Rus. server

[AlexGD]

Äîáðàëñÿ äî ïåðåìåùåíèé ïåðñà.

Ñïàñèáî ìóæèêó çà àäðåñà èíæåêòîâ.

Âîò êîä èñïðàâëåííûé è äîïîëíåííûé:

  Type
  PParams = ^TParams;
  TParams = packed record
    Param1: DWORD;
    Param2: DWORD;
    Param3: single;
    Param4: single;
    Param5: single;
    Param6: byte;
    Param7: Cardinal;
  end;

    aBaseAddress          = $009771BC;      //base address for getting info

...
  aBasePointer := getDWORD(aBaseAddress);
...

    PW_Base_Call          = $00976B1C;    //base address for injections
    PW_Walk_Call1         = $00461FD0;    //addresses for walk injection
    PW_Walk_Call2         = $00465AB0;    //addresses for walk injection
    PW_Walk_Call3         = $004623D0;    //addresses for walk injection

procedure WalkCall(aPParams:PParams); Stdcall;
var
  Address1: pointer;
  Address2: pointer;
  Address3: pointer;
  x, y, z : single;
  flying  : Cardinal;
begin
  Address1 := pointer(PW_Walk_Call1);
  Address2 := pointer(PW_Walk_Call2);
  Address3 := pointer(PW_Walk_Call3);
  x := aPParams^.Param3;
  y := aPParams^.Param4;
  z := aPParams^.Param5;
  flying := aPParams^.Param7;

  asm
    pushad
      mov eax, dword ptr [PW_Base_Call]
      mov eax, dword ptr [eax+$1C]
      mov esi, dword ptr [eax+$20]
      mov ecx, dword ptr [esi+$C10]
      push 1
      call Address1

      mov edi, eax
      lea eax, dword ptr [esp+$0C]
      push eax
      push flying
      mov ecx, edi
      call Address2

      mov ecx, dword ptr [esi+$C10]
      push 0
      push 1
      push edi
      push 1
      call Address3

      mov eax, dword ptr [PW_Base_Call]
      mov eax, dword ptr [eax+$1C]
      mov eax, dword ptr [eax+$20]
      mov eax, dword ptr [eax+$C10]
      mov eax, dword ptr [eax+$30]
      mov ecx, dword ptr [eax+$4]
      mov eax, x
      mov dword ptr[ecx+$20], eax
      mov eax, z
      mov dword ptr[ecx+$24], eax
      mov eax, y
      mov dword ptr[ecx+$28], eax
    popad
  end;
end;

procedure TaPWT.WalkTo(x, y, z: single);
var
  aParams : TParams;
  aParamsSize: DWORD;
  aPlayer: TaPlayer;
begin
  aPlayer        := getPlayer(getDWORD(aBasePointer + $20));
  aParams.Param3 := (x - 400) * 10;
  aParams.Param4 := (y - 550) * 10;
  aParams.Param5 := z * 10;
  aParams.Param7 := aPlayer.TransportMode;
  aParamsSize := SizeOf(aParams);
  injectfunc(aProcessID, @WalkCall, @aParams, aParamsSize);
end;

7é äåëüôè ïî÷åìó-òî íå çàõîòåë ðàáîòàòü ñ äâîðäîì â êîëëå - ïðèøëîñü ââîäèòü â ÒÏàðàìñ åùå è êàðäèíàë (

aPlayer.TransportMode: Cardinal. Íî íóæíî íå çàáûâàòü, ÷òî íà ñàìîì äåëå ýòî áàéò(!). È ïîëó÷àòü åãî íóæíî:
result.TransportMode := getBYTE(playerPointer + $60D);

Ãåò ôóíêöèè, ÷òî ÿ þçàþ:

function TaPWT.getBYTE(aPointer: integer) : BYTE;
var
  dwReaded: DWORD;
begin
  ReadProcessMemory(aProcessID, ptr(aPointer), @result, SizeOf(result), dwReaded);
end;

function TaPWT.getWORD(aPointer: integer) : WORD;
var
  dwReaded: DWORD;
begin
  ReadProcessMemory(aProcessID, ptr(aPointer), @result, SizeOf(result), dwReaded);
end;

function TaPWT.getDWORD(aPointer: integer) : DWORD;
var
  dwReaded: DWORD;
begin
  ReadProcessMemory(aProcessID, ptr(aPointer), @result, SizeOf(result), dwReaded);
end;

function TaPWT.getFLOAT(aPointer: integer) : Single;
var
  dwReaded: DWORD;
begin
  ReadProcessMemory(aProcessID, ptr(aPointer), @result, SizeOf(result), dwReaded);
end;

function TaPWT.getSTRING16(aPointer: integer) : WideString;
var
  dwReaded: DWORD;
  buf : array[0..16] of WideChar;
begin
  ReadProcessMemory(aProcessID, ptr(aPointer), @buf, 16, dwReaded);
  result := buf;
end;

function TaPWT.getSTRING32(aPointer: integer) : WideString;
var
  dwReaded: DWORD;
  buf : array[0..32] of WideChar;
begin
  ReadProcessMemory(aProcessID, ptr(aPointer), @buf, 32, dwReaded);
  result := buf;
end;

[muzhig]

AlexGD, твою помощь трудно переоценить!
Адресок инжекта копки ресов и трав кто нибудь подскажет?

[AlexGD]

Originally Posted by muzhig

AlexGD, òâîþ ïîìîùü òðóäíî ïåðåîöåíèòü!
Àäðåñîê èíæåêòà êîïêè ðåñîâ è òðàâ êòî íèáóäü ïîäñêàæåò?

Òóò õèòðîñòü... Íåò òàêîãî èíæåêòà. Êàê ÿ ïîíÿë - ýòî òîæå àòàêà... Ïîêà ÿ íå â êóðñå, ïîòîìó ÷òî ïèøó íå áîòà è ýòî ìíå åùå íå íàäî áûëî ) Âîçìîæíî è ñîâñåì íå ïîíàäîáèòñÿ... Õîòÿ ÿ åùå íå ñõàâàë ÷òî òàêîå CullCall ó êèòàéöåâ.

Originally Posted by muzhig

òû õîòåë ñêàçàòü
getbyte(playerPointer + $654))

Íîóâýé. Ìîé êîä ïðîâåðåí è ðàáîòàåò... Îò ìåíÿ òåïåðü íèàäíà ïòû÷êî èç ×Ñëèñòà ñâàëèòü íå ìîæåò

Âîò åùå ðàç ïî ýòîìó ïîâîäó...

  aBaseAddress          = $009771BC;      //base address for getting info
  aBasePointer := getDWORD(aBaseAddress);
  playerPointer := getDWORD(aBasePointer + $20);

    result.RunMode := getBYTE(playerPointer + $60C);
    case result.RunMode of
      0: result.RunModeTitle := 'Run';
      1: result.RunModeTitle := 'Walk';
    end;

    result.TransportMode := getBYTE(playerPointer + $60D);
    case result.TransportMode of
      0: result.TransportModeTitle := 'Ground';
      1: result.TransportModeTitle := 'Flying';
      2: result.TransportModeTitle := 'Swimming'; //not works :( need to be clarifyed
    end;

[AlexGD]

Сейчас вот приступлю к поиску как с НПС разговаривать. Задалпался сам брошь летать )

[dwar]

Íó, êîëü ëþäè ñåðüåçíî âçÿëèñü çà ðàáîòó, âîò êîä äëÿ ïðûæêà (ó íåãî íåò îãðàíè÷åíèå íà êîë-âî ñäåëàííûõ ïðûæêîâ)

  PW_Call := pointer($00470E20);
  PW_BASE_ADDR := pointer($00976B1C);
  asm
      pushad
        push  $0
        push  $C8
        push  $1
        push  $3F800000
        push  $4
        mov   esi, dword ptr [PW_BASE_ADDR]
        mov   esi, dword ptr [esi+$1C]
        mov   esi, dword ptr [esi+$20]
        mov   ecx, esi
        mov   eax, $41200000
        mov   dword ptr[ecx+$B58], $1
        mov   dword ptr[ecx+$B08], eax
        mov   dword ptr[ecx+$B60], eax
        mov   dword ptr[ecx+$AE4], $0
        mov   dword ptr[ecx+$B00], $0
        mov   dword ptr[ecx+$AFC], $0
        mov   dword ptr[ecx+$AF8], $0
        call  PW_Call
      popad
  end;

×òî êàñàåòñÿ êîïêè ðåñà… àáñîëþòíî âåðíî, íåò îòäåëüíîé ôóíêöèè äëÿ ýòîãî äåéñòâèÿ, äîñòàòî÷íî âûçâàòü ïðîñòóþ àòàêó ñ íóæíûì id.

À âîò è ðàçãîâîð ñ ÍÈÏîì (ïðîâåðüòå åùå ðàç, ò.ê. ÿ äàâíî åé íå ïîëüçîâàëñÿ, ìîæåò áûòü, ÷òî-íèáóäü ïîìåíÿëîñü óæå)

  PW_Call := pointer ($005AE400);
  PW_BASE_ADDR := pointer ($00976B1C);
  P1 := NPCID^.Param1 ;
    asm
        mov   edx, DWORD PTR [PW_BASE_ADDR]
        mov   ecx, P1
        push  ecx
        mov   ecx, DWORD PTR [edx+$20]
        add   ecx, $EC
        call  PW_Call
    end;

Íî âîò ÷åãî íåò, òàê ýòî ôóíêöèè ïðîäàæè âåùåé…

[AlexGD]

Originally Posted by dwar

Íó, êîëü ëþäè ñåðüåçíî âçÿëèñü çà ðàáîòó, âîò êîä äëÿ ïðûæêà (ó íåãî íåò îãðàíè÷åíèå íà êîë-âî ñäåëàííûõ ïðûæêîâ)
[/code]

Ðàáîòàåò! Ñïñ!

[AlexGD]

Ìàëîñòü ïðèøëîñü ïîïàðèòüñÿ ñî ñïèñêîì íåïèñåé è ìîáîâ... Îêàçàëîñü, ÷òî èìÿ íåïèñÿ èëè ìîáà àæ 64 Âàéä×àðà... Êðóòî çàâåðíóëè. Âíóøàåò...

ôóíêöèè getSTRING16 è getSTRING32 èñ÷åçëè. Òåïåðü ÿ ïîëüçóþ:

function TaPWT.getSTRING(aPointer, length: integer) : WideString;
var
  dwReaded: DWORD;
  buf16 : array[0..16] of WideChar;
  buf32 : array[0..32] of WideChar;
  buf64 : array[0..64] of WideChar;
begin
  if length = 16 then
  begin
    ReadProcessMemory(aProcessID, ptr(aPointer), @buf16, length, dwReaded);
    result := buf16;
  end;
  if length = 32 then
  begin
    ReadProcessMemory(aProcessID, ptr(aPointer), @buf32, length, dwReaded);
    result := buf32;
  end;
  if length = 64 then
  begin
    ReadProcessMemory(aProcessID, ptr(aPointer), @buf64, length, dwReaded);
    result := buf64;
  end;
end;

Ðàáî÷àÿ ôóíêöèÿ äëÿ ïîëó÷åíèÿ ëèñòà ìîáîâ/íåïèñåé

function TaPWT.GetLocationMobNPC(nType: integer): TaNPCArray;
var
  aNPC: TaNPC;
  p1, p2, p3, p4, p5 : DWORD;
  i, n: integer;
begin
  SetLength(result, 768);
  n := 0;
  p1 := getDWORD(aBasePointer + $8);
  p2 := getDWORD(p1 + $24);
  p3 := getDWORD(p2 + $18);
  for i := 0 to 795 do
  begin
    p4 := getDWORD(p3 + (i * 4));
    p5 := getDWORD(p4 + $4);
    if getDWORD(p5 + $B4) = nType then //6 = Mob, 7 = NPC
    begin
      aNPC := getMobNPC(p5);
      if aNPC.ID <> 0 then
      begin
        result[n] := aNPC;
        Inc(n);
      end;
    end;
  end;
end;


function TaPWT.getMobNPC(aPointer: DWORD) : TaNPC;
var
  NamePointer : DWORD;
begin
  result.ID := getDWORD(aPointer + $11C);

  result.HPCurr := getDWORD(aPointer + $12c);
  result.HPMax  := getDWORD(aPointer + $15c);

  result.Level := getDWORD(aPointer + $124);

  NamePointer := getDWORD(aPointer + $23C);
  result.Name := getSTRING(NamePointer, 64);

  result.Location.X := (getFLOAT(aPointer + $3C) / 10) + 400;
  result.Location.Y := (getFLOAT(aPointer + $44) / 10) + 550;
  result.Location.Z := (getFLOAT(aPointer + $40) / 10);
end;

[AlexGD]

Îôîðìëåííûé ðàáî÷èé èíüåêò ðàçãîâîðà ñ ÍÏÑ

    PW_Talk_Call          = $005AE400;    //address for NPC talk call insertion


procedure NPCTalkCall(aPParams:PParams); Stdcall;
var
  NPCIDParam: DWORD;
  Address1: pointer;
begin
  Address1 := pointer(PW_Talk_Call);
  NPCIDParam := aPParams^.Param1;
  asm
    pushad
      mov edx,dword ptr [PW_Base_Call]
      push NPCIDParam
      mov ecx,dword ptr [edx+$20]
      add ecx,$EC
      call Address1
    popad
  end;
end;

procedure TaPWT.TalkToNPC(NPCID: Cardinal);
var
  aParams : TParams;
begin
  aParams.Param1 := NPCID;
  InjectFunc(aProcessID, @NPCTalkCall, @aParams, SizeOf(aParams));
end;

[AlexGD]

И вот началась веселуха...

Как нажать у НПС пункт "Задание"? или хотя бы 1й/2й/3й пункты...

Есть у кого идеи?

[AlexGD]

Хммм... А у тебя BA какой? У меня $009771BC

[AlexGD]

Кстати... Не подскажешь иньект-поинтер на бэйс-атаку? Уже 3 часа убил - не могу найти...

[AlexGD]

Тут хитрая фишка... На самом деле ты нашел инжект не для атаки, а для вызова скила атаки. А это не совсем то. Насколько я понимаю - нужен инжект как будто на рес навели мышку и кликнули. Ты вот сейчас с этим для ресов мучаешься, а я для разговора с неписями )

[AlexGD]

Я OllyDBG первый раз в глаза увидел неделю назад ) Сам учусь еще...

[dwar]

âîò, à åñëè áû âñå ãîòîâîå âûêëàäûâàëè, òî òàêîãî áóðíîãî «èññëåäîâàíèÿ» íèêîãäà áû è íå áûëî… + ÷åëîâåê, êîòîðûé ýòèì çàíèìàåòñÿ, åñòåñòâåííî, íàáèðàåòñÿ îïûòà…
Íî êîððåêòèðîâêè òðåáóþòñÿ âñåãäà, ïîñåìó…
Îøèáêà â íåïðàâèëüíî íàéäåííîé ôóíêöèè. Òà, ÷òî îòâå÷àåò çà àòàêó, íàõîäèòñÿ ÷óòü-÷óòü â äðóãîì ìåñòå, è, êîíå÷íî æå, îäíèì èç ïàðàìåòðîâ åå ÿâëÿåòñÿ wid öåëè.
Îòíîñèòåëüíî ïðîñòîé ñïîñîá ïîèñêà íóæíûõ ôóíêöèé – ïîñòàâèòü òî÷êè îñòàíîâà íà îïðåäåëåííûå êîìàíäû, äîïóñòèì íà mov eax, [976B1C]… Âîò åùå àäðåñà äâóõ case’îâ: 00598B9D, 00598B76. Åñëè â íèõ óñòàíîâèòü áðåéêïîèíòû, òî ïîëó÷èòñÿ îòñëåäèòü ñ ñàìîãî íà÷àëà ìíîãèå äåéñòâèÿ.

×òî êàñàåòñÿ ñáîðà ðåñà íå ïîñðåäñòâîì èíæåêòà, òî çäåñü òîæå îøèáêà, èäóùàÿ ñ ñàìûõ íà÷àë, êîãäà áûëî íàïèñàíî, ÷òî äëÿ ýòîãî íàäî âûáðàòü äåéñòâèòåëüíóþ öåëü, àòàêîâàòü åå, ïîòîì áûñòðî ïåðåïèñàòü id öåëè íà id ðåñà è ÷àð ïîáåæèò êîïàòü (íåóæåëè òàêîå ó êîãî-òî ïîëó÷àëîñü)… Åñòü æå ìàññèâ óêàçàòåëåé âñåõ äåéñòâèé: ïðîñòàÿ àòàêà, ìåäèòàöèÿ, êîïêà ðåñà, ñëåäîâàòü è ò.ï. Äîñòàòî÷íî èñïîëüçîâàòü íóæíûå óêàçàòåëè è, íó ïî÷òè ïðîñòî, ïîëó÷èòñÿ îñóùåñòâèòü áîëüøóþ ÷àñòü ôóíêöèé ÷àðà.

 ýêñåëîâñêîé òàáëèöå, íà ïåðâîì ëèñòå, ÷àñòü àäðåñîâ åùå ãîäè÷íîé äàâíîñòè…

[Sergiy76]

Ðóññêèé áîò àëüôà âåðñèÿ ñêîìïèëèðîâàíûé
À ýòî åãî èñõîäíûé òåêñò íà Ñ++

Áîò ïîêà ðàáîòàåò õóæå MHSà, íî ìîæíî ïåðåäåëûâàòü, óëó÷øèòü.

Âîïðîñ - Êàê íà Ñ++ ðåàëèçîâàòü äâèæåíèå ê êîîðäèíàòå?
Êòî-òü ìîæåò íàïèñàòü ãîòîâóþ ïðîöåäóðó?

Íåîáõîäèìî äëÿ ðåàëèçàöèè ñáîðû ëóòà è áåãà â ìàãàçèí.