Download Ollydbg at [Only registered and activated users can see links. Click Here To Register...]
Open your RFO and login into the world.
Open your Ollydbg, press 'File -> Attach' and select your RFO proccess.
Right click on Ollydbg and select 'View -> Module RF_Online'
Again, Right click on Ollydbg and select 'Search for -> all referenced text strings'
Now we have a list of functions, and need to search for 2 of them. (MoveRequest, RealmovposRequest)
Just like in the picture: [Only registered and activated users can see links. Click Here To Register...]
Save those 2 addresse's to notepad.
Close Ollydbg, and lets continue with CheatEngine.
Again, Open RFO, Open CheatEngine, and attach it to RFO.
Open 'Memory View' and press 'CTRL + G' (goto address), and place your 1st address there.
Right click anywhere on the code, and select 'Select current function' (so it goes to the beginning of the function)
Now we have to find the line of code, checking for the time elapsed delay.
Example: [Only registered and activated users can see links. Click Here To Register...]
As shown in the image
The 'ecx' register contains the amount of time elapsed since last packet was sent. (in ms/milliseconds)
The '1F4' (hexadecimal) is 500(decimal)
So, in 'cmp ecx, 1F4' means, we are checking if 500ms are elapsed.
If the 500ms are elapsed, jae will jmp forward, and keep executing the 'movereq' function.
If the 500ms are NOT elapsed, jae wont jmp forward, but instead use the 'jmp 0x..' to jump to the address exiting the function.
All we have to do, is to replace the 'jae' with 'jmp' so there wont be any checking.
Or replace the '1F4' with a lesser value.
Do the same process with the other function address 'RealmovposRequest'.
Now your game will be able to send 'Move' packet's without delay. (that's all we need to bypass rollback)
Only thing left is to search for the 'Speed Address', change it to a higher value and freeze.
Done, your speed hack is working. Have fun :p
Remember, those addresses are different on each server, and they can change after an update.
Not sure if this method works on every server. but probably is working on 90% of them.
And if you're not able to find the right address on CheatEngine, you probably used the wrong address, or your game is encrypted/protected by an antihack. (that's another story ^^)
Good luck!
Edit --- Video Added
Tutorial Video: [Only registered and activated users can see links. Click Here To Register...]
Open your RFO and login into the world.
Open your Ollydbg, press 'File -> Attach' and select your RFO proccess.
Right click on Ollydbg and select 'View -> Module RF_Online'
Again, Right click on Ollydbg and select 'Search for -> all referenced text strings'
Now we have a list of functions, and need to search for 2 of them. (MoveRequest, RealmovposRequest)
Just like in the picture: [Only registered and activated users can see links. Click Here To Register...]
Save those 2 addresse's to notepad.
Close Ollydbg, and lets continue with CheatEngine.
Again, Open RFO, Open CheatEngine, and attach it to RFO.
Open 'Memory View' and press 'CTRL + G' (goto address), and place your 1st address there.
Right click anywhere on the code, and select 'Select current function' (so it goes to the beginning of the function)
Now we have to find the line of code, checking for the time elapsed delay.
Example: [Only registered and activated users can see links. Click Here To Register...]
As shown in the image
The 'ecx' register contains the amount of time elapsed since last packet was sent. (in ms/milliseconds)
The '1F4' (hexadecimal) is 500(decimal)
So, in 'cmp ecx, 1F4' means, we are checking if 500ms are elapsed.
If the 500ms are elapsed, jae will jmp forward, and keep executing the 'movereq' function.
If the 500ms are NOT elapsed, jae wont jmp forward, but instead use the 'jmp 0x..' to jump to the address exiting the function.
All we have to do, is to replace the 'jae' with 'jmp' so there wont be any checking.
Or replace the '1F4' with a lesser value.
Do the same process with the other function address 'RealmovposRequest'.
Now your game will be able to send 'Move' packet's without delay. (that's all we need to bypass rollback)
Only thing left is to search for the 'Speed Address', change it to a higher value and freeze.
Done, your speed hack is working. Have fun :p
Remember, those addresses are different on each server, and they can change after an update.
Not sure if this method works on every server. but probably is working on 90% of them.
And if you're not able to find the right address on CheatEngine, you probably used the wrong address, or your game is encrypted/protected by an antihack. (that's another story ^^)
Good luck!
Edit --- Video Added
Tutorial Video: [Only registered and activated users can see links. Click Here To Register...]
