[6/8] Using memory to detect boots (almost)

WARNING: This is NOT actually 100% reliable in identify boots x__x, this is used to tell whether a confirmation message will appear if you drop the item.
(Confirmation messages ('safe trade can be performed in trading post' never appear for dropping boots though)
(Small amount of ores could be false positives)

As far as I know most public bots seem to use image compare instead of reading memory for dropping boots...
This is my original research, if you use this in your bot please give credits :)

Base: trove.exe+0x0088F584
Pointers: 0x17c, 0x78, i*4, 0x40, 0x88, 0
where i is the inventory slot index

Data: (the complicated part, please see C++ implementation below)
First you have to xor the data with 0x88940CB6
Then you add 0x190 to get your address...

Outcome:
0 if a warning is not given when the item is dropped, 1 if a warning is given when the item is dropped

NOTE: As of inventory slot upgrade update, inventory slot beyond 45 has not been tested. :o

Inventory has to be kept open for the pointers to work.

Code:

#define INVENTORY_ADDR 0x0088F584
#define MAGIC_CONV 0x88940CB6
#define INVENTORY_SLOT_COUNT 45

//Get base address
DWORD gameBase = x::GetModuleBase(pid,_T("trove.exe"));
//Get inventory base address
DWORD invCBase = gameBase+INVENTORY_ADDR;

long invIds[INVENTORY_SLOT_COUNT]; //allocate array for storing results
if ( x::RPM<DWORD>(pid,invCBase) ) //if inventory is open
{
	for (size_t i = 0; i < INVENTORY_SLOT_COUNT; i++)
	{
		DWORD invObjOff[] = {0x17c, 0x78, i*4, 0x40};
		DWORD invObjAddr = x::RPMPtr(pid,invCBase,invObjOff,sizeof(invObjOff)/sizeof(DWORD)); //get pointer address
		DWORD invObj = x::RPM<DWORD>(pid,invObjAddr); //read process memory
		if (invObj) //the slot is filled with an item
		{
			DWORD invIdOff[] = {0x17c, 0x78, i*4, 0x40, 0x88, 0};
			DWORD invIdAddr = x::RPMPtr(pid,invCBase,invIdOff,sizeof(invIdOff)/sizeof(DWORD)); //get pointed address
			invIdAddr = ((x::RPM<DWORD>(pid,invIdAddr)) ^ MAGIC_CONV) + 0x190; //some weird xor (game protection?)
			invIds[i] = x::RPM<BYTE>(pid, invIdAddr); //0 = no warning, 1 = give warning
		}
		else
			invIds[i] = 0xFFFFFFFF; //slot is empty
	}
}

invIds[i] will be either -1 (empty), 0 (no drop warning) or 1 (give drop warning)

Before you C+P the code above, I would remind you to replace the following:

Code:

DWORD x::GetModuleBase(DWORD pid, TCHAR *szModuleName)

with your own implementation of - Get remote module address (at which the module is loaded)

Code:

DWORD x::RPMPtr (DWORD pid, DWORD baseAddress, DWORD *offsets, size_t offsets_size)

Get pointed address (not data!) from offsets

Code:

template <typename T> T x::RPM(pid, DWORD dwAddress)

- Read process memory at dwAddress

Please be easy on my 1st post.

Good work man, interesting work. I have never look at it this way but i doubt this method is faster than img recognition since correct me if im wrong but ur method is check for everyslot if the item drop will give the drop warning right if it gives then select no and move on to the next slot? Then again brilliant work

Also game server update too much and finding pointer seem to be a not prefered method right now IMO

Originally Posted by taejim

Good work man, interesting work. I have never look at it this way but i doubt this method is faster than img recognition since correct me if im wrong but ur method is check for everyslot if the item drop will give the drop warning right if it gives then select no and move on to the next slot? Then again brilliant work

Also game server update too much and finding pointer seem to be a not prefered method right now IMO

Hmm. . . you don't have to check every slot actually, since when you fish the boot get placed in the first empty slot in your inventory.
Therefore checking where the first empty slot is will suffice.
Assuming you don't move items around while you fish, you can carry the check in a single fixed slot index.

I am not saying this is faster than img recognition (it could be), but I don't really like working with images in my own bot implementation.
Whether it is fast or slow depends on your implementation (e.g. checking every time you reel in vs checking all slots every 10 mins)

For pointers, I think there are methods out there to read them directly from disk image (Trove.exe) but I am not entirely sure.

Originally Posted by taejim

Good work man, interesting work. I have never look at it this way but i doubt this method is faster than img recognition since correct me if im wrong but ur method is check for everyslot if the item drop will give the drop warning right if it gives then select no and move on to the next slot? Then again brilliant work

Also game server update too much and finding pointer seem to be a not prefered method right now IMO

Does it really matter if it's faster or not? Some math: you have 50 inventory slots, when you have all fish you have 35 slots left, it takes at least a couple of hours to fill these slots with boots.
I'm currently running a custom bot with 24 accounts. I loop between all clients every 30mins to check for and drop boots. I've never even had to drop more than 10 boots which means I have 25 more slots. So speed is really not an issue imo

Originally Posted by zlol

Does it really matter if it's faster or not? Some math: you have 50 inventory slots, when you have all fish you have 35 slots left, it takes at least a couple of hours to fill these slots with boots.
I'm currently running a custom bot with 24 accounts. I loop between all clients every 30mins to check for and drop boots. I've never even had to drop more than 10 boots which means I have 25 more slots. So speed is really not an issue imo

This sounds amazing.... I'm currently running 12 bots and I stopped myself there because of issues with it trying to drop boots on multiple clients at once only to mess up the clients and cause them not to fish/other things. Would you be willing to share your bot? I don't mind if it is in EXE form I just would REALLY love this and it'd help me a crap ton.

I'll start working on public client. I want to keep my personal one private, but I'm planning to release a public one after I'm done rewriting it. but since I work ~70 hours a week I don't have much spare time to work on it (as I prefer to actually play when I can

) so it could take weeks before it's ready

Originally Posted by zlol

I'll start working on public client. I want to keep my personal one private, but I'm planning to release a public one after I'm done rewriting it. but since I work ~70 hours a week I don't have much spare time to work on it (as I prefer to actually play when I can

) so it could take weeks before it's ready

Dang. Sounds like it'll be forever by the time you release it xD Fish botting will be obsolete

What have you set for InvCBase?

Originally Posted by sizzlorox

What have you set for InvCBase?

Oh it is the inventory object pointer :P
trove.exe+0x0088F584

its value is NULL if the inventory is not open, so inventory has to be open for the values to load

Remember if you are using Image Compare you are actually evaluating many pixels so I don't really see it's faster than reading from the pointer.

Originally Posted by fairytalesx

Oh it is the inventory object pointer :P
trove.exe+0x0088F584

its value is NULL if the inventory is not open, so inventory has to be open for the values to load

Remember if you are using Image Compare you are actually evaluating many pixels so I don't really see it's faster than reading from the pointer.

1 question how do you find the inventory object pointer?

Originally Posted by taejim

1 question how do you find the inventory object pointer?

Here

its value is NULL if the inventory is not open, so inventory has to be open for the values to load

Originally Posted by Jhem

Here

You dont even understand my question im asking him how he find the pointer address using cheat engine lol

Originally Posted by taejim

You dont even understand my question im asking him how he find the pointer address using cheat engine lol

Open inventory---> Scan for 1
Close inventory-->Scan for 0
repeat this until you got 1 address...

Originally Posted by U mirin brah?

Open inventory---> Scan for 1
Close inventory-->Scan for 0
repeat this until you got 1 address...

You don't understant too ..

Originally Posted by Jhem

1 question how do you find the inventory object pointer?

Ex:
Boot in slot 1 : 0xAAAA, and how to find it ..
Flux in slot 2 : 0xBBBB and how to find it ..
..

....................................

[6/8] Using memory to detect boots (almost)

Post a Reply

Similar Threads

Tags for this Thread