Codecave PrintText

[XtrmJash]

How to update this addresses ? :

private int PrintFps = 0x46e846; //10.20
private int PrintName = 0x4d4d00;
private int ShowFps = 0x96B55A;

Crack open OllyDBG. Load Tibia, and hit play to resume execution when it breaks on entry. Now right click the main area in OllyDBG, and click "Find -> All Referenced Strings". Now you see a list, search it for DX9, DX5, or OpenGL (whichever, it shouldn't matter as all should be referenced). Once you found it, you need to find a reference to it. Double click it, and you'll be taken to some method which uses it. I believe this is an instance of the PrintText (it may be ShowFps though) method, but I'm not certain.

I'm not sure of PrintName or ShowFps, maybe klusbert can advise.

[klusbert]

       Client.PrintFps = RecalcAddress(0x46e226, baseAdr);
            Client.PrintTextFunction = RecalcAddress(0x4D4BD0, baseAdr);
          
            Client.ShowFps = RecalcAddress(0x96B627, baseAdr);
            Client.NopFps = RecalcAddress(0x46e091, baseAdr);

printtextfunction == printname

I missnamed printname, it is actually printtextfunction. That is the address to the function that prints every type of text in tibia.

But if you find printfps function as XtrmJash said, you can find all addresses in this function.
And showfps can easily be found if you are using cheatengine. By enable the fps (alt + F8)

[astra]

Oh, really thanks XtrmJash and klusbert it's very helpfull

[robssito]

IntPtr stringAdr = WinApi.VirtualAllocEx(client.Process.Handle, IntPtr.Zero, (uint)allBytes.Length, WinApi.AllocationType.Commit | WinApi.AllocationType.Reserve, WinApi.MemoryProtection.ExecuteReadWrite);
client.Memory.WriteBytes(stringAdr.ToInt64(), allBytes, (uint)allBytes.Length);

Can you explain me a bit about this?
Well, as you said on the first topic: "I alloc space in memory for my string than I add that into my codeave,"
It is really necessary to alloc the string? What about not alloc it into memory? This part got me confused :s

[klusbert]

In asm code the code looks like this:

02B1001F - mov ecx,02970000 : ["Hello TP!"]

notice 2970000 that is the location of our string.

[robssito]

Thank you klusbert!

[klusbert]

Did you understand it now? I don't know how I could explain it better, but I'm sure DarkStar or Farsa could.

[astra]

I'm trying to update this Fcking addresses but i can't ;|
klusbert or XtrmJash can u show me any screenshots or something from Cheat Engine ?
I find this procedure in olly (i think) and where is my addresses ? XD



This procedure on pastebin: http://pastebin.com/gSaBXwSb

I think better method for me its finding by CE but i don't know how to do it ;/

[wgrzelak]

0133E566 |. E8 B56A0600 CALL Tibia.013A5020 ; \Tibia.014A5020
0133E3CA |> 803D 61C78301 >CMP BYTE PTR DS:[183C761],0

Legend:
PrintFps
PrintName
ShowFps

[astra]

So:

        public static int PrintFps = 0x33E566 - 0x400000 + (int)baseAdress; //10.33
        public static int PrintName = 0x33E3CA - 0x400000 + (int)baseAdress; //10.33
        public static int ShowFps = 0x83C761 - 0x400000 + (int)baseAdress; // 10.33

or without -0x400000 it's not woring.

When i'm looking on older addresses from 10.32 they are totally different..

For example:

        public static int PrintFps = 0x46E566 - 0x400000 + (int)baseAdress; //10.32
AND
        public static int PrintFps = 0x33E566 - 0x400000 + (int)baseAdress; //10.33