Massive Spawning with CE

[6Drako9]

well I think I found a section of code were mass spawn can be activated

0048D028 -- PUSH 00A5E424                                ASCII "ATTACK"
0048D02D -- LEA EAX,DWORD PTR SS:[ESP+20]
0048D031 -- PUSH 00A5E664                                ASCII "%s"
0048D036 -- PUSH EAX
0048D037 -- MOV DWORD PTR SS:[ESP+1C],6
0048D03F -- CALL 00455360

fow those of you that know how to do mass spawn in csv's, you may remember that ATTACK Index 9 is the action for summoning and then Time Length is the time in seconds that it takes for the animation

now as you can see all those pushes are being prepared for the Call at the bottom.

so I'm thinking that in the second line... LEA EAX,[ESP+20] is loading Either the index or the attack (9, in case of a summon) or it is entering the TimeLength (personaly I think its the first one and not the second)

So all we have to do is find the relationship of TimeLength to Index and then check the eax after LEA EAX,[ESP+20] and if its equal... change TimeLength to 0
MASS SPAWN

[Obama]

but they dont give exp

[6Drako9]

what...? summoned mobs don't give exp anymore?

[matii1509]

Originally Posted by 6Drako9

what...? summoned mobs don't give exp anymore?

Yea, it was patched

[elfulll]

only crespo C,B,A

[Vaidas B]

#request to close, even if it would work, it would be added to the banned list, couse it is too easy to abuse.

[~Kakkarot~]

All CE scripts are easy to use, unlike skillhack and sheild hack, mass spawn would hardly be used to ruin the gameplay for other legit players. The bottom line is mass spawn is would be used for lvling.


#close request denied

[Vaidas B]

Thanks for clearning that up.

[bottomy]

It looks like it's just preparing a string.

Pushes "ATTACK" to the stack.
Loads address of some value on the stack, so could be a pointer (or multiple pointers) to a string.
Pushes "%s" to the stack, used for specifying a string of characters.
Moves 6 onto the stack, so could be a value for length maybe? Like for attack or maybe the other string, who knows, though attack is null-terminated so don't see the point if that is the case.

But only way to know is to know is see what the function at 0x00455360 is doing, otherwise if you still can't tell debug.

[6Drako9]

fine so here is the section called by that call at the bottom

00455360 -- MOV ECX,[ESP+8]
00455364 -- PUSH ESI
00455365 -- MOV ESI,[ESP+8]
00455369 -- LEA EAX,[ESP+10]
0045536D -- PUSH EAX
0045536E -- PUSH ECX
0045536F -- PUSH 100
00455374 -- PUSH ESI
00455375 -- CALL 00884A30
0045537A -- ADD ESP,10
0045537D -- TEST EAX,EAX
0045537F -- JL 00455388
00455381 -- CMP EAX,100
00455386 -- JNZ 0045538F
00455388 -- MOV [ESI+FF],0
0045538F -- MOV EAX,ESI
00455391 -- POP ESI
00455392 -- RETN

and here is the section called by the call at 00455375

008B8CD5 -- PUSH EBP
008B8CD6 -- MOV EBP,ESP
008B8CD8 -- SUB ESP,20
008B8CDB -- MOV EAX,[EBP+C]
008B8CDE -- PUSH ESI
008B8CDF -- MOV ESI,[EBP+8]
008B8CE2 -- PUSH EDI
008B8CE3 -- PUSH [EBP+14]
008B8CE6 -- MOV [EBP-1C],EAX
008B8CE9 -- PUSH [EBP+10]
008B8CEC -- LEA EAX,[EBP-20]
008B8CEF -- PUSH EAX
008B8CF0 -- MOV [EBP-14],42
008B8CF7 -- MOV [EBP-18],ESI
008B8CFA -- MOV [EBP-20],ESI
008B8CFD -- CALL 008C2806
008B8D02 -- ADD ESP,0C
008B8D05 -- TEST ESI,ESI
008B8D07 -- MOV EDI,EAX
008B8D09 -- JE 008B8D25
008B8D0B -- DEC [EBP-1C]
008B8D0E -- JS 008B8D18
008B8D10 -- MOV EAX,[EBP-20]
008B8D13 -- MOV [EAX],0
008B8D16 -- JMP 008B8D25
008B8D18 -- LEA EAX,[EBP-20]
008B8D1B -- PUSH EAX
008B8D1C -- PUSH 0
008B8D1E -- CALL 008C265F
008B8D23 -- POP ECX
008B8D24 -- POP ECX
008B8D25 -- MOV EAX,EDI
008B8D27 -- POP EDI
008B8D28 -- POP ESI
008B8D29 -- LEAVE
008B8D2A -- RETN

however...
im starting to lean to the thought that TimeLength might be used in the following opperations under the fist section of code I posted

[Color="Red"]0048CFFF -- MOV BYTE PTR SS:[ESP+128],BL
0048D006 -- [COLOR="Orange"]CALL [EDX+24][/COLOR]
0048D009 -- PUSH 102
0048D00E -- [COLOR="Orange"]CALL 0088AA7F[/COLOR]
0048D013 -- MOV EDI,EAX
0048D015 -- ADD ESP,4
0048D018 -- MOV [ESP+14],EDI
0048D01C -- TEST EDI,EDI
0048D01E -- MOV [ESP+124],18
0048D026 -- JE 0048D05A[/Color]
0048D028 -- PUSH 00A5E424                                ASCII "ATTACK"
0048D02D -- LEA EAX,[ESP+20]
0048D031 -- PUSH 00A5E664                                ASCII "%s"
0048D036 -- PUSH EAX
0048D037 -- MOV [ESP+1C],6
0048D03F -- [COLOR="Orange"]CALL 00455360[/COLOR][Color="Blue"]
0048D044 -- ADD ESP,0C
0048D047 -- LEA ECX,[ESP+10]
0048D04B -- PUSH ECX
0048D04C -- LEA EDX,:[ESP+20]
0048D050 -- PUSH EDX
0048D051 -- MOV ECX,EDI
0048D053 -- [COLOR="Orange"]CALL 0048BE50[/COLOR]
0048D058 -- JMP 0048D05C
0048D05A -- XOR EAX,EAX
0048D05C -- MOV EDX,[ESI]
0048D05E -- PUSH EAX
0048D05F -- MOV ECX,ESI[/Color]

Also here are the other found strings that relate to actions
if you look in the csv's under data\share\action you will see that they use these words to classify different objects, and classify different Actions

0048C826 -- PUSH 00A5E38C         ASCII "PC"
0048C888 -- PUSH 00A5E390         ASCII "MONSTER"
0048C8EA -- PUSH 00A5E398         ASCII "NPC"
0048C94C -- PUSH 00A5E39C         ASCII "ITEM"
0048C9AE -- PUSH 00A5E3A4         ASCII "MONEY"
0048CA10 -- PUSH 00A5E3AC         ASCII "MINIPC"
0048CA72 -- PUSH 00A5E3B4         ASCII "TRADEPC"
0048CAD4 -- PUSH 00A5E3BC         ASCII "REMOTE"
0048CB36 -- PUSH 00A5E3C4         ASCII "SERVANT"
0048CB94 -- PUSH 00A5E3CC         ASCII "GUARD"
0048CBF6 -- PUSH 00A5E3D4         ASCII "BRICK"
0048CC58 -- PUSH 00A5E3DC         ASCII "SENTRY"
0048CCBA -- PUSH 00A5E3E4         ASCII "VEHICLE"
0048CD1C -- PUSH 00A5E3EC         ASCII "RIDER"
0048CD7E -- PUSH 00A5E3F4         ASCII "PET"
0048CDE0 -- PUSH 00A5E3F8         ASCII "ENTER"
0048CE42 -- PUSH 00A5E400         ASCII "STAND"
0048CEA4 -- PUSH 00A5E408         ASCII "MOVE"
0048CF02 -- PUSH 00A5E410         ASCII "MOVETO"
0048CF64 -- PUSH 00A5E418         ASCII "FLY"
0048CFC6 -- PUSH 00A5E41C         ASCII "HOMING"
0048D028 -- PUSH 00A5E424         ASCII "ATTACK"
0048D08A -- PUSH 00A5E42C         ASCII "DEFEAT"
0048D0EC -- PUSH 00A5E434         ASCII "DEAD"
0048D14E -- PUSH 00A5E43C         ASCII "LEAVE"
0048D1B0 -- PUSH 00A5E444         ASCII "SKILL"
0048D212 -- PUSH 00A5E44C         ASCII "REVIVE"
0048D274 -- PUSH 00A5E454         ASCII "BLOCKING"
0048D2D6 -- PUSH 00A5E460         ASCII "BLOCKED"
0048D338 -- PUSH 00A5E468         ASCII "GUARDING"
0048D39A -- PUSH 00A5E474         ASCII "MOTION"
0048D3FC -- PUSH 00A5E47C         ASCII "AIR"
0048D45E -- PUSH 00A5E480         ASCII "OPENMARKET"
0048D4C0 -- PUSH 00A5E48C         ASCII "CLOSEMARKET"
0048D522 -- PUSH 00A5E498         ASCII "TRAP"
0048D584 -- PUSH 00A5E4A0         ASCII "TIMER"
0048D5E6 -- PUSH 00A5E4A8         ASCII "FISHFIGHTING"
0048D648 -- PUSH 00A5E4B8         ASCII "OPENFISHING"
0048D6AA -- PUSH 00A5E4C4         ASCII "CLOSEFISHING"
0048D70C -- PUSH 00A5E4D4         ASCII "OPENBRICK"
0048D76E -- PUSH 00A5E4E0         ASCII "CLOSEBRICK"
0048D7D0 -- PUSH 00A5E4EC         ASCII "SM_STAND"
0048D832 -- PUSH 00A5E4F8         ASCII "SM_DEAD"
0048D894 -- PUSH 00A5E500         ASCII "SM_MOVE"
0048D8F6 -- PUSH 00A5E508         ASCII "SM_REVIVE"
0048D958 -- PUSH 00A5E514         ASCII "ENDSIEGE"
0048D9BA -- PUSH 00A5E520         ASCII "EMOTIMOTION2"
0048DA1C -- PUSH 00A5E530         ASCII "FLYTIMER"
0048DA7E -- PUSH 00A5E53C         ASCII "FLY_STAND"
0048DAE0 -- PUSH 00A5E548         ASCII "FLY_DEAD"
0048DB42 -- PUSH 00A5E554         ASCII "FLY_MOVE"
0048DBA4 -- PUSH 00A5E560         ASCII "FLY_REVIVE"
0048DC06 -- PUSH 00A5E56C         ASCII "DASH"
0048DC68 -- PUSH 00A5E574         ASCII "KNOCKDOWN"
0048DCCA -- PUSH 00A5E580         ASCII "AWK_STAND"
0048DD2C -- PUSH 00A5E58C         ASCII "AWK_MOVE"
0048DD8E -- PUSH 00A5E598         ASCII "STUN"

For example look at this csv of "data\share\action\npc\npc_agatha.act.305.csv"

[UpdateSeeker]

lol kakk, isn't shield hack easy? i thought everyone wud kno the old method of dat using ce already hahaha. but for some reason lota hackers i see online stil ask me how to do it -.-. like isnt dat technique back to bad moon rising? lol. n it's more like client sided, n as long as u can target dk w ce, u can do it