Current Base Address Discovery Methods

[R3D23R0]

Originally Posted by msxgames

0xF10 is the let's say "normal" inventory structure, 0xF18 is the "quest" inventory structure and 0xF14 is the "gear" inventory structure. Under 0xF14 you can find the gear listed under 0xC. 0x0 is the weapon, 0x4 is the hat, 0x8 is the necklace, 0xC is the robe and so on......

currentDur = [[[[[[[realBaseAddress] + 0x1C] + 0x2C] + 0xF14] + 0xC] + 0x0] + 0x74]
maxDur = [[[[[[[realBaseAddress] + 0x1C] + 0x2C] + 0xF14] + 0xC] + 0x0] + 0x78]

The durability is calculated using CEIL(currentDur/100) and CEIL(maxDur/100).

Between your help and Interest's, I finally figured I had an offset or two off and wasn't reading the memory right...

If anyone else is looking for a snippet, this works at the moment:

Global $realbaseaddress = 0xc7662c

Global $baseaddress = _MemoryRead($realbaseaddress, $vOpen) + 0x1c
Global $handle = WinGetHandle($APP_TITLE, "")
Global $vOpen = _MemoryOpen(ProcessExists($EXE_TITLE))
Global $baseoffset = 0x1c
Global $vReadBase = _MemoryRead($vBaseAdress, $vOpen, "dword") + $vBaseOffset
Global $vReadBaseplayer = _MemoryRead($vReadBase, $vOpen, "dword") + $vplayeroffset


Global $dur1 = _MemoryRead($vReadBaseplayer, $vOpen) + 0xF14;
Global $dur2 = _MemoryRead($dur1, $vOpen) + 0xC;
Global $dur3 = _MemoryRead($dur2, $vOpen) + 0x0

$dur4 = _MemoryRead(_MemoryRead($dur3, $vOpen) + 0x74, $vOpen)
$dur = $dur4
$durdisplay = $dur/100

[R3D23R0]

I've been tinkering around with detecting my dq hp charm and replacing it when it runs out, and I've had trouble finding the offset for it, and then after some research I discovered that the ID changes for every DQ charm. There doesn't seem to be any static offset. There's an easy workaround, search in CE for your current HP charm value, what's left of it, and then tick it once, then go back and search for it again, you'll only have one value, hardcode it into your script and it will show your charm value until the charm is gone, then you'll need to repeat the process when the charm is replaced. Annoying, but effective.

Update: I think I may have located the offset for equipped dq charms. Will post after testing.

Originally Posted by msxgames

0xF10 is the let's say "normal" inventory structure, 0xF18 is the "quest" inventory structure and 0xF14 is the "gear" inventory structure. Under 0xF14 you can find the gear listed under 0xC. 0x0 is the weapon, 0x4 is the hat, 0x8 is the necklace, 0xC is the robe and so on......

currentDur = [[[[[[[realBaseAddress] + 0x1C] + 0x2C] + 0xF14] + 0xC] + 0x0] + 0x74]
maxDur = [[[[[[[realBaseAddress] + 0x1C] + 0x2C] + 0xF14] + 0xC] + 0x0] + 0x78]

The durability is calculated using CEIL(currentDur/100) and CEIL(maxDur/100).

DQ charm remaining value is located at [[[[[[[realBaseAddress] + 0x1C] + 0x2C](char struct) + 0xF14(gear inventory)] + 0xC(gear)] + 0x50] + 0xC0]

Not sure why I had trouble locating it before, but it seemed every time I swapped it, the address went somewhere in left field and completely changed. Maybe I mistyped one of the addresses while searching, not the first time I've done that and spent hours banging my head against the wall...

[denzjh]

@R3D23R0 mind helping me with my code, everything seems to work but the Character name

 Spoiler

#RequireAdmin

#include <GUIConstantsEx.au3>
#include <StaticConstants.au3>
#include <WindowsConstants.au3>
#include <NomadMemory.au3>

$BaseAdress = 0xC7662C
$BaseOffset = 0x1C
$PlayerStruct_Offset = 0x2C

$Name_Offset = 0x6B0
$LVL_Offset = 0x4A0
$HP_OffSet = 0x4A8
$MaxHP_OffSet = 0x4F4
$MP_OffSet = 0x4AC
$MaxMP_OffSet = 0x4F8

$PW_Client = _MemoryOpen(ProcessExists("elementclient.exe"))

$PlayerBase = _MemoryRead(_MemoryRead($BaseAdress, $PW_Client, "dword") + $BaseOffset, $PW_Client, "dword") + $PlayerStruct_Offset

$String1 = _MemoryRead(_MemoryRead($PlayerBase, $PW_Client, "dword") + $Name_Offset, $PW_Client, 'wchar[30]')
$String2 = _MemoryRead(_MemoryRead($PlayerBase, $PW_Client, "dword") + $LVL_Offset, $PW_Client, "dword")
$String3 = _MemoryRead(_MemoryRead($PlayerBase, $PW_Client, "dword") + $HP_OffSet, $PW_Client, "dword")
$String4 = _MemoryRead(_MemoryRead($PlayerBase, $PW_Client, "dword") + $MaxHP_OffSet, $PW_Client, "dword")
$String5 = _MemoryRead(_MemoryRead($PlayerBase, $PW_Client, "dword") + $MP_OffSet, $PW_Client, "dword")
$String6 = _MemoryRead(_MemoryRead($PlayerBase, $PW_Client, "dword") + $MaxMP_OffSet, $PW_Client, "dword")

$Form1 = GUICreate("Test", 250, 185 )
$Label1 = GUICtrlCreateLabel($String1, 15, 10, 50, 20)
$Label2 = GUICtrlCreateLabel($String2, 15, 35, 50, 20)
$Label3 = GUICtrlCreateLabel($String3, 15, 60, 50, 20)
$Label4 = GUICtrlCreateLabel($String4, 15, 85, 50, 20)
$Label5 = GUICtrlCreateLabel($String5, 15, 110, 50, 20)
$Label6 = GUICtrlCreateLabel($String6, 15, 135, 50, 20)
GUISetState(@SW_SHOW)

While 1
$nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE
_MemoryClose($PW_Client)
Exit
EndSwitch
WEnd

[msxgames]

The Character name offset is a reference, it's not the name itself. Use something like this:

 Spoiler

$String1 = _MemoryRead(_MemoryRead(_MemoryRead($PlayerBase, $PW_Client, "dword") + $Name_Offset, $PW_Client), $PW_Client, 'wchar[30]')

[denzjh]

Originally Posted by msxgames

The Character name offset is a reference, it's not the name itself. Use something like this:

 Spoiler

$String1 = _MemoryRead(_MemoryRead(_MemoryRead($PlayerBase, $PW_Client, "dword") + $Name_Offset, $PW_Client), $PW_Client, 'wchar[30]')

Thank you very much... Now going onto the next phase of my project...

[R3D23R0]

Originally Posted by denzjh

Thank you very much... Now going onto the next phase of my project...

Sorry I didn't check back forums in time lol.

By the way, coins offset is now at playerstruct + 0x578, if you're curious as to how much you're making per hour.

Global $coin = _MemoryRead($vReadBaseplayer, $vOpen) + 0x578;

[msxgames]

You can use reclass to manage your offsets. Here is an example of the offsets I collected, maybe they are usefull for you.

Reclass can be downloaded from here:

[R3D23R0]

Originally Posted by msxgames

You can use reclass to manage your offsets. Here is an example of the offsets I collected, maybe they are usefull for you.

Reclass can be downloaded from here:

Thanks for posting this. I opened it up and I'm not entirely sure how to use this. I just started using reclass maybe a week or two ago and I just use it to find what address points to what and what offsets point where. I mostly hunt with cheat engine, find what accesses or writes to an address, browse around, then hunt with reclass until I find what I was looking for. I finally realized the hex addresses in reclass point to actual value locations, and that was when things finally clicked and it's much easier now. When I started using Reclass more I realized you can find anything with cheat engine, you just have to be looking for the right value, whether it's *10 or *100 or *x.

[msxgames]

An example how to read ReClass. I started using ReClass 2 weeks ago also, but it's very good to keep a good overview. And sometimes you can find some very interesting offsets. Like the one with the AuctionHall gives a lot of extra information, which I wouldn't have found with CE.

[R3D23R0]

Originally Posted by msxgames

An example how to read ReClass. I started using ReClass 2 weeks ago also, but it's very good to keep a good overview. And sometimes you can find some very interesting offsets. Like the one with the AuctionHall gives a lot of extra information, which I wouldn't have found with CE.

Ok...I guess I'm not good enough with Reclass yet to figure out how you indented all those secondary offsets and got them to point where you got them... I'm going to have to learn how to use more of the features of Reclass I guess.

[denzjh]

@msxgames
I tried to understand the reclass that you attached and i am stuck at the moment... what is the pointer for the SortedNPCList in the class? is it
SortedNPCListPointer = [[[baseAdd + 0x1C] + 0x18] + 0x20] ?
Sorry for being noob?
There is this (SortedNPCList = 0x58) class... but can't follow where the pointer is...

Thanks in advance!

NVM - I got it working now seems typo error on the script, but the Pointer is correct

[msxgames]

Yup, that's how it works.

[R3D23R0]

I'm tinkering around with ideas regarding the in game auto cultivation. Sometimes it just gets screwed up and your character stops attacking for no logical reason. I tried target ID's and mob id's and finally realized I never just auto attack. I always use a skill, so I just set up a timer that would check my current MP and compare it with my MP a while ago, and if it increased, strike 1. If after a little more time it had still increased, strike 2. etc etc etc 3 strikes being it realizes it was borked and I can have it go back to my starting coordinates via the coordinates assistant and reinitiate auto cultivation. Just an idea if anyone else has had a similar issue, that's a decent workaround that won't let you burn charms overnight. And no you don't have to have the client in focus to do all this.

Oh, one other thing. If you ever get the 'enter game fails' or similar error when trying to launch PWI from somewhere, this still works, credits in the quote:

Originally Posted by ntldr32

Stupid GM make an update that fore us to start client with patcher or with Arc launcher, its like go back to old pw lol,.
we can use to baypass it, but since the new autopacth only happend on the 1st client run, and in fact that multi client are legal now in PWI. it mean we only need to ignore the "startbypatcher".
1. open OllyDBG and attach it with pwi client (it is pw international, not pw indo XD, get out if u think this is for pw indo).
2. right click on CPU - main thread window > Search for > All referenced text string.
3. on the referenced text string window, scroll up to the 1st index (CTRL + HOME) > right click > Search for text and type "startbypatcher"
4. double click the "UNICODE startbypatcher"
5. on the CPU - main thread windo. look for "JNZ SHORT 00******" 4 index below "UNICODE startbypatcher". change the JNZ to JMP.
6. right click > copy > select all
7. right click > backup > update backup
8. right click > copty to executable > selection
9. new window apear, right click > save file > save > on file exist msgbox click Yes.
u can now run pwi client w/o Arc or Patcher.

sorry cant post image here XD

[goder2910]

@R3D23R0 Thank for your good tutorial about finding base address.

I have a favor that want to ask you, so please help me.

I want to make simple "bot" with below features:

- Auto press button (something like pressing button when character 's hp is low or use skill in amount of time)
- Auto change target
- Auto pick up item

I can program with C/C++/C#. Can you show me some steps that describe how to use base address (or something else) to make an auto bot ?

Iam a noobie in this aspect, so please forgive me if my question bothers you.

Thank in advanced.

[R3D23R0]

Originally Posted by goder2910

@R3D23R0 Thank for your good tutorial about finding base address.

I have a favor that want to ask you, so please help me.

I want to make simple "bot" with below features:

- Auto press button (something like pressing button when character 's hp is low or use skill in amount of time)
- Auto change target
- Auto pick up item

I can program with C/C++/C#. Can you show me some steps that describe how to use base address (or something else) to make an auto bot ?

Iam a noobie in this aspect, so please forgive me if my question bothers you.

Thank in advanced.

That's pretty much what the auto cultivation bot does, and it's already all there to use, except for the auto pot. You can use a simple script that read the char hp from the client, the offsets are posted around here somewhere, but if you know how to program in C you probably already know how to find offsets with CE. Otherwise there's the auto recovery stone in the boutique that does that for you, you can make up the cost of it within a fraction of the amount of time it lasts for you.