PW Descent offsets (ver.612+)

Page 1 of 5 1 23 Last »
02/22/2012 17:09 Merkada#1
PWI:

Code:
Base address -		0xA52AAC (BASE)
Real base address -	0xA521C0 (RBASE)
Unfreeze address -	0xA52F1C
Send packet address -	0x63AA80
-= character info =- (BASE+0x34)
Code:
X coord			+0x3C		(400+X/10)	Float
Y coord			+0x44		(550+Y/10)	Float
Z coord			+0x40		(Z/10)		Float
Genie pointer		+0x3D0
id			+0x480
lvl 			+0x48C
Cultivation 		+0x490
Current HP  		+0x494
Current MP 		+0x498
Current EXP 		+0x49C
Spirit 			+0x4A0
free stats points 	+0x4A4
Current CHI 		+0x4A8
ATK lvl 		+0x4AC
DEF lvl			+0x4B0
Critical % 		+0x4B4	Float
Rage Damage + % 	+0x4B8	Float
Stealth lvl		+0x4BC
Detection lvl		+0x4C0
Slaying lvl		+0x4C4
Warding lvl		+0x4C8
VIT			+0x4CC
MAG			+0x4D0
STR			+0x4D4
DEX			+0x4D8
Max. HP			+0x4DC
Max. MP			+0x4E0
HP regen		+0x4E4
MP regen		+0x4E8
Speed - walk		+0x4EC	Float
Speed - run		+0x4F0	Float
Speed - swim		+0x4F4	Float
Speed - fly		+0x4F8	Float
Accuracy		+0x4FC
Phys. Atk. Min.		+0x500
Phys. Atk. Max.		+0x504
Atk. Rate = 20/value	+0x508	Float
Range			+0x50C	Float
Metal Dmg. Min.		+0x510
Metal Dmg. Max.		+0x514
Wood Dmg. Min.		+0x518
Wood Dmg. Max.		+0x51C
Water Dmg. Min.		+0x520
Water Dmg. Max.		+0x524
Fire Dmg. Min.		+0x528
Fire Dmg. Max.		+0x52C
Earth Dmg. Min.		+0x530
Earth Dmg. Max.		+0x534
Mag. Atk. Min.		+0x538
Mag. Atk. Max.		+0x53C
Metal Def.		+0x540
Wood Def.		+0x544
Water Def.		+0x548
Fire Def.		+0x54C
Earth Def.		+0x550
Phys. Def.		+0x554
Evasion			+0x558
Max. CHI		+0x55C
Coins			+0x560
Coins Max.		+0x564
ID - Weapon		+0x568
ID - Head Wear		+0x56C
ID - Necklace		+0x570
ID - Robe		+0x574
ID - Body Armor		+0x578
ID - Belt		+0x57C
ID - Legs Armor		+0x580
ID - Shoes Armor	+0x584
ID - Bracelet Armor	+0x588
ID - Ring 1 (left)	+0x58C
ID - Ring 2 (right)	+0x590
ID - Ammunition		+0x594
ID - Aerocrafts		+0x598
ID - Fashion Body	+0x59C		ID different from PWDB,
ID - Fashion Legwear	+0x5A0		probably some calculation for color
ID - Fashion Shoe	+0x5A4
ID - Fashion Glove	+0x5A8
ID - Utility Charm	+0x5AC
ID - Mystical Tome	+0x5B0
ID - Smiley		+0x5B4
ID - Guardian Charm	+0x5B8
ID - Spirit Charm	+0x5BC
ID - Bless Box		+0x5C0
ID - Genie		+0x5C4
ID - Vendor License	+0x5C8
ID - Fashion Head	+0x5CC
Reputation		+0x5D8
Trans.state		+0x5DC
Name			+0x664+0x0	Text(Unicode)
Class			+0x66C		0=BM/1=Wiz/2=Psy/3=Veno/4=Barb/5=Sin/6=Archer/7=Cleric/8=Seeker/9=Mystic
Sex			+0x670		0=male / 1=female
target id		+0xBB4
-= pet stats =- (BASE+0x34+0x10B4)
Code:
Pet Current HP		+((pet slot - 1)*4+0x10)+0x38
Pet Current EXP		+((pet slot - 1)*4+0x10)+0x2C
Pet lvl			+((pet slot - 1)*4+0x10)+0x24
Pet hunger		+((pet slot - 1)*4+0x10)+0x8		0=Full/1=High/2=Peckish/4=Hunger/5=Starving
Pet loyalty		+((pet slot - 1)*4+0x10)+0x4
-= action structures for attack, pick, talk, gather =-
Code:
Action Struct.		RBASE+0x1C+0x34+0x109C
Action List		RBASE+0x1C+0x34+0x109C+0x30
Interact With Action	RBASE+0x1C+0x34+0x109C+0x30+0x8
-action finished	RBASE+0x1C+0x34+0x109C+0x30+0x8+0x8
-action start		RBASE+0x1C+0x34+0x109C+0x30+0x8+0x14
-action not start	RBASE+0x1C+0x34+0x109C+0x30+0x8+0x24
-object id		RBASE+0x1C+0x34+0x109C+0x30+0x8+0x20
-X coord of object 	RBASE+0x1C+0x34+0x109C+0x30+0x8+0x28
-Z coord of object	RBASE+0x1C+0x34+0x109C+0x30+0x8+0x2C
-Y coord of object	RBASE+0x1C+0x34+0x109C+0x30+0x8+0x30
-type of action		RBASE+0x1C+0x34+0x109C+0x30+0x8+0x38
-set error		RBASE+0x1C+0x34+0x109C+0x30+0x8+0x34
-skill pointer		RBASE+0x1C+0x34+0x109C+0x30+0x8+0x50
-new action type	RBASE+0x1C+0x34+0x109C+0xC
-set next action	RBASE+0x1C+0x34+0x109C+0x18
-set new action type	RBASE+0x1C+0x34+0x109C+0x14
-= action structures for move =-
Code:
Action Struct.		RBASE+0x1C+0x34+0x109C
Action List		RBASE+0x1C+0x34+0x109C+0x30
Interact With Action	RBASE+0x1C+0x34+0x109C+0x30+0x4
-action finished	RBASE+0x1C+0x34+0x109C+0x30+0x4+0x8
-action start		RBASE+0x1C+0x34+0x109C+0x30+0x4+0x14
-X			RBASE+0x1C+0x34+0x109C+0x30+0x4+0x20
-Z			RBASE+0x1C+0x34+0x109C+0x30+0x4+0x24
-Y			RBASE+0x1C+0x34+0x109C+0x30+0x4+0x28
-heigh			RBASE+0x1C+0x34+0x109C+0x30+0x4+0x68
-???			RBASE+0x1C+0x34+0x109C+0x30+0x4+0x64
-???			RBASE+0x1C+0x34+0x109C+0x30+0x4+0x6C
-move type		RBASE+0x1C+0x34+0x109C+0x30+0x4+0x2C
-new action type	RBASE+0x1C+0x34+0x109C+0xC
-set next action	RBASE+0x1C+0x34+0x109C+0x18
-set new action type	RBASE+0x1C+0x34+0x109C+0x14
-= NPC/mob/pet list (sorted) =-
Code:
NPC count	RBASE+0x1C+0x1C+0x24+0x14
NPC pointer	RBASE+0x1C+0x1C+0x24+0x50+(X*0x4)	X=NPC number (0 ... NPC count)
NPC X coord.	RBASE+0x1C+0x1C+0x24+0x50+(X*0x4)+0x3C	(400+X/10)	Float
NPC Y coord.	RBASE+0x1C+0x1C+0x24+0x50+(X*0x4)+0x44	(550+Y/10)	Float
NPC Z coord.	RBASE+0x1C+0x1C+0x24+0x50+(X*0x4)+0x40	(Z/10)		Float
NPC id		RBASE+0x1C+0x1C+0x24+0x50+(X*0x4)+0x120
NPC pwdb id	RBASE+0x1C+0x1C+0x24+0x50+(X*0x4)+0x124
NPC current HP	RBASE+0x1C+0x1C+0x24+0x50+(X*0x4)+0x130
NPC max. HP	RBASE+0x1C+0x1C+0x24+0x50+(X*0x4)+0x178
NPC name	RBASE+0x1C+0x1C+0x24+0x50+(X*0x4)+0x260+0x0	Text (Unicode)
NPC spec. feat.	RBASE+0x1C+0x1C+0x24+0x50+(X*0x4)+0x254
-= PPL list (sorted) =-
Code:
PPL count	RBASE+0x1C+0x1C+0x20+0x14
PPL pointer	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)	X=PPL number (0 ... PPL count)
PPL X coord.	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x3C	(400+X/10)	Float
PPL Y coord.	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x44	(550+Y/10)	Float
PPL Z coord.	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x40	(Z/10)		Float
PPL id		RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x480
PPL lvl		RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x48C
PPL cultivation	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x490
PPL current HP	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x494
PPL current MP	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x498
PPL max. HP	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x4DC
PPL max. MP	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x4E0
PPL name	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x664+0x0	Text (Unicode)
PPL HP charm	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x59C
PPL MP charm	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x5A0
PPL cathop name	RBASE+0x1C+0x1C+0x20+0x88+(X*0x4)+0x760+0x0	Text (Unicode)
-= Genie =- (BASE+0x34+0x3D0)
Code:
Genie transformation		+0x4
Genie ID			+0x8
Genie X				+0x38		(400+X/10)	Float
Genie Y				+0x3C		(550+Y/10)	Float
Genie Z				+0x40		(Z/10)		Float
Genie current EXP		+0x68
Genie lvl			+0x6C
Genie free stats points		+0x70
Genie total Affinity		+0x94
Genie Metal Affinity		+0x98
Genie Wood Affinity		+0x9C
Genie Watter Affinity		+0xA0
Genie Fire Affinity		+0xA4
Genie Earth Affinity		+0xA8
Genie Current Energy		+0xAC
Genie Max Energy		+0xB0
Genie Energy recovery		+0xB4
Genie Current Stamina		+0xB8
Genie Growth			+0xBC
Genie Max Lucky Points		+0xC0
Genie number of skills		+0xC4
Genie skill 1. pointer		+0xCC
Genie skill 2. pointer		+0xD0
Genie skill 3. pointer		+0xD4
Genie skill 4. pointer		+0xD8
Genie skill 5. pointer		+0xDC
Genie skill 6. pointer		+0xE0
Genie skill 7. pointer		+0xE4
Genie skill 8. pointer		+0xE8

[B]Genie skill pointer[/B]
Skill ID			+0x8
Skill lvl			+0xc
Skill Cooldown remain		+0x10	(ms)
Skill Cooldown time		+0x14	(ms)
Is colldown running		+0x18	0=rdy/1=cooldown
02/22/2012 20:15 jasty#2
Very nice thanks! I noticed there's a new equipment slot which is for an "Order Token". The address for that is probably
BASE+0x34+0x5D0

Though I don't think there is anything available to put there yet lol.
02/23/2012 01:40 Merkada#3
Quote:
Originally Posted by jasty View Post
Very nice thanks! I noticed there's a new equipment slot which is for an "Order Token". The address for that is probably
BASE+0x34+0x5D0

Though I don't think there is anything available to put there yet lol.
yep probably 5D0 or 5D4 one of thees 2 will be order token we will see when it comes to game
02/23/2012 03:42 amineurin#4
thx for your work Merkada :)
02/25/2012 13:39 Sᴡoosh#5
New Buy packet :

Code:
  lPacket.len := 50;
  lPacket.buf[0] := $25;
  lPacket.buf[1] := $00;

  lPacket.buf[2] := $01;
  lPacket.buf[3] := $00;
  lPacket.buf[4] := $00;
  lPacket.buf[5] := $00;

  lPacket.buf[6] := $28;
  lPacket.buf[7] := $00;
  lPacket.buf[8] := $00;
  lPacket.buf[9] := $00;

  Fillmemory(@lPacket.buf[10], 24, $00);

  lPacket.buf[34] := $01;
  lPacket.buf[35] := $00;
  lPacket.buf[36] := $00;
  lPacket.buf[37] := $00;

  copymemory(@lPacket.buf[38], @ID, sizeof(Cardinal));
  copymemory(@lPacket.buf[42], @Shopindex, sizeof(Cardinal));
  copymemory(@lPacket.buf[46], @Number, sizeof(Cardinal));
02/29/2012 23:04 kandersem#6
Hey guys, make a very simple bot like oracle bot was and let it for free usage for that poor ppl who cannot pay any cuote to get a super-bot please. Im sure it is not really hard to do for you.
03/01/2012 00:01 Merkada#7
Quote:
Originally Posted by kandersem View Post
Hey guys, make a very simple bot like oracle bot was and let it for free usage for that poor ppl who cannot pay any cuote to get a super-bot please. Im sure it is not really hard to do for you.
What exactly is expected from that bot?
if u want for example only search mobs and killing + some autopot its a matter of few mins/hours to do that, when u read this forum, every (or most of things) are explained here (action structure, attacking, looting, gathering, flying, moving... etc) of course only 1 thing take change base address with offsets, so in this post u have many of them and atm all working, and if u want bot for free i thing Prophet bot is still for free (fix me if iam wrong, idk coz not using that bot)
03/01/2012 00:31 martmor#8
Quote:
Originally Posted by kandersem View Post
Hey guys, make a very simple bot like oracle bot was and let it for free usage for that poor ppl who cannot pay any cuote to get a super-bot please. Im sure it is not really hard to do for you.
Thats avaiable as I know. Take the Bot from swoosh. He wrote some time ago that he have a free usage function. That should be similar that Oracle was.

Quote:
Originally Posted by Merkada View Post
and if u want bot for free i thing Prophet bot is still for free (fix me if iam wrong, idk coz not using that bot)
Prophetbot closed
03/01/2012 02:05 Interest07#9
if you want a real simple bot, just make an autoit one. Press tab every x seconds, and attack key right after. then before the next tab press pickup.

Optional pixel detection for potions and you're done.

Possibly 20 lines of code or so...
03/01/2012 02:10 amineurin#10
why not use prophet bot ?
its free, source is included and works fine.
you can add functions u like or recode it...u can do what u want.

theres no need of another autoit bot for free...u can donate his work too.
03/01/2012 07:00 kandersem#11
Quote:
if u want for example only search mobs and killing + some autopot its a matter of few mins/hours to do that, when u read this forum, every (or most of things) are explained here (action structure, attacking, looting, gathering, flying, moving... etc)
That's what i'm talking about but i can`t do it because i have no idea how to do it by myself.

Quote:
Thats avaiable as I know. Take the Bot from swoosh. He wrote some time ago that he have a free usage function. That should be similar that Oracle was.
He removed the option to use it for free.
03/01/2012 10:08 -Dutchman-#12
Thanks Merkada!

1 Question.
You have made a simular post like this before, which has proved me most usefull. The previous post also contained a resource section though.

Any chance that will be added later in this post?

[EDIT - March the 5th]
Found them myself after programming a memoryscanner.

(all in hex btw)

Resource count - 00a52aac - 1C - 28 - 14
Resource pointer array - 00a52aac - 1C - 28 - 18
Resource X coord - 00a52aac - 0x1C - 0x28 - 0x18 - (X*0x4) - 0x4 - 0x3C
Resource Y coord - 00a52aac - 0x1C - 0x28 - 0x18 - (X*0x4) - 0x4 - 0x44
Resource name - 00a52aac - 1C - 28 - 18 - (X*04) - 0x4 - 0x168 - 0x0
[/EDIT]
03/01/2012 11:21 Interest07#13
Quote:
Originally Posted by kandersem View Post
That's what i'm talking about but i can`t do it because i have no idea how to do it by myself.
Follow some basic programming tutorials. You just need an understanding of how object oriented programming works so you can better understand the layout of things in the game's memory.

For example, if you want to create a game you want a mainWindow class. This mainWindow class would contain a class dealing with gui, lists of ingame objects such as NPCs and Items on the floor, a class for the player's character, etcetera. This player class obviously needs variables such as HP and MP.

So imagine a game with classes like that:

Code:
main program: //baseAddress contained in realBaseAddress
void* tableWithFunctions; //variable with size 4, at offset 0x0
int var2; //variable with size 4, at offset 0x4
int var3; //variable with size 4, at offset 0x8
int var4; //variable with size 4, at offset 0xC
int var5; //variable with size 4, at offset 0x10
int var6; //variable with size 4, at offset 0x14
int var7; //variable with size 4, at offset 0x18
MainWindow* mainWindow; //variable with size 4, at offset 0x1C
... etc

class MainWindow
{
   void* tableWithFunctions; //variable with size 4, at offset 0x0
   int var2; //variable with size 4, at offset 0x4
   int var3; //variable with size 4, at offset 0x8
   int var4; //variable with size 4, at offset 0xC
   int var5; //variable with size 4, at offset 0x10
   int var6; //variable with size 4, at offset 0x14
   Gui* gui; //variable with size 4, at offset 0x18
   ObjectLists* lists; //variable with size 4, at offset 0x1C
   ObjectUnderCursor* hoveredObject; //variable with size 4, at offset 0x20
   int var7; //variable with size 4, at offset 0x24
   int var8; //variable with size 4, at offset 0x28
   int var9; //variable with size 4, at offset 0x2C
   int var10; //variable with size 4, at offset 0x30
   Player* player; //variable with size 4, at offset 0x34
   .... etc
}

class Player
{
   void* tableWithFunctions; //variable with size 4, at offset 0x0
   int unknownValues[14]; //variable with size 4*14 = 56 (0x38), at offset 0x4
   float xPosition; //variable with size 4, at offset 0x3C
   float yPosition; //variable with size 4, at offset 0x40
   float zPosition; //variable with size 4, at offset 0x44
   int interestingValues[275]; //variable with size 275 * 4 = 1100 (0x44C), at offset 0x48
   int currentHP; //variable with size 4, at offset 0x494
   int currentMP; //variable with size 4, at offset 0x498
}
This is quite like the actual game is layed out, but with many many more variables and classes of course. So ingame when some calculation requires the player's HP, it is requested something like this:
Code:
mainWindow->player->currentHP
The way a bot would get this same value is via a similar method:
Code:
baseAddress = ReadMemory(realBaseAddress);
mainWindow = ReadMemory(baseAddress + 0x1C);
player = ReadMemory(mainWindow + 0x34);
HP = ReadMemory(player + 0x494);
As it doesn't have access to the game's variables, it simulates their position by calculating the offsets and reading from memory at those offsets. This is actually what happens in the compiled game in Assembly anyway. The way you figure out those offsets has been shown in cheatengine guides everywhere, from end to front (HP value down to baseAddress, opposite way a program does it, as you already know what value it is).

So pick up a C++ tutorial and follow it until you more or less understand what is said here and you'll have a perfectly good idea on how to do it yourself. Once you understand the basics of what those offsets actually MEAN, you can easily find ones you need yourself and/or take whatever is available on these forums and adapt it to your own needs. There are plenty of examples on how to read another program's memory etcetera, the only thing holding you back is basic understanding of a program's structure :)

(PS this goes to anyone claiming to not understand things, follow a basic tutorial on pretty much any (object oriented) programming language (C++, C#, Java, or VB or python) and you'll be able to grasp the basic concepts much better, which makes it easy to explain the more intricate bits of bot making.)
03/01/2012 14:16 kandersem#14
Interest07 you are right, and i will get that C++ tutorial.

Thanks for your explanation :)
03/01/2012 14:34 Merkada#15
wow ty so much Interest07, now i know where the offsets comes and what they mean (yes idk that to now, btw i dont need want that), but from your lil tutorial it seems every variable iis in big tree structure with one root (base/realbase)

and from this my new knowledge based my question...

if it is like u said (i know it is :D) maybe it will be better scan all addresses this way

Code:
For $i = 0x0 To 0x50
	For $i = 0x0 To 0x1000
		For $i = 0x0 To 0x1000
			For $i = 0x0 To 0x1000
				... and so on
			Next
		Next
	Next
Next
with step 0x4 and idk maybe 9-10 levels deep of course for every variable type (text(UNI), hex, dec, float...)
then we have all adresses and all "tree" structure from PWI
or better and faster way is own source code of PWI :D

ok and my main question..... with that structure for example for char stats (0x34 actual) we know 0x3C 0x40 0x44 are XYZ coodinates, and then is looooong way to ppl ID (0x480 now), and many many variables in that place, u thing that variables are any usefull and can be used?

cheers and thx for answer
Page 1 of 5 1 23 Last »