Target ID Sirens of War

06/10/2013 21:22 abdct#1

i am trying to read the Target ID for the object you currently clicked on. i mapped it out to 0x00BBC9CC + 0x34 + 0xC20

and in cheat engine i can successfully grab the ID, but here is the twist I can also grab it successfully in my C application as well but after it shows the correct ID for a second it reverts to 0 forcing you to select another to change the value to an ID again, then it reverts to 0 yet again.

this code was working for the decent patch before this private server released the Sirens of war patch (although i had to find the new location of the targetID).

so i guess my question is, is anyone else who grabs the Target ID notice that it shows the correct data when you first click on something, and then reverts back to 0 instead of keeping the last target id value you clicked on stored?

if i can get this working i might release my hack which hooks directx8/9 functions and injects its own drawable content into the game.

[Only registered and activated users can see links. Click Here To Register...]

if you wish to see my code just ask. essentially i just made a readpointer function which you supply a base address, number of levels of pointers to follow, and offset in bytes to add to each pointer level, and i am assigning that address to a structure which aligns all the structures variables with the ones in game so you can simply do for example:

Code:

PLAYER *player_struct = (PLAYER*)ReadPointer((void*)BASEPOINTER, 1, 0x34);
	char output_text[256];

		PrintText("Your Stats", FormX, FormY, GREEN, pFont);

		sprintf_s(output_text, sizeof(output_text), "Physical Attack: %d - %d", player_struct->Min_Attack_Damage, player_struct->Max_Attack_Damage);
		PrintText(output_text, FormX, 15+FormY, GREEN, pFont);

in case anyones wondering, this hack simply displays details about your currently selected target for now, level, current/max HP and MP. I havent implemented the auto potter yet. eventually i will properly code color outputs for your own health/hp and such so you can visibly tell what your hp is at without reading the number. (ex red would mean below 5k hp or something.)

06/11/2013 11:25 Sᴡoosh#2

I havn't actually done anything with PW for like ages now, but as far as I remember, it was constant for me. While a mob was selected, it was != 0.

06/11/2013 20:07 abdct#3

Quote:

Originally Posted by Sᴡoosh

I havn't actually done anything with PW for like ages now, but as far as I remember, it was constant for me. While a mob was selected, it was != 0.

i figured out the problem. it was due to a miscalculation of the padding in my structure.

Max_coins was mapped to 0x564, and then i was adding 0x6BC bytes after that and then creating my TargetID DWORD assuming it would be at 0xC20. well i overlooked that the end Max_Coins is actually at 0x568 and not 0x564 so adding 0x6BC would actually bring my Target_ID to 0xC24, which is obviously wrong and i dont even know why it would read the correct variable for a split second at all.

anyways i changed my byte padding between Max_Coins from 0x6BC to 0x6B8 and all is working well again.

i might release my "hack" if you can even call it that once i am done a few more features.

06/12/2013 13:39 Sᴡoosh#4

Alright, sounds like the sort of errors I did constantly also ;)

06/13/2013 15:28 Shareen#5

Quote:

Originally Posted by abdct

... Target_ID to 0xC24, which is obviously wrong and i dont even know why it would read the correct variable for a split second at all.

Seeing you were off by 4 bytes and considering the symptoms you reported, sounds like you got the offset for target mouse is hovering over.

06/14/2013 20:06 abdct#6

Quote:

Originally Posted by Shareen

Seeing you were off by 4 bytes and considering the symptoms you reported, sounds like you got the offset for target mouse is hovering over.

that could be entirely possible. i never thought about that.

for swoosh or anyone else that might know, is there a specific offset to view your buffs (positive and negative, as well as your current targets buffs (player not a monster)

if so id greatly appreciate it if you told me or linked me to where it may be documented. ive been through a bunch of google translated russian forums and i dont think ive seen it yet.

even an old offset to where it used to be would help. would give me a general area to start looking.

thank you

going to add an pvp warning system that suggest which skills/buffs to use and when not to. ex: when a sin uses maze steps that your pvping, it will warn you to not waste your stuns and movement debuff skills.

06/14/2013 20:13 Sᴡoosh#7

I don't know where exactly it is located anymore, Shareen may be able to tell you that, not sure how up to date his client data is considering latest happenings ;).

I do know it was an offset in character struct, pointing to an array of 2 byte words represending a buff ID.

06/14/2013 20:21 abdct#8

Quote:

Originally Posted by Sᴡoosh

I don't know where exactly it is located anymore, Shareen may be able to tell you that, not sure how up to date his client data is considering latest happenings ;).

I do know it was an offset in character struct, pointing to an array of 2 byte words represending a buff ID.

ah okay that makes sense. do you recall the general wear abouts of it, as in after the hp's, mp's, coins, stats, etc or was it before all those stats. it might of moved, but it would give me a shorter distance to start looking through.

06/15/2013 00:43 Shareen#9

Quote:

Originally Posted by abdct

ah okay that makes sense. do you recall the general wear abouts of it, as in after the hp's, mp's, coins, stats, etc or was it before all those stats. it might of moved, but it would give me a shorter distance to start looking through.

I'm pasting from old code and you should also note, that I never really rechecked this.

active buffs address, offset: 0x370 ~ Pointer to buffs / debuffs on character
active buffs count, offset: 0x374 ~ Number of buffs / debuffs on character

Easiest way to find offsets is to cast a buff on your self (one that produces image under hp, like hp buffs for example) and look for 1. Cast a different one, look for 2. What you end up with will be the count. 4 bytes “back” is the offset for array address.
I can't confirm with certainty, but I recall count being capped at 10.

These aren't really buffs thought. It's pointer to array of effects you get shown below character hp (for self). I'm calling them effects, as in, effect of some cause (like applying skill action).

I never checked how this data is sent for other players, but one can assume it's sent on target request only, like most other player info.

Either way, values contained in array aren't skill ids, but rather effect ids. Skills have different ids, but can have same effect id, like for example, stun.

Each effect has fields like id, image (icon shown below hp bar), description (shown if you hover with mouse over image of effect),...

Looks something like this:
BUFF_ICON_STUN = 1; // Stun - Immobilized for a moment
BUFF_ICON_SLOW_MOVING = 3; // Decrease movement speed
BUFF_ICON_PARALYZE = 8; // Cannot move
BUFF_ICON_POISONING = 13; // Continually being damaged by wood damage
BUFF_ICON_BLEEDING = 17; // Continually being damaged by physical damage
etc,..

Original ones are written in a file inside some *.pck file, I honestly don't recall which one and where. The ones above I pasted from my code, where I was adding them before having access to *.pck files (or knowing this was in there).

And as Swoosh already pointed out, ids are 2 bytes not 4, like you might be used to from most other things in PW.

Edit:
Wasn't clear enough with that last statement. What I meant to say was, array requires traversing in steps of 2 btyes, rather then 4.

So address to arbitrary effect is: dereferenced activeBuffsAddress + (x * $02), where x ranges from 0 to activeBuffsCount-1.

06/15/2013 06:39 abdct#10

thanks for the info i will take a look at it when i get back from my trip in a few days. everything makes sense for the self buffs, but the current targets buffs information seems a bit lacking, but im 80% sure of where to find them.

after i crack open a client and some tools im sure it wouldnt be that long to find them.

im thinking about creating a branding mod, where the squad leader can brand targets (each player in the party loading the mod which communicates to a middle man server which relays information) so that the leader can brand a mob for first second and third kill as well as which to sleep.

although its useless on official servers where everyone can solo an instance, could have some uses for group pk.

would be fun to figure out where a user/mob is on the screen and apply a decal above their head. im not quite sure how that would pan out id have to make some sizing code to resize the decals depending on distance away from the player and such.

good thing this game doesnt have much for anti code hijacking, besides its pwprotector which looks for auto hotkey tools which are mainly only used in japan (searches for process names and attempts to kill them by my understanding).

06/16/2013 08:23 Shareen#11

Quote:

Originally Posted by abdct

would be fun to figure out where a user/mob is on the screen and apply a decal above their head. im not quite sure how that would pan out id have to make some sizing code to resize the decals depending on distance away from the player and such.

If you are planning to use direct3D hook, then coordinates in memory of anything drawn in world = vertex coordinates. You could just take npc location and draw (you would need to offset your decal +some value on height axis for decal to be drawn on top of npc).

To draw on some overlay in 2d space, coordinates for those can be read from npc structure, last time I updated those they fell +8 and +12 bytes after "Selected" offset (gets set when npc is selected by character).

+8 bytes, x 2d screen coordinates
+12 bytes, y 2d screen coordinates

These won't be exactly on the mark (y won't be, to be more specific) due to 3d to 2d conversion.
Below I'm pasting vuduy response to my question why y doesn't always match:

Quote:

Originally Posted by vuduy

The X,Y coordinates are correct when the camera view is top down (ie: 2D view instead of 3D - without the Z plane). When the Z-plane exists, the view is different, and the Y coordinate is a bit off. The X coordinate is correct however since it is not affected by the Z-plane of the camera view. You can calculate mathematically the offset position of the Y coordinate using the X-Y-Z camera angles; but I don't see a need for it

Original post, page 28: [Only registered and activated users can see links. Click Here To Register...]

06/19/2013 01:44 abdct#12

thanks for the response. i have just came back from my trip so i will look into all this soon.

and yes i am using directx hooks for this (right now i am just hooking to draw my game menu, but it would be easy enough to draw in 3d space.)

i think i am just going to apply the decals for player controlled characters for mass pvp. and their x/y/z coords are pretty easy to find.

i will post an update in a day or so with my advancements on the project. its kind of useless developing things like this for a dieing game such as PW, but you dont come across many games that are still played and have little to no protections.

hmm i just cant quite figure this out.

for now i am just grabbing the x/y/z coords of my current player (from the player structure) and i verrified i am getting the correct values, i am just a bit confused as how to setup the vertex's to draw to the screen. i am still learning bits and pieces of directx.

so far my code looks like so. it grabs the address of the player structure from the game and assigns it to my structure. that parts working.

next i declare the vertex structure containing x/y/z and some rhw float which i do not know what it does (found it on google) and the dword color. and then i proceed to fill in the vertex (i am trying to draw a square/rectangle on the character, ill leave offsetting and such for later im just trying to get it on screen.)(BLACK is a define for D3DCOLOR_ARGB(255, 0, 0, 0) )

from there i use a list of functions to set the pDevice options and issue the DrawPrimitive() function to draw to the screen. Although i cannot find my box anywhere to be found, so I am assuming its drawing to some random spot.

Code:

void DrawBrand(pIDirect3DDevice *pDevice)
{
	PLAYER *player_struct = (PLAYER*)ReadPointer((void*)BASEPOINTER, 1, 0x34);

	struct {
		float x,y,z,rhw;
		DWORD dwColor;
	} qV[4] = { 
				{ player_struct->X_Coord, player_struct->Y_Coord + 10, player_struct->Z_Coord, 0.0f, BLACK},
				{ player_struct->X_Coord, player_struct->Y_Coord, player_struct->Z_Coord, 0.0f, BLACK},
				{ player_struct->X_Coord + 10.0, player_struct->Y_Coord + 10.0, player_struct->Z_Coord, 0.0f, BLACK},
				{ player_struct->X_Coord + 10.0, player_struct->Y_Coord, player_struct->Z_Coord, 0.0f, BLACK}
			  };

	pDevice->SetPixelShader(NULL);
    pDevice->SetRenderState(D3DRS_ALPHABLENDENABLE, true);
    pDevice->SetRenderState(D3DRS_DESTBLEND, D3DBLEND_INVSRCALPHA);
    pDevice->SetTexture(0, NULL);
    pDevice->DrawPrimitiveUP(D3DPT_TRIANGLESTRIP, 2, qV, sizeof(qV[0]));
}

am i supposed to add 400 and then divide by 10 like the offset thread says, or are these numbers the actual position i have to draw to.

im going to keep playing around with this for a while and see if i can get anything to draw.

essentially the question is, do i have to modify the coords i pull from the game before i put them in my vertex structure, or leave them alone, as well as what is the rhw float for inside the structure.

edit: i got the box to draw but its far back into the hemisphere behind the mountains and unless you fly up into the sky you cant find it because it is behind the ocean. i think im getting close though.

edit2: i think there is something wrong with my Y axis as you post said (i think). the Z axis successfully moves the box up and down based on player hight, and it is on the same X plain as the character, but it is way to far back into the 3d map.

here are some screen shots
(this shows the box being drawn it has the correct hight (z axis))
[Only registered and activated users can see links. Click Here To Register...]

(this shows how far back it is being drawn, as you can see its behind the mountains and the ocean)
[Only registered and activated users can see links. Click Here To Register...]

the "physical attack" floats are actually me debugging the x/y/z coords. here is what my current code looks like.

Code:

void DrawBrand(pIDirect3DDevice *pDevice)
{
	PLAYER *player_struct = (PLAYER*)ReadPointer((void*)BASEPOINTER, 1, 0x34);

	struct {
		float x,y,z,rhw;
		DWORD dwColor;
	} qV[4] = { 
				{ (400+player_struct->X_Coord/10), (500+player_struct->Y_Coord/10) + 100.0, (player_struct->Z_Coord/10), 0.0f, BLACK},
				{ (400+player_struct->X_Coord/10), (500+player_struct->Y_Coord/10),(player_struct->Z_Coord/10), 0.0f, BLACK},
				{ (400+player_struct->X_Coord/10) + 100.0, (500+player_struct->Y_Coord/10) + 100.0, (player_struct->Z_Coord/10), 0.0f, BLACK},
				{ (400+player_struct->X_Coord/10) + 100.0, (500+player_struct->Y_Coord/10), (player_struct->Z_Coord/10), 0.0f, BLACK}
			  };

    pDevice->SetPixelShader(NULL);
    pDevice->SetTexture(0, NULL);
    pDevice->DrawPrimitiveUP(D3DPT_TRIANGLESTRIP, 2, qV, sizeof(qV[0]));
}

i think my problem is im trying to draw a 2d object in 3d space. thats why my square is messed up, because i set the Z axis in my vertix to 0 and now it is ontop of everything, although i still cant position the box on my character.

i think that is due to i am trying to use the game coords as "screen coords" rather then actual 3d space coords.

im not sure how to work with 3d objects, im going to have to research a bit.