![[HELP] Metin2 Pserver AG-Hack](https://www.elitepvpers.com/forum/iconimages/autoit/help-metin2-pserver-ag-hack_ltr.gif){kind=small}
habe mich nach einiger Zeit mal wieder ein bischen mit Metin2 befasst und wollte mich mal darin versuchen, einen eigenen Angriffsgeschwindigkeits-Hack zu schreiben. Hab mir dann hier im Forum einige Tutorials durchgelesen, doch komm ich nicht zum gewünschten Ergebnis.
Habe mich zunächst mit
Turtorial befasst. Also mit CheatEngine die Adresse (16256) herausgesucht, nach Pointern gescannt & einen ausgewählt. In meinem Fall ist das: Code:
"client.app"+016B39C4 Offset1: 328 Offset2: 6B0
Code:
#RequireAdmin
#include <pointer.au3>
SetPrivilege("SeDebugPrivilege", 1)
$pid = WinGetProcess("Game Client")
$openmem = _MemoryOpen($pid)
$baseadress = _MemoryModuleGetBaseAddress($pid,"client.app")
$testoffset1 = "328"
$testoffset2 = "6B0"
$testoffset3 = "016B39C4"
Global $AOffset[3]
$AOffset[0] = 0
$AOffset[1] = Dec($testoffset1)
$AOffset[2] = Dec($testoffset2)
$Aaddress = "0x" & Hex($baseadress + Dec($testoffset3))
$Amemread = _MemoryPointerRead($Aaddress, $openmem, $AOffset, "byte[2]")
$Awert = _ReturnMemoryValue($Amemread[1])
$Awert = Dec($Awert)
;_ReturnMemoryValue hab ich in die pointer.au3 verschoben
while 1
_MemoryPointerWrite($Aaddress, $openmem, $AOffset, "16600", "dword")
wend
Code:
#include-once
#region _Memory
Func _MemoryOpen($iv_Pid, $iv_DesiredAccess = 0x1F0FFF, $if_InheritHandle = 1)
If Not ProcessExists($iv_Pid) Then
SetError(1)
Return 0
EndIf
Local $ah_Handle[2] = [DllOpen('kernel32.dll')]
If @Error Then
SetError(2)
Return 0
EndIf
Local $av_OpenProcess = DllCall($ah_Handle[0], 'int', 'OpenProcess', 'int', $iv_DesiredAccess, 'int', $if_InheritHandle, 'int', $iv_Pid)
If @Error Then
DllClose($ah_Handle[0])
SetError(3)
Return 0
EndIf
$ah_Handle[1] = $av_OpenProcess[0]
Return $ah_Handle
EndFunc
Func _MemoryRead($iv_Address, $ah_Handle, $sv_Type = 'dword')
If Not IsArray($ah_Handle) Then
SetError(1)
Return 0
EndIf
Local $v_Buffer = DllStructCreate($sv_Type)
If @Error Then
SetError(@Error + 1)
Return 0
EndIf
DllCall($ah_Handle[0], 'int', 'ReadProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
If Not @Error Then
Local $v_Value = DllStructGetData($v_Buffer, 1)
Return $v_Value
Else
SetError(6)
Return 0
EndIf
EndFunc
Func _MemoryWrite($iv_Address, $ah_Handle, $v_Data, $sv_Type = 'dword')
If Not IsArray($ah_Handle) Then
SetError(1)
Return 0
EndIf
Local $v_Buffer = DllStructCreate($sv_Type)
If @Error Then
SetError(@Error + 1)
Return 0
Else
DllStructSetData($v_Buffer, 1, $v_Data)
If @Error Then
SetError(6)
Return 0
EndIf
EndIf
DllCall($ah_Handle[0], 'int', 'WriteProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
If Not @Error Then
Return 1
Else
SetError(7)
Return 0
EndIf
EndFunc
Func _MemoryClose($ah_Handle)
If Not IsArray($ah_Handle) Then
SetError(1)
Return 0
EndIf
DllCall($ah_Handle[0], 'int', 'CloseHandle', 'int', $ah_Handle[1])
If Not @Error Then
DllClose($ah_Handle[0])
Return 1
Else
DllClose($ah_Handle[0])
SetError(2)
Return 0
EndIf
EndFunc
Func _MemoryPointerRead ($iv_Address, $ah_Handle, $av_Offset, $sv_Type = 'dword')
If IsArray($av_Offset) Then
If IsArray($ah_Handle) Then
Local $iv_PointerCount = UBound($av_Offset) - 1
Else
SetError(2)
Return 0
EndIf
Else
SetError(1)
Return 0
EndIf
Local $iv_Data[2], $i
Local $v_Buffer = DllStructCreate('dword')
For $i = 0 to $iv_PointerCount
If $i = $iv_PointerCount Then
$v_Buffer = DllStructCreate($sv_Type)
If @Error Then
SetError(@Error + 2)
Return 0
EndIf
$iv_Address = '0x' & hex($iv_Data[1] + $av_Offset[$i])
DllCall($ah_Handle[0], 'int', 'ReadProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
If @Error Then
SetError(7)
Return 0
EndIf
$iv_Data[1] = DllStructGetData($v_Buffer, 1)
ElseIf $i = 0 Then
DllCall($ah_Handle[0], 'int', 'ReadProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
If @Error Then
SetError(7)
Return 0
EndIf
$iv_Data[1] = DllStructGetData($v_Buffer, 1)
Else
$iv_Address = '0x' & hex($iv_Data[1] + $av_Offset[$i])
DllCall($ah_Handle[0], 'int', 'ReadProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
If @Error Then
SetError(7)
Return 0
EndIf
$iv_Data[1] = DllStructGetData($v_Buffer, 1)
EndIf
Next
$iv_Data[0] = $iv_Address
Return $iv_Data
EndFunc
Func _MemoryPointerWrite ($iv_Address, $ah_Handle, $av_Offset, $v_Data, $sv_Type = 'dword')
If IsArray($av_Offset) Then
If IsArray($ah_Handle) Then
Local $iv_PointerCount = UBound($av_Offset) - 1
Else
SetError(2)
Return 0
EndIf
Else
SetError(1)
Return 0
EndIf
Local $iv_StructData, $i
Local $v_Buffer = DllStructCreate('dword')
For $i = 0 to $iv_PointerCount
If $i = $iv_PointerCount Then
$v_Buffer = DllStructCreate($sv_Type)
If @Error Then
SetError(@Error + 3)
Return 0
EndIf
DllStructSetData($v_Buffer, 1, $v_Data)
If @Error Then
SetError(8)
Return 0
EndIf
$iv_Address = '0x' & hex($iv_StructData + $av_Offset[$i])
DllCall($ah_Handle[0], 'int', 'WriteProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
If @Error Then
SetError(9)
Return 0
Else
Return $iv_Address
EndIf
ElseIf $i = 0 Then
DllCall($ah_Handle[0], 'int', 'ReadProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
If @Error Then
SetError(3)
Return 0
EndIf
$iv_StructData = DllStructGetData($v_Buffer, 1)
Else
$iv_Address = '0x' & hex($iv_StructData + $av_Offset[$i])
DllCall($ah_Handle[0], 'int', 'ReadProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
If @Error Then
SetError(3)
Return 0
EndIf
$iv_StructData = DllStructGetData($v_Buffer, 1)
EndIf
Next
EndFunc
Func SetPrivilege( $privilege, $bEnable )
Const $TOKEN_ADJUST_PRIVILEGES = 0x0020
Const $TOKEN_QUERY = 0x0008
Const $SE_PRIVILEGE_ENABLED = 0x0002
Local $hToken, $SP_auxret, $SP_ret, $hCurrProcess, $nTokens, $nTokenIndex, $priv
$nTokens = 1
$LUID = DLLStructCreate("dword;int")
If IsArray($privilege) Then $nTokens = UBound($privilege)
$TOKEN_PRIVILEGES = DLLStructCreate("dword;dword[" & (3 * $nTokens) & "]")
$NEWTOKEN_PRIVILEGES = DLLStructCreate("dword;dword[" & (3 * $nTokens) & "]")
$hCurrProcess = DLLCall("kernel32.dll","hwnd","GetCurrentProcess")
$SP_auxret = DLLCall("advapi32.dll","int","OpenProcessToken","hwnd",$hCurrProcess[0], _
"int",BitOR($TOKEN_ADJUST_PRIVILEGES,$TOKEN_QUERY),"int*",0)
If $SP_auxret[0] Then
$hToken = $SP_auxret[3]
DLLStructSetData($TOKEN_PRIVILEGES,1,1)
$nTokenIndex = 1
While $nTokenIndex <= $nTokens
If IsArray($privilege) Then
$ntokenvar=$ntokenindex-1
$priv = $privilege[$ntokenvar]
Else
$priv = $privilege
EndIf
$ret = DLLCall("advapi32.dll","int","LookupPrivilegeValue","str","","str",$priv, _
"ptr",DLLStructGetPtr($LUID))
If $ret[0] Then
If $bEnable Then
DLLStructSetData($TOKEN_PRIVILEGES,2,$SE_PRIVILEGE_ENABLED,(3 * $nTokenIndex))
Else
DLLStructSetData($TOKEN_PRIVILEGES,2,0,(3 * $nTokenIndex))
EndIf
DLLStructSetData($TOKEN_PRIVILEGES,2,DllStructGetData($LUID,1),(3 * ($nTokenIndex-1)) + 1)
DLLStructSetData($TOKEN_PRIVILEGES,2,DllStructGetData($LUID,2),(3 * ($nTokenIndex-1)) + 2)
DLLStructSetData($LUID,1,0)
DLLStructSetData($LUID,2,0)
EndIf
$nTokenIndex += 1
WEnd
$ret = DLLCall("advapi32.dll","int","AdjustTokenPrivileges","hwnd",$hToken,"int",0, _
"ptr",DllStructGetPtr($TOKEN_PRIVILEGES),"int",DllStructGetSize($NEWTOKEN_PRIVILEGES), _
"ptr",DllStructGetPtr($NEWTOKEN_PRIVILEGES),"int*",0)
$f = DLLCall("kernel32.dll","int","GetLastError")
EndIf
$NEWTOKEN_PRIVILEGES=0
$TOKEN_PRIVILEGES=0
$LUID=0
If $SP_auxret[0] = 0 Then Return 0
$SP_auxret = DLLCall("kernel32.dll","int","CloseHandle","hwnd",$hToken)
If Not $ret[0] And Not $SP_auxret[0] Then Return 0
return $ret[0]
EndFunc ;==>SetPrivilege
Func _MemoryGetBaseAddress($ah_Handle, $iHexDec = 0)
Local $iv_Address = 0x00100000
Local $v_Buffer = DllStructCreate('dword;dword;dword;dword;dword;dword;dword')
Local $vData
Local $vType
If Not IsArray($ah_Handle) Then
SetError(1)
Return 0
EndIf
DllCall($ah_Handle[0], 'int', 'VirtualQueryEx', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer))
If Not @Error Then
$vData = Hex(DllStructGetData($v_Buffer, 2))
$vType = Hex(DllStructGetData($v_Buffer, 3))
While $vType <> "00000080"
DllCall($ah_Handle[0], 'int', 'VirtualQueryEx', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer))
$vData = Hex(DllStructGetData($v_Buffer, 2))
$vType = Hex(DllStructGetData($v_Buffer, 3))
If Hex($iv_Address) = "01000000" Then ExitLoop
$iv_Address += 65536
WEnd
If $vType = "00000080" Then
SetError(0)
If $iHexDec = 1 Then
Return Dec($vData)
Else
Return $vData
EndIf
Else
SetError(2)
Return 0
EndIf
Else
SetError(3)
Return 0
EndIf
EndFunc ;==>_MemoryGetBaseAddress
Func _MemoryModuleGetBaseAddress($iPID, $sModule)
If Not ProcessExists($iPID) Then Return SetError(1, 0, 0)
If Not IsString($sModule) Then Return SetError(2, 0, 0)
Local $PSAPI = DllOpen("psapi.dll")
;Get Process Handle
Local $hProcess
Local $PERMISSION = BitOR(0x0002, 0x0400, 0x0008, 0x0010, 0x0020) ; CREATE_THREAD, QUERY_INFORMATION, VM_OPERATION, VM_READ, VM_WRITE
If $iPID > 0 Then
Local $hProcess = DllCall("kernel32.dll", "ptr", "OpenProcess", "dword", $PERMISSION, "int", 0, "dword", $iPID)
If $hProcess[0] Then
$hProcess = $hProcess[0]
EndIf
EndIf
;EnumProcessModules
Local $Modules = DllStructCreate("ptr[1024]")
Local $aCall = DllCall($PSAPI, "int", "EnumProcessModules", "ptr", $hProcess, "ptr", DllStructGetPtr($Modules), "dword", DllStructGetSize($Modules), "dword*", 0)
If $aCall[4] > 0 Then
Local $iModnum = $aCall[4] / 4
Local $aTemp
For $i = 1 To $iModnum
$aTemp = DllCall($PSAPI, "dword", "GetModuleBaseNameW", "ptr", $hProcess, "ptr", Ptr(DllStructGetData($Modules, 1, $i)), "wstr", "", "dword", 260)
If $aTemp[3] = $sModule Then
DllClose($PSAPI)
Return Ptr(DllStructGetData($Modules, 1, $i))
EndIf
Next
EndIf
DllClose($PSAPI)
Return SetError(-1, 0, 0)
EndFunc
Func _ReturnMemoryValue($sAdresse)
$sNewAdresse = ""
$sAdresse = StringTrimLeft($sAdresse, 2)
For $i = StringLen($sAdresse) - 1 To 0 Step -2
$sNewAdresse &= StringMid($sAdresse, $i, 2)
Next
Return $sNewAdresse
EndFunc
#endregion
Wenn ich den Script jetzt aber ausführe, bekomme ich nur die Fehlermeldung:
Im Thread kam die Fehlermeldung schon vor, nur wird dort darauf verwiesen, dass das Script keinen Prozess rein bekommt.Quote:
"Line 314 (File "C:\Users\.....\....\AG.exe"): Error: Subscript used on non accessible variable.
Aber egal, wie ich "Game Client" oder "client.app" genannt habe, die Fehlermeldung blieb die selbe.
Also hab ich ein bischen
und den Code bearbeitet. Version 1:
Version 2:
Code:
#RequireAdmin
#include <Pointer.au3>
SetPrivilege("SeDebugPrivilege", 1)
Global $PID, $Addr, $Base, $MemOpen
$pid = ProcessExists("client.app")
if $pid <> 0 then
$openmem = _MemoryOpen($pid)
$baseadress = _MemoryGetBaseAddress($openmem)
else
msgbox(16,"ERROR","Start Game before running.")
exit
endif
$testoffset1 = "328"
$testoffset2 = "6B0"
$testoffset3 = "016B39C4"
Global $AOffset[3]
$AOffset[0] = 0
$AOffset[1] = Dec($testoffset1)
$AOffset[2] = Dec($testoffset2)
$Aaddress = "0x" & Hex($baseadress + Dec($testoffset3))
while 1
_MemoryPointerWrite($Aaddress, $openmem, $AOffset, "16600", "dword")
wend
Code:
#RequireAdmin
#include <Pointer.au3>
SetPrivilege("SeDebugPrivilege", 1)
Global $PID, $Addr, $Base, $MemOpen
$PID = ProcessExists("client.app")
if $PID <> 0 then
$MemOpen = _MemoryOpen($PID)
$Base = _MemoryGetBaseAddress($MemOpen)
else
msgbox(16,"ERROR","Start Game before running.")
exit
endif
$Addr = $Base + 0x016B39C4
Dim $Offset[2] = [0x328, 0x6B0]
$Modified_Value = 16600
_Calc_Pointer()
_MemoryWrite($Addr, $MemOpen, $Modified_Value, "dword")
Exit
Func _Calc_Pointer()
$i = 0
do
$Addr = _MemoryRead($Addr, $MemOpen) + $Offset[$i]
$i = $i + 1
until $i = UBound($Offset)
EndFunc
Benannte Fehlermeldung ist bei beiden Versionen weg, im Spiel passiert aber leider nichts...
(Habe den Pointer vorher in CheatEngine ausprobiert - funktionierte)
Nun hoffe ich, das mir hier jemand bei dem Grundscript helfen kann.
Schonmal vielen Dank im Vorraus,
.#Believe
