Sending Packets

[Interest07]

As per Smurfin's request:

reposting of what I posted in the Prophet's bot thread.

some example of functions you could use with sending packets (AutoIt code, see link below for C#):

 Spoiler

PHP Code:


;////Code for sending packets.

#include <GUIButton.au3>
#include <GUIToolbar.au3>
#include <GUIConstantsEx.au3>
#include <ProgressConstants.au3>
#include <StaticConstants.au3>
#include <WindowsConstants.au3>
#include <EditConstants.au3>
#include <NomadMemory.au3>
#include <Array.au3>

Global $kernel32 = DllOpen('kernel32.dll')
Global $pid = ProcessExists('elementclient.exe')
global $realBaseAddress = 0x0098657C
global $sendPacketFunction = 0x005BD7B0

;//Deselect target (example usage of sendPacket)
sendDeselectPacket($pid)

DllClose($kernel32)

Func logOut($toAccount, $pid)
    ;//Sends a packet to log the character from the server
    ;//If toAccount=1, it logs to character select 
    ;//If toAccount=0, it exits completely
    local $packet, $packetSize
    
    $packet = '0100'
    $packet &= _hex($toAccount)
    $packetSize = 6

    sendPacket($packet, $packetSize, $pid)
EndFunc    

Func selectTarget($targetId, $pid)
    ;//Select the NPC/Mob/Player denoted by targetId
    local $packet, $packetSize
    
    $packet = '0200'
    $packet &= _hex($targetId)
    $packetSize = 6
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func regularAttack($afterSkill, $pid)
    ;//Start with regular attacks. $afterskill is 1 if you
    ;//start attacking after using a skill.
    local $packet, $packetSize
    
    $packet = '0300'
    $packet &= _hex($afterSkill, 2)
    $packetSize = 3
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func rezToTown($pid)
    ;//Respawn in town after death
    local $packet, $packetSize
    
    $packet = '0400'
    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func rezWithScroll($pid)
    ;//Respawn in the place you died, costs a rez scroll
    local $packet, $packetSize
    
    $packet = '0500'
    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func pickUpItem($uniqueItemId, $itemTypeId, $pid)
    ;//Picks up an item. uniqueItemId is the unique id belonging
    ;//to the individual item on the ground. itemTypeId is the id for 
    ;//the type of item it is. This would be the same as the last
    ;//part in the url on pwdatabase. example:
    ;//http://www.pwdatabase.com/pwi/items/3044
    ;//the itemTypeId for gold is 3044.
    
    local $packet, $packetSize
    
    $packet = '0600'
    $packet &= _hex($uniqueItemId)
    $packet &= _hex($itemTypeId)
    $packetSize = 10
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func deselectTarget($pid)
    ;//Deselects the currently selected target
    local $packet, $packetSize
    
    $packet = '0800'
    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func updateInvPosition($invPosition, $pid)
    ;//This packet is sent whenever you pick up HH/TT items
    ;//Unsure as to why. Also happens when you find a 
    ;//quest item or equipment.
    local $packet, $packetSize
    
    $packet = '0900'
    $packet &= _hex($invPosition, 2)
    $packetSize = 3
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func swapItemInInv($invIndex1, $invIndex2, $pid)
    ;//Swaps the items in the two given inventory locations
    ;//The index for a standard unexpanded inventory runs from 
    ;//0, top left, to 31, bottom right
    local $packet, $packetSize
    
    $packet = '0C00'
    $packet &= _hex($invIndex1, 2)
    $packet &= _hex($invIndex2, 2)
    $packetSize = 4
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func splitStackItemInInv($invIndexSource, $invIndexDestination, $amount, $pid)
    ;//Splits a stack in your inventory located at invIndexSource
    ;//Take off $amouunt from the stack and place them at invIndexDestination
    ;//The index for a standard unexpanded inventory runs from 
    ;//0, top left, to 31, bottom right    
    local $packet, $packetSize
    
    $packet = '0D00'
    $packet &= _hex($invIndexSource, 2)
    $packet &= _hex($invIndexDestination, 2)
    $packet &= _hex($amount, 4)
    $packetSize = 6
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func dropItemOnFloor($invIndexSource, $amount, $pid)
    ;//Drops the stack located at invIndexSource in your inventory
    ;//onto the floor.
    ;//The index for a standard unexpanded inventory runs from 
    ;//0, top left, to 31, bottom right    
    local $packet, $packetSize
    
    $packet = '0E00'
    $packet &= _hex($invIndexSource, 2)
    $packet &= _hex($amount, 4)
    $packetSize = 5
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func swapEquip($equipIndex1, $equipIndex2, $pid)
    ;//Swaps the items in the two given equipment locations
    ;//The index for equipment runs from 
    ;//0, weapon, to 24, speaker?. This also includes fashion
    ;//Obviously there aren't a lot of equipment types you can swap
    ;//besides rings.
    local $packet, $packetSize
    
    $packet = '1000'
    $packet &= _hex($equipIndex1, 2)
    $packet &= _hex($equipIndex2, 2)
    $packetSize = 4
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func swapEquipWithInv($invIndex, $equipIndex, $pid)
    ;//Swaps the items in the invIndex location with the 
    ;//item in the equipment location
    ;//The index for equipment runs from 
    ;//0, weapon, to 24, speaker?. This also includes fashion
    ;//The index for a standard unexpanded inventory runs from 
    ;//0, top left, to 31, bottom right
    local $packet, $packetSize
    
    $packet = '1100'
    $packet &= _hex($invIndex, 2)
    $packet &= _hex($equipIndex, 2)
    $packetSize = 4
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func dropGold($amount, $pid)
    ;//Drops $amount of gold to floor
    local $packet, $packetSize
    
    $packet = '1400'
    $packet &= _hex($amount)
    $packetSize = 6
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func updateStats($pid)
    ;//Is sent whenever a new item is equipped or stat 
    ;//screen is opened or you level up.
    local $packet, $packetSize
    
    $packet = '1500'
    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func increaseStatsBy($con, $int, $str, $agi, $pid)
    ;//Use this after level up to increase your stats. 
    
    local $packet, $packetSize
    
    $packet = '1600'
    $packet &= _hex($con)
    $packet &= _hex($int)
    $packet &= _hex($str)
    $packet &= _hex($agi)    
    
    $packetSize = 18
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func inviteParty($playerId, $pid)
    ;//Invite playerId to your party.
    local $packet, $packetSize
    
    $packet = '1B00'
    $packet &= _hex($playerId)
    $packetSize = 6
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func acceptPartyInvite($playerId, $partyInviteCounter, $pid)
    ;//Accept an invite from playerId. partyInviteCounter is a counter that
    ;//is kept based on the amount of party invites you've had. See post
    ;//on how to find that value.
    local $packet, $packetSize
    
    $packet = '1C00'
    $packet &= _hex($playerId)
    $packet &= _hex($partyInviteCounter)

    $packetSize = 10
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func refusePartyInvite($playerId, $pid)
    ;//Refuses a party invite from playerId
    local $packet, $packetSize
    
    $packet = '1D00'
    $packet &= _hex($playerId)
    $packetSize = 6
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func leaveParty($pid)
    ;//Leave your current party
    local $packet, $packetSize
    
    $packet = '1E00'
    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func evictFromParty($playerId, $pid)
    ;//Evicts playerId from party
    local $packet, $packetSize
    
    $packet = '1F00'
    $packet &= _hex($playerId)
    $packetSize = 6
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func startNpcDialogue($npcId, $pid)
    ;//Opens up an NPC's main menu. Is necessary before
    ;//accepting/handing in quests, buy/sell/repair
    local $packet, $packetSize
    
    $packet = '2300'
    $packet &= _hex($npcId)
    $packetSize = 6
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func useItem($index, $itemTypeId, $pid, $equip=0)
    ;//uses the item located at index. By default inventory index
    ;//is used. If equip=1, then equipment index is used. This
    ;//is necessary when toggling fly mode, as your fly gear
    ;//is then used. 
    ;//itemTypeId is the id for 
    ;//the type of item it is. This would be the same as the last
    ;//part in the url on pwdatabase. example:
    ;//http://www.pwdatabase.com/pwi/items/3044
    ;//the itemTypeId for gold is 3044.
    local $packet, $packetSize

    $packet = '2800'
    $packet &= _hex($equip, 2)
    $packet &= '01'
    $packet &= _hex($index, 2)
    $packet &= '00'
    $packet &= _hex($itemTypeId)
    
    $packetSize = 10
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func useSkill($skillId, $targetId, $pid)
    ;//uses the specified skill on the target. Pass your own
    ;//Id if you wish to use buffs. When teleporting targetId
    ;//is the targeted city.
    local $packet, $packetSize

    $packet = '2900'
    $packet &= _hex($skillId)
    $packet &= '0001'
    $packet &= _hex($targetId)
    
    $packetSize = 12
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func cancelAction($pid)
    ;//Cancels for example your current skillCast
    local $packet, $packetSize

    $packet = '2A00'
    
    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func startMeditating($pid)
    ;//Starts meditating for faster HP/MP regen
    local $packet, $packetSize

    $packet = '2E00'
    
    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func stopMeditating($pid)
    ;//Stop meditating for faster HP/MP regen
    local $packet, $packetSize

    $packet = '2F00'
    
    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func useEmotion($emoteIndex, $pid)
    ;//uses the emotion located at index emoteIndex 0 to 26
    local $packet, $packetSize

    $packet = '3000'
    $packet &= _hex($emoteIndex, 4)
    
    $packetSize = 4
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func beIntimate($pid)
    ;//Uses the kissing / intimate emote when cuddling.
    local $packet, $packetSize

    $packet = '3000'
    $packet &= '1D00'
    
    $packetSize = 4
    
    sendPacket($packet, $packetSize, $pid)
EndFunc



Func swapItemInBank($bankIndex1, $bankIndex2, $pid)
    ;//swaps the location of two stacks in bank. bankIndex runs
    ;//from 0, topleft,  to 15, bottomright, in a standard non 
    ;//upgraded bank.
    local $packet, $packetSize

    $packet = '3800'
    $packet &= '03'
    $packet &= _hex($bankIndex1, 2)
    $packet &= _hex($bankIndex2, 2)
    
    $packetSize = 5
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func splitStackItemInBank($bankIndexSource, $bankIndexDestination, $amount, $pid)
    ;//Splits a stack in your bank located at bankIndexSource
    ;//Take off $amouunt from the stack and place them at bankIndexDestination
    ;//The index for a standard unexpanded bank runs from 
    ;//0, top left, to 15, bottom right    
    local $packet, $packetSize
    
    $packet = '3900'
    $packet &= '03'
    $packet &= _hex($bankIndexSource, 2)
    $packet &= _hex($bankIndexDestination, 2)
    $packet &= _hex($amount, 4)
    
    $packetSize = 7
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func swapItemBankAndInv($bankIndex, $invIndex, $pid)
    ;//Swaps a stack in your bank located at bankIndex 
    ;//with one in your inventory located at invIndex
    local $packet, $packetSize
    
    $packet = '3A00'
    $packet &= '03'
    $packet &= _hex($bankIndex, 2)
    $packet &= _hex($invIndex, 2)
    
    $packetSize = 5
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func splitStackItemInBankToInv($bankIndexSource, $invIndexDestination, $amount, $pid)
    ;//Splits a stack in your bank located at bankIndexSource
    ;//Take off $amouunt from the stack and place them at invIndexDestination
    local $packet, $packetSize
    
    $packet = '3B00'
    $packet &= '03'
    $packet &= _hex($bankIndexSource, 2)
    $packet &= _hex($invIndexDestination, 2)
    $packet &= _hex($amount, 4)
    
    $packetSize = 7
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func splitStackItemInInvToBank($invIndexSource, $bankIndexDestination, $amount, $pid)
    ;//Splits a stack in your inventory located at invIndexSource
    ;//Take off $amouunt from the stack and place them at bankIndexDestination
    local $packet, $packetSize
    
    $packet = '3C00'
    $packet &= '03'
    $packet &= _hex($invIndexSource, 2)
    $packet &= _hex($bankIndexDestination, 2)
    $packet &= _hex($amount, 4)
    
    $packetSize = 7
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func setPartySearchSettings($recruit, $jobId, $lvl, $slogan, $pid)
    ;//Changes party searching settings. 
    ;//recruit=1 means recruiting party
    ;//recruit=0 means searching for party
    ;//jobId=0 & lvl=0 & no slogan -> slogan=0x0
    ;//jobId<>0 & lvl<>0 & no slogan -> slogan=0x40
    ;//jobId=0 & lvl=0 & slogan -> slogan=0x80
    ;//jobId<>0 & lvl<> 0 & slogan -> slogan=0xC0
    local $packet, $packetSize
    
    $packet = '3F00'
    $packet &= _hex($jobId, 2)
    $packet &= _hex($lvl, 2)
    $packet &= _hex($recruit, 2)
    $packet &= _hex($slogan, 2)
    $packet &= '00000000'
    
    $packetSize = 10
    
    sendPacket($packet, $packetSize, $pid)
EndFunc


Func shiftPartyCaptain($playerId, $pid)
    ;//Shifts party captain position to playerId
    local $packet, $packetSize
    
    $packet = '4800'
    $packet &= _hex($playerId)
    $packetSize = 6
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func useSkillWithoutCastTime($skillId, $targetId, $pid)
    ;//uses the specified skill on the target. This function is used
    ;// instead of the regular skill use one for skills such as 
    ;// change to fox/tiger form or the speed buff skills. Pass your own
    ;//Id if you wish to use buffs. 
    local $packet, $packetSize

    $packet = '5000'
    $packet &= _hex($skillId)
    $packet &= '0001'
    $packet &= _hex($targetId)
    
    $packetSize = 12
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func initiateSettingUpCatShop($pid)
    ;//Starts setting up cat shop. This function is needed
    ;//before setting up the catshop.
    local $packet, $packetSize

    $packet = '5400'
    
    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func toggleFashionDisplay($pid)
    ;//Switches between fashion and regular appearance.
    local $packet, $packetSize

    $packet = '5500'
    
    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func acceptRez($pid)
    ;//Accept rez by a priest.
    local $packet, $packetSize

    $packet = '5700'
    
    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func increaseFlySpeed($start, $pid)
    ;//If start=1, start faster flying. 
    ;//If start=0, stop faster flying
    local $packet, $packetSize

    $packet = '5A00'
    $packet &= _hex($start)
    
    $packetSize = 6
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func askMaleToCarry($playerId, $pid)
    ;//WHen female use this to ask a male playerId to carry you
    local $packet, $packetSize

    $packet = '5E00'
    $packet &= _hex($playerId)
    
    $packetSize = 6
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func askFemaleToBeCarried($playerId, $pid)
    ;//WHen female use this to ask a female playerId to be carried
    local $packet, $packetSize

    $packet = '5F00'
    $packet &= _hex($playerId)
    
    $packetSize = 6
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func acceptRequestByFemaleToBeCarried($playerId, $pid)
    ;//When female asks you to carry her use this to accept
    local $packet, $packetSize

    $packet = '6000'
    $packet &= _hex($playerId)
    $packet &= '00000000'

    $packetSize = 10
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func acceptRequestByMaleToCarryYou($playerId, $pid)
    ;//When male asks you if you want to be carried, use this to accept.
    local $packet, $packetSize

    $packet = '6100'
    $packet &= _hex($playerId)
    $packet &= '00000000'

    $packetSize = 10
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func releaseCarryMode($pid)
    ;//Stop carrying / being carried
    local $packet, $packetSize

    $packet = '6200'

    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc



Func summonPet($petIndex, $pid)
    ;//summons pet at index petIndex. petIndex runs from 
    ;//0 to 9, depending on how many slots you have unlocked
    local $packet, $packetSize

    $packet = '6400'
    $packet &= _hex($petIndex)
    
    $packetSize = 6
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func recallPet($pid)
    ;//recalls your currently summoned pet
    local $packet, $packetSize

    $packet = '6500'
    
    $packetSize = 2
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func setPetMode($petMode, $pid)
    ;//Sets the pet to the specified mode:
    ;//petMode=0 -> defensive
    ;//petMode=1 -> attack
    ;//petMode=2 -> manual
    local $packet, $packetSize

    $packet = '6700'
    $packet &= '00000000'
    $packet &= '03000000'
    $packet &= _hex($petMode)
    
    $packetSize = 14
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func setPetFollow($pid)
    ;//Pet follows the owner
    local $packet, $packetSize

    $packet = '6700'
    $packet &= '00000000'
    $packet &= '02000000'
    $packet &= '00000000'

    $packetSize = 14
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func setPetStop($pid)
    ;//Pet stops doing whatever it was doing
    local $packet, $packetSize

    $packet = '6700'
    $packet &= '00000000'
    $packet &= '02000000'
    $packet &= '01000000'

    $packetSize = 14
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func setPetAttack($targetId, $pid)
    ;//Sets pet to do standard attacks on the target.
    local $packet, $packetSize

    $packet = '6700'
    $packet &= _hex($targetId)
    $packet &= '01'
    $packet &= '00000000'

    $packetSize = 11
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func setPetUseSkill($targetId, $skillId, $pid)
    ;//Uses skillId on the targetId. Walks up to target if out of range.
    local $packet, $packetSize

    $packet = '6700'
    $packet &= _hex($targetId)
    $packet &= '04000000'
    $packet &= _hex($skillId)
    $packet &= '00'

    $packetSize = 15
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func setPetStandardSkill($skillId, $pid)
    ;//Sets skillId to be the skill the pet uses whenever
    ;//it is cooled down
    local $packet, $packetSize

    $packet = '6700'
    $packet &= '00000000'
    $packet &= '05000000'
    $packet &= _hex($skillId)

    $packetSize = 14
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func useGenieSkill($skillId,$targetId, $pid)
    ;//Uses skillId on the target
    local $packet, $packetSize

    $packet = '7400'
    $packet &= _hex($skillId, 4)
    $packet &= '0001'
    $packet &= _hex($targetId)

    $packetSize = 10
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func feedEquippedGenie($invIndex, $amount, $pid)
    ;//Feeds the equipped genie the amount indicated from
    ;//inv index 
    local $packet, $packetSize

    $packet = '7500'
    $packet &= _hex($invIndex, 2)
    $packet &= _hex($amount)

    $packetSize = 7
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func acceptQuest($questId, $pid)
    ;//Accept a new quest
    local $packet, $packetSize

    $packet = '2500'
    $packet &= '07000000'
    $packet &= '04000000'
    $packet &= _hex($questId)

    $packetSize = 14
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func handInQuest($questId,$optionIndex, $pid)
    ;//Hand in quest, select reward optionIndex, 
    ;//which runs from 0 for first option, to more.
    local $packet, $packetSize

    $packet = '2500'
    $packet &= '06000000'
    $packet &= '08000000'
    $packet &= _hex($questId)
    $packet &= _hex($optionIndex)

    $packetSize = 18
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func sellItem($itemTypeId,$invIndex,$amount, $pid)
    ;//Sell $amount of items of type itemTypeId, located at invIndex
    ;//This function could be expanded to include selling multiple items
    ;//simultaneously. This would require setting nBytes equal to 
    ;//4 + 12 * nDifferent items. Add the extra items on the same way
    ;//as the first item.
    local $packet, $packetSize

    $packet = '2500'
    $packet &= '02000000'
    $packet &= '10000000' ;//nBytes following
    $packet &= '01000000' ;//nDifferent items being sold
    $packet &= _hex($itemTypeId)
    $packet &= _hex($invIndex)
    $packet &= _hex($amount)

    $packetSize = 26
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func buyItem($itemTypeId,$shopIndex,$amount, $pid)
    ;//Buy $amount of items of type itemTypeId, located at shopIndex
    ;//shopIndex is calculated as follows:
    ;//Each tab in the shop has 32 available spaces, index of each space 
    ;//starts at 0, index of each tab starts at 0. $shopIndex would then be 
    ;//shopIndex = tabIndex * 32 + spaceIndex
    ;//This function could be expanded to include buying multiple items
    ;//simultaneously. This would require setting nBytes equal to 
    ;//8 + 12 * nDifferent items. Add the extra items on the same way
    ;//as the first item.
    local $packet, $packetSize

    $packet = '2500'
    $packet &= '01000000'
    $packet &= '14000000' ;//nBytes following
    $packet &= '00000000'
    $packet &= '01000000' ;//nDifferent items being bought
    $packet &= _hex($itemTypeId)
    $packet &= _hex($shopIndex)
    $packet &= _hex($amount)

    $packetSize = 30
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func repairAll($pid)
    ;//Repair all items
    local $packet, $packetSize

    $packet = '2500'
    $packet &= '03000000'
    $packet &= '06000000' 
    $packet &= 'FFFFFFFF'
    $packet &= '0000' 

    $packetSize = 16
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func repairItem($itemTypeId, $isEquipped, $locationIndex, $pid)
    ;//repairs the item of type itemTypeId at locationIndex, if 
    ;//isEquipped=1, location refers to equipment. If isEquipped=0,
    ;//location refers to inventory.
    local $packet, $packetSize

    $packet = '2500'
    $packet &= '03000000'
    $packet &= '06000000' 
    $packet &= _hex($itemTypeId)
    $packet &= _hex($isEquipped, 2)
    $packet &= _hex($locationIndex, 2)

    $packetSize = 16
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func upgradeSkill($skillId, $pid)
    ;//Upgrades the requested skill by one level
    local $packet, $packetSize

    $packet = '2500'
    $packet &= '09000000'
    $packet &= '04000000' 
    $packet &= _hex($skillId)

    $packetSize = 14
    
    sendPacket($packet, $packetSize, $pid)
EndFunc

Func sendPacket($packet, $packetSize, $pid)
    ;//Declare local variables
    Local $pRemoteThread, $vBuffer, $loop, $result, $OPcode, $processHandle, $packetAddress
    
    ;//Open process for given processId
    $processHandle = memopen($pid)
    
    ;//Allocate memory for the OpCode and retrieve address for this
    $functionAddress = DllCall($kernel32, 'int', 'VirtualAllocEx', 'int', $processHandle, 'ptr', 0, 'int', 0x46, 'int', 0x1000, 'int', 0x40)
    
    ;//Allocate memory for the packet to be sent and retrieve the address for this
    $packetAddress = DllCall($kernel32, 'int', 'VirtualAllocEx', 'int', $processHandle, 'ptr', 0, 'int', $packetSize, 'int', 0x1000, 'int', 0x40)
    
    ;//Construct the OpCode for calling the 'SendPacket' function
    $OPcode &= '60'                                ;//PUSHAD
    $OPcode &= 'B8'&_hex($sendPacketFunction)    ;//MOV     EAX, sendPacketAddress
    $OPcode &= '8B0D'&_hex($realBaseAddress)    ;//MOV     ECX, DWORD PTR [revBaseAddress]
    $OPcode &= '8B4920'                            ;//MOV     ECX, DWORD PTR [ECX+20]
    $OPcode &= 'BF'&_hex($packetAddress[0])        ;//MOV     EDI, packetAddress    //src pointer
    $OPcode &= '6A'&_hex($packetSize,2)            ;//PUSH    packetSize        //size
    $OPcode &= '57'                                ;//PUSH    EDI
    $OPcode &= 'FFD0'                            ;//CALL    EAX
    $OPcode &= '61'                                ;//POPAD
    $OPcode &= 'C3'                                ;//RET        
    
    ;//Put the OpCode into a struct for later memory writing
    $vBuffer = DllStructCreate('byte[' & StringLen($OPcode) / 2 & ']')
    For $loop = 1 To DllStructGetSize($vBuffer)
        DllStructSetData($vBuffer, 1, Dec(StringMid($OPcode, ($loop - 1) * 2 + 1, 2)), $loop)
    Next
    
    ;//Write the OpCode to previously allocated memory
    DllCall($kernel32, 'int', 'WriteProcessMemory', 'int', $processHandle, 'int', $functionAddress[0], 'int', DllStructGetPtr($vBuffer), 'int', DllStructGetSize($vBuffer), 'int', 0)
        
    ;//Put the packet into a struct for later memory writing
    $vBuffer = DllStructCreate('byte[' & StringLen($packet) / 2 & ']')
    For $loop = 1 To DllStructGetSize($vBuffer)
        DllStructSetData($vBuffer, 1, Dec(StringMid($packet, ($loop - 1) * 2 + 1, 2)), $loop)
    Next
    
    ;//Write the packet to previously allocated memory
    DllCall($kernel32, 'int', 'WriteProcessMemory', 'int', $processHandle, 'int', $packetAddress[0], 'int', DllStructGetPtr($vBuffer), 'int', DllStructGetSize($vBuffer), 'int', 0)
        
    ;//Create a remote thread in order to run the OpCode
    $hRemoteThread = DllCall($kernel32, 'int', 'CreateRemoteThread', 'int', $processHandle, 'int', 0, 'int', 0, 'int', $functionAddress[0], 'ptr', 0, 'int', 0, 'int', 0)
    
    ;//Wait for the remote thread to finish
    Do
        $result = DllCall('kernel32.dll', 'int', 'WaitForSingleObject', 'int', $hRemoteThread[0], 'int', 50)
    Until $result[0] <> 258
    
    ;//Close the handle to the previously created remote thread
    DllCall($kernel32, 'int', 'CloseHandle', 'int', $hRemoteThread[0])
    
    ;//Free the previously allocated memory
    DllCall($kernel32, 'ptr', 'VirtualFreeEx', 'hwnd', $processHandle, 'int', $functionAddress[0], 'int', 0, 'int', 0x8000)
    DllCall($kernel32, 'ptr', 'VirtualFreeEx', 'hwnd', $processHandle, 'int', $packetAddress[0], 'int', 0, 'int', 0x8000)
    
    ;//Close the Process
    memclose($processHandle)
    
    Return True
EndFunc

Func memopen($pid)
    Local $mid = DllCall($kernel32, 'int', 'OpenProcess', 'int', 0x1F0FFF, 'int', 1, 'int', $pid)
    Return $mid[0]
EndFunc

Func memclose($mid)
    DllCall($kernel32, 'int', 'CloseHandle', 'int', $mid)
EndFunc

Func _hex($Value, $size=8)
    Local $tmp1, $tmp2, $i 
    $tmp1 = StringRight("000000000" & Hex($Value),$size) 
    For $i = 0 To StringLen($tmp1) / 2 - 1 
        $tmp2 = $tmp2 & StringMid($tmp1, StringLen($tmp1) - 1 - 2 * $i, 2)
    Next
    Return $tmp2
EndFunc 


The following regular expression should get you the base address for the partyInvCounter

 Spoiler

PHP Code:

$search = StringRegExp($data, 
'8B87(.{8})' & _                              ;//mov     eax, dword_A62C28[edi]
'8B.{6}' & _                                  ;//mov     ecx, [esp+60h+var_40]
'03C6' & _                                      ;//add     eax, esi
'8B50.{2}' & _                                    ;//mov     edx, [eax+0Ch]
'2BCA' & _                                      ;//sub     ecx, edx
'8B50.{2}' & _                                    ;//mov     edx, [eax+8]
'3BCA',2)                                     ;//call    dword ptr [edx+1Ch]
ConsoleWrite('invCounterBase=0x'&hex(dec(rev($search[1]))+0x20)&@CRLF) 


The value you are looking for in the accept party invite is then:

PHP Code:

$partyInviteCounter = readMemory(invCounterBase+0x14) 


Find skillIds here:


If you need to find the address for the sendPacket function you can use the offset retriever included in this

some stuff on sending movement packets

For an example of code in C# look

In some cases it might be preferable to use actionStructs instead of packets, 's the example code in C# you could use.

[Smurfin]

just got IDA Pro installed, I'm totally blind with it lol, could you pls explain the first steps before searching this (void *Src, size_t Size)
cmiiw :
1. run IDA Pro
2. drag elementclient.exe
3. choose portable executable for 80386 [PE] , then click ok without messing other things.
4. fill (void *Src, size_t Size) in text search

but the result is far too different compared to your screenshot, dunno what I did wrong, please advise.


Here is how mine looks like :

 Spoiler

should I go to sub_5D9C80 before searching ? but couldn't find the same hex, closest I can find is sub_5D9CB0 , it's a B not eight.

[lolkop]

finding the function isn't realy hard, since it gets called when ever you move.
here's how it looks like in pwi:

 Spoiler

0062F320   53               PUSH EBX
0062F321   56               PUSH ESI
0062F322   8B7424 10        MOV ESI,DWORD PTR SS:[ESP+10]
0062F326   57               PUSH EDI
0062F327   8D1CB5 02000000  LEA EBX,DWORD PTR DS:[ESI*4+2]
0062F32E   53               PUSH EBX
0062F32F   E8 BC9D1B00      CALL elementc.007E90F0
0062F334   8BF8             MOV EDI,EAX
0062F336   83C4 04          ADD ESP,4
0062F339   85FF             TEST EDI,EDI
0062F33B   74 3B            JE SHORT elementc.0062F378
0062F33D   66:8B4424 10     MOV AX,WORD PTR SS:[ESP+10]
0062F342   85F6             TEST ESI,ESI
0062F344   66:8907          MOV WORD PTR DS:[EDI],AX
0062F347   74 17            JE SHORT elementc.0062F360
0062F349   8D4F 02          LEA ECX,DWORD PTR DS:[EDI+2]
0062F34C   7E 12            JLE SHORT elementc.0062F360
0062F34E   8D4424 14        LEA EAX,DWORD PTR SS:[ESP+14]
0062F352   8B50 04          /MOV EDX,DWORD PTR DS:[EAX+4]
0062F355   83C0 04          |ADD EAX,4
0062F358   8911             |MOV DWORD PTR DS:[ECX],EDX
0062F35A   83C1 04          |ADD ECX,4
0062F35D   4E               |DEC ESI
0062F35E  ^75 F2            \JNZ SHORT elementc.0062F352
0062F360   A1 0CB9A500      MOV EAX,DWORD PTR DS:[A5B90C]  <--- base adress
0062F365   53               PUSH EBX                       <--- code length
0062F366   57               PUSH EDI                       <--- code position in client
0062F367   8B48 20          MOV ECX,DWORD PTR DS:[EAX+20]  <--- ecx = [base + 0x20] (char struct)
0062F36A   E8 A1EFFDFF      CALL elementc.0060E310         <--- used call
0062F36F   57               PUSH EDI
0062F370   E8 8B9D1B00      CALL elementc.007E9100
0062F375   83C4 04          ADD ESP,4
0062F378   5F               POP EDI
0062F379   5E               POP ESI
0062F37A   5B               POP EBX
0062F37B   C3               RETN

so letz build a script in autoit to make our script get the adress for us...
all we have to do is replace the variable call and jump adresses by placeholders and run regexp funcs to get the adresses.

when we're done our script looks like this:

 Spoiler

$path = "elementclient.exe"
$file = FileOpen($path, 16)
$data = FileRead($file, FileGetSize($path))
FileClose($file)
$search = StringRegExp($data, '53'& _ ;             PUSH EBX
                              '56'& _ ;             PUSH ESI
                              '8B742410'& _ ;       MOV ESI,DWORD PTR SS:[ESP+10]
                              '57'& _ ;             PUSH EDI
                              '8D1CB502000000'& _ ; LEA EBX,DWORD PTR DS:[ESI*4+2]
                              '53'& _ ;             PUSH EBX
                              'E8.{8}'& _ ;         CALL elementc.007E90F0
                              '8BF8'& _ ;           MOV EDI,EAX
                              '83C404'& _ ;         ADD ESP,4
                              '85FF'& _ ;           TEST EDI,EDI
                              '74.{2}'& _ ;         JE SHORT elementc.0062F378
                              '668B442410'& _ ;     MOV AX,WORD PTR SS:[ESP+10]
                              '85F6'& _ ;           TEST ESI,ESI
                              '668907'& _ ;         MOV WORD PTR DS:[EDI],AX
                              '74.{2}'& _ ;         JE SHORT elementc.0062F360
                              '8D4F02'& _ ;         LEA ECX,DWORD PTR DS:[EDI+2]
                              '7E.{2}'& _ ;         JLE SHORT elementc.0062F360
                              '8D442414'& _ ;       LEA EAX,DWORD PTR SS:[ESP+14]
                              '8B5004'& _ ;         /MOV EDX,DWORD PTR DS:[EAX+4]
                              '83C004'& _ ;         |ADD EAX,4
                              '8911'& _ ;           |MOV DWORD PTR DS:[ECX],EDX
                              '83C104'& _ ;         |ADD ECX,4
                              '4E'& _ ;             |DEC ESI
                              '75.{2}'& _ ;         \JNZ SHORT elementc.0062F352
                              'A1(.{8})'& _ ;       MOV EAX,DWORD PTR DS:[A5B90C]  <--- base adress
                              '53'& _ ;             PUSH EBX                       <--- code length
                              '57'& _ ;             PUSH EDI                       <--- code position in client
                              '8B4820'& _ ;         MOV ECX,DWORD PTR DS:[EAX+20]  <--- ecx = [base + 0x20] (char struct)
                              'E8(.{8})'& _ ;       CALL elementc.0060E310         <--- used call
                              '57'& _ ;             PUSH EDI
                              'E8.{8}'& _ ;         CALL elementc.007E9100
                              '83C404'& _ ;         ADD ESP,4
                              '5F'& _ ;             POP EDI
                              '5E'& _ ;             POP ESI
                              '5B'& _ ;             POP EBX
                              'C3', 2) ;            RETN
$call_pos = StringInStr($data, $search[0])/2 + 0x400049
ConsoleWrite('$base = 0x'&rev($search[1])&@CRLF)
ConsoleWrite('$call = 0x'&Hex(Dec(rev($search[2])) + $call_pos + 5)&@CRLF)

Func rev($string)
	Local $all
	For $i = StringLen($string) + 1 To 1 Step -2
		$all = $all & StringMid($string, $i, 2)
	Next
	While StringLeft($all, 1) = '0'
		$all = StringTrimLeft($all, 1)
	WEnd
	Return $all
EndFunc

Edit:
btw Interest07 you should make autoit caluculate the packet size.
and beside that static stuff should allways stay written in the client. if you keep on redoing the same stuff over and over again, you're just wasting cpu and memory.

[Smurfin]

woot! it works, thanks a lot lolkop, saves me the trouble doing something hard and spare Interest07 from explaining the how

the sendpacket works great, tried some of the packet collection there and each one is done exactly like what the function said.

the dropgold doesn't work for me though, or maybe I used it wrong, I put it like this :
dropgold(1,$pid)

but it gives me this error :

>"C:\Program Files\AutoIt3\SciTE\..\autoit3.exe" /ErrorStdOut "G:\AutoIT\Smurfit 1.7 PJ\sendpacket.au3"    
G:\AutoIT\Smurfit 1.7 PJ\sendpacket.au3 (183) : ==> Variable used without being declared.:
$packet &= _hex($invIndex)
$packet &= _hex(^ ERROR
>Exit code: 1    Time: 0.309

not that I'll be using dropGold much lol, I prefer picking it , just curious

[Interest07]

oops, little error in that function Smurfin, it should say $amount, not $invIndex.

I edited it in the first post now

@lolkop, i know I can just calculate the size of the packet, but I like it better this way (not sure why, just gives me a more complete view of the different packets to me I guess). What static stuff are you referring to?

[Smurfin]

tks, done changing and now it works, tried using it to drop 1 gold per x millisecond and it leaves gold trails when walk

is SkillId the same for every server ? do you have the list for cleric ?

[Interest07]

lol funny gold thing

and for PW MS the skill Ids are as follows:

11  "Metal Element Mastery"

15  "Chromatic Healing Beam"

16  "Extremity Recovery Array"
 
17  "Five Element Hierogram"
 
18  "Resurrection"

19  "Plume Barrier"

113  "Pure Heart Spell"

114  "Whisht Heart Spell"

115  "Sapience Pour"

116  "River of Rejuvenation"

117  "Five Corporeity Hierogram"

118  "Five Tone Hierogram"

119  "Five Hue Hierogram"

120  "Solid Shell Hierogram"

121  "Aegis’s Spirit"

122  "Rimption Soul Exaltation"

123  "Heaven’s Array"

124  "Divine Weapons"

125  "Plume Quill"

126  "Feather Razors"

127  "Great Cyclone"

128  "Thunder Sphere"

129  "Hurricane Blast"

130  "Galactic Storm"

163  "Thunder Wield"

189  "Purify Spell"

190  "Flying Mastery"

191  "Spirit Gather Hierogram"

192  "Celestial Guard Hierogram"

193  "Nimbus-Aid Hierogram" 

194  "Grand Protector"

232  "Fury Burst"

233  "Advanced Fury Burst"

372  "Ether Fury Burst"

373  "Dark Fury Burst"

542  "Holy-Pure Heart Spell"

543  "Dark-Pure Heart Spell"

544  "Holy-Whisht Heart Spell"

545  "Dark-Whisht Heart Spell"

546  "Holy-Sapience Pour"

547  "Dark-Sapience Pour"

548  "Holy-Resurrection"

549  "Dark-Resurrection"

550  "Holy-Purify Spell"

551  "Dark-Purify Spell"

552  "Holy-Chromatic Healing Beam"

553  "Dark-Chromatic Healing Beam"

554  "Holy-River of Rejuvenation"

555  "Dark-River of Rejuvenation"

556  "Holy-Five Element Hierogram"

557  "Dark-Five Element Hierogram"

558  "Holy-Five Corporeity Hierogram"

559  "Dark-Five Corporeity Hierogram"

560  "Holy-Five Tone Hierogram"

561  "Dark-Five Tone Hierogram"

562  "Holy-Five Hue Hierogram"

563  "Dark-Five Hue Hierogram"

564  "Holy-Solid Shell Hierogram"

565  "Dark-Solid Shell Hierogram"

566  "Holy-Spirit Gather Hierogram"

567  "Dark-Spirit Gather Hierogram"

568  "Holy-Celestial Guard Hierogram"

569  "Dark-Celestial Guard Hierogram"

570  "Holy-Nimbus-Aid Hierogram"

571  "Dark-Nimbus-Aid Hierogram"

572  "Holy-Plume Quill"

573  "Dark-Plume Quill"

574  "Holy-Plume Barrier"

575  "Dark-Plume Barrier"

576  "Holy-Feather Razors"

577  "Dark-Feather Razors"

578  "Holy-Great Cyclone"

579  "Dark-Great Cyclone"

580  "Holy-Thunder Sphere"

581  "Dark-Thunder Sphere"

582  "Holy-Hurricane Blast"

583  "Dark-Hurricane Blast"

584  "Holy-Thunder Wield"

585  "Holy-Galactic Storm"

586  "Dark-Thunder Wield"

587  "Dark-Galactic Storm"

588  "Holy-Metal Element Mastery"

919  "Protective Divinity Light"

920  "Wings of Protection"

921  "Wind Elf"

922  "God's Seal"

933  "Wind Elf"

934  "God's Seal"

[lolkop]

Originally Posted by Interest07

@lolkop, i know I can just calculate the size of the packet, but I like it better this way (not sure why, just gives me a more complete view of the different packets to me I guess). What static stuff are you referring to?

everything thats not needing any parameters is static.

simply store the code to push in the memory. there's no need to delete it right after using it and rewrite it some secs later...

[Smurfin]

what tools do you use to get packets ? is it wpepro ?
can we intercept packets and tamper with it before send it back to the game ?

I remember ever done it using wpe pro on other game, putting 1million gold to storage/inventory bank then withdraw 100k, the server will send packet contain a value of 100.000 [in hex i think] , then wpepro will search that value in the packet and alter it then send it back to the game, but I was disconnected. Tried it on PW long time ago when I play on pw my en, but I forgot the result, it just didn't work.

I wonder if we can use it like that, record a succesful refine equipment packet, then replace whatever incoming packet with the recorded succesful refine packet for the next refines, is it doable ?

[Interest07]

The packets are encrypted before sent to the server as far as I know, so WPE pro won't help. I view the packets by settings a breakpoint at the sendPacket function (so before encryption) using MHS and displaying whats in the stack. YOu can automatically edit the packets here if you wish, but the above methods shouldn't be possible though, as you send a packet to the server saying "Please refine this n that item" instead of "I refined this item, update it please"

[vuduy]

Good to see someone finally gets it right. Although you need to steer away from AutoIt; that is just a CPU killer.

[Smurfin]

@Interest07 :
ohh I see , thought it was that simple.
btw have you ever found anything related to refining equips, like the formula of how the game decide the success rate, do they put like a 100% fail rate randomly too ?



hi vuduy, what other language do you suggest ? the easiest one for beginner.

[vuduy]

C# is the easiest/quickest to use and program anything.

Like you, I started with AutoIt 5-6 years ago, then I switched to coding in C++/.NET which is alright, then on to C# which I find so easy and fast to make a program.

Of course, everything is self-learn. If you can learn AutoIt on your own then you will be able to learn C# easily, and you will find that whatever things you do in AutoIt, you can do it in C# with fewer lines and a lot faster.

Did I mention that you will cut CPU usage down by at least 50%?

[Smurfin]

thanks for the info, I'll look into it later.

I agree autoit seems like using too much resources, the tool I made uses like from 0 to 24% CPU usage randomly at times on a quadcore x3350, could be because of my noobness in making it though , but still kinda surprising coz when I look in task manager sometimes it's just on top and even beat elementclient.exe itself lol

[lolkop]

Originally Posted by vuduy

Did I mention that you will cut CPU usage down by at least 50%?

Epic Fail!
code efficience is not language related!

Originally Posted by vuduy

If you can learn AutoIt on your own then you will be able to learn C# easily, and you will find that whatever things you do in AutoIt, you can do it in C# with fewer lines and a lot faster.

you won't be able to do anything in less lines than it could be done in autoit.