RegEx Offset Finder Source code

Example how to write Offset Finder with AutoIt.
Code from: [Only registered and activated users can see links. Click Here To Register...]

Code:

---

#RequireAdmin
#region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Compression=4
#AutoIt3Wrapper_Res_Description=Find offsets for Perfect World
#AutoIt3Wrapper_Res_Fileversion=2.0
#AutoIt3Wrapper_Res_LegalCopyright=No0oB
#AutoIt3Wrapper_Res_Language=1041
#AutoIt3Wrapper_Run_Tidy=y
#endregion ;**** Directives created by AutoIt3Wrapper_GUI ****
#include <GUIListView.au3>
#include <WinAPI.au3>
;#include <Array.au3>
Opt("GUIOnEventMode", 1)

Global $UnfreezeOffset = "(0F95C084C08885(.{8}))"
Global $SearchExression = _
                ".*?(8B0D(.{8})898D40F1FFFF6A01)" & _ ;Base_Address
                ".*?(8986(.{8})8A4F03)" & _ ;LVL_Offset
                ".*?(898E(.{8})8B5714)" & _ ;Culti_Offset
                ".*?(8996(.{8})8B4718)" & _ ;EXP_Offset
                ".*?(8986(.{8})8B4F04)" & _ ;Spirit_offset
                ".*?(898E(.{8})8B570C)" & _ ;HP_OffSet
                ".*?(8996(.{8})8B471C)" & _ ;MP_OffSet
                ".*?(8986(.{8})8B4F08)" & _ ;CHI_OffSet
                ".*?(898E(.{8})8B5710)" & _ ;MaxHP_OffSet
                ".*?(8996(.{8})8B4720)" & _ ;MaxMP_OffSet
                ".*?(8986(.{8})8A4702)" & _ ;MaxCHI_Offset
                ".*?(8B108996(.{8})8B4004)" & _ ;gold_Offset
                ".*?(6A0A8986(.{8}))" & _ ;state_Offset
                ".*?(8986(.{8})8B40048BC8)" & _ ;castid_Offset
                ".*?(A1(.{8})578B482081C1EC)" & _ ;BaseCall_Offset
                ".*?(568BF18B86(.{8})85C0)" & _ ;target_Offset
                ".*?(8B8E(.{8})3BCB740655)" & _ ;pet_Offset
                ".*?(8B8E(.{8})8B47503BC8)" & _ ;str_Offset
                ".*?(8B96(.{8})8B47543BD0)" & _ ;dex_Offset
                ".*?(8B86(.{8})8B4F5C3BC1)" & _ ;vit_Offset
                ".*?(8B8E(.{8})8B47603BC8)" & _ ;mag_Offset
                ".*?(8B96(.{8})8B47643BD0)" & _ ;reputation_Offset
                ".*?(EB5D8B8E(.{8})B801)" & _ ;class_Offset
                ".*?(8B491C33C08B91(.{8})85D2)" & _ ;jump_Offset
                ".*?(32C0C38B89(.{8})568BB0)" & _ ;charid_Offset
                ".*?(8B83(.{8})8D4C243C)" & _ ;name_Offset
                "";".*?((.{8}))" & _ ;

Global $NameArray[26] = [ _
                "Base_Address", _
                "LVL_Offset", _
                "Culti_Offset", _
                "EXP_Offset", _
                "Spirit_Offset", _
                "HP_Offset", _
                "MP_Offset", _
                "CHI_Offset", _
                "MaxHP_Offset", _
                "MaxMP_OffSet", _
                "MaxCHI_Offset", _
                "Gold_Offset", _
                "State_Offset", _
                "CastID_Offset", _
                "BaseCall_Address", _
                "TargetID_Offset", _
                "Pet_Offset", _
                "STR_Offset", _
                "DEX_Offset", _
                "VIT_Offset", _
                "MAG_Offset", _
                "Reputation_Offset", _
                "Class_Offset", _
                "Jump_Offset", _
                "CharID_Offset", _
                "Name_Offset"]

#region ### START Koda GUI section ### Form=
$hGuiMain = GUICreate("Offset Retriever v2.0", 340, 400, -1, -1)
GUISetOnEvent(-3, "_Exit")
GUISetBkColor(0x000000, $hGuiMain)
$ButtonFind = GUICtrlCreateButton("Find", 160, 3, 75, 25)
$ButtonSave = GUICtrlCreateButton("Save", 240, 3, 75, 25)
$ListView = _GUICtrlListView_Create($hGuiMain, "Name|Value(hex)|Value(dec)", 10, 30, 320, 340)
_GUICtrlListView_SetExtendedListViewStyle($ListView, 0x00010120)
_GUICtrlListView_SetColumnWidth($ListView, 0, 120)
_GUICtrlListView_SetColumnWidth($ListView, 1, 100)
_GUICtrlListView_SetColumnWidth($ListView, 2, 100)
GUICtrlCreateLabel("Offset Retriever by No0oB", 10, 8, 128, 17)
GUICtrlSetColor(-1, 0xFFFFFF)
GUICtrlSetOnEvent($ButtonFind, "ButtonFindClick")
GUICtrlSetOnEvent($ButtonSave, "ButtonSaveClick")
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
        Sleep(100)
WEnd

Func _Exit()
        Exit
EndFunc  ;==>_Exit

Func ButtonFindClick()
        Local $File = "elementclient.exe", $Data = ""
        $PID = ProcessExists($File)
        If $PID <> 0 Then
                $Elementclient = GetModuleBaseByName($PID, $File)
                $Data = ReadMemory("0x" & Hex($Elementclient[1]), 'byte[' & $Elementclient[2] & ']')
        Else
                MsgBox(0, "Offset Retriever", "Point me to your 'elementclient.exe'.")
                Local $File = FileOpenDialog("Search for file...", @DesktopDir, "(elementclient.exe)", 4, "")
                If FileExists($File) Then
                        $FileHnd = FileOpen($File, 16)
                        Local $Data = FileRead($FileHnd, FileGetSize($File))
                        FileClose($FileHnd)
                Else
                        Local $Data = ""
                EndIf
        EndIf

        If $Data <> "" Then
                Local $x = 0
                Local $check = StringRegExp($Data, $SearchExression, 3)
                If IsArray($check) Then
                        Local $info[UBound($check) / 2][3]
                        For $i = 1 To (UBound($check) - 1) Step 2
                                $info[$x][0] = $NameArray[$x]
                                $info[$x][1] = _RemoveZero(Reverse($check[$i]))
                                $info[$x][2] = Dec(Reverse($check[$i]))
                                $x += 1
                        Next
                        _ArraySort($info, 1, 0, 0, 2)
                        $aUnfreezeOffset = StringRegExp($Data, $UnfreezeOffset, 1)
                        $aBaseAddress = $info[0][1]
                        If IsArray($aUnfreezeOffset) Then
                                $UnfreezeAddress = ("0x" & $aBaseAddress) - 0x1C
                                $UnfreezeAddress = Hex($UnfreezeAddress + Dec(Reverse($aUnfreezeOffset[1])))
                                $ArraySize = UBound($info, 1)
                                ReDim $info[$ArraySize][3]
                                $info[$ArraySize - 1][0] = "Unfreeze_Address"
                                $info[$ArraySize - 1][1] = _RemoveZero($UnfreezeAddress)
                                $info[$ArraySize - 1][2] = Dec($UnfreezeAddress)
                        EndIf
                        _ArraySort($info, 1, 0, 0, 2)
                        _GUICtrlListView_BeginUpdate($ListView)
                        _GUICtrlListView_DeleteAllItems($ListView)
                        _GUICtrlListView_AddArray($ListView, $info)
                        For $i = 0 To 3
                                _GUICtrlListView_SetColumnWidth($ListView, $i, $LVSCW_AUTOSIZE_USEHEADER)
                        Next
                        _GUICtrlListView_EndUpdate($ListView)
                Else
                        $msg = MsgBox(4, "Error", "Can't find all Offsets..." & @CRLF & "Try it with older method?" & @CRLF & "(Slow but maybe it'll find some offsets)")
                        If $msg = 6 Then
                                _OldFindWay($Data)
                        EndIf
                EndIf
        EndIf
EndFunc  ;==>ButtonFindClick

Func _OldFindWay($Data)
        $Expressions = StringSplit($SearchExression, ".*?", 3)
        Dim $info[UBound($Expressions) - 1][3]
        _ArrayDelete($Expressions, 0)
        $Progress = GUICtrlCreateProgress(10, 375, 320, 17)
        For $i = 0 To UBound($Expressions) - 1 Step 1
                $offset = StringRegExp($Data, $Expressions[$i], 1)
                If IsArray($offset) Then
                        $info[$i][0] = $NameArray[$i]
                        $info[$i][1] = _RemoveZero(Reverse($offset[1]))
                        $info[$i][2] = Dec(Reverse($offset[1]))
                Else
                        $info[$i][0] = $NameArray[$i]
                        $info[$i][1] = 0
                        $info[$i][2] = 0
                EndIf
                GUICtrlSetData($Progress, $i / (UBound($Expressions) - 1) * 100)
        Next
        _ArraySort($info, 1, 0, 0, 2)
        $UnfreezeOffset = "(0F95C084C08885(.{8}))"
        $aUnfreezeOffset = StringRegExp($Data, $UnfreezeOffset, 1)
        $aBaseAddress = $info[0][1]
        If IsArray($aUnfreezeOffset) Then
                $UnfreezeAddress = ("0x" & $aBaseAddress) - 0x1C
                $UnfreezeAddress = Hex($UnfreezeAddress + Dec(Reverse($aUnfreezeOffset[1])))
                $ArraySize = UBound($info, 1)
                ReDim $info[$ArraySize][3]
                $info[$ArraySize - 1][0] = "Unfreeze_Address"
                $info[$ArraySize - 1][1] = _RemoveZero($UnfreezeAddress)
                $info[$ArraySize - 1][2] = Dec($UnfreezeAddress)
        EndIf
        GUICtrlSetData($Progress, 100)
        GUICtrlDelete($Progress)
        For $x = UBound($info, 1) - 1 To 0 Step -1
                If $info[$x][2] = 0 Then
                        _ArrayDelete($info, $x)
                EndIf
        Next
        _ArraySort($info, 1, 0, 0, 2)
        _GUICtrlListView_BeginUpdate($ListView)
        _GUICtrlListView_DeleteAllItems($ListView)
        _GUICtrlListView_AddArray($ListView, $info)
        For $i = 0 To 3
                _GUICtrlListView_SetColumnWidth($ListView, $i, $LVSCW_AUTOSIZE_USEHEADER)
        Next
        _GUICtrlListView_EndUpdate($ListView)
EndFunc  ;==>_OldFindWay

Func ButtonSaveClick()
        $ItemCount = _GUICtrlListView_GetItemCount($ListView)
        If $ItemCount > 0 Then
                Local $ResFile = @ScriptDir & "\Custom_Offsets.ini", $ResFileHex = @ScriptDir & "\Custom_Offsets_Hex.ini", $PROPHET_ADDRESS_SECTION_HEX = "Perfect_World_Base_Address_In_Hex", $PROPHET_ADDRESS_SECTION = "Perfect_World_Base_Address_In_Decimal", $ResSectionDec = "Custom_32_Offsets_In_Decimal", $ResSectionHex = "Custom_32_Offsets_In_Hex"
                $Progress = GUICtrlCreateProgress(10, 375, 320, 20)

                $Text = _GUICtrlListView_GetItemTextArray($ListView, 0)
                IniWrite($ResFile, $PROPHET_ADDRESS_SECTION, $Text[1], $Text[3])
                $Text = _GUICtrlListView_GetItemTextArray($ListView, 1)
                IniWrite($ResFile, $PROPHET_ADDRESS_SECTION, $Text[1], $Text[3])
                $Text = _GUICtrlListView_GetItemTextArray($ListView, 2)
                IniWrite($ResFile, $PROPHET_ADDRESS_SECTION, $Text[1], $Text[3])

                $Text = _GUICtrlListView_GetItemTextArray($ListView, 0)
                IniWrite($ResFileHex, $PROPHET_ADDRESS_SECTION_HEX, $Text[1], $Text[2])
                $Text = _GUICtrlListView_GetItemTextArray($ListView, 1)
                IniWrite($ResFileHex, $PROPHET_ADDRESS_SECTION_HEX, $Text[1], $Text[2])
                $Text = _GUICtrlListView_GetItemTextArray($ListView, 2)
                IniWrite($ResFileHex, $PROPHET_ADDRESS_SECTION_HEX, $Text[1], $Text[2])

                For $i = 3 To $ItemCount - 1
                        $Text = _GUICtrlListView_GetItemTextArray($ListView, $i)
                        $ResKey = StringReplace($Text[1], " ", "_")
                        IniWrite($ResFile, $ResSectionDec, $ResKey, $Text[3])
                        IniWrite($ResFileHex, $ResSectionHex, $ResKey, $Text[2])
                        GUICtrlSetData($Progress, $i / ($ItemCount - 1) * 100)
                Next

                GUICtrlDelete($Progress)
        EndIf
EndFunc  ;==>ButtonSaveClick

Func _RemoveZero($sHexString)
        If StringLen($sHexString) <> 0 Then
                Do
                        $sHexString = StringTrimLeft($sHexString, 1)
                Until StringLeft($sHexString, 1) <> "0"
        EndIf
        Return $sHexString
EndFunc  ;==>_RemoveZero

Func Reverse($sString)
        Local $sRevString
        For $i = StringLen($sString) + 1 To 1 Step -2
                $sRevString = $sRevString & StringMid($sString, $i, 2)
        Next
        Return $sRevString
EndFunc  ;==>Reverse

Func ReadMemory($Address, $Type = 'dword')
        Local $BytesRead, $Value
        Local $PID = ProcessExists("elementclient.exe")
        Local $hProc = _WinAPI_OpenProcess(0x1F0FFF, 1, $PID, True)
        Local $Buffer = DllStructCreate($Type)
        _WinAPI_ReadProcessMemory($hProc, $Address, DllStructGetPtr($Buffer), DllStructGetSize($Buffer), $BytesRead)
        Local $Value = DllStructGetData($Buffer, 1)
        _WinAPI_CloseHandle($hProc)
        Return $Value
EndFunc  ;==>ReadMemory

Func GetModuleBaseByName($PID, $module) ; thx to lolkop for this
        Local $hSnapshot, $me32, $bFound, $baseAddress[3]
        $me32 = DllStructCreate("int;int;int;int;int;int;int;int;char[256];char[260]")
        DllStructSetData($me32, 1, DllStructGetSize($me32))
        $hSnapshot = DllCall("kernel32.dll", "hwnd", "CreateToolhelp32Snapshot", "int", 8, "int", $PID)
        If $hSnapshot[0] = -1 Then Return 0
        $bFound = DllCall("kernel32.dll", "int", "Module32First", "hwnd", $hSnapshot[0], "ptr", DllStructGetPtr($me32))
        If $bFound[0] Then
                Do
                        If StringLower(DllStructGetData($me32, 9)) = StringLower($module) Then
                                $baseAddress[1] = DllStructGetData($me32, 6)
                                $baseAddress[2] = DllStructGetData($me32, 7)
                                ExitLoop
                        EndIf
                        $bFound = DllCall("kernel32.dll", "int", "Module32Next", "hwnd", $hSnapshot[0], "ptr", DllStructGetPtr($me32))
                Until Not $bFound[0]
        EndIf
        DllCall("kernel32.dll", "int", "CloseHandle", "int", $hSnapshot[0])
        Return $baseAddress
EndFunc  ;==>GetModuleBaseByName

---

Wow thats pretty cool done :-). But is the way via Patterns not a bit easyer? How robust is the code, i mean does it break easyer than a pattern for ida or ollydbg?