Sending Packets

12/15/2014 07:17 Smurfin#406
Same here but worse, I don't know about anything much, I just follow pattern sometimes.

About the flyup using packet it's because my function only move to x,y, and z too, but it stops if x and y already reached, and I read about flying to certain altitude [Only registered and activated users can see links. Click Here To Register...] and Interest07 wrote "Flying until a certain altitude is 'moving by packets'" so I thought that's how it's done.

Here is the function I use to Move, there is Z (Z coordinate) and there is H ( Height), I remember Interest07 said the move action using HEIGHT is like moving using alt + click in world map.

It stops after X and Y is reached and doesn't care about the HEIGHT, sure it will go up but only if the character hasn't reached X and Y.

Code:
func movexyz()
$moveactionplus[5]=0x8
_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,0)
$moveactionplus[5]=0x14
_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,1)
$moveactionplus[5]=0x20
_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,$xx,"float")
$moveactionplus[5]=0x28
_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,$yy,"float")
$moveactionplus[5]=0x24
_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,$z,"float")
$moveactionplus[5]=0x68
_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,$hh,"float")
$movetoh = _MEMORYPOINTERREAD($APPBASEADDRESS, $mid2, $moveactionplus,"float")
if $movetoh[1]>=0.0 then 
	$moveactionplus[5]=0x64
	_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,26625)
	$moveactionplus[5]=0x6c
	_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,256)
else
	$moveactionplus[5]=0x64
	_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,26624)
	$moveactionplus[5]=0x6c
	_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,65536)
EndIf




;$moveactionplus[5]=0x2c
;_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,0)
$moveactionplus[5]=0x2c
_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,1)




$moveactionvalue=_memorypointerread($APPBASEADDRESS, $mid2, $moveaction)
$actionstructplus[3]=0xc ;actionstruct
_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $actionstructplus,$moveactionvalue[1])
$actionstructplus[3]=0x18 ;actionstruct
_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $actionstructplus,1)
$moveactionvalue=_memorypointerread($APPBASEADDRESS, $mid2, $moveaction)
$actionstructplus[3]=0x14 ;actionstruct
_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $actionstructplus,$moveactionvalue[1])
endfunc
I've tried what you suggested "writeMemory(moveType, MoveAction + 0x2C)" with moveType=1 (the part I separate with a few lines in my function above), but it still won't move up.

If you observe the movement packets, it should fit with Interest07's post about sending movement packet
Quote:
...
0000<X><Y><Z><X><Y><Z><interval><speed><moveType>< counter>
500 ms later
0000<X><Y><Z><X><Y><Z><interval><speed><moveType>< counter>
500 ms later
0000<X><Y><Z><X><Y><Z><interval><speed><moveType>< counter>
500 ms later
0700<X><Y><Z><speed><direction><moveType><counter> <interval>


id = 0000 this is the id for a moving packet
...
Quote:
THese are by far the most annoying packets to send. Usually you'll prefer using the action struct for moving. It can however be good to know it's possible in certain situations.
now I know what that means :D
12/15/2014 14:43 Stark77#407
i used Interest's WQ-Bot as example. here is my moveto and flyz. the flyz uses the moveto with the height+moveType. So if u move to X,Y and your height is lower that what u want, just make him use flyz. works fine for me. never tested if this works in water.

Code:
MoveTo(X, Z, Y=0, moveType=0, height=-1.0
{  
	actionStruct := ReadMemoryUint(playerPointer + playerActionStructOffset, processID)
	if X < 1000
		X := floattohex((X*10)-4000) 
	if Z < 1000
		Z := floattohex((Z*10)-5500) 
	if Y < 1000
		Y := floattohex(Y*10) 
	
	actionList := ReadMemoryUint(actionStruct+0x30,processID)
	MoveAction := ReadMemoryUint(actionList+0x4,processID)
	writeMemory(0, MoveAction+0x8, processID)				;Action finished = 0
	writeMemory(1, MoveAction+0x14, processID)				;Action Start = 1	
	writeMemory(X, MoveAction + 0x20, processID)
	writeMemory(Y, MoveAction + 0x24, processID)
	writeMemory(Z, MoveAction + 0x28, processID)
	writeMemory(FloatToHex(height), MoveAction + 0x68, processID)
	if(height >= 0.0)
	{
		writeMemory(26625, MoveAction + 0x64, processID)
		writeMemory(256, MoveAction + 0x6C, processID) 
	}
	else 
	{
		writeMemory(26624, MoveAction + 0x64, processID)
		writeMemory(65536, MoveAction + 0x6C, processID) 
	}
	writeMemory(moveType, MoveAction + 0x2C, processID)			;movetype for flying 1 for ground run 0
	writeMemory(MoveAction, actionstruct+0xC, processID)
	writeMemory(1, actionstruct+0x18, processID)
	writeMemory(moveAction, actionstruct+0x14, processID)
}

flyZ(height)
{
	X := getX()
	Y := getY()
	MoveTo(X, Y, height, 1, height)
}
12/15/2014 15:43 Smurfin#408
Thanks a lot for the function, I'll look into it and translate to AutoIT later.

-edit-
tried it a bit , it worked vertically but no matter what height I put it , it always go vertically down >_<"

I'll try again later I'm a bit confused lol, the Z is now Y and the Y is now Z, but hey it works vertically, just wondering why it always goes down on mine. :confused:

-edit 2-
I'll just put my analyzation here for notes later when I have the time to go back into this.

from my function, 0x20 = x, 0x28 = y, 0x24 = z
Code:
	$xx=(10*$x)-4000
	$yy=(10*$y)-5500
	$hh=$h

$moveactionplus[5]=0x20
_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,$xx,"float")
$moveactionplus[5]=0x28
_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,$yy,"float")
;$moveactionplus[5]=0x24
;_MEMORYPOINTERWRITE($APPBASEADDRESS, $mid2, $moveactionplus,$zz,"float")
but from your function, 0x20=X, 0x24=Y, 0x28=Z but you treat Z like my Y and treat Y like my Z.
Quote:
actionStruct := ReadMemoryUint(playerPointer + playerActionStructOffset, processID)
if X < 1000
X := floattohex((X*10)-4000)
if Z < 1000
Z := floattohex((Z*10)-5500)
if Y < 1000
Y := floattohex(Y*10)
writeMemory(X, MoveAction + 0x20, processID)
writeMemory(Y, MoveAction + 0x24, processID)
writeMemory(Z, MoveAction + 0x28, processID)
the original MoveTo :
MoveTo(X, Z, Y=0, moveType=0, height=-1.0
then for flyz :
MoveTo(X, Y, height, 1, height)

from here MoveTo for flyz uses X as X, Y as your Z which is a Y for mine, and height replaces Y=0 which is a Z or height for mine.

-edit 3-

Nevermind the above, got it right now. I'll just let it there and not delete it for a reminder if I mess up my function again by accident or just forgot :D.
Z has to be multiplied by 10 while Height uses a number as in the game. I guess I forgot to add $zz=$h*10

and it WORKS UNDER WATER , thanks again :handsdown:

=edit 4============================================

One more thing, I use these things a lot like sending keypresses repeatedly, action functions for auto follow, move, drop down from flyer, fly, etc . So every once in a while my character can get stuck probably because of inbetween forced actions executed while other action still incomplete, sometimes equipping/unequipping flyer doesn't work and have to relog to reset, or character get stuck like walking on a treadmill or repeatedly jumping in place

It's similar to aps sins' which also get stuck often because of button mashing too fast for doing 3 sparks / normal attacking / whatever skills, I bet if you have a sin you ever encounter that.

My question is, is there any way to reset that kind of char stuck without relogging, but using memorywrite ? Haven't tried observing default value for every memory address used in action struct and compare the values to the ones after getting stuck though , but if you or anyone ever encounter that and can fix it without relog, please post it here on the how.
12/18/2014 10:50 Smurfin#409
Another packets that might be useful for multiclienting.
Code:
Func RollCall($pid)
	;//Daily Roll Call quest
	$packet='310003000000017E77'
	$packetsize=9
	sendPacket($packet, $packetSize, $pid)
EndFunc

Func acceptPsySummon($summonerId,$pid)
        ;//summonerId is charId of the psychic 
        ;//used for summoning using useSkill
        ;//sendpacket with $skillId=1824
 	$packet='82000201'
	$packet&= _hex($summonerId)
	$packetsize=8
	sendPacket($packet, $packetSize, $pid)
EndFunc
02/19/2015 02:07 jasty#410
I've been playing a bit with packets and found something a little fun with leap skills.

Code:
   
Func Leap($leapSkillId, $pos, $pid) 
   local $packet, $packetSize
   $packet = '5900'
   $packet &= _hex($leapSkillId)
   $packet &= _hex($pos[0], 8, 'float')
   $packet &= _hex($pos[2], 8, 'float') ;altitude
   $packet &= _hex($pos[1], 8, 'float')
   $packet &= '0300'
   
   $packetSize = 20    
   sendPacket($packet, $packetSize, $pid)
EndFunc
You can see that the leap packet just encodes the destination but there's really nothing about what direction you are facing. In practice I found that you can leap in any direction, through solid walls, and even at angles up to 60 degrees from the horizontal or so (nearly vertical). Going through walls allows some interesting exploration into out of bounds areas you can't normally get to even with teleport skills. This is probably one of the easiest ways to get into out of bounds areas. You're still limited to the range of the skill though and if you teleport into an invalid area it wont work. Here's a set of skillIds which should work but there might be others I'm forgetting about.

Blademaster
Leap Back = 58 (distance 16)
Tiger Leap = 59 (distance 16)

Wizard
Distance Shrink = 100 (distance 25)
Sage Distance Shrink = 478 (distance 25)
Demon Distance Shrink = 479 (distance 30)

Archer
Leap Left = 1844 (distance 20)
Leap Right = 1845 (distance 20)

Here's some helper code to make exploration easier:
Code:
Func PlayerPos()
	$Player = _MemoryRead(_MemoryRead(_MemoryRead($ADDRESS_BASE, $GAME_PROCESS) + 0x1C, $GAME_PROCESS) + 0x28, $GAME_PROCESS)
	Dim $pos[3]
	$pos[0] = _MemoryRead($Player + 0x3C, $GAME_PROCESS, 'float')
	$pos[1] = _MemoryRead($Player + 0x44, $GAME_PROCESS, 'float')
	$pos[2] = _MemoryRead($Player + 0x40, $GAME_PROCESS, 'float')
	Return $pos
EndFunc
 
 Func PlayerDir()
	$Player = _MemoryRead(_MemoryRead(_MemoryRead($ADDRESS_BASE, $GAME_PROCESS) + 0x1C, $GAME_PROCESS) + 0x28, $GAME_PROCESS)
	Dim $dir[3]
	$dir[0] = -1* _MemoryRead($Player + 0x14, $GAME_PROCESS, 'float')
	$dir[1] = _MemoryRead($Player + 0xC, $GAME_PROCESS, 'float')
	$dir[2] = 0
	Return $dir
EndFunc

Func FancyLeap($distance, $skillId, $pid, $angle=0)
	;you can use negative distance to leap backwards
	;angle can go up to about 60 degrees
	$pos = PlayerPos()
	$dir = PlayerDir()

	$pos[0] = $pos[0] + $dir[0] * $distance*cos($angle/180.0*3.14159)
	$pos[1] = $pos[1] + $dir[1] * $distance*cos($angle/180.0*3.14159)
	$pos[2] = $pos[2] + abs($distance)*sin($angle/180*3.14159)
	Leap($skillId, $pos, $pid)
EndFunc
02/20/2015 12:00 Stark77#411
now thats what i call hax :P
working just fine. do u use this for anything or is it just for the fun of it?
02/20/2015 19:03 jasty#412
Quote:
Originally Posted by Stark77 View Post
now thats what i call hax :P
working just fine. do u use this for anything or is it just for the fun of it?
Took some shortcuts through out of bounds areas when running nuema. You can probably find some added shortcuts in farming TT (though door hacks already broke that). Vertical leaps can climb above the ceiling and run around up there in some places as well. I set it up so I used the count of a stack of items in a certain spot in my inventory as the angle and bound it to a hotkey so I can adjust the angle in game (often times you want to angle the leap up). It's like having a new skill.

I don't think there's too much use outside of OOB shortcuts. Teleport skills have had their own broken shortcuts but those don't usually let you go OOB so leaps can be more versatile.

It would be OP to use in TW to jump into and out of the base easily through the wall but I wouldn't use this in front of people. I guess you could set up a leap so it works identically to a teleport (where you leap to a selected target's location as long as it is in range), that shouldn't be too obvious even in PVP as long as the vertical difference isn't much.
03/04/2015 19:02 jasty#413
Here's what the fancy leap has done to my 3-3 farming bot. It opened up some interesting shortcuts in the route.
[Only registered and activated users can see links. Click Here To Register...] (3x speed)

In the video I move the camera but don't provide any actual input. It takes about 30 minutes for the bot to run 3-3. I'd share the code but the route and skillset are hardcoded and wouldn't work for other characters. I'm rather proud of it, it's a pity I can't show it off more.
03/05/2015 16:25 Underavelvetmoon#414
That's insane! I love it. What language did you code it in? Would love to check out the source to see what's going on in there.
03/07/2015 18:32 Smurfin#415
Wow farming bot ninja style. Great job for finding something like that. It somehow reminds me of wallhack but works differently and it's 'ninjarcher' class onli :D
03/07/2015 18:55 dumbfck#416
Haha that is awesome, nice job!
03/12/2015 18:54 jasty#417
There is actually a version of the superleap you can do with teleport skills like assassin / bm / duskblade / seeker

The only real difference is that you have to pass a targetId in addition to the destination.

The only restrictions are that the target must be an NPC/Player within a valid range of you (for the skill) and the destination must be within range of you. Unlike leap you can teleport straight up.

For example you can use an NPC 30m away and teleport 30m straight up out of the level. Leaps actually cant go perfectly up by teleport can. You can't use your own id for the target though, it has to be something else.

Something you can almost always do is use an all class pet that you summon as the teleport target.

That all said teleport users had an easy time getting through walls anyway but this can still get you into interesting OOB areas and makes scripting instances easier.

Ohh and here is what the script looks like I wrote to make that video, it's nothing special and plenty messy. Most of it was generated by hitting a Hotkey as I run the instance manually to create move/kill/leap commands.

03/17/2015 18:51 Stark77#418
packet structure for pressing the refinement button:


note: without any refinement Aids RefinementAidPosition (inventory posistion of refine aid like tisha) is 'FFFFFFFF'
04/08/2015 13:23 EurybiX#419
actually pretty helpful.
used some of this pakets to make a private tool working more stable.


thx!
04/22/2015 18:32 weborg#420
can you make a simple script with F1 hotkey for doing vertial demon mage leap? I have no auto-it knowledge