Local player offset

fallenpowa · 2025-05-25T17:36:56.000Z

I'm planning to create a bot like a follow bot or an auto dungeon bot, but I can't do it because I think I have the wrong local player address or offsets. If anyone has the correct ones, could you please share them?

import pymem import pymem.process import tkinter as tk import time import math import traceback # ------------------------------ # Addresses and Offsets # ------------------------------ ENTITY_LIST = 0x1097504 LOCAL_PLAYER = 0x1097680 ENTITY_OBJECT_OFFSETS = [0x7C] ENTITY_POS_OFFSETS = [0xC4, 0x4, 0x80] POSITION_OFFSETS = [0x8, 0x28, 0xC4, 0x4, 0x80] ACCELERATION_OFFSETS = [0x8, 0x28, 0xC4, 0x4, 0xB0] ENTITY_MAX = 512 # ------------------------------ # Memory Functions # ------------------------------ def read_pointer_chain(pm, base, offsets): try: addr = base for offset in offsets[:-1]: addr = pm.read_int(addr + offset) if addr is None: return 0 return addr + offsets[-1] except: return 0 def read_vec3(pm, base, offsets): addr = read_pointer_chain(pm, base, offsets) try: x = pm.read_float(addr) y = pm.read_float(addr + 0x4) z = pm.read_float(addr + 0x8) return (x, y, z) except: return (0, 0, 0) def write_vec3(pm, base, offsets, vec): addr = read_pointer_chain(pm, base, offsets) try: pm.write_float(addr, vec[0]) pm.write_float(addr + 0x4, vec[1]) pm.write_float(addr + 0x8, vec[2]) except: pass def distance(a, b): return math.sqrt((a[0]-b[0])**2 + (a[2]-b[2])**2) # ------------------------------ # Bot Class # ------------------------------ class TroveBot: def __init__(self): print("[+] Starting Trove Radar...") try: self.pm = pymem.Pymem("Trove.exe") self.base = pymem.process.module_from_name(self.pm.process_handle, "Trove.exe").lpBaseOfDll print(f"[+] Trove.exe found. Base: {hex(self.base)}") except Exception as e: print("[-] Trove.exe not found! Start the game and try again.") raise e self.root = tk****() self.root.title("Trove Radar") self.canvas = tk.Canvas(self.root, width=500, height=500, bg='black') self.canvas.pack() self.root.after(50, self.update) self.root.mainloop() def update(self): try: self.canvas.delete("all") local_pos = read_vec3(self.pm, self.base + LOCAL_PLAYER, POSITION_OFFSETS) entity_list_ptr = self.pm.read_int(self.base + ENTITY_LIST) closest_dist = float("inf") closest_pos = None for i in range(ENTITY_MAX): entity_base = self.pm.read_int(entity_list_ptr + i * 4) if not entity_base: continue entity_obj = read_pointer_chain(self.pm, entity_base, ENTITY_OBJECT_OFFSETS) if not entity_obj: continue entity_pos = read_vec3(self.pm, entity_obj, ENTITY_POS_OFFSETS) dx = entity_pos[0] - local_pos[0] dz = entity_pos[2] - local_pos[2] x = 250 + dx * 4 y = 250 + dz * 4 self.canvas.create_oval(x - 3, y - 3, x + 3, y + 3, fill='red') dist = distance(local_pos, entity_pos) if 2 < dist < closest_dist: closest_dist = dist closest_pos = entity_pos # Follow closest entity if closest_pos: dx = closest_pos[0] - local_pos[0] dz = closest_pos[2] - local_pos[2] length = math.sqrt(dx ** 2 + dz ** 2) if length > 0: accel_x = (dx / length) * 2.0 accel_z = (dz / length) * 2.0 write_vec3(self.pm, self.base + LOCAL_PLAYER, ACCELERATION_OFFSETS, (accel_x, 0.0, accel_z)) except Exception as e: print("[!] Error:", e) traceback.print_exc() self.root.after(30, self.update) # ------------------------------ # Start # ------------------------------ if __name__ == "__main__": try: TroveBot() except Exception as e: print("An error occurred:", e) input("Press ENTER to exit...")

import pymem import pymem.exception import pymem.process import tkinter as tk import time import math import traceback import pymem.ptypes # ================================================ # CONFIGURATION # ================================================ DEBUG = False # Set to False to disable debug messages # ================================================ # GAME ADDRESSES AND OFFSETS # ================================================ ENTITY_LIST = 0x1097504 LOCAL_PLAYER = 0x1097680 ENTITY_OBJECT_OFFSETS = [0x7C] ENTITY_POS_OFFSETS = [0xC4, 0x4, 0x80] POSITION_OFFSETS = [0x8, 0x28, 0xC4, 0x4, 0x80] ACCELERATION_OFFSETS = [0x8, 0x28, 0xC4, 0x4, 0xB0] # ================================================ # ENTITY FILTERING # ================================================ EXCLUDED_NAMES = [ "pet", "portal", "abilities", "placeable", "cornerstone", "services", "client", "karma", "mana", "outpost", ] # ================================================ # UTILITY CLASSES # ================================================ class Vec3: """3D vector representation with basic math operations""" def __init__(self, x=0.0, y=0.0, z=0.0): self.x = float(x) self.y = float(y) self.z = float(z) def __sub__(self, other): return Vec3(self.x - other.x, self.y - other.y, self.z - other.z) def __add__(self, other): return Vec3(self.x + other.x, self.y + other.y, self.z + other.z) def is_not_zero(self): """Check if vector has non-zero values""" return math.floor(self.x) != 0.0 and math.floor(self.y) != 0.0 and math.floor(self.z) != 0.0 def length(self): """Calculate vector magnitude""" return math.sqrt(self.x * self.x + self.y * self.y + self.z * self.z) def normalized(self): """Return normalized version of the vector""" len_ = self.length() return Vec3() if len_ == 0.0 else Vec3(self.x/len_, self.y/len_, self.z/len_) class Entity: """Game entity representation""" def __init__(self, name="", position=Vec3(), range=-1.0, scale=0.5): self.name = name self.position = position self.range = range self.scale = scale # ================================================ # MEMORY OPERATIONS # ================================================ def debug_print(*args, **kwargs): """Wrapper for debug messages""" if DEBUG: print("[DEBUG]", *args, **kwargs) def read_pointer_chain(pm, base, offsets): """Follow pointer chain to get final memory address""" if not offsets: return base try: ptr = pymem.ptypes.RemotePointer(pm.process_handle, base) for offset in offsets[:-1]: ptr = pymem.ptypes.RemotePointer(pm.process_handle, ptr.value + offset) return ptr.value + offsets[-1] except Exception as e: debug_print(f"Pointer chain failed: {str(e)}") return None def read_vec3(pm, base, offsets): """Read 3D vector from memory""" addr = read_pointer_chain(pm, base, offsets) try: return ( pm.read_float(addr), pm.read_float(addr + 0x4), pm.read_float(addr + 0x8) ) except Exception as e: debug_print(f"Failed to read Vec3: {str(e)}") return (0, 0, 0) def write_vec3(pm, base, offsets, vec): """Write 3D vector to memory""" addr = read_pointer_chain(pm, base, offsets) try: pm.write_float(addr, vec[0]) pm.write_float(addr + 0x4, vec[1]) pm.write_float(addr + 0x8, vec[2]) except Exception as e: debug_print(f"Failed to write Vec3: {str(e)}") def get_address(pm, base, offsets): """Calculate address from base and offsets""" try: address = base for offset in offsets[:-1]: address = pm.read_uint(address + offset) if address == 0: return 0 return address + offsets[-1] if offsets else base except Exception as e: debug_print(f"Address calculation failed: {str(e)}") return 0 def read_string(pm, address, max_len): """Read string from memory""" try: bytes_ = pm.read_bytes(address, max_len) return bytes_.split(b'\0', 1)[0].decode('latin-1', errors='replace') except Exception as e: debug_print(f"String read failed: {str(e)}") return "" # ================================================ # ENTITY MANAGEMENT # ================================================ def get_all_entities(pm, world, our_pos, max_range): """Retrieve all entities within specified range""" entities = [] nodes = [] try: if world == 0: return entities node_info = get_address(pm, world, [0x7C]) base_addr = pm.read_uint(node_info) size_addr = get_address(pm, node_info, [0x8]) size = pm.read_uint(size_addr) step = pm.read_uint(get_address(pm, node_info, [0x4])) # Node collection logic if size == 0: address = base_addr for _ in range(100): # Fail-safe address_next = pm.read_uint(address) & 0xFFFFFFFE if address_next == 0: break nodes.append(address) address = address_next else: for i in range(size): address = base_addr + i * step while True: address_next = pm.read_uint(address) if address_next == 1: break nodes.append(address) address = address_next & 0xFFFFFFFE if address == 0: break # Entity processing for node in nodes: try: entity = get_address(pm, node, [0x10, 0xC4, 0x4, 0x0]) name_addr = get_address(pm, entity, [0x58, 0x64, 0x0]) if not name_addr: continue name = read_string(pm, name_addr, 96) if not name or any(ex in name.lower() for ex in EXCLUDED_NAMES): continue pos_addr = get_address(pm, entity, [0x58, 0xC4, 0x4, 0x80]) if not pos_addr: continue position = Vec3( pm.read_float(pos_addr), pm.read_float(pos_addr + 0x4), pm.read_float(pos_addr + 0x8) ) delta = position - our_pos dist = delta.length() if dist < max_range: entities.append((dist, Entity(name, position, dist))) except Exception as e: debug_print(f"Entity processing error: {str(e)}") except Exception as e: debug_print(f"get_all_entities error: {str(e)}") traceback.print_exc() return entities def nearest_entity(entities): """Find closest entity from list""" return min(entities, key=lambda x: x[0])[1] if entities else Entity() # ================================================ # BOT CORE # ================================================ class TroveBot: """Main application class""" def __init__(self): self.pm = None self.base = None self.root = tk****() self.canvas = tk.Canvas(self.root, width=500, height=500, bg='black') self.canvas.pack() try: self.initialize_memory() self.root.after(50, self.update) self.root.mainloop() except Exception as e: print(f"Initialization failed: {str(e)}") input("Press ENTER to exit...") def initialize_memory(self): """Connect to game process""" debug_print("Initializing memory...") self.pm = pymem.Pymem("Trove.exe") self.base = pymem.process.module_from_name( self.pm.process_handle, "Trove.exe" ).lpBaseOfDll print("[+] Successfully connected to Trove.exe") def get_local_position(self): """Get player's current position""" try: pos = read_vec3(self.pm, self.base + LOCAL_PLAYER, POSITION_OFFSETS) return Vec3(*pos) if pos != (0, 0, 0) else None except Exception as e: debug_print(f"Position read error: {str(e)}") return None def update_ui(self, local_pos, entities): """Update radar display""" self.canvas.delete("all") # Draw player self.canvas.create_oval(245, 245, 255, 255, fill='green') # Draw entities for dist, entity in entities: dx = entity.position.x - local_pos.x dz = entity.position.z - local_pos.z x = 250 + dx * 4 y = 250 + dz * 4 self.canvas.create_oval(x-3, y-3, x+3, y+3, fill='red') def handle_movement(self, local_pos, entity): """Move player towards target entity""" if entity.range == -1 or not entity.position.is_not_zero(): return try: delta = entity.position - local_pos if delta.length() > 0.1: direction = delta.normalized() accel = (direction.x * 2.0, 0.0, direction.z * 2.0) write_vec3(self.pm, self.base + LOCAL_PLAYER, ACCELERATION_OFFSETS, accel) debug_print(f"Moving towards {entity.name} ({accel[0]:.2f}, {accel[2]:.2f})") except Exception as e: debug_print(f"Movement error: {str(e)}") def update(self): """Main update loop""" try: local_pos = self.get_local_position() if not local_pos: return world = get_address(self.pm, self.base, [ENTITY_LIST, 0x0]) if not world: return entities = get_all_entities(self.pm, world, local_pos, 100.0) closest = nearest_entity(entities) self.update_ui(local_pos, entities) self.handle_movement(local_pos, closest) except Exception as e: debug_print(f"Update error: {str(e)}") traceback.print_exc() finally: self.root.after(30, self.update) # ================================================ # ENTRY POINT # ================================================ if __name__ == "__main__": TroveBot()

Originally Posted by FAISAL32

Man when I saw "localplayer" I thought your problem was with the localplayer
but turns out it’s actually in the EntityList
You know bro, you’re lucky you didn’t use my old method
it was wrong even though it extracted the entities correctly, but from 80 to 90 they'd get included in the list

So you need to use CholeOwO’s method
it’s the best way, even better than mine in the perfect silent aim

So I’m gonna tweak your code a bit to show you Chole’s method

I hope the code is clear for you
I also added a filter that ignores certain types of entities like I use in silent aim
you’ll need to modify that too to match what you need

Good luck with your project, who knows, maybe it’ll be the best auto farm in the future

note: important
make sure the entity extraction is actually working
CholeOwO’s method, I haven’t tested it myself
I just applied what I understood from it

Code:

import pymem
import pymem.exception
import pymem.process
import tkinter as tk
import time
import math
import traceback
import pymem.ptypes

# ================================================
# CONFIGURATION
# ================================================
DEBUG = False  # Set to False to disable debug messages

# ================================================
# GAME ADDRESSES AND OFFSETS
# ================================================
ENTITY_LIST = 0x1097504
LOCAL_PLAYER = 0x1097680
ENTITY_OBJECT_OFFSETS = [0x7C]
ENTITY_POS_OFFSETS = [0xC4, 0x4, 0x80]
POSITION_OFFSETS = [0x8, 0x28, 0xC4, 0x4, 0x80]
ACCELERATION_OFFSETS = [0x8, 0x28, 0xC4, 0x4, 0xB0]

# ================================================
# ENTITY FILTERING
# ================================================
EXCLUDED_NAMES = [
    "pet", "portal", "abilities", "placeable", "cornerstone",
    "services", "client", "karma", "mana", "outpost",
]

# ================================================
# UTILITY CLASSES
# ================================================
class Vec3:
    """3D vector representation with basic math operations"""
    def __init__(self, x=0.0, y=0.0, z=0.0):
        self.x = float(x)
        self.y = float(y)
        self.z = float(z)

    def __sub__(self, other):
        return Vec3(self.x - other.x, self.y - other.y, self.z - other.z)

    def __add__(self, other):
        return Vec3(self.x + other.x, self.y + other.y, self.z + other.z)

    def is_not_zero(self):
        """Check if vector has non-zero values"""
        return math.floor(self.x) != 0.0 and math.floor(self.y) != 0.0 and math.floor(self.z) != 0.0

    def length(self):
        """Calculate vector magnitude"""
        return math.sqrt(self.x * self.x + self.y * self.y + self.z * self.z)

    def normalized(self):
        """Return normalized version of the vector"""
        len_ = self.length()
        return Vec3() if len_ == 0.0 else Vec3(self.x/len_, self.y/len_, self.z/len_)

class Entity:
    """Game entity representation"""
    def __init__(self, name="", position=Vec3(), range=-1.0, scale=0.5):
        self.name = name
        self.position = position
        self.range = range
        self.scale = scale

# ================================================
# MEMORY OPERATIONS
# ================================================
def debug_print(*args, **kwargs):
    """Wrapper for debug messages"""
    if DEBUG:
        print("[DEBUG]", *args, **kwargs)

def read_pointer_chain(pm, base, offsets):
    """Follow pointer chain to get final memory address"""
    if not offsets:
        return base
    try:
        ptr = pymem.ptypes.RemotePointer(pm.process_handle, base)
        for offset in offsets[:-1]:
            ptr = pymem.ptypes.RemotePointer(pm.process_handle, ptr.value + offset)
        return ptr.value + offsets[-1]
    except Exception as e:
        debug_print(f"Pointer chain failed: {str(e)}")
        return None

def read_vec3(pm, base, offsets):
    """Read 3D vector from memory"""
    addr = read_pointer_chain(pm, base, offsets)
    try:
        return (
            pm.read_float(addr),
            pm.read_float(addr + 0x4),
            pm.read_float(addr + 0x8)
        )
    except Exception as e:
        debug_print(f"Failed to read Vec3: {str(e)}")
        return (0, 0, 0)

def write_vec3(pm, base, offsets, vec):
    """Write 3D vector to memory"""
    addr = read_pointer_chain(pm, base, offsets)
    try:
        pm.write_float(addr, vec[0])
        pm.write_float(addr + 0x4, vec[1])
        pm.write_float(addr + 0x8, vec[2])
    except Exception as e:
        debug_print(f"Failed to write Vec3: {str(e)}")

def get_address(pm, base, offsets):
    """Calculate address from base and offsets"""
    try:
        address = base
        for offset in offsets[:-1]:
            address = pm.read_uint(address + offset)
            if address == 0:
                return 0
        return address + offsets[-1] if offsets else base
    except Exception as e:
        debug_print(f"Address calculation failed: {str(e)}")
        return 0

def read_string(pm, address, max_len):
    """Read string from memory"""
    try:
        bytes_ = pm.read_bytes(address, max_len)
        return bytes_.split(b'\0', 1)[0].decode('latin-1', errors='replace')
    except Exception as e:
        debug_print(f"String read failed: {str(e)}")
        return ""

# ================================================
# ENTITY MANAGEMENT
# ================================================
def get_all_entities(pm, world, our_pos, max_range):
    """Retrieve all entities within specified range"""
    entities = []
    nodes = []
    
    try:
        if world == 0:
            return entities
            
        node_info = get_address(pm, world, [0x7C])
        base_addr = pm.read_uint(node_info)
        size_addr = get_address(pm, node_info, [0x8])
        size = pm.read_uint(size_addr)
        step = pm.read_uint(get_address(pm, node_info, [0x4]))

        # Node collection logic
        if size == 0:
            address = base_addr
            for _ in range(100):  # Fail-safe
                address_next = pm.read_uint(address) & 0xFFFFFFFE
                if address_next == 0:
                    break
                nodes.append(address)
                address = address_next
        else:
            for i in range(size):
                address = base_addr + i * step
                while True:
                    address_next = pm.read_uint(address)
                    if address_next == 1:
                        break
                    nodes.append(address)
                    address = address_next & 0xFFFFFFFE
                    if address == 0:
                        break

        # Entity processing
        for node in nodes:
            try:
                entity = get_address(pm, node, [0x10, 0xC4, 0x4, 0x0])
                name_addr = get_address(pm, entity, [0x58, 0x64, 0x0])
                
                if not name_addr:
                    continue
                    
                name = read_string(pm, name_addr, 96)
                if not name or any(ex in name.lower() for ex in EXCLUDED_NAMES):
                    continue
                    
                pos_addr = get_address(pm, entity, [0x58, 0xC4, 0x4, 0x80])
                if not pos_addr:
                    continue
                    
                position = Vec3(
                    pm.read_float(pos_addr),
                    pm.read_float(pos_addr + 0x4),
                    pm.read_float(pos_addr + 0x8)
                )
                delta = position - our_pos
                dist = delta.length()
                
                if dist < max_range:
                    entities.append((dist, Entity(name, position, dist)))
                    
            except Exception as e:
                debug_print(f"Entity processing error: {str(e)}")

    except Exception as e:
        debug_print(f"get_all_entities error: {str(e)}")
        traceback.print_exc()

    return entities

def nearest_entity(entities):
    """Find closest entity from list"""
    return min(entities, key=lambda x: x[0])[1] if entities else Entity()

# ================================================
# BOT CORE
# ================================================
class TroveBot:
    """Main application class"""
    def __init__(self):
        self.pm = None
        self.base = None
        self.root = tk****()
        self.canvas = tk.Canvas(self.root, width=500, height=500, bg='black')
        self.canvas.pack()
        
        try:
            self.initialize_memory()
            self.root.after(50, self.update)
            self.root.mainloop()
        except Exception as e:
            print(f"Initialization failed: {str(e)}")
            input("Press ENTER to exit...")

    def initialize_memory(self):
        """Connect to game process"""
        debug_print("Initializing memory...")
        self.pm = pymem.Pymem("Trove.exe")
        self.base = pymem.process.module_from_name(
            self.pm.process_handle, 
            "Trove.exe"
        ).lpBaseOfDll
        print("[+] Successfully connected to Trove.exe")

    def get_local_position(self):
        """Get player's current position"""
        try:
            pos = read_vec3(self.pm, self.base + LOCAL_PLAYER, POSITION_OFFSETS)
            return Vec3(*pos) if pos != (0, 0, 0) else None
        except Exception as e:
            debug_print(f"Position read error: {str(e)}")
            return None

    def update_ui(self, local_pos, entities):
        """Update radar display"""
        self.canvas.delete("all")
        
        # Draw player
        self.canvas.create_oval(245, 245, 255, 255, fill='green')
        
        # Draw entities
        for dist, entity in entities:
            dx = entity.position.x - local_pos.x
            dz = entity.position.z - local_pos.z
            x = 250 + dx * 4
            y = 250 + dz * 4
            self.canvas.create_oval(x-3, y-3, x+3, y+3, fill='red')

    def handle_movement(self, local_pos, entity):
        """Move player towards target entity"""
        if entity.range == -1 or not entity.position.is_not_zero():
            return

        try:
            delta = entity.position - local_pos
            if delta.length() > 0.1:
                direction = delta.normalized()
                accel = (direction.x * 2.0, 0.0, direction.z * 2.0)
                write_vec3(self.pm, self.base + LOCAL_PLAYER, ACCELERATION_OFFSETS, accel)
                debug_print(f"Moving towards {entity.name} ({accel[0]:.2f}, {accel[2]:.2f})")

        except Exception as e:
            debug_print(f"Movement error: {str(e)}")

    def update(self):
        """Main update loop"""
        try:
            local_pos = self.get_local_position()
            if not local_pos:
                return

            world = get_address(self.pm, self.base, [ENTITY_LIST, 0x0])
            if not world:
                return

            entities = get_all_entities(self.pm, world, local_pos, 100.0)
            closest = nearest_entity(entities)

            self.update_ui(local_pos, entities)
            self.handle_movement(local_pos, closest)

        except Exception as e:
            debug_print(f"Update error: {str(e)}")
            traceback.print_exc()
        finally:
            self.root.after(30, self.update)

# ================================================
# ENTRY POINT
# ================================================
if __name__ == "__main__":
    TroveBot()

thanks for the corrections and suggestions on the code. I'll try to share a fully working bot as soon as possible.

DATA_IN = bytearray([ # pop eax ; add esp, 8 ; push eax ; mov eax,[ebx+14] 0x58, 0x83, 0xC4, 0x08, 0x50, 0x8B, 0x43, 0x14, # push ebx ; push ecx ; sub esp, 0x30 0x53, 0x51, 0x83, 0xEC, 0x30, # save xmm0, xmm1, xmm2 to stack 0xF3, 0x0F, 0x7F, 0x44, 0x24, 0x20, 0xF3, 0x0F, 0x7F, 0x4C, 0x24, 0x10, 0xF3, 0x0F, 0x7F, 0x14, 0x24, # mov ebx, [Trove.exe+108BD70] ; mov ecx, 0 0xBB, 0xE0, 0xE6, 0x30, 0x1D, 0xB9, 0x00, 0x00, 0x00, 0x00, # loop # add ebx, [Offset + ecx * 4] 0x03, 0x1C, 0x8D, 0xFF, 0xFF, 0xFF, 0xFF, # <- patched later with offset address # mov ebx, [ebx] ; cmp ebx, 0 ; je return 0x8B, 0x1B, 0x83, 0xFB, 0x00, 0x0F, 0x84, 0x32, 0x00, 0x00, 0x00, # inc ecx ; cmp ecx, 4 ; jl loop 0x41, 0x83, 0xF9, 0x04, 0x7C, 0xE8, # movups xmm0, [ebx+80] 0x0F, 0x10, 0x83, 0x80, 0x00, 0x00, 0x00, # movaps xmm1, xmm0 ; cmpps xmm1, xmm4, 2 0x0F, 0x28, 0xC8, 0x0F, 0xC2, 0xCC, 0x02, # movaps xmm2, xmm5 ; cmpps xmm2, xmm0, 2 0x0F, 0x28, 0xD5, 0x0F, 0xC2, 0xD0, 0x02, # pand xmm1, xmm2 ; movmskps ecx, xmm1 0x66, 0x0F, 0xDB, 0xCA, 0x0F, 0x50, 0xC9, # and ecx, 7 ; cmp ecx, 7 ; jne return 0x83, 0xE1, 0x07, 0x83, 0xF9, 0x07, 0x0F, 0x85, 0x04, 0x00, 0x00, 0x00, # mov byte ptr [eax+1], 0 0xC6, 0x40, 0x01, 0x00, # restore xmm2, xmm1, xmm0 0xF3, 0x0F, 0x6F, 0x14, 0x24, 0xF3, 0x0F, 0x6F, 0x4C, 0x24, 0x10, 0xF3, 0x0F, 0x6F, 0x44, 0x24, 0x20, # add esp, 0x30 ; pop ecx ; pop ebx ; ret 0x83, 0xC4, 0x30, 0x59, 0x5B, 0xC3, # offset (4 DWORDs) 0x00, 0x00, 0x00, 0x00, # offset 0 0x28, 0x00, 0x00, 0x00, # offset 1 0xC4, 0x00, 0x00, 0x00, # offset 2 0x04, 0x00, 0x00, 0x00 # offset 3 ])

import pymem, ctypes import pymem.memory, pymem.process, pymem.pattern # Constants MODULE = "Trove.exe" # Name of the target process PLAYER_OFFS = [0x1097680, 0x0] # Offsets to reach the player structure SIG = bytes([0x8B, 0x43, 0x14, 0x83, 0xC4, 0x08, 0x0F]) # Signature to find the target instruction DATA_ON = b'\xE8\xFF\xFF\xFF\xFF\x90' # Pattern when Noclip is enabled DATA_OFF = b'\x8B\x43\x14\x83\xC4\x08\xF8' # Original bytes to restore when disabling Noclip DATA_IN = bytearray([ 0x58, 0x83, 0xC4, 0x08, 0x50, 0x8B, 0x43, 0x14, 0x53, 0x51, 0x83, 0xEC, 0x30, 0xF3, 0x0F, 0x7F, 0x44, 0x24, 0x20, 0xF3, 0x0F, 0x7F, 0x4C, 0x24, 0x10, 0xF3, 0x0F, 0x7F, 0x14, 0x24, 0xBB, 0xE0, 0xE6, 0x30, 0x1D, 0xB9, 0x00, 0x00, 0x00, 0x00, 0x03, 0x1C, 0x8D, 0xFF, 0xFF, 0xFF, 0xFF, 0x8B, 0x1B, 0x83, 0xFB, 0x00, 0x0F, 0x84, 0x32, 0x00, 0x00, 0x00, 0x41, 0x83, 0xF9, 0x04, 0x7C, 0xE8, 0x0F, 0x10, 0x83, 0x80, 0x00, 0x00, 0x00, 0x0F, 0x28, 0xC8, 0x0F, 0xC2, 0xCC, 0x02, 0x0F, 0x28, 0xD5, 0x0F, 0xC2, 0xD0, 0x02, 0x66, 0x0F, 0xDB, 0xCA, 0x0F, 0x50, 0xC9, 0x83, 0xE1, 0x07, 0x83, 0xF9, 0x07, 0x0F, 0x85, 0x04, 0x00, 0x00, 0x00, 0xC6, 0x40, 0x01, 0x00, 0xF3, 0x0F, 0x6F, 0x14, 0x24, 0xF3, 0x0F, 0x6F, 0x4C, 0x24, 0x10, 0xF3, 0x0F, 0x6F, 0x44, 0x24, 0x20, 0x83, 0xC4, 0x30, 0x59, 0x5B, 0xC3, 0x00, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0xC4, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00 ]) # Custom code injected to handle Noclip logic # Resolve a pointer using a list of offsets def get_ptr(pm, base, offs): try: for o in offs[:-1]: base = pm.read_int(base + o) return base + offs[-1] except: raise ValueError("Pointer resolution failed") # Change memory protection on a specific region def protect(h, addr, sz, prot): old = ctypes.c_uint32() if not ctypes.windll.kernel32.VirtualProtectEx(h, addr, sz, prot, ctypes.byref(old)): raise RuntimeError("VirtualProtectEx failed") return old.value # Scan the module for the target instruction using a signature def find_target(pm, base): try: mod = pymem.process.module_from_name(pm.process_handle, MODULE) found = pymem.pattern.pattern_scan_module(pm.process_handle, mod, SIG) if found is None: raise ValueError("Signature not found") return found # Return address where signature was found except Exception as e: print(f"Error finding target: {e}") return None # Enable Noclip by injecting custom code and patching a function call def enable_noclip(pm): try: base = pm.process_base.lpBaseOfDll target = find_target(pm, base) if target is None: raise ValueError("Target not found") player = get_ptr(pm, base, PLAYER_OFFS) original = pm.read_bytes(target, len(DATA_OFF)) # Backup original bytes size = len(DATA_IN) in_addr = pymem.memory.allocate_memory(pm.process_handle, size) # Allocate memory for custom code # Inject the player address and custom return address DATA_IN[31:35] = player.to_bytes(4, 'little') DATA_IN[43:47] = ((in_addr + 131) & 0xFFFFFFFF).to_bytes(4, 'little') pymem.memory.write_bytes(pm.process_handle, in_addr, bytes(DATA_IN), size) # Write custom code protect(pm.process_handle, in_addr, size, 0x40) # Make memory executable # Calculate relative jump from target to injected code rel = (in_addr - (target + 5)) & 0xFFFFFFFF patch = b'\xE8' + rel.to_bytes(4, 'little', signed=True) + b'\x90' # Call to injected code protect(pm.process_handle, target, len(patch), 0x40) # Change protection for patching pymem.memory.write_bytes(pm.process_handle, target, patch, len(patch)) # Overwrite target with call return in_addr, original, target # Return info to disable later except Exception as e: print(f"Enable error: {e}") return None, None, None # Disable Noclip by restoring the original bytes def disable_noclip(pm, addr, orig, target): try: if target is None: raise ValueError("Target not found") protect(pm.process_handle, target, len(orig), 0x40) pymem.memory.write_bytes(pm.process_handle, target, orig, len(orig)) except Exception as e: print(f"Disable error: {e}") # Main entry point def main(): try: pm = pymem.Pymem(MODULE) print(f"Connected: {MODULE} (PID {pm.process_id})") in_addr, orig, target = enable_noclip(pm) # Enable Noclip and get state if not in_addr or not target: return print("Enable failed") input("Press Enter to disable...") disable_noclip(pm, in_addr, orig, target) # Restore original state except pymem.exception.ProcessNotFound: print(f"{MODULE} not found") except Exception as e: print(f"Error: {e}") finally: if 'pm' in locals(): pm.close_process() # Run main when the script is executed if __name__ == "__main__": main()

import time from pymem import Pymem TROVE_EXE = "Trove.exe" LOCAL_PLAYER_OFFSET = 0x1097680 TICK_DELAY = 0.02 BYPASS_PUSH = 0.4 # Bypass def full_distance_bypass(): try: pm = Pymem(TROVE_EXE) base_address = pm.base_address + LOCAL_PLAYER_OFFSET print("[✓] bypass running. ") while True: x = pm.read_float(base_address + 0x80) y = pm.read_float(base_address + 0x84) z = pm.read_float(base_address + 0x88) pm.write_float(base_address + 0x80, x + BYPASS_PUSH) pm.write_float(base_address + 0x88, z + BYPASS_PUSH) time.sleep(TICK_DELAY) except KeyboardInterrupt: print("\n[!] Bypass manually stopped.") except Exception as e: print(f"[!] Error: {e}") full_distance_bypass()

import time import pymem import pymem.process import pymem.ptypes # === Configuration === TROVE_EXE = "Trove.exe" LOCAL_PLAYER_OFFSET = 0x1097680 # Offset to local player pointer Pos_off = [0x8, 0x28, 0xC4, 0x4, 0x80] # Pointer chain to position struct # Signature and patch bytes for enabling/disabling bypass bypass_sig_off = bytes([0xDC, 0x67, 0x68, 0xC6, 0x45, 0xFF, 0x01, 0xD9]) bypass_sig_on = bytes([0xDC, 0x47, 0x68, 0xC6, 0x45, 0xFF, 0x01, 0xD9]) # Bypass settings bypass_enabled = False TICK_DELAY = 0.02 # Delay between position updates BYPASS_PUSH = 0.4 # Amount to push position forward # === Helper: Follow a pointer chain === def read_pointer_chain(pm, base, offsets): """Follow a pointer chain and return the final address.""" if not offsets: return base try: ptr = pymem.ptypes.RemotePointer(pm.process_handle, base) for offset in offsets[:-1]: ptr = pymem.ptypes.RemotePointer(pm.process_handle, ptr.value + offset) return ptr.value + offsets[-1] except Exception: return None # === Bypass Logic === def full_distance_bypass(): try: pm = pymem.Pymem(TROVE_EXE) # Get base address of Trove.exe module base_address = pymem.process.module_from_name(pm.process_handle, TROVE_EXE).lpBaseOfDll print("[✓] Bypass running...") # Calculate local player base pointer local_player = base_address + LOCAL_PLAYER_OFFSET # Scan for bypass signature if bypass_enabled: sig = pymem.pattern.pattern_scan_module(pm.process_handle, pm.process_base, bypass_sig_off) pm.write_bytes(sig, bypass_sig_on, len(bypass_sig_on)) print(f"[✓] Signature found at: {hex(sig)}") else: sig = pymem.pattern.pattern_scan_module(pm.process_handle, pm.process_base, bypass_sig_on) pm.write_bytes(sig, bypass_sig_off, len(bypass_sig_off)) print(f"[✓] Signature found at: {hex(sig)}") # Main loop: constantly push the player forward while True: pos_addr = read_pointer_chain(pm, local_player, Pos_off) if pos_addr: x = pm.read_float(pos_addr) y = pm.read_float(pos_addr + 0x8) # Not used, but read z = pm.read_float(pos_addr + 0x4) # Write updated position to memory pm.write_float(pos_addr, x + BYPASS_PUSH) pm.write_float(pos_addr + 0x4, z + BYPASS_PUSH) else: print("[!] Failed to resolve position address") time.sleep(TICK_DELAY) except KeyboardInterrupt: print("\n[!] Bypass manually stopped.") except Exception as e: print(f"[!] Error: {e}") # === Start the bypass === full_distance_bypass()

Local player offset

Post a Reply

Similar Threads

Tags for this Thread