in a ejay sound format: pxd
so reversing the dll again to find out what functions for that inside.
next find out how the function is called and then code a tool to convert pxd sample to mp3 sample.

was fun and sometime i got crazy :D

Quote:
Originally Posted by dumbfck View Post
I figure it's time I start looking at AutoIt lol... So here's the AutoIt equivalent, in the format used in [Only registered and activated users can see links. Click Here To Register...]


Seems that the _hex function reverses the bytes, so if your ID was 0x00123456, you'd need to call the function like this:
Code:
refreshAhPage($pid, 0x56341200)
I was too lazy to dig any deeper, or read the playerId from the client memory ^_^
thanks for this!
i give it a try wen i went to new city.
i wonder why in interests c# sample are so much stuff like: 0x25, 0x00, 0x1A, 0x00
and how to convert this to autoit, like u did: $packet = '25001A00'
that was my problem, i start like this:
$packet = '25'
$packet = '00'
$packet = '1A' :o

at the moment i use client unfreeze, send mouseclick to refresh button.
but im interested to understand how the packet stuff goes, seams lot more what can be done with this and interests me :)

Quote:
Originally Posted by dumbfck View Post
Your flash AH stuff is looking awesome by the way. You're really working fast on it hehe.
thanks for that :)
but i have no time now and it goes so slooooow at the moment :(
only 7 days left and then i move to another city...then time without internet comes to me.

but someday....i rule the world *erm* finish my tool :D

btw: this board is realy nice.
1 of 3 places were much discussion about pw, maybe more..but cant read chinese :o
04/25/2011 12:14 Smurfin#71
finally, got my chatlog working but with all hex and the <><><> thingy, is that ingame color command ?


now trying omarranimado's getppllist but still haven't gotten it to work
04/25/2011 14:56 omarranimado#72
Quote:
Originally Posted by Smurfin View Post
finally, got my chatlog working but with all hex and the <><><> thingy, is that ingame color command ?
[/spoiler]
u mean like ^FFE400 ?
thats #FFE400 in html style like <font color="#FFE400">Text</font>
this color, worldchat

rest is postet id, smiley...

take a look in first post spoilers:
Quote:
chatTable.Columns.Add("p->msg", typeof(string));
chatTable.Columns.Add("msgID", typeof(string));
chatTable.Columns.Add("Scope", typeof(string));
chatTable.Columns.Add("Message", typeof(string));
chatTable.Columns.Add("itemID", typeof(string));
chatTable.Columns.Add("smiley", typeof(string));
chatTable.Columns.Add("uk1", typeof(string));
chatTable.Columns.Add("uk3", typeof(string));
chatTable.Columns.Add("uk4", typeof(string));
chatTable.Columns.Add("uk5", typeof(string));
chatTable.Columns.Add("uk6", typeof(string));


"Local", // 0
"World", // 1
"Squad", // 2
"Faction", // 3
"Whisper", // 4
"5", // 5
"6", // 6
"Trade", // 7
"Notification", // 8
"System", // 9
"Gen. Info", // 0xa
"Local info(b)", // 0xb
"Local info(c)", // 0xc

Quote:
Originally Posted by Smurfin View Post
now trying omarranimado's getppllist but still haven't gotten it to work
^^its not founded from me, i just used the offsets :)

just a tipp, ppl counter is like:
Quote:
$ppl_counter = memread(memread(memread(memread(memread($REAL_BASE _ADDRESS) + 0x1C) + 0x1C) +0x20) + 0x14)
04/25/2011 18:24 dumbfck#73
Yep and as for the part in <a><b><c>
a - unknown - always seems to be 3
b - Message type - Same as the message type value in the message struct.
c - Unknown - Always seems to be 0

omarranimado - Awesome, thanks for the dumbfck edition of the MP3 program, that's really cool ^_^
Unfortunately, I couldn't get it to work on XP. I'm guessing it was built for Win7 / Vista?
It threw the error "Cant initiate Bass.dll"
I traced it back a little bit - Bass.dll needed wer.dll and ieshims.dll - So I tried to install those. But, they required ncrypt.dll - Which in turn required bcrypt.dll.
On trying to register bcrypt.dll, I got a different error, and dependency walker said
"Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module."

At this point, I gave up lol.

Looks like a lot of that stuff is included in IE8 on Win7 and Vista, but unfortunately not on XP.

If I get my second box up and running again (Win7) I'll give it another try. But thanks again anyway =]


Interest07 - D'oh! Thought it seemed to good to be true :D
Guess I got lucky with those two items. Definitely gonna take a deeper look at this sometime though.


*Edit:
Quote:
Originally Posted by SunB View Post
Hi guys,
Could you please post a guide for extract the item data form the Data files?
I am stuck when finding the real name of an item in inventory but I got the rendered text whenever your mouse is hover this item... :(
We're still working on this - hopefully we'll have a solution soon =]
04/25/2011 18:56 Smurfin#74
Quote:
Originally Posted by omarranimado View Post
u mean like ^FFE400 ?
thats #FFE400 in html style like <font color="#FFE400">Text</font>
this color, worldchat

rest is postet id, smiley...

take a look in first post spoilers:




^^its not founded from me, i just used the offsets :)

just a tipp, ppl counter is like:
I missed the string separation from dmbfck's code then, only the chat type, I hope autoit can handle multiple colors in GUICtrlCreateListView box, because it can't display multiple colors in an editbox :( all colors in there will use the last color setting, it'll look ugly and doesn't match the chat type color.

tks for the info, I'll double check my script later whether it has the correct format for the offsets or not, if all else fails then probably the offsets are different because pw indo is still in older version or it's just me :o


Quote:
Originally Posted by dumbfck View Post
Yep and as for the part in <a><b><c>
a - unknown - always seems to be 3
b - Message type - Same as the message type value in the message struct.
c - Unknown - Always seems to be 0
owh ok, so far only have seen the 'a' , should run the chatlog longer and see what type it is in the game if it ever appears here. Could be a horn or something else.
04/25/2011 20:04 omarranimado#75
Quote:
Originally Posted by dumbfck View Post
omarranimado - Awesome, thanks for the dumbfck edition of the MP3 program, that's really cool ^_^
Unfortunately, I couldn't get it to work on XP. I'm guessing it was built for Win7 / Vista?
It threw the error "Cant initiate Bass.dll"
I traced it back a little bit - Bass.dll needed wer.dll and ieshims.dll - So I tried to install those. But, they required ncrypt.dll - Which in turn required bcrypt.dll.
On trying to register bcrypt.dll, I got a different error, and dependency walker said
"Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module."

At this point, I gave up lol.
hm weierd, its not a system dll.
just a dll to work with streaming audio.
[Only registered and activated users can see links. Click Here To Register...]

Quote:
BASS is an audio library for use in Windows and Mac OSX software. Its purpose is to provide developers with powerful and efficient sample, stream (MP3, MP2, MP1, OGG, WAV, AIFF, custom generated, and more via add-ons), MOD music (XM, IT, S3M, MOD, MTM, UMX), MO3 music (MP3/OGG compressed MODs), and recording functions. All in a tiny DLL, under 100KB* in size.

On Windows, BASS requires DirectX 3 or above for output, and takes advantage of DirectSound and DirectSound3D hardware accelerated drivers, when available. On OSX, BASS uses CoreAudio for output, and OSX 10.3 or above is recommended. Both PowerPC and Intel Macs are supported.
in source u see:
Quote:
;################################################# #############################
; function: load bass.dll
;################################################# #############################
_Bass_startup(@ScriptDir & "\daten\bass.dll")
If @error Then
MsgBox(0, "Fehler", "bass.dll not found!")
Exit
EndIf
;Initalize bass. Required for most functions.
_BASS_Init (0, -1, 44100, 0, "")

;Check if bass iniated. If not, we cannot continue.
If @error Then
MsgBox(0, "Fehler", "Cant initiate Bass.dll!")
Exit
EndIf
your the first who cant run it :eek:
hmmm...im shure u have directx :D

u can tell me more ?



Quote:
Originally Posted by Smurfin View Post
I missed the string separation from dmbfck's code then, only the chat type, I hope autoit can handle multiple colors in GUICtrlCreateListView box, because it can't display multiple colors in an editbox :( all colors in there will use the last color setting, it'll look ugly and doesn't match the chat type color.
yep, autoit can make colored listview colums.
heres a sample for that:

Page 5 of 12 « First 34 5 67 Last »