Register for your free account! | Forgot your password?

Go Back   elitepvpers > MMORPGs > Perfect World > PW Hacks, Bots, Cheats, Exploits
You last visited: Today at 08:46

  • Please register to post and access all features, it's quick, easy and FREE!

Advertisement



[GUIDE] How to find offsets with Cheat Engine

Discussion on [GUIDE] How to find offsets with Cheat Engine within the PW Hacks, Bots, Cheats, Exploits forum part of the Perfect World category.

Reply
 
Old 07/08/2013, 00:58   #16
 
elite*gold: 10
Join Date: Sep 2010
Posts: 400
Received Thanks: 234
Quote:
Originally Posted by ntldr32 View Post
ty for magic word "static" XD, I found a lot of static addresses that can be used as a reference to determine the connection game. However, by using a value of 1 as a reference to the current connection and 0 for disconnection, I think maybe this is 00C1D758 exact address. I'm not sure either, but so far it works fine, .. thank muah ... XD,
0xC1D758 is the correct static offset, but since you asked, here is the 'disconnect from server' window offset and how to find it. The static offset will definitely change when elementclient is updated. This offset chain has a better chance of remaining intact (although GUI stuff does sometimes change with bigger updates)
Code:
[[[[[[[baseCall]+0x1C]+0x18]+0x8]+0xC4]+0x798]+0x90]
(1 byte)
0x798 is the base for the window object, 0x90 is the flag that says if the dialogue is active.

Also you are correct that my GUI mapper didn't work for this. I need to look into why that is. (Although the GUI mapper does mostly work with updated base address... and child objects work if you replace all instances of 0x1C4 with 0x1C8).

But for easy future reference if for some reason this offset changes, here's how to find it.

Possibly the two most useful GUI system offsets are:
Code:
[[[[[baseCall]+0x1C]+0x18]+0x8]+0x254]
and
[[[[[baseCall]+0x1C]+0x18]+0x8]+0x258]
They show which GUI dialogue window you are hovering over and the child control of that object (respectively).
Load those offsets into Cheat Engine and then pull out your ethernet cable or otherwise disable your internet so the game disco's.
Now hover over the "Disconnected from server" window and write down the value in the first (0x254) offset.
In CE, add this address manually, then right click it and 'Find out what accesses this address'.
Just click on the first one (or any of them really) and click 'More information'.
It'll look something like this:



Look at the instruction above the red one (with the edi*4 in it) which is the one that references the dialogue object from the dialogue list - So just take the value of EDI and multiply it by 4.
In this case, that's 0x1E6 * 4 = 0x798
Then just take my word for it (or see some of my other GUI posts) that 0x90 is the flag that indicates if a dialogue is 'open'.
The list of dialogue objects is at (and has been for a long time)
Code:
[[[[[baseCall]+0x1C]+0x18]+0x8]+0xC4]
So just add the window offset at the 'visible' flag and that gives us:
Code:
[[[[[[[baseCall]+0x1C]+0x18]+0x8]+0xC4]+0x798]+0x90]
Magic
dumbfck is offline  
Thanks
1 User
Old 07/08/2013, 18:39   #17
 
ntldr32's Avatar
 
elite*gold: 0
Join Date: Feb 2011
Posts: 75
Received Thanks: 34
i have another question guys,..
i made(or maybe translate) BuildInventoryArray function into VB.net,
PHP Code:
Imports Perfect_World.NomadMemory
Imports Perfect_World
.offset
Public Class global_function
    
Public Shared Sub BuildInventoryArray()
        
Dim pointer_address _MemoryRead(CHAR_DATA_BASE OFFSET_INVENTORYBASE(1), PROCESS_INFORMATION) + 12
        Dim pointer 
_MemoryRead(pointer_addressPROCESS_INFORMATION)
        
Dim inventory_base
        
For As Integer 0 To inventorysize() - 1
            On Error Resume Next
            inventory_base 
_MemoryRead(pointer 4PROCESS_INFORMATION)
            
Dim itm As ListViewItem
            Dim l_item
(7) As String
            l_item
(0) = _MemoryRead(inventory_basePROCESS_INFORMATION)
            
l_item(1) = _MemoryRead(inventory_base OFFSET_INVENTORYSTACKAMOUNTPROCESS_INFORMATION)
            
l_item(2) = _MemoryRead(inventory_base OFFSET_INVENTORYMAXSTACKAMOUNTPROCESS_INFORMATION)
            
l_item(3) = _MemoryRead(inventory_base OFFSET_INVENTORYSELLPRICEPROCESS_INFORMATION)
            
l_item(4) = _MemoryRead(inventory_base OFFSET_INVENTORYBUYPRICEPROCESS_INFORMATION)
            
l_item(5) = _MemoryRead(inventory_base OFFSET_INVENTORYIDPROCESS_INFORMATION)
            
Dim item_string As String
            Dim item_name 
As String
            item_string 
_MemoryRead_Unicode(_MemoryRead(inventory_base OFFSET_INVENTORYDESCRIPTIONPROCESS_INFORMATION), PROCESS_INFORMATION500500)
            If 
item_string.Length 0 Then
                item_name 
""
            
Else
                
item_name item_string.Split("\r")(0).Remove(07)
            
End If
            
l_item(6) = item_name
            itm 
= New ListViewItem(l_item)
            
Form1.list_inventory.Items.Add(itm)
        
Next
    End Sub
    
Public Shared Function inventorysize() As Integer
        Dim inventorysize_address 
As Integer _MemoryRead(CHAR_DATA_BASE OFFSET_INVENTORYBASE(1), PROCESS_INFORMATION) + 16
        Dim I_size 
As Integer _MemoryRead(inventorysize_addressPROCESS_INFORMATION)
        Return 
I_size
    End 
Function

End Class 
all works fine, but i need something, that missing, i need offset for subtype,. so i can filter only the potion to be show.
for example healing potion have subtype 1795, i just want want to show item with subtype 1795(healing potion) that exist in inventory, idk ow to find it with CE, so i try my luck by loop read
PHP Code:
Dim sub_tipe As Integer
Dim OFFSET_INVENTORY_SUBTYPE_ID 
As Integer 0
While sub_tipe <> 1795
    OFFSET_INVENTORY_SUBTYPE_ID 
OFFSET_INVENTORYID 1
    sub_tipe 
_MemoryRead(inventory_base OFFSET_INVENTORY_SUBTYPE_IDPROCESS_INFORMATION)
End While 
the loop stop when OFFSET_INVENTORY_SUBTYPE_ID = 2394420
so i think that value could be the offset for item sub type. but after relog, it show another value,.. qq. i give up, and i come here and ask for the exact item subtype offset XD,..
ntldr32 is offline  
Old 07/08/2013, 23:34   #18
 
elite*gold: 10
Join Date: Sep 2010
Posts: 400
Received Thanks: 234
Your loop search code doesn't seem to actually be doing much:
Code:
[COLOR=#000000][COLOR=#007700]While [/COLOR][COLOR=#0000BB]sub_tipe [/COLOR][COLOR=#007700]<> [/COLOR][COLOR=#0000BB]1795 
    OFFSET_INVENTORY_SUBTYPE_ID [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]OFFSET_INVENTORYID [/COLOR][COLOR=#007700]+ [/COLOR][COLOR=#0000BB]1 
    sub_tipe [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]_MemoryRead[/COLOR][COLOR=#007700]([/COLOR][COLOR=#0000BB]inventory_base [/COLOR][COLOR=#007700]+ [/COLOR][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID[/COLOR][COLOR=#007700], [/COLOR][COLOR=#0000BB]PROCESS_INFORMATION[/COLOR][COLOR=#007700]) 
[/COLOR][COLOR=#0000BB]End [/COLOR][COLOR=#007700]While 
[/COLOR][/COLOR]

because you're not actually incrementing anything. If you know the base address for a struct (for example, an item), you'd want to do something like this:
(By the way, I am assuming that what you are calling inventory_base is actually an item base within the inventory? I didn't check the whole code and my VB is a bit rusty)
Code:
[COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID [/COLOR][COLOR=#007700]= inventory_base
[/COLOR][/COLOR]While [/COLOR][COLOR=#0000BB]sub_tipe [/COLOR][COLOR=#007700]<> [/COLOR][COLOR=#0000BB]1795 
    [/COLOR][/COLOR][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID = [/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID + 4[/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][COLOR=#0000BB]
    sub_tipe [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]_MemoryRead[/COLOR][COLOR=#007700]([/COLOR][COLOR=#0000BB]inventory_base [/COLOR][COLOR=#007700]+ [/COLOR][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID[/COLOR][COLOR=#007700], [/COLOR][COLOR=#0000BB]PROCESS_INFORMATION[/COLOR][COLOR=#007700]) 
[/COLOR][COLOR=#0000BB]End [/COLOR][COLOR=#007700]While 
[/COLOR]


And you'd probably want a condition in there so that it won't search forever if it doesn't find it, e.g., a set amount of memory to search.

Code:
[COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID [/COLOR][COLOR=#007700]= inventory_base
[/COLOR][/COLOR]While [/COLOR][COLOR=#0000BB]sub_tipe [/COLOR][COLOR=#007700]<> [/COLOR][COLOR=#0000BB]1795 _
And [/COLOR][/COLOR][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID < (inventory_base + 0x1000[/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR])
[/COLOR][/COLOR][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID = [/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB][COLOR=#000000][COLOR=#007700][COLOR=#000000][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID + 4[/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][/COLOR][COLOR=#0000BB]
    sub_tipe [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#0000BB]_MemoryRead[/COLOR][COLOR=#007700]([/COLOR][COLOR=#0000BB]inventory_base [/COLOR][COLOR=#007700]+ [/COLOR][COLOR=#0000BB]OFFSET_INVENTORY_SUBTYPE_ID[/COLOR][COLOR=#007700], [/COLOR][COLOR=#0000BB]PROCESS_INFORMATION[/COLOR][COLOR=#007700]) 
[/COLOR][COLOR=#0000BB]End [/COLOR][COLOR=#007700]While 
[/COLOR]


However - You're better off searching in CE first then coding the correct offset into your program lol.
If you know the base address of an item, then do a normal search in CE but set the start address as the base of the item and set the end address at, say, 0x1000 above that. So if the item base address is 0x02345678 and the value you are searching for is 1795 (decimal) then:
Search for 1795 (hex box UNchecked)
Start address 0x02345678
End address 0x02346678

Those offsets are not static so they will change after a relog - That's why we reference offsets using chains starting from the base address.

Sorry, I don't have my hax computer on at the moment and it takes forever to warm up otherwise I would have just found the offset. But hey, teach a man to fish and all that

dumbfck is offline  
Thanks
1 User
Old 07/09/2013, 12:05   #19
 
ntldr32's Avatar
 
elite*gold: 0
Join Date: Feb 2011
Posts: 75
Received Thanks: 34
Quote:
Originally Posted by dumbfck View Post
Your loop search code doesn't seem to actually be doing much
hehehe, i call that loop as 'LUCKY LOOP' but the relust isnt luck at all, only get the fisrt condition,.. ill try use CE now XD

no luck, still cant find that offset for subtype, the value from address range {inventory_base} to {inventory_base + Xnumber} not given a satisfactory results,.
i think maybe the value for subtype not stored on inventory base range address, but maybe stored in somewhere else where the client call that value by linking it with the item id on inventory. Anyway to find where gm put info abt all item? so i can link it with the item id on my inventory?. ofc without reading the element.data file XD,
ntldr32 is offline  
Old 07/10/2013, 10:09   #20
 
elite*gold: 10
Join Date: Sep 2010
Posts: 400
Received Thanks: 234
Take a look at the Prophet bot offset:
Code:
ItemBase_Offset=28
ItemID_Offset=272
ItemSN_Offset=276
ItemName_Offset=360
ItemType_Offset=336
(Bear in mind that those are in decimal).
So you should be able to find something around there. It's been a while since I did any inventory stuff...

And as for linking all data, the only way to really do that is from elements.data. I don't know if Ronny still maintains his selEdit data files, but that's how I used to get the data. I just made a C# version of his extraction code and used his data files then stored everything into a database. I'd love to know how he originally created those offset files though.
dumbfck is offline  
Old 07/10/2013, 10:19   #21
 
Sᴡoosh's Avatar
 
elite*gold: 20
Join Date: May 2009
Posts: 1,290
Received Thanks: 326
Initially the element structs where reversed, and still are by a huge part of community. I can pass you completely described structs if you want them dumbfck - as long as you keep them to yourself as they aren't public, and that's good. Since I stopped caring for the server dev part of PW, last one I have is v69 (PWI 1.4.5). If you need, I can get v80+ also though. Same goes for tasks.data btw.
Sᴡoosh is offline  
Old 07/10/2013, 10:26   #22
 
elite*gold: 10
Join Date: Sep 2010
Posts: 400
Received Thanks: 234
I would be quite interested in seeing those actually, just out of curiosity! Cheers
dumbfck is offline  
Old 07/10/2013, 10:37   #23
 
Sᴡoosh's Avatar
 
elite*gold: 20
Join Date: May 2009
Posts: 1,290
Received Thanks: 326
Check your PM.
Sᴡoosh is offline  
Thanks
1 User
Old 07/10/2013, 15:59   #24
 
Interest07's Avatar
 
elite*gold: 0
Join Date: Mar 2010
Posts: 862
Received Thanks: 576
I would've been interested in those a year or so ago, pretty cool that. My 'hacking' days are over I still enjoy reading these forums though from time to time to see what's developing.
Interest07 is offline  
Old 07/10/2013, 17:53   #25
 
ntldr32's Avatar
 
elite*gold: 0
Join Date: Feb 2011
Posts: 75
Received Thanks: 34
Quote:
Originally Posted by dumbfck View Post
Take a look at the Prophet bot offset:
Code:
ItemBase_Offset=28
ItemID_Offset=272
ItemSN_Offset=276
ItemName_Offset=360
ItemType_Offset=336
no subtype in there,
the ItemType_Offset contain the main type of an item on our inventory, eg 11385488 for all kinds of Hp/Mp potion, but not filter the Mp or the Hp. ItemName_Offset contain the item name on bag, but only after mouse hover that item, its mean on bot, ItemName_Offset will allways return empty string. I think only the ItemID_Offset that usefull. But since cant find any info abt subtype, so i decide to filter by main type only(ItemType_Offset) :/, not filter hp/mp pot but at least filter all pots.
also, bcos the ItemName_Offset always return empty string before the mouse hover it, i used the posted by Sᴡoosh.
For my first contribution on this forum, i made a function based on that file to return file name by item_type. i just try to avoid reading big file XD (i think, reading memory is lighter than reading large files heheheh). But still need to find out how to get itemsubtype, XD, and for Ronny sTolls, its look like the sEldit isnt work anymore for PWI
__________
For Sᴡoosh, I have a suggestion for you pGrind. Make the pGrind can be purchased by a guild / faction. In other words, all the players from the guild / faction who bought pGrind can use, or they can be bought with money from the guild / faction XD. You know it, "restaurant patrons" do not need to buy a plate to eat there . hahahahaha
Also, do some action if game disconected like what i do on my bot XD, eg close the game client(free computer from unused job), turn off the computer or relog the game,.
Attached Files
File Type: zip item.zip (141.2 KB, 11 views)
ntldr32 is offline  
Old 07/10/2013, 18:52   #26
 
Sᴡoosh's Avatar
 
elite*gold: 20
Join Date: May 2009
Posts: 1,290
Received Thanks: 326
Quote:
Originally Posted by ntldr32 View Post
For Sᴡoosh, I have a suggestion for you pGrind. Make the pGrind can be purchased by a guild / faction. In other words, all the players from the guild / faction who bought pGrind can use, or they can be bought with money from the guild / faction XD. You know it, "restaurant patrons" do not need to buy a plate to eat there . hahahahaha
Also, do some action if game disconected like what i do on my bot XD, eg close the game client(free computer from unused job), turn off the computer or relog the game,.
I won't add any more features to it, only bugfixes and maintainance. I don't really care about PW anymore, .
Sᴡoosh is offline  
Old 07/10/2013, 20:47   #27
 
elite*gold: 0
Join Date: Nov 2012
Posts: 96
Received Thanks: 81
Quote:
Originally Posted by ntldr32 View Post
no subtype in there,
the ItemType_Offset contain the main type of an item on our inventory, eg 11385488 for all kinds of Hp/Mp potion, but not filter the Mp or the Hp. ItemName_Offset contain the item name on bag, but only after mouse hover that item, its mean on bot, ItemName_Offset will allways return empty string. I think only the ItemID_Offset that usefull. But since cant find any info abt subtype, so i decide to filter by main type only(ItemType_Offset) :/, not filter hp/mp pot but at least filter all pots.
also, bcos the ItemName_Offset always return empty string before the mouse hover it, i used the posted by Sᴡoosh.
For my first contribution on this forum, i made a function based on that file to return file name by item_type. i just try to avoid reading big file XD (i think, reading memory is lighter than reading large files heheheh). But still need to find out how to get itemsubtype, XD, and for Ronny sTolls, its look like the sEldit isnt work anymore for PWI
__________
For Sᴡoosh, I have a suggestion for you pGrind. Make the pGrind can be purchased by a guild / faction. In other words, all the players from the guild / faction who bought pGrind can use, or they can be bought with money from the guild / faction XD. You know it, "restaurant patrons" do not need to buy a plate to eat there . hahahahaha
Also, do some action if game disconected like what i do on my bot XD, eg close the game client(free computer from unused job), turn off the computer or relog the game,.
did you know that in the time you used for searching the "subId", it would be more clever to make just a little sort function by using the itemID ?
pro: function now finished, 1 offset more you dont need to find after a update, no time consuming...

just remember, thats a simple bot and not a complex rocket steering software

to the name offset:
Interest07 posted, i mean some years ago, a way to get the item name like you hover with the mouse over it.
dumbfck postet some months ago also a working function for that.

to "your" bot:
it sound all time cool to mess with other working bots or dream about functions, if there is no finished bot yet from you...but 1000 newbie questions, especially for bot source codes
Murmuring is offline  
Old 07/11/2013, 21:49   #28
 
ntldr32's Avatar
 
elite*gold: 0
Join Date: Feb 2011
Posts: 75
Received Thanks: 34
Quote:
Originally Posted by Murmuring View Post
it sound all time cool to mess with other working bots or dream about functions, if there is no finished bot yet from you...but 1000 newbie questions, especially for bot source codes
i never ask for source code,
why i come here and ask for code? use ready-made bot is more easy than come and ask for code.
i already have a function that can return item info(name, subtype, etc) by id, but it is a 'database like' function, and what i need is memory based where i dont need to change item info for every server,
ntldr32 is offline  
Old 07/11/2013, 22:58   #29
 
elite*gold: 0
Join Date: Nov 2012
Posts: 96
Received Thanks: 81
Quote:
Originally Posted by ntldr32 View Post
i never ask for source code,
why i come here and ask for code? use ready-made bot is more easy than come and ask for code.
^^sure ?

Quote:
Originally Posted by ntldr32 View Post
nice job.!!! but I dont believe the "exe", I just believe "source code". so can u post the source code.?,
^^ ups

as i say before...if its just for pots, simply sort them by the itemID.
there not much different hp/mp pots to sort out.
Murmuring is offline  
Old 07/12/2013, 14:36   #30
 
ntldr32's Avatar
 
elite*gold: 0
Join Date: Feb 2011
Posts: 75
Received Thanks: 34
Quote:
Originally Posted by Murmuring View Post
^^sure ?


^^ ups

as i say before...if its just for pots, simply sort them by the itemID.
there not much different hp/mp pots to sort out.
yes i was asking u to post for code
not mean ill use that code bcos, its still prophet bot(the function all same, with only different on windows) that i already have.
but its make me wonder why you "CLOSE THE CODE THAT WAS OPEN SOURCE" and u are not the owner of prophet bot , u sould make new bot and and close the source of your own bot, not edit Prophet Bot and use that name like u are the owner,
Thats why i ask for the code.
if the code were closed since its made, ill wont ask for code, but still prophet bot was open, who know what you add on it ,
any changes on Open Source project that you want to go public have to provide, if not, you better use it for private ,
ntldr32 is offline  
Reply


Similar Threads Similar Threads
guide: debug pwi, find function addresses and offsets, write a bot(c++ code included)
09/04/2022 - PW Hacks, Bots, Cheats, Exploits - 123 Replies
hi, let's start right away. what you can learn: - trace and call ingame-functions like attack, cast spell, pick up, moveto, ... - traverse object lists like items, mobs, players - read ingame structures (class objects) and how they play together - write your own fully client-side bot that doesnt need to simulate mouse/keyboard input and doesnt need to read pixels
[Video] Finding Offsets with Cheat Engine
06/04/2013 - Battle of the Immortals - 5 Replies
Ok, I have been getting asked quite a bit lately how to find offsets. I figured rather than explaining it over, over, and over again I would just make a set of videos. The first video will show you how to find the Target Pointer Offset. This process is extremely easy to do but for some reason many people can't figure it out. Time permitting I will be making a couple more videos to show the process for almost all offsets. Video #1: Target Pointer Offset (Battle of the Immortals) Video...
Everyone asking about offsets and cheat engine!!!
04/19/2013 - Aion - 0 Replies
If you've ever wanted to know about finding offsets, what to do with offsets, how to make your own programs, how to use cheat engine, or anything else related to this subject please direct all your attention to the link below! HACKING TUTORIALS More TUTORIALS
Cheat engine info-update offsets
03/26/2010 - Dekaron - 4 Replies
I saw that there a new offsets in the macros section here but im new to using the cheat engine so coul anyone tell me how to update the offsest to make my hacks work?



All times are GMT +1. The time now is 08:46.


Powered by vBulletin®
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.
SEO by vBSEO ©2011, Crawlability, Inc.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Support | Contact Us | FAQ | Advertising | Privacy Policy | Terms of Service | Abuse
Copyright ©2025 elitepvpers All Rights Reserved.