[update] Tibia 9.31

[megano0body]

acPrintName 004F04AF
acPrintFPS 0045A993
acShowFPS 86E8D2
acNopFPS 0045A8E9
acPrintText 004B7090
acPrintMap 004F2444
acPrintMapNext 004F2449
acPrintMapOriginal 004F51F0

acSendFunction 004FBA80
acSendBuffer 828A08
acSendBufferSize 9B4894
acGetNextPacket 004FC460
acRecvStream 9B4880

AdrNameSpy1 004F344B
AdrNameSpy2 004F3458
NameSpy1Default 5075
NameSpy2Default 4375
NameSpy1Enabled 9090
NameSpy2Enabled 9090

LevelSpyDefault = 89 86 C0 5B 00 00

LevelSpy1 004EF31F
LevelSpy2 004EF40B
LevelSpy3 004EF47B
LevelSpyAdd1 28
LevelSpyAdd2 5BC0

AdrDatPtr 829220
AdrFrameRatePointer 86F638
AdrScreenRectAndLevelSpyPtr 871884
AdrMapPointer 8741A8

AdrLastSeeID 9B4C10
AdrSelfConnection 82B8DC

AdrBattle 7E7188

AdrVip 7E4ED8
AdrFlags 7E4ECC
AdrSkills 7E716C
AdrSkillsPercent 81F060
AdrExperience 81F000
AdrCapacity 81F00C
AdrStamina 81F094
AdrSoul 81F038
AdrMana 81F04C
AdrManaMax 81EFF8
AdrHP 7E4EC4
AdrHPMax 81F090
AdrLevel 81F034
AdrLevelPercent 81F08C
AdrMagic 81F03C
AdrMagicPercent 81F044
AdrID 81F09C
AdrAcc (^.^)

AdrGoToX 81F098
AdrGoToY 81F080
AdrGoToZ 7E4ED4

AdrAttackSquare 81F048
AdrAttackID 86E8D4
AdrAttackTimer 9B5EC8

AdrInventory 874118
AdrContainer 8718A8

[Dark Pallys]

Has ASLR been disabled on 9.31?

[DarkstaR]

I haven't actually checked the base address, but Visual Studio allows me to toggle ASLR on and off in the command prompt. That indicates that Tibia's header does have a relocation table, meaning it should have ASLR.

[Dark Pallys]

I reinstalled Tibia and compared the executables (patched and clean install) and they were exactly the same o.O

[DarkstaR]

What do you mean? ASLR takes effect in the forking of the executable. When the executable is loaded into memory it is placed at a random* location within the heap. The executable also has what is called a relocation table** that references all static references to code or memory so the forking can properly align the addresses. The binaries can still be the same.

*From what I've seen, Tibia keeps the same base across restarts. E.G. I ran 3 Tibia's, they all had base 00D00000, along with all Tibia's following them. This pattern only changed after restarting my machine.
**This is based on things I've read from Google. I'm not exactly sure how it works.

[Dark Pallys]

Ahh that may be it.. My Tibia was still using base 00400000 even after the reinstall.. but that's probably because I didn't actually run Tibia with ASLR enabled, ever. :P

[maozao]

Ahh that may be it.. My Tibia was still using base 00400000 even after the reinstall.. but that's probably because I didn't actually run Tibia with ASLR enabled, ever. :P

But, if you are using a Win 7/Vista the ASLR is enabled again if you reinstall your Tibia.

[Dark Pallys]

Still.. really odd.. I reinstalled Tibia, and rebooted my pc.. and base is still 00400000..

anyway.. I can't get packet.dll to work.. :/

[code=asm]
;The call to WS2_32.send
MEMORY_ADDRESS_Send_Pointer equ 006C5960h

;The value in the mov ecx before the call to WS2_32.send
MEMORY_ADDRESS_Socket_Pointer equ 0086EB00h

;The key used to encrypt/decrypt the packets
MEMORY_ADDRESS_XTEA_Key equ MEMORY_ADDRESS_Socket_Pointer + 2Ch[/code]

The addresses seem to be correct.. le sigh

[maozao]

XTea_Key = 0x7DCE78

[DarkstaR]

DP, I'm pretty sure your on my msn so hit me up and I'll see if I can maybe help with packet.dll. I've never touched it nor have I used pure masm, but I'm good at inline asm and reversing. Also, I use the same method in my bot that packet.dll uses (I think?).