[GF] Metin2: Reverse Engineering with AI for Non-Reverse Engineers

06/22/2026 12:54 madagascar007#1
This guide shows how the outdated [Only registered and activated users can see links. Click Here To Register...] (eXLib needed for [Only registered and activated users can see links. Click Here To Register...]) was successfully rebuilt and revived for the latest GameForge (GF) Metin2 client (as of 20/06/26) without any traditional manual reverse engineering knowledge required.

The Core Concept

Instead of using Cheat Engine / IDA / Ghidra manually, you let a powerful AI agent locally interact directly with the live running game process attached to Cheat Engine via MCP. The AI reads memory, finds structures, generates AOB signatures, traces call graphs, and suggests/fixes code - while you only validate results in-game. This approach completely bypasses the need for deep reverse engineering knowledge.

Key Tools Used

• Claude Code with Opus 4.8 (or other high-reasoning LLM with tool calling capabilities)
* - Purpose: Autonomous reverse engineering agent
* - Link: [Only registered and activated users can see links. Click Here To Register...]

• Cheat Engine MCP Bridge
* - Purpose: Allows the AI to control Cheat Engine through function calls (memory reads, AOB scanning, Lua execution)
* - GitHub:*[Only registered and activated users can see links. Click Here To Register...]

• Outdated Metin2 Client Source
* - Purpose: Reference for structures, classes (CInstanceBase, etc) and network protocols
* - GitHub: [Only registered and activated users can see links. Click Here To Register...]

• Visual Studio 2022 + Detours
* - Purpose: Building the injectable DLL library

Important: The method uses static memory reads + Lua only (no debugger attachment) because the client’s protection crashes on Cheat Engine breakpoint attachment.


High-Level Workflow (Proven on GF Client)

1. Diagnosis
  • Test all existing AOB signatures against the live client
  • Identify which ones are dead (in this case, 13 out of 24 were outdated)

2. AI-Driven Analysis
  • AI explores the live process (this-pointers, vtables, call graphs)
  • Re-derives fresh AOB signatures when needed
  • Finds correct struct offsets (example: character position moved from expected 0x7C4 → real 0x7BC in CInstanceBase)
  • Handles ASLR by working with RVAs

3. Code Adjustments
  • Update offsets and signatures in defines.h / Offsets.h
  • Add NULL guards and robustness so dead signatures don’t crash the DLL
  • Temporarely strip unused parts (server communication code)
  • Fix threading issues (especially Python GIL when re-enabling packet hooks)

4. Build & Test
  • Compile with MSBuild (Release | Win32 | v142 toolset)
  • Deploy as eXLib.mix which auto-injects*(or .dll used with injector)
  • Validate everything live in-game (position reading, pathfinding, etc.)

5. Iterative Improvement
  • Re-enable features one by one (e.g. CheckPacket hook)
  • Fix crashes (GIL hardening + error clearing was required)


Why This Works for Non-Reverse Engineers

- The AI does the actual disassembly interpretation and pattern finding

- You only need to:
  • Give the AI clear goals
  • Apply the suggested code changes
  • Test in-game

- No manual sig scanning or deep ASM knowledge required

Limitations & Notes
  • This method can be used to reverse engineer anything, including new game updates and outdated addresses whenever the client is rebuilt*(new game version release)
  • Educational / research use only. Automating gameplay violates Metin2 ToS
  • No anti-cheat bypasses were added because*it uses the same injection method as the original library.

Resources

Quote:
Matteo:

Is Claude letting you run prompts like that?
Yes, Claude Code CLI specifically by using framing to your advantage.

I tagged the cloned outdated source of MetinPythonLibV2 repo locally, cloned an outdated client source and installed the Cheat Engine MCP into Claude Code CLI (like adding a plugin) then attached CE to the running Metin2 client (character in-game).

✅ Framed the ask something like this:

"checkout this outdated @MetinPythonLibV2 library that used to work on the older Metin2 client, but now on the latest client build it crashes when injected, help me with a multi-step plan to make it work again (with limited functionality initially) on the latest client version, only: walker + pathfinding, you will be using the cheatengine mcp tools available while CE is attached to the client with character in-game - for function names / references / strings checkout this old @metin2-client-source"

👆that spit out a game plan without any issues or restrictions, then once agreed to - it started the RE work eventually landing on:


❌ On the other hand, if you approach it with something like: "hey I want to hack this Metin2 game to gain advantages over regular players, help me reverse engineer it and profit "

Then you might experience some difficulties reversing 🥲

---

Let's just say that both of these matter:
  • using Claude Code CLI locally with access to sources and Cheat Engine MCP
  • framing it as a genuine RE*project, without profit-driven intentions and game ToS violation


🔴 A bad example I tried would be: directly in Claude online (web chat): paste some snippets of server + client code to help reverse the client-side visual effect of calling the Compass for Metin Stones.

I don't even wanna begin telling you how many ethics lessons I got on every prompt and how hard it was to just get some basic info (functions and variable names that I could look-up myself) 😅

Lo' and behold, as soon as I pasted the same snippets into Claude Code CLI running on my windows machine, continuing the same RE conversation from earlier, it started reversing and writing the C++ / Python right away and here's the result:


To be continued...
07/14/2026 21:54 madagascar007#2
Some updates on the topic:

To streamline the AI - Cheat Engine MCP connection and ease of use, I built a python windows app that you can open with double-click and a 1 Button click to Setup & Launch the CE MCP, it handles:

- adds MCP CLI config for Claude Code, Codex, Gemini CLIs (you can select whichever one you use)

- opens Cheat Engine with Admin rights
-*launches the CE MCP bridge .lua script within opened Cheat Engine

Notes:
1.*The program comes with bundled Python (hence the ~70mb size once compiled) so you don't need to have python installed on the system and added to PATH.
2. The CE-MCP-Launcher app source is public on my Github meaning you can build it from source so you don't have to download the .exe for safety reasons:*github.com/ikevin127/cheatengine-mcp-launcher
3. All you need to have installed on your system is one of the 3 AI CLIs and Cheat Engine.

Here's a quick preview of how the CE-MCP-Launcher works on GF Metin2 client:


---

With the CE-MCP-Launcher and more reversing and changes on the eXLib source (source on Github), I was able to put together a system that replicates GF Auto-Hunt but free, with most of the features working exactly as the original Auto-Hunt:

- opens the Auto-Hunt window which looks and works pretty much like the official GF Auto-Hunt
- features auto skills, auto HP/SP potions only, auto attack with filters, focus range distance circle, auto resurrect with attack resumed after 5 seconds (allows HP to recover)

What it does

Auto attack — filter by monster level range and type (metins, bosses)
Focus range zone — locks your hunting spot where you Confirm Focus Range and hit Start so your character stops wandering off across the map, range circle animation is 1:1 with GF Auto-Hunt
- Smart potions — HP/SP % thresholds, and it won't waste potions while your Sun/Moon Elixir is already auto-potting
- Auto skills & buffs — recasts buffs right as they expire, hits offensive skills on target, live skill-duration input in seconds (can add delay)
- Auto-revive + anti-stuck — gets unstuck from unreachable spots instead of freezing

Not in this version (coming later):
- only supports standard HP/SP potions on % for now — support for other healing potions, buffing potions, fish, waters, dews, elixirs, and bravery capes (on interval) will arrive with other updates later



---

Next will attempt a GF Trading Glass bot (obviously client-side only) that will use the same UI as the Trading Glass, goal is so provide otherwise paid features (itemshop: auto-hunt, trading glass) for free through bots that don't look like hacking to the other players, unlike most bots which offer DMG / fast walking speed / teleport hacks that can get users banned easily.
07/19/2026 22:27 cosmin555#3
Very nice madagascar! I'm not a cheat user but i always was intrigued just to learn and reverse engineer metin2 especially. Mersi frate mult respect! :)
07/28/2026 23:00 madagascar007#4
Quote:
Next will attempt a GF Trading Glass bot (obviously client-side only) that will use the same UI as the Trading Glass, goal is so provide otherwise paid features (itemshop: auto-hunt, trading glass) for free through bots that don't look like hacking to the other players, unlike most bots which offer DMG / fast walking speed / teleport hacks that can get users banned easily.
Following up on this

Added Trading-Glass + Shop Search bot in the sidebar replacing the old Shop Searcher, here's how it works:
  • opens new Shop Search window which is used to scan all shops while in the shop map, it's using 48 checkpoints scanning the entire map and not missing any of the in-range shops at any checkpoint (see checkpoint map in youtube video attached below)
  • once the full shop map was scanned (~20mins depending on character walking speed), the Trading Glass button can be pressed which opens a Trading Glass window similar to official GF one which has all the filters used in official GF trading glass, below is a complete youtube video on how to use the bot


How does the scanner work exactly ?

Checkpoint generation: _loadCollisionGrid reads OpenBot/Maps/<map>.dat — line 1 is maxX maxY, then one row per y of '0'/'1' cells, 1 cell = 100 world units. generateCheckpoints lays a grid at step//2 offset (so 25, 75, 125…), reverses xs on odd rows for the boustrophedon order, snaps each point to the nearest walkable cell via an expanding ring search up to 30 cells, dedupes on a //4 cell key, and emits world coords (cell * 100).

On the latest version of the privateshop map that resolves to:
  • 512×512 cells, 29.3% walkable (76,905 cells)
  • 10×10 = 100 grid points → 52 dropped (unwalkable with no walkable cell within 30), 17 snapped off-grid, 0 duplicates → 48 checkpoints
  • consecutive spacing min 3100 / avg 4939 / max 7072 world units, 232,114 units of total walk

The sweep state machine (_sweepTick, driven from OnUpdate at SWEEP_TICK = 0.1s):
  • SW_WALK — Movement.GoToPositionAvoidingObjects(cp) → eXLib.FindPath A* on the DLL side, walking real MoveToDestPosition moves. Arrival = within SWEEP_ARRIVE = 350.
  • SW_DRAIN — Spawn packets keep trickling in after you stop, so instead of a fixed sleep it snapshots the in-range count every tick and waits for 2 consecutive identical counts plus SWEEP_SETTLE = 0.3s minimum. Fast-loading checkpoints cost 0.3s; slow ones wait as long as needed. The _drainDt < 0 branch handles app.GetTime() running backwards on a world reload.
  • SW_SCAN — per shop, three substates: SendOnClickPacket → poll shop.IsOpen() then ScanShop + SendShopEndPacket → poll for closed, then pop. Give up after 5 tries. Strict close-before-open, one shop at a time.


Queue is built as [v for v in vids if v not in self.swScannedVids], which matters because InstancesList is global and still holds shops from earlier checkpoints — that set is what stops the overlap from causing redundant work.

ScanShop. Iterates SLOT_COUNT (40) * shop.GetTabCount() slots, pulling GetItemID/Price/Cheque/Count/MetinSocket/GetItemAttribute plus proto metadata via _itemMeta (type, subtype, level limit, class bitmask derived from IsAntiFlag). Three details worth calling out: position is captured while the shop is open with a NaN guard falling back to the player's own position; owner name is snapshotted at scan time so it survives despawn; and dedupe is on a coordinate key (round(x/100)), not VID, because VIDs recycle across map reloads. Vnum 50300 gets the skill name prefixed so books are distinguishable.

Completion writes a tab-separated index to OpenBot/Data/tradingglass_<map>.txt, so a crash doesn't cost a full re-sweep.
09/26/2026 14:29 Jantue#5
Hi, I updated ExLib, but I'm getting a red bar error; how can I fix this?