[Question] House Permit Bot (AutoIt3)

[clintonselke]

Originally Posted by _fobos_

Some more info about hooking to jump function, when doing so you will get the "cant jump to this coordinate" message when someone stands on the coordinate you're trying to jump too.
So it aint that failsafe either, course you could add a rand() of 1-2 to each coordinate. anyway thought id share.
But eitherway dont think with autoit u can hook to a function, proof me wrong

YES and NO!

I'm pretty sure u've seen autoit do DLL injection in another thread, but i know autoit can not do assembly language

I'm gonna write the DLL in c/c++, and im gonna use an autoit functions to inject this DLL into conquer.exe (Note: that this inject function is not a primary function of autoit, it actually grabs the function from another DLL just like the NomadMemory.au3 grabs ReadProcessMemory from a system DLL). Then im gonna use the TCPSocket functions of autoit to communicate to the DLL that is hosting on 127.0.0.1 on port 27015 (only for one co client atm, i can use different port numbers for each client i want to communicate with).

And source for the DLL i attach below. Its modeled off your DLL injection to pause and resume minesweeper.

If AutoIt wont inject directly, then i'll make it call another program that makes the injection ... Then AutoIt can communicate to it with sockets.

And I can communicate with it using Telnet also for debugging.

like

> telnet 127.0.0.1 27015
ctrl+]
> send jump 123 211 <-- causes the DLL to call ConquerJump(123,211), making the player jump to coordinates (123,211)

Edit: umm... forgot 'extern "C"' just b4 DllMain() function, i forgot i used .cpp file.

[clintonselke]

PHP Code:

; AutoIt code to communicate to the injected DLL. I can get autoit to make a call to Winject.exe with some parameters to inject the DLL, if i can not find the extension for autoit :p
Global $Socket

TCPStartUp()

$Socket = TCPConnect("127.0.0.1", 27015)

 . . .

Func Jump($x, $y)
    TCPSend($Socket, "jump " & $x & " " & $y)
EndFunc 


[clintonselke]

Originally Posted by _fobos_

Some more info about hooking to jump function, when doing so you will get the "cant jump to this coordinate" message when someone stands on the coordinate you're trying to jump too.
So it aint that failsafe either, course you could add a rand() of 1-2 to each coordinate.

well that ain't much fun

maybe hooking this jump will allow for making an multiple house permit bots running at once in AutoIt, or multiple other bots running at once in AutoIt.

I know u don't like autoit (i've been tracking ur posts ), but i find it has a really nice syntax. It has similar syntax to c/c++, and ya don't have to do much setup code or compiling. True autoit has less power, but its easy to work with. Ever seen socket programming done w/ just a TCPConnect() & TCPSend() , w/o this WSAStartup() stuff and everything else u have to do.

AutoIt is a nice noob language, and im a noob

Edit: TCPStartUp() lol, i forgot about that... that must be the thingy that calls WSAStartup() internally.

[clintonselke]

Not working yet

My CO2Claw.log

Binding to port 12345
Listening for connections
Accepting connection
Recieved command: jump 40 80

i switch to port 12345, bcuz port 27015 was already in use. (lol picked a random port # and happened to be in use already, theres like 65536 of them)

anyway, i went telnet

telnet
> open 127.0.0.1 12345
Ctrl+]
> send jump 40 80

and ya can see from my log the DLL got the command jump 40 80, then that makes it call the following...

PHP Code:

static int ConquerJump_x, ConquerJump_y;

void ConquerJump(int x, int y)
{
    ConquerJump_x = x;
    ConquerJump_y = y;
    asm("pushl _ConquerJump_x;\n"
        "pushl _ConquerJump_y;\n"
        "movl $0x005DABC0, %ecx;\n"
        "movl $0x004C6303, %eax;\n"
        "call *%eax;\n");
} 


and it crashes lol... i could have the address of the jump() function wrong (004C6303), or i just called it using the wrong assembly language

I'm a noob at assembly, expecially that AT&T assembly (i use mingw compiler).

Edit: PS: i love ur SkillerSluwt _fobos_

[hok30]

Originally Posted by clintonselke

Yea, its all only script, i wont compile it to .exe, had so many going "someone scan it plz", "someone scan it plz", in my other posts. I think more people are comfortable with just the source, at least for the "Programming" section, the other sections i would release executables. If ya want to test it, u use AutoIt3 to run the script, remember to follow the instructions in the first post.lol

Yeah, I'm not a beginner AutoIt programmer myself and I know what it is xD

Although, you're script looks good.

[clintonselke]

When i execute conquer first, then run OllyDBG and attach it to the conquer process, i get a different address for what i think is the jump() function.

I now think its at 004C5F99, can anyone confirm that?

Thanks.

Edit:

Here is what i see

0048672D   > F645 08 08     TEST BYTE PTR SS:[EBP+8],8
00486731   . 74 0F          JE SHORT Conquer.00486742
00486733   . FF75 EC        PUSH DWORD PTR SS:[EBP-14]               ; /Arg2
00486736   . 8BCE           MOV ECX,ESI                              ; |
00486738   . FF75 E8        PUSH DWORD PTR SS:[EBP-18]               ; |Arg1
0048673B   . E8 59F80300    CALL Conquer.004C5F99                    ; \Conquer.004C5F99

with a breakpoint

ECX and ESI holds 005DABB8

EDIT: IT WORKS IT WORKS!!!! I Can't Believe it ,,, it WORKS ... I just got my x and y coordinate mixed up lol.

[clintonselke]

ok, i got autoit to do one jump xD

PHP Code:

Func MoveTo($Coord, $AddNoise = False)
    If $AddNoise Then
        $Coord[0] = $Coord[0] + Int(Random(-$NOISE_IN_WAYPOINT, $NOISE_IN_WAYPOINT))
        $Coord[1] = $Coord[1] + Int(Random(-$NOISE_IN_WAYPOINT, $NOISE_IN_WAYPOINT))
    EndIf
    TCPSend($Socket, "jump " & $Coord[0] & " " & $Coord[1])
    Delay(500)
EndFunc 


but after it jumps the $Socket connection is lost ... any1 experienced w/ autoit sockets?

thanks again xD

[_fobos_]

Originally Posted by clintonselke

ok, i got autoit to do one jump xD

PHP Code:

Func MoveTo($Coord, $AddNoise = False)
    If $AddNoise Then
        $Coord[0] = $Coord[0] + Int(Random(-$NOISE_IN_WAYPOINT, $NOISE_IN_WAYPOINT))
        $Coord[1] = $Coord[1] + Int(Random(-$NOISE_IN_WAYPOINT, $NOISE_IN_WAYPOINT))
    EndIf
    TCPSend($Socket, "jump " & $Coord[0] & " " & $Coord[1])
    Delay(500)
EndFunc 


but after it jumps the $Socket connection is lost ... any1 experienced w/ autoit sockets?

thanks again xD

Not me, no experience with autoit sockets
But yes that looks like the jump function,
I did something like this

__asm
{
push x
push y
mov ecx,esi
call jump
}

Inject it and call it.

EDIT: I just read ur other posts on other page, must admit pretty nice thinking there
if its still crashing debug when executing so you see what goes wrong and where

[IAmHawtness]

When you're doing this good, you could just make a 100 % memory based bot without needing any mouse clicks at all, which is a good idea since people (e.g. flying archers) could be blocking NPCs and stuff like that.

You could find the "talk to NPC" function and call it, too, like you did with the jump function. Same with selling items, dropping, etc. That takes time, though .

Anyways, good luck with your bot <3.

[clintonselke]

Originally Posted by _fobos_

EDIT: I just read ur other posts on other page, must admit pretty nice thinking there
if its still crashing debug when executing so you see what goes wrong and where

Its starting to turn out nice. Not crashing anymore, only problem now is that my autoit sockets wont stay open. But the weird thing is it works fine using telnet from command prompt. And i kinda think i know what it is, I think my c/c++ DLL is using Blocking sockets and autoit is using Asyncronise sockets, and might be y the dam connection doesn't stay past 1 data send. But that single data send works brillantly ... just need more than one

I'll get back to work on it , and soon i'll release the latests source so ur all not left in the dark on this project.

[clintonselke]

Originally Posted by IAmHawtness

When you're doing this good, you could just make a 100 % memory based bot without needing any mouse clicks at all, which is a good idea since people (e.g. flying archers) could be blocking NPCs and stuff like that.

You could find the "talk to NPC" function and call it, too, like you did with the jump function. Same with selling items, dropping, etc. That takes time, though .

Anyways, good luck with your bot <3.

Yea, thats a great idea .

Wanna help me , those functions are so hard to find

i saw a thread called [CO2]Functions, it had all the memory addresses of really nice functions , but its outdated . However maybe the assembly language instruction patterns are similar and i can search the patterns to find their new locations in memory for the new client.

Wish me luck

[clintonselke]

Originally Posted by clintonselke

ok, i got autoit to do one jump xD

PHP Code:

Func MoveTo($Coord, $AddNoise = False)
    If $AddNoise Then
        $Coord[0] = $Coord[0] + Int(Random(-$NOISE_IN_WAYPOINT, $NOISE_IN_WAYPOINT))
        $Coord[1] = $Coord[1] + Int(Random(-$NOISE_IN_WAYPOINT, $NOISE_IN_WAYPOINT))
    EndIf
    TCPSend($Socket, "jump " & $Coord[0] & " " & $Coord[1])
    Delay(500)
EndFunc 


but after it jumps the $Socket connection is lost ... any1 experienced w/ autoit sockets?

thanks again xD

lol.... i know the problem... its my script. no such function as Delay(), i need to use Sleep() lol.

[hok30]

Dude. Stop triple posting and quoting yourself to talk to.

[Alexios]

hok30@
What is the problem? It is one very interesting thread, and it has to do with Programming! It is not request or other **** that people post in the Programming Section.
I think that he does do not hurt anyone. He keeps "in live" a very interesting thread.

[clintonselke]

Ok, guys, i decided to release the code and executables now. I have AutoIt3 using the conquer jump() now for more accuracy. Sorry about the triple posting, i just get excited sometimes .

This code is not 100% working atm, but it lets others know how to call conquer functions with AutoIt.

I have also included a DllInject.au3 file, which is a extended function for autoit allow u to inject Dlls into processes. Unfortunately it is currently not working for me, so u guys will have to use Winject.exe instead before u run the script.

One good thing now is there is no longer a need to use Ctrl+L for learning mode.

Note also: I found the questions at the mine caves to be dynamically allocated, it works on my computer but not my brothers. And for some strange reason, the addresses for the map coordinates have now changed also (need to search it too in cheat engine). What a pain

U'll need to update these values using CheatEngine if they are invalid for your machine. (these will be needed to be done until one of us makes them static )

Global Const $REPLY_ADDRESS[4] = [0x01D3DFBC, 0x01D3E0F4,0x01D3E22C,0x01D3E364]

In order they are the addresses for the replies TOP-LEFT (0), TOP-RIGHT (1), BOTTOM-LEFT (2), BOTTOM-RIGHT (3)

And update these too, for your client. I dont know y they suddenly change on me.
Global Const $X_COORDINATE_ADDRESS = 0x005DAD20 ;0x005DAE34
Global Const $Y_COORDINATE_ADDRESS = 0x005DAD24 ;0x005DAE38

And the following are the steps to running it.

Step 1: Run conquer, log in ur char. (ur noob only, incase of botjail / click jail)

Step 2: Run Winject.exe and inject CO2Claw.dll into ur running process of conquer.

Step 3: Use cheatEngine or similar program to update the addresses for ur player coordinates and for ur mine cave question text-replies (using text search). Sorry bout this step

Step 4: Update those new addresses in house-permit-quest.au3

Step 5: Run house-permit-quest.au3 with ur autoit.

Step 6: Try out Alt+1 (it should buy 2 tc scrolls), Alt+2 should go from pharmacist to market, Alt+3 mk to craftsman (trades for wood), Alt+5 craftsman to carpenter (trades for rosewood), Use a tc scroll and press Alt+4, that should send ya to mine caves (coords inside cave are now inaccurate , u made need to click to help it once inside).

The new one seems like more of a pain than the old one atm... But no more Alt+L for its learning of mouse to map coordinates , plus it jumps faster and is faster at following the waypoints.

I need to find those functions for talking to NPCs and for moving items from inventory to wh, its gonna take forever to find those functions.

Edit: for your X-Coordinate try address 0x005DAE2C, and for your Y-Coordinate try address 0x005DAE30. Idk y they suddenly moved and seemed to become fixed again.

Update: found a function for clicking the guard w/o using the mouse.

StrRes.ini:
100029=Hold the Ctrl key and left click to attack the guard.

100029 is 186BD in hexidecimal

search "push 186BD"

004C7693 |. 68 BD860100 PUSH 186BD

scroll to top of function

Starts at 004C746F

now seach CALL 004C746F

00485FB3   . 6A 01          PUSH 1
00485FB5   . 6A 01          PUSH 1
00485FB7   > 57             PUSH EDI
00485FB8   . 8BCE           MOV ECX,ESI
00485FBA   . E8 B0140400    CALL Conquer.004C746F

When i add a break point here, and click on the Guard, the code stops at the breakpoint. But looks like for attack guard, not for talk to NPC. I'll keep looking.

Edit: Its for attack monster too, not just guard it seems. that EDI might be the ID-number of the thing its told to attack. Not really good useful for this bot, but for anothe bot maybe, one used for melee hunting or something.