Gurud's PoE Trainer FullBight, Maphack and Zoomhack 1.0.0.e+

[DaxxTrias]

EDIT : Script now working (hit Edit script in CE on right click context menu and go figure, Enable was listed twice before the script, but still confused - why cant i find those AOB if i search manually?

Useing the non steam version of the game, i cant even find the AOB: 76 04 8d 44 24 10 d9 00 d9 on the memory viewer --- I wonder why it works for all but me?

Edit: Just tested the other 2 AOB too and nothing found on all 3.
Windows 7 64x

When you search, I assume you're doing it inside the memory viewer. I'm also assuming you use the search memory option, and in there are entering the search as an array of bytes.

You also need to make sure the From/To box is accurate. CE has a dirty habit of adjusting the from to whatever area you are looking at. I always change it back to the default 00400000

It doesn't make much sense that the only reason I can search out an array is because of my customized, obfuscated svn build of CE

Screenshot
https://i.imgur.com/yh0dtgG.png

[alucard1]

Daxx, does the function that needs to be changed for zoom hack always appear around the same area, because I've noticed that only one byte was changed from the previous one, Was wondering, if I made a small list of AoB scans to find things that are already near it, if I can than use those, to get me back to the right area to update the AoB scan for the zoomhack.

[DaxxTrias]

Daxx, does the function that needs to be changed for zoom hack always appear around the same area, because I've noticed that only one byte was changed from the previous one, Was wondering, if I made a small list of AoB scans to find things that are already near it, if I can than use those, to get me back to the right area to update the AoB scan for the zoomhack.

The majority of the time, patches are small. Incremental. Usually all that changes is the address, but once in a while they'll change a few parts of the code we use. Rarely (unless an overhaul to the backend, or active countermeasures against us) do they re-write entire subroutines.

You can setup a scanning platform that finds an address prior to what you want, label it, then stick a + var onto the label to get what you want. Gurud has several examples of this inside the FullBright

Example:

you want PoE.exe+1608

So you AOB scan and get the coordinate before it, at PoE.exe+1600

Then take that AOB scan result label, and tag it with a +8. Voila.

aoblight1+2: <---
light1:
dd (float)7500

Thats one way to do it. The way I do it however is more manual, I prefer always having to dig inside the code if theres only a few offsets I need to keep track of. Keeps me sharp, and I just like doing it.

So I'll take an entire codeblock, lets say:

PathOfExileSteam.exe+1C9730 - 83 EC 0C - sub esp,0C
PathOfExileSteam.exe+1C9733 - 56 - push esi
PathOfExileSteam.exe+1C9734 - 57 - push edi
PathOfExileSteam.exe+1C9735 - 8B 7C 24 1C - mov edi,[esp+1C]
PathOfExileSteam.exe+1C9739 - 80 3F 00 - cmp byte ptr [edi],00
PathOfExileSteam.exe+1C973C - 8B F1 - mov esi,ecx
PathOfExileSteam.exe+1C973E - 75 69 - jne PathOfExileSteam.exe+1C97A9
PathOfExileSteam.exe+1C9740 - E8 EB0A0200 - call PathOfExileSteam.exe+1EA230
PathOfExileSteam.exe+1C9745 - 50 - push eax
PathOfExileSteam.exe+1C9746 - E8 F5540200 - call PathOfExileSteam.exe+1EEC40
PathOfExileSteam.exe+1C974B - 84 C0 - test al,al
PathOfExileSteam.exe+1C974D - 74 5A - je PathOfExileSteam.exe+1C97A9
PathOfExileSteam.exe+1C974F - 66 0F6E 47 18 - movd xmm0,[edi+18]
PathOfExileSteam.exe+1C9754 - 0F57 C9 - xorps xmm1,xmm1
PathOfExileSteam.exe+1C9757 - F3 0F10 15 C8477A00 - movss xmm2,[PathOfExileSteam.std::_Mutex::_Mutex+14FEC0]
PathOfExileSteam.exe+1C975F - 0F5B C0 - cvtdq2ps xmm0,xmm0
PathOfExileSteam.exe+1C9762 - F3 0F59 05 BC287600 - mulss xmm0,[PathOfExileSteam.std::_Mutex::_Mutex+10DFB4]
PathOfExileSteam.exe+1C976A - F3 0F58 86 A8160000 - addss xmm0,[esi+000016A8]
PathOfExileSteam.exe+1C9772 - 0F2F C8 - comiss xmm1,xmm0
PathOfExileSteam.exe+1C9775 - F3 0F11 44 24 0C - movss [esp+0C],xmm0
PathOfExileSteam.exe+1C977B - F3 0F11 4C 24 1C - movss [esp+1C],xmm1
PathOfExileSteam.exe+1C9781 - F3 0F11 54 24 10 - movss [esp+10],xmm2
PathOfExileSteam.exe+1C9787 - 8D 44 24 1C - lea eax,[esp+1C]
PathOfExileSteam.exe+1C978B - 77 04 - ja PathOfExileSteam.exe+1C9791
PathOfExileSteam.exe+1C978D - 8D 44 24 0C - lea eax,[esp+0C]
PathOfExileSteam.exe+1C9791 - F3 0F10 00 - movss xmm0,[eax]
PathOfExileSteam.exe+1C9795 - 0F2F C2 - comiss xmm0,xmm2
PathOfExileSteam.exe+1C9798 - 76 04 - jna PathOfExileSteam.exe+1C979E <-- zoom1
PathOfExileSteam.exe+1C979A - 8D 44 24 10 - lea eax,[esp+10]
PathOfExileSteam.exe+1C979E - D9 00 - fld dword ptr [eax]
PathOfExileSteam.exe+1C97A0 - D9 9E A8160000 - fstp dword ptr [esi+000016A8]
PathOfExileSteam.exe+1C97A6 - C6 07 01 - mov byte ptr [edi],01
PathOfExileSteam.exe+1C97A9 - 5F - pop edi
PathOfExileSteam.exe+1C97AA - 5E - pop esi
PathOfExileSteam.exe+1C97AB - 83 C4 0C - add esp,0C
PathOfExileSteam.exe+1C97AE - C2 0800 - ret 0008
PathOfExileSteam.exe+1C97B1 - CC - int 3

That way when patch times come, I have lots of bytes to work with to make a pattern.

I also keep a backup, and that is the IDA diassembler. If something drastic happens, I can fallback on that and compare between versions at a much more refined level then CE provides.

[alucard1]

Your second code bracket is pretty much what I've done, i took all that so i can go up/down to look for the particular portion I want/need. Glad to know I'm on the right track, just looking at it I see which one I want. Thanks.

Now I just need them to break zoomhack again to see if I can sort it out myself.

[darkbluefirefly]

but how do you know that's the zoom function?? like how did you figure out that that function controls the zoom? thanks!

[DaxxTrias]

but how do you know that's the zoom function?? like how did you figure out that that function controls the zoom? thanks!

Wrong person to be asking, I didn't write any of the functions in Gurud's script. That'd be Gurud and Wrongusername that should be asked that question.

I'm not one to reinvent the wheel, but its entirely possible i'd have taken a different route to come up with the hacks myself. I didn't have to though.

[gurud]

Gurud' was working fine in every regard except Zoom. So Zoom was the only one I touched.

Only thing my personal copy has that you guys don't have is a customized full-bright (different bright settings) and 1 or 2 more bug-fixes to symbol registers.

Thank's for saving me the trouble, i was traveling till now, i updated the trainer in the first post, also in regards to FullBright if you check my code i have a No-mist hack inside it for extra brightness in misty maps, (most of them). Also if you found a better value to light just post it for me to update ^^

but how do you know that's the zoom function?? like how did you figure out that that function controls the zoom? thanks!

Well for what i've seen looking at the two addresses for the zoom function in olly debugger, they are both localized near a Call for d3dx.perspective module, so my guess is that SKU the creator of zoomhack looked in olly debugger for the string "perspective" and changed w/e was near that word till he found that.

But if you want a simpler approach you could just go in full zoom and look for "1" float (meaning 100%). decrase the view and look for less, etc, when you find only 1 adress you can change it to what you want. the bigger problem is the black square that will appear when you zoom out too muth, i didn't look into it because there was already a working zoomhack.

[DaxxTrias]

Thank's for saving me the trouble, i was traveling till now, i updated the trainer in the first post, also in regards to FullBright if you check my code i have a No-mist hack inside it for extra brightness in misty maps, (most of them). Also if you found a better value to light just post it for me to update ^^

Not a problem. I sat on it for a while because I thought you would show up. In any event, I'm working on a little personal side project for PoE atm, once that is done I'll see about tossing some stuff your way.

[SummerDaysAhead]

I managed to get search to work, no idea why it wasnt working before as i was doing exactly what you explained. I even put it to 00000000 to 7FFFFFFF to make sure im gettin the whole thing heh

Had problems with top part of memory viewer not displayin correctly but fixed that problem. Now just need to find a way to understand why these were the values to search for and how to know what to change the values to in order to get desired effect, I would hate to imagine it was all guesswork once he search for perspective but so far thats alot of what ive done in order to be successful in other CE attempts. Id love to find tutorials on how to do this correctly.

I hadnt thought to use olly yet, thx for the reminder. gona have to look at the stuff in there too now -- is there any other tools that are being used successfully on PoE


Thanks for the help.

[gurud]

I would hate to imagine it was all guesswork once he search for perspective but so far thats alot of what ive done in order to be successful in other CE attempts. Id love to find tutorials on how to do this correctly.

I hadnt thought to use olly yet, thx for the reminder. gona have to look at the stuff in there too now -- is there any other tools that are being used successfully on PoE

Thanks for the help.

Not really guesswork, since next to the call for d3dx9_42.D3DXMatrixPerspectiveFovLH would be very likely to have instructions related to zoom.
He would test it by changing jumps, nopping things, etc... after lots of games crashes he would have found something.
d3dx9 stands for Directx 3d 9 release 42 and it's the API used for this game, and at this point is referring to the perspective.... so... yehh...

API - Wikipedia, the free encyclopedia

This is the code i saved from olly patch 1.0.0c i guess

006A9BB6   81EC 84000000    SUB ESP,84
006A9BBC   53               PUSH EBX
006A9BBD   8B5D 08          MOV EBX,DWORD PTR SS:[EBP+8]
006A9BC0   F3:0F1083 880100>MOVSS XMM0,DWORD PTR DS:[EBX+188]                                    ; zoom2
006A9BC8   56               PUSH ESI
006A9BC9   57               PUSH EDI
006A9BCA   83EC 10          SUB ESP,10
006A9BCD   F3:0F114424 0C   MOVSS DWORD PTR SS:[ESP+C],XMM0
006A9BD3   F3:0F1083 840100>MOVSS XMM0,DWORD PTR DS:[EBX+184]
006A9BDB   894C24 1C        MOV DWORD PTR SS:[ESP+1C],ECX
006A9BDF   DB4424 1C        FILD DWORD PTR SS:[ESP+1C]
006A9BE3   898B 8C010000    MOV DWORD PTR DS:[EBX+18C],ECX
006A9BE9   8983 90010000    MOV DWORD PTR DS:[EBX+190],EAX
006A9BEF   894B 04          MOV DWORD PTR DS:[EBX+4],ECX
006A9BF2   8943 08          MOV DWORD PTR DS:[EBX+8],EAX
006A9BF5   F3:0F114424 08   MOVSS DWORD PTR SS:[ESP+8],XMM0
006A9BFB   85C9             TEST ECX,ECX
006A9BFD   79 06            JNS SHORT PathOfEx.006A9C05
006A9BFF   D805 D4B89400    FADD DWORD PTR DS:[94B8D4]
006A9C05   D88B 94010000    FMUL DWORD PTR DS:[EBX+194]
006A9C0B   894424 1C        MOV DWORD PTR SS:[ESP+1C],EAX
006A9C0F   DB4424 1C        FILD DWORD PTR SS:[ESP+1C]
006A9C13   85C0             TEST EAX,EAX
006A9C15   79 06            JNS SHORT PathOfEx.006A9C1D
006A9C17   D805 D4B89400    FADD DWORD PTR DS:[94B8D4]
006A9C1D   DEF9             FDIVP ST(1),ST
006A9C1F   F3:0F1083 800100>MOVSS XMM0,DWORD PTR DS:[EBX+180]
006A9C27   8D4424 20        LEA EAX,DWORD PTR SS:[ESP+20]
006A9C2B   D95C24 04        FSTP DWORD PTR SS:[ESP+4]
006A9C2F   F3:0F110424      MOVSS DWORD PTR SS:[ESP],XMM0
006A9C34   50               PUSH EAX
006A9C35   FF15 581A8300    CALL DWORD PTR DS:[<&d3dx9_42.D3DXMatrixPerspectiveFovLH>]      ; d3dx9_42.D3DXMatrixPerspectiveFovLH
.
.
.
006A9FC5   FF15 1C1A8300    CALL DWORD PTR DS:[<&d3dx9_42.D3DXMatrix>; d3dx9_42.D3DXMatrixMultiply
006A9FCB   DB83 8C010000    FILD DWORD PTR DS:[EBX+18C]
006A9FD1   F3:0F1083 880100>MOVSS XMM0,DWORD PTR DS:[EBX+188]                                          ; zoom3
006A9FD9   8B93 8C010000    MOV EDX,DWORD PTR DS:[EBX+18C]
006A9FDF   83EC 10          SUB ESP,10
006A9FE2   8DAB F4010000    LEA EBP,DWORD PTR DS:[EBX+1F4]
006A9FE8   F3:0F114424 0C   MOVSS DWORD PTR SS:[ESP+C],XMM0
006A9FEE   F3:0F1083 840100>MOVSS XMM0,DWORD PTR DS:[EBX+184]
006A9FF6   B9 10000000      MOV ECX,10
006A9FFB   8D7424 68        LEA ESI,DWORD PTR SS:[ESP+68]
006A9FFF   8BFD             MOV EDI,EBP
006AA001   F3:A5            REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
006AA003   F3:0F114424 08   MOVSS DWORD PTR SS:[ESP+8],XMM0
006AA009   85D2             TEST EDX,EDX
006AA00B   79 06            JNS SHORT PathOfEx.006AA013
006AA00D   D805 D4B89400    FADD DWORD PTR DS:[94B8D4]
006AA013   8B83 90010000    MOV EAX,DWORD PTR DS:[EBX+190]
006AA019   D88B 94010000    FMUL DWORD PTR DS:[EBX+194]
006AA01F   DB83 90010000    FILD DWORD PTR DS:[EBX+190]
006AA025   85C0             TEST EAX,EAX
006AA027   79 06            JNS SHORT PathOfEx.006AA02F
006AA029   D805 D4B89400    FADD DWORD PTR DS:[94B8D4]
006AA02F   DEF9             FDIVP ST(1),ST
006AA031   F3:0F1083 800100>MOVSS XMM0,DWORD PTR DS:[EBX+180]
006AA039   8D8C24 E8000000  LEA ECX,DWORD PTR SS:[ESP+E8]
006AA040   D95C24 04        FSTP DWORD PTR SS:[ESP+4]
006AA044   F3:0F110424      MOVSS DWORD PTR SS:[ESP],XMM0
006AA049   51               PUSH ECX
006AA04A   FF15 581A8300    CALL DWORD PTR DS:[<&d3dx9_42.D3DXMatrix>; d3dx9_42.D3DXMatrixPerspectiveFovLH

But like i said this is not an easy method, at least for me xD

[maquino85]

What's the difference between the two versions?

[SummerDaysAhead]

Ok, PerspectiveFov would def have grabbed my attention too, now i know what to try out on next game and see if i can figure anything out hehe :P

What does FLD1 do? i noticed when i looked at the maphack script all it did was fld1 and then when lookin at a CE on client with it turned on and CE with client not turned on, the opcodes are still identical, only the Address has a Label instead of an address -- Whats happening there?

Also, does this mean multiply 5th on stack with 1st on stack? mulss, xmm4, xmm0? (lookin up other code that uses similar instruction and this is what it looked like it was doing...
So then fullbright1 would be multiplying 5th on stack by PoE+XXXX
And Fullbright2 would be subtracting PoE+XXXX from 5th on stack again?
am i understanding this correct?


Tryin to memorize as much as i can about whats being changed and the addresses in that area and copy/pasting the opcodes/addresses so i can see what happens next patch and try to figure stuff out. So breaking down the script piece by piece tryin to understand whats happening.



Thank you very much for the info... Tried to +Rep ya but cant yet...

[DaxxTrias]

What's the difference between the two versions?

The trainer is standalone. Download, run, enjoy.
The Cheat Table is for people who have Cheat Engine.

Theres Pro's and Con's to both, and I'll simplify it to this:

Trainer is commonplace, easy to use, and highly available. This also makes it a prime target for cheat detection, since loads of people will run an app thats the same size, same checksum, same window title, etc etc.

Cheat Table gives you more freedom. You can not only customize the table scripts if you are knowledgeable enough, you can go a step further and build custom builds of CE, such as what I do. I use a bleeding edge version of CE, what the author puts up daily, then I customize it, and remove any tags it has. This makes it far less likely I'll ever be caught in a snare that looks for file name, file size, checksum, window title, etc.

[gurud]

What does FLD1 do? i noticed when i looked at the maphack script all it did was fld1 and then when lookin at a CE on client with it turned on and CE with client not turned on, the opcodes are still identical, only the Address has a Label instead of an address -- Whats happening there?
Also, does this mean multiply 5th on stack with 1st on stack? mulss, xmm4, xmm0?

The opcodes are not the same when on and off:

ON: mapHack1 - fld1 
OFF: mapHack1 - fld dword ptr [eax]

refer to the link below for the instructions meaning:
x86 instruction listings - Wikipedia, the free encyclopedia

also in your example it would multiply 1st on stack with 5th on stack not the other way around like you said.
in my Fullbright:
mulpd xmm1,xmm1 //means you are multiplying the last xmm1 with the first xmm1.
movq [edi+00000150],xmm1 //means you are Moving xmm1 to the address of edi+150

So then fullbright1 would be multiplying 5th on stack by PoE+XXXX
And Fullbright2 would be subtracting PoE+XXXX from 5th on stack again?
am i understanding this correct?

No idea what you are talking about, where did you get this?

[DaxxTrias]

Okay so my pet project, I'm giving it out. Been playing all day without any problems on it so I'll call it safe to use.

Map Opacity. I wanted it to be more crisp, and while the engine has constraints, I was able to get it a bit more opaque then was normally possible. The inverse is also possible if you read the comment inside the script, incase you are batshit crazy and want no map at all.

Perhaps tomorrow I'll have another gift, prettier than this.

[ENABLE]

alloc(maxopaq,4)
label(opaq)
registersymbol(maxopaq)
registersymbol(opaq)

aobscan(_maxopaq,D9 83 A4 09 00 00 8B 83 64 09 00 00)

maxopaq:
dd 40000000 // set to all zero's to blank the map entirely.

_maxopaq:
opaq:
fld dword ptr [maxopaq]

[DISABLE]

opaq:
fld dword ptr [ebx+000009A4]

dealloc(maxopaq)
unregistersymbol(maxopaq)
unregistersymbol(opaq)