Drakensang Online (Bot)

[BlubBlab]

Okay first comes first:
The Game can be found here:

http://www.drakensang.com/

The game looks like that:


EDIT: I did come to this came trough some of this videos: https://www.youtube.com/watch?v=tOP7ITJnjfQ
It is a Diablo 2 clone as a web browser game but it has also a client which can be downloaded.(I'm using it)
Unlike d2 it hasn't random maps.

What I want to do is while I'm making a bot for the game, making a more generic framework for bots. I can't guarantee I will ever be finished with this but I hope I will learn something be this.

Why I choose this game? Because it is 2D, hasn't random Maps and the premium currency drops in the game as loot xD(poor design choice).

Okay I started memory searching I found until now this:
2A7DA0F8 actual life
2A7DA158 Rage
2A7DA1D4 max life

Okay It seems it true sometimes, sometimes not(map change) but I think I have the offset so I start following pointers tomorrow and yeah the client seems to be Java.

[lisa]

looks very minimalistic, which isn't a bad thing when starting up a bot for a game.
Turns out someone already has the name lisa, what are the odds lol

The addresses you posted aren't statics for me, maybe game changes from country to country or server to server, it is really hard to say at this stage.

try this CE file.
It has hp/maxhp/x/y/dir1/dir2 as pointers from a static.

[lisa]

well when I put same CE file on my 64 machine the static address was different.

So if those don't work change the initial address.
either 00AA0818 or 00AA038c, probably need to do up a pattern search for it to be reliable.

Adding an image.

Seems my old laptop can handle 2 of the game going at once, which is very handy for searching for things in memory.
I have pointers holding true for this PC but when I use them on a different PC they don't hold true and like I said earlier need to change the 818 and 38C /shrug

[BlubBlab]

I think that comes from the fact it is Java each version is little bit different and for the type long on 64bit machines with 64bit Java it use int64 on 32bit it use a different data type. Hm finding a value is really easy finding pointer seems a harder when I say scan for pointer to this address it gave me a huge list and I can see a button next scan.I'm using CE 6.3

EDIT:Okay I found a pointer with a offsets of 1C down the max HP.
I think the first ones are in a block like in Runes of magic because max Hp and current HP have an offset of 28(decimal) to each other and when I see your picture everything until dir 2 seems to be together.

EDIT2: AH O.o that base pointer was that what you mentioned.(AA0818 or 00AA038c)

[lisa]

As far as grouping in memory goes I can confirm for player these are closish together

Code: Select all

	MaxHP = 0x1D4,
	HP = 0xF8,
	Rage = 0x158,
	X = 0x40,
	Y = 0x48,
	dir1 = 0x10,
	dir2 = 0x18,

And in another section of memory these are closish together

Code: Select all

	playerlvl = 0x80,
	playername = 0x21C,
	playerxp = 0x268,
	playerardament = 0x270,
	playergold = 0x274,

The first section I mentioned I can get 100% of the time on 1 PC atm, flawlessly. The second group seems to have issues and I am still working out why, might be something to do with my coding as CE has no issue with showing second group.

But yeah those values are the offsets to the base for that section of memory, no doubt a lot more info in each section about the player.

In CE you can search for

gold very easily which will give you the place for the others in that group. All you need to do is sell something to increase gold and it only takes 1-2 changes in value to get the result, there will be 3 of them, the last one is in the section of memory with the rest of the group.

Max HP and that will give you the others in that section, all you need is 1 item with +hp on it and remove and put it on while you do searches for current max HP, it will take 3-4 changes before you get down to 2 results. The one you want ends in 4.

Like I said though I am working through an issue which might be my coding or may be an issue with how memory is done in the game. Hopefully I can get it sorted out today.

[lisa]

Ok it was an issue with my code, finally worked it out lol

Feel free to give this a try, if it doesn't work then you may need to change the statics and/or offsets in addresses.lua

Just start it with
ds/main

DS.zip

(2.85 KiB) Downloaded 676 times

Thats with a 32bit machine.

Notice in addresses.lua I have 2 sets of possible static/pointers to get to each section of memory and it tests them both to decide which to use. Temporary work around for now atleast.

Not sure this game has hooked me, seems kind of boring at this stage but then I haven't played it much, have 4 chars to lvl 6ish but yeah I'm just not feeling enthusiastic playing it.

[BlubBlab]

O.o I found the pointer for what is under my mouse (Name)

00D5F03C(ebp-4) base pointer
offset + 4

That could be come in handy for looting or open a shop or targeting a mob

Is it on your machine the same base pointer?

EDIT:
Okay the last thing I need to do is finding the mobs/loot in the game for the x/z coordinates than I can simple click it.(and I can program a simple grinding bot)

I suspect their is an array of pointers to the objects similar to rom. Okay that array should be in the lower memory region because the player base pointer could/should be in it.

I saw that I can browse memory but can I some how follow pointer and change the view from hexadecimal to integer, float and so on.?

[BlubBlab]

Okay I started with the players around me:


I can confirm it is a list and that the pointer to each block has an offset of 4 bytes pre the name of the players.
But I don't see a list of pointers to them yet (perhaps their are some double pointers)

[BlubBlab]

Okay don't use stack Addresses ^^

Today I have learned to use CE than everything thing else. What makes problems is they are not 1 list more like 3 or 4 lists which have seems different purposes and each have the name twice in the header for a unknown reasons. So it is a maze.

On top I had a disconnect in the middle of the work .....
Okay maybe I start with the mops instead of the players tomorrow.

[BlubBlab]

Okay seems not easy, after I failed to get some additional information I tried to get Lisa ct file to work in my CE.
After some tries it does load correctly but reckless which base addresses I put in from the choices It won't work and when I'm reading this correct it is 4x pointer structure with offsets. I can only suspect that the very base address change by each restart of the client.

I surly don't want to know how many hours those back tracking costed Lisa.
So I need something automaticly to solve this maze, when I remember correctly Rock5 have similar problems with Aion.
I need a pattern search that search around this adresses, I think a way would follow them and set the result fix like the player name.

Okay from the other side of view, when I run the lua script

Code: Select all

-------------------------------------------------------------------------------
WARNING: Failure reading memory from 0x28FA24 at 0x41 in memoryReadUInt(). Error
 code 299 (Nur ein Teil der ReadProcessMemory- oder WriteProcessMemory-Anforderu
ng wurde abgeschlossen.)
WARNING: Failure reading memory from 0x28FA24 at 0x40 in memoryReadUInt(). Error
 code 299 (Nur ein Teil der ReadProcessMemory- oder WriteProcessMemory-Anforderu
ng wurde abgeschlossen.)
0:16am - ../Documents/micromacro/scripts/ds/attach.lua:29: bad arg
ument #3 to 'memoryReadIntPtr' ((null))

I'm not sure what that means It seems the first part can't be read, It's maybe not the fault that the addresses are wrong

[lisa]

I surly don't want to know how many hours those back tracking costed Lisa.

Pointer scan, takes a few minutes

I'm not sure what that means It seems the first part can't be read, It's maybe not the fault that the addresses are wrong

Yeah static address is wrong for your PC/client/what ever else is different

[BlubBlab]

I surly don't want to know how many hours those back tracking costed Lisa.

Pointer scan, takes a few minutes

hm not really the issus take me about 10-30 sec max ,follow to many possibles is the issues. Okay for me more the knowledge holes that I have from unexperience with CE and memory search but I think I got it one by one.

I'm not sure what that means It seems the first part can't be read, It's maybe not the fault that the addresses are wrong

Yeah static address is wrong for your PC/client/what ever else is different

Hm yes I thinking about making a loop from 0xAA0800 to 0xAA0FFF to test it out which it is but those first 2 warning are a bit odd they basically say some dependences are not fulfilled. I can only think of 2 reasons 1.) something was forgotten 2.)MM know that the pointer can't be 0 and read 0.

In case 2 I could use memoryReadUInt ??

[lisa]

2.)MM know that the pointer can't be 0 and read 0.

you get that error with pointers, Ptr, So basically it is saying that the offsets for the Pointer doesn't go into readible memory.
So if it points to 0x3877873837 then it tries to go to that address in memory which doesn't exist and so it says that reading the Ptr with the details it has doesn't work and returns the error.

[BlubBlab]

I tried to make some sort of pattern search from the pointer offsets but hm don't work.
I don't know why.

Besides I found some issues I think the first windows is the luncher and not the game, after on scan round MM didn't do the second round. The other was. Some pointer had negative numbers O.O, at least I had an error on that:

Code: Select all

	--printf("PointerBase: 0x%x \n",base)

Gave some error about miss format with negative numbers I don't know where the error is in printf or in memoryReadIntPtr.
Okay maybe that is all because I have an old version of MM.

Lisa can you test my script perhaps it work on your PC. Only put your char name on line 2 and test if it gave some results.(and maybe change line 12 about which window to start with)

[Administrator]

That error is from the print. %x expects only positive numbers. For an address, you probably want an unsigned int, and that could explain why you're getting a negative number.

[BlubBlab]

AHHH.
I did take a lock in the http://www.solarstrike.net/wiki/index.p ... _Functions.(and everything was clear after I saw that multiple version of Pointer reading exist.)
I simple used was already in their, I need memoryReadUIntPtr instead of memoryReadIntPtr. Okay but I wouldn't recommend using memoryReadIntPtr because negative addresses are like negative lengths, in school I called them hyperspace coordinates.

EDIT: Okay I did maybe found the pattern on my PC at least it works when I'm change the zone and I back tracked it very hardcore. It is very different I can tell:

[rock5]

0x304f17 is probably too large an offset to expect it not to change. You could try doing a pattern search for that offset, as well as the base address.

[lisa]

0x304f17 is probably too large an offset to expect it not to change. You could try doing a pattern search for that offset, as well as the base address.

having a look at the pic I would say that is the static address done is his own special way.
Basically (Base + 0x304F17) is the static address, I personally don't see a static ending in 7 as being very reliable though.

[BlubBlab]

It was 0x304F17B but yeah it didn't work after a restart, I suspected that.

Okay I can explain what I have done until now for that first finding a the table in which stands the name and the XP, by starting the debugger or use Lisa offsets I can find the table base address of the player.

When I add the debugger on the base address it don't show me any kind of offset unlike Lisa. So I search an pointer with this address I got about 15x results because this is to much to handle I change the zone, now only 3 addresses show the way to the new table base address.

2 of them weren't used so I didn't find anything out with the debugger.( I could when I'm zone hm)
That one which was over were that one in the static in the list,the debugger showed me a address which is a little bit below(in the pic)
search for it bring 0 results.

Searching for the static I choose brings about 20 results but the only way to find about about them is make a bet that one of them is the last (static)one and add them all.

So I have 2 options follow the 2 other pointer or make a bet?

(I'm surely thing the reason it is so different is I have 64-bit 7.55 Java)

[BlubBlab]

Okay I'm not completely through but I'm very confidante this time that I have found the address.

Code: Select all

bases = {0xAA0818,0xAA0388,0xAA085C,0xAA0390},
	base = 0x00,
	playerbase = {},
	playerbase1 = {0x404,0x40,0x40,0x38},
	playerbase2 = {0x6B4,0x40,0x40,0x38},
	playerbase3 = {0x7FC,0x7D4},	
	--High address table Base 
	playerbase4 = {0x26C,0x404,0x2C,0xA4},
	--Low adresse Base table alternative.
	playerbase5 = {0x664,0x40,0x44,0x38},

I finally understand how CE works(that advanced pointer search is awesome)

Quick tut how to find: Like Lisa already said
1.)search for your LP/XP change it.
2.)Next try debugger if you are able to find some offsets,if so add the new addresses to your list
3.)Now make a advances pointer search for it, if finished change zone
4.)Repeat 1 until 3 their is an option with that you can make filter the list, use the address for the filter you now founded
5.)Close the Game, restart it repeat 1 until 3(not change zone) and filter again.