PWI Eclipse changes

[Kruger2001]

Hi, Does anyone know the packages for the character selection at login please

[Stark77]

base|0x1C|0x10|0x8|0xAC|0x8|0x34|0xA44

need to use memwrite starting with 0 as first char

[sasukezero]

Hmmmm when reading character selection, i have to think about my way of login in lol
At the moment I'm using Imagesearch via autoit to login my Buffers and co, which is ok....but ineffective.
Does anyone actually know, how to easily press like the Start button at the login and in the character selection? Like i guess it has to be done over injection of code, like with digging and so, but maybe its easier with only the Start button.
Trigger a Flag maybe ?

I find it quite interesting to automate more and more in a easier way, thats why I'm asking.
Maybe someone has a idea or a better way

[Kruger2001]

Hi,

this works for me without Imagesearch, example in AHK:

Run, elementclient.exe, C:\Program Files (x86)\Perfect World International\PWI_en\element\
;get Ahk_ID from client
Sleep, 8000
ESC(ahk_id) ;to close Server Select
sleep, 1000
ControlSend,, TestAccount, % "ahk_id " Ahk_ID
ControlSend,, {Tab}, % "ahk_id " Ahk_ID
ControlSend,, TestPW, % "ahk_id " Ahk_ID
Enter(ahk_id)
Sleep, 2000
ESC(ahk_id) ;to Close Infobox
Sleep, 1000
;Implement character selection
Enter(ahk_id) ;Log in to Game

;From Character selection back to Login Screen use ESC

ESC(AhkID)
{
ControlSend,, {ESC}, % "ahk_id " AhkID
}

ENTER(AhkID)
{
ControlSend,, {ENTER}, % "ahk_id " AhkID

This Function to Log from game to character select in Autoit:

Func logOut($toAccount, $pid)
    ;//Sends a packet to log the character from the server
    ;//If toAccount=1, it logs to character select 
    ;//If toAccount=0, it exits completely
    local $packet, $packetSize
    
    $packet = '0100'
    $packet &= _hex($toAccount)
    $packetSize = 6

    sendPacket($packet, $packetSize, $pid)
EndFunc

The advantage is that you do not have to wait for Imagesearch, so you can do other things at the time.
The disadvantage that respond to error messages during login is difficult, maybe you can read from memory.

I need sometimes ForceLog, no idea how to do that.

[Stark77]

ControlSend,, TestAccount, % "ahk_id " Ahk_ID
ControlSend,, {Tab}, % "ahk_id " Ahk_ID
ControlSend,, TestPW, % "ahk_id " Ahk_ID

this part is not working for me. it can close the serverlist with sending ESC but i cannot write the account info in the login form.

have u ever tested this?

btw: this is how i get the ahk_id

 Spoiler

   WinGet, id, list,,, Program Manager
   Loop, %id%
   {
      this_id := id%A_Index%
      WinGetTitle, this_title, ahk_id %this_id%
      if this_title contains Perfect World
      {
         AhkID := this_id
         break
      }
   }

EDIT: it only works for me if i use the windowname

[Kruger2001]

Yes, I had the same problem:

ControlSend,, %Login%{Tab}%Password%{Enter}, % "ahk_id " Ahk_ID

ControlSend,, AccName{Tab}AccPW{Enter}, % "ahk_id " Ahk_ID

the two do not work.

separately it works fine for me

[sasukezero]

ahhhhh lol i didnt even try to close the server selection with ESC.....I've just done it by image search but this is better. The sleep is one idea hmm i might check if there is a flag or so that triggers when you're in the login window. Then a sleep wouldn't be necessary.

The window has to be unfreezed for controlsend right ? I tried that before but doesn't work without unfreezing if i remember right. Or does it work in AHK ?

Idk how force log is working either, i tried to find the flag before and once did, but i couldn't find the end of the offset chain.....so i went by just leaving it how it is.

At the logout, I'm using the same function. First, I was using also image search and then yeah the logout via packages. Its way better.

About the ID, you mean the PID right ?
I get this easily by this:

$pid = ProcessExists('elementclient.exe')

[Kruger2001]

ahk_id, Each window or control has a unique ID, also known as a HWND (short for handle to window) This ID can be used to identify the window or control even if its title changes. So we are not talking about the Process ID.
at ControlSend you do not need to unfreeze

[Stark77]

Well maybe this will give u some ideas on how to do it.
Not sure if those offset chains change often.

 Spoiler

PHP Code:

PWIstartTitle := "Perfect World International: Eclipse"

Login1:
{
    gui submit, nohide
    LoginList := StrSplit(LoginListStr, ",")
    Loop % LoginList.MaxIndex()
    {
        if (mod(a_index-1,3) != 0)
            continue
        if (LoginList[a_index] != Player1)
            continue
        playername := LoginList[a_index]
        nickname := LoginList[a_index+1]
        password := LoginList[a_index+2]
    }
    if (ULogin1 = 1){
        if (extern){
            Sleep, 2000
            send, %nickname%{Tab}%password%
            return
        }
        if(StartClient = 1){
            Run, %myWorkDir%\elementclient.exe startbypatcher, , min
            sleep, 3000
            if (MoveWindow = 1)
                WinMove, %PWIstartTitle%, , LeftWindowEdge, 0

                ;get the processID for memread
                WinGet, processID, pid, %PWIstartTitle%
                global processID := processID

                ; wait till serverping is not 0 or a very high number
            loop,
            {
                ServerPing := readOffsetChain("0x1C|0x10|0x8|0xC4|0xDC|0x24C|0x168|0xB0")
                if ((ServerPing > 50) AND (ServerPing < 3000))
                    break
                if (A_index > 20)
                    return
                sleep, 1000
            }
           
           ;~ close server list
           ControlSend,, {ESC}, %PWIstartTitle%
           sleep, 1000
        }else if(Relog = 1){
            WinActivate, %playername%|
        }
        
        ControlSend,, %nickname%, %PWIstartTitle%
        ControlSend,, {Tab}, %PWIstartTitle%
        ControlSend,, %password%, %PWIstartTitle%
        sleep, 3000

        ;~ choose force log
                if (Forcelog = 1)
                writeOffsetChain(1,"0x1C|0x10|0x8|0xC4|0x14|0xE8|0x121")

        ControlSend,, {ENTER}, %PWIstartTitle%
        ; wait till value of current char is lower 8 (without being loged in its a very high number)
        Loop
        {
            ChoosenCharacter := readOffsetChain("0x1C|0x10|0x8|0xC4|0x8|0x34|0xA44")
            if (ChoosenCharacter < 8)
                break
            if (A_index > 15)
                return
            sleep, 1000
        }
        
        ;~ select char to use
        thisCharNum := 0
        thisCharNum := getcharnumber(playername)
        writeOffsetChain(thisCharNum,"0x1C|0x10|0x8|0xC4|0x8|0x34|0xA44")

        ControlSend,, {ENTER}, %PWIstartTitle%
        Sleep, 2000
        ControlSend,, {ENTER}, %PWIstartTitle%
        Sleep, 500
        ControlSend,, {ENTER}, %PWIstartTitle%
        
        if (Rename = 1)
        {
            WinSetTitle, Perfect World International, ,%Player1%|
            ;~ WinActivate, %Player1%|
        }
    }
}
return 


guess important for u is:

> ControlSend,, %password%, %PWIstartTitle%

> ServerPing := readOffsetChain("0x1C|0x10|0x8|0xC4|0xDC|0x24C|0x168|0xB0")

> ChoosenCharacter := readOffsetChain("0x1C|0x10|0x8|0xC4|0x8|0x34|0xA44")

> if (Forcelog = 1)
       writeOffsetChain(1,"0x1C|0x10|0x8|0xC4|0x14|0xE8|0x121")

Only problem so far: if the account infos contain something like @ the controlsend isnt working this way. i solved this now with increasing the holding time of keys abit:
> SetKeyDelay, 10, 5

[sasukezero]

These are some **** good informations. I gotta dig into this whenever I'm done with my finals. Thank you guys very much i always get to learn new things here which are quite awesome. Always gets me a step further and lets my knowledge grow bigger.

Automation is wonderful

[Kruger2001]

thanks Stark

the address where you can enter and change his username and pw is easy to find with CE, but the address will change every time I am searching for the offsets. in this way maybe you could get around it.

[DurianMontong]

Originally Posted by jasty

Doesn't that require the game window to have focus? I'm using it to control a lot of alts in background windows that go through an instance I'm farming but they get caught up on some annoying lips.

I solved it in a messy way by modifying the location information in memory vertically but not enough to trigger a rubberband.

Interestingly the standard location offsets didn't work. I think those are only used visually but not for the physics calculations. I know there are some skills like leap that move your character visually but as far as the physics are concerned you are already at the destination spot.

The offsets that I found in the character struct are:
$Player + 0x704 = x
$Player + 0x70C = y
$Player + 0x708 = z

So I just add like 2 meters to the Z coordinate and move forward. It's a really ugly jump though and would love to make it a real one. You can also modify these values if your character becomes stuck in geometry.

jasty maybe you can make tiny program for this new wallhack

[Smurfin]

Originally Posted by jasty

Here's how I would find the follow function offset. The current ACTION3 offset is 0x4a28e0 which seems to be called after most game actions.

I use Cheat Engine -> Browse memory region -> right click in the instruction list on top -> go to address -> 0x4a28e0.

This puts me at the beginning of the function and I toggle a breakpoint there.
Then back in game I follow on someone to trip the breakpoint.

In the bottom window I right click and choose "Show full stack trace"
The address at the top of the list is the return address from ACTION3.

Double click that and you jump to the code that called Action3.
Scroll up a little bit from that call you see a call to 0x4A5B50

That is probably the follow command.

To save you the trouble from doing this again you can build a regex to find this automatically. Go to 0x4A5B50 and make a regex to auto find it by copying the first 40 or so bytes but inserting wild cards in any of the bytes that look like offsets.

You can also build a regex from the bytes around the call to the function by capturing the offset and adding 0x400000.

After I toggled a breakpoint at the beginning of action3 address, my game freezed right after I clicked follow or do anything in the client. Did I do anything wrong ?

This is what I got, the Action3 Address for my version (PWI 843 or 841) is 0x004A2090 , I've scrolled it up a bit, which one do you think might be the follow address ? is it 4926E4 ? or 4287BC0 ? (4A1AA0 is Action1).

I've tried both 4926E4 and 4287BC0, but they all crashed the client.

Denzjh's follow address is a bit different, it starts with 6 not 4.
$ADDRESS_ACTION1 = 0x49FF80
$ADDRESS_FOLLOW = 0x6820C0
$ADDRESS_ACTION3 = 0x4A0590

[jasty]

Well the one right above A2090 is that +287BC0
You have to add 0x400000 to that to get the absolute memory address so it's
0x687BC0.

0x400000 is the windows default base address for loading a 32bit executable into memory, below that address lives things like DLLs and bios and whatnot.

[Smurfin]

Wow thanks a ton , it's working now !