Getting Actions Functions

[Lolrapa]

Hello everybody!! I'm back trying to learn some more and now I'm trying to make my program do some actions in the game.

I'm working with VC++, injected into the client and I'm trying to learn how to identify and use some tibia functions, right now I'm trying to make my char eat or moove.

I allready did it by using tibia functions to send packets and by sending messages to the game window and now I want to know if its posible to use tibia functions for this.

Ex: when I click on an item I guess tibia will rise a click event and then call a "Item Use" function with the information of the item, position, etc. and taht function will send the packets.

• There is any way to find those functions and use them?
• It is worth to do it? I guess there will be many adresses to update then.
• There is any other way you think it might be safer or easier?

Thank you all!!

[ottizy]

The simplest way for me to find these functions I described here: http://tpforums.org/forum/threads/63...5642#post55642

However I found out after making the screenshots that ASLR was enabled so the addresses shown will not be correct.

I'd argue that calling internal functions is the safest way to go since you'll most likely never miss if Cipsoft decides to change a packet structure which is easily done otherwise.

[Lolrapa]

Thank You!! I was able to understund how to find these adresses and found one my self! Great tutotrial, I learned about intermodular calls and how to read the call stack (that was way shorter than I expected).

I found the adress of the Use Item in container function and I figured out that it takes at least 4 parameters (two times the position in the container, the item id to use and the container id)

I made this function then:

typedef void(__fastcall *_useItem)(DWORD poscon1, DWORD itemId, DWORD poscon2, DWORD container);

And called it in sync with the main thread but it crashes tibia
Here is an example of a call to the use item function

Add.jpg

There is something wrong with my function definition?
How can I tell if there is any other param or the return type?

Note:
I have ASLR on too and wen i get the real adress of this fucntion is [0x1DF80 + BaseAdress], maybe is nothing but most adresses have 6 digits, maybe i'm in the wrong module?

[ottizy]

I dont think that is the correct parameters. Show the registers and stack when you just call it normally.

I think the location parameters are pointers to location structures.

[Lolrapa]

Hey! I'm pretty sure those are the values, not cpmpletely sure about the order but that shouldn't make tibia crash.
How can I know if there is another param involved? Maybe via registers


To the left is the call stack when I use your method.

To the right is the registers and the stack when function 12CDF80 is called.

If you see some discordance between the two sides of the image is because the ASLR changed the addresses between screenshots

Function 12CDF80 = Function 1BDF80


Thanks!

[Lolrapa]

I've been reading about the fast call convention and I realized that ECX and EDX are also parameters in my function

ECX is always 0xFFFF
EDX is 0x40 + IdContainer

Convention says that allways ECX and EDX come first and then the opther parameters int he stack from left to right;
So I changed my function to:

typedef void(__fastcall *_useItem)(DWORD ECX, DWORD EDX, DWORD poscon1, DWORD itemId, DWORD poscon2, DWORD container);

Now the function works, it eats the brea but it makes tibia crash anyways. What am I missing?
I'm calling _useItem function in sync with peekMessage Function

[Brunocg]

The first three (ECX, EDX and poscon1 in your case) parameters are the tile coordinates (TileXCoord, TileYCoord, TileZCoord) which the item stands.
If the item is inside a container, TileXCoord will always be 0xFFFF, TileYCoord will be the container ID (0x41 is the first opened container) and TileZCoord will be the item position within the container.

The fourth parameter is the item ID and the fifth parameter is again, its position within the container, you deduced them right. (remember that when the item stands on a tile instead of a container, that redundancy does not happens).

The sixth parameter is not the container ID as you said.
If UseItem function parameters are similar to UseItemWith function (I suppose they are), the last parameter is TargetIsNotBank (I named it TargetIsNotGround in my code to avoid confusion). TargetIsNotBank is a boolean that will always be 1 for items inside containers. It will only be 0 if the item you are using has the flag isBank (tibia.dat) set to 1.

[Lolrapa]

Thank for the help!
But I think you may be mistaken, here is a picture of the stack in the use item function call.

d2.jpg

The number 3 is the 6th parameter and its the Id of the container where the item was, i opened 4 container to do this test, the target container last so it must have id 3.

By the way, do you know about .dat file? I've been trying to read it today but this ecuation...

spritecount = width * height * blendframes * xrepeat * yrepeat * zrepeat * animations

...to get the sprites does not match the current structure when animations is bigger than 1.
I can't fine any pattern

Thanks again!

[Brunocg]

Thank for the help!
But I think you may be mistaken, here is a picture of the stack in the use item function call.

d2.jpg

The number 3 is the 6th parameter and its the Id of the container where the item was, i opened 4 container to do this test, the target container last so it must have id 3.

By the way, do you know about .dat file? I've been trying to read it today but this ecuation...

spritecount = width * height * blendframes * xrepeat * yrepeat * zrepeat * animations

...to get the sprites does not match the current structure when animations is bigger than 1.
I can't fine any pattern

Thanks again!

Yea, I may be wrong indeed. As I said, I was supposing that UseItem parameters were similar to UseItemWith. It seems they are not. In spite of that, did you managed to call the function?

In order to count the sprites, try the following:
SpritesCount := Width * Height * Layers * PatternWidth * PatternHeight * PatternDepth * Phases;

There is a really good topic created by Jo3 here that may help you

[Lolrapa]

Thanks! I found this code http://pastebin.com/YgL99fwg that works fine, it was a trick with the animations.

My "Use Item" function works, it uses the item but then it crashes tibia, maybe I'm missing something before maind the call