Show HP of the targeted mobs

07/05/2010 10:58 gail137#1
Hi all!

Has anybody a modified client or a program witch show the actual targeted mob's hp? It would be very greatful, if it could see...

p.s.:Sorry for my bad english.
07/12/2010 16:36 No0oB#2
??? what pw version are you playing ? in pw int. you can see the mobs hp ^^"
or do you mean the hp of other players ?
07/13/2010 14:43 gail137#3
I play with malaysian version client on a private server.

Yeah I know, the mob's hp is seen, but just with a red bar. I would like to see the exact hp value (for example in HH 2-2 last boss...2,2M, or 235k hp or 1,56k hp etc.)
Naturally if it is not very hard it could be use to see the hps of other players.
I had long time ago a chineese hack, which could do it. But at the moment i can not use this hack...:S All of theese reasons i ask your helps;)
07/14/2010 20:29 No0oB#4
ok ^^ idk why but in pwi mobs exact HP stands over the red hp bar ^^" ( like 124/124)
but i'll try to figure out how to show this value ^^
07/15/2010 18:54 gail137#5
Hi again!

I founded some pictures on my pc to show how i would like to see the hp's of the mobs and of the players, npcs:
[Only registered and activated users can see links. Click Here To Register...]
[Only registered and activated users can see links. Click Here To Register...]
[Only registered and activated users can see links. Click Here To Register...]

I hope i helped you a little...thanks in advance for the program..=)
07/16/2010 07:19 No0oB#6
ok so you want to see hp after the name ?
ok i'think i can do this but idk if that works for you pw... it'll may be only for pw international ^^"
07/16/2010 12:28 chakjii#7
well i couldnt find the exact hp of the mobs in memory (like 1234/2341)
but the percent value... target a mob with full hp, search in tsearch for the value "100", attack the mob a little and search for a decreased value within the results and you'll find it =)

have fun
07/20/2010 01:39 No0oB#8
i've made a tool to show you the id name and hp (like 500/600) of other players ^^
it's a little bit buggy but if there are some problems with showing the name just select your char or do a right click on the tools window ^^

if you want to see infos about mobs you can use my PwTool ^^

the file with x64 in its name is compiled for 64bit systems(idk if this works but if not the other file should work ^^
07/20/2010 18:01 gail137#9
Hm... i would like to thanks in adnvance...but i does not work...maybe ....i....so i summarize my experiences about your program....

Does the pwtool.exe requires offset.ini? 'cause without offset it not work the hp mp values are wrong...

My offset:
[Perfect_World_Base_Address_In_Decimal]
Application_Title=Element Client
Base_Address=9451524
[Custom_32_Offsets_In_Decimal]
Fly_Offset=1580
Jump_Offset=2824
Zoom_Offset=2042
Target_Offset=2584
HP_Offset=1104
MaxHP_Offset=1144
MP_Offset=1108
MaxMP_Offset=1148
PetHP_Offset=3020

If i copy my offset in the dir of the pwtools.exe...the hp mp values are working correctly but....
the agi str etc value is not correct...experience wrong too...
the target ID for example:x8010144E but the name id hp does not work...
if i refresh the list nothing is in it...:S (found 0)

the x64 version is not working (line 9234 Error subscript used with non-array variable...:S but i ve got x64 win

i have not idea wwhat i have to change in the custom offset?! hat kind of parameter is need for the pwtools.exe?

Have you got any idea to solve the problem?
07/21/2010 04:25 No0oB#10
maye ^^ what pw are you playing ? this tools are made for pw int. but i added the ini stuff to make some functions work on other pw versions like my-en ^^" so i'm sorry if this is not fully working for you ^^" and the experience is calculated with a static address ($yourlevel * 4 + $StaticAddress) and if the static is not the same like in pwi it's not working... sry ^^ i only have pwi ant can't download other version because i have only a dl rate of 7kb/s -.-

this is the stuff for PW Int. to run PwTool correctly ^^ (you need to change this for your pw)
Code:
[Perfect_World_Base_Address_In_Decimal]
Base_Address=10437900
Base_Address_Offset=32
Unfreeze_Address=10439036
[Custom_32_Offsets_In_Decimal]
Jump_Offset=3068
Fly_Offset=1648
Target_Offset=2816
CharID_Offset=1112
Name_Offset=1552
Name_Overhead_Offset=1752
LVL_Offset=1124
Class_Offset=1560
HP_Offset=1132
MaxHP_Offset=1196
MP_Offset=1136
MaxMP_Offset=1200
VIT_Offset=1180
STR_Offset=1188
MAG_Offset=1184
DEX_Offset=1192
Gold_Offset=1328
EXP_Offset=1140
Spirit_Offset=1144
Attribute_Offset=1148
Reputation_Offset=1290
[Custom_Mob_Offsets_In_Decimal]
Level_Offset=292
ID_Offset=284
Type_Offset=180
Name_Offset=596
07/21/2010 20:25 gail137#11
Ok-ok.

I started to search for the offsets:
I found a lot of them:
[Perfect_World_Base_Address_In_Decimal]
Application_Title=Element Client
Base_Address=9451524
Base_Address_Offset=32
Unfreeze_Address=10324444
[Custom_32_Offsets_In_Decimal]

Fly_Offset=1580
Target_OffSet=2584
CharID_Offset=1084
Name_Offset=1508
Name_overhead_Offset=1708
Class_Offset=1516
MaxMP_OffSet=1148
MaxHP_OffSet=1144
MP_OffSet=1108
HP_OffSet=1104
Name_Offset=1552
Jump_Offset=2824
VIT_Offset=1128
MAG_Offset=1132
STR_Offset=1136
DEX_Offset=1140
Gold_Offset=1276
EXP_Offset=1112
Spirit_Offset=1116
Attribute_Offset=1120
Reputation_Offset=1262

with these offsets the mob's ID is working correctly...but i do not know how have i search for the following offsets?

Unfreeze_Address;
CharID_Offset;
Name_Offset;(like text? or 4 byte?)
Name_Overhead_Offset;
LVL_Offset;
Class_Offset;

and the main offsets:
[Custom_Mob_Offsets_In_Decimal]
Level_Offset; ( i try to search for the lvl like 4 byte but nothing:S
ID_Offset;
Type_Offset;
Name_Offset;?

Which are floats from these offset? or how did you search them?
[Only registered and activated users can see links. Click Here To Register...]

And the exact version of the pw is 2.2.0 build 2265.
07/21/2010 21:09 No0oB#12
the names you can find by searching for text ^^
the pointer for the names is: baseaddress + nameoffset + 0
same the overhead name ^^
the mob stuff is not that easy totell you how to fin it sry ^^"
07/22/2010 00:58 lolkop#13
the mobstuff isn't more hard to handle than the player stuff.

if you're using a debugger and set breakpoints on the values, u'll find this structure to get the current mob hp:
Code:
clientbase + 0x1C + 0x8 + 0x24 + 0x18+ X*0x4 + 0x4 + 0x12C
well since 0x12C the the hp offset, the stuff before that points to the mob base.

if you check the 5th offset u'll see that there's a variable in it. the client seems to allways keep track of all npcs/pets/mobs in ur range.
you can easily use that for your tool. make it loop through that mob table (from 0 to 768) to get all mobs around you.

now that u've got the infos for all mobs around you, you can simply filter out the mob u've selected from that list.

to get the selected mobs id, you can use this structure:
Code:
clientbase + 0x1C + 0x20 + 0xB00
now that u've got the mob base, you can take a look deeper in it. comparing the info of more mobs will get you more adresses, which could be helpfull for your tool later.

for me i found those adresses kinda helpful:
Code:
selected type = 0 (mob/npc/pet?)
cur HP = 0x12C
max HP = 0x16C
xtra info = 0x248
so when u're done, you should be able to build up this code:
Code:
Func GetSelectedInfo($pid)
	Local $array[8], $mid, $clientbase, $base, $pointer1, $pointer2, $pointer3, $pointer4, $mob_base, $mob_id, $mob_name, $mob_lvl, $i
	$mid = memopen($pid)
	$clientbase = memread($mid, 0x9F3E6C)
	$base = memread($mid, $clientbase + 0x1C)
	$selected = memread($mid, memread($mid, $base + 0x20) + 0xB00)
	If $selected = 0 Then  ; If nothing is selected, there's no need to display anything.
		Return False
	EndIf
	$pointer3 = memread($mid, memread($mid, memread($mid, $base + 0x8) + 0x24) + 0x18)
	For $i=0 To 768
		$pointer4 = memread($mid, $pointer3 + $i*0x4)
		$mob_base = memread($mid, $pointer4 + 0x4)
		If $mob_base<>0 Then
			$mob_id = memread($mid, $mob_base + 0x11C)
			If $selected = $mob_id Then
				$array[0] = memread($mid, $mob_base + 0x12C) ;cur HP
				$array[1] = memread($mid, $mob_base + 0x16C) ;max HP
				$array[2] = $array[0]/$array[1] * 100 ;percentage
				$array[4] = memread($mid, memread($mid, $mob_base + 0x254), 'wchar[30]') ;Mob Name
				$array[5] = memread($mid, $mob_base + 0x124) ; Mob Level
				Switch memread($mid, $mob_base + 0x248)
					Case 0
						$array[6] = 'normal'
					Case 1
						$array[6] = 'Increased Movement'
					Case 2
						$array[6] = 'Unknown Special'
					Case 3
						$array[6] = 'Increased Defence'
					Case 4
						$array[6] = 'Increased Magical Resistance'
					Case 5
						$array[6] = 'Increased Attack'
					Case 6
						$array[6] = 'Increased Magical Attack'
					Case 7
						$array[6] = 'Sacrificial Assault'
					Case 8
						$array[6] = 'Increased Life'
					Case 9
						$array[6] = 'Weak'
				EndSwitch
				Switch memread($mid, $mob_base)
					Case 0x90F888
						$array[7] = 'NPC'
					Case 0x90F5D8
						$array[7] = 'Mob'
					Case 0x90F9C8
						$array[7] = 'Pet'
				EndSwitch
				Return $array
			EndIf
		EndIf
	Next
	memclose($mid)
EndFunc
whis could be used like this for example:
Code:
Dim $pid = ProcessExists("elementclient.exe"), $old_hp, $old_name
While 1
	$info = GetSelectedInfo($pid)
	If IsArray($info) Then
		If $info[4]<>$old_name Then
			$old_name = $info[4]
			ConsoleWrite(@CRLF)
			ConsoleWrite($info[7]&' Name: '&$info[4]&' (lvl '&$info[5]&')'&@CRLF)
			ConsoleWrite('Special Info: '&$info[6]&@CRLF)
		EndIf
		If $info[0]<>$old_hp Then
			$old_hp = $info[0]
			ConsoleWrite($info[7]&' HP: '&$info[0]&'/'&$info[1]&' ('&Round($info[2],2)&'%)'&@CRLF)
		EndIf
	EndIf
	Sleep(10)
WEnd
and it will return something like this:
Code:
Mob Name: Venomous Ghoul (lvl 21)
Special Info: Increased Life
Mob HP: 4308/4308 (100%)

Mob Name: Arboride Dryad (lvl 21)
Special Info: Increased Movement
Mob HP: 2633/2633 (100%)
Mob HP: 1464/2633 (55.6%)
Mob HP: 1465/2633 (55.64%)
Mob HP: 1466/2633 (55.68%)
Mob HP: 458/2633 (17.39%)
Mob HP: 459/2633 (17.43%)
Mob HP: 461/2633 (17.51%)
well it's just an example :P, but now that you know how to get a list off all available mobs, you could also use the client function to select special mob ids.

all you need is posted right here:
[Only registered and activated users can see links. Click Here To Register...]

so using this help you should be able to build up a bot, which is able to select mobs, depending on their special status, lvl, name or hp.

for example you could add a function for wizzards, to not attack mobs with increased magical defence.



well maybe u'd like to get some more info about the mo id selection. you can see the client function for selecting the mobs, in the thread i've posted above.

to use all those functions you need the client base, and the call adress.
the function in the client looks like this:
Code:
;~ 0046061D     A1 6C3E9F00       MOV EAX,DWORD PTR DS:[9F3E6C] < ClientBase
;~ 00460622     57                PUSH EDI
;~ 00460623  |. 8B48 20           MOV ECX,DWORD PTR DS:[EAX+20]
;~ 00460626  |. 81C1 EC000000     ADD ECX,0EC
;~ 0046062C  |. E8 8F961800       CALL elementc.005E9CC0 < Call

;~ The ClientBase and the Call may change with every Client update.
;~ So they are the variable adresses we need to search for =)
so why not use autoit to get the adresses we need? :P we've got such lovely stringregexp functions, which are extremely efficient, in finding code.

Code:
$path = "elementclient.exe"
$file = FileOpen($path, 16)
$data = FileRead($file, FileGetSize($path))
FileClose($file)
$select = StringRegExp($data, '(A1(.{8})578B482081C1EC000000E8(.{8}))', 1)
$call_pos = StringInStr($data, $select[0])/2 + 0x40000E
ConsoleWrite('Base = '&rev($select[1])&@CRLF)
ConsoleWrite('Call = '&Hex(('0x'&rev($select[2])) + $call_pos + 5)&@CRLF)

Func rev($string)
	Local $all
	For $i = StringLen($string) + 1 To 1 Step -2
		$all = $all & StringMid($string, $i, 2)
	Next
	Return $all
EndFunc
this function will return something like this (in PWI for example):
Code:
Base = 009F3E6C
Call = 005E9CC0
and there u've got the 2 variable adresses u're looking for =)
07/22/2010 06:39 No0oB#14
thanks lolkop =)
i couldn't say it better :)
(maybe because my english isn't as good as yours xD)
...
i found the structs for players and mats around but my harddisc's crashed -.- and all my stuff and backups was dead -.- and now i can't find them again ^^" maybe you know how to get them again -.- i found the mob struct you are talking about in your post but could't find the other two again -.-
07/22/2010 12:47 gail137#15
Wow..LOL=) At firstly i would like to fix that i am not an IT prof. guy...so thanks for the information, but it was a little bit too much xD I need a little time to understand all informationsxD (i have downloaded autoIT and i will check the tutorials for it)

At firstly i have to set the offsets correctly:
I founded the address for the char name texts like this:

006f4b9f - 66 89 18 -mov [eax],bx
Is this correct? eax;234?

I have got problem to find these offset yet:
CharID_Offset;Name_Offset;Name_Overhead_Offset;

[Custom_Mob_Offsets_In_Decimal]
Level_Offset=??
ID_Offset=??
Type_Offset=??
Name_Offset=??


I think the injection will be the secund part of our "project"=)