Register for your free account! | Forgot your password?

Go Back   elitepvpers > Flyff (Fly For Fun) > Flyff Hacks, Bots, Cheats, Exploits & Macros
You last visited: Today at 15:04

  • Please register to post and access all features, it's quick, easy and FREE!

 

[Tutorial] Call a function inside Neuz (melee attack example)

Reply
 
Old   #1
 
elite*gold: 0
Join Date: Nov 2009
Posts: 287
Received Thanks: 246
Lightbulb [Tutorial] Call a function inside Neuz (melee attack example)


Hello sexy cheaters

I decided to make a little “tutorial” to explain you how to do some hacks like greyb1t’s last hack for Insanity which can be found here:

1. Introduction

The first thing i want to say, I am not a teacher as I am not enough skilled in coding and I usually do not produce proper code. But I will try to comment my code so you can understand it.

This “tutorial” can be used to make other hacks in flyff if you understand it correctly and can do more powerful things, I let you imagine what can be done

This is only for education purpose so please do not do it against the rules or make sure to have permission to do it..

This hack will be patched soon as it is easy to fix but as I said, you can do it for other hacks if the game server does not check your calls.

We will do this test in [Krona Flyff] client.
Quote:
Note that I will not release any code that kills many mobs at the same time just to not see nabs aoeing the hole spawn. If you know how to find the mobs in the camera view then you can code it by yourself but I do not recommend it xD
2. How does it work?

What we will do is to call a function inside the game client (Neuz.exe). This function is:
Quote:
void CDPClient::SendMeleeAttack( OBJMSG dwAtkMsg, OBJID objid, int nParam2, int nParam3, FLOAT fVal )
As you can see, it is member of the CDPClient class which means that it can be called by our game client.

So, we will need to find in "Neuz.exe" the following few things:
  • The client address
  • The “SendMeleeAttack()” method address
  • The parameters values to pass to our function

Different ways can be used to get these addresses but a fast method is to search for “Referenced strings” with CE or with your preferred debugger.

Quote:
Note that Krona has an anti-debugger protection and I only succeeded to bypass it with CE “VEH” debugger. x32dbg and olly are detected and close immediately when a software breakpoint is reached.
After CE finishes the processing, search for the string “DoAttackMelee” => you will find an unique address, then click it and you will get somewhere here:


Scroll down a little bit and you will be here:


As you can see:
  • The client address is at : Neuz.exe+9FDA70
  • The SendMeleeAttackaddress is at: Neuz.exe+4197B0

You have to set up a break point at the function start in order to find the list of the parameters:
  • Put a breakpoint at the start of the SedMeleeAttack function (or press F5 in CE)
  • Hit a mob with a melee attack
  • Your CE should break! Then go to CE and right click the Stack frame and select "Full Stack"
  • Remove the break point and Press F9 to continue
  • Check the Stack Frame and you will see all the parameters of the function
  • The ECX register holds the "Client" address which is the class pointer
Example for "Insanity FlyFF"


At the end, we will see that:
  • OBJMSG dwAtkMsg: this is an integer and it has the value 29 (or 0x1D in hexadecimals)
  • OBJID objid: this is the mob ID (i.e session ID and not to be confused with the fixed constant player_id). This can be found by selecting different mobs in the game and using the Dissect Data/Structure feature of CE => See below to know how to find this value...
  • int nParam2: always equal to 0
  • int nParam3: always equal to 0x10000 (or 65536 in decimals)
  • FLOAT fVal: this is the equipped weapon attack speed. This value can be found by calling another method called GetActiveHandItemProp() which applies to the class CMover. => Let’s do not do it for the moment and just use a hardcoded value. The values can be found using your debugger:
    - For the sword: the attack speed is 0.08500000089f
    - For the knux: 0.0700000003f
    If you can find a pointer to the current Equipped Weapon structure then you can get the attack speed which is at offset 0x130.
    You also can get this value on the fly using "thread context and debug registers" method by setting a hardware breakpoint in your code at a certain position:
    Neuz.exe+14F21E - F3 0F10 82 30010000 - movss xmm0,[edx+00000130]
    and get the EAX value but this will be for advanced users only.


3. How to find the target ID address?

If you have no idea how to find the target ID I will explain it to you using CE but of course you can find it using another way in CE or even using other tools (for example if you have a packet editor, which can be done using my tutorial by the way , you can read the target ID by hooking the send() function that sends a packet to the server when you select a target...)
1 - Put a breakpoint at the function start (Press F5)
2 - Hit a mob using a melee attack
3 - Go back to CE and check the Stack frame and save the target ID value in notepad
Example for "Insanity FlyFF", target ID = 0x015767F5 (hexadecimal)
4 - In CE: New Scan, check "Hex" button and write down 0x015767F5
5 - In most cases, the first address is the correct one but be sure the address is not static (not green). Here it is 0x035976D0
6 - Add the address 0x035976D0 to the list and right-click "Find out what accesses this address"
7 - Select the same mob 2 or 3 times and you will see that the accessor is 0x035973E0 with offset 0x2F0
This means that the session ID of the selected target is at offset 0x2F0 and the "entity" address representing our mob is at address 0x035973E0
8 - Now we need to find a static pointer (green address) for our target 0x035973E0 so we can find it every time we run Neuz...
9 - Select the same mob and Scan for 0x035973E0, hex button checked of course.
10 - Unselect the mob and you will see 2 values changing to 00000000
11 - The second address is the correct one (or you can test both to find the correct one). Add the address 0x278EBBB0 to the list and do "Find out what writes to this address"
12 - Select the mob and you will see that the offset for the target is 0x20 and the base is 0x278EBB90
13 - We now must find a static pointer that points to 0x278EBB90
Scan for 0x278EBB90, "Hex" button checked -> bingo , we found 2 static pointers
14 - The second pointer 0x015EAF90 is the correct one!
15 - To test it, add a pointer manually in CE:
Address = "Neuz.exe" + B6AF90 (it is eaqual to 0x015EAF90 for me but this changes all the time so always use relative address starting from "Neuz.exe")
Offset 1 = 0x20
Offset 2 = 0x2F0


That’s all for the parameters so let’s start the boring part

4. Code

When you want to call a function in your Neuz module, you can use a pointer to your function like this:
Quote:
typedef void (__thiscall * SendMeleeAttack_t)(void * client, unsigned int dwAtkMsg, unsigned int objid, int nParam2, int nParam3, float fVal);
SendMeleeAttack_t pSendMeleeAttack = (SendMeleeAttack_t)((DWORD)g_hExeModule+0x4197B0);
__thiscall : this is the used calling convention => very important
All you need later is to call the function inside Neuz by just writing:
Quote:
pSendMeleeAttack((void*)g_DPlay, dwAtkMsg , SelectedID , nParam2 , nParam3,fItemAttakSpeed);
Quote:
Note that g_DPlay is the pointer to our client: (void*) means a pointer to anything.
This means that the function we are going to call is called by a pointer to our client so you will need to add the parameter “(void*)client” when you call it.
The other parts of the code are easy to understand so there is nothing special to explain here (I am tired of writing )

You must register and activate your account in order to view images.

Source code

VirusTotal


The full solution was made with Visual Studio 2012 and is attached to this thread. You have all the permissions to use or modify it…

If you need any help and if I can then I will reply to you otherwise please don't blame me.

If this helped someone then please push the thanks button.

Regards
Attached Files
File Type: zip CallFunction.zip (10.2 KB, 258 views)
File Type: zip InsanityAroundKill.zip (1,005.9 KB, 173 views)



cookie69 is online now  
Thanks
23 Users
Old   #2
 
elite*gold: 0
Join Date: May 2012
Posts: 361
Received Thanks: 100
Edit: It's more complex than I throught :-? time to see if could work in C#


starswper is offline  
Old   #3
 
elite*gold: 0
Join Date: May 2008
Posts: 35
Received Thanks: 8
Its my idea or its just like a range hack? You can do more than a single target at the same time? Good work btw
benja14 is offline  
Old   #4
 
elite*gold: 0
Join Date: Nov 2009
Posts: 287
Received Thanks: 246
Quote:
Originally Posted by benja14 View Post
Its my idea or its just like a range hack? You can do more than a single target at the same time? Good work btw
It is like a range hack and the mob will hit you anyway as you are sending a melee attack.
I am not sure that you can send a melee attack for many targets at the same time exactly (I have not checked), but I was talking about making a loop through the mobs in the camera view and sending the attack to them (like you do when you make a memory but that uses AOE mode)


cookie69 is online now  
Old   #5
 
elite*gold: 0
Join Date: Sep 2014
Posts: 1
Received Thanks: 0
any one know how to use speedhack using CE? not like activating the "enable speedhack" button. i mean just edit the code or something.
jiem0 is offline  
Old   #6
 
elite*gold: 0
Join Date: Apr 2017
Posts: 1
Received Thanks: 0
Thank you for taking your time to help complete strangers

Im a complete novice in programming but is the attached file currently working on kronaflyff? If so, how do I make it work there doesnt seem to be an .exe file.,
CheeseBites1234567 is offline  
Old   #7
 
elite*gold: 0
Join Date: Nov 2009
Posts: 287
Received Thanks: 246
Quote:
Originally Posted by jiem0 View Post
any one know how to use speedhack using CE? not like activating the "enable speedhack" button. i mean just edit the code or something.
This is very basic cheating question.

For CE help, just search in youtube and you can find thousands of tutorials.

For pservers, just use CE to find your speed address like you do to find your HP, etc.. and edit it. For example you can equip/unequip a cape that gives you more speed and find the address with CE...

If you are playing in the official server, I think that you can edit the data*.res files to increase the default speed factor => search for the threads in elitepvpers that talk about editing the data files. Or find a hidden CE and use the first method above.

Third option (hard) is to code a packet handler and send a packet to increase the speed factor (maybe SNAPSHOTTYPE_SET_SPEED_FACTOR). But I am not even sure that you can bypass server checks in the offi.

Fourth option is to not speed hack as it is against the game rules


Quote:
Originally Posted by CheeseBites1234567 View Post
Thank you for taking your time to help complete strangers

Im a complete novice in programming but is the attached file currently working on kronaflyff? If so, how do I make it work there doesnt seem to be an .exe file.,
This thread is more for people who have some basic knowledge in hacking and are at least beginners in c/c++ programming.

As you asked for a .exe, without figuring out that there is a c++ code that you need to modify/compile and generate a DLL that you will need to inject later into Krona game client, I think that you need more training before to use it

cookie69 is online now  
Old   #8
 
elite*gold: 0
Join Date: Sep 2014
Posts: 519
Received Thanks: 140
Good tutorial. Even useful for other games!

Greetings,
qqdev
qqdev is offline  
Old   #9
 
elite*gold: 0
Join Date: Jul 2008
Posts: 23
Received Thanks: 0
Could have some fun, but where did you find the prototype of this function ? do you have any doc / header file ? Maybe i'll do something with it :3
Thanks
ayoubleg is offline  
Old   #10
 
elite*gold: 0
Join Date: Nov 2009
Posts: 287
Received Thanks: 246
Quote:
Originally Posted by ayoubleg View Post
Could have some fun, but where did you find the prototype of this function ? do you have any doc / header file ? Maybe i'll do something with it :3
Thanks
can be found in the source code or you can decompile your Neuz client (if you target a special server) with IDA or any debugger (xdbg,ollydbg,..)

cookie69 is online now  
Old   #11
 
elite*gold: 0
Join Date: Jul 2008
Posts: 23
Received Thanks: 0
Thanks, i'll try something on Flyff Official serv(EU ones)
ayoubleg is offline  
Old   #12
 
elite*gold: 0
Join Date: Jun 2017
Posts: 2
Received Thanks: 0
Hey is this still possible on server like InsanityFlyFF?
ImxTwinky is offline  
Old   #13
 
elite*gold: 0
Join Date: Jun 2017
Posts: 20
Received Thanks: 29
Well developed Bot.
Tested it on C# and C++ Works Fine with FlyForSky / Insanity and SoD flyff.
Keep developing! ^^
ButtBoobies is offline  
Thanks
2 Users
Old   #14
 
elite*gold: 0
Join Date: Jan 2017
Posts: 14
Received Thanks: 7
can u send me the program to test it please?
xAziz is offline  
Old   #15
 
elite*gold: 0
Join Date: Jun 2017
Posts: 20
Received Thanks: 29
Quote:
Originally Posted by xAziz View Post
can u send me the program to test it please?
No -_- Aren't u a hacker? lol, Noob hacker.
And u are begging me to give u the programs.
Also I'm not open to sell or give any of my programs or bots to anyone


ButtBoobies is offline  
Thanks
2 Users
Reply

Tags
call function, flyff, hack, krona



« Previous Thread | Next Thread »

Similar Threads
[TOOL] 1.5-2x attack speed 4 melee s
because i play with warior char n envious with launcher 10x hack attack speed here is attack speed for melee weapon altough just 1.5-2x but really...
15 Replies - RFO Hacks, Bots, Cheats, Exploits & Guides
[Tutorial]1.5-2x Launcher attack speed for melee! Got the Idea from (Hige)
I've Already Posted this on the "Other Forum" ^_~ but seems no ones cares about it so thats why i'm sharing this to you guys.. This is the...
13 Replies - RFO Hacks, Bots, Cheats, Exploits & Guides
[release]1.5-2x attack speed for melee
because i play with warior char n envious with launcher 10x hack attack speed here is attack speed for melee weapon :D altough just 1.5-2x but...
155 Replies - RFO Hacks, Bots, Cheats, Exploits & Guides
Requesting Melee Speed Attack.
I Search the whole forum but no Luck for me..
3 Replies - RF Online
10x Melee attack sped or any better speed attack than 2x
I tested All Guides of melee Speed attack, and nothing work correctly ... Maybe i cant setup or This dont function -_-'' So... SomeBody can explain...
6 Replies - RF Online



All times are GMT +2. The time now is 15:04.


Powered by vBulletin®
Copyright ©2000 - 2017, Jelsoft Enterprises Ltd.
SEO by vBSEO ©2011, Crawlability, Inc.

Support | Contact Us | FAQ | Advertising | Privacy Policy
Copyright ©2017 elitepvpers All Rights Reserved.