Reading map data (stuck...)

UPDATE:
Now, the first part of the code checks whether Y is in range 0x0~0xFF.
If it's larger than 0xFF, blockType is 0xFFFF. (sky?)
If it's smaller than 0x0, block Type is 0x000F. (ground that you can't dig further)

Then OMGWHATISTHIS1111111111

Code:

v4 = (X & 0xFFFFFFF0) - *(_DWORD *)(this + 4),
v5 = *(_DWORD *)(this + 0x14) * (((BYTE4(v4) & 0xF) + (signed int)v4) >> 4),
v6 = (Z & 0xFFFFFFF0) - *(_DWORD *)(this + 0xC),
v7 = *(_DWORD *)(*(_DWORD *)(this + 0x20)
                        + 4
                        * ((Y & 0xFFFFFFF0) / 16
                         + *(_DWORD *)(this + 0x18) * (((BYTE4(v6) & 0xF) + (signed int)v6) >> 4)
                         + v5)))

//??? =  4 *((Y & 0xFFFFFFF0)/0x10 + ????)
//v7 = *(DWORD *)(*(DWORD *)(this+0x20) + 4*???)

Say X,Y,Z are the coordinates of the block.

Code:

mapDataAddress = *(DWORD *)(??? + 0x2C) + 8*( 0x100 *(Y&0xF) | 0x10*(Z&0xF) | (X&0xF) );

Now the ??? address is calculated in a complicated way so I'm stuck. Any ideas?

From IDA

Code:

signed __int16 __thiscall sub_9060E0(struct_mapBlockBase *this, int X, int Y, int Z)
{
  __int64 v4; // qax@2
  int v5; // ecx@2
  __int64 v6; // qax@2
  int mapBlockAddress; // eax@2
  signed __int16 result; // ax@3
  struct_mapBlockBase *mapBlockBase; // [sp+Ch] [bp-4h]@1

  mapBlockBase = this;
  if ( Y & 0xFFFFFF00
    || (v4 = (X & 0xFFFFFFF0) - this->nearX,
        v5 = this->totalSize * (((BYTE4(v4) & 0xF) + v4) >> 4),
        v6 = (Z & 0xFFFFFFF0) - mapBlockBase->nearZ,
        (mapBlockAddress = *(mapBlockBase->baseAddress
                           + 4 * ((Y & 0xFFFFFFF0) / 0x10u + mapBlockBase->diff * (((BYTE4(v6) & 0xF) + v6) >> 4) + v5))) == 0) )
  {
    result = 0xFu;
    if ( Y >= 0 )
      result = 0xFFFFu;
  }
  else
  {
    result = *(*(mapBlockAddress + 0x2C) + 8 * (X & 0xF | 16 * (Z & 0xF | 16 * (Y & 0xF))));
  }
  return result;
}

Caller function *(*v8 + 0x24)

Code:

v8 = *(this + 0x34);
byte_CB7E80[(*(*v8 + 0x24))(v19, v18, v17)]

X Y Z for teleport ?

Originally Posted by darkm125

X Y Z for teleport ?

Not teleport, X,Y,Z are coordinates for block not player

I'm trying to read block data to find ores and water:
unsigned char blockData[8] --> 1B 00 xx 00 00 ?? 00 00
then for ?? I have
0: shapestone
1: formicite
2: infinitum
3: primodial flame
4: golden soul
5: block recipe
6: glacier shard
7: somber soul
8+: crystalized cloud
but I can't find pointer address.
Water is 13 00 xx xx 00 00 00 00

I tried teleport hack but if you "move" too fast the server sends you back.
Also if you try to clip inside walls the servers sends you to the surface. . .

LIKE THIS

The memory region however is only 16x16x16 cubes (0x8000) so I don't know how to read other map areas

Xd you have spawn block ?

@darkm125

Yes but it does not sync with server :c
Also I don't have pointer to block memory region :c
Good news is you can "remove" walls for wallhack

How did you make your ore finder though? Did you hook D3D or read from memory :o

Originally Posted by fairytalesx

@<a href="http://www.mpgh.net/forum/member.php?u=2750846" target="_blank">darkm125</a>


Yes but it does not sync with server :c
Also I don't have pointer to block memory region :c
Good news is you can "remove" walls for wallhack

How did you make your ore finder though? Did you hook D3D or read from memory

Wallhack is outdated now is 2d radar hack ( shapestone position work 100%, need debug other ore )

Originally Posted by darkm125

Wallhack is outdated now is 2d radar hack ( shapestone position work 100%, need debug other ore )

Nice job

Did you use d3d hook? Is it internal hack or external D3D overlay?

(or swf injection? 0.0)

swf injection.

Originally Posted by darkm125

swf injection.

Interesting. . .

Did you load it through something like IggyPlayerCreateFromMemory or by editing existing game swf files?

@fairytalesx hey the itemdesc afterxor it is + 0x80 right? However its only read the 1st line of desc do u know if there is offset for desc line too in IDA? Because i cant find it i can only find the xor i keep asking u and u keep ignore my question if u know where the desc start in ida can u take a pic of that location in IDA? And i can start from there Thank you

Originally Posted by taejim

They changed the function address so I had to find it again. . .

Code:

.text:0082A330 sub_82A330      proc near               ; CODE XREF: sub_98A450+DCp
.text:0082A330                                         ; sub_9D7200+39p ...
.text:0082A330
.text:0082A330 arg_0           = dword ptr  8
.text:0082A330
.text:0082A330                 push    ebp
.text:0082A331                 mov     ebp, esp
.text:0082A333                 push    esi
.text:0082A334                 mov     esi, [ebp+arg_0]
.text:0082A337                 mov     dword ptr [esi], 0
.text:0082A33D                 mov     dword ptr [esi+4], 0
.text:0082A344                 mov     dword ptr [esi+8], 0
.text:0082A34B                 push    dword ptr [ecx+78h] ; Size  ItemDescSize
.text:0082A34E                 push    dword ptr [ecx+80h] ; Src   ItemDescOffset
.text:0082A354                 mov     ecx, esi ;Base of XORProtected Address
.text:0082A356                 call    sub_75F380 ;call to memcpy
.text:0082A35B                 mov     eax, esi
.text:0082A35D                 pop     esi
.text:0082A35E                 pop     ebp
.text:0082A35F                 retn    4

This is the function which copies text for display when you hover on an item

Originally Posted by fairytalesx

They changed the function address so I had to find it again. . .

Code:

.text:0082A330 sub_82A330      proc near               ; CODE XREF: sub_98A450+DCp
.text:0082A330                                         ; sub_9D7200+39p ...
.text:0082A330
.text:0082A330 arg_0           = dword ptr  8
.text:0082A330
.text:0082A330                 push    ebp
.text:0082A331                 mov     ebp, esp
.text:0082A333                 push    esi
.text:0082A334                 mov     esi, [ebp+arg_0]
.text:0082A337                 mov     dword ptr [esi], 0
.text:0082A33D                 mov     dword ptr [esi+4], 0
.text:0082A344                 mov     dword ptr [esi+8], 0
.text:0082A34B                 push    dword ptr [ecx+78h] ; Size  ItemDescSize
.text:0082A34E                 push    dword ptr [ecx+80h] ; Src   ItemDescOffset
.text:0082A354                 mov     ecx, esi ;Base of XORProtected Address
.text:0082A356                 call    sub_75F380 ;call to memcpy
.text:0082A35B                 mov     eax, esi
.text:0082A35D                 pop     esi
.text:0082A35E                 pop     ebp
.text:0082A35F                 retn    4

This is the function which copies text for display when you hover on an item

Thank you im just starting out with ida so this is really helpful thank you. And also the offset of item name 0x40 is it near the itemnamefunc?

Originally Posted by taejim

Thank you im just starting out with ida so this is really helpful thank you. And also the offset of item name 0x40 is it near the itemnamefunc?

Yes, here it is :)

Code:

.text:0098A507                 call    sub_829E10           ;call to copy ItemName
.text:0098A50C                 push    eax
.text:0098A50D                 lea     ecx, [esi+4]
.text:0098A510                 call    sub_764C20
.text:0098A515                 push    [ebp+var_10]
.text:0098A518                 lea     ecx, [ebp+var_8]
.text:0098A51B                 push    [ebp+Src]
.text:0098A51E                 call    sub_75E5C0
.text:0098A523                 mov     edi, [ebp+arg_0]
.text:0098A526                 lea     eax, [ebp+Size]
.text:0098A529                 push    eax
.text:0098A52A                 mov     ecx, edi
.text:0098A52C                 call    sub_82A330           ;call to copy ItemDescription

Originally Posted by fairytalesx

Yes, here it is

Code:

.text:0098A507                 call    sub_829E10           ;call to copy ItemName
.text:0098A50C                 push    eax
.text:0098A50D                 lea     ecx, [esi+4]
.text:0098A510                 call    sub_764C20
.text:0098A515                 push    [ebp+var_10]
.text:0098A518                 lea     ecx, [ebp+var_8]
.text:0098A51B                 push    [ebp+Src]
.text:0098A51E                 call    sub_75E5C0
.text:0098A523                 mov     edi, [ebp+arg_0]
.text:0098A526                 lea     eax, [ebp+Size]
.text:0098A529                 push    eax
.text:0098A52A                 mov     ecx, edi
.text:0098A52C                 call    sub_82A330           ;call to copy ItemDescription

thank you verymuch and i found out the XOR in multiple places not so i got the itenamefunction wrong so thank you so much

do you mind if i can have a copy of the idb of yours?

Also, the new update in the desc of the new fish there is like Weight: xxlbs ... and i cant seem to read that i can only read the 1st line of description anyidea why?

Originally Posted by taejim

thank you verymuch and i found out the XOR in multiple places not so i got the itenamefunction wrong so thank you so much

My idb is just a fresh decompile of Trove.exe build in 11/8 and it will be too large to upload.

EDIT2: Should be non-string (float or something)

Reading map data (stuck...)

Post a Reply

Similar Threads

Tags for this Thread