Help with calling this function!

First off: sorry for my poor english!

Im trying with my dll to set off the "set stat function". The one that u press when you add a stat point to str, dex or what ever. My goal is to make players able to set there Stats to whatever they use to have from an earlier saved point. So if you play against different sort of mobs or players you reform your stats to be suetable for that sertan task in just 1 second right where you stand. Im thinking this is very useful for many ppl here.

So now i could use help with the actuall call of seting a stat point. Cos this makes me D/C thinking i havent got the correct parameters before calling the function :(

This is what use when to call it: (offsets updated from last patch)

void __cdecl SendFunc()
{
UINT_PTR adr = 0x004205D0; //function address
int Param1;
int Param2;

Param1 = 0x0013FC14;
Param2 = 0x0CE;
__asm
{
push Param1
push Param2
mov edx,Param1
mov eax,Param2
mov ecx,0x0058BAA0
call adr
}
}


If one goes to the function and trace whats calling it you end upp here:

49BAA9 ADD ESP,0C
49BAAC LER EDX,DWORD PTR SS:[EBP-70]
49BAAF PUSH EDX
49BAB0 MOV EAX,DWORD PTR SS:[EBP-74]
49BAB3 PUSH EAX
49BAB4 MOV ECX, TwelveSk.0058BAA0
49BAB9 CALL TwelveSk.004205D0

So to me it looks like i need to have 2 parameters set before i can use the function (TwelveSk.004205D0). These being PUSH EDX and PUSH EAX.

When i BP on call (49BAB9) to see what values the register hold before executing the fucntion.. then this is what i got:
EAX 000000CE
ECX 0058BAA0
EDX 0013FC14
EBX 00000000
ESP 0013FC04
EBP 0013FC84
ESI 00402810 TwelveSk.00402810
EDI 0013FD30

As you can see, EDX value i added into Param1 (Param1 = 0x0013FC14;) and also EAX (Param2 = 0x0CE;)
This dont seem to do the jobb correct cos i still get DC as if bad packet is sent.
Any clue of whats wrong?

Thankful for any help / Zowex


btw, this is what i have learned from the bases of using Mega Bytes Send Chat packet code from here:[Only registered and activated users can see links. Click Here To Register...]

Capture the packet or just read it in memory and see if it is the same or similar to the real packet. Also check to make sure the value is on both stack + those registers. lol.

I am not sure what you mean with this though. It is a good idea and a good function. However you cannot simply re-stat your character. Before level 40 or so you can reset your stats by going to the elder and having them reset. After level 40 the only way you can reset your stats is by using a special item called a BloodClear(or something).

However the function above would be nice to put into a bot, so it automatically adds stat points everytime you level up.

well.. for all we know this could work even after lvl 40+ .. with a little modification or so

It be great if someone with a lvl 40+ chracter would try this code and see if it resets the stats or not ( dont have any lvl 40+ char). Its the normal packet sent to server to resets the stats.

void __cdecl SendFunc()
{
UINT_PTR adr = 0x0049DF10;
__asm
{


MOV ECX,0x010CFE58
call adr
}
}

Quote:

Originally Posted by zowex It be great if someone with a lvl 40+ chracter would try this code and see if it resets the stats or not ( dont have any lvl 40+ char). Its the normal packet sent to server to resets the stats. void __cdecl SendFunc() { UINT_PTR adr = 0x0049DF10; __asm { MOV ECX,0x010CFE58 call adr } }

Hey dude,

That is an awesome job on that function. Unfortunately it does not work with any character above level 40, it does just as I assumed it would do, it Disconnects you from the server. I wonder if maybe a simply change of level on the client would help that, but I highly doubt that one.

Either way, nice job on the function. It worked on my level 30 character and I am quite surprised that it worked. If an NPC function like that can work anywhere just by calling the code manually I wonder what other NPC functions can be used without actually using the NPC itself. Would be nice to be able to buy pills in the field(guarantee it would not work but hey, stat reset technically shouldn't work either).

Good job though.

Nice job :)

If I can find the disconnect message and trace it back to the function or memory addy prehaps we can make the client side disconencts cese to exist :D