Wonderland

[Stark77]

Great job CeifadorX. Would it be possible for you to post it without ASM (so in the form I posted the opcode)?

[CeifadorX]

of course, my friend

Follow function (arg is int playerid)

 Spoiler

0x60
0xB9 0x00 0x00 0x00 0x00 //Base Address
0x8B 0x09
0x8B 0x49 0x1C //Structure (0x1c)
0x8B 0x71 0x34 //Player structure (0x34)
0x8B 0x8E 0x00 0x00 0x00 0x00 //Action Base Address (0x1780)
0x57
0x6A 0x07
0xBA 0x00 0x00 0x00 0x00 //Walk1 address
0xFF 0xD2
0x8B 0xF8
0xBB 0x00 0x00 0x00 0x00 //Player ID
0x53
0x8B 0xCF

0xBA 0x00 0x00 0x00 0x00 //Follow Address
0xFF 0xD2

8B 8E 80 17 00 00
0x6A 0x00
0x57
0x6A 0x01
0xBA 0x00 0x00 0x00 0x00 //Walk3 Address
0xFF 0xD2
0x5F
0x61
0xC3

moveto function (args is float x,y,z and int flymode var)

 Spoiler

0x60
0xB9 0x00 0x00 0x00 0x00 //Base Address
0x8B 0x09
0x8B 0x49 0x1C //Structure (0x1c)
0x8B 0x71 0x34 //Player Structure (0x34)
0x8B 0x8E 0x00 0x00 0x00 0x00 //Action Base Address (0x1780)
0x6A 0x01
0xBA 0x00 0x00 0x00 0x00 //walk1 address
0xFF 0xD2
0x8B 0xF8
0x50
0xBA 0x00 0x00 0x00 0x00 //flymode
0x52
0x8B 0xCF
0xBA 0x20 0x1B 0x4F 0x00 //walk2 address
0xFF 0xD2
0x8B 0x8E 0x00 0x00 0x00 0x00 //Action Base Address
0xB8 0x00 0x00 0x00 0x00 //x pos (posicao x a ir)
0x8B 0xD7
0x83 0xC2 0x20 //x action offset/FollowID offset (0x20)
0x89 0x02
0xB8 0x00 0x00 0x00 0x00 //z pos (posicao z a ir)
0x8B 0xD7
0x83 0xC2 0x24 //z action offset (0x24)
0x89 0x02
0xB8 0x00 0x00 0x00 0x00 //y pos (posicao y a ir)
0x8B 0xD7
0x83 0xC2 0x28 //y action offset (0x28)
0x89 0x02
0x6A 0x00
0x6A 0x01
0x57
0x6A 0x01
0xBA 0x00 0x00 0x00 0x00 //walk3 address
0xFF 0xD2
0x5F
0x61
0xC3

but i donot can make auto fly mode works, for flymode (value 1) u need use fly before move function. I was trying to understand the part of lea asm but I ran out of time.

PS: all vars need reverse address. i donot hav a function, my asm class auto convert.

[Stark77]

Great - thank you very much!

[Stark77]

Hi guys,

as you know there is a new small update.
Here is my list of changed offsets/adresses:

realBaseAddress = 0xF45A68
SendPacketAddress = 0x8A0480
AutoPathAddress = 0x415790
ADDRESS_ACTION1 = 0x4ED990
ADDRESS_ACTION2 = 0x4F2560
ADDRESS_ACTION3 = 0x4EDE60
ADDRESS_GATHER = 0x4D9A20
CastAddress = 0x4E9600
InventoryListOffset = 0x1344
MoveMode_Offset = 0x820
playerActionStructOffset = 0x17A8

However, sadly my movement function is not working with them.
The autopath is working, but there is a small issue with flymode.

Does anyone have different values or ideas what I did wrong?

[jasty]

Autopath is 0x40baf0 Rest is fine.

[Stark77]

Thank you very much for your help Jasty.
Sadly, also with this address the autopath would always fly.
Seems my move function might be the issue.

I listed them all (autopath and normal) below.
I tried differnent ways and cannot find alternatives atm.
If anyone has an idea, I would be really grateful.

 Spoiler

MoveTo(X,Y,Z=0,flyflag=0)
{
if X < 1000
X := floattohex((X*10)-4000)
if Y < 1000
Y := floattohex((Y*10)-5500)
revHex(revX, X)
revHex(revY, Y)
revHex(revZ, Z)
revHex(revBaseAddress, realbaseAddress)
revHex(revAutoPathAddress, AutoPathAddress)

func =
func = %func%60
func = %func%B9%revY%
func = %func%BA%revZ%
func = %func%B8%revX%
func = %func%6a00
func = %func%51
func = %func%52
func = %func%50
func = %func%6a03
func = %func%6a00
func = %func%6a00
func = %func%684A010000
func = %func%b9%revBaseAddress%
func = %func%8B09
func = %func%83C11C
func = %func%8B09
func = %func%BB%revAutoPathAddress%
func = %func%FFD3
func = %func%B9%revZ%
func = %func%6A00
func = %func%6A00
func = %func%6A00 ; set to 6A01 to drop at destination
func = %func%51
func = %func%6A01
if (flyflag=0)
func = %func%6A01
else
func = %func%6A00
func = %func%6A00
func = %func%684A010000
func = %func%B9%revBaseAddress%
func = %func%8B09
func = %func%83C11C
func = %func%8B09
func = %func%BB%revAutoPathAddress%
func = %func%FFD3
func = %func%61
func = %func%C3

injectCode(func)
}

 Spoiler

normalMoveTo(X,Y,Z=0,flyflag=0)
{
if (X < 1000)
{
X := floattohex((X*10)-4000)
Y := floattohex((Y*10)-5500)
Z := floattohex(Z*10)
}

revHex(revX, X)
revHex(revY, Y)
revHex(revZ, Z)
revHex(revBaseAddress, realbaseAddress)
revHex(revPlayerOffSet, playerOffSet,2)
revHex(revADDRESS_ACTION1, ADDRESS_ACTION1)
revHex(revADDRESS_ACTION2, ADDRESS_ACTION2)
revHex(revADDRESS_ACTION3, ADDRESS_ACTION3)
revHex(OFFSET_ACTIONBASE, playerActionStructOffset)
revHex(FLYMODE, flyflag)

func =
func = %func%60
func = %func%B8%revBaseAddress%
func = %func%8B00
func = %func%8B401C
func = %func%8B70%revPlayerOffSet%
func = %func%8B8E%OFFSET_ACTIONBASE%
func = %func%6A01
func = %func%BA%revADDRESS_ACTION1%
func = %func%FFD2
func = %func%8BF8
func = %func%8D442418
func = %func%50
func = %func%BA%FLYMODE%
func = %func%52
func = %func%8BCF
func = %func%BA%revADDRESS_ACTION2%
func = %func%FFD2
func = %func%8B8E%OFFSET_ACTIONBASE%
func = %func%B8%revX%
func = %func%8BD7
func = %func%83C220
func = %func%8902
func = %func%B8%revZ%
func = %func%8BD7
func = %func%83C224
func = %func%8902
func = %func%B8%revY%
func = %func%8BD7
func = %func%83C228
func = %func%8902
func = %func%6A00
func = %func%6A01
func = %func%57
func = %func%6A01
func = %func%BA%revADDRESS_ACTION3%
func = %func%FFD2
func = %func%61
func = %func%C3

injectCode(func)
}

 Spoiler

normalMoveTo2(X,Y,Z=0,flyflag=0)
{
if (X < 1000)
{
X := floattohex((X*10)-4000)
Y := floattohex((Y*10)-5500)
Z := floattohex(Z*10)
}

revHex(revX, X)
revHex(revY, Y)
revHex(revZ, Z)
revHex(revBaseAddress, realbaseAddress)
revHex(revPlayerOffSet, playerOffSet,2)
revHex(revADDRESS_ACTION1, ADDRESS_ACTION1)
revHex(revADDRESS_ACTION2, ADDRESS_ACTION2)
revHex(revADDRESS_ACTION3, ADDRESS_ACTION3)
revHex(OFFSET_ACTIONBASE, playerActionStructOffset)
revHex(FLYMODE, flyflag)

func =
func = %func%60 ;PUSHAD
func = %func%B8%revBaseAddress% ;MOV EAX,BaseAddress
func = %func%8B00 ;MOV EAX,DWORD PTR DS:[EAX]
func = %func%8B401C ;MOV EAX,DWORD PTR DS:[EAX+1C]
func = %func%8B78%revPlayerOffSet% ;MOV EDI,DWORD PTR DS:[EAX+34]
func = %func%8B8F%OFFSET_ACTIONBASE% ;MOV ECX,DWORD PTR DS:[EDI+playerActionStructOffset]
func = %func%6A01 ;PUSH 1
func = %func%BA%revADDRESS_ACTION1% ;MOV EDX, Walk1
func = %func%FFD2 ;CALL EDX
func = %func%8D4C241C ;LEA ECX,[ESP+1C]
func = %func%89C6 ;MOV ESI,EAX
func = %func%51 ;PUSH ECX
func = %func%BA%FLYMODE% ;MOV EDX,FLYMODE
func = %func%52 ;PUSH EDX
func = %func%89F1 ;MOV ECX,ESI
func = %func%BA%revADDRESS_ACTION2% ;MOV EDX,Walk2
func = %func%FFD2 ;CALL EDX
func = %func%8B8F%OFFSET_ACTIONBASE% ;MOV ECX,DWORD PTR DS:[EDI+playerActionStructOffset]
func = %func%B8%revX% ;MOV EAX,X
func = %func%89F2 ;MOV EDX,ESI
func = %func%83C220 ;ADD EDX,20
func = %func%8902 ;MOV DWORD PTR DS:[EDX],EAX
func = %func%B8%revZ% ;MOV EAX,Z
func = %func%89F2 ;MOV EDX,ESI
func = %func%83C224 ;ADD EDX,24
func = %func%8902 ;MOV DWORD PTR DS:[EDX],EAX
func = %func%B8%revY% ;MOV EAX,Y
func = %func%89F2 ;MOV EDX,ESI
func = %func%83C228 ;ADD EDX,28
func = %func%8902 ;MOV DWORD PTR DS:[EDX],EAX
func = %func%6A01 ;PUSH 1
func = %func%56 ;PUSH ESI
func = %func%6A01 ;PUSH 1
func = %func%BA%revADDRESS_ACTION3% ;MOV EDX,Walk3
func = %func%FFD2 ;CALL EDX
func = %func%61 ;POPAD
func = %func%C3 ;RETN

injectCode(func)
}

 Spoiler

normalMoveTo3(X,Y,Z=0,flyflag=0)
{
if (X < 1000)
{
X := floattohex((X*10)-4000)
Y := floattohex((Y*10)-5500)
Z := floattohex(Z*10)
}

revHex(revX, X)
revHex(revY, Y)
revHex(revZ, Z)
revHex(revBaseAddress, realbaseAddress)
revHex(revPlayerOffSet, playerOffSet,2)
revHex(revADDRESS_ACTION1, ADDRESS_ACTION1)
revHex(revADDRESS_ACTION2, ADDRESS_ACTION2)
revHex(revADDRESS_ACTION3, ADDRESS_ACTION3)
revHex(OFFSET_ACTIONBASE, playerActionStructOffset)
revHex(FLYMODE, flyflag)

func =
func = %func%60
func = %func%B9%revBaseAddress%
func = %func%8B09
func = %func%8B491C
func = %func%8B7134
func = %func%8B8E
func = %func%%OFFSET_ACTIONBASE%
func = %func%6A01
func = %func%BA%revADDRESS_ACTION1%
func = %func%FFD2
func = %func%8BF8
func = %func%50
func = %func%BA%FLYMODE%
func = %func%52
func = %func%8BCF
func = %func%BA%revADDRESS_ACTION2%
func = %func%FFD2
func = %func%8B8E%OFFSET_ACTIONBASE%
func = %func%B8%revX%
func = %func%8BD7
func = %func%83C220
func = %func%8902
func = %func%B8%revZ%
func = %func%8BD7
func = %func%83C224
func = %func%8902
func = %func%B8%revY%
func = %func%8BD7
func = %func%83C228
func = %func%8902
func = %func%6A00
func = %func%6A01
func = %func%57
func = %func%6A01
func = %func%BA%revADDRESS_ACTION3%
func = %func%FFD2
func = %func%5F
func = %func%61
func = %func%C3

injectCode(func)
}

[jasty]

My MoveTo is the same as your normalMoveTo2 and it works.

It looks like you are converting the floats to strings with 'floattohex' and then sending strings to 'revHex'. Is your revHex function able to properly handle hex strings as input? The other times you are calling it the parameter is an int.

[Stark77]

Hi jasty,

thank you again for your help.
The conversion function cannot be the issue as I always used it before and it was working. In the past we noticed that some move functions do not work for certain operating systems. Maybe that could cause the issue, as I still run windows 7.

[jasty]

I run win7 too and have the same moveto. Are you accidentally passing integers into float to hex? I really would examine the strings that are being generated to make sure they are as expected. That part is fishy.

[Stark77]

Thanks again for the effort. If the adresses are correct and you use the same function and OS, it is really strange. Like I said these conversions always worked for me and looking at the code generated it seems to be just fine.

normalmove2(10,10) generated (without spaces and explanations in brackets):

60
B8 685af400 (%revBaseAddress%)
8B00
8B401C
8B78 34 (%revPlayerOffSet%)
8B8F a8170000 (%OFFSET_ACTIONBASE%)
6A01
BA 90d94e00 (%revADDRESS_ACTION1%)
FFD2
8D4C241C
89C6
51
BA 00000000 (%FLYMODE%)
52
89F1
BA 60254f00 (%revADDRESS_ACTION2%)
FFD2
8B8F a8170000 (%OFFSET_ACTIONBASE%)
B8 00c073c5 (%revX%)
89F2
83C220
8902
B8 00000000 (%revZ%)
89F2
83C224
8902
B8 00c0a8c5 (%revY%)
89F2
83C228
8902
6A01
56
6A01
BA 60de4e00 (%revADDRESS_ACTION3% )
FFD2
61
C3

[jasty]

Comparing that to mine it looks good except for one part... I was wrong when I said "rest is fine".

$ADDRESS_ACTION1 = 0x4ecd80

 Spoiler

Global $ADDRESS_BASE = 0xf45a68
Global $ADDRESS_SENDPACKET = 0x8a0480
Global $ADDRESS_AUTOPATH = 0x40baf0
Global $ADDRESS_ACTION1 = 0x4ecd80
Global $ADDRESS_ACTION2 = 0x4f2560
Global $ADDRESS_ACTION3 = 0x4ede60
Global $ADDRESS_GATHER = 0x4d9a20
Global $ADDRESS_FOLLOW = 0x4f0180
Global $ADDRESS_CASTSKILL = 0x4e9600
Global $ADDRESS_REGATTACK = 0x4d3a80
Global $PARTYINV_ADDRESS = 0xf57c50
Global $MACRO_ADDRESS_BASE = 0xf46b95
Global $OFFSET_ACTIONBASE = 0x17a8

Global $ADDRESS_CHAT_BASE = 0xF4F0FC-0xC

[CeifadorX]

Good Morning!

There was some change in the structure of movement, the follow function no longer works, and on the game screen, if you put to follow, the avatar even flies attracted to the chased or down the wings.

Unfortunately I'm still kind of busy lately, but I'll see if I can debug the new structure this weekend.

[Stark77]

I dont know what I did wrong as I was searching for the addresses but this one is working just fine. Thank you a lot

In case anyone is interested, here is the new buff ID list:

   
   BuffBase := ReadMemoryUint(playerPointer + 0x390, processID)
   BuffCounter := ReadMemoryUint(playerPointer + 0x39C, processID)
   Loop % BuffCounter
      BuffID := ReadMemoryUint(BuffBase + (A_Index-1)*0x1A, processID)

I dont know yet how to read these new timers on the buffs, but could actually become quite helpful

[jasty]

Originally Posted by Stark77

I dont know yet how to read these new timers on the buffs, but could actually become quite helpful

Timers are just unix timestamps at BuffBase + 0x1a*i + 0x6.
You probably need to compare that against the games internal timestamp at 0xF68C94 rather than your system time.

[rama666]

Hi guys, I'm PWI player and was try to resurect WQ/Gather bot from this topic
I'm try input ofsets but bot still blind

 Spoiler

[Address]
Base=0xF45A68
SendPacket=0x8A0480
AutoPath=0x40baf0
ActionStart=0x004E6FB0
ActionStop=0x004E8080
Move=0x004EC720
Gather=0x004D9A20

I know nobody want config it but that will be great - many players said tnx for u! Or mabe u can link some info and I'll learn basic pw-bot dev rules.
Ty anyway