Player information

[KillerJohn]

Well, I'm stuck
This is what I know:

- player data is available only in-game (in tObData)
- I can read MY player index from CObLocal
- the character's seed (like in Armory links) can be found at tObData + 0x7448 (0x7450 is the character's name)

- player data is NOT available in menu
- however I can read the current character's name from "Root.NormalLayer.BattleNetCampaign_main.LayoutRoot.Slot1.LayoutRoot.Portrait.te xt"

What I don't know:
- the most important: how can I read the player's seed in menu where I can't access tObData
- how can I know which party icon (like "Root.NormalLayer.portraits.stack.party_stack.portrait_0.Frame") belongs to a specific player structure. Your player's character always has the 0. icon, but others are completely messed up when people leave and re-enter the game or the party...


I hope somebody solved this before me, because I'm stuck. Completely.

[boredevil]

Can´t help with the out of game problem.
But maybe this can help.

at 0x00EB6320

int __cdecl D3::GetPlayerByIndex(int a1)
{
  int result; // eax@2

  if ( a1 == -1 )
    result = 0;
  else
    result = *(_DWORD *)(**(_DWORD **)TlsGetValue(dwTlsIndex) + 0xB0) + 0x8598 * a1 + 0x58;
  return result;
} 

returned object
+0x04 = acdguid
+0x08 = ractorguid

i didn´t test it for multipe players. but that seems to be correct assuming the local player got index 0. so it could be the indexes match up with the party frames

[KillerJohn]

Can´t help with the out of game problem.
But maybe this can help.

at 0x00EB6320

int __cdecl D3::GetPlayerByIndex(int a1)
{
  int result; // eax@2

  if ( a1 == -1 )
    result = 0;
  else
    result = *(_DWORD *)(**(_DWORD **)TlsGetValue(dwTlsIndex) + 0xB0) + 0x8598 * a1 + 0x58;
  return result;
} 

returned object
+0x04 = acdguid
+0x08 = ractorguid

i didn´t test it for multipe players. but that seems to be correct assuming the local player got index 0. so it could be the indexes match up with the party frames

Yeah, I know this, thanks. And no, the local player index is NOT always 0 (except when you created the game). Especially when you join a game - then you just get a free slot in that game.

[enigma32]

I've found the following structure in memory using CheatEngine, but not yet a static pointer path.. An array with these gets populated when it retrieves the hero list during login.

// SizeOf = 368 (0x170)
struct Character {
  0x044: int Seed1;
  0x104: int Seed2;
  0x110: char* Name; // MaxLength = 152
}

Seed1 contains the same value as Seed2, no idea why it's repeated.
I'll continue to work on it.

[KillerJohn]

I've found the following structure in memory using CheatEngine, but not yet a static pointer path.. An array with these gets populated when it retrieves the hero list during login.

// SizeOf = 368 (0x170)
struct Character {
  0x044: int Seed1;
  0x104: int Seed2;
  0x110: char* Name; // MaxLength = 152
}

Seed1 contains the same value as Seed2, no idea why it's repeated.
I'll continue to work on it.

Maybe this is the list of your own characters, not the ones in the current party. Sounds good, I hope that you can find a static path!
I love you!

[enigma32]

Maybe this is the list of your own characters, not the ones in the current party. Sounds good, I hope that you can find a static path!
I love you!

I got the impression you wanted the seed for you own character This works for me:

while (true)
{
	int val1 = engine.Memory.Read<int>(0x01726FE4);
	int val2 = engine.Memory.Read<int>(val1 + 0x04);
	int val3 = engine.Memory.Read<int>(val2 + 0x9C);

	Console.Clear();
	Console.WriteLine("0x" + val1.ToString("X8"));
	Console.WriteLine("0x" + val2.ToString("X8"));
	Console.WriteLine("0x" + val3.ToString("X8") +
		(val3 == 0 ? " (NULL)" : ""));

	if (val3 != 0)
	{
		int count = engine.Memory.Read<int>(val3 + 0x9C);
		int array = engine.Memory.Read<int>(val3 + 0xAC);
		Console.WriteLine("Array: 0x" + array.ToString("X8"));
		Console.WriteLine("Count: " + count);
		for (int i = 0; i < count; i++)
		{
			int item = array + i * 0x170;

			int seed1 = engine.Memory.Read<int>(item + 0x044);
			int seed2 = engine.Memory.Read<int>(item + 0x104);

			int namePtr = engine.Memory.Read<int>(item + 0x110);
			byte[] buffer = engine.Memory.ReadBytes(namePtr, 152);
			string name = Encoding.ASCII.GetString(buffer).Split('\0')[0];

			Console.WriteLine("Character[" + i + "]: { Name: " + name + ", Seed1: " + seed1 + ", Seed2: " + seed2 + " }");
		}
	}
	System.Threading.Thread.Sleep(100);
}

[enigma32]

Here comes the information I've been able to make sense of Hopefully some of it can be of use
Could not find an index or flag saying what character was selected, kinda sucks.

[[[0x01726FE4] + 0x04] + 0x9C] This is the address of the "Root". If it is zero/0/null the client has not logged in.
"Root"+0x9C: NumberOfCharacters
"Root"+0xAC: CharacterContainer*

// SizeOf = 48 (0x30)
struct CharacterContainer {
  0x004: int AllocationStart;
  0x00C: int Capacity;
  0x010: int ItemSize;
  0x014: int ItemCount;
  0x020: int FreeCount;
  0x028: int AllocationEnd;
}

Not sure if it belongs in the container, but it is followed by an int that is either "0xFEEDFACE" (container empty), or "0x600DFOOD" (has been populated).

NOTE: When deleting a character, it will not be removed immediately from the container. That means ItemCount != NumberOfCharacters.

// SizeOf = 368 (0x170)
struct Character {
  0x010: int Seed1;
  0x0D0: int Seed2;
  0x0DC: char* Name; // MaxLength = 152 (distance between the strings in memory)
  0x0E4: int OnlineStatus; // 0 per default, 1: available, 2: away, 3: busy (this is per character, makes little sense)
  0x0F4; int Level;
  0x0F8; int ???; // 0 per default, then 1 if character has been selected but currently unselected or in character selection
  0x0FC; int ParagonLevel;
  0x15C; int PlayedInSeconds;
  0x164; long Created; // microseconds since epoch
  0x16C; long LastPlayed; // microseconds since epoch
}

Anything with a time is updated after leaving a game. The rest updates live.

Converting the timestamps for .NET:
DateTime epoch = new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc);
DateTime utcDateTime = epoch.AddMilliseconds(microsecondsSinceEpoch / 1000);

And a take-it-or-leave-it example:

while (true)
{
	int val1 = engine.Memory.Read<int>(0x01726FE4);
	int val2 = engine.Memory.Read<int>(val1 + 0x04);
	int val3 = engine.Memory.Read<int>(val2 + 0x9C);

	Console.Clear();
	Console.WriteLine("0x" + val1.ToString("X8"));
	Console.WriteLine("0x" + val2.ToString("X8"));
	Console.WriteLine("0x" + val3.ToString("X8") +
		(val3 == 0 ? " (NULL)" : ""));

	if (val3 != 0)
	{
		int count = engine.Memory.Read<int>(val3 + 0x9C);
		int array = engine.Memory.Read<int>(val3 + 0xAC);

		int allocationBeginsAt = engine.Memory.Read<int>(array + 0x004);
		int capacity = engine.Memory.Read<int>(array + 0x00C);
		int itemSize = engine.Memory.Read<int>(array + 0x010);
		int itemCount = engine.Memory.Read<int>(array + 0x014);
		int freeCount = engine.Memory.Read<int>(array + 0x020);
		int allocationEndsAt = engine.Memory.Read<int>(array + 0x028);
		int goodFood = engine.Memory.Read<int>(array + 0x030); // 0xFEEDFACE || 0x600DF00D

		Console.WriteLine("Array: 0x" + array.ToString("X8"));
		Console.WriteLine("Count: " + count);
		for (int i = 0; i < itemCount; i++)
		{
			int item = allocationBeginsAt + i * itemSize;

			int seed1 = engine.Memory.Read<int>(item + 0x010);
			int seed2 = engine.Memory.Read<int>(item + 0x0D0);
			int unknown1 = engine.Memory.Read<int>(item + 0x0D8);

			int namePtr = engine.Memory.Read<int>(item + 0x0DC);
			byte[] buffer = engine.Memory.ReadBytes(namePtr, 152);
			string name = Encoding.ASCII.GetString(buffer).Split('\0')[0];

			int onlinestatus = engine.Memory.Read<int>(item + 0x0E4); // 0: not defined, 1: online, 2: afk, 3: busy (character specific value)
			int inactive = engine.Memory.Read<int>(item + 0x0E8); // starts off as 0, then set to 1 whenever going from selected -> unselected, possibly an update/cache flag?
			int level = engine.Memory.Read<int>(item + 0x0F4);
			int possibleFlag = engine.Memory.Read<int>(item + 0x0F8); // 0 for last index
			int paragon = engine.Memory.Read<int>(item + 0x0FC);

			int dead = engine.Memory.Read<int>(item + 0x138);
			int playedSeconds = engine.Memory.Read<int>(item + 0x15C);
			TimeSpan played = new TimeSpan(0, 0, playedSeconds);

			DateTime epoch = new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc);
			long createdInEpochMicroseconds = engine.Memory.Read<long>(item + 0x160);
			long lastPlayedInEpochMicroseconds = engine.Memory.Read<long>(item + 0x168);
			DateTime created = epoch.AddMilliseconds(createdInEpochMicroseconds / 1000);
			DateTime lastPlayed = epoch.AddMilliseconds(lastPlayedInEpochMicroseconds / 1000);

			Console.ForegroundColor = inactive == 0 ? ConsoleColor.Red : ConsoleColor.Green;
			Console.WriteLine("Character[" + i + "]: { Name: " + name + ", Seed1: " + seed1 + ", Seed2: " + seed2 + ", Inactive: " + inactive + ", Level: " + level + ", Paragon: " + paragon + " }");
			Console.ResetColor();
		}
	}
	System.Threading.Thread.Sleep(100);
}

[KillerJohn]

I... Cant... Find... A... Word... Omg

here comes the information i've been able to make sense of hopefully some of it can be of use
could not find an index or flag saying what character was selected, kinda sucks.

[[[0x01726fe4] + 0x04] + 0x9c] this is the address of the "root". If it is zero/0/null the client has not logged in.
"root"+0x9c: Numberofcharacters
"root"+0xac: Charactercontainer*

// sizeof = 48 (0x30)
struct charactercontainer {
  0x004: Int allocationstart;
  0x00c: Int capacity;
  0x010: Int itemsize;
  0x014: Int itemcount;
  0x020: Int freecount;
  0x028: Int allocationend;
}

not sure if it belongs in the container, but it is followed by an int that is either "0xfeedface" (container empty), or "0x600dfood" (has been populated).

Note: When deleting a character, it will not be removed immediately from the container. That means itemcount != numberofcharacters.

// sizeof = 368 (0x170)
struct character {
  0x010: Int seed1;
  0x0d0: Int seed2;
  0x0dc: Char* name; // maxlength = 152 (distance between the strings in memory)
  0x0e4: Int onlinestatus; // 0 per default, 1: Available, 2: Away, 3: Busy (this is per character, makes little sense)
  0x0f4; int level;
  0x0f8; int ???; // 0 per default, then 1 if character has been selected but currently unselected or in character selection
  0x0fc; int paragonlevel;
  0x15c; int playedinseconds;
  0x164; long created; // microseconds since epoch
  0x16c; long lastplayed; // microseconds since epoch
}

anything with a time is updated after leaving a game. The rest updates live.

Converting the timestamps for .net:
Datetime epoch = new datetime(1970, 1, 1, 0, 0, 0, datetimekind.utc);
datetime utcdatetime = epoch.addmilliseconds(microsecondssinceepoch / 1000);

and a take-it-or-leave-it example:

while (true)
{
	int val1 = engine.memory.read<int>(0x01726fe4);
	int val2 = engine.memory.read<int>(val1 + 0x04);
	int val3 = engine.memory.read<int>(val2 + 0x9c);

	console.clear();
	console.writeline("0x" + val1.tostring("x8"));
	console.writeline("0x" + val2.tostring("x8"));
	console.writeline("0x" + val3.tostring("x8") +
		(val3 == 0 ? " (null)" : ""));

	if (val3 != 0)
	{
		int count = engine.memory.read<int>(val3 + 0x9c);
		int array = engine.memory.read<int>(val3 + 0xac);

		int allocationbeginsat = engine.memory.read<int>(array + 0x004);
		int capacity = engine.memory.read<int>(array + 0x00c);
		int itemsize = engine.memory.read<int>(array + 0x010);
		int itemcount = engine.memory.read<int>(array + 0x014);
		int freecount = engine.memory.read<int>(array + 0x020);
		int allocationendsat = engine.memory.read<int>(array + 0x028);
		int goodfood = engine.memory.read<int>(array + 0x030); // 0xfeedface || 0x600df00d

		console.writeline("array: 0x" + array.tostring("x8"));
		console.writeline("count: " + count);
		for (int i = 0; i < itemcount; i++)
		{
			int item = allocationbeginsat + i * itemsize;

			int seed1 = engine.memory.read<int>(item + 0x010);
			int seed2 = engine.memory.read<int>(item + 0x0d0);
			int unknown1 = engine.memory.read<int>(item + 0x0d8);

			int nameptr = engine.memory.read<int>(item + 0x0dc);
			byte[] buffer = engine.memory.readbytes(nameptr, 152);
			string name = encoding.ascii.getstring(buffer).split('\0')[0];

			int onlinestatus = engine.memory.read<int>(item + 0x0e4); // 0: Not defined, 1: Online, 2: Afk, 3: Busy (character specific value)
			int inactive = engine.memory.read<int>(item + 0x0e8); // starts off as 0, then set to 1 whenever going from selected -> unselected, possibly an update/cache flag?
			Int level = engine.memory.read<int>(item + 0x0f4);
			int possibleflag = engine.memory.read<int>(item + 0x0f8); // 0 for last index
			int paragon = engine.memory.read<int>(item + 0x0fc);

			int dead = engine.memory.read<int>(item + 0x138);
			int playedseconds = engine.memory.read<int>(item + 0x15c);
			timespan played = new timespan(0, 0, playedseconds);

			datetime epoch = new datetime(1970, 1, 1, 0, 0, 0, datetimekind.utc);
			long createdinepochmicroseconds = engine.memory.read<long>(item + 0x160);
			long lastplayedinepochmicroseconds = engine.memory.read<long>(item + 0x168);
			datetime created = epoch.addmilliseconds(createdinepochmicroseconds / 1000);
			datetime lastplayed = epoch.addmilliseconds(lastplayedinepochmicroseconds / 1000);

			console.foregroundcolor = inactive == 0 ? Consolecolor.red : Consolecolor.green;
			console.writeline("character[" + i + "]: { name: " + name + ", seed1: " + seed1 + ", seed2: " + seed2 + ", inactive: " + inactive + ", level: " + level + ", paragon: " + paragon + " }");
			console.resetcolor();
		}
	}
	system.threading.thread.sleep(100);
}

[KillerJohn]

+0xEC is the character class
0 = dh, 1 = barb, 2 = wiz, 3 = wd, 4 = monk

+0x10C seems to be the difficulty of the character

the only thing I need is to find the selected character
You are a genius, sir. I'm nowhere near to use CheatEngine as efficient as you.

[KillerJohn]

I got the impression you wanted the seed for you own character This works for me:

Of course I want the seed of my own, selected character. People would love a real per-account per-character stat-tracker in TurboHUD, but for that I have to get the unique ID (seed) of the currently selected character. What you did there with the character list is insane! I'm sure that HUD users (with me) will adore you if you can find a pointer to the currently selected characters seed or index.

[enigma32]

Thank you, glad I can be of assistance. And challenge accepted!

For the big block of unidentified behavior, I believe most of it is bitflags for conversations made, lore learned and quests completed. I base that on the protobuf information I could find here: https://github.com/zku/Diablo-III-Pr...to/Hero_pb2.py (best source I could find)

[KillerJohn]

Your offets are working for me, but for my beta testers [0x01726FE4] is zero

mine:


on other computer the first pointer is already wrong:

[enigma32]

Couldn't find an indexer or pointer sadly Until a better solution is found, one can retrieve the current character name from the following UI element if outside a game:

Name: Root.NormalLayer.BattleNetCampaign_main.LayoutRoot.Slot1.LayoutRoot.Portrait.text
Hash: 0xC213F9005C737FEF

or ObjectManager alt. tObData inside a game and match that against the list. There's probably a brief moment where the name can't be read from either location.

Some more values identified, updates when leaving game.
0x150: int LastPlayedQuest
0x154: int LastPlayedQuestStep // bitflags or number keeping track of the quest state, like what checkpoint is active and how much is done, -1 for fresh quest.

[KillerJohn]

Couldn't find an indexer or pointer sadly Until a better solution is found, one can retrieve the current character name from the following UI element if outside a game:

Name: Root.NormalLayer.BattleNetCampaign_main.LayoutRoot.Slot1.LayoutRoot.Portrait.text
Hash: 0xC213F9005C737FEF

or ObjectManager alt. tObData inside a game and match that against the list. There's probably a brief moment where the name can't be read from either location.

Some more values identified, updates when leaving game.
0x150: int LastPlayedQuest
0x154: int LastPlayedQuestStep // bitflags or number keeping track of the quest state, like what checkpoint is active and how much is done, -1 for fresh quest.

Nice, thank you for the new fields. Do you have any idea about why is that the offsets are not working for some people? (all other addresses arre good for them)

Btw using the character name is not a solution because for example I have 5 characters with the same name

[enigma32]

Your offets are working for me, but for my beta testers [0x01726FE4] is zero

mine:


on other computer the first pointer is already wrong:

What you get from 0x01726FE4 changes with the process, but 0 is obviously not good for anything... I switched server to see if that made any difference. It did not, but my account got blocked for suspicious behavior, lol... There was also a small update it seemed when I restarted client, but that did not break anything for me.

These are the 3 paths I found from start, maybe another one works better:
[[[0x01726FE4] + 0x04] + 0x9C]
[[[0x017A388C] + 0x04] + 0x9C]
[[[0x017F6874] + 0x10] + 0x9C]