How to use Windows XP Tibia 9.1+ address in Vista/7

[Blackd]

Updated code of my VB6 function.
Now you don't need to know region size of Tibia.exe
Now it will work in any Tibia version since 9.1.
Tested up to version 9.44

Public Function getProcessBase(ByVal hProcess As Long, Optional PIDinsteadHp As Boolean = False) As Long
    On Error GoTo goterr
    Const expectedRegionSize As Long = &H2C3000
    Dim lpMem As Long, ret As Long, lLenMBI As Long
    Dim lWritten As Long, CalcAddress As Long, lPos As Long
    Dim sBuffer As String
    Dim sSearchString As String, sReplaceString As String
    Dim si As SYSTEM_INFO
    Dim mbi As MEMORY_BASIC_INFORMATION
    Dim realH As Long
    Dim pid As Long
    Dim res As Long
    If PIDinsteadHp = True Then
        res = GetWindowThreadProcessId(hProcess, pid)
        realH = OpenProcess(PROCESS_READ_WRITE_QUERY, False, pid)
        hProcess = realH
    End If
    Call GetSystemInfo(si)
    lpMem = si.lpMinimumApplicationAddress
    lLenMBI = Len(mbi)
    ' Scan memory
    Do While lpMem < si.lpMaximumApplicationAddress
        mbi.RegionSize = 0
        ret = VirtualQueryEx(hProcess, ByVal lpMem, mbi, lLenMBI)
        If ret = lLenMBI Then
            If (mbi.State = MEM_COMMIT) Then
'           Debug.Print "BaseAddress=" & Hex(mbi.BaseAddress)
'           Debug.Print "AllocationBase=" & Hex(mbi.AllocationBase)
'           Debug.Print "RegionSize=" & Hex(mbi.RegionSize)
           If (mbi.RegionSize >= expectedRegionSize) Then ' this is the interesting region
                If PIDinsteadHp = True Then
                   CloseHandle hProcess
                End If
               getProcessBase = mbi.AllocationBase
               Exit Function
           End If
          
           End If
           lpMem = mbi.BaseAddress + mbi.RegionSize
        Else
           Exit Do
        End If
    Loop
    If PIDinsteadHp = True Then
       CloseHandle hProcess
    End If
goterr:
    getProcessBase = 0
End Function

[Blequi]

I made some tests and worked great, I'm not at home now, so I will post what I remember from my head:

[code=csharp]Uint32 OffSet = Client.Process.MainModule.BaseAdress.ToUint32() - 0x400000; //Not sure about the BaseAddress path now
Player.Addresses.Experience += OffSet; //Player Exp Address must be the address used in the Windows XP
MessageBox.Show("Exp: " + Client.Memory.ReadUint32(Player.Addresses.Experien ce)); //Just to check if worked.[/code]

Nice and easy ;D

I will post the correct code when I'm in home, but it's just to show you how easy it is.

You don't need to check the OS, because if you are using WindowsXP the OffSet value will be 0, so 0x123456 + 0 = 0x123456

Tested in a Windows Seven and worked good.

Cya~

Assuming you've tested this method above and is working,
what's mean the "Client.Process.MainModule.BaseAdress.ToUint32 ()"?

If you answer in easy words (for a noob) i'll thank you.

PS: As you can see, I'm noob and avoiding try to write all the blackd method in Delphi... then i hope that you described is easier than first posted by blackd.

If someone have this written in Delphi, I would thank.

[matzen]

Post edited, I decided to create a new thread: http://tpforums.org/forum/thread-10179.html

Hopefully my thread will help those who, like me, are having difficult in using Blackd's code to read random addresses on Windows 7.

[Czepek]

Jesus, have you ever heard about BBCode's? (in this case MyCode)

[.code]Your code here[./code]

[.code=language]Your code here.[./code]

[size=xx-small]Remove dots[/size]

Regards, Czepek!

[matzen]

Hey, I know about it, but I personally chose not to use the code tag in order to not display the scroll bar.

Can you help me with inserting Blackd's code into my module? I just need to find the damn BaseAddress so I can find the TWO offsets in question. It can't be that hard, but I am a newbie. All that I need is a working example. I have no idea where Blackd's code go, and what I have to call to use it.

[Czepek]

Do you know that BlackD tools are open sourced? Feel free to use it, but remember to put credits to the real author of code.

Regards, Czepek!

[matzen]

Yeah, I know they are open source, but I can't deduce anything from looking at them as of yet, hence my post. I edited it btw, and created a thread.

[matzen]

Stupid question: does it also work on Win7 64bit? I am grateful that my code is now working on Win7 thanks to Blackd, but I have yet to test it on Win7 64bit.

[gorgonas]

I try your function and dont works for me.

following that link

http://czepekpage.pl/index.php?page=threads&tid=21

I traduce function and make some changes to use in VB6.

that is the code.

Public Declare Function Module32First Lib "kernel32" (ByVal hSnapshot As Long, uProcess As MODULEENTRY32) As Long
Public Declare Function Module32Next Lib "kernel32" (ByVal hSnapshot As Long, uProcess As MODULEENTRY32) As Long
Public Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Public Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal lFlags As Long, ByVal lProcessID As Long) As Long

Public Const TH32CS_SNAPMODULE = &H8


Private Type MODULEENTRY32
  dwSize As Long
  th32ModuleID As Long
  th32ProcessID As Long
  GlblcntUsage As Long
  ProccntUsage As Long
  modBaseAddr As Long
  modBaseSize As Long
  hModule As Long
  szModule As String * 256
  szExePath As String * 260
End Type


Public Function ObtenerBase() As Long
Dim tibiaclient As Long
Dim pid As Long
Dim SnapShot As Long
Dim Base As Long
Dim ModuleEntry  As MODULEENTRY32
Dim CurrentModule As Long

Base = 0

tibiaclient = FindWindow("tibiaclient", vbNullString)
GetWindowThreadProcessId tibiaclient, pid

If pid = 0 Then
    ObtenerBase = Base
    Exit Function
End If

SnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid)

ModuleEntry.dwSize = Len(ModuleEntry)

CurrentModule = Module32First(SnapShot, ModuleEntry)

If Right(Left(ModuleEntry.szModule, InStr(ModuleEntry.szModule, Chr(0)) - 1), 4) = ".exe" Then
    Base = ModuleEntry.modBaseAddr
Else
    Do While CurrentModule
        If Right(Left(ModuleEntry.szModule, InStr(ModuleEntry.szModule, Chr(0)) - 1), 4) = ".exe" Then
            Base = ModuleEntry.modBaseAddr
            Exit Do
        End If
        CurrentModule = Module32Next(SnapShot, ModuleEntry)
    Loop
End If

CloseHandle (SnapShot)
    
ObtenerBase = Base

End Function

Public Function PreparaMemoria(Memoria As Long) As Long
Dim Base As Long
Dim XPBase As Long

XPBase = &H400000
Base = ObtenerBase

If Base = 0 Then
    Exit Function
End If

Memoria = Memoria + (Base - XPBase)

PreparaMemoria = Memoria
End Function

sorry for my bad english, i hope that function will be useful.

[matzen]

I try your function and dont works for me.

following that link

http://czepekpage.pl/index.php?page=threads&tid=21

I traduce function and make some changes to use in VB6.

that is the code.

Public Declare Function Module32First Lib "kernel32" (ByVal hSnapshot As Long, uProcess As MODULEENTRY32) As Long
Public Declare Function Module32Next Lib "kernel32" (ByVal hSnapshot As Long, uProcess As MODULEENTRY32) As Long
Public Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Public Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal lFlags As Long, ByVal lProcessID As Long) As Long

Public Const TH32CS_SNAPMODULE = &H8


Private Type MODULEENTRY32
  dwSize As Long
  th32ModuleID As Long
  th32ProcessID As Long
  GlblcntUsage As Long
  ProccntUsage As Long
  modBaseAddr As Long
  modBaseSize As Long
  hModule As Long
  szModule As String * 256
  szExePath As String * 260
End Type


Public Function ObtenerBase() As Long
Dim tibiaclient As Long
Dim pid As Long
Dim SnapShot As Long
Dim Base As Long
Dim ModuleEntry  As MODULEENTRY32
Dim CurrentModule As Long

Base = 0

tibiaclient = FindWindow("tibiaclient", vbNullString)
GetWindowThreadProcessId tibiaclient, pid

If pid = 0 Then
    ObtenerBase = Base
    Exit Function
End If

SnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid)

ModuleEntry.dwSize = Len(ModuleEntry)

CurrentModule = Module32First(SnapShot, ModuleEntry)

If Right(Left(ModuleEntry.szModule, InStr(ModuleEntry.szModule, Chr(0)) - 1), 4) = ".exe" Then
    Base = ModuleEntry.modBaseAddr
Else
    Do While CurrentModule
        If Right(Left(ModuleEntry.szModule, InStr(ModuleEntry.szModule, Chr(0)) - 1), 4) = ".exe" Then
            Base = ModuleEntry.modBaseAddr
            Exit Do
        End If
        CurrentModule = Module32Next(SnapShot, ModuleEntry)
    Loop
End If

CloseHandle (SnapShot)
    
ObtenerBase = Base

End Function

Public Function PreparaMemoria(Memoria As Long) As Long
Dim Base As Long
Dim XPBase As Long

XPBase = &H400000
Base = ObtenerBase

If Base = 0 Then
    Exit Function
End If

Memoria = Memoria + (Base - XPBase)

PreparaMemoria = Memoria
End Function

sorry for my bad english, i hope that function will be useful.

Hey! I managed to fix my program to work on Vista/7 quite a few months ago. Like I said, I used BlackD's open source function to get Tibia's base address.

Nonetheless, thank you.