No packet is sent from client to server about experience.
You kill or cause damage to a monster, the server works out how much exp you get, adds it to your total exp and sends you a standard 0x3f9 packet with a 0x05 switch and the total amount of exp you have.
You can't simply do everything you want with packets, they are not some super 1337 thing that you can rule with if you understand them. They are very simple and not at all complex, most stuff is handled server side and the client is merely informed about it.
Leave the protocol analysis and reversal to the experts because they don't need ideas or advice, if there's a vulnerability, they will spot it without wild speculation from people who don't know how it all works.