| View previous topic :: View next topic |
| Author |
Message |
shroom
Cheater
![]() Reputation: 0
Joined: 24 Jun 2013
Posts: 29
|
 Posted: Tue Jun 25, 2013 3:36 pm Post subject: |
 |
|
| GNIREENIGNE wrote: | | Do a different pointer scan, this time, uncheck the box that says 'only find paths with a static address', set your max level to 2 and your maximum offset value to 9999. Report back. |
Char X
"SamuraiOrc.exe"+0013B774 +658 +16ed
1B180358 +1560 +16ed
0F2A5054 +20c8 +1845
0F6F039C +20c8 +1845 Works
0F2A5054 +2658 +1845
0F6F039C +2658 +1845 Works
Char Y
"SamuraiOrc.exe"+0013B774 +658 +16d9
1B180358 +1560 +16d9
0F2A5054 +20c8 +1831
0F6F039C +20c8 +1831 Works
0F2A5054 +2658 +1831
0F6F039C +2658 +1831 Works
only 2 of each these pointers works rest fails on restart... but these are no good for you right?
|
|
| Back to top |
|
 |
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Tue Jun 25, 2013 3:43 pm Post subject: |
|
|
You know, I was thinking...when you did your default, 5-level scan which yielded these results:
[[[[["SamuraiOrc.exe"+002EFCA8]+1C90]+121C]+15A4]+1831]
[[[[["SamuraiOrc.exe"+002EFCA8]+1C90]+121C]+15A4]+1845]
You said that they didn't work after the game restarted...but did you open your pointer list back up and do a rescan? You may have working pointers in that list.
If you still have that list, it would be worth investigating.
|
|
| Back to top |
|
|
shroom
Cheater
![]() Reputation: 0
Joined: 24 Jun 2013
Posts: 29
|
| Posted: Tue Jun 25, 2013 4:14 pm Post subject: |
|
|
| GNIREENIGNE wrote: | You know, I was thinking...when you did your default, 5-level scan which yielded these results:
[[[[["SamuraiOrc.exe"+002EFCA8]+1C90]+121C]+15A4]+1831]
[[[[["SamuraiOrc.exe"+002EFCA8]+1C90]+121C]+15A4]+1845]
You said that they didn't work after the game restarted...but did you open your pointer list back up and do a rescan? You may have working pointers in that list.
If you still have that list, it would be worth investigating. |
well i this takes too long so heres what i did
scanned for x address with 99 999offset range and level 5
at level 4 my disk space run out with result of 152 milions pointers
then i did first rescan for the address number dropped to 35 500 then second number dropped to 29 320 then third number dropped to 11 000 and now it seems we have got our X pointer
"SamuraiOrc.exe"+006C3430 +90 +99ac +1845
since the Y address is nearby by -14 bytes then
the Y pointer should be
"SamuraiOrc.exe"+006C3430 +90 +99ac +1831
so?
just checked and seems to work .... so whats the next step?
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Tue Jun 25, 2013 4:20 pm Post subject: |
|
|
Well...that's what I was going to have you do next...except, I wouldn't use 99 999 offset. Since you ran out of disk space, your pointer results may or may not be reliable in the long run (stopping the scan prematurely is like throwing your results in the trash). Did you close the game and check if the pointer is still working?
If it is working, change out the addresses in your script:
[[[[["SamuraiOrc.exe"+002EFCA8]+1C90]+121C]+15A4]+1831]
[[[[["SamuraiOrc.exe"+002EFCA8]+1C90]+121C]+15A4]+1845]
so that they follow your current set of offsets:
[[[["SamuraiOrc.exe"+006C3430]+90]+99ac]+1831]
[[[["SamuraiOrc.exe"+006C3430]+90]+99ac]+1845]
|
|
| Back to top |
|
|
shroom
Cheater
![]() Reputation: 0
Joined: 24 Jun 2013
Posts: 29
|
| Posted: Tue Jun 25, 2013 4:36 pm Post subject: |
|
|
| GNIREENIGNE wrote: | Well...that's what I was going to have you do next...except, I wouldn't use 99 999 offset. Since you ran out of disk space, your pointer results may or may not be reliable in the long run (stopping the scan prematurely is like throwing your results in the trash). Did you close the game and check if the pointer is still working?
If it is working, change out the addresses in your script:
[[[[["SamuraiOrc.exe"+002EFCA8]+1C90]+121C]+15A4]+1831]
[[[[["SamuraiOrc.exe"+002EFCA8]+1C90]+121C]+15A4]+1845]
so that they follow your current set of offsets:
[[[["SamuraiOrc.exe"+006C3430]+90]+99ac]+1831]
[[[["SamuraiOrc.exe"+006C3430]+90]+99ac]+1845] |
finally thank you yes it seems to work although still something to work on..
i have tested on few maps and it seems certain type of mob never gets vacced
and also would it be possible to pimp the script so you can set the X,Y u want to be monsters vaced at?
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Tue Jun 25, 2013 4:48 pm Post subject: |
|
|
| shroom wrote: | | finally thank you yes it seems to work |
-I'm glad. 
| shroom wrote: | | i have tested on few maps and it seems certain type of mob never gets vacced |
This is where we might try a different injection point (different instruction). Or, we may be required to inject at multiple instructions, since this game seems to be an oddball of sorts.
| shroom wrote: | | and also would it be possible to pimp the script so you can set the X,Y u want to be monsters vaced at? |
This is what I originally wrote for you and you wanted to change it.
|
|
| Back to top |
|
|
shroom
Cheater
![]() Reputation: 0
Joined: 24 Jun 2013
Posts: 29
|
| Posted: Tue Jun 25, 2013 5:02 pm Post subject: |
|
|
| GNIREENIGNE wrote: | | shroom wrote: | | finally thank you yes it seems to work |
-I'm glad.
| shroom wrote: | | i have tested on few maps and it seems certain type of mob never gets vacced |
This is where we might try a different injection point (different instruction). Or, we may be required to inject at multiple instructions, since this game seems to be an oddball of sorts.
| shroom wrote: | | and also would it be possible to pimp the script so you can set the X,Y u want to be monsters vaced at? |
This is what I originally wrote for you and you wanted to change it. |
OFFTOPIC
well i think i can be honest with you now, the game is not oddball its was written by my friend whos very good hacker(he cracks programs packed in RISC Themida with 20mb of VirutalProtect VM for breakfest), but more then hacking hes reverse engineer and specializes in PE cryptography. i asked him if he could teach me to hack 2D mmos he said that he dont have time to teach me basics and wrote this game which he says "is same as most online 2D mmos in mean of code" and gave me huge list of hacks he want see me to do and 4 of these hacks are various VACs.. item vac,mob vac ,npc vac, object vac.
ONTOPIC
so basically now i need to find the address of the mobs which dont get vaced and find instruction that changes its X address right?
oh and sorry if the first version did that ill try to look at it
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Tue Jun 25, 2013 5:10 pm Post subject: |
|
|
| shroom wrote: | OFFTOPIC
well i think i can be honest with you now, the game is not oddball its was written by my friend whos very good hacker |
-That explains why I couldn't find it...and, yes, why it is an oddball of sorts.
| shroom wrote: | ONTOPIC
so basically now i need to find the address of the mobs which dont get vaced and find instruction that changes its X address right? |
-Maybe. It could be, that, one of the instructions that accesses your coordinates, also accesses enemyA coordinates (and) enemyB coordinates; (or) one of the instructions could access all coordinates; (or) there could be a different instruction for each type (hero, enemyA, enemyB etc.). At this point, I wouldn't rule anything out.
|
|
| Back to top |
|
|
shroom
Cheater
![]() Reputation: 0
Joined: 24 Jun 2013
Posts: 29
|
| Posted: Tue Jun 25, 2013 6:29 pm Post subject: |
|
|
| GNIREENIGNE wrote: | | shroom wrote: | OFFTOPIC
well i think i can be honest with you now, the game is not oddball its was written by my friend whos very good hacker |
-That explains why I couldn't find it...and, yes, why it is an oddball of sorts.
| shroom wrote: | ONTOPIC
so basically now i need to find the address of the mobs which dont get vaced and find instruction that changes its X address right? |
-Maybe. It could be, that, one of the instructions that accesses your coordinates, also accesses enemyA coordinates (and) enemyB coordinates; (or) one of the instructions could access all coordinates; (or) there could be a different instruction for each type (hero, enemyA, enemyB etc.). At this point, I wouldn't rule anything out. |
hmm i dunno yet i changed the instruction to hook
fld dword ptr [esi+000000E8]
and now it vacs everything NPCs,Objecs,mobs
and it actually works with the handmade pointers o.o
nvm i see but that saves char position could u make the script so that i input my X,Y values and not save the ones where char is
also question when the mobs die their corpse return to their old pos and they drop items there cant it be made so that they drop items on the spot that they are vaced? or will i have to make item vac separately for that?
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Tue Jun 25, 2013 6:46 pm Post subject: |
|
|
| shroom wrote: | hmm i dunno yet i changed the instruction to hook
fld dword ptr [esi+000000E8]
and now it vacs everything NPCs,Objecs,mobs |
-This is what I mean when I say, there may be an instruction that accesses them all.
| shroom wrote: | | and it actually works with the handmade pointers o.o |
-Okay.
| shroom wrote: | | nvm i see but that saves char position could u make the script so that i input my X,Y values and not save the ones where char is |
-Yes. You can assign whatever value you want to x/y. You would need to determine what those values are, beforehand, otherwise, you would just be guessing...and your enemies could land off the map (for example).
|
|
| Back to top |
|
|
shroom
Cheater
![]() Reputation: 0
Joined: 24 Jun 2013
Posts: 29
|
| Posted: Tue Jun 25, 2013 6:55 pm Post subject: |
|
|
| GNIREENIGNE wrote: | | shroom wrote: | hmm i dunno yet i changed the instruction to hook
fld dword ptr [esi+000000E8]
and now it vacs everything NPCs,Objecs,mobs |
-This is what I mean when I say, there may be an instruction that accesses them all.
| shroom wrote: | | and it actually works with the handmade pointers o.o |
-Okay.
| shroom wrote: | | nvm i see but that saves char position could u make the script so that i input my X,Y values and not save the ones where char is |
-Yes. You can assign whatever value you want to x/y. You would need to determine what those values are, beforehand, otherwise, you would just be guessing...and your enemies could land off the map (for example). |
quite not i know the pointers for char y,x so i know if i vac them char x -20 where they are gunna end
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Tue Jun 25, 2013 7:34 pm Post subject: |
|
|
Yes...but you're still basing those coordinates off of your character coordinates; values that you already know. This can be done with the script, also. You don't have to put all enemies at hero coordinates, you can put them at hero coordinates x+20 etc. For that matter, with the script that I originally made for you, you can put them anywhere.
There are many ways to do it. Some ways are more practical than others, depending on who you ask. I'm certainly not going to argue with you about it.
|
|
| Back to top |
|
|
shroom
Cheater
![]() Reputation: 0
Joined: 24 Jun 2013
Posts: 29
|
| Posted: Tue Jun 25, 2013 7:43 pm Post subject: |
|
|
| GNIREENIGNE wrote: | Yes...but you're still basing those coordinates off of your character coordinates; values that you already know. This can be done with the script, also. You don't have to put all enemies at hero coordinates, you can put them at hero coordinates x+20 etc. For that matter, with the script that I originally made for you, you can put them anywhere.
There are many ways to do it. Some ways are more practical than others, depending on who you ask. I'm certainly not going to argue with you about it. |
well another problem emerged i made item vac but now all items are glued to my pos but i cant loot them what do you suggest shall i analyze ?
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Tue Jun 25, 2013 9:10 pm Post subject: |
|
|
Again, if you would have stuck with the original script that I made you, you would not have this problem of items being stuck in place. Regarding whether or not the items will still be retrievable, will depend on how the game was made.
| shroom wrote: | | what do you suggest shall i analyze ? |
-I would start by incorporating the original script that I made for you (or, at least some adaptations of it), so that you can shut off the vacuum effect.
|
|
| Back to top |
|
|
shroom
Cheater
![]() Reputation: 0
Joined: 24 Jun 2013
Posts: 29
|
| Posted: Wed Jun 26, 2013 8:08 am Post subject: |
|
|
| GNIREENIGNE wrote: | Again, if you would have stuck with the original script that I made you, you would not have this problem of items being stuck in place. Regarding whether or not the items will still be retrievable, will depend on how the game was made.
| shroom wrote: | | what do you suggest shall i analyze ? |
-I would start by incorporating the original script that I made for you (or, at least some adaptations of it), so that you can shut off the vacuum effect. |
nope that doesn't change much... even when vac is disabled then still cant loot the items
i have checked what accesses the x address and
This instructions are executed only when item is present and is not being looted
00439BDE - D9 86 B0000000 - fld dword ptr [esi+000000B0] this is what i use and vacs all items
00439C3C - D9 86 B0000000 - fld dword ptr [esi+000000B0]
00439CEC - D9 86 B0000000 - fld dword ptr [esi+000000B0]
00439DD3 - D9 86 B0000000 - fld dword ptr [esi+000000B0]
0045C161 - D9 03 - fld dword ptr [ebx]
0045B146 - D9 07 - fld dword ptr [edi]
0045B172 - D9 07 - fld dword ptr [edi]
0045B192 - D9 17 - fst dword ptr [edi]
00459BD5 - D9 87 B0000000 - fld dword ptr [edi+000000B0]
00438C29 - D9 86 B0000000 - fld dword ptr [esi+000000B0] - vacs only etc
this is present only when item is being looted
00451F8E - D9 80 B0000000 - fld dword ptr [eax+000000B0] -hooking this did nothing
00451FC5 - D9 86 B0000000 - fld dword ptr [esi+000000B0] - also nothing
0045C20F - D9 03 - fld dword ptr [ebx]
0045C2AD - D8 03 - fadd dword ptr [ebx]
0045C2B3 - D9 1B - fstp dword ptr [ebx]
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
