[Release/Guide] Bot

[SimSir]

Originally Posted by MoepMeep

I guess tax isn't 100 then

hehe i see now ^^ insert coin ty

how i can selling item ?

ican try this code but not working..

PHP Code:

SendPacket(0x16,"dbbww",NpcID,MerchantTax,1,ItemIndexID,Count); 


[NoTtT]

Originally Posted by DerKleineDarky

well silentius is doing the most parts of that hackit, but only the parts where you dont need any "hacking" skills he is by far a better coder than me, but important things for kalhacks are kinda differend to the stuff he does
well working with him is pretty nice, btw also i would have to give credits to alex and even to kevin (he got me with his crappy source doing my own xD)
even you and meak could be mentioned, for giving some packets when i needed them, also i got to give credits to sandro...
so all in all, my hackit is pretty well, i bet much better than from anybody else here (dont count sandro ) because i were able to ask for help when i needed it

to make it short, you begged for snippets & asked silentius to put it together & compile it for you.

[mohm195]

Originally Posted by SimSir

hehe i see now ^^ insert coin ty

how i can selling item ?

ican try this code but not working..

PHP Code:

SendPacket(0x16,"dbbww",NpcID,MerchantTax,1,ItemIndexID,Count); 


As fair as I know, 0x16 is NPC replay, 0x18 for buying and 0x19 for selling.

[SimSir]

Originally Posted by mohm195

As fair as I know, 0x16 is NPC replay, 0x18 for buying and 0x19 for selling.

i can working on int server

this code working...


First Get Tax

PHP Code:

SendPacket(0x14,"d",NpcID); 


and sniff tax ^^

PHP Code:

    case 0x4C://Merchant Tax Getting
        {
        MerchantTax = *(BYTE*)&szBuffer[3];
        break;
        } 


if get tax send buy packet

PHP Code:

SendPacket(0x15,"dbbww",NpcID,MerchantTax,1,ItemIndexID,Count); 


for buying

PHP Code:

SendPacket(0x16,"dbdw",NpcID,1,ItemID,Count); 


sry bad eng^^

[sidor]

Originally Posted by bloodx

Brauch ich glaub nicht viel zu sagen, kleine Zusammenstellung von den Sachen die gepostet wurden.

 Spoiler

Exports.def

 Spoiler

EXPORTS
DirectSoundCaptureCreate=__E__0__ @6
DirectSoundCaptureCreate8=__E__1__ @12
DirectSoundCaptureEnumerateA=__E__2__ @7
DirectSoundCaptureEnumerateW=__E__3__ @8
DirectSoundCreate=__E__4__ @1
DirectSoundCreate8=__E__5__ @11
DirectSoundEnumerateA=__E__6__ @2
DirectSoundEnumerateW=__E__7__ @3
DirectSoundFullDuplexCreate=__E__8__ @10
DllCanUnloadNow=__E__9__ @4
DllGetClassObject=__E__10__ @5
GetDeviceID=__E__11__ @9

DllMain.cpp

 Spoiler

#include <Windows.h>
#include <process.h>

FARPROC dsoundFunction[12] = {0};
HMODULE dsound_Orginal				= (HMODULE)INVALID_HANDLE_VALUE;
HANDLE			hMainThread			= INVALID_HANDLE_VALUE;
unsigned int	uiMainThreadID	= 0;

extern unsigned int __stdcall MainThread(void * pParams);

BOOL APIENTRY DllMain(_In_ HANDLE _HDllHandle, _In_ DWORD _Reason, _In_opt_ LPVOID _Reserved)
{
	switch(_Reason){
	case DLL_PROCESS_ATTACH:
		dsound_Orginal = LoadLibrary("dsound_.dll");

		hMainThread = (HANDLE)_beginthreadex(NULL, 0, &MainThread, NULL, NULL, &uiMainThreadID);

		dsoundFunction[0] = GetProcAddress(dsound_Orginal,"DirectSoundCaptureCreate");
		dsoundFunction[1] = GetProcAddress(dsound_Orginal,"DirectSoundCaptureCreate8");
		dsoundFunction[2] = GetProcAddress(dsound_Orginal,"DirectSoundCaptureEnumerateA");
		dsoundFunction[3] = GetProcAddress(dsound_Orginal,"DirectSoundCaptureEnumerateW");
		dsoundFunction[4] = GetProcAddress(dsound_Orginal,"DirectSoundCreate");
		dsoundFunction[5] = GetProcAddress(dsound_Orginal,"DirectSoundCreate8");
		dsoundFunction[6] = GetProcAddress(dsound_Orginal,"DirectSoundEnumerateA");
		dsoundFunction[7] = GetProcAddress(dsound_Orginal,"DirectSoundEnumerateW");
		dsoundFunction[8] = GetProcAddress(dsound_Orginal,"DirectSoundFullDuplexCreate");
		dsoundFunction[9] = GetProcAddress(dsound_Orginal,"DllCanUnloadNow");
		dsoundFunction[10] = GetProcAddress(dsound_Orginal,"DllGetClassObject");
		dsoundFunction[11] = GetProcAddress(dsound_Orginal,"GetDeviceID");
		break;
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		
		break;
	}
	return TRUE;
}
// DirectSoundCaptureCreate
extern "C" __declspec(naked) void __stdcall __E__0__()
{
	__asm
	{
		jmp dsoundFunction[0*4];
	}
}

// DirectSoundCaptureCreate8
extern "C" __declspec(naked) void __stdcall __E__1__()
{
	__asm
	{
		jmp dsoundFunction[1*4];
	}
}

// DirectSoundCaptureEnumerateA
extern "C" __declspec(naked) void __stdcall __E__2__()
{
	__asm
	{
		jmp dsoundFunction[2*4];
	}
}

// DirectSoundCaptureEnumerateW
extern "C" __declspec(naked) void __stdcall __E__3__()
{
	__asm
	{
		jmp dsoundFunction[3*4];
	}
}

// DirectSoundCreate
extern "C" __declspec(naked) void __stdcall __E__4__()
{
	__asm
	{
		jmp dsoundFunction[4*4];
	}
}

// DirectSoundCreate8
extern "C" __declspec(naked) void __stdcall __E__5__()
{
	__asm
	{
		jmp dsoundFunction[5*4];
	}
}

// DirectSoundEnumerateA
extern "C" __declspec(naked) void __stdcall __E__6__()
{
	__asm
	{
		jmp dsoundFunction[6*4];
	}
}

// DirectSoundEnumerateW
extern "C" __declspec(naked) void __stdcall __E__7__()
{
	__asm
	{
		jmp dsoundFunction[7*4];
	}
}

// DirectSoundFullDuplexCreate
extern "C" __declspec(naked) void __stdcall __E__8__()
{
	__asm
	{
		jmp dsoundFunction[8*4];
	}
}

// DllCanUnloadNow
extern "C" __declspec(naked) void __stdcall __E__9__()
{
	__asm
	{
		jmp dsoundFunction[9*4];
	}
}

// DllGetClassObject
extern "C" __declspec(naked) void __stdcall __E__10__()
{
	__asm
	{
		jmp dsoundFunction[10*4];
	}
}

// GetDeviceID
extern "C" __declspec(naked) void __stdcall __E__11__()
{
	__asm
	{
		jmp dsoundFunction[11*4];
	}
}

Main.cpp

 Spoiler

#include "main.h"

extern HANDLE			hMainThread;



extern int (__stdcall *DetourRecv)(SOCKET Socket,char *Buffer, int Length, int Flags);
extern int __stdcall FilterRecv(SOCKET Socket,char *Buffer, int iLength, int iFlags);
extern int engineSend(BYTE Header,LPCSTR szFormat,...);

extern DWORD __stdcall DebugConsole(LPVOID*);

unsigned int __stdcall MainThread(void * pParams)
{
	AllocConsole();

	int HandleIn = _open_osfhandle((long)GetStdHandle(STD_INPUT_HANDLE), _O_TEXT);
	int HandleOut = _open_osfhandle((long)GetStdHandle(STD_OUTPUT_HANDLE), _O_TEXT);

	FILE *In = _fdopen(HandleIn, "r");
	FILE *Out = _fdopen(HandleOut, "w");

	*stdin = *In;
	*stdout = *Out;

	SetConsoleTitle("Debug Console");

	DetourRecv = (int (__stdcall *)(SOCKET, char *, int, int))DetourFunction((PBYTE)recv,(PBYTE)FilterRecv);

	CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)DebugConsole,NULL,NULL,0);

	CloseHandle(hMainThread);
	_endthreadex(0);
	return NULL;
}

DWORD _stdcall DebugConsole(LPVOID*){

	char szDebugHandle[255]={0};
	while(true){

		std::cin >> szDebugHandle;

		if(strcmp(szDebugHandle,"test") == 0)
		{

		}
	}

	return NULL;
}

Main.h

 Spoiler

#ifndef MAIN_H
#define MAIN_H

#include <WinSock2.h>
#include <detours.h>
#include <Windows.h>
#include <iostream>
#include <io.h>
#include <fcntl.h>
#include <process.h>
#include <math.h>
#include <stdio.h>

#pragma comment(lib, "detours.lib")
#pragma comment(lib, "ws2_32.lib")

#define INST_NOP 0x90
#define INST_CALL 0xe8
#define INST_JMP 0xe9
#define INST_BYTE 0x00
#define SHORT_JZ 0x74

#define orange 16594
#define lightblue 15073034
#define violett 12615808
#define green 32768
#define pink 16751615
#define blue 15453831
#define red 255


#endif MAIN_H

send.cpp

 Spoiler

#include "main.h"

extern DWORD dwFindPattern(DWORD dwAddress,DWORD dwLen, BYTE *bMask, char * szMask);

DWORD dwEngineSendA = dwFindPattern(0x401000,0x2bc000,(BYTE*)"\x55\x8B\xEC\x83\xEC\x18\x83\x3D\x00\x00\x00\x00\x00\x00\x00\x33\xC0","xxxxxxxx???????xx");
DWORD dwEngineSendB = dwFindPattern(dwEngineSendA+1,0x2bc000,(BYTE*)"\x55\x8B\xEC\x83\xEC\x18\x83\x3D\x00\x00\x00\x00\x00\x00\x00\x33\xC0","xxxxxxxx???????xx");
DWORD dwEngineBack = dwEngineSendB + 0x06;


__declspec( naked ) int engineSend(BYTE Header,LPCSTR szFormat,...){

	__asm push ebp;
	__asm mov ebp, esp;
	__asm sub esp, 18h;
	__asm jmp dwEngineBack;
}

recv.cpp

 Spoiler

#include "main.h"

int (__stdcall *DetourRecv)(SOCKET Socket, char *Buffer, int Length, int Flags);

extern int engineSend(BYTE Header,LPCSTR szFormat,...);

extern void KalChat(int color,char* mFormat,...);


/*

WORD size;
memcpy((void*)&size,(void*)((DWORD)szBuffer),2);
int i;
{
for (i=0;i<=size;i++)
{
printf("%02x ",(BYTE)szBuffer[i]);
}
printf("\n\n");
break;
*/

enum Packets {PlayerAppear=0x32,
			MonsterAppear=0x33,
			Item=0x36,
			MonsterAni=0x3d,
			FirstPacket=0x2a};

struct Items
{
	DWORD dwItemID;
	DWORD AchseX;
	DWORD AchseY;
}Itemx;
struct Monsters 
{
	DWORD dwMonsterUID;
	DWORD dwMonsterUIDx;
	DWORD dwMonsterX;
	DWORD dwMonsterY;
}Monster;

void MyRecv(char* szBuffer,int iLenght)
{
	/*WORD size;
	memcpy((void*)&size,(void*)((DWORD)szBuffer),2);
	int i;
		for (i=0;i<=size;i++)
		{
			printf("%02x ",(BYTE)szBuffer[i]);
		}
		printf("\n\n");
		*/
	switch(szBuffer[2])
	{
	case FirstPacket:
/*
Send Login?!

*/
		break;
	case PlayerAppear:
		break;
	case Item:
		Itemx.dwItemID = *(DWORD*)&szBuffer[5];
		Itemx.AchseX = *(DWORD*)&szBuffer[5+4];
		Itemx.AchseY = *(DWORD*)&szBuffer[5+4+4];
		engineSend(0x1D,"ddd",Itemx.dwItemID,Itemx.AchseX/32,Itemx.AchseY/32);
		break;
	case MonsterAppear:
		break;
	case MonsterAni:
		Monster.dwMonsterUID = *(DWORD*)&szBuffer[3];
		engineSend(0x0D,"bbd",1,1,Monster.dwMonsterUID);
		break;
	}
}
/*
Thanks to ILikeItEasy
*/
int ASyncPos = 0;
int FinalSize = 0;
int __stdcall FilterRecv(SOCKET Socket,char *Buffer, int iLength, int iFlags)
{
	if (ASyncPos==FinalSize && FinalSize>0)
	{
		MyRecv(Buffer, ASyncPos);

		ASyncPos = 0;
	}
	int RecvRET = DetourRecv(Socket, Buffer, iLength, iFlags);
	if (RecvRET<0)
	{
		return RecvRET;
	}
	if (ASyncPos==0)
		FinalSize = *((short int*) Buffer);
	ASyncPos+=RecvRET;

	return RecvRET;
}

Functions.cpp

 Spoiler

#include "main.h"

bool bDataCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
	for(;*szMask;++szMask,++pData,++bMask)
		if(*szMask=='x' && *pData!=*bMask )
			return false;
	return (*szMask) == NULL;
}

DWORD dwFindPattern(DWORD dwAddress,DWORD dwLen, BYTE *bMask, char * szMask) {
	for(DWORD i=0;i<dwLen;i++)
		if( bDataCompare( (BYTE*)( dwAddress+i ),bMask,szMask) )
			return (DWORD)(dwAddress+i);
	return NULL;
}

LPVOID MemcpyEx(DWORD lpDest, DWORD lpSource, int len)
{
	DWORD oldSourceProt,oldDestProt=0;
	VirtualProtect((LPVOID)lpSource,len,PAGE_EXECUTE_READWRITE,&oldSourceProt);
	VirtualProtect((LPVOID)lpDest,len,PAGE_EXECUTE_READWRITE,&oldDestProt);
	memcpy((void*)lpDest,(void*)lpSource,len);
	VirtualProtect((LPVOID)lpDest,len,oldDestProt,&oldDestProt);
	VirtualProtect((LPVOID)lpSource,len,oldSourceProt,&oldSourceProt);
	return (LPVOID)lpDest;
};

DWORD Intercept(int instruction, DWORD lpSource, DWORD lpDest, int len)
{
	DWORD realtarget;
	LPBYTE buffer = new BYTE[len];

	memset(buffer,0x90,len);

	if (instruction != INST_NOP && len >= 5)
	{
		buffer[(len-5)] = instruction; 
		DWORD dwJMP = (DWORD)lpDest - (lpSource + 5 + (len-5));
		memcpy(&realtarget,(void*)(lpSource+1),4);
		realtarget = realtarget+lpSource+5;
		memcpy(buffer + 1 + (len-5),&dwJMP,4);
	}
	if (instruction == SHORT_JZ)
	{
		buffer[0]=instruction;
		buffer[1]=(BYTE)lpDest;
	}
	if (instruction == INST_BYTE)
	{
		buffer[0]=(BYTE)lpDest;
	}
	MemcpyEx(lpSource, (DWORD) buffer, len);// Call to intercept
	delete[] buffer;
	return realtarget;
}
/*
Thanks to Syntex (:
*/
typedef int (__cdecl * Chat_org)(char, char*, int);
BYTE pChat[] = {0x55,0x8B,0xEC,0x83,0x3D,0x48,0x2B,0x86,0x00,0x00,0x74,0x17,0x8B,0x45,0x10,0x50}; // pattern //
char * mChat = "xxx????????xxxx"; // mask //

unsigned long Chat_add = dwFindPattern( 0x00400000,0x00700000,pChat,mChat);

void KalChat(int color,char* mFormat,...){ 
	char* mText = new char[255];
	va_list args;
	va_start(args, mFormat);
	vsprintf_s(mText,255,mFormat,args);
	va_end(args);

	((Chat_org)Chat_add)(0,mText,color);
}

its is possible for anyone to upload a clean source of bot and sound.dll?
i trying with that above but i cant compile it:/


anyway i trying to made a bot for IC
bot attack only moob what acctualy atack char
attack only by LA every 6,1sec and normal arrow
use medis / pick /behead
can be a water option to

i saw some ppl with that bot but for IS
no ug/og now walk/teleport
any tips for that?

[bloodx]

What do your want to do? =D pm me if u have a Question

[pamz12]

if i understand right, he wants that cracked bots's (that sirix posted them) source is released

[OnlyLT]

would be very nice

[sidor]

ok i totally bored:/
i to stupid to make it yhhh


anyway i want like in this video i made



that all and use medium or large medis if hp go down by 60%


standing on spot dont move
kill moobs one by one by normal arrow and LA

but only that who actually attack me


i know there is two acc who got that bot
71IS and 77 is (i force them )
he use only Dok and kill one by one in d3
i want something like this
so i trying to talk with them got totally 0 answer :/

anyway is someone can create that bot for me
i can pay by geons
by shared drops
by leeh in party
or i can give 3 IC accounts (but low lvl)

[bloodx]

Just save the MonsterUID in a Array and move to each move to each mob one by one and kill it. oO?

[SimSir]

PHP Code:

//Map Height Calculate Pointer
DWORD pHeight        = dwFindPattern(0x401000,0x007FFFFF,(BYTE*)"\x55\x8B\xEC\x81\xEC\x94\x00\x00\x00\xD9\x45\x08\xD8\x35\x00\x00\x00\x00\xD9\x5D\x08","xxxxxxxxxxxxxx????xxx"); 


PHP Code:

nt Height(int X, int Y) 
{ 
    return (int)(((oHeight)pHeight)(X-262144,Y-262144)*10); 
} 


PHP Code:

bool BotMove(DWORD *moveID,float safeRange,DWORD *x, DWORD *y, WORD SpeedMs, BYTE Speed){
    DWORD Timer    =    0;
    DWORD tmpID =    *moveID;//Mob or player id or item id^^
    bool ret    =    true;
    //cout << "in bot moving" << endl;
    while(true){
        Sleep(10);//For Laggingg
        if (tmpID != *moveID || PMe.DieState==true/*if we die*/){//We Check All time id if we mob die or item disappear we stop ...
            ret = false;
            break;
        }
        if (GetTickCount()-Timer>SpeedMs){
            Timer=GetTickCount();

            int xRange    = *x - ActivePlayers[0].pX;
            int yRange    = *y - ActivePlayers[0].pY;
            float Range    = sqrt(float((xRange*xRange)+(yRange*yRange)));//two coordinaes
            int Step    = (Range / Speed);
            int NextX    = ActivePlayers[0].pX + xRange/Step;
            int NextY    = ActivePlayers[0].pY + yRange/Step;
            int NextZ    = Height(NextX,NextY);
            if (NextZ == 0) NextZ = ActivePlayers[0].pZ;

            if (Range <=safeRange){
                SendPacket(0x12,"bbb",0,0,0);
                break;            
            }
            if(Step>1){ 
                SendPacket(0x11,"bbb",NextX-ActivePlayers[0].pX,NextY-ActivePlayers[0].pY,NextZ-ActivePlayers[0].pZ);
                ActivePlayers[0].pX += NextX-ActivePlayers[0].pX;
                ActivePlayers[0].pY += NextY-ActivePlayers[0].pY;
                ActivePlayers[0].pZ += NextZ-ActivePlayers[0].pZ;
            }else if(Step==1){ 
                SendPacket(0x12,"bbb",NextX-ActivePlayers[0].pX,NextY-ActivePlayers[0].pY,NextZ-ActivePlayers[0].pZ);
                ActivePlayers[0].pX += NextX-ActivePlayers[0].pX;
                ActivePlayers[0].pY += NextY-ActivePlayers[0].pY;
                ActivePlayers[0].pZ += NextZ-ActivePlayers[0].pZ;
                break;
            }
          // cout << "move Range: " << Range <<  endl;
        }
    }
    //cout << "out bot moving" << endl;

    return ret;
} 


using sample ;

PHP Code:

BotMove(&ActiveMonsters[Mob_Slot_ID].MonsterID,Attack_Range,&ActiveMonsters[Mob_Slot_ID].mX,&ActiveMonsters[Mob_Slot_ID].mY,250,11); 


i need teleport statu packet and a sample who have ?

[MichalPL]

If som1 can code games, making bot will be piece of cake ? Or its somthing much more harder ,different ?

[MoepMeep]

Depends on the kind of games he makes.

[pamz12]

can we ever aspect tut for playerlike bot ? :P
and sry for digg...

[MoepMeep]

Maybe after finishing my current project