trying to make an auto follow Bot

[saintdog]

Hello,

I'm trying to make a an auto follow bot for SWTOR, given the pathetic /follow command. (Maybe the 80 dollar version of the game has a working auto follow ? /joking).

All i really want to do is read the distance to the target. I can handle targeting the correct person, etc, and I'm going to use the UI to press 'w' until the target distance has been reached. I'll worry about the lack of a "/face" command later.

The problem is, I'm having some difficulty finding the mem addr of the position. I am using the L SPiro MH tool.
I looked at the post which basically gives a blatant address, but when I try these it's not correct. I've also tried scanning for the float (*10 of the UI value), and to no luck. What stupid mistake am I making here ?

If i get something working I'd certainly share.

Thanks,

---------- Post added at 12:51 PM ---------- Previous post was at 12:06 PM ----------

I Figured it out... Sort of.

1. i was multiplying by 10, it's divide the Game UI value (in other words if the distance was 11.11, the memory value is 1.111)
2. The program I was using didn't work correctly, or I used it incorrectly. CheatEngine worked.


Update:

found a bearing to target in degrees. It's below the distance to target (as seen in the Mem Addresses post)

datatype = Float
mem position = Distance To Target - 0x58

value = -179.9 to 179.9 degrees
0 means you're facing target,
negative means you're facing to the right of the target, positive means you're facing to the left of the target

(I still haven't figured out the player base addr... maybe swtor updated this?)

[dook123]

[[[[[ MemoryMan.dll + 00027E8C ] + 798 ] + 504 ] + 14 ] + 8 ] = PB. Player Base, address.

This is from the address thread. It seems to work for me.

[saintdog]

Thanks Dook,

So I now have the memory addresses that I'm looking for. But I need to write a program to view these and send input. What is the best way to do this ? Does anyone have C# .NET / AHK snippits for attaching to a game to read memory?
I thought about doing the whole thing in AHK, but There's not much support for reading memory.

I'm skilled with programming languages, but not in creating a "detect resistant" macro.
I just want a working / quick auto follow....

Anyone care to enlighten me?

Thanks,

[tearf]

To do the attach you're going to want to do something like this:

    Declare Function ReadProcessMemoryFloat Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Single, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
    Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As 
    Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Integer, ByVal bInheritHandle As Integer, ByVal dwProcessId As Integer) As Integer

    Dim blnAttachedToGame As Boolean = False

    Dim readHandle As Integer 'IntPtr
    Dim intMemBasePlayer As Integer
    Dim intMemBaseSWTOR As Integer

    Private Function getBaseAddress(ByVal oProcess As Process, ByVal strBase As String) As Int32
        Try
            Dim ffxiMainIndex As Integer = 0
            For i = 0 To oProcess.Modules.Count - 1
                If oProcess.Modules.Item(i).ModuleName.ToLower = strBase Then
                    oMainIndex = i
                    Exit For
                End If
            Next
            Return oProcess.Modules.Item(oMainIndex).BaseAddress.ToInt32
        Catch ex As Exception
            Return Nothing
        End Try
    End Function

    Sub AttachGame()
        Try
            Dim strProcessName As String = "swtor"
            Dim objProcesses As Process() = Process.GetProcessesByName(strProcessName)
            Dim objProcess As Process
            For Each objProcess In objProcesses
                readHandle = OpenProcess(PROCESS_VM_READ, False, CUInt(objProcess.Id))
                Dim intTmpBaseMemMan As Integer = getBaseAddress(objProcess, "memoryman.dll")
                intMemBaseSWTOR = getBaseAddress(objProcess, "swtor.exe")

                Dim lngStep1 As Long = 0
                Dim lngStep2 As Long = 0
                Dim lngStep3 As Long = 0
                Dim lngStep4 As Long = 0
                Dim lngStep5 As Long = 0

                ReadProcessMemory(readHandle, intTmpBaseMemMan + &H27E8C, lngStep1, 4, Nothing) 'F4540000
                ReadProcessMemory(readHandle, lngStep1 + &H798, lngStep2, 4, Nothing) 'F4540798
                ReadProcessMemory(readHandle, lngStep2 + &H504, lngStep3, 4, Nothing) 'ED9E06E
                ReadProcessMemory(readHandle, lngStep3 + &H14, lngStep4, 4, Nothing) 'F1880200
                ReadProcessMemory(readHandle, lngStep4 + &H8, lngStep5, 4, Nothing) 'F613F068

                intMemBasePlayer = lngStep5

                If intMemBasePlayer <> 0 Then
                    WriteLog("Attached to SWTOR.EXE [" & objProcess.Id & "]")
                    blnAttachedToGame = True
                    Exit For
                End If
            Next
            If intMemBasePlayer = 0 Then WriteLog("Error: SWTOR.EXE not found")
        Catch ex As Exception
            WriteLog("Error attaching>> " & ex.ToString)
        End Try
    End Sub

Then to grab values from memory:

        ReadProcessMemoryLong(readHandle, intMemBasePlayer + &H28, intLastTarget, 4, Nothing)
        ReadProcessMemoryFloat(readHandle, intMemBasePlayer + &H40, sngHealth, 4, Nothing) 'F4072770
        ReadProcessMemoryFloat(readHandle, intMemBasePlayer + &H80, sngDistanceToTarget, 4, Nothing) 'F40727B0
        ReadProcessMemoryFloat(readHandle, intMemBasePlayer + &H100, sngPlayerX, 4, Nothing) 'F4072830
        ReadProcessMemoryFloat(readHandle, intMemBasePlayer + &H104, sngPlayerY, 4, Nothing) 'F4072834
        ReadProcessMemoryFloat(readHandle, intMemBasePlayer + &H108, sngPlayerZ, 4, Nothing) 'F4072838
        ReadProcessMemoryFloat(readHandle, intMemBasePlayer + &H114, sngPlayerAngle, 4, Nothing) 'F4072844
        sngDistanceToTarget = sngDistanceToTarget * 10

        ReadProcessMemoryFloat(readHandle, intMemBaseSWTOR + &H1080AC4, fltPlayerX, 4, Nothing)
        ReadProcessMemoryFloat(readHandle, intMemBaseSWTOR + &H1080ACC, fltPlayerY, 4, Nothing)
        ReadProcessMemoryFloat(readHandle, intMemBaseSWTOR + &H1080AC8, fltPlayerZ, 4, Nothing)
        ReadProcessMemoryFloat(readHandle, intMemBaseSWTOR + &H1085570, fltTargetX, 4, Nothing)
        ReadProcessMemoryFloat(readHandle, intMemBaseSWTOR + &H1085578, fltTargetY, 4, Nothing)
        ReadProcessMemoryFloat(readHandle, intMemBaseSWTOR + &H1085574, fltTargetZ, 4, Nothing)

[saintdog]

excellent! I love vb script.


Thanks for the help.
I'll see if i can roll something together. I noticed that the distance to target value is actually in two places in memory, and that only one of them -0x58 will give you the bearing.

[saintdog]

Tearf,

Thanks for the kick start. I have a quick question for you.

The addresses that It's reading are not putting any values in the buffers except for the Player Base. But I think I'm having an overall issue with the memory addreses.

I tried a direct memory read with the same value from cheat engine that I used to find range to target. For some reason; reading this memory address puts 0 bytes into the buffer? but cheat engine is reading it fine. Is there some virtual offset that I must apply to the addresses I'm programatically reading?

Through debug, I also noticed that memman.dll and swtor.exe have the same offset. Is this typical?

Thanks for the help, I think i'm pretty close here. What a fun hobby.

[tearf]

There are two SWTOR processes, and it only works if you connect to the right one. That's why in the code above it's looping through both and if we don't get a non-zero PB address then it continues... That would be my first guess.

The other thing it could be is insufficient privilege to read the other process' memory. Make sure you're running your code as Admin. So when you run it, right-click, Run As Administrator...

[saintdog]

I think my flaw is with understanding how ReadProcessMemory works.

Is the order that the memory is read important ?

For Example, when I find an address using cheat engine say the address is 0x5555 - I cannot simply do this:
ReadProcessMemory(readHandle, &h55555, lngStep1, 4, Nothing) - there is no value in lngStep1.
but in cheat engine, which I create a variable to view at the address of 0x5555 I can see the value.

Also, I noticed that I get an overflow exception when I try to read the value into lngStep2: (although this wasn't happening yesterday)
ReadProcessMemory(readHandle, lngStep1 + &H798, lngStep2, 4, Nothing) 'F4540798