PWI Eclipse changes

jasty · 11/12/2015, 03:00

My list of poorly named offsets...

Remmm · 11/29/2015, 22:41

$ADDRESS_QUESTAVAILABLE = 0x89E040
This is the address verification functions availability quest?
As a result of its use, and search for it?

jasty · 11/30/2015, 21:35

Quote:

Originally Posted by Remmm

$ADDRESS_QUESTAVAILABLE = 0x89E040
This is the address verification functions availability quest?
As a result of its use, and search for it?

Ohh that's commented out. I wanted to find a function that said if you have done a daily today but failed. My stuff is cobbled together from many sources and unorganized.

Smurfin · 12/17/2015, 06:29

Quote:
Originally Posted by jasty
Here's all of the addresses and offsets I use... its not super well organized and most of the names don't match other stuff though.

Spoiler

#include-once

Global $ADDRESS_BASE = 0xd56b8c
Global $ADDRESS_SENDPACKET = 0x79d330
Global $ADDRESS_AUTOPATH = 0x457030
Global $ADDRESS_ACTION1 = 0x4a25b0
Global $ADDRESS_ACTION2 = 0x4a8970
Global $ADDRESS_ACTION3 = 0x4a2bc0
Global $ADDRESS_GATHER = 0x497d30
Global $ADDRESS_CASTSKILL = 0x490120
Global $ADDRESS_REGATTACK = 0x497bf0
Global $PARTYINV_ADDRESS = 0xd616c8
Global $ADDRESS_INSTANCE_BASE = 0xd5732c
Global $MACRO_ADDRESS_BASE = 0xd57c4e
Global $OFFSET_ACTIONBASE = 0x1400

global $Player_Offset = 0x28
global $playerIDOffset = 0x4B8
global $PlayerClass_Offset = 0x6EC ;+10
global $PlayerName_Offset = 0x6E8 ;+10
global $PlayerParty_Offset = 0x7B8
global $PlayerCurrentSkill_Offset = 0x7D4
global $playerEquipOffset = 0x5b0 ;+8
global $PlayerAvatarBag_Offset = 0xfec ;+10
global $InventoryListOffset = 0xFA0 ;+20
global $EquippedListOffset = 0xFA4 ;+20
global $QuestInvListOffset = 0xFA8
global $PlayerNpcWindow = 0xDB2 ;+10
global $PhysPosOffset = 0x718-0x40

Global $QuestList_Offset = 0x1408 ;+10
global $PlayerEarningTime_Offset = 0x161C ;+18

global $PlayerMoveCounter_Offset = 0xac8
global $PlayerTransportMode_Offset = 0x6F4
global $PlayerSwimSpeed_Offset = 0x530
global $PlayerWalkSpeed_Offset = 0x530+0x4
global $PlayerFlySpeed_Offset = 0x530+0xC

global $PlayerCamX_Offset = 0x974
global $PlayerCharmActive_Offset = 0x1624
global $PlayerCharmActive_MagBit = 0x10000
global $PlayerCharmActive_PhysBit = 0x100
global $PlayerCharmCooldown_Offset = 0xC04 ;+10

global $PartyCount_Offset = 0x18

;~ #-------- NPC ----------------#
global $NpcListOffset = 0x20
global $sortedNpcListOffset = 0x5c
global $NpcCounterOffset = 0x18
global $NpcUIDOffset = 0x114
global $NpcIDOffset = 0x118
global $NpcNameOffset = 0x25C
global $NpcLVLOffset = 0x120
global $NpcHPOffset = 0x128
global $NpcHPmaxOffset = 0x17C
global $NpcStatusOffset = 0x210
global $NpcSpecialOffset = 0x24C
global $NpcX = 0x3C
global $NpcY = 0x44
global $NpcZ = 0x40

;global $NpcBuffCountOffset = 0x32C

global $NpcStatusBitDead = 0x80
global $NpcStatusBitIncSpeed = 0x100
global $NpcStatusBitIncDef = 0x300
global $NpcStatusBitIncAtt = 0x500
global $NpcStatusBitSacAss = 0x700
global $NpcStatusBitIncLife = 0x800
global $NpcStatusBitWeak = 0x900
global $NpcStatusBitIsPet = 0x1000

global $NpcStatusBitIsNpc = 0x4000
global $NpcStatusBitIsFly = 0x10000
global $NpcStatusBitIsWater = 0x20000

global $bufflist = 0x390
global $buffcount = 0x398 ;check

global $PlayerTarget_Offset = 0x5A4
global $PlayerFactionId_Offset = 0x694 ;+10
global $PlayerChiOffset = 0x4E0

global $sortedInventoryListOffset = 0xC
global $InventorySizeOffset = 0x14
global $InvName_Offset = 0x4C
global $InvID_Offset = 0xC
global $InvDurability_Offset = 0x74
global $InvStackAmount_Offset = 0x14
global $gearAddonList_Offset = 0xb0

global $itemTypeX = 0x8
global $itemIDX = 0xC
global $itemCountX = 0x14

global $HP_OffSet = 0x4cc
global $MaxHP_OffSet = 0x520
global $MP_OffSet = 0x4d0
global $MaxMP_OffSet = 0x524
global $HPCooldown_Offset = 0xBA4
global $MPCooldown_Offset = 0xBAC

global $PlayerSkill_Offset = 0x142c
global $PlayerPassiveSkill_Offset = 0x1444
global $GenieSkill_Offset = 0x145c ;from player, skill count is this +0x4

global $SkillID_Offset=8
global $SkillLVL_Offset=12
global $SkillCurCD_Offset=16
global $SkillCD_Offset=20

global $PlayerGenie_Offset = 0x408
global $GenieEnergy_Offset = 0xAC

;Global $ADDRESS_QUESTAVAILABLE = 0x89E040
;Global $QUEST_LIST_POINTER = 0xD23624

Here is my python script for finding all the function addresses at the top. I havent tried making one for doing all the offsets I use.
Spoiler
Code:
import re
import binascii
addresses = [
		("ADDRESS_BASE", 'A1(.{8})5332DB8B48.{2}'),
		("ADDRESS_SENDPACKET", '6AFF68.{8}64A100000000506489250000000083EC185356578BF96A07'),
		("ADDRESS_AUTOPATH", '6AFF68.{8}64A100000000506489250000000083EC2053568BF18D4C2408E8.{8}8B4C243C8B542440'),
		("ADDRESS_ACTION1", '64A1.{8}6AFF68.{8}508B442410648925.{8}5683F8138BF1'),
		("ADDRESS_ACTION2", '83EC2453558B6C243056578B7C243C8BF133DB896E2C8B07894620'),
		("ADDRESS_ACTION3", '5355568B74241485F6578BD975095F5E5D32C05BC20C00'),
		("ADDRESS_GATHER", '5355578BF98B87.{8}C1E807A8010F85.{8}E8.{8}84C00F85.{8}8B6C2410'),
		("ADDRESS_CASTSKILL", '535556578BF16A04E8.{8}8B8E.{8}83C40485C974076A02'),
		("ADDRESS_REGATTACK", '53558B6C240C56578BF985ED0F84.{8}3BAF.{8}0F84.{8}A1.{8}'),
		("PARTYINV_ADDRESS", '9068.{8}68.{8}6A066A1068(.{8})E8.{8}C390', 0x20),
		("ADDRESS_INSTANCE_BASE", '5F5E5B8BE55DC21000E8....FFFF8B0D(.{8})898D....FFFFE8....FFFF84C07525'),
		("MACRO_ADDRESS_BASE ", '81C4.{8}C21000A0(.{8})8BB424.{8}8B3D.{8}84C074056A0656FFD76A0056FFD781C5', 0x1E),
		("OFFSET_ACTIONBASE ", '8B40..8B0D.{8}3BC1740B837E..027C05C64424..018B8F(.{8})6A006A016A02C64424..00E8.{8}85C0'),
		("GameRun", "5f5e5b8be55dc21000e8....ffff8b0d(.{8})898d....ffffe8....ffff84c075")
		]
		
		
		
def retrieveAddresses(file, addresses):
	for address in addresses:
		pattern = address[1]
		match = re.search(pattern.lower(), ascii)
		if match:
			value = hex(match.start()/2 + 0x400000)
			if len(match.groups()) > 0:
				#print match.groups(0)[0]
				value = revHex(match.groups(0)[0])
				offset = address[2] if len(address) > 2 else 0
				value = hex(int(value, 16)+offset)
			
			print "Global $"+address[0],"=", value
		else:
			print "; Not found: $"+address[0] 



def revHex(string):
	return ''.join([str(string[x:x+2]) for x in range(len(string)-2, -2, -2)])

f = open("C:\Games\PWI_en\element\elementclient.exe", 'rb')
data = f.read()
ascii = binascii.hexlify(data)


retrieveAddresses(ascii, addresses)

PWID just got patched and this offset list fits perfectly, but what is the unfreeze address for this version if anyone still has it ?

Stark77 · 12/17/2015, 10:11

maybe try this:
UnfreezOffset = 0x4EC

but havent checked

Smurfin · 12/17/2015, 22:54

It's usually something like this Unfreeze=13824152 or 0xD2F098, but that also works.
global $osunfreeze[2]
$osunfreeze[1]=0x4ec
_MEMORYPOINTERwrite($APP_BASE_ADDRESS, $MID, $osunfreeze,1)

Thanks !

======

Anyone able to solo FSP Judgement mode after Riptide ?

Is there any method for jumping, using packet or memory-write ?

jasty · 12/18/2015, 18:08

Quote:

Originally Posted by Smurfin

Is there any method for jumping, using packet or memory-write ?

I use a ghetto jump that just moves the vertical position of the player up by a few meters in memory before walking forward. The data I manipulate is at Player + 0x724 as the one at 0x40 doesn't seem to be used for actual motion.

thegioitrucquan · 12/23/2015, 08:48

Quote:

Originally Posted by jasty

Here are the offsets I am using with this latest update. I doubt I'm using the same names as the bigger bots out there.

Spoiler

Does anyone know how to get a list of mail Ids from the mailbox? I'd like to make a bot that auto relists AH items. But the mailbox is being mean to me.

Also I'd be interested in how to find a list of currently available quests from an NPC if anyone knows how.

My PW version is there. Plz explain this struct :
Global $OFFSET_ACTIONBASE = 0x13F0
Seem, It mean:
($ADDRESS_BASE) 0xd2e444 + 0x28 + 0x13F0 + 0x18 + 0x8 + Offset...

jasty · 12/23/2015, 20:09

It's the offset from the player struct to the action struct.

I think it's mostly used for checking and setting the action flag (whether you are busy doing something). I also seem to use it in my move code though. I got the code from somewhere in this thread I think.

Spoiler

Code:

Func ActionFlag() ;return 1=Busy with doing something,  0=idle char
	$POINTER_BASE = _MemoryRead(_MemoryRead($ADDRESS_BASE, $GAME_PROCESS) + 0x1C, $GAME_PROCESS)
	$POINTER_CHAR = _MemoryRead($POINTER_BASE + $Player_Offset, $GAME_PROCESS)
	$POINTER_ACTION = _MemoryRead($POINTER_CHAR + $OFFSET_ACTIONBASE, $GAME_PROCESS)
	Return _MemoryRead($POINTER_ACTION + 0x24, $GAME_PROCESS)
EndFunc

Func MoveTo($DEST_X, $DEST_Y, $DEST_Z=-1, $VERTICAL=0) ;uses actual coords
	;Construct the OpCode for calling the 'MoveTo' function
	$OPcode =  "60"                   			;60             PUSHAD
	$OPcode &= "B8" & _Hex($ADDRESS_BASE)     	;B8 00000000    MOV EAX,#Baseadr
	$OPcode &= "8B00"            				;8B00           MOV EAX,DWORD PTR DS:[EAX]
	$OPcode &= "8B401C"          				;8B40 1C        MOV EAX,DWORD PTR DS:[EAX+1C]
	$OPcode &= "8B70" & _Hex($Player_Offset, 2) ;8B70 28        MOV ESI,DWORD PTR DS:[EAX+28]
	$OPcode &= "8B8E" & _Hex($OFFSET_ACTIONBASE);8B8E 11111111  MOV ECX,DWORD PTR DS:[ESI+ActArr]
	$OPcode &= "6A01"            				;6A 01          PUSH 1
	$OPcode &= "BA" & _Hex($ADDRESS_ACTION1)    ;BA 00000000    MOV EDX,Walk1
	$OPcode &= "FFD2"            				;FFD2           CALL EDX
	$OPcode &= "8BF8"            				;8BF8           MOV EDI,EAX
	$OPcode &= "8D442418"        				;8D4424 18      LEA EAX,DWORD PTR SS:[ESP+18]
	$OPcode &= "50"              				;50             PUSH EAX
	$OPcode &= "BA" & _Hex($VERTICAL)      		;BA 00000000    MOV EDX, fly mode
	$OPcode &= "52"              				;52             PUSH EDX
	$OPcode &= "8BCF"            				;8BCF           MOV ECX,EDI
	$OPcode &= "BA" & _Hex($ADDRESS_ACTION2)    ;BA 00000000    MOV EDX,Walk2
	$OPcode &= "FFD2"            				;FFD2           CALL EDX
	$OPcode &= "8B8E" & _Hex($OFFSET_ACTIONBASE);8B8E 22222222  MOV ECX,DWORD PTR DS:[ESI+ActArr]
	$OPcode &= "B8" & _Hex($DEST_X, 8, 'float') ;B8 00000000    MOV EAX,x
	$OPcode &= "8BD7"            				;8BD7           MOV EDX,EDI
	$OPcode &= "83C220"          				;83C2 20        ADD EDX,20
	$OPcode &= "8902"            				;8902           MOV DWORD PTR DS:[EDX],EAX
	$OPcode &= "B8" & _Hex($DEST_Z, 8, 'float') ;B8 00000000    MOV EAX,z
	$OPcode &= "8BD7"            				;8BD7           MOV EDX,EDI
	$OPcode &= "83C224"          				;83C2 24        ADD EDX,24
	$OPcode &= "8902"            				;8902           MOV DWORD PTR DS:[EDX],EAX
	$OPcode &= "B8" & _Hex($DEST_Y, 8, 'float') ;B8 00000000    MOV EAX,y
	$OPcode &= "8BD7"            				;8BD7           MOV EDX,EDI
	$OPcode &= "83C228"          				;83C2 28        ADD EDX,28
	$OPcode &= "8902"            				;8902           MOV DWORD PTR DS:[EDX],EAX
	$OPcode &= "6A00"            				;6A 00          PUSH 0
	$OPcode &= "6A01"            				;6A 01          PUSH 1
	$OPcode &= "57"              				;57             PUSH EDI
	$OPcode &= "6A01"            				;6A 01          PUSH 1
	$OPcode &= "BA" & _Hex($ADDRESS_ACTION3)    ;BA 00000000    MOV EDX,Walk3
	$OPcode &= "FFD2"            				;FFD2           CALL EDX
	$OPcode &= "61"              				;61             POPAD
	$OPcode &= "C3"              				;C3             RETN

	InjectCode($OPcode)
EndFunc

Smurfin · 01/03/2016, 01:47

Quote:

Originally Posted by jasty

I use a ghetto jump that just moves the vertical position of the player up by a few meters in memory before walking forward. The data I manipulate is at Player + 0x724 as the one at 0x40 doesn't seem to be used for actual motion.

Could you please give an example on how to utilize that ? and is that the offset for PWI today, PWID where I play still at the version with $ADDRESS_BASE = 0xd56b8c.

I'm trying to use it for soloing Judgement mode for auto get back to spot when my char dies because for some reason Barb and BM can't just walk past the bridge, they have to jump, and there is a small lava pit in front of the door at bat boss.

jasty · 01/03/2016, 03:01

Man I really don't feel like I should be setting the example because of how much of a hack this is...

Spoiler

Ohh looking at this something I should have mentioned is that the coordinate frame for the physics coordinates is vertically offset from normal coordinates. It's like 1.8 off or something weird, I have no idea why but I preserve the difference when setting the new coords.

You can actually do vertical translations pretty high without any rubberbanding. The tolerance is much higher vertically than horizontally (probably to allow for jumping and falling). That said, even though the horizontal translation tolerance is low it's enough to work your way through thin walls which is occasionally useful.

Smurfin · 01/03/2016, 06:18

Thanks, it'll be so useful !!

---

When I tried the jump script, my character's starchart glow moved up but when I moved my character, it didn't move from that height. Do I have to also move using script for the jump script to work ?

It's kinda like wallhack back in the day, but it was character nickname that went up iirc.

It also messed something up I guess, when I tried to fly then clicked somewhere without adjusting height , my character also went up and flying with WASD didn't work, it's like bumping to a wall.

jasty · 01/03/2016, 16:35

Hmm that looks like the right set of coordinates since mine also moves the flare. Maybe that's too high and youre getting rubberbanded? Walking forward your character should appear at that spot. I'd play with it some more with smaller jumps.

sasukezero · 01/26/2016, 23:51

just aside of this, whoever struggle to find their offsets after a update, get Reclass lol I finally understood how it works after a tutorial on youtube. Well i checked it out now, as i have time.
When the offset changed by idk a few bytes then its easy to find them with this. Jasty made a awesome work with his address retriever tho. But maybe this helps others too.
This was the Tutorial:

Through Doug Confere, i checked out IDA too. You can save the old elementclient.exe before the update and compare to after update to check both in IDA and find offsets via hex comparing like its done in the retriever

here is a tutorial:

Just yeah wouldn't use the links, idk if they are safe, but he shows how its done.
Hope this is helpful

Kruger2001 · 03/01/2016, 18:44

Autologin with Startcommands
(login.bat)
start elementclient.exe startbypatcher user:login pwd

assword role:charname

does anyone know how the server selection skip?

I have already tried:

server:Etherblade
server:[US WEST]Twilight Temple
server

wigc2.perfectworld.com
server:66.151.133.71
server

wigc2.perfectworld.com:29000
server:66.151.133.71:29000
server:0 - 4
server:04
server:2,1

without success...

elementclient.exe startcommands:
user
pwd
area
token2
token
role
agent
gt
coreclient
export
server
miniclient
luadebug
rtdebug
sepfile
rendernofocus
nocheck
facepill

Debug:
start elementclient.exe game:cpw console:1
open console ingame:
shift+~ or shift+ö

// ========== Debug commands ==========

"d_cameramode"
"d_boundbox"
"d_rtdebug"
"d_npcid"
"d_itemid"
"d_runspeed"
"d_goto"
"d_gotoline"
"d_fly"
"d_c2scmd"
"d_c2scmdp"
"d_viewradius"
"d_relogin"
"d_skill"
"d_render_water"
"d_render_grass"
"d_render_forest"
"d_render_shadow"
"d_render_outline"
"d_turnaround"
"d_testdist"
"d_gfx"
"d_showpos"
"d_trnlayer"
"d_a3dstat"
"d_gamestat"
"d_treelod"
"d_fps"
"d_playerradius"
"d_showid"
"d_skipframe"
"d_modelupdate"
"d_minidump"
"d_settimeofday"
"d_getservertime"
"d_task"
"d_mipmapbias"
"d_updatelua"
"d_trncull"
"d_gscmd"
"d_delcmd"
"d_fixedcamera"
"d_towerdefense"
"d_camturnspeed"
"d_cutscene"
"d_hdr"
"d_skillnotarget"
"d_buyrepuitem"
"d_anm"
"d_gamesnake"
"d_tinygame"

// ========== GM commands ==========

"gm_kickout_role"
"gm_kickout_user"
"gm_list_user"
"gm_online_num"
"gm_restart_sev"
"gm_shutup_role"
"gm_shutup_user"
"gm_moveto_player"
"gm_callin_player"
"gm_broadcast"
"gm_showid"
"gm_forbid_role"
"gm_trigger_chat"
"gm_generate"