Containers??????

[Brunocg]

I wrote a proof of concept to show you how to traverse the containers tree. I coded it in C#, since it's not my prefered language, I may not be quite familiar with it. I hope that's what you are looking for.

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace Containers
{
    class Program
    {
        [DllImport("kernel32.dll")]
        static extern int ReadProcessMemory(
            IntPtr pHandle,
            UInt32 address,
            IntPtr buffer,
            int size,
            out int readedBytes
        );

        struct TTreeNode {
            public UInt32 left, parent, right;
            public byte color;
            public byte isNil;
            public UInt32 key, containerAddress;
        }

        struct TTreeEntry {
            public UInt32 proxy, head; //Head is not the tree root, instead, Head.Parent is.
            public int count;
        }

        static TTreeNode ReadTreeNode(IntPtr pHandle, UInt32 nodeAddress)
        {
            int readedBytes;
            Type nodeType = typeof(TTreeNode);
            int typeSize = Marshal.SizeOf(nodeType);
            IntPtr buffer = Marshal.AllocHGlobal(typeSize);

            ReadProcessMemory(pHandle, nodeAddress, buffer, typeSize, out readedBytes);

            TTreeNode node = (TTreeNode)Marshal.PtrToStructure(buffer, nodeType);

            if (node.isNil == 0)
            {
                Console.WriteLine("Index: {0} Container address: 0x{1:X}", node.key, node.containerAddress);
                ReadTreeNode(pHandle, node.left);
                ReadTreeNode(pHandle, node.right);
            }

            return node;
        }

        static void ReadTree(IntPtr pHandle, UInt32 entryAddress)
        {
            int readedBytes;
            Type entryType = typeof(TTreeEntry);
            int typeSize = Marshal.SizeOf(entryType);
            IntPtr buffer = Marshal.AllocHGlobal(typeSize);

            ReadProcessMemory(pHandle, entryAddress, buffer, typeSize, out readedBytes);

            TTreeEntry entry = (TTreeEntry) Marshal.PtrToStructure(buffer, entryType);

            Marshal.FreeHGlobal(buffer);

            TTreeNode node = ReadTreeNode(pHandle, entry.head);
            ReadTreeNode(pHandle, node.parent);
        }

        static UInt32 ReadContainerAddress(IntPtr pHandle, UInt32 pointertAddress)
        {
            int readedBytes;
            int intSize = sizeof(UInt32);
            IntPtr buffer = Marshal.AllocHGlobal(intSize);

            ReadProcessMemory(pHandle, pointertAddress, buffer, intSize, out readedBytes);

            UInt32 result = (UInt32)Marshal.PtrToStructure(buffer, typeof(UInt32));

            Marshal.FreeHGlobal(buffer);

            return result;
        }

        static void Main(string[] args)
        {
            Process process = Process.GetProcessesByName("tibia")[0];
            UInt32 containers_PointerAddress = 0xB7A2A4;
            ReadTree(process.Handle, ReadContainerAddress(process.Handle, ((UInt32) process.MainModule.BaseAddress.ToInt32()) + containers_PointerAddress - 0x400000));
            Console.ReadLine();
        }
    }
}

[crackgm]

I would like to say only one thing - you are my master.

THANK YOU!

Also I have one more question - how to use internal functions? Easiest way? Injecting into tibia?
Because without packets or internal function it's not possible to move item from containers?


[offtop] Do you also see forum "unlayouted" ?

[Brunocg]

Also I have one more question - how to use internal functions? Easiest way? Injecting into tibia?
Because without packets or internal function it's not possible to move item from containers?


[offtop] Do you also see forum "unlayouted" ?

In order to execute an internal function you need to be inside the target process context, the easiest way IMO is the old fashioned dll injection. Also you can move items by sending mouse clicks to the client window, but that`s a hell of work, since u`ll have to be aware of every container position and scrolling state.

No, I don`t follow unlayouted forum.

[klusbert]

You can do alot with codecaves. Take a look at https://github.com/klusbert/MemoryScanner.

I call walk function and say function with codecaves. I even setup a packetlistner with a codecave.

Even tho I only used codecaves for learning purpose, I supose you can have Great succses with them if you set them up corectly

[sleepy22]

you can do alot with codecaves. Take a look at https://github.com/klusbert/memoryscanner.

I call walk function and say function with codecaves. I even setup a packetlistner with a codecave.

Even tho i only used codecaves for learning purpose, i supose you can have great succses with them if you set them up corectly

very nice tool bro!

[crackgm]

You can do alot with codecaves. Take a look at https://github.com/klusbert/MemoryScanner.

I call walk function and say function with codecaves. I even setup a packetlistner with a codecave.

Even tho I only used codecaves for learning purpose, I supose you can have Great succses with them if you set them up corectly

Thank you very much! Now I just need to study a bit codecave and have a nice hours spent finding function addresses, I've never succeded looking for them...It's pain in my a... But still thanks!

[sleepy22]

Thank you very much! Now I just need to study a bit codecave and have a nice hours spent finding function addresses, I've never succeded looking for them...It's pain in my a... But still thanks!

add in skype bro!

[Blequi]

using C++ templates, you guys could code the most important STL data structures used by Tibia at the moment. Then, just declaring types correctly, we have a lot of structures out-of-the-box, avoiding to rewrite code.

ex: Character List is a std::vector<Character>, Vip List is a std::list<Vip>, Presets is a std::map<std::string, std::vector<Hotkey>> (indexed by Preset), Containers is

struct Containers
{
   int unknown;
   std::map<int, Container*> map;
}