Aion Bot

[rock5]

I can confirm the direction address you have can turn the player (camera), you can then use forward keypress to go that direction. So turning is easy enough, the actual movement forward will be the pain,

Actually I have the player:moveTo working just fine. As I mentioned above, I use the numlock to move.

MM not being able to deal with address 0x8000000 + kind of put me off, even if we manage to get something working if the addresses needed are in that region then we are toast.

Not necessarily. If we can read by pointers then we just have to always use pointers. Eg. I think I found the memory area that holds the table of addresses for the objects around you. This table is in a range we can read. The addresses stored there are mostly 0xFxxxxxxx. So if we want to search for a target we might not be able to do this

Code: Select all

pawn.Address = memoryReadUInt(getProc(), gamebase + whatevervalue)
pawn.X = memoryReadFloat (getProc(), pawn.Address + pawnX_offset)

because pawn.Address will be too high a range to read. But we could do this.

Code: Select all

pawn.Address = memoryReadUInt(getProc(), gamebase + whatevervalue)
pawn.X = memoryReadFloatPtr (getProc(), gamebase + whatevervalue, pawnX_offset)
etc.

Ohh yeah I found the static that gives us the value of "Game.dll", I'll post it tomorrow from work.

I have no problems using

Code: Select all

BaseAddress = getModuleAddress(findProcessByWindow(__WIN), "game.dll");

I don't know what benefit there would be to reading it from memory.

[Administrator]

You'll need to update to the latest experimental version to access the upper memory region.
http://www.solarstrike.net/phpBB3/viewt ... 695#p45695

I just uploaded this now so even if you downloaded the experimental version recently, you still need to update.

[nightclaw]

so sorry my typing sucks

i was thinking cant you use the Rubot trial to read its memory when sending waypoint movment commands

also the 2nd one i linked the guys said you ask tech ???s about it to help with yours if you want he said post them and he well tell ya much as he can with out giving source code

[lisa]

You'll need to update to the latest experimental version to access the upper memory region.
http://www.solarstrike.net/phpBB3/viewt ... 695#p45695

I just uploaded this now so even if you downloaded the experimental version recently, you still need to update.

Tested and it read an Int at 0x7117B5DC just fine, haven't tested more than that at this stage but that is a good start =)

[lisa]

getting varied results, can't explain it.
It will run fine and then 5 minutes later it will get failed to read and then later it will get weird values.

A simple print

Code: Select all

playerHP = memoryReadFloat(proc, mainOffset + 0xFB67E0)
playerMaxHP = memoryReadFloat(proc, mainOffset + 0xFB67DC)

printf("player HP address 0x%x\n",mainOffset + 0xFB67E0)
printf("value at HP Address %d\n",memoryReadFloat(proc, mainOffset + 0xFB67E0))
printf("Character hitpoints:\t(%d/%d)\n",playerHP,playerMaxHP);

And yet it prints the value as 0 when I can clearly see on CE the value isn't 0, rest of the prints were fine though.

This is with new MM admin posted today.

Ok little more info on the failed to read, I added a few prints and narrowed it down.
I was using this which was posted by someone.

Code: Select all

	mywin = findProcess("AION*");
	proc = openProcess(mywin);
	mainOffset = getModuleAddress(mywin, "Game.dll");

occasionally it was having mainOffset valued at 0
I changed it to this

Code: Select all

repeat 
	mywin = findProcess("AION*");
	proc = openProcess(mywin);
	mainOffset = getModuleAddress(mywin, "Game.dll");
until mainOffset ~= 0

haven't had a failed to read since changing it.

This basically the files someone else posted but updated to latest addresses.
Looks like this

Code: Select all

Character name:         charname
Character hitpoints:    (432/432)
Character mana:         (450/450)
Character Dp Points:    -362807296
Character Experience:   (12423/14583)
Character Exp Debt:     0
Character Level:        5
Character Position:     (1759,434,119)
Target Position:        (1755,428,118)
Target Name:            Tula
Target hitpoints:       (2961/2961)

no idea what dp points actually are but I have 0/4,000.

printinfo.lua

(4.5 KiB) Downloaded 180 times

addresses.lua

(923 Bytes) Downloaded 194 times

[Administrator]

This is with new MM admin posted today.

Ok little more info on the failed to read, I added a few prints and narrowed it down.
I was using this which was posted by someone.

Code: Select all

	mywin = findProcess("AION*");
	proc = openProcess(mywin);
	mainOffset = getModuleAddress(mywin, "Game.dll");

occasionally it was having mainOffset valued at 0
I changed it to this

Code: Select all

repeat 
	mywin = findProcess("AION*");
	proc = openProcess(mywin);
	mainOffset = getModuleAddress(mywin, "Game.dll");
until mainOffset ~= 0

haven't had a failed to read since changing it.

I don't immediately see anything that should be causing it to fail to find it. Are you noticing any patterns?
It could be caused by 3 different things: Invalid toolhelp32 snapshot handle, failure to copy module list to buffer, or failure to find the module.

I've attached a new executable that includes messages in log.txt for the first 2 of those 3 failures.

[rock5]

I use findWindow instead of findProcess and have never noticed that happen to me. Maybe one is more reliable than the other.

[lisa]

with the new .exe this was stuck in an infinite loop, added the time out to exit it.

Code: Select all

repeat 
	mywin = findProcess("AION*");
	proc = openProcess(mywin);
	mainOffset = getModuleAddress(mywin, "Game.dll");
until mainOffset ~= 0 or (os.time() - starttime) > 10

so mainOffset was always 0


Ok so where is that embarrased thingy

I was doing the mem read as a float and not an int

[Administrator]

with the new .exe this was stuck in an infinite loop, added the time out to exit it.

Nothing changed that should effect how it runs. I only added some logging. It will definitely not work very well with 64bit processes but I don't think that's an issue with AION, is it?

[lisa]

with the new .exe this was stuck in an infinite loop, added the time out to exit it.

Nothing changed that should effect how it runs. I only added some logging. It will definitely not work very well with 64bit processes but I don't think that's an issue with AION, is it?

yeah I must have been having a bad day yesterday, I also changed something else before testing the exe you posted. Fixed it up now and got rid of the loop, it hasn't had mainOffset as 0 since, so I haven't seen any extra prints.
I'll keep testing it.

Did some playing around with keypresses.

It isn't the actual keys themselves but the action that goes with the key.

If you set a key to autorun it will work, if you set a key to next target it will work.

So you could assign a key for autorun and use it, or just keep it as numlock.
Same for Tab and target next mob

If you press enter to start up the chat thingy, so text goes into the text and then just do simple key presses with it attached and not focus it will do the keypresses into that chat thing.
So it is purely the action associated with the keys that has the issue.

[lisa]

Rock you feel like sharing your movement code? Would save me writing it up myself =)

I have some attacking stuff going but nothing fancy, just key presses with set wait times (cooldown), then loot once mob dead. Botted new mage 1-7 just doing that, gold seems to come from quests though as after I got to lvl 6 I had about 1,200 gold but the hunter I manually quested to 6 had around 40,000 gold.

I was sad that a Hunter is actually what I would call a rogue =(

Been pretty busy so haven't done much really.

[rock5]

All I have is a moveTo function. It's not like I've got waypoints working yet. Anyway, this is a project I sort of wanted to work on myself at my own pace. So pretty much ignoring any contribution others might be making because I want to do everything myself my own way. I guess I don't mind sharing something if you need something in particular but I suspect you were after functioning waypoints.

[nightclaw]

no matter the time takes i THANK you ALL

[rock5]

Well, I've hit a dead end. I thought I was making good progress, especially after finding target of target which turned out to be pretty tricky, but I just spent literally all day trying to find the object table in memory and failed. And with my previous failure to do macros, there is no way to target a specific mob or npc except blindly tapping the target key until you target your desired target.

I'll have to take a break until I think of something else to try.

[lisa]

have you tried to force game to target something with CE?
I tried a few different things but couldn't force the game to target something, finding the object array is of course nice but you need to also be able to force game to target what you want or the info is kind of useless, unless you just get character to face the object using it's info from memory and then hit tab.

It may or may not help you but have you noticed that the target name address always ends in
03A 43A 83A C3A
If you go to the address at 000 400 800 C00 it has a value, mine is currently 2FB395D4, do a hex 4byte search in CE and you will get all of the mobs around you, you also get other results which don't have names.

Hope this helps.

[rock5]

have you tried to force game to target something with CE?
I tried a few different things but couldn't force the game to target something, finding the object array is of course nice but you need to also be able to force game to target what you want or the info is kind of useless, unless you just get character to face the object using it's info from memory and then hit tab.

Yes I have found a way to target. Each pawn has what I'm calling a handle at offset 0x13C. It's a 2 byte value usually in the FF00-FFFF range (the player pawn is always FFFF). If you change Game.dll+FB1086 to this value then attack, you will action that pawn. Unfortunately, though, it does not change the "target address info" that we previously discovered. So if we want to use the player.targetPtr and related info we would have to change player.targetPtr when targeting the handle.

It may or may not help you but have you noticed that the target name address always ends in
03A 43A 83A C3A

I guess that means the memory size for each object is 0x400.

If you go to the address at 000 400 800 C00 it has a value, mine is currently 2FB395D4, do a hex 4byte search in CE and you will get all of the mobs around you, you also get other results which don't have names.

I'm not sure why you are doing a search. If I do a search for that value I end up 200+ results. How did you come to the conclusion "you will get all of the mobs around you"?

Wait, I think I know what you are saying. You are saying all objects have that value at that location. I'll think about it but I don't see how that can be useful besides doing a full memory scan whenever we want to find a target.

[lisa]

Wait, I think I know what you are saying. You are saying all objects have that value at that location.

well all mobs do anyway, other objects are different.

I find there are a few ways they tend to keep object info.

1. they have an array for mobs, another array for NPC, another array for objects you can interact with, etc..

2. they have an array of absolutely everything around you all in the same array, so mob info could be next to an object or NPC.

I haven't dived into aion too much as I know I will just post everything I find and you are trying to work it out for yourself, so I have been resisting the urge lol

I believe it is a good idea if you can quickly identify the difference between a mob or object though, obviously with case 1 it is easy as all mobs are in the 1 array but in case 2 you need to be able to work out what you can and can't kill =)

[nightclaw]

Well, I've hit a dead end. I thought I was making good progress, especially after finding target of target which turned out to be pretty tricky, but I just spent literally all day trying to find the object table in memory and failed. And with my previous failure to do macros, there is no way to target a specific mob or npc except blindly tapping the target key until you target your desired target.

I'll have to take a break until I think of something else to try.

thats not true you type in a command with a name and target i do it all time with macro 4 crafting for the crafting NPC ya just type it in the chat,,,like if i want my macros to target npc sam i just type in /Select Sam and it targets him if i want walk to him and open chat all i have do is /Select Sam with /Attack and it target him and run to him and open chat .
here all the basic / commands

/Select [target] -----Select a Target
/Skill Assist Target -----If you target your tank and he is in turn targeting a mob, your target will switch to the mob
/Select [%target'starget] -----Same as /skill Assist Target
/Attack----Attack or opens NPC chats
/Automatic Selection-----It will choose nearest mob
/Skill [skill name]-----Use the skill as reflected in the skill name
[%Target]-----Will display Target name.
[%group1]-----Will display the player occupying the first slot of the party
/delay 1-------delay set to 1 sec

hope this help i have alot more..

[lisa]

The macro/ingamefunctions are pretty impressive with what you can actually accomplish with them.
I failed to manipulate the macros via memory though, which would be pretty awesome.

[rock5]

thats not true you type in a command with a name and target i do it all time with macro 4 crafting for the crafting NPC ya just type it in the chat

Are you talking about entering directly into chat? So from the bot you would send the keypresses "[ENTER]/select sam[ENTER]"? I don't know how reliable it would be but worth a try.