MQ2autosize offset woes

[headedtomexico]

anyone familiar with mq2autosize and how to find the offsets for it? I'm working with the october 05 client, the oldest offset I could find for it was jan 06, and the function it hooks passes a float. So i poped the client source up in IDA and pecked around starting at the jan 06 offset and working my way out trying all the subroutines that where passed a float and just couldnt find it.

I also tried pulling up cheatengine, and I flopped shrink/grow back and forth for like 10 minutes till I found where size is held. I wasn't really sure where to go from there. I would get a different offset everytime, and I know like the /docrack for runspeed has a static offset. I don't really get how the memory is being allocated for that, so I don't really know what to do with the offset I get from cheatengine.

Anyone know of a good article I should read or something that would illuminate what i'm doing?

 

[Czarman]

anyone familiar with mq2autosize and how to find the offsets for it? I'm working with the october 05 client, the oldest offset I could find for it was jan 06, and the function it hooks passes a float. So i poped the client source up in IDA and pecked around starting at the jan 06 offset and working my way out trying all the subroutines that where passed a float and just couldnt find it.

I also tried pulling up cheatengine, and I flopped shrink/grow back and forth for like 10 minutes till I found where size is held. I wasn't really sure where to go from there. I would get a different offset everytime, and I know like the /docrack for runspeed has a static offset. I don't really get how the memory is being allocated for that, so I don't really know what to do with the offset I get from cheatengine.

Anyone know of a good article I should read or something that would illuminate what i'm doing?

If you had the old DLL you could open it in IDA and probably find it. Here is a snippet from 12-23-2008 DLL that has the offset:

.text:040013F0 ; public: void __thiscall SizeClass::SizeFunc(float)
.text:040013F0 ?SizeFunc@SizeClass@@QAEXM@Z proc near  ; CODE XREF: Size(EQData::_SPAWNINFO *,char * const)+60p
.text:040013F0                 mov     eax, 530900h
.text:040013F5                 jmp     eax
.text:040013F5 ?SizeFunc@SizeClass@@QAEXM@Z endp

There was a write up on Kenetixeq and FH about how to find stuff like these, both sites are gone. What I remember is you needed to jump to character location in memory (something I believe is a given from eqgame.h) and watch that area for changes. If I find the write up some place I will repost it. I believe it also used GHU or something else similar to cheatengine. Been a while since I did this myself, sorry not more knowledgeable.