Memory addresses of dropped items

[Jalan_Jalan]

I already wrote about this topic in the UHF Memory thread. But as it would be probably easier to keep track of the work and development of this topic, I decided to make a new thread about it.

What I have found out so far is the following (copied from my post in UHF thread):

That's what I've found so far:

At the moment (addresses are dynamic), items that are on the ground are stored in memory as follows:

Credits go to warriorchamp!

base address: 0x005697EC
offset 1: 0x0 (if you increase this by 4, you get the 2nd, 3rd and so on item)
offset 2: 0x10 (constant)
offset 3: 0x19C

Concerning offset 3:

at 19c - item ID
at 198 - timer, counting up, stops when item disappears or is picked up
at 1a0 - coordinate y ("absolute system", 5 digits)
at 1a4 - coordinate x
at 1a8 - = 1 if cursor is above item AND item can be picked, otherwise 0
at 214 - 4 bytes that change to zero when item is picked up, haven't found out what they mean yet. Maybe they have got something to with the item being free for everyone to pick up or not.

The base address has been updated for the latest patch (5031).

Method to calculate the "control-click-coordinates" for an item that has been dropped.

1. Get the coordinates of the item (at offset 1a0 and 1a4, see above), let's call them $itemx and itemy
2. Get the coordinates of your char (x=
005696DC, y=005696E0), $charx and $chary
3. Get the ctrl-click coords of your char (the window-related coords you would have to click on to click your char.), let's say they are called $ctrlclickx (at 0x0056B114) and $ctrlclicky (at 0x0056B118)
4. Now, subtract the item's coords from the char's coords

5. Subtract the offsets from the ctrl-click-coords of your char.


Send a mousclick to the calculated coordinates.

While searching for the new addresses after the last patch, I found the following by chance:

Base: 0x005697E0 (not working for patch 5031)
Offsets: Same as for items on ground (0,10,19c)
At this address the item that just has been picked up is stored. Maybe this can be usefull to check the picked up stuff and drop useless crap.

If you have any questions, or if I should make anything clearer, feel free to send me a PM or drop a line in this thread.

[David5646]

Very nice work

[warriorchamp]

@Jalan_Jalan
Hm nice work I found the coords too but with another method and that's not that good I'm trying this atm


Many-many-many thanks Jalan. This works good I think in 1-2 weeks the bot will be published and after that i restart the COtobo project

[ephe]

Originally Posted by warriorchamp

@Jalan_Jalan
Hm nice work I found the coords too but with another method and that's not that good I'm trying this atm


Many-many-many thanks Jalan. This works good I think in 1-2 weeks the bot will be published and after that i restart the COtobo project

With Jalan_Jalan's work published, anyone who's willing to invest some time in working on the AHK/AutoIt stuff would be able to make something which is equivalent to SV if not better. And I could count myself among those almost 2 months ago, while now it's about 1 month that I don't even start CO. It's good, because this time it's not like I *forced* myself to quit playing (giving chance for another dive-in in the future), but I actually lost interest bit by bit, I keep checking in here only for the sake of my curiosity.
It's just my personal opinion, but while I somewhat agree with Jalan_Jalan releasing this kind of details (useless by themselves if you don't know how to apply them), if I were in your place warriorchamp, I would never release to the public the ready-to-be-run bot, because everything would get spoiled in a matter of 3 weeks tops. I would use it for myself and give it to Jalan_Jalan at the condition he swears not to pass it to anyone

[Lateralus]

Thank you soooo much, I've been experimenting with the memory recently and this can be used to make a great bot like SV. And I agree - don't to release it to the public, keep it for personal use and distribute it ONLY to the people who helped you.

[warriorchamp]

Hmmmm Maybe you're right I already made the console for the bot xD

If i finish the beta version i will send it to few ppl..

[Jalan_Jalan]

Addresses have been updated for the latest patch.
Please try out if they are correct, made it in a hurry

[warriorchamp]

Originally Posted by Jalan_Jalan

Addresses have been updated for the latest patch.
Please try out if they are correct, made it in a hurry

I tested these and didnt worked for me.

I have the new addresses I can PM you with my addresses if you want xD

[nTL3fTy]

Originally Posted by Jalan_Jalan

Addresses have been updated for the latest patch.
Please try out if they are correct, made it in a hurry

What about all the other useful pointers you found pre-5028, for example - character equipment?

[Jalan_Jalan]

Originally Posted by nTL3fTy

What about all the other useful pointers you found pre-5028, for example - character equipment?

Oh, these:

Addresses of the stats of the stuff you wear ...updated for patch 5031

Well, the items you wear are stored at the following memory addresses atm:

(It's an address with 2 pointers, the first pointer determionates the item (ring, necky, ...), the 2nd pointer points to details of the item (like name, UID, dura ...)

The "base" address is 0x004725cc.

Offset 1: (Offsets are in hex)

24 ?
28 Helmet
2c Necklace
30 Armor
34 RH weapon
38 Shield / LH Weapon
3c Ring
40 ?
44 Boots
48 Garment

Offset 2 (Examples, all features of an item are stored there)

4 = UID as 4byte
c = Item ID as 4byte
10 = Item Name as Text
22 = Lvl as 2byte
24 = Strength as 2byte
38 = Max Attack as 2byte
3a = Min Attack as 2byte
3e = Agility as 2byte
46 = Dura as 2byte
48 = max Dura as 2byte

The Durability values are stored as follows:
There's a 4 digit number, let's call it abcd. The first 2 digits are the ones that are interesting, so, ab would be the dura at offset 46, or the max dura at offset 48.

[Jalan_Jalan]

One more, addresses of the surrounding players / monsters:

"This post has been deleted by the author"

PM me if you wanna know something.

[nTL3fTy]

Will test when I get a chance, good work once again.

#Edit
For character equipment:

Offset 1: (Offsets are in hex)

24 ?
28 Helmet
2c Necklace
30 Armor
34 RH weapon
38 Shield / LH Weapon
3c Ring
40 ? => Talisman (MagicBottle/Gourd)
44 Boots
48 Garment

[warriorchamp]

4____UID__________4byte
c____Item ID_______4byte
10___Item Name_____Text
22___Lvl ___________2byte
23___Gender________2byte
24___Strength_______2byte
25___Req.Strength___2byte
26___Agility_________2byte
27___Req.Agility_____2byte
28___Stamina_______2byte
29___Req.Stamina___2byte
2a___Mana__________2byte
2b___Req.Mana______2byte
2f___Weight(???)_____2byte
38___Max Attack_____2byte
3a___Min Attack_____2byte
3c___Defense_______2byte
3e___Agility_________2byte
40___Dodge_________2byte
42___HP____________2byte
44___MP____________2byte
46___Dura__________2byte
48___max Dura______2byte
4b___1stSoc_________2byte
4C___2ndSoc________2byte
4f___+______________2byte
50___Magic_________2byte
52___MagicAtt_______2byte
5f___Prof(Trojan'sArmor)_2byte

[warriorchamp]

@Jalan_Jalan

I have the same problem with this method just like with my method...

Sometimes it points to "dontknowhere"...

Edit: Something missed from your method... So i tested it.

Everything works fine until i kill the monster or i go far away from the monster... After that points to "dontknowhere". I changed the offset and everything but i dont know how could i find the new pointer to the 1st monster...

Edit2: Included to my bot it works very well I must test it few times

[Jalan_Jalan]

Maybe you could try this:

Let your program read from the first 10 or so monster addresses, there chance that all of them will be empty should be low (or read every second, like offset 0, 8, 10, 18 and so on).
Now we'd have to find out what monster is closest to our char. Maybe this could be done buy reading the mob's coordinates (those are ctrl-click coords, right)
$mobx
$moby

subtract the from the char's coords
$value1 = $charx-$mobx
$value2 = $chary-$moby

make $value1 and $value2 be positive (multiplicate with -1 if negative or so)

add $value1 and $value2

The lowest sum belongs to the monster that is closest to you.

Or, easier, just read from 10 monster addresses and attack the first "victim" you find. If the bot doesn't run miles when you do it like this, it should be ok.