SRL Archive - Test corner

What the topic says ;)

~RM

nice, soon there shall be three ways to bot with simba :stirthepot:

~shut

Btw, nowadays RSBot's use less CPU option changes your rendering and only shows the terrain, so if anyone cares look into it and find out how can we just render the terrain and that certain NPC we are looking for etc… The OpenGL stuff people worked on earlier was pretty leet though.

OpenGL would be an amazing project that I would help with. I can't help with the ASM stuff but I'd do all the developing otherwise if there is any.

From: n3ss3s
Btw, nowadays RSBot's use less CPU option changes your rendering and only shows the terrain, so if anyone cares look into it and find out how can we just render the terrain and that certain NPC we are looking for etc… The OpenGL stuff people worked on earlier was pretty leet though.

Frement's done it already. ;)

In theory, simply using OGL to render will cut down on your CPU usage. In addition, if you were to simply cut out the OGL render phase - which shouldn't be hard assuming you can recognize objects from their meshes - you should be able to achieve even lower CPU utilization than RSBot.

Or just render at like 1/4 and scale up ;)

From: Smartzkid
In theory, simply using OGL to render will cut down on your CPU usage. In addition, if you were to simply cut out the OGL render phase - which shouldn't be hard assuming you can recognize objects from their meshes - you should be able to achieve even lower CPU utilization than RSBot.

Or just render at like 1/4 and scale up ;)

I've got no idea how to do that, but you guys feel free to throw out some threads, content, ideas, whatever you feel like doing ;)

~RM

Well, heres a compiling code of the dll (Crashes my java atm, im looking into it).

silentwolf never left a source of the plugin for simba anywhere, so I'm remaking that also.

#include "opengl32.h"
#include <vector>
using namespace std;
#define GL_TEXTURE_RECTANGLE_ARB 0x84F5

char szVersion[] = "0.1b";

bool drawing_model;
bool draw = false;

bool draw_overlay = false;
unsigned int draw_stride = 12;

struct NPC
{
	GLfloat x;				//x,y,z coords
	GLfloat y;
	GLfloat z;
	unsigned int stride;
	unsigned int x_s;		//screen coord
	unsigned int y_s;		//screen coord
	unsigned int id;		//id of model
};

vector<NPC> NPCs;

GLuint lastBuffer = 0;

//vector<unsigned int> bufferCRC;
unsigned int bufferCRC[50000];

HDC				F_hDC;
HFONT			F_hOldFont;
HFONT			F_hFont;
UINT			F_FontBase;
bool            F_bFontsBuild = 0;

char szSharedMemoryName[]="Local\\MyFileMappingObject";
DWORD * pCommands;

unsigned int last_stride;


void F_BuildFonts()
{
	F_hDC			= wglGetCurrentDC();

	F_FontBase	= glGenLists(96);
	F_hFont		= CreateFont(-10, 0, 0, 0, FW_NORMAL,	FALSE, FALSE, FALSE, ANSI_CHARSET, OUT_TT_PRECIS, CLIP_DEFAULT_PRECIS, PROOF_QUALITY, FF_DONTCARE|DEFAULT_PITCH, "Courier New"); //"Lucida Console");
	F_hOldFont	= (HFONT) SelectObject(F_hDC, F_hFont);
	wglUseFontBitmaps(F_hDC, 32, 96, F_FontBase);
	SelectObject(F_hDC, F_hOldFont);
	DeleteObject(F_hFont);

	F_bFontsBuild = true;
}

void CreateSharedMemory()
{
	HANDLE hMapFile;

	hMapFile = CreateFileMapping(
                 INVALID_HANDLE_VALUE,    // use paging file
                 NULL,                    // default security
                 PAGE_READWRITE,          // read/write access
                 0,                       // maximum object size (high-order DWORD)
                 255,                     // maximum object size (low-order DWORD)
                 szSharedMemoryName);     // name of mapping object

	if (hMapFile == NULL)
	{
		return;
	}
	pCommands = (DWORD *)MapViewOfFile(hMapFile,   // handle to map object
							FILE_MAP_ALL_ACCESS, // read/write permission
							0,
							0,
							255);
	if (pCommands == NULL)
	{
		CloseHandle(hMapFile);
		return;
	}
}

void ExecuteCommands()
{
	if(pCommands[1] == 1)		//if command status "not done"
	{
		if(pCommands[0] == 1)	//if command = FindModelByID
		{
			pCommands[11] = 0;	//return id not found

			for (unsigned int i = 0; i < NPCs.size(); i++)
			{
				if (NPCs[i].id == pCommands[2])
				{
					pCommands[11] = 1;				//return id found
					pCommands[12] = NPCs[i].x_s;	//xcoord
					pCommands[13] = NPCs[i].y_s;	//ycoord
				}
			}
			pCommands[1] = 0;	//set command status to 'done'
		}
	}
}


void F_glPrint(int x, int y, const char *fmt, ...)
{
	if (!F_bFontsBuild) F_BuildFonts();

	if (fmt == NULL)	return;

	glRasterPos2i(x,y);

	char		text[256];
	va_list		ap;

	va_start(ap, fmt);
	vsprintf(text, fmt, ap);
	va_end(ap);

	glPushAttrib(GL_LIST_BIT);
	glListBase(F_FontBase - 32);
	glCallLists(strlen(text), GL_UNSIGNED_BYTE, text);
	glPopAttrib();
}

DWORD QuickChecksum(DWORD *pData, int size)
{
	if(!pData) { return 0x0; }

	DWORD sum;
	DWORD tmp;
	sum = *pData;

	for(int i = 1; i < (size/4); i++)
	{
		tmp = pData[i];
		tmp = (DWORD)(sum >> 29) + tmp;
		tmp = (DWORD)(sum >> 17) + tmp;
		sum = (DWORD)(sum << 3)  ^ tmp;
	}

	return sum;
}



void sys_glMultiTexCoord2fARB(GLenum target, GLfloat s, GLfloat t)
{
	orig_glMultiTexCoord2fARB(target,s,t);
}

void sys_glActiveTextureARB(GLenum target)
{
	orig_glActiveTextureARB(target);
}

void sys_glBufferDataARB(GLenum target, GLsizei size, const void* data, GLenum usage)
{
	//bufferCRC.reserve(lastBuffer+10);
	bufferCRC[lastBuffer] = QuickChecksum((DWORD*)data, size);
	//bufferCRC[lastBuffer] = lastBuffer;

	orig_glBufferDataARB(target, size, data, usage);
}

void sys_glVertexPointer (GLint size,  GLenum type,  GLsizei stride,  const GLvoid *pointer)
{
	last_stride = stride;
	drawing_model = true;

	if(stride == 12 && pointer != 0)		//NPC model
	{
		NPC newNPC;
		GLfloat* temp;

		temp = (GLfloat*)pointer;
		newNPC.x = *temp;
		temp = (GLfloat*)((DWORD)pointer+4);
		newNPC.y = *temp;
		temp = (GLfloat*)((DWORD)pointer+8);
		newNPC.z = *temp;

		newNPC.stride = stride;

		NPCs.push_back(newNPC);
	}
	else
	{
		NPC newNPC;
		newNPC.x = 0;
		newNPC.y = 0;
		newNPC.z = 0;
		newNPC.stride = stride;
		NPCs.push_back(newNPC);
	}

	(*orig_glVertexPointer) (size, type, stride, pointer);
}

void sys_glDrawElements (GLenum mode,  GLsizei count,  GLenum type,  const GLvoid *indices)
{
	if(drawing_model)
		NPCs.back().id = bufferCRC[lastBuffer];

	/*if((last_stride == 12 && stride12) || (last_stride == 16 && stride16) || (last_stride == 24 && stride24))
		glPolygonMode(GL_FRONT_AND_BACK, GL_LINE);
	else
		glPolygonMode(GL_FRONT_AND_BACK, GL_FILL);*/

	(*orig_glDrawElements) (mode, count, type, indices);
}

void sys_glBindBufferARB(GLenum target, GLuint id)
{
	lastBuffer = id;

	orig_glBindBufferARB(target, id);
}

void sys_glPopMatrix (void)
{
	double ModelView[16];
	double ProjView[16];
	int Viewport[4];
	double View2D[3];

	if(drawing_model)
	{
		orig_glGetDoublev(GL_MODELVIEW_MATRIX, ModelView);
		orig_glGetDoublev(GL_PROJECTION_MATRIX, ProjView) ;
		orig_glGetIntegerv(GL_VIEWPORT, Viewport);

		if(gluProject(NPCs.back().x, NPCs.back().y, NPCs.back().z, ModelView, ProjView, Viewport, &View2D[0], &View2D[1], &View2D[2]) == GL_TRUE)
		{
			NPCs.back().x_s = (unsigned int)View2D[0];
			NPCs.back().y_s = (unsigned int)Viewport[3]-(unsigned int)View2D[1];
		}
	}

	drawing_model = false;

	(*orig_glPopMatrix) ();
}

void sys_glEnable (GLenum cap)
{
	NPC drawNPC;
	if(draw && cap == GL_TEXTURE_RECTANGLE_ARB)
		ExecuteCommands();											//check if command needs to be run every frame
	if(draw && draw_overlay && cap == GL_TEXTURE_RECTANGLE_ARB)		//draw overlays
	{
		orig_glPushMatrix();
		orig_glLoadIdentity();
		orig_glDisable(GL_TEXTURE_RECTANGLE_ARB);
		glDisable(GL_SCISSOR_TEST);

		orig_glColor4f(0.0f, 0.0f, 1.0f, 1.0f);
		F_glPrint(30,30,"Interception 2 %s",szVersion);
		F_glPrint(30,45,"Current stride: %u",draw_stride);

		glEnable(GL_SCISSOR_TEST);
		orig_glEnable(GL_TEXTURE_RECTANGLE_ARB);
		orig_glPopMatrix();

		while (!NPCs.empty())
		{
			drawNPC = NPCs.back();
			NPCs.pop_back();

			if(drawNPC.stride != draw_stride)
				continue;

			orig_glPushMatrix();
			orig_glLoadIdentity();
			orig_glDisable(GL_TEXTURE_RECTANGLE_ARB);
			glDisable(GL_SCISSOR_TEST);

			orig_glColor4f(1.0f, 0.0f, 0.0f, 1.0f);
			F_glPrint(drawNPC.x_s,drawNPC.y_s,"%u",drawNPC.id);

			glEnable(GL_SCISSOR_TEST);
			orig_glEnable(GL_TEXTURE_RECTANGLE_ARB);
			orig_glPopMatrix();
		}
		draw = false;

		if(GetAsyncKeyState(VK_NUMPAD7)&1)
			draw_stride = 12;
		if(GetAsyncKeyState(VK_NUMPAD8)&1)
			draw_stride = 16;
		if(GetAsyncKeyState(VK_NUMPAD9)&1)
			draw_stride = 24;
	}
	(*orig_glEnable) (cap);
}

void sys_glOrtho (GLdouble left,  GLdouble right,  GLdouble bottom,  GLdouble top,  GLdouble zNear,  GLdouble zFar)
{
	draw = true;
	if(GetAsyncKeyState(VK_NUMPAD5)&1)
			draw_overlay = !draw_overlay;
	(*orig_glOrtho) (left, right, bottom, top, zNear, zFar);
}

void sys_glPushMatrix (void)
{
	(*orig_glPushMatrix) ();
}

void sys_wglSwapBuffers(HDC hDC)
{
	(*orig_wglSwapBuffers) (hDC);
}

void sys_BindTextureEXT(GLenum target, GLuint texture)
{
	orig_BindTextureEXT(target,texture);
}

void sys_glAlphaFunc (GLenum func,  GLclampf ref)
{
	(*orig_glAlphaFunc) (func, ref);
}

void sys_glBegin (GLenum mode)
{
	(*orig_glBegin) (mode);
}

void sys_glBitmap (GLsizei width,  GLsizei height,  GLfloat xorig,  GLfloat yorig,  GLfloat xmove,  GLfloat ymove,  const GLubyte *bitmap)
{
	(*orig_glBitmap) (width, height, xorig, yorig, xmove, ymove, bitmap);
}

void sys_glBlendFunc (GLenum sfactor,  GLenum dfactor)
{
	(*orig_glBlendFunc) (sfactor, dfactor);
}

void sys_glClear (GLbitfield mask)
{
	(*orig_glClear)(mask);
}

void sys_glClearAccum (GLfloat red,  GLfloat green,  GLfloat blue,  GLfloat alpha)
{
	(*orig_glClearAccum) (red, green, blue, alpha);
}

void sys_glClearColor (GLclampf red,  GLclampf green,  GLclampf blue,  GLclampf alpha)
{
	(*orig_glClearColor) (red, green, blue, alpha);
}

void sys_glColor3f (GLfloat red,  GLfloat green,  GLfloat blue)
{
	(*orig_glColor3f) (red, green, blue);
}

void sys_glColor3ub (GLubyte red,  GLubyte green,  GLubyte blue)
{
	(*orig_glColor3ub) (red, green, blue);
}

void sys_glColor3ubv (const GLubyte *v)
{
	(*orig_glColor3ubv) (v);
}

void sys_glColor4f (GLfloat red,  GLfloat green,  GLfloat blue,  GLfloat alpha)
{
	(*orig_glColor4f) (red, green, blue, alpha);
}

void sys_glColor4ub (GLubyte red,  GLubyte green,  GLubyte blue,  GLubyte alpha)
{
	(*orig_glColor4ub) (red, green, blue, alpha);
}

void sys_glCullFace (GLenum mode)
{
	(*orig_glCullFace) (mode);
}

void sys_glDeleteTextures (GLsizei n,  const GLuint *textures)
{
	(*orig_glDeleteTextures) (n, textures);
}

void sys_glDepthFunc (GLenum func)
{
	(*orig_glDepthFunc) (func);
}

void sys_glDepthMask (GLboolean flag)
{
	(*orig_glDepthMask) (flag);
}

void sys_glDepthRange (GLclampd zNear,  GLclampd zFar)
{
	(*orig_glDepthRange) (zNear, zFar);
}

void sys_glDisable (GLenum cap)
{
	(*orig_glDisable) (cap);
}

void sys_glEnd (void)
{
	(*orig_glEnd) ();
}

void sys_glFrustum (GLdouble left,  GLdouble right,  GLdouble bottom,  GLdouble top,  GLdouble zNear,  GLdouble zFar)
{
	(*orig_glFrustum) (left, right, bottom, top, zNear, zFar);
}

void sys_glPopName (void)
{
	(*orig_glPopName) ();
}

void sys_glPrioritizeTextures (GLsizei n,  const GLuint *textures,  const GLclampf *priorities)
{
	(*orig_glPrioritizeTextures) (n, textures, priorities);
}

void sys_glPushAttrib (GLbitfield mask)
{
	(*orig_glPushAttrib) (mask);
}

void sys_glPushClientAttrib (GLbitfield mask)
{
	(*orig_glPushClientAttrib) (mask);
}

void sys_glRotatef (GLfloat angle,  GLfloat x,  GLfloat y,  GLfloat z)
{
	(*orig_glRotatef) (angle, x, y, z);
}

void sys_glShadeModel (GLenum mode)
{
	(*orig_glShadeModel) (mode);
}

void sys_glTexCoord2f (GLfloat s,  GLfloat t)
{
	(*orig_glTexCoord2f) (s, t);
}

void sys_glTexEnvf (GLenum target,  GLenum pname,  GLfloat param)
{
	(*orig_glTexEnvf) (target, pname, param);
}

void sys_glTexImage2D (GLenum target,  GLint level,  GLint internalformat,  GLsizei width,  GLsizei height,  GLint border,  GLenum format,  GLenum type,  const GLvoid *pixels)
{
	(*orig_glTexImage2D) (target, level, internalformat, width, height, border, format, type, pixels);
}

void sys_glTexParameterf (GLenum target,  GLenum pname,  GLfloat param)
{
	(*orig_glTexParameterf) (target, pname, param);
}

void sys_glTranslated (GLdouble x,  GLdouble y,  GLdouble z)
{
	(*orig_glTranslated) (x, y, z);
}

void sys_glTranslatef (GLfloat x,  GLfloat y,  GLfloat z)
{
	(*orig_glTranslatef) (x, y, z);
}

void sys_glVertex2f (GLfloat x,  GLfloat y)
{
	(*orig_glVertex2f) (x, y);
}

void sys_glVertex3f (GLfloat x,  GLfloat y,  GLfloat z)
{
	(*orig_glVertex3f) (x, y, z);
}

void sys_glVertex3fv (const GLfloat *v)
{
	(*orig_glVertex3fv) (v);
}

void sys_glViewport (GLint x,  GLint y,  GLsizei width,  GLsizei height)
{
	(*orig_glViewport) (x, y, width, height);
}

PROC sys_wglGetProcAddress(LPCSTR ProcName)
{
	if (!strcmp(ProcName,"glMultiTexCoord2fARB"))
	{
		orig_glMultiTexCoord2fARB=(func_glMultiTexCoord2fARB_t)orig_wglGetProcAddress(ProcName);
		return (FARPROC)sys_glMultiTexCoord2fARB;
	}
	else if (!strcmp(ProcName,"glBindTextureEXT"))
	{
		orig_BindTextureEXT=(func_BindTextureEXT_t)orig_wglGetProcAddress(ProcName);
		return (FARPROC)sys_BindTextureEXT;
	}
	else if(!strcmp(ProcName,"glActiveTextureARB"))
	{
		orig_glActiveTextureARB=(func_glActiveTextureARB_t)orig_wglGetProcAddress(ProcName);
		return (FARPROC)sys_glActiveTextureARB;
	}
	else if(!strcmp(ProcName,"glBufferDataARB"))
	{
		orig_glBufferDataARB=(func_glBufferDataARB_t)orig_wglGetProcAddress(ProcName);
		return (FARPROC)sys_glBufferDataARB;
	}
	else if(!strcmp(ProcName,"glBindBufferARB"))
	{
		orig_glBindBufferARB=(func_glBindBufferARB_t)orig_wglGetProcAddress(ProcName);
		return (FARPROC)sys_glBindBufferARB;
	}

	return orig_wglGetProcAddress(ProcName);
}

#pragma warning(disable:4100)
BOOL __stdcall DllMain (HINSTANCE hinstDll, DWORD fdwReason, LPVOID lpvReserved)
{
	switch(fdwReason)
	{
		case DLL_PROCESS_ATTACH:
			DisableThreadLibraryCalls (hOriginalDll);
			CreateSharedMemory();
			return Init();

		case DLL_PROCESS_DETACH:
			if ( hOriginalDll != NULL )
			{
				FreeLibrary(hOriginalDll);
				hOriginalDll = NULL;
			}
			break;
	}
	return TRUE;
}
#pragma warning(default:4100)

EDIT: I'll create a new thread when I have a fully working source which doesn't crash Java.

I am so excited! :)

If anyone wants to have some fun playing with OpenGL but has no clue where to start or what to do, I would recommend trying out GLIntercept. It will allow you to do some intense logging and extract every texture your client loads with nearly no effort.

Enjoy!

And using GLIntercept, you can rotate and move the camera as much as you like, using the numpad, without any modifications or scripting at all! Just read the readme.txt and use the numpad to move around :)

From: Zyt3x
And using GLIntercept, you can rotate and move the camera as much as you like, using the numpad, without any modifications or scripting at all! Just read the readme.txt and use the numpad to move around :)

Woah woah woah wait….

Does this mean there is a free-fly camera available for exploit with this? Because if there, is, that would be incredibly useful.

Ah, it's so good to see that people are starting to seriously consider OpenGL :)

Note that moving the camera makes what is on your screen not line up with what you're clicking on; this could probably be solved if the adjustments were made prior to rendering.

I wonder how hard it would be to increase the render distance?

That might be possible to do with GLIntercept using scripting, but would it be worth it? I mean.. Runescape only loads the models needed to full the MainScreen, not what's behind it nor to the left/right

Say you could force them to stay in memory. Wouldn't that be awesome?

Ohhh this is very exciting! This might keep me off rsbot for good with a step in this direction.

How exactly would one intercept? I mean, can it be done from a plugin, or do you have to overwrite some shit?

You place a dll named "opengl32.dll" in your java bin folder, so when java loads opengl, it loads your dll instead of the one in your windows folder. Your dll then loads the real dll and passes calls through to it, doing whatever you want to do in between.

In game hacking, it is very common (more often: necessary) to inject code, because anti-cheat software can easily detect the 'dll redirection' technique above.

Is it possible to make Runescape a 2D game with this? (Place the camera facing straight down) ;) That would greatly simplify… Just about anything.

Someone should hack up a playable first-person 3d view with less/no fogging :p
Wizzup, should be able to, but you would need to do the maths to make the objects line up with the clicks, would also be neccessary with my idea

From: Smartzkid
You place a dll named "opengl32.dll" in your java bin folder, so when java loads opengl, it loads your dll instead of the one in your windows folder. Your dll then loads the real dll and passes calls through to it, doing whatever you want to do in between.

In game hacking, it is very common (more often: necessary) to inject code, because anti-cheat software can easily detect the 'dll redirection' technique above.

That sounds like a dirty technique to me. How would "code injection" work, precisely?

Some good reads:
http://www.codeproject.com/KB/threads/winspy.aspx
http://stackoverflow.com/questions/1994676/hooking-directx-endscene-from-an-injected-dll
http://en.wikipedia.org/wiki/DLL_injection
http://social.msdn.microsoft.com/Forums/en/windowsgeneraldevelopmentissues/thread/5eb16909-3053-4d7f-94f9-83aecf01bd72
http://easyhook.codeplex.com/
http://stackoverflow.com/questions/925981/overlaying-on-a-3d-fullscreen-application

Granted, the override method is much easier to accomplish. Main disadvantage is that we have to keep the .dll in the JRE folder, possibly breaking other games.

From: Smartzkid
Main disadvantage is that we have to keep the .dll in the JRE folder, possibly breaking other games.

Like Minecraft.

Minecraft wont run with GLIntercept's DLL inside the jre folder

Maybe an extension that would place the dll in there? When you setup the extension for the first time, it would ask a directory where to put it, and when you close simba, it would delete it from there? Just a thought. You cant play other games when you are botting RS, but, I cant think of any other way.