elitepvpers

elitepvpers (https://www.elitepvpers.com/forum/)
-   Forsaken World (https://www.elitepvpers.com/forum/forsaken-world/)
-   -   Forsaken World collaboration (https://www.elitepvpers.com/forum/forsaken-world/854983-forsaken-world-collaboration.html)

vuduy 11/24/2010 07:20

Forsaken World collaboration
 
1 Attachment(s)
I am looking for help mapping the opcodes for PWE's latest game Forsaken World. It's a whole new ball game; every single code is different.

My main computer apparently can't launch the game because of its new protection not working properly on certain x64 configurations; and my other computer is too slow to be painfully working on it.

I can provide the tool for you to hook to the game client and it will dump the opcodes whenever something is sent to the server (you will need NET Framework 4.0 though); or you can grab MHS and setup breakpoints + scripts to dump manually.

Download:
- the tool can be downloaded from the attachment and it works for all PWE games.
- you will need NET Framework 4.0 to run it ([Only registered and activated users can see links. Click Here To Register...])
- you may also need MS C++ 2010 Redistributable ([Only registered and activated users can see links. Click Here To Register...])
(EDIT: I posted the MS C++ 2008 Redistributable earlier which won't work; needs the 2010 version)

Requirement:
- your own FW CB account
- some knowledge of hexadecimals and offsets will make things easier

For starters, here are some current offsets for the latest client:

Send function address = 0x7876B0
Base = 0xD14280

Self player's structure = [Base + 0x20] + 0x24

NPC hash list = [[[Base + 0x20] + 0xc] + 0x20] + 0x18
NPC sequential list = [[[Base + 0x20] + 0xc] + 0x20] + 0x48
NPC's name offset = 0x1c8
NPC's unique Id = 0x150 (8 bytes long = 64 bit) (example: 0x8000000000001A56)

Player's hash list = [[[Base + 0x20] + 0xc] + 0x1c] + 0x18
Player's sequential list = [[[Base + 0x20] + 0xc] + 0x1c] + 0x88
Player name's offset = 0x54c
Player's Id = 0x220 (also 8 bytes = 64 bit)

Loot hash list = [[[Base + 0x20] + 0xc] + 0x24] + 0x18
Loot's name = 0x1e0
Loot's unique Id = 0x130 (8 bytes)

Opcodes format:
============
Cancel = "001D"
NormalAttack = "02001C"
Select = "{0:X16}0007"
Interact = "{0:X16}0046" (engage dialog with NPC)
UseInventory = "{0:X8}00{1:X2}01000032" where {0} = item Id, {1} = inventory slot
UseEquipment = "{0:X8}00{1:X2}00000032" where {0} = item Id, {1} = equipment slot
UseSkill = "{0:X16}0102000000000000000000000000{1:X8}0020 " where {0} = target Id, {1} = skill Id

Opcodes function in C#
================+
Code:

byte[] HexToBytes(string str)
{
        if (string.IsNullOrEmpty(str) || str.Length % 2 != 0) return null;
        byte[] buffer = new byte[str.Length / 2];
        for (int bx = 0, sx = 0; bx < buffer.Length; ++bx, ++sx)
        {
                // Convert first half of byte
                char c = str[sx];
                buffer[bx] = (byte)((c > '9' ? (c > 'Z' ? (c - 'a' + 10) : (c - 'A' + 10)) : (c - '0')) << 4);

                // Convert second half of byte
                c = str[++sx];
                buffer[bx] |= (byte)(c > '9' ? (c > 'Z' ? (c - 'a' + 10) : (c - 'A' + 10)) : (c - '0'));
        }
        return buffer;
}

byte[] GetOpCodes(string format, params object[] operands)
{
        try
        {
                byte[] data = (operands == null) ? HexToBytes(format) : HexToBytes(string.Format(format, operands));
                if (data != null) Array.Reverse(data);
                return data;
        }
        catch
        {
                return null;
        }
}

Example how to use:
Code:

// Selecting targets
string Select = "{0:X16}0007";
ulong targetId = 0x8000000000005001;
byte[] opcodes = GetOpCodes(Select, targetId);

// Using skill
string UseSkill = "{0:X16}0102000000000000000000000000{1:X8}0020";
ulong targetId = 0x8000000000005001;
uint skillId = 0x160;
byte[] opcodes = GetOpCodes(UseSkill, targetId, skillId);


Interest07 11/24/2010 08:24

:( don't have an account there, or I would love to have a go at it lol

Shareen 11/24/2010 15:03

Registered for CB, waiting on any email notification from them.

BuBucekTop 11/24/2010 22:15

Awaiting approval for CB. Then of cource, I'll join collaboration

BuBucekTop 12/02/2010 12:29

BTW, in your attach you've forgot PWDump.dll =/

vuduy 12/02/2010 14:52

It's embedded resource in the net assembly; should work fine. You can try it on PW.

Interest07 12/02/2010 15:32

interesting that theyre using 8 bytes long ids now... any clue as to why? :o

I can't imagine they have THAT many NPCs

vuduy 12/02/2010 16:19

They're just making it a harder time for us which is kinda stupid really; their protection is very lame and stupid; only hurt legitimate players (like me can't start the game).

At least they force me to rewrite my bot to support both 32bit and 64bit Ids in one bot.

Interest07 12/02/2010 18:10

I use XP 64bit, oh well might be in for some issues if I try that game, but I'm already used to it by now, couldn't even connect my phone to my PC cos the software didn't support my windows. Have to mail my own applications to my phone to use them *sighs*

Oh well, I'm pretty sure it won't stop anyone from doing what they want with their games, especially not you lol :D

Shareen 12/03/2010 14:23

Quote:

Originally Posted by vuduy (Post 7938305)
It's embedded resource in the net assembly; should work fine. You can try it on PW.

After selecting the process elementclient and clicking button Analyze, I get the following error dialog box(c/p):
---------------------------
elementclient (3340)
---------------------------
Unable to hook process.
---------------------------
OK
---------------------------

I have .NET Framework 4.0 and I also tried after reinstalling MS C++ Redistributable. When I say reinstall I mean "repair" because I had full installation of Visual Studio 2008 already installed and appart from remove, repair was the only option left. PWEDump analyze failed before and after with same error.

Attempted PW version was PWI 446 (current) as well as one version before current patch, numeric version of which I do not recall.

System specs are:
Windows XP 32bit (eng)
Intel Pentium 4 3.20Ghz
3070Mb RAM

Reason for reporting this issue is not my desire to use it on PW, just wanted to test if all is ok, in case I do get CB key for Forsaken World, which I have not received as of yet.

vuduy 12/03/2010 15:18

Did you get a popup about missing MSVCR100.DLL? I built the DLL in VS2010 and it's linking with this version. If you are missing this, you can google and download it and place in the Windows\System32 folder.

Other than that, I don't see any other possible problem. You can view the source code by using Reflector (free). The hooking process is straight forward.

EDIT: I gave the link to the MS C++ 2008 Redistributable by mistake on my first post; you need the 2010 version which now has the correct link.

Shareen 12/04/2010 13:58

The 2010 version of MS C++ Redistributable did the trick, it now works as it should. Thanks for the modified link.

Just for reference, no, I did not get a popup about missing MSVCR100.DLL before.

godsblight 12/26/2010 19:05

here is a dump of some things.

Code:

Analyzing process game (1316)
Found base = D107D0
Found send function address = 7876B0
12/26/2010 10:02:26 AM: 19-00-82-07-F5-C3-FE-7D-53-43-F5-45-50-C0-82-07-F5-C3-FE-7D-53-43-F5-45-50-C0-30-02-B4-03-21-01-00
12/26/2010 10:02:27 AM: 19-00-F3-DD-F5-C3-A7-C7-53-43-D7-CA-04-C0-F3-DD-F5-C3-A7-C7-53-43-D7-CA-04-C0-26-02-C3-03-21-02-00
12/26/2010 10:02:27 AM: 1A-00-C9-4D-F6-C3-A5-DE-53-43-EA-F5-98-BF-F6-03-5E-21-03-00-3A-01
12/26/2010 10:02:28 AM: 07-00-FD-04-00-00-00-00-00-80
12/26/2010 10:02:28 AM: 07-00-FD-04-00-00-00-00-00-80
12/26/2010 10:02:29 AM: 1C-00-02
12/26/2010 10:02:29 AM: 1C-00-02
12/26/2010 10:02:33 AM: 20-00-90-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-02-01-FD-04-00-00-00-00-00-80
12/26/2010 10:02:35 AM: 1C-00-0F
12/26/2010 10:02:35 AM: 20-00-91-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-02-01-FD-04-00-00-00-00-00-80
12/26/2010 10:02:36 AM: 20-00-93-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-02-01-FD-04-00-00-00-00-00-80
12/26/2010 10:02:39 AM: 1B-00
12/26/2010 10:02:40 AM: 19-00-48-CC-F6-C3-93-F9-53-43-85-0E-07-3F-48-CC-F6-C3-93-F9-53-43-85-0E-07-3F-15-02-BB-03-21-04-00
12/26/2010 10:02:40 AM: 18-00-01-00-02-50-35-11-00-00-00-00
12/26/2010 10:02:40 AM: 19-00-F1-BF-F6-C3-49-02-54-43-B6-0A-03-3E-F1-BF-F6-C3-49-02-54-43-B6-0A-03-3E-23-02-C1-00-21-05-00
12/26/2010 10:02:41 AM: 1A-00-1D-91-F6-C3-B9-21-54-43-36-F1-01-3F-4D-03-0A-21-06-00-A4-00
12/26/2010 10:02:41 AM: 1B-00
12/26/2010 10:02:42 AM: 19-00-58-0C-F7-C3-6C-CE-53-43-F6-D9-8B-3F-58-0C-F7-C3-6C-CE-53-43-F6-D9-8B-3F-FD-01-4E-02-21-07-00
12/26/2010 10:02:42 AM: 19-00-50-D4-F6-C3-71-F3-53-43-08-86-AB-3F-50-D4-F6-C3-71-F3-53-43-08-86-AB-3F-FB-01-08-01-21-08-00
12/26/2010 10:02:43 AM: 19-00-39-F1-F6-C3-D5-DF-53-43-A3-63-AB-3F-39-F1-F6-C3-D5-DF-53-43-A3-63-AB-3F-25-02-6F-00-21-09-00
12/26/2010 10:02:43 AM: 19-00-0E-1D-F7-C3-02-C4-53-43-33-78-9E-3F-0E-1D-F7-C3-02-C4-53-43-33-78-9E-3F-0F-02-B5-00-21-0A-00
12/26/2010 10:02:44 AM: 1A-00-BE-7E-F7-C3-7A-8B-53-43-4C-51-2B-3F-9D-02-D0-21-0B-00-75-01
12/26/2010 10:02:47 AM: 1B-00
12/26/2010 10:02:47 AM: 1A-00-CA-99-F7-C3-4E-7A-53-43-36-BD-69-3F-06-03-8D-21-0C-00-6D-00
12/26/2010 10:02:47 AM: 1B-00
12/26/2010 10:02:47 AM: 1A-00-D0-7E-F7-C3-70-8B-53-43-36-62-2B-3F-05-03-BE-21-0D-00-6D-00
12/26/2010 10:02:48 AM: 1B-00
12/26/2010 10:02:48 AM: 1A-00-BE-88-F7-C3-E6-86-53-43-83-9D-17-3F-0C-01-B3-21-0E-00-6A-00
12/26/2010 10:02:48 AM: 1B-00
12/26/2010 10:02:49 AM: 1A-00-D3-7E-F7-C3-6E-8B-53-43-2C-63-2B-3F-B2-00-DA-21-0F-00-9F-00
12/26/2010 10:02:51 AM: 1F-00-A9-07-00-00-02-01-02-40-FE-10-00-00-00-00
12/26/2010 10:04:05 AM: 18-00-01-00-02-70-26-11-00-00-00-00
12/26/2010 10:04:26 AM: 18-00-01-00-02-D0-CE-0E-00-00-00-00
12/26/2010 10:04:28 AM: 51-00
12/26/2010 10:04:28 AM: 18-00-01-00-02-50-C6-0D-00-00-00-00


Rask_of_Shadows 02/06/2011 16:11

Vuduy what all do you need? I'd be glad to help but do you just want me to record and dump it here? Or are you looking for specific stuff?

vuduy 02/06/2011 17:01

Anything that is useful. Example, cast skills, get the dump and formalize the opcodes; different type of skills may have different opcodes eg. instant cast skill (no cast time) vs normal cast skills.

Also get opcodes for summoning/stowing pets, feeding pets, and any other activities with pets.

Get opcodes for inventory item usage, like using pots, using mounts, or any other special items.

Get opcodes for buying, selling, repairing.

Also, find data offsets like HP, MP, level, gender, etc... all the useful properties for NPC, player and provisions.


All times are GMT +2. The time now is 16:25.

Powered by vBulletin®
Copyright ©2000 - 2026, Jelsoft Enterprises Ltd.
SEO by vBSEO ©2011, Crawlability, Inc.