Re: 3.0.5 not working
Posted: Sun Oct 24, 2010 6:25 pm
The process to find the address for the "table of tables" is quite simple (its simple now that i know what i'm looking for...):
Open CE and do a text search for: "ImageObjectDB", memory browse to the first result (might be 1,2 or more depending on game version but the important one is always first one so far), set the view to 8 columns (just expand the window horizonatly until you see 8).
Here comes a tricky part: you have to align the result by moving lef or right depending on how you see it, to align the result until you get the version of the database on one line and the name on the next one (version is something like: "v0.20 min 0730" and a date) align the view so the "v" is the first char on the line and then you can see the first address we need is the the address that points to the previous 4 bytes to that char. (Look at picture 1).
Ok, now we do another search in CE, this time we search for 4 bytes in hexa, and the term is the address we just found (in this case: 016449C0), the result we need is the first one, after all this patches it always has been the 1st one, but thats easy to check, go memory browse the first result, and if that points to a list of addresses close to each other, then it is the one we looking for, once we are sure this is the address we are looking for, in memory browse window press CTRL+P (or go to Tools->Pointer scan) and do a pointer scan search for this address, put the address in "Address to find" and leave all by default except for "Max level", set it at 2.
When pointer scan finish look for a pointer in Client.exe whose offsets are: 540 the first one and 78 the last one, yo probably get more than one of those results, go for the first again and we're set. (540 and 78 are the offsets i found all the time for the last 3 patches, that could change some time...) the result will be a 2 pointer address, the only one we need is the first one (Client.exe+XXXXX) Client.exe starts at 004XXX so if the result is: Client.Exe+005D7914 the addres we need is: 009D7914 and thats all, thats the address we need to put in addresses.lua in tablesBase like this: tablesBase = 0x9D7914,
I hope this makes any sense because i'm really tired, didn't sleep the last 2 nights because of work... But more than that, i hope it helps to get someone else that can do this besides me...
Open CE and do a text search for: "ImageObjectDB", memory browse to the first result (might be 1,2 or more depending on game version but the important one is always first one so far), set the view to 8 columns (just expand the window horizonatly until you see 8).
Here comes a tricky part: you have to align the result by moving lef or right depending on how you see it, to align the result until you get the version of the database on one line and the name on the next one (version is something like: "v0.20 min 0730" and a date) align the view so the "v" is the first char on the line and then you can see the first address we need is the the address that points to the previous 4 bytes to that char. (Look at picture 1).
Ok, now we do another search in CE, this time we search for 4 bytes in hexa, and the term is the address we just found (in this case: 016449C0), the result we need is the first one, after all this patches it always has been the 1st one, but thats easy to check, go memory browse the first result, and if that points to a list of addresses close to each other, then it is the one we looking for, once we are sure this is the address we are looking for, in memory browse window press CTRL+P (or go to Tools->Pointer scan) and do a pointer scan search for this address, put the address in "Address to find" and leave all by default except for "Max level", set it at 2.
When pointer scan finish look for a pointer in Client.exe whose offsets are: 540 the first one and 78 the last one, yo probably get more than one of those results, go for the first again and we're set. (540 and 78 are the offsets i found all the time for the last 3 patches, that could change some time...) the result will be a 2 pointer address, the only one we need is the first one (Client.exe+XXXXX) Client.exe starts at 004XXX so if the result is: Client.Exe+005D7914 the addres we need is: 009D7914 and thats all, thats the address we need to put in addresses.lua in tablesBase like this: tablesBase = 0x9D7914,
I hope this makes any sense because i'm really tired, didn't sleep the last 2 nights because of work... But more than that, i hope it helps to get someone else that can do this besides me...