Quote:
Originally Posted by cerbere63
hello,
i like what you've done.
i try to find pwi current offsets but it didn't really work. i don't manage to find real base address etc..
good luck with this project . i will try to work on it too
|
I stumbled around for a long time before I finally sifted through the rubble here to find something that still worked. Here's how you can do it:
Find unfreeze address
----
1. Open PWI client, log in, get on a character, then go to Cheat Engine(CE)
2. Search for 0, exact value, 4 bytes
3. After scan finishes, go to PWI client
4. Freeze PWI with hotkey(don't use f12 if auto culti is set to f12, you'll crash PWI client)
5. Go back to CE, search 1 instead of 0 with "Next scan", and wait for scan to finish.
6. Go back to PWI client, unfreeze with hotkey, go back to CE, search 0 in "Next Scan"
7. After scan finishes, go to PWI client
8. Repeat steps 4 to 7 until you're left with a handful of addresses. When I get down to 10 I'll just add them all to my list below, and one by one I'll click the box on the left that forces change, and change the value to 1, and see if PWI client is unfreezed. If it isn't the one, uncheck it, and try the next one. Once you get the one that unfreezes the client, you're ready to find the base address
Find base address:
----
1. Add that unfreeze address to your list in CE (well, we already did, didn't we?)
2. Right click on that address, and choose 'find out what accesses this address'.
3. Go back to the PWI client, and attack some mobs, lose some hp, whatever, for about 10 seconds. I'm not sure how long it takes, but it doesn't take long.
4. Go back to CE. It's got a box with 'opcodes'.
5. Look in that box, there should be 3 or 4 addresses. They'll say something like 'xxx, [aaa + 00000zzz]'. That zzz in hex is your unfreeze address offset.
6. We're not done yet. Copy that zzz to notepad or write it down. Where it said 'aaa', copy that too, or write it down.
7. Stop that 'opcodes' process and close that box.
8. In CE, search for 'aaa', and make sure to tick the 'hex' box.
9. On the left in the results, you should see a
green address.
That's your base address.
10. Do a victory dance because you just got the base address in probably less than a minute. If, on the other hand, it didn't work, ...well, try it again? I'm not sure where you need to go from there.
Finding the base and char struct offsets
----
Now these I'm not 100% sure about, and this is where it gets tricky and complicated. Anyone who uses CE should know how to get HP values, basically it's just searching for your hp, going back into the client, losing or gaining hp, and then checking with 'next scan' again.
Anyway, you get the HP address, and then add it to your list in CE, and find out 'what accesses this address'. Go back into PWI and goof around and lose some hp, then come back to CE. You should have a few addresses in the 'opcodes' box. They should all have the same suffix, (i.e. this time it's 000004A8).
4A8/1192 is your HP offset.
Find base and player offset
----
While you're there on the 'opcodes' box, check out all four lines. You might see something like this:
------------first line
Code:
00480113 - 8B 8E F4040000 - mov ecx,[esi+000004F4]
00480119 - 88 44 24 28 - mov [esp+28],al
0048011D - 8B 86 A8040000 - mov eax,[esi+000004A8] <<
00480123 - 89 4C 24 30 - mov [esp+30],ecx
00480127 - 8B 8E 140F0000 - mov ecx,[esi+00000F14]
---------------fourth line
Code:
005846AE - 8B D8 - mov ebx,eax
005846B0 - 89 5C 24 28 - mov [esp+28],ebx
005846B4 - 8B 83 A8040000 - mov eax,[ebx+000004A8] <<
005846BA - 8B BB A0040000 - mov edi,[ebx+000004A0]
005846C0 - 89 44 24 34 - mov [esp+34],eax
Don't worry, yes, it's confusing at first, but do you see the similarities? esp+28 is in both addresses, before the HP offset is named. I think I can safely say with a reasonable amount of confidence that that number is your base offset. I just know it works this time (28), it may not work next time.
------------ third line
Code:
0046910D - 89 86 B4040000 - mov [esi+000004B4],eax
00469113 - 8B 4F 04 - mov ecx,[edi+04]
00469116 - 89 8E A8040000 - mov [esi+000004A8],ecx <<
0046911C - 8B 57 0C - mov edx,[edi+0C]
0046911F - 89 96 AC040000 - mov [esi+000004AC],edx
I'm guessing on this one too, but do you see the numbers around 4A8? 04 + 0c in hex = 16, and 16+28 = 44, and that's the current player offset (44).
Another way that you might be able to find the player offset is to take that address up above, [esi+000004A8], and find out what ESI stands for down below. When you find that out, (for example, esi = 18864850), take that address and search for it in HEX with CE.
Pick the first result, I'm not sure if it matters or not, and add it below to your list. Double click it in your list, and tick the 'pointer' box, and below, put in
18864850, and in the 'offset' smaller box above, put your hp offset (4A8, currently) Hit ok, and you'll see the address in your list changed. Now 'find out what accesses this address' on that new address, and it will say 'pointer?', so you say, 'of course, CE, I know it's a pointer, I just put it in there!' :p
My first result says:
Code:
00444ED1 - 0F84 E8000000 - je elementclient.exe+44FBF
00444ED7 - 8B 7C 24 2C - mov edi,[esp+2C]
00444EDB - 8B 11 - mov edx,[ecx] <<
00444EDD - 57 - push edi
00444EDE - B3 01 - mov bl,01
2c in hex is 44, and that is the player offset, no?
Anyways, I hope this helps someone.