PWI Eclipse changes

[Stark77]

@bestvlad: cant remember any issues with those coordinates sry

@jasty: i only start a client and let AHK type in the account info after a fix delay that works quite good for me. but dont know any other way.

Run, %A_WorkingDir%\elementclient.exe startbypatcher
sleep, %LoadingTime%
WinActivate, Perfect World International
WinMove, Perfect World International, , 0, 0
WinSetTitle, Perfect World International, ,%PlayerName%
send, %nickname%{Tab}%password%
send, {Enter}

[bestvlad]

Stark77, I've just rewritten AutoPath function code to C# and it works fine.

AutoPath function:

 Spoiler

public void AutoPath(float x, float y, int alt = 0, int dismount = 0)
        {
            if (x < 1000)
            {
                x = x * 10 - 4000;
                y = y * 10 - 5500;
            }
            asm.Pushad();
            asm.Mov_EAX(x);
            asm.Mov_ECX(y);
            asm.Mov_EDX(alt);
            asm.Push6A(0);
            asm.Push_ECX();
            asm.Push_EDX();
            asm.Push_EAX();
            asm.Push6A(3);
            asm.Push6A(0);
            asm.Push6A(0);
            asm.Push68(0x14A);
            asm.Mov_ECX((Int32)AddressesAndOffsets.base_address);
            asm.Mov_ECX_DWORD_Ptr_ECX();
            asm.Add_ECX(0x1c);
            asm.Mov_ECX_DWORD_Ptr_ECX();
            asm.Mov_EBX((Int32)AddressesAndOffsets.autopath_address);
            asm.Call_EBX();
            asm.Mov_ECX(alt);
            asm.Push6A(0);
            asm.Push6A(0);
            asm.Push6A(dismount);
            asm.Push_ECX();
            asm.Push6A(1);
            asm.Push6A(0);
            asm.Push6A(0);
            asm.Push68(0x14A);
            asm.Mov_ECX((Int32)AddressesAndOffsets.base_address);
            asm.Mov_ECX_DWORD_Ptr_ECX();
            asm.Add_ECX(0x1c);
            asm.Mov_ECX_DWORD_Ptr_ECX();
            asm.Mov_EBX((Int32)AddressesAndOffsets.autopath_address);
            asm.Call_EBX();
            asm.Popad();
            asm.Ret();

            asm.Run();
        }

MoveTo function:

 Spoiler

public void MoveTo(float x, float y, float z, int fly = 0)
        {
            if (x < 1000)
            {
                x = x * 10 - 4000;
                y = y * 10 - 5500;
                z *= 10;
            }
            asm.Pushad();
            asm.Mov_EAX((Int32)AddressesAndOffsets.base_address);
            asm.Mov_EAX_DWORD_Ptr_EAX();
            asm.Mov_EAX_DWORD_Ptr_EAX_Add((Int32)AddressesAndOffsets.base_offset);
            asm.Mov_ESI_DWORD_Ptr_EAX_Add((Int32)AddressesAndOffsets.player_offset);
            asm.Mov_ECX_DWORD_Ptr_ESI_Add((Int32)AddressesAndOffsets.player_action_struct_offset);
            asm.Push6A(1);
            asm.Mov_EDX((Int32)AddressesAndOffsets.action1_address);
            asm.Call_EDX();
            asm.Mov_EDI_EAX();
            asm.Lea_EAX_DWORD_Ptr_ESP_Add(0x18);
            asm.Push_EAX();
            asm.Mov_EDX(fly);
            asm.Push_EDX();
            asm.Mov_ECX_EDI();
            asm.Mov_EDX((Int32)AddressesAndOffsets.action2_address);
            asm.Call_EDX();
            asm.Mov_ECX_DWORD_Ptr_ESI_Add((Int32)AddressesAndOffsets.player_action_struct_offset);
            asm.Mov_EAX(x);
            asm.Mov_EDX_EDI();
            asm.Add_EDX(0x20);
            asm.Mov_DWORD_Ptr_EDX_EAX();
            asm.Mov_EAX(z);
            asm.Mov_EDX_EDI();
            asm.Add_EDX(0x24);
            asm.Mov_DWORD_Ptr_EDX_EAX();
            asm.Mov_EAX(y);
            asm.Mov_EDX_EDI();
            asm.Add_EDX(0x28);
            asm.Mov_DWORD_Ptr_EDX_EAX();
            asm.Push6A(0);
            asm.Push6A(1);
            asm.Push_EDI();
            asm.Push6A(1);
            asm.Mov_EDX((Int32)AddressesAndOffsets.action3_address);
            asm.Call_EDX();
            asm.Popad();
            asm.Ret();

            asm.Run();
        }

[Stark77]

prety sure u still need to use the reversed hexa form of the coordinates like i posted in my example. maybe move to (500,500,0) and print your x value that u inject and compare it.

[sasukezero]

@jasty
I am using image search for logging in chars with autoit. but there i don't have a character switcher build in cause i don't need it. I guess its easily possible by changing some vars.

For relogging/switching between chars, i am using package send to log out to the character selection -> wait for image(like the start button) and then send "ESC" to get to the login window(also here a wait for image), through which i can login another character.

This way i don't have set sleeps, which can fail in case of lag or whatever.

I hope that helps ^^

[bestvlad]

Originally Posted by Stark77

prety sure u still need to use the reversed hexa form of the coordinates like i posted in my example. maybe move to (500,500,0) and print your x value that u inject and compare it.

Iteger and floating values are converted to HEX correctly by function similar to yours:

 Spoiler

public string IntToHexString(int value, int size)
        {
            string temp = null;
            string hexString = "";
            temp = "0000000" + this.Hex(value);
            temp = temp.Substring(temp.Length - size, size);
            for (int i = 0; i <= temp.Length / 2 - 1; i++)
            {
                hexString += temp.Substring(temp.Length - 2 - 2 * i, 2);
            }
            return hexString;
        }

[jasty]

Originally Posted by sasukezero

@jasty
I am using image search for logging in chars with autoit. but there i don't have a character switcher build in cause i don't need it. I guess its easily possible by changing some vars.

For relogging/switching between chars, i am using package send to log out to the character selection -> wait for image(like the start button) and then send "ESC" to get to the login window(also here a wait for image), through which i can login another character.

This way i don't have set sleeps, which can fail in case of lag or whatever.

I hope that helps ^^

I didn't know autoit had imagesearch. Last I looked I only saw pixelsearch and I couldn't find pixels that worked. Python has an imagesearch but the tolerance value didn't work and all the buttons had a little transparency that was ******** it up.

Actually I still don't see imagesearch in the are you using a custom library? Can it read pixels from minimized windows?

[bestvlad]

Fixed my MoveTo function. Coords should be passed in that oreder: X, Z, Y.

Is there any way to change Z while flying like drag the spinner in game?

[sasukezero]

Idk if i could make it work with minimized windows. i didn't try it cause i don't need it in my case.
I guess i got the image search from here:
But im not sure anymore. Else i can upload it here.

About the Transparency, just use things that don't have it, like the start button and so.
What i did at the character selection was, make a pic of the start button eventho its transparent. It shows always the same. Only thing that can kick in is a mouse, that hovers over. I move the mouse in the middle for that via Mousemove().

In case of doing minimized image search would also a print Window work, i guess.
Maybe ill look into it.
I might check for flags that are there when you're in different modes, but it works just awesome with image search in my case.

[bestvlad]

Stark77, do you have an injectable code for attack?

[Stark77]

Hmm for normalattack i still use packets:

 Spoiler

Func regularAttack($afterSkill, $pid)
;//Start with regular attacks. $afterskill is 1 if you
;//start attacking after using a skill.
local $packet, $packetSize

$packet = '0300'
$packet &= _hex($afterSkill, 2)
$packetSize = 3

sendPacket($packet, $packetSize, $pid)
EndFunc

For other skills the injection denzjh postet here:

 Spoiler

UseSkill(skillId)
{
	i := 0
	loop %nActiveSkills%
	{
		skillPointer := ReadMemoryUint(skillListPointer+i, processID)
		thisSkillId := ReadMemoryUint(skillPointer + 0x8, processID)
		if(skillId = thisSkillId)
			break
		i := i + 0x4
	}
	revhex(revBaseAddress,realBaseAddress)
	revhex(revskillPointer,skillPointer)
	revhex(revSkillID,SkillID)
	revhex(revCastAddress,CastAddress)
	
	func = 60
	func = %func%B8%revBaseAddress%
	func = %func%8B00
	func = %func%8B401C
	func = %func%8B7028
	func = %func%B8%revskillPointer%
	func = %func%6AFF
	func = %func%6A00
	func = %func%6A00
	func = %func%B9%revSkillID%
	func = %func%51
	func = %func%8BCE
	func = %func%BA%revCastAddress%
	func = %func%FFD2
	func = %func%61
	func = %func%C3


	injectCode(func)
	while ((GetSkillCooldown(skillId) = 0) AND (gettargethp() > 0))
	{
		sleep, 500
		if A_index > 10
			break
	}
}

[bestvlad]

Does anyone know SendChatMessage function address?

[louco89]

Unfortunately AddressRetriever does not work with executable of PWBR
Perhaps because we not had the Eclipse update here yet.

[Craz1nf]

I have not been able to get autopath to change its altitude, just stays at current Z position. At the moment my character will get on its flyer & just start flying to the X,Y location without flying up/down to Z.

not sure if i have to do something more after calling AutoPath() ?

any help would be appreciated

 Spoiler

; # example location
AutoPath(1525.06, 1258.52, 452.60)


; # the current AutoPath function i'm using
Func AutoPath($DEST_X, $DEST_Y, $ALT=0, $DISMOUNT=0)
   Local $ADDRESS_BASE = $vBaseAddress
   Local $ADDRESS_AUTOPATH = $vAutoPathAddress

    ;Construct the OpCode for calling the 'AutoPath' function
    $OPcode = '60'								;60					PUSHAD
    $OPcode &= 'B9' & _Hex($DEST_Y, 8, 'float') ;B9 00000000		MOV ECX, Y-FLOAT
    $OPcode &= 'BA' & _Hex($ALT)				;BA 00000000		MOV EDX, Z-INT
    $OPcode &= 'B8' & _Hex($DEST_X, 8, 'float') ;B8 00000000		MOV EAX, X-FLOAT
    $OPcode &= '6A00'							;6A 00				PUSH 0
    $OPcode &= '51'								;51					PUSH ECX
    $OPcode &= '52'								;52					PUSH EDX
    $OPcode &= '50'								;50					PUSH EAX
    $OPcode &= '6A03'							;6A 03				PUSH 3
    $OPcode &= '6A00'							;6A 00				PUSH 0
    $OPcode &= '6A00'							;6A 00				PUSH 0
    $OPcode &= '684A010000'						;68 14A0			PUSH 0X14A
    $OPcode &= 'B9'&_Hex($ADDRESS_BASE)			;B9 00000000		MOV ECX, BASE_ADDRESS
    $OPcode &= '8B09'							;8B09				MOV ECX, DWORD PTR DS:[ECX]
    $OPcode &= '83C11C'							;83C1 1C			ADD ECX, 1C
    $OPcode &= '8B09'							;8B09				MOV ECX, DWORD PTR DS:[ECX]
    $OPcode &= 'BB'&_Hex($ADDRESS_AUTOPATH)		;BB 00000000		MOV EBX, AUTOPATH_ADDRESS
    $OPcode &= 'FFD3'							;FFD3				CALL EBX
    $OPcode &= 'B9' & _Hex($ALT)				;B9 00000000		MOV ECX, Z-INT
    $OPcode &= '6A00'							;6A 00				PUSH 0
    $OPcode &= '6A00'							;6A 00				PUSH 0
    $OPcode &= '6A' & _Hex($DISMOUNT, 2)		;6A 00				PUSH FLAG-DISMOUNT AT DESTINATION
    $OPcode &= '51'								;51					PUSH ECX
    $OPcode &= '6A01'							;6A 00				PUSH 1
    $OPcode &= '6A00'							;6A 00				PUSH 0
    $OPcode &= '6A00'							;6A 00				PUSH 0
    $OPcode &= '684A010000'						;68 14A0			PUSH 0X14A
    $OPcode &= 'B9'&_Hex($ADDRESS_BASE)			;B9 00000000		MOV ECX, BASE_ADDRESS
    $OPcode &= '8B09'							;8B09				MOV ECX, DWORD PTR DS:[ECX]
    $OPcode &= '83C11C'							;83C1 1C			ADD ECX, 1C
    $OPcode &= '8B09'							;8B09				MOV ECX, DWORD PTR DS:[ECX]
    $OPcode &= 'BB'&_Hex($ADDRESS_AUTOPATH)		;BB 00000000		MOV EBX, AUTOPATH_ADDRESS
    $OPcode &= 'FFD3'							;FFD3				CALL EBX
    $OPcode &= '61'								;61					POPAD
    $OPcode &= 'C3'								;C3					RET

	InjectCode($OPcode)
 EndFunc

[Stark77]

hmm i cannot see the misstake atm. i use normal move to fly or swim. maybe take a look at it (set the flyflag=1 to fly):

 Spoiler

normalMoveTo(X,Y,Z=0,flyflag=0)
{
	if (X < 1000)
	{
		X := floattohex((X*10)-4000) 
		Y := floattohex((Y*10)-5500) 
		Z := floattohex(Z*10)
	}
		
	revHex(revX, X)
	revHex(revY, Y)
	revHex(revZ, Z)
	revHex(revBaseAddress, 0xD2E444)
	revHex(revADDRESS_ACTION1, 0x4A1AA0)
	revHex(revADDRESS_ACTION2, 0x4A7DE0)
	revHex(revADDRESS_ACTION3, 0x4A2090)
	revHex(OFFSET_ACTIONBASE, 0x13F0)
	revHex(FLYMODE, flyflag)

	func =					
	func = %func%60
	func = %func%B8%revBaseAddress%
	func = %func%8B00
	func = %func%8B401C
	func = %func%8B7028
	func = %func%8B8E%OFFSET_ACTIONBASE%
	func = %func%6A01
	func = %func%BA%revADDRESS_ACTION1%
	func = %func%FFD2
	func = %func%8BF8
	func = %func%8D442418
	func = %func%50
	func = %func%BA%FLYMODE%
	func = %func%52
	func = %func%8BCF
	func = %func%BA%revADDRESS_ACTION2%
	func = %func%FFD2
	func = %func%8B8E%OFFSET_ACTIONBASE%
	func = %func%B8%revX%
	func = %func%8BD7
	func = %func%83C220
	func = %func%8902
	func = %func%B8%revZ%
	func = %func%8BD7
	func = %func%83C224
	func = %func%8902
	func = %func%B8%revY%
	func = %func%8BD7
	func = %func%83C228
	func = %func%8902
	func = %func%6A00
	func = %func%6A01
	func = %func%57
	func = %func%6A01
	func = %func%BA%revADDRESS_ACTION3%
	func = %func%FFD2
	func = %func%61
	func = %func%C3

	injectCode(func)
}

[Craz1nf]

thanks, tried with the normal MoveTo function posted on page 4 of this thread

 Spoiler

Const $vBaseAddress = 0x00D2E444
Const $vAutoPathAddress = 0x00456F20
Const $OFFSET_ACTIONBASE = 0x000013F0
Const $ADDRESS_GATHER = 0x4975A0
Const $ADDRESS_ACTION1 = 0x4A1AA0
Const $ADDRESS_ACTION2 = 0x4A7DE0
Const $ADDRESS_ACTION3 = 0x4A2090


MoveTo(1525.06, 1258.52, 452.60, 1)  ; ## does not move/runs on spot
MoveTo(1525.06, 1258.52, 452.60, 0)  ; ## autopath/walks fine


Func MoveTo($DEST_X, $DEST_Y, $DEST_Z, $VERTICAL=0)
   Local $ADDRESS_BASE = $vBaseAddress
   Local $ADDRESS_AUTOPATH = $vAutoPathAddress

	;Construct the OpCode for calling the 'MoveTo' function
	$OPcode =  "60"                   			;60             PUSHAD
	$OPcode &= "B8" & _Hex($ADDRESS_BASE)     	;B8 00000000    MOV EAX,#Baseadr
	$OPcode &= "8B00"            				;8B00           MOV EAX,DWORD PTR DS:[EAX]
	$OPcode &= "8B401C"          				;8B40 1C        MOV EAX,DWORD PTR DS:[EAX+1C]
	$OPcode &= "8B7028"          				;8B70 28        MOV ESI,DWORD PTR DS:[EAX+28]
	$OPcode &= "8B8E" & _Hex($OFFSET_ACTIONBASE);8B8E 11111111  MOV ECX,DWORD PTR DS:[ESI+ActArr]
	$OPcode &= "6A01"            				;6A 01          PUSH 1
	$OPcode &= "BA" & _Hex($ADDRESS_ACTION1)    ;BA 00000000    MOV EDX,Walk1
	$OPcode &= "FFD2"            				;FFD2           CALL EDX
	$OPcode &= "8BF8"            				;8BF8           MOV EDI,EAX
	$OPcode &= "8D442418"        				;8D4424 18      LEA EAX,DWORD PTR SS:[ESP+18]
	$OPcode &= "50"              				;50             PUSH EAX
	$OPcode &= "BA" & _Hex($VERTICAL)      		;BA 00000000    MOV EDX, fly mode
	$OPcode &= "52"              				;52             PUSH EDX
	$OPcode &= "8BCF"            				;8BCF           MOV ECX,EDI
	$OPcode &= "BA" & _Hex($ADDRESS_ACTION2)    ;BA 00000000    MOV EDX,Walk2
	$OPcode &= "FFD2"            				;FFD2           CALL EDX
	$OPcode &= "8B8E" & _Hex($OFFSET_ACTIONBASE);8B8E 22222222  MOV ECX,DWORD PTR DS:[ESI+ActArr]
	$OPcode &= "B8" & _Hex($DEST_X, 8, 'float') ;B8 00000000    MOV EAX,x
	$OPcode &= "8BD7"            				;8BD7           MOV EDX,EDI
	$OPcode &= "83C220"          				;83C2 20        ADD EDX,20
	$OPcode &= "8902"            				;8902           MOV DWORD PTR DS:[EDX],EAX
	$OPcode &= "B8" & _Hex($DEST_Z, 8, 'float') ;B8 00000000    MOV EAX,z
	$OPcode &= "8BD7"            				;8BD7           MOV EDX,EDI
	$OPcode &= "83C224"          				;83C2 24        ADD EDX,24
	$OPcode &= "8902"            				;8902           MOV DWORD PTR DS:[EDX],EAX
	$OPcode &= "B8" & _Hex($DEST_Y, 8, 'float') ;B8 00000000    MOV EAX,y
	$OPcode &= "8BD7"            				;8BD7           MOV EDX,EDI
	$OPcode &= "83C228"          				;83C2 28        ADD EDX,28
	$OPcode &= "8902"            				;8902           MOV DWORD PTR DS:[EDX],EAX
	$OPcode &= "6A00"            				;6A 00          PUSH 0
	$OPcode &= "6A01"            				;6A 01          PUSH 1
	$OPcode &= "57"              				;57             PUSH EDI
	$OPcode &= "6A01"            				;6A 01          PUSH 1
	$OPcode &= "BA" & _Hex($ADDRESS_ACTION3)    ;BA 00000000    MOV EDX,Walk3
	$OPcode &= "FFD2"            				;FFD2           CALL EDX
	$OPcode &= "61"              				;61             POPAD
	$OPcode &= "C3"              				;C3             RETN

	InjectCode($OPcode)
 EndFunc


Func InjectCode($OPcode)
	;Declare local variables

	;Open process for given processId
	$processHandle = memopen($PID)

	;Allocate memory for the OpCode and retrieve address for this
	$functionAddress = DllCall('kernel32.dll', 'int', 'VirtualAllocEx', 'int', $processHandle, 'ptr', 0, 'int', 100, 'int', 0x1000, 'int', 0x40)

	;Construct the OpCode for calling the function

	;Put the OpCode into a struct for later memory writing
	$vBuffer = DllStructCreate('byte[' & StringLen($OPcode) / 2 & ']')
	For $loop = 1 To DllStructGetSize($vBuffer)
		DllStructSetData($vBuffer, 1, Dec(StringMid($OPcode, ($loop - 1) * 2 + 1, 2)), $loop)
	Next

	;Write the OpCode to previously allocated memory
	DllCall('kernel32.dll', 'int', 'WriteProcessMemory', 'int', $processHandle, 'int', $functionAddress[0], 'int', DllStructGetPtr($vBuffer), 'int', DllStructGetSize($vBuffer), 'int', 0)


	;Create a remote thread in order to run the OpCode
	$hRemoteThread = DllCall('kernel32.dll', 'int', 'CreateRemoteThread', 'int', $processHandle, 'int', 0, 'int', 0, 'int', $functionAddress[0], 'ptr', 0, 'int', 0, 'int', 0)

	;Wait for the remote thread to finish
	Do
		$result = DllCall('kernel32.dll', 'int', 'WaitForSingleObject', 'int', $hRemoteThread[0], 'int', 50)
	Until $result[0] <> 258

	;Close the handle to the previously created remote thread
	DllCall('kernel32.dll', 'int', 'CloseHandle', 'int', $hRemoteThread[0])

	;Free the previously allocated memory
	DllCall('kernel32.dll', 'ptr', 'VirtualFreeEx', 'hwnd', $processHandle, 'int', $functionAddress[0], 'int', 0, 'int', 0x8000)

	Return True
EndFunc

If i leave flymode flag set to 0, it walks to the coordinates, but if i set it to 1, my character will just standstill/start running on the spot (on screen) and does not move to the destination, from another client the char appears to be standing still.

Another thing i noticed is that MoveTo walks a straight line, it does not use in-game autopath type paths (walking around objects to destination), i assume this is normal?

EDIT:
tried passing 1.0 instead of 1: MoveTo(X, Y, Z, 1.0), it does not standstill this way, but works the same as if i used MoveTo(x, y, z, 0) and walks to destination instead of flying.