[Development] C# sources

funhacker · 06/22/2010, 14:43

Quote:

Originally Posted by hio77

you know how much a co mod would maul me for that lol ... they seem to jump on people for anything ... theres like 3 over there and they are all really active and really good at thier job ... honistly its a EO server so it should be in the EO section regardless of the help

look up theres a post from .Arco who i know to be a well known co mod so that just shows that word travels

if i was really that desperate for help i would throw the source up here every 10 mins when i change things lol

in some ways im taking making this sever as a way for me to learn alot more about C#

i will be turning to a few in the co section when i move onto the new encryption in eo as idk how to write the decryption (or rather find the encryption method in the first place)

the worse thing about it is finding the hidden keys such as trying to find the constitution on a mage for example (its a 0 so there no chance in working it out in one log ...)

perhaps i could fill you in on the file encryptions i worked out...

hio77 · 06/22/2010, 21:31

Quote:

Originally Posted by funhacker

perhaps i could fill you in on the file encryptions i worked out...

that could be helpful

i never thought anyone here had looked at the encryption and stuff as well lol

funhacker · 06/23/2010, 09:26

Quote:

Originally Posted by hio77

that could be helpful i never thought anyone here had looked at the encryption and stuff as well lol

2 Files I did so far was the levexp.dat and the mapdestination.dat (pathfinder)

hio77 · 06/23/2010, 09:55

Quote:

Originally Posted by funhacker

2 Files I did so far was the levexp.dat and the mapdestination.dat (pathfinder)

i just realised that we are talking about 2 different things ... your talking file encryption were as im talking packet encryption ...

funhacker · 06/23/2010, 11:49

Yes but on both files.. new and old TQ used the same encryption method..

Faith. · 06/23/2010, 16:14

levexp.dat is the file control the Lvl exp bar , that you were the 1st who fixed it at acme online ?

funhacker · 06/23/2010, 17:28

Yes... maybe oneday I might get around to sharing the application I made to transfer your database table into a working levexp.dat

hio77 · 06/23/2010, 22:08

Quote:

Originally Posted by funhacker

Yes but on both files.. new and old TQ used the same encryption method..

yup ild just expect it to be a different method ... if its the same ild be very surprised ... i dont deny that you can do those files good and well ild say uld be able to work out the packet encryption as well

Quote:

Originally Posted by [Devil]

levexp.dat is the file control the Lvl exp bar , that you were the 1st who fixed it at acme online ?

yup it is that file .... acme is the only ones ....

funhacker · 06/24/2010, 05:51

I guess you could send me a bunch of packets letting me know what each one would contain... best one I would suggest is trading because that way we know of a few variables that should be included

Itemtype.ID (For Sure)
Perhaps cq_Item.ID (this would be about 80%)

another good one would be a chat packet?
This way we know it should contain following
cq_user.ID
target Name? or Target ID?
String - if encrypted would make this packet the easiest to work out

Lastly I guess would be something like a small shop (not Mall) it should include but not for certain all of Item IDs available in the shop...

Another handy one to have to make some nice bots/hacks would be a packet when walking around an almost empty map (include 2 to 3 monsters of different types)
It should have X and Y coords Monster Type ID and maybe Spawn ID? or Unique Monster ID.

funhacker · 06/27/2010, 03:31

*bump*

hio77 · 06/27/2010, 04:44

Quote:

Originally Posted by funhacker

I guess you could send me a bunch of packets letting me know what each one would contain... best one I would suggest is trading because that way we know of a few variables that should be included

Itemtype.ID (For Sure)
Perhaps cq_Item.ID (this would be about 80%)

another good one would be a chat packet?
This way we know it should contain following
cq_user.ID
target Name? or Target ID?
String - if encrypted would make this packet the easiest to work out

Lastly I guess would be something like a small shop (not Mall) it should include but not for certain all of Item IDs available in the shop...

Another handy one to have to make some nice bots/hacks would be a packet when walking around an almost empty map (include 2 to 3 monsters of different types)
It should have X and Y coords Monster Type ID and maybe Spawn ID? or Unique Monster ID.

yup yup ill see what i can give you

Quote:

Originally Posted by funhacker

*bump*

sorry lol been busy with school and stuff for the rest of the week and spent the weekend with my gf lol ... our 1 year anniversary today so iv kinda been putting that ahead of stuff

ill sort some packets from eo soon though

funhacker · 06/28/2010, 03:39

not a problem, quite understandable

hio77 · 06/29/2010, 11:37

ok its a little late but anyway

lets start off with a Client --> Server auth request

Current EO PS packet

Spoiler

Current Real eo

Spoiler

Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F

00000000 6E B7 16 CF 71 87 A9 8F EB D4 1C 35 0F 8B A9 8F n·.Ïq‡©.ëÔ.5.‹©.
00000010 A1 8B A9 83 A1 8B A9 83 A1 8B A9 8F A1 87 A9 83 ¡‹©ƒ¡‹©ƒ¡‹©.¡‡©ƒ
00000020 A1 87 A9 8F A1 87 A9 8F A1 87 A9 83 A1 8B A9 8F ¡‡©.¡‡©.¡‡©ƒ¡‹©.
00000030 A1 8B A9 83 A1 8B A9 83 A1 8B A9 8F A1 87 A9 83 ¡‹©ƒ¡‹©ƒ¡‹©.¡‡©ƒ
00000040 A1 87 A9 8F A1 87 A9 8F A1 87 A9 83 A1 8B A9 8F ¡‡©.¡‡©.¡‡©ƒ¡‹©.
00000050 A1 8B A9 83 A1 8B A9 83 A1 8B A9 8F A1 87 A9 83 ¡‹©ƒ¡‹©ƒ¡‹©.¡‡©ƒ
00000060 A1 87 A9 8F A1 87 A9 8F A1 87 A9 83 A1 8B A9 8F ¡‡©.¡‡©.¡‡©ƒ¡‹©.
00000070 A1 8B A9 83 A1 8B A9 83 A1 8B A9 8F A1 87 A9 83 ¡‹©ƒ¡‹©ƒ¡‹©.¡‡©ƒ
00000080 A1 87 A9 8F A1 87 A9 8F 19 11 FA AC F7 88 33 C9 ¡‡©.¡‡©...ú¬÷ˆ3É
00000090 CA 23 F6 A0 AC E7 65 26 D7 5E 13 15 F7 1F 09 48 Ê#ö ¬çe&×^..÷..H
000000A0 F2 1A 8B E1 CE 5C 9A CF F5 B4 AF E7 34 30 B7 C0 ò.‹áÎ\šÏõ´¯ç40·À
000000B0 0E C1 C3 77 3F E9 92 FC ED 2A 83 8D 4B 67 41 AA .ÁÃw?é’üí*ƒ.KgAª
000000C0 C0 B8 A5 3B 5A 19 B4 54 15 A0 4E 1C 5D 62 FF F6 À¸¥;Z.´T. N.]bÿö
000000D0 03 65 D9 0F 77 7D 3A 45 FB 62 C8 23 C3 1D D5 FB .eÙ.w}:EûbÈ#Ã.Õû
000000E0 87 71 6F 1A 15 47 C1 8A BB 51 59 24 D6 33 21 81 ‡qo..GÁŠ»QY$Ö3!.
000000F0 44 B6 D6 2A 4A F6 AB B3 73 37 47 7D 77 DC 03 84 D¶Ö*Jö«³s7G}wÜ.„
00000100 89 58 80 2B 8C E9 C5 88 4B 1D F1 A4 19 F3 66 5B ‰X€+ŒéÅˆK.ñ¤.óf[
00000110 F4 1B 3A E0 0F E8 07 E0 0F E8 07 EC 0F E4 07 E0 ô.:à.è.à.è.ì.ä.à
00000120 0F E4 07 EC 0F E4 07 EC DE C7 2E BC 2E E8 07 EC .ä.ì.ä.ìÞÇ.¼.è.ì
00000130 0F E8 07 E0 0F E8 07 E0 0F E8 07 EC 0F E4 07 E0 .è.à.è.à.è.ì.ä.à
00000140 0F E4 07 EC 0F E4 07 EC 0F E4 07 E0 0F E8 07 EC .ä.ì.ä.ì.ä.à.è.ì
00000150 0F E8 07 E0 .è.à

ok now this packet has 3 strings that i know of:
Username (this is login in both packets)
Password (this is password in both packets)
ServerName (the name of the server in the OEM - sadly with real eo this is a harder task to match up ... its using the LA/LV server)

Packet Layout

Code:

Offset     Type     Value
0      ushort         52
2      ushort         1051
4      string[16]     Account_Name
20    string[16]     Account_Password
36    string[16]     GameServer_Name

just to explain the packet layout a bit

offset 0,1 2 bytes to give the packet length
offset 2,3 bytes to give packet ID

the rest don't appear to have any counters but a locked to a string size (16 for conquer i cant find my notes on eo but i think its 15 off my head)

these bytes are as per standard in eo (16 Bit bytes) for the first two .. in other words it needs to be flipped like editing the itemtype

ill get you more packets soon

good luck

btw i have posted the packets in file version as well ... should be more clearer than txt format on here

EDIT: [OFFTOPIC] you can actually copy the code of a npc off another server lol ... i could take your quest or w/e for example ...

i might post proof of this as-well sometime but i wont be showing how its done forsure lol

DEADP00L · 06/29/2010, 20:34

keep goin hio, your doing awesome man

funhacker · 06/29/2010, 20:40

Quote:
Originally Posted by hio77
ok its a little late but anyway

lets start off with a Client --> Server auth request

Current EO PS packet

Spoiler

Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F

00000000 14 01 24 04 6C 6F 67 69 6E 00 00 00 00 00 00 00 ..$.login.......
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000080 00 00 00 00 70 61 73 73 77 6F 72 64 00 00 00 00 ....password....
00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000100 00 00 00 00 73 65 72 76 65 72 00 00 00 00 00 00 ....server......
00000110 00 00 00 00 ....

Current Real eo

Spoiler

Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F

00000000 6E B7 16 CF 71 87 A9 8F EB D4 1C 35 0F 8B A9 8F n·.Ïq‡©.ëÔ.5.‹©.
00000010 A1 8B A9 83 A1 8B A9 83 A1 8B A9 8F A1 87 A9 83 ¡‹©ƒ¡‹©ƒ¡‹©.¡‡©ƒ
00000020 A1 87 A9 8F A1 87 A9 8F A1 87 A9 83 A1 8B A9 8F ¡‡©.¡‡©.¡‡©ƒ¡‹©.
00000030 A1 8B A9 83 A1 8B A9 83 A1 8B A9 8F A1 87 A9 83 ¡‹©ƒ¡‹©ƒ¡‹©.¡‡©ƒ
00000040 A1 87 A9 8F A1 87 A9 8F A1 87 A9 83 A1 8B A9 8F ¡‡©.¡‡©.¡‡©ƒ¡‹©.
00000050 A1 8B A9 83 A1 8B A9 83 A1 8B A9 8F A1 87 A9 83 ¡‹©ƒ¡‹©ƒ¡‹©.¡‡©ƒ
00000060 A1 87 A9 8F A1 87 A9 8F A1 87 A9 83 A1 8B A9 8F ¡‡©.¡‡©.¡‡©ƒ¡‹©.
00000070 A1 8B A9 83 A1 8B A9 83 A1 8B A9 8F A1 87 A9 83 ¡‹©ƒ¡‹©ƒ¡‹©.¡‡©ƒ
00000080 A1 87 A9 8F A1 87 A9 8F 19 11 FA AC F7 88 33 C9 ¡‡©.¡‡©...ú¬÷ˆ3É
00000090 CA 23 F6 A0 AC E7 65 26 D7 5E 13 15 F7 1F 09 48 Ê#ö ¬çe&×^..÷..H
000000A0 F2 1A 8B E1 CE 5C 9A CF F5 B4 AF E7 34 30 B7 C0 ò.‹áÎ\šÏõ´¯ç40·À
000000B0 0E C1 C3 77 3F E9 92 FC ED 2A 83 8D 4B 67 41 AA .ÁÃw?é’üí*ƒ.KgAª
000000C0 C0 B8 A5 3B 5A 19 B4 54 15 A0 4E 1C 5D 62 FF F6 À¸¥;Z.´T. N.]bÿö
000000D0 03 65 D9 0F 77 7D 3A 45 FB 62 C8 23 C3 1D D5 FB .eÙ.w}:EûbÈ#Ã.Õû
000000E0 87 71 6F 1A 15 47 C1 8A BB 51 59 24 D6 33 21 81 ‡qo..GÁŠ»QY$Ö3!.
000000F0 44 B6 D6 2A 4A F6 AB B3 73 37 47 7D 77 DC 03 84 D¶Ö*Jö«³s7G}wÜ.„
00000100 89 58 80 2B 8C E9 C5 88 4B 1D F1 A4 19 F3 66 5B ‰X€+ŒéÅˆK.ñ¤.óf[
00000110 F4 1B 3A E0 0F E8 07 E0 0F E8 07 EC 0F E4 07 E0 ô.:à.è.à.è.ì.ä.à
00000120 0F E4 07 EC 0F E4 07 EC DE C7 2E BC 2E E8 07 EC .ä.ì.ä.ìÞÇ.¼.è.ì
00000130 0F E8 07 E0 0F E8 07 E0 0F E8 07 EC 0F E4 07 E0 .è.à.è.à.è.ì.ä.à
00000140 0F E4 07 EC 0F E4 07 EC 0F E4 07 E0 0F E8 07 EC .ä.ì.ä.ì.ä.à.è.ì
00000150 0F E8 07 E0 .è.à

ok now this packet has 3 strings that i know of:
Username (this is login in both packets)
Password (this is password in both packets)
ServerName (the name of the server in the OEM - sadly with real eo this is a harder task to match up ... its using the LA/LV server)

Packet Layout
Code:
Offset     Type     Value
0      ushort         52
2      ushort         1051
4      string[16]     Account_Name
20    string[16]     Account_Password
36    string[16]     GameServer_Name
just to explain the packet layout a bit

offset 0,1 2 bytes to give the packet length
offset 2,3 bytes to give packet ID

the rest don't appear to have any counters but a locked to a string size (16 for conquer i cant find my notes on eo but i think its 15 off my head)

these bytes are as per standard in eo (16 Bit bytes) for the first two .. in other words it needs to be flipped like editing the itemtype

ill get you more packets soon

good luck

btw i have posted the packets in file version as well ... should be more clearer than txt format on here

EDIT: [OFFTOPIC] you can actually copy the code of a npc off another server lol ... i could take your quest or w/e for example ...

i might post proof of this as-well sometime but i wont be showing how its done forsure lol

Yes that's been out there for a while (the NPC thing) as when you notice the client has it's own way of interpreting the cq_action thus the old dat file that can still be found in the client. You know that the packet encryption is pretty obvious?