Tibia 7.6 addresses

[hlep]

Hello. Could somebody give me memory addresses for Tibia 7.6 which are important to write hook proxy? I mean Send function, Recive function, Socket structure and Xtea address.

[Zmulan]

Find the adress for 8.55 or so (get it from TibiaAPI)
then use this method to find it for 7.6,

http://www.tpforums.org/forum/thread-5310.html

[hlep]

I tried to do it but with bad results : d Can you check adresses in Tibia 7.6 for me please? : /

[Crille]

if you don't know how to find those addresses, I highly doubt you're able to write a proxy

[Zmulan]

0x5B7608; //8.55

U have to find something that doesnt change with tibia updates, as in the example below, i searched for the 8,55 adress and found


PUSH DWORD PTR SS:[ESP+0Ch]
PUSH DWORD PTR SS:[ESP+0Ch]
PUSH DWORD PTR SS:[ESP+0Ch]
PUSH DWORD PTR DS:[ECX+4h]


copy that and search for it on the 7,6 exe. That's how you find the address,
some are harder than others to find ofc.

Pointer to the WS2_32.Send function
<-7.6, 8,55->
http://www.ladda-upp.com/bilder-a/asdasdasd-437.JPG

[hlep]

@up
Bad url to this image.


Ye that's true i won't make hook proxy xd I found someone who will do it for me if i find addresses from 7.6 protocol. So please, can you give me exac addresses, please? : /

[Zmulan]

clicking the image won't work, just copy the url.. anyway, i attached the picture.
the <- side of the screen is 7,6.. -> is 8.55

As u can see,
/// Pointer to the WS2_32.Send function
public static uint SendPointer = 0x5B7608; //8.55
8.55:
DS:[005B7608]=71AA428A (WS2_32.send)

For 7,6,
DS:[0047E530]=71AA428A (WS2_32.send)

And the pointer to the recieve function:
8.55:
DS:[005B75DC]=71AA615A (WS2_32.recv)

For 7,6:
DS:[0047E534]=71AA615A (WS2_32.recv)

I'll do some searching and edit this post with the Xtea and the other addresses soon...

[hlep]

Thank you very much : ] As i see you are good at programming xd Could you make for me application which will be analysing recived packets and if it gets packet of red message (any red message - cleans, gm messages, restarts) it will sending strings "exiva pause" into "exiva testsound"? Blackd Proxy doesn't catch gm messages because my 7.6 ots has changed ot engine : s It's only one way to play alarm on gm - playing alarm on any red message. Now i have only simple code in delphi with getting last packet from Tibia memory address but it doesn't work at all.

@edit
Red message starts on B6 byte so i think it isn't difficult to write this condition.

[hlep]

Does somebody have memory address of socket struct for Tibia 7.6? : //

P.S. Sorry for double post : |

[pater]

i guess nvm from tpforums ... am i right ??

[Nvm]

Yes Xd Could you help me? : /

[Farsa]

sadly, yes.

[Nvm]

I need socket struct memory address for Tibia 7.6, do you have it?