The Bytecode Club - Reverse Engineering Forum
Enhanced bot using memory reads - Printable Version

+- The Bytecode Club - Reverse Engineering Forum (https://the.bytecode.club)
+-- Forum: Lobby (https://the.bytecode.club/forumdisplay.php?fid=1)
+--- Forum: Game Cheating, Botting & Reverse Engineering (https://the.bytecode.club/forumdisplay.php?fid=97)
+--- Thread: Enhanced bot using memory reads (/showthread.php?tid=348)

Pages: 1 2 3 4 5 6 7 8 9

RE: Enhanced bot using memory reads - Greyman - 01-18-2015

(01-17-2015, 10:22 PM)madalilng Wrote:  1000021 = xbow.
1000027 =   inferno tower.

1000025 = Archer Queen Smile

RE: Enhanced bot using memory reads - Greyman - 01-18-2015

A bit of progress last night:

- Clan Castle troop compositions
- Collector resources (gold, elixir, DE)
- Basic trap info


This is a dump from a TH9 opponent in the war the clan leader started last night (great opportunity to look at TH9's for more than 2 minutes at a time!).  As you can see, clan castle troops and traps are visible, despite being an enemy base.

I have a good feeling about this war Tongue

[Image: CoC3.png]

[Image: CoC4.png]

RE: Enhanced bot using memory reads - Greyman - 01-18-2015

(01-17-2015, 09:58 PM)Greyman Wrote:  
(01-17-2015, 09:01 PM)madalilng Wrote:  here's my computation to calculate miners/pumps this should work.


Code:
double[] collector_max = { 500, 1000, 1500, 2500, 10000, 20000, 30000, 50000, 75000, 100000, 150000, 200000 };
double[] collector_ph = { 200, 400, 600, 800, 1000, 1300, 1600, 1900, 2200, 2500, 3000, 3500 };

foreach (var B in _b.buildings)
{
int _lvl = B.lvl; // Collector level..
var _collectedtime = B.res_time;
var _timedif = (collector_max[_lvl] / collector_ph[_lvl] * 3600) - _collectedtime ;
var _collectedres = (_timedif * (collector_ph[_lvl] / 3600));
if (B.data == 1000002){ // elixir pump
Total_elix += (double)(_collectedres);
}
if (B.data == 1000004)
   { // Gold Mine
        Total_Gold += (double)(_collectedres);
   }
}

Hi Madalilng,

I've seen code very similar to this in a VMT entry, about 5 or 6 pointer references deep from the elixir collector base struct.  It was one of about half a dozen routines I'd bookmarked for further analysis Smile

Many thanks for the heads up, I'll definitely be trying this out.  I'm pretty sure I've seen something similar to res_time relatively close to the VMT entry in question, which makes it the top candidate for analysis when I circle back to collectors.

Interestingly, the res_time when the collector is boosted (if what I've found is equivalent) seems to go constantly backwards, while the in-memory reference to the resource per hour stays the same.  It looked like SuperCell dodgy the boost by modifying the time basepoint, rather than boosting the collection rate.  Have you noticed anything similar?  Bizarre if true, but the same result in the end I guess.

Hi Madalilng,

So the "res_time" parameter isn't directly readable from memory for a collector, but has to be calculated from a couple of values elsewhere in the struct and then divided by a constant. There's two separate "last collected time" and "active time this session" variables that are inputs into the equation. Other than that, your formula was perfect. There's a couple of VMT methods that expose the details, including the locations of the two variables and the constant divider.

Thanks again for the information, it was incredibly useful in narrowing down the correct routines to analyze.

Grey.

RE: Enhanced bot using memory reads - Greyman - 01-18-2015

Oops, I've broken storage capacities. Ah well, not terribly important for this particular application.

RE: Enhanced bot using memory reads - madalilng - 01-18-2015

good to hear that bro... Smile
maybe i'm analyzing packets that server sends to client that's why they're not the same variables...
btw can you see the loots in finding match?

RE: Enhanced bot using memory reads - Greyman - 01-18-2015

(01-18-2015, 12:46 PM)madalilng Wrote:  good to hear that bro... Smile
maybe i'm analyzing packets that server sends to client that's why they're not the same variables...
btw can you see the loots in finding match?

Do you mean in raids? Those are not working at the moment - I get a null reference exception in my code when I try to look at an enemy base that's a potential raid. The code works for war enemies though, so I'm assuming it's something simple that I've broken.

Hopefully will be able to fix it this evening after the kids go to bed.

RE: Enhanced bot using memory reads - madalilng - 01-18-2015

can you elaborate how to setup your method in reading memory? and how about static variables ?

RE: Enhanced bot using memory reads - Greyman - 01-18-2015

(01-18-2015, 01:09 PM)madalilng Wrote:  can you elaborate how to setup your method in reading memory?  and how about static variables ?

For development, I use Cheat Engine server for Android running on the Andy emulator. CEServer isn't available from the creator as an Android x86 version, so you can find one that I've compiled here: http://greyman.org/ceserver.zip

Once you're set up, let me know and I'll help you out with some additional details Smile

RE: Enhanced bot using memory reads - madalilng - 01-18-2015

it will work with bluestacks?

RE: Enhanced bot using memory reads - Greyman - 01-18-2015

(01-18-2015, 01:26 PM)madalilng Wrote:  it will work with bluestacks?

It will, so long as your BlueStacks instance is rooted. I just prefer Andy because I have more control over some of the lower-level OS stuff I use for other projects.