Sending Packets

[No0oB]

i creatd a little page to show u what i mean ^^
its just an testpage to show you...
the page should look much better... and the tables too xD

atm u can add testdata to the pw int table (but not remove it ^^")

link:

[BuBucekTop]

maybe some wiki-style ? free trak hosting, imho, will be the best solution..

[Interest07]

This does look like a pretty cool idea. I can prolly host it.

[blackmorpheus]

Hmm i'm putting a breakpoint on 62f320, but it doesn't seem to get called at all.
Could it perhaps be 60e310 ? That's showing exactly the stuff..

[Interest07]

Yeah its been 0x60E310 on PWI for quite a while

[blackmorpheus]

Thanks, this is how i fixed it with a bit of c++ and asm,which seems much faster/shorter than your code :P

Do you have an idea on how to get all the id's from mobs/items/players in a player's area?

Also i could write a C++ version of the encrypt function if you like, you could make a stand-alone bot then

PHP Code:

char buffer[32];
DWORD sendFunction = 0x60e310;
DWORD *base0 = (DWORD *)0xa5b90c;

void SendPacket(char * pkt, int len)
{    
    DWORD ptr2 = *(DWORD *)(*(DWORD *)0xa5b90c + 0x20);    
    __asm{
        push len
        push pkt
        mov ecx,ptr2
        call sendFunction
    }    
}

void AttackTarget()
{
    const int len = 3;
    buffer[0] = 3;
    buffer[1] = 0;
    buffer[2] = 0;
    SendPacket(buffer, len);
}

void DropGold(int amount)
{    
    int am = amount;
    const int len = 6;
    buffer[0] = 0x14;
    buffer[1] = 0x00;
    memcpy(buffer + 2,&am,4);    
    SendPacket(buffer,len);    
} 


[louco89]

Tanks for this Interest07, i'm trying to convert autoit to delphi, when i done some work i post here

 Spoiler

type
PPacket = ^TPacket;

TPacket = packed record
Len: cardinal;
Buf: array [0 .. 63] of byte;
end;

procedure SendCall(aPacket: PPacket); stdcall;
var
addr: Pointer;
size, Buf: DWORD;
begin
addr := Pointer(PW_SEND_PACK_CALL);
size := PDword(aPacket)^;
Buf := DWORD(aPacket) + 4;
asm
pushad
mov eax, dword ptr [PW_BASE_ADDRESS]
mov ecx, dword ptr [eax + $20]
push size
push buf
call addr
popad
end;
end;

function HexToInt(HexNum: string): LongInt;
begin
Result := StrToInt('$' + HexNum);
end;

procedure Deselect;
var
lPacket: TPacket;
pckHead: word;
begin
// Packet: 0800
// Length: 2
lPacket.Len := 2;
pckHead := $08;
copymemory(@lPacket.Buf[0], @pckHead, sizeOf(pckHead));
lPacket.Buf[1] := $00;
InjectFunc(wh, @SendCall, @lPacket, sizeOf(lPacket));
end;

procedure Logout(ToAcount: Integer = 1);
var
lPacket: TPacket;
pckHead: word;
AccHex: LongInt;
begin
// Packet: 0100 - and 0 or 1 in hex
// 0 - Logout full
// 1 - Logout to char select
// Size:= 6
if (ToAcount > 1) or (ToAcount < 0) then
ToAcount := 1;
lPacket.Len := 6;
pckHead := $01;
copymemory(@lPacket.Buf[0], @pckHead, sizeOf(pckHead));
lPacket.Buf[1] := $00;
AccHex := HexToInt(IntToHex(ToAcount, 8));
copymemory(@lPacket.Buf[2], @AccHex, sizeOf(cardinal));
InjectFunc(wh, @SendCall, @lPacket, sizeOf(lPacket));
end;

procedure StartMedit;
var
lPacket: TPacket;
pckHead: word;
begin
// Packet: 2E00
// Length: 2
lPacket.Len := 2;
pckHead := $2E;
copymemory(@lPacket.Buf[0], @pckHead, sizeOf(pckHead));
lPacket.Buf[1] := $00;
InjectFunc(wh, @SendCall, @lPacket, sizeOf(lPacket));
end;

procedure StopMedit;
var
lPacket: TPacket;
pckHead: word;
begin
// Packet: 2F00
// Length: 2
lPacket.Len := 2;
pckHead := $2F;
copymemory(@lPacket.Buf[0], @pckHead, sizeOf(pckHead));
lPacket.Buf[1] := $00;
InjectFunc(wh, @SendCall, @lPacket, sizeOf(lPacket));
end;

procedure UseAction(Action: Integer = 0);
var
lPacket: TPacket;
pckHead: word;
AcHex: LongInt;
begin
// Packet: 3000 - and 0 for 26 in hex
// Size:= 4
if (Action > 26) or (Action < 0) then
Action := 0;
lPacket.Len := 4;
pckHead := $30;
copymemory(@lPacket.Buf[0], @pckHead, sizeOf(pckHead));
lPacket.Buf[1] := $00;
AcHex := HexToInt(IntToHex(Action, 4));
copymemory(@lPacket.Buf[2], @AcHex, sizeOf(cardinal));
InjectFunc(wh, @SendCall, @lPacket, sizeOf(lPacket));
end;

procedure PartySetting(Recruit, JobId, lvl, Slogan: Integer);
var
lPacket: TPacket;
pckHead: word;
JobHex, RecHex, LvlHex, SlogHex: LongInt;
begin
{ ;//Changes party searching settings.
;//recruit=1 means recruiting party
;//recruit=0 means searching for party
;//jobId=0 & lvl=0 & no slogan -> slogan=0x0
;//jobId<>0 & lvl<>0 & no slogan -> slogan=0x40
;//jobId=0 & lvl=0 & slogan -> slogan=0x80
;//jobId<>0 & lvl<> 0 & slogan -> slogan=0xC0 }
// Size: 10;
// Obs: Works but not show
JobHex := HexToInt(IntToHex(JobId, 2));
RecHex := HexToInt(IntToHex(Recruit, 2));
LvlHex := HexToInt(IntToHex(lvl, 2));
SlogHex := HexToInt(IntToHex(Slogan, 2));

lPacket.Len := 10;
pckHead := $3F;
copymemory(@lPacket.Buf[0], @pckHead, sizeOf(pckHead));
lPacket.Buf[1] := $00;
copymemory(@lPacket.Buf[2], @JobHex, sizeOf(cardinal));
copymemory(@lPacket.Buf[3], @LvlHex, sizeOf(cardinal));
copymemory(@lPacket.Buf[4], @RecHex, sizeOf(cardinal));
copymemory(@lPacket.Buf[5], @SlogHex, sizeOf(cardinal));
lPacket.Buf[6] := $00;
lPacket.Buf[7] := $00;
lPacket.Buf[8] := $00;
lPacket.Buf[9] := $00;
lPacket.Buf[10] := $00;
InjectFunc(wh, @SendCall, @lPacket, sizeOf(lPacket));
end;

procedure DropGold(Quant: Integer = 0);
var
lPacket: TPacket;
pckHead: word;
QuantHex: LongInt;
begin
if Quant <= 0 then
exit;
{ $packet = '1400'
$packet &= _hex($amount)
$packetSize = 6 }
lPacket.Len := 6;
pckHead := $14;
copymemory(@lPacket.Buf[0], @pckHead, sizeOf(pckHead));
lPacket.Buf[1] := $00;
QuantHex := HexToInt(IntToHex(Quant, 8));
copymemory(@lPacket.Buf[2], @QuantHex, sizeOf(cardinal));
InjectFunc(wh, @SendCall, @lPacket, sizeOf(lPacket));
end;

procedure RegularAttack(AfterSkill: Integer = 1);
var
lPacket: TPacket;
pckHead: word;
AftHex: LongInt;
begin
{ $packet = '0300'
$packet &= _hex($afterSkill, 2)
$packetSize = 3 }
lPacket.Len := 3;
pckHead := $03;
copymemory(@lPacket.Buf[0], @pckHead, sizeOf(pckHead));
lPacket.Buf[1] := $00;
AftHex := HexToInt(IntToHex(AfterSkill, 2));
copymemory(@lPacket.Buf[2], @AftHex, sizeOf(cardinal));
InjectFunc(wh, @SendCall, @lPacket, sizeOf(lPacket));
end;

procedure Target(IDTarget: DWORD);
var
lPacket: TPacket;
pckHead: word;
TarHex: LongInt;
begin
{ $packet = '0200'
$packet &= _hex($targetId)
$packetSize = 6 }
lPacket.Len := 6;
pckHead := $02;
copymemory(@lPacket.Buf[0], @pckHead, sizeOf(pckHead));
lPacket.Buf[1] := $00;
TarHex := HexToInt(IntToHex(IDTarget, 8));
copymemory(@lPacket.Buf[2], @TarHex, sizeOf(cardinal));
InjectFunc(wh, @SendCall, @lPacket, sizeOf(lPacket));
end;

Example:

 Spoiler

procedure TForm1.Button1Click(Sender: TObject);
begin
aHandle := FindWindow(nil, PWideChar(PW_TITLE));
if (aHandle <= 0) then
begin
MessageBox(Handle, 'PWWindow?', 'Error!',
MB_ICONERROR + MB_OK);
exit;
end;
TId := GetWindowThreadProcessId(aHandle, @PId);
wh := OpenProcess(PROCESS_ALL_ACCESS, False, PId);
Deselect;
end;

[penipu81]

in this function : Func pickUpItem($uniqueItemId, $itemTypeId, $pid)
how to find id $uniqueItemId ?

[SunB]

After using some action object, things work perfectly but after using about 4-5 times, the game client becomes not responding. Any recommendation for that?

[ericthow]

do you have perfect world - legend of mermaid bot? (my-en) please give me.. please~~

[maniack88]

hi interest07, how do i find packet for

• toggle fly
• fly until certain altitude
• go to location

all the packet i believe its available from your fly wq, but it quite different from this send packet.. appreciate if you could make a function for those action.. thx in advance

[Interest07]

Originally Posted by maniack88

hi interest07, how do i find packet for

• toggle fly
• fly until certain altitude
• go to location

all the packet i believe its available from your fly wq, but it quite different from this send packet.. appreciate if you could make a function for those action.. thx in advance

The source code for the Fly WQ bot is provided, so you should be able to reconstruct how to do those things. Toggling fly mode is a matter of using your flyGear, there's even an example of that somewhere in this thread.

Flying until a certain altitude is 'moving by packets', for which an explanation is linked to in the first post.

Go to location uses actionstructs, which is also linked to in the first post.

[natas420]

Thanks for sharing all the great information in this thread, it has helped me to learn a lot.

[alienpw]

wow, this thread is wonderful.
I tried to port the code to vb6, and got no luck.
VirtualAllocEx seems to work fine, but CreateRemoteThread function always return 0.

I'm wondering if I put the right realBaseAddress & SendPacketFunctionAddress.
Coz the realBaseAddress I got from WQBot is different from the BaseAddress I use to get Player HP info and such.

[Interest07]

when you get the base address for player HP, what offsets do you end up with?

its probably [[baseAddress + 0x20] + 0x4C0 (i think this one is it)]
with realBaseAddress it would be
[[[reaslBaseAddress + 0x1C] + 0x20] + 0x4C0]

that would explain why theyre different


Does perfect world crash when your createRemoteThread returns 0?