Cheat Engine Mob HP Values

11/08/2011 21:16 zerosmoke#1

I've always used Cheat Engine to find Max HP/HP values for mobs in PWI, but lately it hasn't been working. Basically my targeting system uses those values to make sure the mob isn't being attacked. If anyone knows if there's a new way to determine those values, please post.

Thanks!

11/08/2011 21:19 Sᴡoosh#2

Get targeted mob info by hashing or looking up target ID in mob array.

11/08/2011 21:32 zerosmoke#3

I've re-checked the values and I've found the addresses, but PWE has taken out the values and created a random numeral generator in its place, which is absolutely useless.

By mob array you mean reading the Mob ID and verifying it's hp values that way?

11/08/2011 21:34 Sᴡoosh#4

What you are finding are probably pointers, no random numbers. I never did it this way and cannot tell what they changed, but your better of anyway by looping through mob struct.

Cheers

11/08/2011 21:40 zerosmoke#5

Ok, I'll show you how I did it from square 1. I open up PWI client and log in. I find a mob and target it. Then I open Cheat Engine and attach to elementclient.exe. I do a quick search (exact value, 4 bytes) for the mob's hp, usually 4 digits, i.e. 1979. (Usually have client unfreezed for this) When I get search results, I go back to client and retarget to a mob with different hp than I just searched. I go back to CE and do a 'next scan' with the new hp value. That gives me HP/Max HP values addresses which I then convert to decimal for my targeting system.

Is it clearer now?

11/08/2011 21:41 Sᴡoosh#6

Yeah I understood from the beginning on how you searched for the dynamic addresses - but what I do not understand is how you can have so much patience and do this every time you restart PW :D

I would have fucked that approach the 2. time - im a lazy ass :D

11/08/2011 22:05 zerosmoke#7

Quote:

Originally Posted by Sᴡoosh

Yeah I understood from the beginning on how you searched for the dynamic addresses - but what I do not understand is how you can have so much patience and do this every time you restart PW :D

I would have fucked that approach the 2. time - im a lazy ass :D

I don't reboot my client often, my software is pretty stable and never causes a crash. It usually took me less than 2 minutes to reconfigure my config file when I launch the client with the mob hp values.

Yeah, here's something interesting, I tried searching for the hp values again, and when I killed all the mobs the hp values went to 3204448256 and 3206869842 and stayed at those values. Some flash games use *8 on the values so I divided my results by 8 and got some decimal addresses that could be in the range of the hp values... but it's all guesswork. I'd really rather not use mob ID's for targeting, been there, done that, doesn't work well. All I want my targeting system to do is tell me if the mob has full hp or not, by comparing it with its max hp. I don't want a system that only targets specific mobs.

Quote:

Originally Posted by Sᴡoosh

Yeah I understood from the beginning on how you searched for the dynamic addresses - but what I do not understand is how you can have so much patience and do this every time you restart PW :D

I would have fucked that approach the 2. time - im a lazy ass :D

Does your software use dynamic addresses for hp values?

11/08/2011 22:19 Sᴡoosh#8

Mine scans mob struct for target ID and if it finds a match, it returns mob HP. It actually works very straight forward and clean, never had a problem with it.

My client does not crash either, it's just that I cannot let it run too long, as I need to save power :D

Cheers

11/08/2011 22:35 zerosmoke#9

Quote:

Originally Posted by Sᴡoosh

Mine scans mob struct for target ID and if it finds a match, it returns mob HP. It actually works very straight forward and clean, never had a problem with it.

My client does not crash either, it's just that I cannot let it run too long, as I need to save power :D

Cheers

Meh, I don't have the time to figure out how I'd need to modify mine to work like that. Back to pixelsearch for me.

Cheers

11/08/2011 23:09 Sᴡoosh#10

Alright, good luck :)

11/09/2011 09:54 dumbfck#11

I would have thought pixel searching was more of a PITA than using the mob struct, to be honest.
What language are you using? (I'd assume AutoIt or AHK if you're doing pixel searching?).

11/09/2011 15:25 zerosmoke#12

Quote:

Originally Posted by dumbfck

I would have thought pixel searching was more of a PITA than using the mob struct, to be honest.
What language are you using? (I'd assume AutoIt or AHK if you're doing pixel searching?).

Yeah, it's written in Autoit, loosely based off MHS, but I've edited the code to add more features and add little tweaks such as email/sms notification if the bot dies, use of genie to prevent leveling, auto-log in case of genie being full of exp, chat detection and auto-random-reply, etc etc etc.

Basically my code has gone from:

Global $CFG_BASEADDRESSTARHP_KEY = "Base_AddressTARHP"
Global $CFG_BASEADDRESSTARMAXHP_KEY = "Base_AddressTARMAXHP"

Func CheckTarHP()
$TarMAXHP = _MemoryRead($APP_BASE_ADDRESSTARMAXHP, $PROCESS_INFORMATION)
$TTarHP = _MemoryRead($APP_BASE_ADDRESSTARHP, $PROCESS_INFORMATION)
$TARGET_STATE = _MemoryPointerRead($APP_BASE_ADDRESS, $PROCESS_INFORMATION, $OFFSET_AT)
$TarHP = $TTarHP
$TARHP_PERC = $TarHP / $TarMAXHP * 100
EndFunc

...
(targeting code)
ControlSend($APP_TITLE,"","","{tab}")
Sleep(1500)
$TarMAXHP = _MemoryRead($APP_BASE_ADDRESSTARMAXHP, $PROCESS_INFORMATION)
Sleep(1500)
CheckTarHP()
Sleep(1500)
If $TarHP = $TarMAXHP Then
KillTarget()
Else
Sleep(1500)
TargetMob()
EndIf
...

to this:

ControlSend($APP_TITLE,"","","{tab}")
Sleep(1500)
Sleep(1500)
$coord = PixelSearch(308, 452, 332, 468, 0xCA2712)
If Not @error Then
KillTarget()
Else
Sleep(1500)
TargetMob()
EndIf

...I simply put the mob hp/info bar down in a specific place when I launch the client so it reads the top/end part of the hp bar looking for the last color. Works fairly fast too. If the mob has even been hit a little bit it knows and won't attack. I would rather compare hp values, but since I need the client window in focus for my hunting/relocation/chat detection feature to work, it's not like it matters as far as that goes.

11/09/2011 15:36 dumbfck#13

I'll write a proper post when I get home later. The mob struct is really quite simple, so I'll knock something up in AutoIt.

Also, someone here wrote a thread about [Only registered and activated users can see links. Click Here To Register...] which can be used without having the client window focused ;)

11/09/2011 19:43 amineurin#14

the best is, u take a look on prophet bots source code.
theres all u need inside, like targeting, mob hp and much more.
for genie exp, use interest07 packet to fill genie with exp.

if this board was moderated, a lot info not get lost.
im on it, but reaction of epvp is such slow...remember me on pwi support :D

11/09/2011 23:47 dumbfck#15

Oh yeah - Nearly forgot :P

I still hate AutoIt, so my code probably isn't by any means written nicely lol - but anyway, here's a simple demo for reading mob info using the mob struct. I made it a fully runnable script so you can play with it / inspect it if you feel the need.

I originally tried to not bother rescanning for the NPC / Mob index if the target ID hadn't changed, but then I forgot that if a new mob pops up, or you move in range of more mobs / NPCs the index can change as the hashtable is completely rebuilt - So unfortunately you do have to scan through the full list each time (well - you break the loop when you find it) so it probably can't get any more efficient in that respect. I believe this doesn't happen in the unordered NPC / mob list, but for that one you have to potentially scan up to 768 values to find it. That's probably more efficient in the long run, but meh :P

I was hoping that the AutoIt debugger amineurin recently showed me might make AutoIt less painful, but it's pretty horrendous xD. Oh well, thanks anyway ami ^^

One day when I can be arsed, I might compile a thread of all the little snippets of code for things like mob / npc / people lists along with how to find them. We'll see lol

Anyway, here's the code:

Spoiler

Code:

#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
#include <StaticConstants.au3>
#include <NomadMemory.au3>
#include <Array.au3>

Opt("GUIOnEventMode", 1) ;0=disabled, 1=OnEvent mode enabled
$hGui = GUICreate("PWI Simple target info by dumbfck", 330, 100)
$lblMobId = GUICtrlCreateLabel("NPC / Mob ID: ", 10, 15, 130, 15)
$lblMobName = GUICtrlCreateLabel("NPC / Mob Name: ", 10, 35, 130, 15)
$lblMobMaxHp = GUICtrlCreateLabel("NPC / Mob Max HP: ", 10, 55, 130, 15)
$lblMobHp = GUICtrlCreateLabel("NPC / Mob HP: ", 10, 75, 130, 15)

$lblMobIdVal = GUICtrlCreateLabel("", 150, 15, 130, 15)
$lblMobNameVal = GUICtrlCreateLabel("", 150, 35, 130, 15)
$lblMobMaxHpVal = GUICtrlCreateLabel("", 150, 55, 130, 15)
$lblMobHpVal = GUICtrlCreateLabel("", 150, 75, 130, 15)

GUISetOnEvent(-3, "_Quit")

Global $kernel32 = DllOpen('kernel32.dll')

Global $procName = "elementclient.exe"
Global $processes
Global $pid
Global $pHandle

; Are assigned in constructOffsets()
Global $baseCall = 0xB28AC4
Global $baseAddress
Global $offsetTargetId = 0xB68

Global $targetIndex, $targetId, $prevTargetId = 0


GUISetState(@SW_SHOW, $hGui)

$processes = ProcessList($procName)
If UBound($processes) < 2 Then    ; first entry is always empty
    MsgBox(16, 'Error', 'No elementclients found')
    Exit
Else
    $pid = $processes[1][1] ; [x][1] = PID of process
    $pHandle = _MemoryOpen($pid)
EndIf

; Loop forever
While 1
    getTargetIndex();
    
    if not $targetId = 0 Then
        Local $aryNpc[7] = [0x00, 0x1C, 0x1C, 0x24, 0x50, $targetIndex * 4, 0x11C]
        $id = _MemoryPointerRead($baseCall, $pHandle, $aryNpc)
        GUICtrlSetData($lblMobIdVal, Hex($id[1]))
        
        $aryNpc[6] = 0x12C
        $maxHp = _MemoryPointerRead($baseCall, $pHandle, $aryNpc)
        GUICtrlSetData($lblMobHpVal, $maxHp[1])
        
        $aryNpc[6] = 0x16C
        $hp = _MemoryPointerRead($baseCall, $pHandle, $aryNpc)
        GUICtrlSetData($lblMobMaxHpVal, $hp[1])
        
        Local $aryName[8] = [0x00, 0x1C, 0x1C, 0x24, 0x50, $targetIndex * 4, 0x254, 0x00]
        $name = _MemoryPointerRead($baseCall, $pHandle, $aryName, 'wchar[30]')
        GUICtrlSetData($lblMobNameVal, $name[1])

    Else
        GUICtrlSetData($lblMobMaxHpVal, "")
        GUICtrlSetData($lblMobMaxHpVal, "")
        GUICtrlSetData($lblMobMaxHpVal, "")
        GUICtrlSetData($lblMobMaxHpVal, "")
    EndIf
    
    Sleep(200)
WEnd

Func getTargetIndex()
    Local $aryTargetId[4] = [0x00, 0x1C, 0x34, $offsetTargetId]
    Local $i, $npcId, $found = false
    $targetId = _MemoryPointerRead($baseCall, $pHandle, $aryTargetId)
    $targetId = $targetId[1]
    
    if not $targetId = 0 Then
        Local $aryNpcCount[5] = [0x00, 0x1C, 0x1C, 0x24, 0x14]
        $npcCount = _MemoryPointerRead($baseCall, $pHandle, $aryNpcCount)
        $npcCount = $npcCount[1]
        Local $aryNpcId[7] = [0x00, 0x1C, 0x1C, 0x24, 0x50, 0x00, 0x11C]
        ;ConsoleWrite('NPC count ' & $npcCount & @CRLF)
        For $i = 0 to $npcCount
            $aryNpcId[5] = $i * 4
            $npcId = _MemoryPointerRead($baseCall, $pHandle, $aryNpcId)
            $npcId = $npcId[1]
            ;ConsoleWrite($i & ' ' & Hex($npcId) & @CRLF)
            If $npcId = $targetId Then
                ;ConsoleWrite('Found ' & Hex($npcId) & @CRLF)
                $found = true
                ExitLoop
            EndIf
        Next
        
        if $found Then
            $targetId = $npcId
            $targetIndex = $i
        Else
            $targetId = 0
            $targetIndex = 0
        EndIf
    EndIf
    
    $prevTargetId = $targetId
    
EndFunc

Func _Quit()
    Exit
EndFunc   ;==>_Quit