[VB6] Tibia - basic memory reading

[Agent007]

You can read Tibia's memory while it is running to find things like the players current HP, mana, experience, position - etc. I don't really explain things in detail in terms of the VB language, but it should teach you something (it helps if you have a little VB6 experience beforehand).

 

 

1. The Functions

 

Code:

 

Option Explicit

 

Private Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hWnd As Long, lpdwProcessId As Long) As Long

Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long

Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long

Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long

 

Firstly, we are declaring a few functions from the Win32 API (application programming interface). Most of the function names are pretty self explanatory.

 

 

1a. Obtaining Tibia's window handle (hWnd)

 

We need a function to obtain Tibia's window handle - this is used to find things like the process handle and the process ID, things which we will need if we wish to read Tibia's memory.

 

Code:

 

Public Function Tibia_Hwnd() As Long

 

Here's how we start our function to obtain Tibia's hWnd. We'll be using this a lot later on.

Here, we are declaring the function. Public Function basically tells VB that this is the start of a new function - the name of the function is 'Tibia_Hwnd'. We are making it a long so that whenever it is used, it returns a long value.

 

Code:

 

Dim tibiaclient As Long

 

Here, we declare a variable (a variable is a word that holds a value) to hold the client's window.

 

Code:

 

tibiaclient = FindWindow("tibiaclient", vbNullString)

 

Then we simply 'fill' the variable (put a value into) by using a function that we have previously declared (see the first code box).

 

It sets 'tibiaclient' to a value, which is obtained with the 'FindWindow' function. tibiaclient is the class name of the Tibia client. The FindWindow function is used: FindWindow(class-name, window-name). We don't require the function to search for a window name, so we put in 'vbNullString' instead, which basically means that there is nothing there.

 

Code:

 

Tibia_Hwnd = tibiaclient

 

Returning the value to the Tibia_Hwnd function, so that we can use it as a function later on (and we will! )

 

Code:

 

End Function

 

This line is basically telling VB that the function is finished.

 

 

1b. Reading from Tibia's memory (function)

 

 

Code:

 

Public Function ReadMemory(Address As Long) As Long

 

Now that we know how to begin functions, we are going to begin another one. This one is to read longs from the memory.

 

Before we attempt to read memory, we need Tibia's process ID + handle. We can obtain these using Tibia's hWnd (which we obtained earlier ).

 

Code:

 

Dim PID As Long, PHandle As Long

 

So we need two more variables: one for the process ID, one for the process handle.

 

Code:

 

If Tibia_Hwnd = 0 Then Exit Function

 

Tibia_Hwnd: the function that finds Tibia's window. If it returns a value of 0, it can't find Tibia - therefore we cancel the function.

 

Code:

 

GetWindowThreadProcessId Tibia_Hwnd, PID

 

This line uses the GetWindowThreadId function (which we already declared - see first code box!) to find Tibia's process ID. We enter where to look (Tibia_Hwnd) and then where to store the value (PID).

 

Code:

 

PHandle = OpenProcess(&H10, False, PID)

If PHandle = 0 Then Exit Function

 

Here we have used the OpenProcess function to obtain the process handle and store it in 'PHandle', and then checked to see if PHandle returned 0 (returned 0 = didn't find anything = didn't work ).

 

Code:

 

ReadProcessMemory PHandle, Address, ReadMemory, 4, 0&

 

Now, down to the actual memory reading (finally!). We are using the ReadProcessMemory function (declared already - see first code box). The attributes we input are self explanatory - the last two simply mean that we are reading a value that is 4 digits long (long values) and 0& is something that you probably won't need to worry about (leave it as it is ).

 

When we're done with reading (or editing - which we aren't doing right now anyway) the memory, we can close the handle on the client (and end the function):

 

Code:

 

CloseHandle PHandle

End Function

 

2. Putting it into action

 

Here we can experiment with the functions that we have already created. Compared to actually making the functions, using them is relatively easy

 

So, here's how we would use the function read a value from Tibia's memory, and then:

 

- store it in a variable:

 

Code:

 

level = ReadMemory(&ADDRESS)

 

- display it on your form:

 

Code:

 

Label1.Caption = ReadMemory(&ADDRESS)

 

You would replace &ADDRESS with an actual memory address. They can be found using a program such as Cheat Engine (any memory editing/searching program). For now, though, I'll use &H613B60 - which is where the player's level is stored.

 

The finished product

 

Here's the finished example form code.

 

FORM1

Code:

 

Option Explicit

 

Private Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hWnd As Long, lpdwProcessId As Long) As Long

Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long

Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long

Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long

 

Public Function Tibia_Hwnd() As Long

Dim tibiaclient As Long

tibiaclient = FindWindow("tibiaclient", vbNullString)

Tibia_Hwnd = tibiaclient

End Function

 

Public Function ReadMemory(Address As Long) As Long

Dim PID As Long, PHandle As Long

If Tibia_Hwnd = 0 Then Exit Function

GetWindowThreadProcessId Tibia_Hwnd, PID

PHandle = OpenProcess(&H10, False, PID)

If PHandle = 0 Then Exit Function

ReadProcessMemory PHandle, Address, ReadMemory, 4, 0&

CloseHandle PHandle

End Function

 

Private Sub Label1_Click()

Label1.Caption = ReadMemory(&H613B68)

End Sub

 

When you click 'Label1', it will change Label1's caption the whatever value found at address &H613B68.

 

You can experiment with this to make things like experience checkers, and go on to make spell casters and other bots!