Use teleport services by send packet

[dumbfck]

Somewhere at home I have documented the offsets for the structure which contain all of your unlocked teleports. It's basically like a big list showing which places you can go to from each teleporter.
I'll dig it out later if that's of any use to you.

[amineurin]

would be nice dumbfck

im interested to play with this all, maybe i can teleport into dungeons without the fee from any place.
or like the teleport stones from boutique, i can teleport from any place to any city.

just like to test what can be done.
since ingame are tele stones, faction or squad teles, teleporter and those dungeon porting stones in archo.

atm i run out of time, but keeped it in mind for testing
some packet sniffing for all this teleporting ways are needed first.

edit:

25533 ; is ID of npc from pwdb, or you can found it in mob\npc\pet array offset 0x120 (PW Genesis) or 0x124 (PW Descent)
7901 ; is id of land in world_targets.txt.
Kinh Đào Thành ; is name of land in world_targets.txt.
2681.93 ;pos x z y . When you teleport to this land, you will be here. use to check teleport is success or not.
241.793
-4268.359

Di chuyển Hồng Oanh ;name of npc teleport

26177 ;id of teleport service. You can found other infomation in table 50 of elements.data

13 ;max number of point that this teleporter can get you to

7102 ;$toPoin=0 will get you to that land, id from world_targets.txt
7101 ;$toPoin=1 will get you to that land...below is similar with $toPoint =2,3,4 to maxpoint-1
7902
7801
7802
3501
2101
5201
3801
3802
3803
6802
7001

so if i understand it right...
some arrays are needed first:
1. world_targets.txt = names and cords from citys
2. cords and id from tele npc from the citys

functions:
1. check with cords from array1 were u are right now
2. move to teleporter npc cords with help of arrray2=line of city found in array1
3. send packets: select npc, open dialog
4. read out the possible teleporter points to get to
(here i dont know how and what we get back
maybe a list from point 0-13 with the city id from world_targets.txt and the pointer number.
lets say we get back id 7901 and point 0)
5. look in results for the id of a city we want to teleport to
(maybe here a other array for worldquest bot, city 1, city 2, city 3.
or read out quest info and use npc we had to go to as identifier for city.
best would be some kind of travellist, city1 can reached from city2,city4,city8 and so on)
6. send packet: teleport with pointer of city we want to teleport to

[jollyjoker0305]

An example about teleport from 664 392 25 (near Dreamcaver Port) to North Achosaur

1: Check distange from here to all city by a loop with this function and data of city in world_targets.txt

 Spoiler

PHP Code:

Func getDisToNPC($npcPosX,$npcPosY, $npcPosZ, $pid)
   Return Sqrt((getPX()-$npcPosX)^2 + (getPY()+$npcPosY)^2 + (getPZ()-$npcPosZ)^2)
EndFunc 


2: When find nearest city, in this case is Dreamcaver Port with id = 6301. Go to here (some code to advoid stuck needed).

3: Get $npcID, npc position by use npcTypeID offset or by name... Go near teleporter enough to use service (i'm using getDisToNPC()<3)

4: Then load data from a file like this

 Spoiler

6201	4	6301	6101	5501	5401		
6301	6	6201	5401	5501	3803	3801	3802

PHP Code:

While 1
$Line=FileReadLine("datateleporter.txt")
If @error = -1 Then ExitLoop
$data=StringSplit ( $line, "    ")
If $data[1]= 6301 Then ExitLoop 


in my case, $data[0]=17. $data[1]= ID land, $data[2]= max point, $data[3-8]={6201, 5401, 5501, 3803, 3801, 3802}
$data[9-17]=""

5: I need to go to North Achosaur so i need $toPoint of 3803. This will get $toPoint.

 Spoiler

PHP Code:

For $i=3 to $array[0] 
If $data[$i]=3803 Then
$toPoint=$i-3 ;because 3 first element of array (0,1,2)is use to store other info
EndIf
Next 


6: Then the last thing need : use teleport service

 Spoiler

PHP Code:

selectTarget($npcID, $pid)
Sleep(1000)
startNpcDialogue($npcID, $pid)
Sleep(1000)
useTeleport($topoint, $pid) 


But... i'm confusing by apply A* to find shortest route

oh, Below is for ami
This is the function useTeleportStone

 Spoiler

PHP Code:

Func useTeleportStone($index, $itemTypeId,$city, $pid)
    ;//uses the Teleport Stone located at $index. 
    ;//$itemTypeId is the id for the type of item, probably 14351 or 26651
    ;//$city is ID of city, can be found in 
    ;// element\map\world\world_targets.txt
    local $packet, $packetSize

   $packet = '6D00'
   $packet &= "0001"
   $packet &= _hex($index,4)
   $packet &= _hex($itemTypeId)
   $packet &= _hex($city)
   $packetSize = 14
   sendPacket($packet, $packetSize, $pid)
EndFunc 


Tele by porting stones in archo is just accept a quest which take you gold and move you to position

For faction or squad teles i wasn't able to use -> no info yet.

[st3a7th0523]

need help on how to sniff packets for buying items such as MP potions and convert it to a function for prophet bot... so you have any suggestions of what program should be run to sniff the packets out.. if there's a tutorial a link would be appreciated.. thank you.. more power to all those brilliant minds out there..

[Interest07]

Simply hook the sendPacket function ingame like I described:

[Murmuring]

Originally Posted by st3a7th0523

need help on how to sniff packets for buying items such as MP potions and convert it to a function for prophet bot... so you have any suggestions of what program should be run to sniff the packets out.. if there's a tutorial a link would be appreciated.. thank you.. more power to all those brilliant minds out there..

can you please stop spamming your buy packet question in all those helpfull threads ?
there are some nice tutorials here, like this ones:

[st3a7th0523]

@murmuring
thank you for the link of nice tutorials, sorry bout the spam question.. thanks again

[Smurfin]

Sorry for necro, but I just googled teleportation by packet and this thread came up , might as well post it here than making a new thread.

How to sniff pw packets and figuring out which packet is for what, I tried asgborges's CE plugin but after a while it always crashed my pw client.

To jollyjoker0305 if you're still around, please share how you sniff packet and know which one to use. I tried Interest07's method using MHS but it didn't turn out well for me.

[sirius21]

smurfit, sendpacket reztotown,change?

[Smurfin]

I don't know, haven't used reztotown since too long ago since I leveled up my sin to 105.

[Underavelvetmoon]

Originally Posted by Smurfin

Sorry for necro, but I just googled teleportation by packet and this thread came up , might as well post it here than making a new thread.

How to sniff pw packets and figuring out which packet is for what, I tried asgborges's CE plugin but after a while it always crashed my pw client.

To jollyjoker0305 if you're still around, please share how you sniff packet and know which one to use. I tried Interest07's method using MHS but it didn't turn out well for me.

I get all my packet data from following the sendpacket address through Olly. Set a breakpoint, travel, record the packet, travel to a different place, record it, look at differences, etc etc.

[Smurfin]

Could you please make a step by step tutorial, no need to use SS if it's a lot of work.

for example :
1. run ollydbg
2. klik file menu then load elementclient.exe
3. etc etc.

Tks in advance.

[Underavelvetmoon]

Originally Posted by Smurfin

Could you please make a step by step tutorial, no need to use SS if it's a lot of work.

for example :
1. run ollydbg
2. klik file menu then load elementclient.exe
3. etc etc.

Tks in advance.

I dont have the time to at the moment sadly. The hardest part for me is finding the send packet address, and its so annoying that it changes with every update. In really super simple terms (Assuming you know the sendpacket address - last I had it was 0x00725700 - not sure how true that is):

1. Open up olly and attach Element, either while its running or run it after attaching.
2. Find sendpacket address, set a breakpoint. Itll break often because of the way the packets work, you just need to find a window to do it. It normally breaks every 30 seconds unless you force it to break ie. traveling. (Make sure you have the dialog of NPC already open and ready to choose which place to travel to before setting breakpoint, otherwise itll break when you talk to her.)
3. Follow the address in the stack.
4. Document its values/parameters.
5. Repeat till you have a good understand of what defines how/where to travel.

I think dumbfck did a guide for finding packets. Should be linked in the treasure map thread.

Imo reversing/using packets is the easiest part. Finding the new address's is always what I struggle with.

[Smurfin]

Thanks for the info, I'll try it when I have the time later.

about the packets received using that method, are they encrypted ?

[Underavelvetmoon]

Originally Posted by Smurfin

Thanks for the info, I'll try it when I have the time later.

about the packets received using that method, are they encrypted ?

Not at all. I used it to try and change what Item I was buying in the boutique (A long shot I know xD) and the item data wasnt encrypted, but the server knows haha. Have you checked out the travel information in the game files? Maybe thatll help you some what:

world targets.txt

1001	"Snowy Village"	1	"-2545.362,215.254,4116.355"	1
1101	"Village of Shattered Ice"	1	"-1507.853,221.732,4240.106"	2
1201	"Avalanche Village"	1	"-748.192,232.988,4233.242"	3
1301	"Timberfield"	1	"989.864,219.043,4172.403"	4
1501	"City of Misfortune"	1	"2638.999,252.093,4187.146"	6
1801	"City of a Thousand Streams"	1	"-2825.774,379.020,3092.210"	7
1802	"North Barrier Village"	1	"-2472.598,218.104,3434.835"	7
1803	"East Barrier Village"	1	"-2120.043,241.310,3141.281"	7
1804	"South Barrier Village"	1	"-2473.461,218.278,2719.753"	7
1901	"Camp of the Intrepid"	1	"-1450.183,221.104,2655.743"	8
2001	"Sumor Camp"	1	"-672.108,219.841,2748.688"	9
2101	"Etherblade City"	1	"486.999,259.024,3239.123"	10
2103	"Hidden Heroes Village"	1	"973.886,225.056,3201.253"	10
2201	"Walled Stronghold"	1	"1663.124,234.018,3250.909"	12
2301	"Angler's Village"	1	"2378.086,218.935,2824.619"	13
2601	"Immolation Camp"	1	"-2691.530,218.014,1967.518"	14
2701	"Sirry Wine Camp"	1	"-1637.869,218.189,2249.479"	15
2801	"Swiftwind Tribe"	1	"-282.430,223.084,2126.672"	16
2901	"Tradewind Village"	1	"295.511,221.000,1879.260"	17
3001	"Orchid Temple"	1	"1793.222,283.999,2147.087"	18
3101	"Allies Camp"	1	"2197.207,222.000,1741.022"	13
3401	"Town of Arrivals"	1	"-2800.763,533.220,906.030"	19
3501	"City of the Lost"	1	"-1479.506,255.600,988.488"	20
3701	"Wellspring Village"	1	"267.682,219.474,973.912"	22
3801	"Archosaur, North District"	1	"1470.490,219.608,1180.864"	23
3802	"Archosaur, West District"	1	"1285.395,219.608,1139.265"	23
3803	"Archosaur, South District"	1	"1631.274,219.666,816.075"	23
3901	"The Village of Naught"	1	"2759.727,218.816,665.586"	24
4201	"Sundown Town"	1	"-2750.892,523.075,395.719"	25
4301	"Broken Bridge Village"	1	"-1703.701,219.608,97.810"	20
4401	"Gate of Antiquity"	1	"-132.664,218.753,-309.447"	28
4402	"Dragon's End"	1	"-1193.517,522.480,163.870"	27
4502	"The Silver Pool"	1	"490.750,220.651,179.278"	29
4601	"Hidden Orchid"	1	"1864.714,240.037,155.064"	31
4701	"Sanctuary"	1	"2459.055,219.549,121.932"	32
5001	"Sandsong Village"	1	"-2225.729,490.490,-819.583"	33
5101	"Village of Brutes"	1	"-1797.476,524.405,-1356.713"	34
5201	"City of the Plume"	1	"-758.535,221.795,-1342.069"	35
5302	"Arrowhead Manor"	1	"321.946,219.968,-909.332"	36
5303	"King's Feast"	1	"640.251,370.454,-1196.552"	36
5401	"Whetstone Keep"	1	"1384.167,218.779,-1359.285"	37
5501	"Village of the Lost"	1	"2411.270,234.372,-777.739"	38
5801	"Cromagnon Village"	1	"-2874.756,523.858,-2367.675"	39
5901	"Dreaming Stronghold"	1	"-1958.673,525.069,-2269.380"	40
6001	"Bamboo Village"	1	"-305.631,223.818,-1992.817"	35
6101	"Tusk Town"	1	"473.857,282.011,-2133.737"	42
6201	"Village of the Dreaming Cloud"	1	"1465.155,229.139,-1756.321"	43
6301	"Dreamweaver Port"	1	"2672.815,228.042,-1786.640"	44
7101	"Netherspring"	1	"2295.373,253.629,-3073.782"	45
7102	"Nightfire Altar"	1	"2879.347,252.453,-2932.103"	45
7901	"City of Raging Tides"	1	"2681.930,241.793,-4268.359"	47
7902	"Camp Wave Breaker"	1	"2714.839,243.003,-3740.826"	47
7801	"Lonely Cloud Reef"	1	"1492.917,222.889,-4513.990"	46
7802	"The Blunted Lance Stand"	1	"1226.012,243.010,-3875.635"	46
6601	"Shrine of the Immortals"	1	"-2877.245,200.254,-2932.609"	48
6602	"Spire of Awakening"	1	"-2543.000,135.225,-3105.000"	48
6701	"Shrine of the Ancestors"	1	"-1723.385,222.221,-3214.715"	49
6801	"Guardian's Keep"	1	"-908.157,224.201,-3162.449"	50
6802	"Tellus City"	1	"-229.354,240.300,-3202.394"	50
6901	"Galeroar Town"	1	"130.724,226.500,-3452.501"	51
6902	"Forgotten Sanctuary"	1	"723.800,167.500,-2886.582"	51
7001	"Elysium Village"	1	"1350.221,241.710,-2982.360"	-1
9011	"Celestial Lake"	137	"-1745.831,36.001,346.719"	-1
9012	"Warblades Outpost"	137	"-1541.209,38.888,-176.559"	-1
9013	"Solstice Outpost"	137	"-1227.468,57.001,107.706"	-1
9014	"Candlelight Village"	137	"-1943.464,34.002,177.462"	-1
9021	"Sapphire Altar"	137	"-877.186,57.801,262.628"	-1
9022	"Sand Light Crystal"	137	"-889.554,136.022,-359.152"	-1
9023	"Unseen Gate"	137	"-95.618,48.801,-324.257"	-1
9032	"Corona Sanctuary"	137	"668.177,29.501,-363.072"	-1
9033	"Shrouded Temple"	137	"508.550,46.802,352.851"	-1
9034	"Nexus of Luminance"	137	"-470.474,83.651,312.134"	-1
9035	"Sandscape Tower"	137	"436.555,83.651,-10.555"	-1
9036	"Kirin Town"	163	"-315.707,298.250,-910.872"	-1
9037	"Dragon Tower"	163	"-749.295,362.625,-170.165"	-1
9038	"Bamboo Raccoon Village"	163	"-276.918,312.560,-381.882"	-1
9039	"Tree Raccoon Village"	163	"-407.116,360.800,139.858"	-1
9040	"Autumn Village"	163	"-148.777,394.111,646.193"	-1

The co-ordinates I believe are where you will be ported to if you travel to that place. The number before the name of the teleport is what I believe to be the ID of the port, although I havent tried reversing it in Olly to find out.

Its a shame none of this runs using Dialog ID's. Would be so much easier haha. Using packets feels archaic almost now days xD