Alright, folks. Here comes the explanation (for researchers).
1)
GetUIInventoryItem function is located here:
Code: Select all
ACOrigins.exe+22266B0 - 40 53 - push rbx
ACOrigins.exe+22266B2 - 48 83 EC 20 - sub rsp,20
ACOrigins.exe+22266B6 - 48 8B D9 - mov rbx,rcx
ACOrigins.exe+22266B9 - 48 8B 0D 48F29D02 - mov rcx,[ACOrigins.exe+4C05908]
ACOrigins.exe+22266C0 - 48 85 C9 - test rcx,rcx
ACOrigins.exe+22266C3 - 74 33 - je ACOrigins.exe+22266F8
ACOrigins.exe+22266C5 - 48 8B 15 04293D02 - mov rdx,[ACOrigins.exe+45F8FD0]
ACOrigins.exe+22266CC - E8 FFD80200 - call ACOrigins.exe+2253FD0
ACOrigins.exe+22266D1 - 48 85 C0 - test rax,rax
ACOrigins.exe+22266D4 - 74 22 - je ACOrigins.exe+22266F8
ACOrigins.exe+22266D6 - 4C 8B 00 - mov r8,[rax]
ACOrigins.exe+22266D9 - 48 8B D3 - mov rdx,rbx
ACOrigins.exe+22266DC - 48 8B C8 - mov rcx,rax
ACOrigins.exe+22266DF - 41 FF 90 A8000000 - call qword ptr [r8+000000A8]
ACOrigins.exe+22266E6 - 48 85 C0 - test rax,rax
ACOrigins.exe+22266E9 - 74 0D - je ACOrigins.exe+22266F8
ACOrigins.exe+22266EB - 48 8B C8 - mov rcx,rax
ACOrigins.exe+22266EE - E8 DDBFFEFF - call ACOrigins.exe+22126D0
ACOrigins.exe+22266F3 - 48 85 C0 - test rax,rax
ACOrigins.exe+22266F6 - 75 02 - jne ACOrigins.exe+22266FA
ACOrigins.exe+22266F8 - 33 C0 - xor eax,eax
ACOrigins.exe+22266FA - 48 83 C4 20 - add rsp,20
ACOrigins.exe+22266FE - 5B - pop rbx
ACOrigins.exe+22266FF - C3 - ret
With this function you can feed-in a hash and get the
UIInventoryItem pointer buda mentioned. In fact, I am using this function in "Inventory Item Swapper v2" script, transcribed as follows:
Code: Select all
GetUIInventoryItem:
sub rsp,28
mov rbx,rcx
call GetUIInventoryContext
test rax,rax
je short GetUIInventoryItem_exit_A
mov r8,[rax]
mov rdx,rbx
mov rcx,rax
call qword ptr [r8+A8]
test rax,rax
je short GetUIInventoryItem_exit_A
mov rcx,rax
call ACOrigins.exe+22126D0
test rax,rax
jne short GetUIInventoryItem_exit_B
GetUIInventoryItem_exit_A:
xor eax,eax
GetUIInventoryItem_exit_B:
add rsp,28
ret
GetUIInventoryContext:
sub rsp,28
mov rcx,[ACOrigins.exe+4C05908]
test rcx,rcx
je short GetUIInventoryContext_exit_A
mov rdx,[ACOrigins.exe+45F8FD0]
call ACOrigins.exe+2253FD0
test rax,rax
jne short GetUIInventoryContext_exit_B
GetUIInventoryContext_exit_A:
xor eax,rax
GetUIInventoryContext_exit_B:
add rsp,28
ret
2) Inside this function engine will iterate through all available items; am not yet sure if these are all items you have in your inventory, that are visible -- as in, you can hover mouse on to get information -- or just all game items. Will test later on to determine which scenario. I'll get back to this in just a bit, you'll see why.
The iterator is here:
Code: Select all
ACOrigins.exe+22256F7 - 8B 6E 18 - mov ebp,[rsi+18]
ACOrigins.exe+22256FA - 48 8B 7E 10 - mov rdi,[rsi+10]
ACOrigins.exe+22256FE - C1 ED 11 - shr ebp,11
ACOrigins.exe+2225701 - C1 E5 03 - shl ebp,03
ACOrigins.exe+2225704 - 48 03 EF - add rbp,rdi
ACOrigins.exe+2225707 - 48 3B FD - cmp rdi,rbp
RSI+10 holds table start address; RSI+18 moved into EBP will be the table size; RBP+RDI becomes table end address. A table with pointers to pointers to UIInventoryItems. In my case, start is
0x000000016C51A600, size is
0x1D50 and end is
0x000000016C51C350. If you do the math, 0x1D50 / 8-byte pointers = 0x3AA, aka 938 UIInventoryItems. You can get yours via setting a break there and equipping an item; as soon as CE breaks, trace the 6 lines and extract what you need.
3) Now, the first pointer in my case is 0x000000005F1417C8. If I browse its memory, I see this:
First pointer you see highlighted, if ran through a query of mine that returns its
name, would be:
Yup,
UIInventoryItem 
Let's browse its memory:
Offsets 0x68 and 0x98, as per buda's observations, contain the indexes to
name and
description.
If I now feed these indexes to the decryptor I've ripped and moved to a threaded function of mine, I get these results:
Now, I said I would get back to 2) -- I've checked my inventory and I don't have that scroll or whatever it is (I'll adjust that as well, fetching item category, sub-category, rarity). So it's a list of all game items I guess, 938 so far.
Having said that, you can either wait for me to post a list of all items or intervene and create your own version of my 'ramblings'
BR,
Sun
CE just freezes when i click the cheats
