Memory addresses

[thebluefish]

Quick question... Im a newbie to this stuff but I found player coordinates, health value easily, how exactly do you find mob coordinates and stuff liek IsAggro? any tips would be great! (Beyond "scan for them" pleae )

Well think of the player as an object in the game, and that object stores its own data such as coordinates, health, etc... Enemies would also be objects, and they would each also store their own values. So you would first have to find some table or index of all enemies currently loaded, and then look at information from there.

[Apoc]

Some neat info about the game.

They have a built in teleport function. (1yd range [so thats 10yds in WoW terms])
The also have a built in insta-kill function (requires you to "obtain" an item. Which is trivial to do)
They have a "warp to map note" function. (Yes, you warp to anything on the map that has a tooltip.)

Abilities are incredibly nice to work with in this game, as casting an ability gives you an enum result back telling you if it succeeded, or an error reason otherwise.

The game *does* have a Click-To-Move of sorts. (No, there's no option in game to use CTM as a regular player. )

Also, for those of you looking to do any form of navigation. Rotating the character requires you to write to 3 different addresses. (An animation, behavior, and server-sending address)

The game's input layers are made of awesome and win. Including the GUI stuff. (There's no real "frame" stuff thats easily accessible. Its all HTML/Actionscript based)

I will say however, the most annoying part of this game, is the lack of "ID" for objects. While there's a prototype and template ID, you'll more often than not be relying on a "spec" string. (And we all know, string comparisons are slow as balls.)

[jacrazy]

Well think of the player as an object in the game, and that object stores its own data such as coordinates, health, etc... Enemies would also be objects, and they would each also store their own values. So you would first have to find some table or index of all enemies currently loaded, and then look at information from there.

The problem is I know that, I just am not sure how to do it. For example ive found the dynamic mob array of current target, but i have no clue how to find the static base of the whole array (the health part being pointer scanned multiple times finds no common base) so... yeah, any tips would be greatly appreciated!

[thebluefish]

swtor.exe+0 is 00400000
If you want addresses based on it then you just need to substract 00400000 from the adress I gave.
Thus :
0147F924 = 00400000+0107F924
0147F924 = swtor.exe+0107F924

You addresses also work fine.

Some more addresses :
[0147BB68] + 3C : Player angle, float, in radians, with origin in Y axix
[ [ [ [ [ 10027E8C] + 3B8 ] + 504 ] + 14 ] + 8 ] + 40 : Player health, float, percentage from 0.0 to 100.0

Your address for player angle worked perfectly, player health on the other hand did not. Everytime I get the first address, it's simply 0 and therefore not really much I can do with it. Yes I did make sure to subtract 0z00400000 and add my own base address, but alas it still leads to a dead end. Lucky for me Cheat Engine also freezes my system if I try to do a pointer search v.v

[luthien23]

Bear in mind that player healt only works after it has changed at least once.
If you just log into the game and read the value you get nothing of use out of it.
Also, the address in this thread is old.
Take a at http://www.ownedcore.com/forums/star...ddresses.html]

This thread should rather be locked since it's outdated.

[Distiny]

Some neat info about the game.
The also have a built in insta-kill function (requires you to "obtain" an item. Which is trivial to do)

Share or sell a hack with this function

[Azmodeus]

Some neat info about the game.
I will say however, the most annoying part of this game, is the lack of "ID" for objects. While there's a prototype and template ID, you'll more often than not be relying on a "spec" string. (And we all know, string comparisons are slow as balls.)

Just calculate the hashes and you will save a TON of time. Dont just blindly read the full array, when the hash will take you to within 2-3 reads of the value.

[Apoc]

Just calculate the hashes and you will save a TON of time. Dont just blindly read the full array, when the hash will take you to within 2-3 reads of the value.

What does this have to do with an "ID" ?

I'm well aware of how the DOM lists work, and indexing into them. I was referring to there being no static ID for certain mobs, items, etc. (Excluding maybe the spec string) Something to make bot creation easier. FNV is plenty fast (and unique) enough to do whats needed for ID purposes.

Besides; you shouldn't be iterating the global nodes list unless you're doing some form of debugging or similar. (I only ever iterate it once to pull a bunch of the "Oracle" classes, and some input handlers. Aside from that, there's another DOM list with nothing but (N)PCs in it which is safer to iterate often. (There's typically 35k nodes in the global DOM list from the GOM. Thats incredibly slow to iterate. Fairly fast to do lookups by node ID. Its just a hashmap of sorts)

[Azmodeus]

I guess I misunderstood then because I have not found anything yet that does not have an id... atleast for my bot. PCs, Stats, NPCs (interactable).

I havnt delved much into the items, spells, and other things, so maybe I have a challenge yet ahead of me.

[Zero1234]

Does anyone know the memory address for credits? I am developing a simple credits per hour script that writes to file.

[Apoc]

I guess I misunderstood then because I have not found anything yet that does not have an id... atleast for my bot. PCs, Stats, NPCs (interactable).

I havnt delved much into the items, spells, and other things, so maybe I have a challenge yet ahead of me.

I'm talking ID as like; Imperial Medical Droid's ID is 533 (and all of them share the same "533" ID) Instead of their spec string imperial.droid.medical (or w/e it actually is)

[Sirmabus]

Sure the nodes have IDs.
I found more then one "LPNODE GetNodeByID(UINT64 uID)" type function.

If we are talking about the same thing anyhow.

As I recall the high 32bits of the ID look similar to WOW, LOTRO, etc., in that the high bits are like a class/type.
But then I'm a bit rusty not having looked at SWTOR for several weeks (just been playing it).
I'll have to do a dump and look again to be sure once I get everything updated to the current client.

The ID function(s) used to be easily found by be string references which were merged with other strings as some sort of ID/hashcodes as you probably know in the last one or two beta clients. And which one of the last things I did was dump all these strings out and make an IDA plug-in to string label what ever matching static codes it can find.

[Nomoko]

Hey can anyone help me to get the new angle address? my addresses have been changed since the last patch and im having a hard time to find the correct addresses for the angle. Thanks in advance!

[Apoc]

Sure the nodes have IDs.
I found more then one "LPNODE GetNodeByID(UINT64 uID)" type function.

If we are talking about the same thing anyhow.

As I recall the high 32bits of the ID look similar to WOW, LOTRO, etc., in that the high bits are like a class/type.
But then I'm a bit rusty not having looked at SWTOR for several weeks (just been playing it).
I'll have to do a dump and look again to be sure once I get everything updated to the current client.

The ID function(s) used to be easily found by be string references which were merged with other strings as some sort of ID/hashcodes as you probably know in the last one or two beta clients. And which one of the last things I did was dump all these strings out and make an IDA plug-in to string label what ever matching static codes it can find.

Yes, you can do some quick determination on a few node IDs (or definition IDs rather) but actual NPC-specific ones, there doesn't seem to be much correlation. At best you'd have to use the spec strings to determine more "generic" NPC ID's. (Again; not talking about node IDs!) If you manage to find anything more useful out of the IDs, please do let me know. Until then I'll continue using the template/proto names. (Well, hashes of them) Keep in mind; prototypes (eg; abilities, specific placeables, etc) have static IDs that do not change. (You can look them up in the assets by their proto ID) Most "nodes" start with 0xE000........ Prototypes start with 0xD000 if I remember correctly. (I'll check that again later) But "SystemNodes" (eg; RefSystemNode) also use 0xE000.... most of the time, but can use 0xD000.... See the bottom of the post for a script dump example.

Also; the native script funcs (Eg; GetNodeByID, GetPrototypeById, GetPosition_w, etc) are now just referenced by the hash of the func name. (I think only 1 func has been removed since the beta? I may be wrong.)

Lastly; there's only 1 native script function "GetNodeByID" (I'll check my script func enum to double check, but yea). Bioware registers a bunch of native script functions, not all of them directly in .text. (Some are stored in .data as an array of structs with hash->func which tends to throw IDA off for whatever reason)

RefSystemNode(TYPE_NodeRef_strOracle__2, &v24, 0xE0008D91C6EABF3EuLL);    v12 = PrepareCallNodeRef2(FUNC_LocalizeStringWithTokenList, &v24, &v27);
    ((void (__cdecl *)(int, int, int, int, int, int))v12)(v6, v27, v7, v8 | 0x17, v10, v11);
    UnprepareCall();
    CopyValueString(v25, v6);
    TrackLine(590);
    v13 = v25;
    ConstructNodeRef(TYPE_NodeRef_guiApi__7, &v23);
    RefSystemNode(TYPE_NodeRef_guiApiFactory__8, &v22, 0xE000AC6ACCDACC39uLL);
    v14 = PrepareCallNodeRef2(FUNC_getApi, &v22, &v27);

[abdula123]

some thoughts about UI:

1. for user interface (panels, buttons, map, quest log, etc) in SWTOR BioWare does use Scaleform_GFx - Scaleform - Wikipedia, the free encyclopedia - (like they do in MassEffect and DragonAge games)
2. when we say Lenin, we mean The Communist Party.... er... Scaleform_GFx is just a Flash-with-GPU-support. And Flash with own virtual machine is loosely coupled with other game engine parts.


to pass game events to UI used "registerInvokeListener" mechanism on Flash side and "invokeRegistered" functions on HeroScript side.

for example - this script pass queue status on server selection screen

  hsl_TrackLine(191);
  hsl_PopUntilTemporaries(0);
  hsl_RefSystemNode(20, &v5, (unsigned int)&unk_74BE365A);
  hsl_RefNodeFieldNodeRef(21, (int)&v4, (int)&v5, 11);
  v6 = hsl_RefNodeFieldLookupList((int)&v4, 12);
  hsl_TrackLine(192);
  hsl_SF_GFx_ClearAndReserveParams_maybe(hsl_CurrentInterface, 2);
  hsl_TrackLine(193);
  LODWORD(v1) = hsl_RefLookupListElementByIntInt(v6, 0x290EDEE1u, 0x3BD0CBE3u);
  hsl_SF_GFx_AddParamInteger(hsl_CurrentInterface, v1);
  hsl_TrackLine(194);
  LODWORD(v2) = hsl_RefLookupListElementByIntInt(v6, (int)unk_EC1CF1A9, 0xAF293F5Eu);
  hsl_SF_GFx_AddParamInteger(hsl_CurrentInterface, v2);
  hsl_TrackLine(195);
  return hsl_SF_GFx_InvokeRegisteredWithParams_maybe(hsl_CurrentInterface, a1, 3, (int)&hs_setQueueData);

small part of in-game invoke-calls, without params (yet)

InvokeRegistered: setPlayerPosition
InvokeRegistered: setPlayerPosition
InvokeRegistered: setPlayerPosition
InvokeRegistered: setPlayerPosition
InvokeRegistered: setPlayerPosition
InvokeRegistered: setPlayerPosition
InvokeRegistered: setPlayerPosition
InvokeRegistered: setPlayerPosition
InvokeRegistered: setPlayerPosition
InvokeRegistered: onChangedPlayerAbilitySlot
InvokeRegistered: onChangedQuickSlot
InvokeRegistered: onChangedQuickSlot
InvokeRegistered: onChangedPlayerEffectPositiveSlot
InvokeRegistered: onChangedCharacterEffectPositiveSlot
InvokeRegistered: onChangedPlayerEffectPositiveSlot
InvokeRegistered: onChangedCharacterEffectPositiveSlot
InvokeRegistered: setGlobalCooldownTime
InvokeRegistered: setGlobalCooldownTime
InvokeRegistered: onChangedPlayerAbilitySlot
InvokeRegistered: onChangedQuickSlot
InvokeRegistered: onChangedQuickSlot
InvokeRegistered: onChangedPlayerEffectPositiveSlot
InvokeRegistered: onChangedCharacterEffectPositiveSlot
InvokeRegistered: onChangedPlayerEffectPositiveSlot
InvokeRegistered: onChangedCharacterEffectPositiveSlot
InvokeRegistered: onChangedPlayerEffectPositiveSlot
InvokeRegistered: onChangedCharacterEffectPositiveSlot
InvokeRegistered: onChangedPlayerEffectPositiveSlot
InvokeRegistered: onChangedCharacterEffectPositiveSlot
InvokeRegistered: onChangedPlayerEffectPositiveSlot
InvokeRegistered: onChangedCharacterEffectPositiveSlot
InvokeRegistered: onChangedPlayerEffectPositiveSlot
InvokeRegistered: onChangedCharacterEffectPositiveSlot
InvokeRegistered: setGlobalCooldownTime
InvokeRegistered: onChangedPlayerEffectPositiveSlot
InvokeRegistered: onChangedCharacterEffectPositiveSlot
InvokeRegistered: onUpdateSocialAreaCount
InvokeRegistered: guiIsGameOptionsEnabled
InvokeRegistered: onCmdStart
InvokeRegistered: onCmdStop
InvokeRegistered: guiIsGameOptionsEnabled
InvokeRegistered: guiIsGameOptionsEnabled
InvokeRegistered: onCmdStart
InvokeRegistered: guiIsWorldMapEnabled
InvokeRegistered: showWorldMap
InvokeRegistered: removeMiniMapNotes
InvokeRegistered: guiIsWorldMapEnabled
InvokeRegistered: removeMiniMapNotes
InvokeRegistered: setCurrentMapID
InvokeRegistered: setWorldMapBounds
InvokeRegistered: clearMapNotes
InvokeRegistered: removeMapNotes
InvokeRegistered: onSetMapNotes
InvokeRegistered: guiIsWorldMapEnabled
InvokeRegistered: setWorldMapBounds
InvokeRegistered: setCurrentMapID
InvokeRegistered: setLocalMapID
InvokeRegistered: setAvailablePlanetMapID
InvokeRegistered: onSetGuiPlayerWorldMapName
InvokeRegistered: onCmdStop
InvokeRegistered: setInstanceTravelData
InvokeRegistered: guiIsGameOptionsEnabled
InvokeRegistered: onCmdStart
InvokeRegistered: guiIsCrewSkillsEnabled
InvokeRegistered: onChangedHasAnyCompanion
InvokeRegistered: onCmdStop
InvokeRegistered: onChangedCrewSkill
InvokeRegistered: onChangedCompanionInfo
InvokeRegistered: onChangedCrewTaskDone
InvokeRegistered: onChangedCrewTaskDone
InvokeRegistered: onChangedCrewTaskDone
InvokeRegistered: onChangedCrewTaskDone
InvokeRegistered: onChangedCrewAvailability
InvokeRegistered: onChangedGuiCrewSkillsEnabled
InvokeRegistered: guiIsCrewSkillsEnabled
InvokeRegistered: guiIsCrewMissionsEnabled
InvokeRegistered: onChangedGuiCraftingEnabled
InvokeRegistered: onChangedSchematicsAdd
InvokeRegistered: onChangedSubtypesAdd
InvokeRegistered: onChangedSchematicsDifficulty
InvokeRegistered: onChangedSchematicsDifficulty
InvokeRegistered: onChangedHolocomEnabled
InvokeRegistered: onChangedHolocomEnabled
InvokeRegistered: guiIsCrewSkillsEnabled
InvokeRegistered: guiIsCrewCraftingEnabled
InvokeRegistered: onChangedGuiCompanionCraftingClose
InvokeRegistered: onChangedGuiCompanionMissionsEnabled
InvokeRegistered: onChangedCompanionMissions
InvokeRegistered: setCompanionMissionsFilter
InvokeRegistered: onChangedCompanionMissions
InvokeRegistered: onChangedHolocomEnabled
InvokeRegistered: onChangedHolocomEnabled
InvokeRegistered: onChangedCompanionMissions
InvokeRegistered: addChatMessage
InvokeRegistered: onUpdateSocialAreaCount
InvokeRegistered: addChatMessage
InvokeRegistered: addChatMessage
InvokeRegistered: bannerMessage
InvokeRegistered: setCompanionNameWithGender
InvokeRegistered: onChangedCompanionAwayUntil
InvokeRegistered: onChangedTaskMissionInfo
InvokeRegistered: onChangedCrewAvailability
InvokeRegistered: onChangedTaskProgress
InvokeRegistered: guiIsTrainerWindowEnabled
InvokeRegistered: onChangedGuiCurrency
InvokeRegistered: setPlayerMoney
InvokeRegistered: onChangedCompanionMissions
InvokeRegistered: addChatMessage
InvokeRegistered: addChatMessage
InvokeRegistered: onChangedHolocomEnabled

also Flash standard external interface used to call GFx_Movie node's methods, which do all game engine interactions.




so if I install hooks on InvokeRegistered, then I can grab all events passing to UI and have all information, that UI have (almost done).
and if I can do external interface calls from my own code, then I can do all that UI can do in game (done).

and it is mean - crew skills automation, DPS rotation automation and many other good things.