XP and Coin Hack

HiddenName · 09/14/2010, 19:38

Ok, it's possible, my guildies use it. Now lets figure out here how they do it. All i know is they use simple Cheat Engine to replace the ID of potions with one of quest items and then give them to NPC so they get the rewards. I ask only if someone knows the item ID's and does it have an idea how to get them ?

LemoniscooL · 09/14/2010, 22:51

Umm .. if your guildies use it, why dont they tell you how

I know that something like this worked in way older games but thats already ages ago and i dont think it will work in boi.

xAvengerx · 09/15/2010, 14:07

XP and coin hack? How can it be possible by any means? Could be some exploit when you can repeat the same quest as much as you want, not sure.

HiddenName · 09/15/2010, 17:04

I think they do the Segg quests over and over again. Sadly only ppl 90+ have this "secret". I think we just need the item id's to make it. Or i'll share it when i reach that lvl one day, if it sitll works then

LemoniscooL · 09/16/2010, 06:24

im fooling around with the game files atm and i think the Item ID's could be located inside the ".\Data\item.dat"-File. Cuz when you replace the item.dat with an empty one you cant see any items and also cant move items you have in your inventory anymore.
the only thing that keeps me from posting a list of item ID's is .. the contents of the item.dat arent plain text only, maybe somehow encrypted, maybe just stored as binary data ill have a deeper look at it ^^

blah-1 · 09/16/2010, 10:36

I think its encrypted, when i try to unpack it i see only a billion of txt files with random useless ****, which means there is protection.

LemoniscooL · 09/16/2010, 11:09

unpack it? how Oo
i think its just a text file with some plain text and some encrypted text
why i think so? well there are things in it like:

Spoiler

and then a load of this at the end:

Spoiler

blah-1 · 09/16/2010, 13:45

Well i got some useful multi unpacker which i found once when i was doing my usual web-digging for stuff.

But even that doesn't work, coz of the unknown protection.

Wsup87 · 09/16/2010, 17:32

Guess all that is needed is a program able to change the ids from the file. so you wont delete them but change them into something diferent.

Once you can read the ids its easy to get ids.

So find out how to see the ids of the items and then its easy to see the ids of the items we need. for example just replace items or add the item to the bag after checking the ids and the new id will be from the item that you pretend

So, what now? lets find a way to get read the ids xD

Wsup87 · 09/16/2010, 17:40

Been analysing and the only items i think they are able to replace is the ones you got in the main backpack since the academy books need to be in the quest "part" of the bag, and since you cant move the items there its hard to find the ids

Well was trying to put the items in an order in bag, then copy the file then change the order then copy the file back. what was teh idea? if i had 1 expensive item in slot 1 then changed it with a cheap item and put back the item. then the game would think that in slot 1 was the expensive item. not succeding, stil you can try it you self and see if you succeed better then me =P

LemoniscooL · 09/16/2010, 21:21

Okay i think you didnt understand me Wsup. You know what a text-based database is?
The item.dat could be something similar to that, containing a list of items, their corresponding models, the corresponding icons etc. thats for the game to look into when it recieves a packet to look those things up. It doesnt store what items you have in your inventory or sth like that, thats all serverside and stored in memory at runtime. So moving it changing items and moving back wouldnt have any effect at all of course, especially when moving at runtime. I just deleted it and started the game to guess what could be in there.

I'm sure i could get the item ids from the packets somehow but that would take ages to get a complete list.

//Edit:
Well .. after testing several encryption algos and asking friends im pretty sure its simply Raw Data, but if so we need the parser for it and i cant disassemble the game.exe olly gets detected all the time >.< (even with HideDebugger plugin)

cre4tiv3 · 09/18/2010, 00:14

its easy. pm me if you wana know how to bypass isdebugpresent for game.exe

~~phantom23~~ · 09/20/2010, 07:07

if u want i can send u the last version of the client unpacked. cya

LemoniscooL · 09/22/2010, 22:21

okay .. now that i unpacked the game.exe i could trace where the item.dat is loaded and came to this:

Code:

0045F916   |.  57                PUSH EDI                                   ; /Arg5 = 000A5CC1
0045F917   |.  68 701A9200       PUSH dump.00921A70                         ; |Arg4 = 00921A70 ASCII "CDragoonGame::LoadGameData"
0045F91C   |.  68 08179200       PUSH dump.00921708                         ; |Arg3 = 00921708 ASCII "\n%sÓÃÊ±%d\n"
0045F921   |.  6A 02             PUSH 2                                     ; |Arg2 = 00000002
0045F923   |.  8D45 CC           LEA EAX,[LOCAL.13]                         ; |
0045F926   |.  50                PUSH EAX                                   ; |Arg1 = 00E3EB04
0045F927   |.  E8 F467FAFF       CALL dump.00406120                         ; \dump.00406120

well .. im still tracing the Call there to understand whats going on there but it could still take a while xD
anyways what do you think about this: "\n%sÓÃÊ±%d\n"
looks like some kind of encryption key to me, but could also be a string that is written to a file with writing line breaks at the beginning and at the end .. or some kind of error message (the multiclient protection also has a message like this) but as its pushed as an argument for a function that doesnt log data or open messageboxes i doubt that ... what do you think?

Fibrasek · 09/25/2010, 07:27

Quote:
Originally Posted by LemoniscooL
okay .. now that i unpacked the game.exe i could trace where the item.dat is loaded and came to this:
Code:
0045F916   |.  57                PUSH EDI                                   ; /Arg5 = 000A5CC1
0045F917   |.  68 701A9200       PUSH dump.00921A70                         ; |Arg4 = 00921A70 ASCII "CDragoonGame::LoadGameData"
0045F91C   |.  68 08179200       PUSH dump.00921708                         ; |Arg3 = 00921708 ASCII "\n%sÓÃÊ±%d\n"
0045F921   |.  6A 02             PUSH 2                                     ; |Arg2 = 00000002
0045F923   |.  8D45 CC           LEA EAX,[LOCAL.13]                         ; |
0045F926   |.  50                PUSH EAX                                   ; |Arg1 = 00E3EB04
0045F927   |.  E8 F467FAFF       CALL dump.00406120                         ; \dump.00406120
well .. im still tracing the Call there to understand whats going on there but it could still take a while xD
anyways what do you think about this: "\n%sÓÃÊ±%d\n"
looks like some kind of encryption key to me, but could also be a string that is written to a file with writing line breaks at the beginning and at the end .. or some kind of error message (the multiclient protection also has a message like this) but as its pushed as an argument for a function that doesnt log data or open messageboxes i doubt that ... what do you think?

%s is a reference to string/char in C/C++
and %d is a reference for int/double

In the middle, could be some text shit not-translated, and those \n looks like line breaks for me...