Hey Cencil and thanks for the great work in this thread. Thanks to you, I was able to get a C++ version of your packet logger working :) Care to elaborate on the auto-sync teleporter with packets? I tried modifying the x,y,z and different variations of the flags but had no luck. In my PacketEncrypt detour I simply set x,y,z to some value. Then I modified my physical/visual x,y,z in memory and tried to move. It kept putting me back to original location but was sending movement packets (0x0D) with the location I was trying to teleport to. Any help would be appreciated.Quote:
Yeah with heartbeat I just meant the movement :)
Change the last flag from 0 to 1 to get an auto sync teleporter with packets :p
Heartbeat movement packet under normal conditions:
uint16 packet code (0x0D)
uint16 time1
uint16 time2
float x
float y
float z
uint8 unk
uint16 flags, just set this shit to 0x1
Works fine for me, I just tested it in the packet detour without modifiying my position in the memory.Quote:
if (wOpCode = $0D) and (packetSize = 21) then
begin
with pVec do
begin
x := 0;
y := 0;
z := 100;
end;
Move(pVec, buffer[6], SizeOf(pVec)); // 12 bytes
wNewFlag := 1;
Move(wNewFlag, buffer[19], SizeOf(wNewFlag)); // 2 bytes
pBuffer := @buffer[0];
end;
p := TGW2Packet.Create(); p.PutUInt16($0D); p.PutUInt16(1000); // timing 1 (incorrect value but the server doesn't care) p.PutUInt16(1000); // timing 2 (incorrect value but the server doesn't care) p.PutFloat(100); p.PutFloat(100); p.PutFloat(50); p.PutUInt8(0); p.PutUInt16(1); // sync position :) p.Send(); p.Free()
void _fastcall my_PacketEncrypt(VOID* Unk, VOID* Unk1, int bufferSize, packet* pBuffer, int* pTargetBuffer)
{
if(bufferSize == 21 && pBuffer->opcode == 0x0D) //movement packet
{
cout << "moving\n" << endl;
pBuffer->x = 100;
pBuffer->y = 100;
pBuffer->z = 100;
pBuffer->flags[2] = 1;
cout << "opcode:" << pBuffer->opcode << " x:" << pBuffer->x << " y:" << pBuffer->y << " z:" << pBuffer->z << endl;
}
orig_PacketEncrypt(Unk, Unk1, bufferSize, pBuffer, pTargetBuffer);
}
struct packet{
UINT16 opcode; //2 bytes
UINT16 Time1; //2 bytes
UINT16 Time2; //2 bytes
FLOAT x; //4 bytes
FLOAT y; //4 bytes
FLOAT z; //4 bytes
CHAR flags[3]; //3 bytes
};
typedef VOID (_fastcall *tPacketEncrypt)(VOID* Unk, VOID* Unk1, int bufferSize, packet* pBuffer, int* pTargetBuffer); VOID _fastcall my_PacketEncrypt(VOID* Unk, VOID* Unk1, int bufferSize, packet* pBuffer, int* pTargetBuffer); tPacketEncrypt orig_PacketEncrypt = (tPacketEncrypt)(0x00A69C60);
oderQuote:
RotCos = 0x016A55C0
RotSin = 0x016A55C4
Manche sachen (z.B Autowalk) sind ja selbsterklärend aber bei den oben genannten, bin ich selbst nach googlen nicht raufgekommen!Quote:
Base PreTargetPos = 0x015D359C
Offset1 = 0x8c
OffsetPosX = 0x78
OffsetPosY = 0x7C
OffsetPosZ = 0x80
Base Adrenaline = 0x016A5600
Offset1 = 0x184
Offset2 = 0x2C
RotCos wird wahrscheinlich der Cosinus der Kamera sein undQuote:
bin neu in der Bot-Programmierung! Kann mir bitte irgendeiner die Begriffe der Memories erklären also z.b.:
oder
Manche sachen (z.B Autowalk) sind ja selbsterklärend aber bei den oben genannten, bin ich selbst nach googlen nicht raufgekommen!
Danke für eure Hilfe!
Derrod
Wenn man zu einem Agent schaut sieht man schon den Lebenspunktebalken, er wird also schon vorausgewählt, ist aber noch nicht im target.Quote:
Danke für eure Hilfe!
Derrod
004065F0 GetNetworkClassPtr 00B1C2A0 GetCliContext 00AEAE70 GetAsContext 00B1CC90 GetControlledCharacter 00B2AA90 Character::GetPlayer 00B32150 Character::IsAlive 00B32180 Character::IsDowned 00B321E0 Character::IsInWater 00B32240 Character::IsPlayer 00BF0430 Character::GetAgent 00B1C270 GetPlayerFromListById 00A66D50 Msg::DispatchStream 00A68420 Msg::GetPacketHandler 00A69C20 DeEncryptPacket 00A674E0 PutPacketQueue 00A7A140 PutPacketQueueCallProxy 00B61BD0 ProcessChatInput 00B658C0 PH_ChatMessage // packethandler for 0x133 00A7C390 SendMoveJump 00A7DB50 SendMoveStart 00A7DD10 SendMoveTurn
if (FMover.SetPosition(Position)) then
begin
p := TGW2Packet.Create(28);
p.PutUInt16($0D);
p.PutUInt32(dwTiming);
p.PutUInt32(dwTiming);
p.PutVec3(Position);
p.PutUInt32(0);
p.PutUInt16(0);
p.Send();
p.Free();
end;
// send call
asm
push pBuf
mov eax, $00A67BF0
call eax
mov edx, $1C // unpacked size
mov ecx, eax
mov eax, $00A674E0
call eax
end;
RotCos is the cosinus player's facing not camera's. If you rotate your character you can see that those values change from -1 to 1 (4 peaks for north,west,south,east). You can calculate angle of facing using arc functions (atan2 in our case, which is included in pretty much every language).Quote:
RotSin der Sinus
PreTargetPos damit kannst wahrscheinlich die Position des vorherigen Ziels auslesen (X,Y und Z)
Adrenalin kannst wahrscheinlich das Adrenalin auslesen
Do you mind explaining the first 2 lines of the assembly? Is pBuf the pointer to your packet to send? Why is there a need to call $00A67BF0 (better yet, what function is that)?Quote:
...
The PutPacketQueue function requires the unpacked packet buffer.
For example:
After you called it gw packs, encrypts and sends the packet for you.Code:if (FMover.SetPosition(Position)) then begin p := TGW2Packet.Create(28); p.PutUInt16($0D); p.PutUInt32(dwTiming); p.PutUInt32(dwTiming); p.PutVec3(Position); p.PutUInt32(0); p.PutUInt16(0); p.Send(); p.Free(); end; // send call asm push pBuf mov eax, $00A67BF0 call eax mov edx, $1C // unpacked size mov ecx, eax mov eax, $00A674E0 call eax end;
I didn't reversed what the function result from 0x00A67BF0 does in PutPacketQueue, but it seems to be fine for all movement packets.Quote:
Thanks so much for all the information you've put in this thread. I've learned so much and have gotten a ton of this working (main problem now is figuring out how to get a thread to execute code in the GW2 address space). Thanks again for all of the work you've freely shared!