How to modify the memories?

[Lamkefyned]

Hello, I want to modify the memories in a script but do not know how anyone help me?

[rock5]

Assuming that they are static addresses you would do something like

Code: Select all

memoryWriteByte(getProc(), 0x9F997C, 99)
memoryWriteInt(getProc(), 0x9F997D, 201750)

That's assuming you do it through the bot. If you wanted to write a separate program it would require extra coding. To "lock" the value you would have to put it in a loop.

Note: Not all changes made to memory are propagated to the server. So even if it looks like you changed the value in game it actually has no affect.

[BlubBlab]

First I'm not sure you need Lua you can also right click and edit the value but in any case here

To execute Lua script with CE:

Table->Show Cheat Table Lua Script
write what you want to run and ->Execute Script (Note: this will add the code to the cheat table)

To add Lua Script to CE permanently add it to main.lua of the CE directory.
You can with both ways use "require" and also "include" I believe.

You can also use a Lua function for a filter rescan of the pointers.

In the main.lua is basically all of the documentation for CE & Lua there is and show clearly it was written by a hacker but for read & write from a specific point in memory it is clear enough.

Like:

Code: Select all

readInteger(address) : Reads an integer from the specified address
readPointer(address): In a 64-bit target this equals readQword, in a 32-bit target readInteger()

[Lamkefyned]

as I can do something like this without having to make a repeat function?

Code: Select all

local offsets = {addresses.charPtr_offset, addresses.pawnSwim_offset1, addresses.pawnSwim_offset2}
local active = 4

function fly()
	memoryWriteString(getProc(), addresses.swimAddress, string.rep(string.char(0x90),#addresses.swimAddressBytes));
	memoryWriteIntPtr(getProc(), addresses.staticbase_char, offsets, active);
	printf("Swimhack ACTIVATED!\n");
end

function flyoff()
	memoryWriteString(getProc(), addresses.swimAddress, string.char(unpack(addresses.swimAddressBytes)));
	printf("Swimhack DEactivated.\n");
end

Code: Select all

<?xml version="1.0" encoding="utf-8"?><waypoints type="TRAVEL">
	<onLoad><!-- <![CDATA[ -->
	--=== key usage ===--
	--=== fly  		NUMPAD1 ===--
	--=== flyoff  	NUMPAD2 ===--
	--=== speed  	NUMPAD4 ===--
	--=== speedoff  NUMPAD5 ===--
	
cprintf(cli.blue, "Press numpad 1 to fly\n")
cprintf(cli.blue, "Press numpad 2 to not fly\n")
cprintf(cli.green, "Press numpad 4 to run fast\n")
cprintf(cli.green, "Press numpad 5 to walk normal speed\n")
cprintf(cli.red, "Press Ctrl + L to exit\n")
	
	
	local delay = 1 -- time between key presses.
	local time = os.time()
	while(true) do

		if keyPressed(key.VK_NUMPAD1) and (os.time() - time > delay ) then
			fly()
			time = os.time()
		end
		if keyPressed(key.VK_NUMPAD2) and (os.time() - time > delay ) then
			flyoff()
			time = os.time()
		end
		if keyPressed(key.VK_NUMPAD4) and (os.time() - time > delay ) then
			speed("on")
			time = os.time()
		end		
		if keyPressed(key.VK_NUMPAD5) and (os.time() - time > delay ) then
			speed("off")
			time = os.time()
		end	
	end
	]]></onLoad>
</waypoints>

Code: Select all

function DP() -- OPTION 1
 repeat
	memoryWriteByte(getProc(), 0x9F997C, 1)
	memoryWriteInt(getProc(), 0x9F997D, 207120)
 until false
end

[rock5]

That fly code replaces the instruction that updates the 'fly' value to 0x90s. This in effect disables the instruction so it doesn't change. It's a bit tricky to do. Basically when you right click the result in CE and do a "Find what writes to this address" then you can find the code that continuously updates it and replace the bytes with 0x90s. You need to know exactly how many bytes to do though. It you get it wrong you'll probably crash the game.

[Lamkefyned]

refers to this??

[rock5]

Looks like you are just viewing memory so no. Like I said right click the address and select "Find what writes to this address". You should get a dialog pop up. When the value changes you should get results appearing in it. Those results should point to the code that changed it.

It didn't change for me but I suspect it's because you are using a different version of the game.

[Lamkefyned]

is that what you mean? Codes .... are different from the original server or the Rom4u because I'm on a new server Beta

[rock5]

That looks suspiciously wrong. I think it's saying it copied 11 to ecx. I would have expected ecx to equal 9F997D but it doesn't. And it's copying 11 whereas in your address list it shows 15. And if it's an address that is continuously updating it should have updated it more than 2 times (unless you were very fast taking the screen shot).

If it was correct I would suggest you try.

Code: Select all

function DPon()
   memoryWriteString(getProc(), 0x6B23A2, string.char(0x90,0x90,0x90,0x90,0x90))
   memoryWriteByte(getProc(), 0x9F997C, 1)
   memoryWriteInt(getProc(), 0x9F997D, 207120)
end
function DPoff()
   memoryWriteString(getProc(), 0x6B23A2, string.char(0xB9,0x11,0x00,0x00,0x00))
end

But like I said, I don't know enough to know how many bytes to do.

[Lamkefyned]

backpack full?

[Lamkefyned]

When the packet is received from the mail until the backpack

When I open the package in my backpack and out 2 objects which get in the CE and Package

It may be this code?

[rock5]

Note: we only did the 1 address. If you want to freeze both you might have to do the other one too.

What is it supposed to do anyway?

[Lamkefyned]

He explained, when the object bone sent from another character when you pick up the mail puts a rune, that rune is a piece of what you want

[Lamkefyned]

are equal? does with 4 bits of bite?

[rock5]

You talking about the mail hack? I think I read something about that once. Never did it myself. I think they fixed that in the official servers a while ago. So how does it work? When you receive the item in the mail you change those addresses, lock the memory then accept the item? Then you have the rune you want? Does it work with CE?

[Lamkefyned]

In a while I recorded a video and upload it to youtube to watch it .... I'm not in an official server I see a pirate be

[Lamkefyned]

Code: Select all

https://www.youtube.com/watch?v=_TQWC77KEk4

you can help me make this code? with Rombot?

[rock5]

That already looks pretty convenient, just switch to CE change the values, and switch back. Do you want a function you can use while botting? Try something like this.

Code: Select all

function DP_On(number, id)
    local function writeValues()
       memoryWriteByte(getProc(), 0x9F997C, number)
       memoryWriteInt(getProc(), 0x9F997D, id)
    end
    registerTimer("DPTimer", 50, writeValues);
end
function DP_Off()
    unregisterTimer("DPTimer")
end

That uses a registered timer. That means the memory is being written to continuously in the background while you can execute other commands, eg.

Code: Select all

DP_On(100, 123456)
Do some stuff
Open the package
DP_Off()

I've set the timer to 50ms. My CE has a freeze update time of 100ms. If it doesn't work or doesn't work reliably you can try adjusting this value.

[Lamkefyned]

does not work and you will change a couple of times while ...