-
Member
hi, risk of getting banned high when reading memory?
Last edited by houseradish; 06-04-2021 at 04:59 PM.
-
Originally Posted by
houseradish
hi, risk of getting banned high when reading memory?
If you are just reading memory and you are using the limited user method, the risk is currently low.
-
Member
Originally Posted by
Sychotix
If you are just reading memory and you are using the limited user method, the risk is currently low.
which option is less risky:
1) opetate with data directly from memory with frequent accesses (without changing them)
2) copy data to an array and process it
Last edited by houseradish; 06-23-2021 at 12:51 PM.
-
Contributor
Originally Posted by
houseradish
which option is less risky:
1) opetate with data directly from memory with frequent accesses (without changing them)
2) copy data to an array and process it
What matters is the mechanism you use to interact with the client.
If you open a process handle and keep it open, they can trace that back to your program.
If you read memory in another obscure way that is uncommon, then the only way they'd be able to trace that is if they had your code to know exactly what you were doing.
For #2 , if you plan to OpenProcess/ReadProcessMemory over and over, then that might have some performance issues, and it would only be "less risky" than #1 because you won't have the handle open to the process all the time, but you could still get detected the same exact way if the stars aligned and they managed to catch you in your small window of memory reading.
With #1 , as long as you have private code, it would be hard to get banned for it simply because plenty of applications open process handles for read access, and they can't verify them all to know if it's being used for cheating or not. As such, you can just piggyback off another legitimate application's handle to read memory the same way and it'd be very hard to get detected because the reads are coming from a legitimate source.
Lastly, you can also use the limited user approach to deny access to your program's files, and that seems to be hard for them to work around due to how Windows works. Limited user + #1 + private code means you should NEVER get banned for simply reading memory in this game. This is why a lot of games just use BE/EAC to protect against memory reading, because unless you're using a driver, it's really hard to stop or limit.
-
Post Thanks / Like - 1 Thanks
Sychotix (1 members gave Thanks to pushedx for this useful post)
-
Member
please comment for what need this fields of struct, i dont understand what i read with this.
TerrainData[0xD8] = StdVector<byte> MeleeLayerPathfindingData
TerrainData[0xF0] = StdVector<byte> RangedLayerPathfindingData
Last edited by houseradish; 07-18-2021 at 05:32 AM.
-
Contributor
Originally Posted by
houseradish
please comment for what need this fields of struct, i dont understand what i read with this.
TerrainData[0xD8] = StdVector<byte> MeleeLayerPathfindingData
TerrainData[0xF0] = StdVector<byte> RangedLayerPathfindingData
You would first read the 3 pointers that comprise the std::vector (in x64 now, since 32-bit client is gone)
Code:
[StructLayout(LayoutKind.Sequential, Pack = 1)]
public struct NativeVector
{
public UIntPtr First; // 0x0 (0x8 bytes)
public UIntPtr Last; // 0x8 (0x8 bytes)
public UIntPtr End; // 0x10 (0x8 bytes)
// End @ 0x18
}
Then, you'd simply read the byte array from First to Last. Ignore End, since that just tells you how big the total underlying buffer really is. All bytes past Last will be unused for the container.
Use simple math to get how many bytes you should read:
Code:
var native = YourMemoryReadingFunction<NativeVector>( ... ); // however your own code is
...
var count = native.Last.ToUInt64() - native.First.ToUInt64();
...
var meleeData = YourMemoryReadingFunctionArray<byte>(native.First, count); // however your own code is
Then, you can use the byte array of data itself as I've shown in my first post in this thread: https://www.ownedcore.com/forums/mmo...ml#post4201469 (Finding map data in memory)
-
Member
winapi func in c# (I have some experience only with him at the moment) is ok for read or i need use something else?
Last edited by houseradish; 08-30-2021 at 01:26 PM.
-
Originally Posted by
houseradish
winapi func in c# (I have some experience only with him at the moment) is ok for read or i need use something else?
ReadProcessMemory would be how you read memory of an application in windows.
-
Member