my very old bot got outdatet, i did it for 3.3 version or older
here is how i find my Objectmanager,
looking through the code and some related \ObjectMgrClient.cpp ascii string
its updated to 4.0.6
Code:
FindObjectManager proc
invoke ScanPattern,hProcess,BaseAddr,BaseAddrEnd,addr ThreadLocalStorageIndex,sizeof ThreadLocalStorageIndex,addr ThreadLocalStorageIndexNotation
mov ThreadLocalStorage,eax ;007C03C5
add eax,ClientConnectionPointerDistance ;007C03DB
invoke ReadMemDword,hProcess,eax ;
mov ClientConnectionPointer,eax ;01139F80
mov eax,ThreadLocalStorage ;
add eax,ClientConnectionOffsetDistance ;
invoke ReadMemDword,hProcess,eax ;
mov ClientConnectionOffset,eax ;00002C34
invoke ReadMemDword,hProcess,ClientConnectionPointer
add eax,ClientConnectionOffset
invoke ReadMemDword,hProcess,eax
mov ObjectManager,eax
Ret
FindObjectManager EndP
Code:
ClientConnectionPointerDistance equ 14h ; difference from found scanpattern offset
ClientConnectionOffsetDistance equ 1Ah ; difference from found scanpattern offset
ThreadLocalStorageIndex db 033h,0C0h,\
064h,08Bh,015h,020Ch,000h,000h,000h,\
08Bh,0DDh,070h,0B1h,0C2h,001h,\
08Bh,00Ch,08Ah,\
08Bh,015h,0A8h,0E1h,0AAh,001h,\
089h,082h,000h,000h,000h,000h
;ASCII ".\ObjectMgrClient.cpp"
;01288E66 |> \33C0 XOR EAX,EAX ; kernel32.BaseThreadInitThunk
;01288E68 |> 64:8B15 2C000>MOV EDX,DWORD PTR FS:[2C]
;01288E6F |. 8B0D 70B1C201 MOV ECX,DWORD PTR DS:[1C2B170]
;01288E75 |. 8B0C8A MOV ECX,DWORD PTR DS:[EDX+ECX*4]
;01288E78 |. 8B15 A8E1AA01 MOV EDX,DWORD PTR DS:[1AAE1A8]
;01288E7E |. 8982 2C460000 MOV DWORD PTR DS:[EDX+462C],EAX ; kernel32.BaseThreadInitThunk
ThreadLocalStorageIndexNotation db "xxxxxxxxxxx0000xxxxx0000xx00xxxx",0
this works fine
but now i come to my localplayer(Mychar) pattern
i dont know how i got it at 3.3 , course i missed to comment my scource at that point.
here is my scource i used at 3.3
Code:
FindPlayerBaseOffset proc
invoke ScanPattern,hProcess,BaseAddr,BaseAddrEnd,addr PlayerBasePattern,sizeof PlayerBasePattern,addr PlayerBaseNotation
mov PlayerBasepatternAddr,eax ;004E2A60
add eax,19h ;004E2A79
invoke ReadMemDword,hProcess,eax ;10BD5F4
invoke ReadMemDword,hProcess,eax ;e.g1264EDA8
add eax,34h ;e.g 07E71A50
invoke ReadMemDword,hProcess,eax
add eax,24h
invoke ReadMemDword,hProcess,eax
mov PlayerBaseOffset,eax
mov MyLocalPlayer.MyObjectOffset,eax
Ret
FindPlayerBaseOffset EndP
Code:
PlayerBasePattern db 55h,8Bh,0ECh,8Bh,45h,08h,81h,0ECh,00h,01h,00h,00h,56h,8Bh,75h,0Ch,57h,8Bh,7Dh,10h,8Bh,0CEh,0Bh,0CFh,0A3h,0F4h,0D5h,0Bh,01h ; +19h
;004E28D0 /$ 55 PUSH EBP
;004E28D1 |. 8BEC MOV EBP,ESP
;004E28D3 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
;004E28D6 |. 81EC 00010000 SUB ESP,100
;004E28DC |. 56 PUSH ESI
;004E28DD |. 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C]
;004E28E0 |. 57 PUSH EDI
;004E28E1 |. 8B7D 10 MOV EDI,DWORD PTR SS:[EBP+10]
;004E28E4 |. 8BCE MOV ECX,ESI
;004E28E6 |. 0BCF OR ECX,EDI
;004E28E8 |. A3 F4D50B01 MOV DWORD PTR DS:[10BD5F4],EAX
PlayerBaseNotation db "xxxxxxxxxxxxxxxxxxxxxxxxx0000",0
hope someone could point me intothe right direction to find the right pattern
thx ninar1
edit or simply asked:
ClientConnectionPointer can be found at 01288E78
but where or how can i find PlayerBaseOffset