We got a problem?

[lifriet]

Wtf is happenning with 9.43 addresses? Appears to be all pointers, I'm right?


PS: I'm so high at now

Edit: Ye, things changed so much.

[maozao]

Omfg! o.o

I'm downloading the client right now.

[Hey there]

Is that so? You guys will get in trouble to update the whole thing?

[maozao]

Some addresses that looks like that aren't static anymore:

Player Health, Max health, Mana, Max Mana, Id, Cap(?)

More informations in the address thread when Mega~ creates it, wont stole the thread from him hehehe

[Blackd]

Some addresses that looks like that aren't static anymore:

Player Health, Max health, Mana, Max Mana, Id, Cap(?)

More informations in the address thread when Mega~ creates it, wont stole the thread from him hehehe

you are right, I am still trying to get new method to read such things from memory now. I am not very good with assembler.
I finally found the problem, and the solution:

Just look the difference between the code of Tibia at 9.42

00415E10  /$ 55             PUSH EBP
00415E11  |. 8BEC           MOV EBP,ESP
00415E13  |. 6A FF          PUSH -1
00415E15  |. 68 81B46C00    PUSH Tibia.006CB481
00415E1A  |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
00415E20  |. 50             PUSH EAX
00415E21  |. 81EC 44010000  SUB ESP,144
00415E27  |. A1 40067A00    MOV EAX,DWORD PTR DS:[7A0640]
00415E2C  |. 33C5           XOR EAX,EBP
00415E2E  |. 8945 EC        MOV DWORD PTR SS:[EBP-14],EAX
00415E31  |. 53             PUSH EBX
00415E32  |. 56             PUSH ESI
00415E33  |. 57             PUSH EDI
00415E34  |. 50             PUSH EAX
00415E35  |. 8D45 F4        LEA EAX,DWORD PTR SS:[EBP-C]
00415E38  |. 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
00415E3E  |. 8965 F0        MOV DWORD PTR SS:[EBP-10],ESP
00415E41  |. C745 FC 000000>MOV DWORD PTR SS:[EBP-4],0
00415E48  |. E8 C3AE0F00    CALL Tibia.00510D10
00415E4D  |. 0FB7F0         MOVZX ESI,AX
00415E50  |. E8 BBAE0F00    CALL Tibia.00510D10
00415E55  |. 0FB7F8         MOVZX EDI,AX
00415E58  |. E8 63B00F00    CALL Tibia.00510EC0
00415E5D  |. 8BD8           MOV EBX,EAX
00415E5F  |. E8 5CB00F00    CALL Tibia.00510EC0
00415E64  |. E8 F7B10F00    CALL Tibia.00511060
00415E69  |. 8985 D0FEFFFF  MOV DWORD PTR SS:[EBP-130],EAX
00415E6F  |. 8995 D4FEFFFF  MOV DWORD PTR SS:[EBP-12C],EDX
00415E75  |. E8 96AE0F00    CALL Tibia.00510D10
00415E7A  |. 0FB7C0         MOVZX EAX,AX
00415E7D  |. 8985 CCFEFFFF  MOV DWORD PTR SS:[EBP-134],EAX
00415E83  |. E8 E8AC0F00    CALL Tibia.00510B70
00415E88  |. 0FB6C8         MOVZX ECX,AL
00415E8B  |. 898D D8FEFFFF  MOV DWORD PTR SS:[EBP-128],ECX
00415E91  |. E8 7AAE0F00    CALL Tibia.00510D10
00415E96  |. 0FB7D0         MOVZX EDX,AX
00415E99  |. 8995 C8FEFFFF  MOV DWORD PTR SS:[EBP-138],EDX
00415E9F  |. E8 6CAE0F00    CALL Tibia.00510D10
00415EA4  |. 0FB7C0         MOVZX EAX,AX
00415EA7  |. 8985 DCFEFFFF  MOV DWORD PTR SS:[EBP-124],EAX
00415EAD  |. E8 BEAC0F00    CALL Tibia.00510B70
00415EB2  |. 0FB6C8         MOVZX ECX,AL
00415EB5  |. 898D BCFEFFFF  MOV DWORD PTR SS:[EBP-144],ECX
00415EBB  |. E8 B0AC0F00    CALL Tibia.00510B70
00415EC0  |. E8 ABAC0F00    CALL Tibia.00510B70
00415EC5  |. 0FB6D0         MOVZX EDX,AL
00415EC8  |. 8995 C4FEFFFF  MOV DWORD PTR SS:[EBP-13C],EDX
00415ECE  |. E8 9DAC0F00    CALL Tibia.00510B70
00415ED3  |. 0FB6C0         MOVZX EAX,AL
00415ED6  |. 8985 C0FEFFFF  MOV DWORD PTR SS:[EBP-140],EAX
00415EDC  |. E8 2FAE0F00    CALL Tibia.00510D10
00415EE1  |. 0FB7C8         MOVZX ECX,AX
00415EE4  |. 898D E0FEFFFF  MOV DWORD PTR SS:[EBP-120],ECX
00415EEA  |. E8 21AE0F00    CALL Tibia.00510D10
00415EEF  |. E8 1CAE0F00    CALL Tibia.00510D10
00415EF4  |. 8935 EC9C7A00  MOV DWORD PTR DS:[7A9CEC],ESI -> adrMyHP=&H7A9CEC
00415EFA  |. 893D 48C07A00  MOV DWORD PTR DS:[7AC048],EDI -> adrMyMaxHP=&H7AC048
00415F00  |. 891D C4BF7A00  MOV DWORD PTR DS:[7ABFC4],EBX
00415F06  |. 8B95 C8FEFFFF  MOV EDX,DWORD PTR SS:[EBP-138]
00415F0C  |. 8915 04C07A00  MOV DWORD PTR DS:[7AC004],EDX -> adrMyMana=&H7AC004
00415F12  |. 8B85 DCFEFFFF  MOV EAX,DWORD PTR SS:[EBP-124]
00415F18  |. A3 B0BF7A00    MOV DWORD PTR DS:[7ABFB0],EAX -> adrMyMaxMana=&H7ABFB0
00415F1D  |. 8B8D C0FEFFFF  MOV ECX,DWORD PTR SS:[EBP-140]
00415F23  |. 890D F0BF7A00  MOV DWORD PTR DS:[7ABFF0],ECX
00415F29  |. 8B95 E0FEFFFF  MOV EDX,DWORD PTR SS:[EBP-120]
00415F2F  |. 8915 4CC07A00  MOV DWORD PTR DS:[7AC04C],EDX
00415F35  |. 8B85 D8FEFFFF  MOV EAX,DWORD PTR SS:[EBP-128]
00415F3B  |. 50             PUSH EAX
00415F3C  |. 8B8D CCFEFFFF  MOV ECX,DWORD PTR SS:[EBP-134]
00415F42  |. 51             PUSH ECX
00415F43  |. 8B95 D4FEFFFF  MOV EDX,DWORD PTR SS:[EBP-12C]
00415F49  |. 52             PUSH EDX
00415F4A  |. 8B85 D0FEFFFF  MOV EAX,DWORD PTR SS:[EBP-130]
00415F50  |. 50             PUSH EAX
00415F51  |. E8 3A140500    CALL Tibia.00467390
00415F56  |. 8B8D C4FEFFFF  MOV ECX,DWORD PTR SS:[EBP-13C]           ; |
00415F5C  |. 51             PUSH ECX                                 ; |Arg2
00415F5D  |. 8B95 BCFEFFFF  MOV EDX,DWORD PTR SS:[EBP-144]           ; |
00415F63  |. 52             PUSH EDX                                 ; |Arg1
00415F64  |. E8 67170500    CALL Tibia.004676D0                      ; \Tibia.004676D0
00415F69  |. 83C4 18        ADD ESP,18
00415F6C  |. C745 FC FFFFFF>MOV DWORD PTR SS:[EBP-4],-1
00415F73  |. 8B4D F4        MOV ECX,DWORD PTR SS:[EBP-C]
00415F76  |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
00415F7D  |. 59             POP ECX
00415F7E  |. 5F             POP EDI
00415F7F  |. 5E             POP ESI
00415F80  |. 5B             POP EBX
00415F81  |. 8B4D EC        MOV ECX,DWORD PTR SS:[EBP-14]
00415F84  |. 33CD           XOR ECX,EBP
00415F86  |. E8 944B2600    CALL Tibia.0067AB1F
00415F8B  |. 8BE5           MOV ESP,EBP
00415F8D  |. 5D             POP EBP
00415F8E  \. C3             RETN

and same code, at Tibia 9.43...

00415D80  /$ 55             PUSH EBP
00415D81  |. 8BEC           MOV EBP,ESP
00415D83  |. 6A FF          PUSH -1
00415D85  |. 68 91B56C00    PUSH Tibia.006CB591
00415D8A  |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
00415D90  |. 50             PUSH EAX
00415D91  |. 81EC 44010000  SUB ESP,144
00415D97  |. A1 40067A00    MOV EAX,DWORD PTR DS:[7A0640]
00415D9C  |. 33C5           XOR EAX,EBP
00415D9E  |. 8945 EC        MOV DWORD PTR SS:[EBP-14],EAX
00415DA1  |. 53             PUSH EBX
00415DA2  |. 56             PUSH ESI
00415DA3  |. 57             PUSH EDI
00415DA4  |. 50             PUSH EAX
00415DA5  |. 8D45 F4        LEA EAX,DWORD PTR SS:[EBP-C]
00415DA8  |. 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
00415DAE  |. 8965 F0        MOV DWORD PTR SS:[EBP-10],ESP
00415DB1  |. C745 FC 000000>MOV DWORD PTR SS:[EBP-4],0
00415DB8  |. E8 E3B00F00    CALL Tibia.00510EA0
00415DBD  |. 0FB7F0         MOVZX ESI,AX
00415DC0  |. E8 DBB00F00    CALL Tibia.00510EA0
00415DC5  |. 0FB7F8         MOVZX EDI,AX
00415DC8  |. E8 83B20F00    CALL Tibia.00511050
00415DCD  |. 8BD8           MOV EBX,EAX
00415DCF  |. E8 7CB20F00    CALL Tibia.00511050
00415DD4  |. E8 17B40F00    CALL Tibia.005111F0
00415DD9  |. 8985 D0FEFFFF  MOV DWORD PTR SS:[EBP-130],EAX
00415DDF  |. 8995 D4FEFFFF  MOV DWORD PTR SS:[EBP-12C],EDX
00415DE5  |. E8 B6B00F00    CALL Tibia.00510EA0
00415DEA  |. 0FB7C0         MOVZX EAX,AX
00415DED  |. 8985 CCFEFFFF  MOV DWORD PTR SS:[EBP-134],EAX
00415DF3  |. E8 08AF0F00    CALL Tibia.00510D00
00415DF8  |. 0FB6C8         MOVZX ECX,AL
00415DFB  |. 898D D8FEFFFF  MOV DWORD PTR SS:[EBP-128],ECX
00415E01  |. E8 9AB00F00    CALL Tibia.00510EA0
00415E06  |. 0FB7D0         MOVZX EDX,AX
00415E09  |. 8995 C8FEFFFF  MOV DWORD PTR SS:[EBP-138],EDX
00415E0F  |. E8 8CB00F00    CALL Tibia.00510EA0
00415E14  |. 0FB7C0         MOVZX EAX,AX
00415E17  |. 8985 DCFEFFFF  MOV DWORD PTR SS:[EBP-124],EAX
00415E1D  |. E8 DEAE0F00    CALL Tibia.00510D00
00415E22  |. 0FB6C8         MOVZX ECX,AL
00415E25  |. 898D BCFEFFFF  MOV DWORD PTR SS:[EBP-144],ECX
00415E2B  |. E8 D0AE0F00    CALL Tibia.00510D00
00415E30  |. E8 CBAE0F00    CALL Tibia.00510D00
00415E35  |. 0FB6D0         MOVZX EDX,AL
00415E38  |. 8995 C4FEFFFF  MOV DWORD PTR SS:[EBP-13C],EDX
00415E3E  |. E8 BDAE0F00    CALL Tibia.00510D00
00415E43  |. 0FB6C0         MOVZX EAX,AL
00415E46  |. 8985 C0FEFFFF  MOV DWORD PTR SS:[EBP-140],EAX
00415E4C  |. E8 4FB00F00    CALL Tibia.00510EA0
00415E51  |. 0FB7C8         MOVZX ECX,AX
00415E54  |. 898D E0FEFFFF  MOV DWORD PTR SS:[EBP-120],ECX
00415E5A  |. E8 41B00F00    CALL Tibia.00510EA0
00415E5F  |. E8 3CB00F00    CALL Tibia.00510EA0
00415E64  |. A1 08409400    MOV EAX,DWORD PTR DS:[944008]  --- first address related with hp/mana =&H944008
00415E69  |. 8BD0           MOV EDX,EAX
00415E6B  |. 33D6           XOR EDX,ESI
00415E6D  |. 8915 00409400  MOV DWORD PTR DS:[944000],EDX
00415E73  |. 8BC8           MOV ECX,EAX
00415E75  |. 33CF           XOR ECX,EDI
00415E77  |. 890D 8CBE9700  MOV DWORD PTR DS:[97BE8C],ECX
00415E7D  |. 8BD0           MOV EDX,EAX
00415E7F  |. 33D3           XOR EDX,EBX
00415E81  |. 8915 80BE9700  MOV DWORD PTR DS:[97BE80],EDX
00415E87  |. 8BC8           MOV ECX,EAX
00415E89  |. 338D C8FEFFFF  XOR ECX,DWORD PTR SS:[EBP-138]
00415E8F  |. 890D 84BE9700  MOV DWORD PTR DS:[97BE84],ECX
00415E95  |. 3385 DCFEFFFF  XOR EAX,DWORD PTR SS:[EBP-124]
00415E9B  |. A3 0C409400    MOV DWORD PTR DS:[94400C],EAX  --- last address related with hp/mana =&H94400C
00415EA0  |. 8B95 C0FEFFFF  MOV EDX,DWORD PTR SS:[EBP-140]
00415EA6  |. 8915 E0BF7A00  MOV DWORD PTR DS:[7ABFE0],EDX
00415EAC  |. 8B85 E0FEFFFF  MOV EAX,DWORD PTR SS:[EBP-120]
00415EB2  |. A3 30C07A00    MOV DWORD PTR DS:[7AC030],EAX
00415EB7  |. 8B8D D8FEFFFF  MOV ECX,DWORD PTR SS:[EBP-128]
00415EBD  |. 51             PUSH ECX
00415EBE  |. 8B95 CCFEFFFF  MOV EDX,DWORD PTR SS:[EBP-134]
00415EC4  |. 52             PUSH EDX
00415EC5  |. 8B85 D4FEFFFF  MOV EAX,DWORD PTR SS:[EBP-12C]
00415ECB  |. 50             PUSH EAX
00415ECC  |. 8B8D D0FEFFFF  MOV ECX,DWORD PTR SS:[EBP-130]
00415ED2  |. 51             PUSH ECX
00415ED3  |. E8 C8140500    CALL Tibia.004673A0
00415ED8  |. 8B95 C4FEFFFF  MOV EDX,DWORD PTR SS:[EBP-13C]           ; |
00415EDE  |. 52             PUSH EDX                                 ; |Arg2
00415EDF  |. 8B85 BCFEFFFF  MOV EAX,DWORD PTR SS:[EBP-144]           ; |
00415EE5  |. 50             PUSH EAX                                 ; |Arg1
00415EE6  |. E8 F5170500    CALL Tibia.004676E0                      ; \Tibia.004676E0
00415EEB  |. 83C4 18        ADD ESP,18
00415EEE  |. C745 FC FFFFFF>MOV DWORD PTR SS:[EBP-4],-1
00415EF5  |. 8B4D F4        MOV ECX,DWORD PTR SS:[EBP-C]
00415EF8  |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
00415EFF  |. 59             POP ECX
00415F00  |. 5F             POP EDI
00415F01  |. 5E             POP ESI
00415F02  |. 5B             POP EBX
00415F03  |. 8B4D EC        MOV ECX,DWORD PTR SS:[EBP-14]
00415F06  |. 33CD           XOR ECX,EBP
00415F08  |. E8 554C2600    CALL Tibia.0067AB62
00415F0D  |. 8BE5           MOV ESP,EBP
00415F0F  |. 5D             POP EBP
00415F10  \. C3             RETN

There is something to do with some of the following addresses:

&H944008 value example=1321998974
&H944000 value example=1321999053
&H97BE8C value example=1321999047
&H97BE80 value example=1322029776
&H97BE84 value example=1321998955
&H94400C value example=1321998941

the example values are for a player with
hp: 179/185
mana:21/35

current hp=&H944008 XOR &H944000
max hp=&H944008 XOR &H97BE8C

current mana=&H944008 XOR &H97BE84
max mana=&H944008 XOR &H94400C

so...

adrXOR=&H944008
adrMyHP=&H944000
adrMyMaxHP=&H97BE8C
adrMyMana=&H97BE84
adrMyMaxMana=&H94400C

MyHP = Memory_ReadLong(adrMyHP, lngTibiaPID)
MyMaxHP = Memory_ReadLong(adrMyMaxHP, lngTibiaPID)
MyMana = Memory_ReadLong(adrMyMana, lngTibiaPID)
MyMaxMana = Memory_ReadLong(adrMyMaxMana, lngTibiaPID)
If TibiaVersionLong >= 943 Then
 valueXOR = Memory_ReadLong(adrXOR, lngTibiaPID)
 MyHP = valueXOR Xor MyHP
 MyMaxHP = valueXOR Xor MyMaxHP
 MyMana = valueXOR Xor MyMana
 MyMaxMana = valueXOR Xor MyMaxMana
End If

PROBLEM SOLVED, Better luck next time, Cipsoft

[lifriet]

If possible... how do you found that addresses (for HP and Mana)?

[maozao]

Nice find.

This address 0x944008 means something or it's just the base value to calc ?

[Cupquake]

There is something to do with some of the following addresses:

&H944008 value example=1321998974
&H944000 value example=1321999053
&H97BE8C value example=1321999047
&H97BE80 value example=1322029776
&H97BE84 value example=1321998955
&H94400C value example=1321998941

the example values are for a player with
hp: 179/185
mana:21/35

current hp=&H944008 XOR &H944000
max hp=&H944008 XOR &H97BE8C

current mana=&H944008 XOR &H97BE84
max mana=&H944008 XOR &H94400C

PROBLEM SOLVED, Better luck next time, Cipsoft

 hp := readinteger($944008) xor readinteger($944000);
hpmax := readinteger($944008) xor readinteger($97BE8C);

soo... is there a way to find the hp address in a traditional way? i mean, how to find those addresses (xor, etc without ollydbg)

[maozao]

You must to check in Tibia code, basically those are the instructions:

MOV ECX,DWORD PTR DS:[944008] -> 0x944008 don't know what's that address yet.
XOR ECX,DWORD PTR DS:[97BE80]

[Blackd]

you can read such addresses directly in windows xp. in vista/7 you need to add the dynamic offset.
in any case (xp,vista or 7), after that, you have to do the XOR between 2 values to get a final value.

you don't need to use ollydbg now, but in future patches, you only have to look at the updated code in ollydbg to get future updated address.

Just look between the [ ] symbols in this part of code:

00415E64  |. A1 08409400    MOV EAX,DWORD PTR DS:[944008]  --- first address related with hp/mana =&H944008
00415E69  |. 8BD0           MOV EDX,EAX
00415E6B  |. 33D6           XOR EDX,ESI
00415E6D  |. 8915 00409400  MOV DWORD PTR DS:[944000],EDX
00415E73  |. 8BC8           MOV ECX,EAX
00415E75  |. 33CF           XOR ECX,EDI
00415E77  |. 890D 8CBE9700  MOV DWORD PTR DS:[97BE8C],ECX
00415E7D  |. 8BD0           MOV EDX,EAX
00415E7F  |. 33D3           XOR EDX,EBX
00415E81  |. 8915 80BE9700  MOV DWORD PTR DS:[97BE80],EDX
00415E87  |. 8BC8           MOV ECX,EAX
00415E89  |. 338D C8FEFFFF  XOR ECX,DWORD PTR SS:[EBP-138]
00415E8F  |. 890D 84BE9700  MOV DWORD PTR DS:[97BE84],ECX
00415E95  |. 3385 DCFEFFFF  XOR EAX,DWORD PTR SS:[EBP-124]
00415E9B  |. A3 0C409400    MOV DWORD PTR DS:[94400C],EAX  --- last address related with hp/mana =&H94400C