🖼️ Enhanced bot using memory reads

Howdy folks,

Has anyone here thought of reading memory to enhance the bot capabilities?  I've started messing around with reverse engineering the data structures in-memory, and pretty quickly came up with this:

It wouldn't take too much effort to add troop building, raiding, etc.  It also has the advantage that you can see the exact composition and layout of a targeted base, including the resource in each collector, storage, etc as well as clan castle troops.  I've also started getting some basic information on traps, which would be impossible from a pixel-based bot as they're typically invisible.

If anyone has started heading down the same road and is interested in exchanging information, please feel free to PM me.

Is this from an enemy base? o_O

With this, you can create an efficient bot. How do you do this? Seems interesting.

Is this from an enemy base? o_O

The above is from my base, but the technique works just as well on an enemy base.  Here's a dump from an enemy base that I recently raided:

Thats awesome. It's even got the current volume in the stores

With this, you can create an efficient bot. How do you do this? Seems interesting.

I use a modified version of Cheat Engine server for Android, along with a custom client that I've written using C#/.NET that has some additional features that Cheat Engine doesn't. For static analysis of the ARM code in Clash I use IDA Pro.

I only do it this way for ease of development, once CoC is sufficiently reverse engineered the bot could run natively on the phone with no PC required. However, that's a long way off - what you see here so far is only a few weeks effort on the project, most of which has been developing the tools required to mess with CoC running on Android. I'm anticipating 6+ months before it's a viable bot.

Very interesting, good idea!

*=-' pid='3955' dateline='1421485770']
Thats awesome.  It's even got the current volume in the stores

Yep, but not from collectors 🙁.  The amount of elixir/gold/DE etc in a collector doesn't seem to be stored directly - as far as I can tell it's calculated on the fly using a "last time collected" indicator of some sort.  Probably done that way for network sync purposes I'm thinking, but the ARM code I've seen that references the memory location still seems needlessly complicated.

Usually that's an indicator of either poorly written code or deliberate obfuscation, and neither would surprise me from SuperCell, but in this case there also seems to be more than that going on.  I've only just started this bot, so I don't have a holistic grasp of the code as yet.

I'm starting on dumping traps and clan castle info before going back to collector levels, but I'll update the thread regardless if/when I make significant progress with any aspect of the bot.

here's my computation to calculate miners/pumps this should work.

double[] collector_max = { 500, 1000, 1500, 2500, 10000, 20000, 30000, 50000, 75000, 100000, 150000, 200000 };
double[] collector_ph = { 200, 400, 600, 800, 1000, 1300, 1600, 1900, 2200, 2500, 3000, 3500 };

 foreach (var B in _b.buildings)
{
int _lvl = B.lvl; // Collector level.. 
var _collectedtime = B.res_time; 
var _timedif = (collector_max[_lvl] / collector_ph[_lvl] * 3600) - _collectedtime ;
var _collectedres = (_timedif * (collector_ph[_lvl] / 3600));
 if (B.data == 1000002){ // elixir pump 
 Total_elix += (double)(_collectedres);
 }
 if (B.data == 1000004)
    { // Gold Mine
         Total_Gold += (double)(_collectedres);
    }
}

This is amazing Greyman! Well done!