[CODE]Ingame Functions( POST YOUR FINDINGS HERE )

[ntKid]

Hi guys, here is how to send a Skill using SkillId ( not using a keyboard press )

//Retrieves the skill ID from the actual slotbar
ULONG myGetSkillIdFromSlotBar( ULONG lpSlot, ULONG lpBase = 0x0179D9B0 )
{
	ULONG dwDelta = ( lpSlot - 1 ) * 4, dwRes = NULL;

	__asm
	{
		mov eax, lpBase;
		mov eax, [ eax ];
		mov edi, dwDelta;
		mov eax, [ eax + 0x00000004 ];
		mov eax, [ eax + 0x0000000C ];
		mov eax, [ eax + 0x00000604 ];
		mov eax, [ eax + 0x00000004 ];
		mov eax, [ eax + edi ];
		mov dwRes, eax;
	}
	return dwRes;
}

//Send skill by Id
VOID mySendSkillID( ULONG lpSkillId, ULONG lpBase = 0x0179D87C, ULONG lpFunction = 0x006F1DA0 )
{
	__asm
	{
		mov edi, lpBase;
		mov edi, [ edi ];
		mov edi, [ edi + 0x000000A0 ];
		mov edi, [ edi + 0x00000010 ];
		mov eax, 0x00000000;
		mov esi, lpSkillId;
		push eax;
		push eax;
		mov eax, [ esi + 0x00000008 ];
		shr eax, 0x0C;
		and eax, 0x0000FFFF;
		push eax;
		mov ecx, edi;
		call lpFunction;
	}
}

//here is an example for sending the skill that is on your number 1 key using game engine.
mySendSkillID( myGetSkillIdFromSlotBar( 1 ) );

Here is how you can query your current target agro information, can be tweaked to index the treasures drops or index the nearest monster on your Field of Vision. ( Usefull to stop using the tab key aswell just need to get select target function )

ULONG myGetMonsterTargetbyID( ULONG lpMonsterId, ULONG lpBase = 0x0179D9D8 )
{
	ULONG dwTargetId = NULL;

	__asm
	{
		mov ecx, lpBase;
		mov ecx, [ ecx ];
		mov esi, ecx;
Search:
		mov eax, [ esi + 0x00000008 ];
		mov ebx, [ eax + 0x00000178 ];
		cmp ebx, lpMonsterId;
		je FoundId;
		mov esi, [ esi ];
		cmp esi, ecx;
		je Finnished;
		jmp Search;
FoundId:
		mov ebx, [ eax + 0x00000170 ];
		mov dwTargetId, ebx;
Finnished:
		;
	}

	return dwTargetId;
}

Here is an example of selecting the nearest target using the game engine

VOID mySelectNearestTarget( ULONG lpBase = 0x00F38224, ULONG lpFunction = 0x0068DB50 )
{
	__asm
	{
		mov esi, lpBase;
		mov esi, [ esi ];
		push 0x00000001;
		mov ecx, esi;
		call lpFunction;
	}
}

//most basic multiclient bot example.
mySelectNearestTarget( );
mySendSkillID( myGetSkillIdFromSlotBar( 1 ) );

Camera View Distance

/*
Sometimes the monsters are in your field of vision but they are so far away 
that you cannot tab it for selection just change the maximum view distance.
Dont forget to VirtualProtect it to PAGE_EXECUTE_READWRITE 
before writting, or just use cheat engine on address 
00E07C78 ( FLOAT ) and set it to ur needs.
*/
*( PFLOAT )0x00E07C78 = 3600;

Based on Thr!ce research this ( linked list ) will index the items on your inventory you can get the SlotBase structure ( thx Thr!ce )

ULONG dwSlotArray = *( PULONG )( *( PULONG )( *( PULONG )( ( *( PULONG )0x0179D920 ) + 0x00000214 ) + 0x000000F0 ) + 0x00000038 ) + 0x00000010;

while( dwSlotArray )
{
	PULONG dwSlotBase = *( PULONG )( dwSlotArray + 0x0000000C );
	
//dwSlotBase = EAX from GetInventoryBase ( Thr!ce ) - CODE GOES HERE


	dwSlotArray = *( PULONG )dwSlotArray;//next slot

}

Walk to Position( X, Y )

//This will allow you to move to a specific position, usefull for melee classes return back to spot
when botting.
INT MoveToPosition( FLOAT lpX, FLOAT lpY, ULONG lpFunction = 0x00885CB0 )
{
	ULONG dwRes = NULL;

	__asm
	{
		mov eax, lpFunction;
		call eax;
		cmp eax, dwRes;
		je Finnish;
		mov ecx, eax;
		mov eax, [ eax ];
		mov eax, [ eax + 0x00000014 ];
		push lpY;
		push lpX;
		call eax;
		mov dwRes, eax;
Finnish:
		;
	}

	return dwRes;
}
//usage
MoveToPosition( 800, 500 );//will make your character walk to position 800,500 of current map

Warp to position

/*
This is usefull to warp directly into bosses on dungeons, by clicking the boss name on the
quest list.
006E1E63 ( BYTE ) and set it to 0xD8 = On, 0xD9 = Off
*/
*( PBYTE )0x006E1E63 = 0xD8;// D8 On/ D9 Off

a simple LUA editable bot and source code example using Thr!ce AFKLoader and these functions.

If this is usefull for you please credit me and press thanks button( this will keep me happy enough to make some of my research public in the future )

Here is some suggestions to have a look at:

-

-

-

-

-



-

CODE SHARES:
-

-

-

-

-

-

-

-

-

-

-

You are welcome to post your findings on this thread aswell.

[AlainProvist]

Thanks for sharing .

I know this is supposed to be the basics but how did you find your lpBase ? On which client version are you using this ?

[ntKid]

Originally Posted by AlainProvist

Thanks for sharing .

I know this is supposed to be the basics but how did you find your lpBase ? On which client version are you using this ?

Thanks for feedback Alain this is working with the current client ( Katar Update ), i just searched for the shortest pointer i could find and rescanned it ( closing and starting the game several times ) since it was returning valid values for every session i just assumed these are correct and are not DMA.

[TheStupidDog]

Great work ntKid Hopefully more bots will surface soon. Personally, I'm only looking for a way to just spam keys without doing anything else (basically to speed up AFK farming a little). Appreciate you sharing your findings bud Thanks pressed!

[lensur13]

What programming language? STEP TO USE THAT?

[TheStupidDog]

No offense, but if you can't tell what language that is I doubt you'll be able to use it But to answer your question it's assembler I believe.

[errorlog2]

what tools do you use?

[Thr!ce]

Nice find, bye bye VM .

[Omdi]

Why not using packets :O?

[Shane¸]

Originally Posted by Omdihar

Why not using packets :O?

the client has some weird encryption thus it's easier for now

[pureleech]

are you guys gonna make a bot for this game or just using those code for personal use?

[Shane¸]

Originally Posted by pureleech

are you guys gonna make a bot for this game or just using those code for personal use?

you're pretty impatient

[Omdi]

Originally Posted by Shane¸

the client has some weird encryption thus it's easier for now

I'll have a look at the encryption later, gonna release something like a packet sniffer then

Originally Posted by pureleech

are you guys gonna make a bot for this game or just using those code for personal use?

After my current projects are finished, I'll try my best to create a clientless bot

[Oriya9]

Originally Posted by Omdihar

I'll have a look at the encryption later, gonna release something like a packet sniffer then

That'd be a game-changing event. would **** love to see the encryption algorithm released.
will you also release the source of such packet sniffer?

[Omdi]

Originally Posted by Oriya9

That'd be a game-changing event. would **** love to see the encryption algorithm released.
will you also release the source of such packet sniffer?

Sure if you want