Map Restrictions [Group Effort]

Truth1010 · 09/24/2014, 20:38

Hey guys & girls.

So lately things have slowed down around here on the 'development' side of things, it's like people have gotten bored with trying to figure out new things and would rather just wait for full answers from the "elite devs" instead. I was hoping, and wondering if anyone out there was still trying to learn things for themselves, no matter what it may be.

I myself have been slowly working through CheatEngine / Assembly with the goal of figuring out those elusive map restrictions (15/30 PvP zones)
Has anyone else been working on these and hit a wall with lack of knowledge like i have? If so, it would be nice if we could combine any info we have and work together to figure out the things that the elite devs have already figured out and proven possible.

All the information i have found so far is
Map ID address locations
Movement (map leave/map enter) address locations
Tele rune x/y/z co-ordinate address locations (float)

And a few other smaller parts that don't equal up to much. With that data i seem to have found where the map movement / summon data is held, but i see no restrictions, anyone else have any input to add?

Truth1010 · 09/24/2014, 21:41

The 'never ending' one is a bit of a problem though. It works for every usable item as far as i could find out. Rec runes/link hammers, but also other items like potions, with no 'visible' limits on certain item ID's to make only rec runes "unlimited"

I did find where the offset for setting the number of items you can buy/sell to max when you open and NPC (it's usually 10) So you can sell/ drop entire sets of 255, instead of needing to type in 255.

Also currently have free repairs (for single items, or 'all' items)
and making your GM char logged in as visible (to stop the annoying walk after teleport while invisible)
And also means no need for /char off if you are just testing stuff and usually do that.

sominus · 09/25/2014, 04:07

Problem with map summon restriction is that (according to an old post), is client sided. So, if a player manages to enter the game with a different/patched game.exe, he will bypass the restriction. Unless the server-side has a restriction also I guess. I supose is the holy grail.

Anyway, you could check with a sql script if a player has been on a forbidden (lower level) map, using the ActionLog table and ban him. But that's a dirty solution, since it involves banning.

Have you tested about 'free for all' map condition? (a map where everyone is an enemy). My interes is in: does kills count as Battle kills? Or PvP kills?

Truth1010 · 09/25/2014, 08:19

Yea, LilPro made a post a few years back stating that it is indeed client sided.. I just can't see how, as to my knowledge, game.exe is "fully" visual" and contains no real "end" data that bypasses the server side data's limits.
I would assume it to be like 99% of everything else i have found, and be in the PS_Game.exe otherwise wouldn't you just be able to steal a servers game.exe with the "map restrictions" built in and just use whatever restrictions they have (Exile's 55 map for example)

I remember seeing the SQL script too, but the problem with that is.. i don't think it's a "live" update, it requires a certain action (char screen/log out) to actually "force" the character out of the restricted map. But then again, i am probably better with assembly than SQL, it really is my weak point that i need to learn more on. And also, this wouldn't stop usage of movement/summon/tele saves, as far as i could see anyway.

And finally, i've never actually looked into the FFA map, but yes. I would assume that sort of "code" to contain all sorts of restrictions, i just wouldnt know where to look for that one really as like you say, the only way i could see to search for it, wouldnt be through same faction battles, but then as you say it would just add battle kills, instead of PvP kills (to my knowledge, never played a FFA map/server)

nubness · 09/25/2014, 11:44

Most things are handled by the server. Those which aren't (but should) lead to exploits which we all have seen over the years.

As for your questions about an FFA map, think about it. You kill someone without requesting a battle with them. Do you get a kill or a victory ? The answer is obvious.

Locking maps for certain levels is not too difficult. There's multiple ways of doing it.
The easy way is to find the pre-built function which is called every time you get summoned or move to someone or upon other certain events. That function is a short one, and contains a few assembly instructions meant to check if you're on the default maps with a level cap, map18 -> lv15, map30, 31, 32 -> lv30, CR2, AR2 -> lv35.
Once you found that function you may need to jump to a code cave and add your own level-map checks.

Good luck !

JuuF · 09/25/2014, 12:02

And i can give you tips about Teleport stone. First take a teleport point then search it's x coordinate as float then take another teleport point and do the same till you find the x coordinate of your teleport stone's first slot then move to a dungeon and see what access to it while you're trying to take Teleport Point.Im sure you'll find something

Once you find Teleport Point Set function all you have to do is setting restriction.

Im one of those newbies which is trying to learn things for themselves and to be honest there arent that many "elite devs" left.. So all we need is some teamwork

I'm sure nubness and castor will help us in any way they can

Truth1010 · 09/25/2014, 17:20

Thanks for the input Nubness & Juuf.

With the FFA map, i did assume it would count as a kill for that simple reason you stated. If no 'battle' is began by the client, then it can't assume that the kill was a battle victory, so instead it instantly takes it as a pvp kill, regardless of Faction. I just hadn't seen it in effect myself to be certain of which was correct, thanks for pointing it out clearly

With the map level restrictions your "easy" method is exactly how (and the only way i thought possible) i was trying to figure it out.
I was doing searches for Map ID's while moving to different maps, then seeing what accessed when i moved through to the maps you stated (18,30) I could see the addresses / assembly of the actual movements.. how it starts with the "movement trigger" and small checks before leaving the map you are in. Then it jumps down to entering the new map. But i couldn't / can't quite figure out where the check for level access to those map would be as no "accessed" address seems to be found when you get the "cannot move to the selected map due to restrictions" error, it doesn't seem to even start the movement code section..

I'll keep digging into it though, I'm sure I'll spot something eventually, just not knowing what exactly to see makes things difficult... I started looking for hex of 15/18/30 to see map ID or level, but that didn't seem to bring any answers either.

sominus · 09/26/2014, 03:22

Did you find the lookup table (as mentioned in lilpro's post)?
I remember there was a compare to see if a value was 12 and then if it was 1E (maps 18 and 30), then there was a check if it was 46 (kanos, don't know what for). At least in the exe I tried, wich was EP5.1 I think. But that's all how far I got.

Truth1010 · 09/26/2014, 08:23

Well i was messing around with it yesterday, and in the game.exe (5.4, so i assume all to be the same code, just different addresses) I managed to find the level value for summon stones in the 15 map.
0F - 15. Changing this value to a higher number allowed for the "use" of party summon stone, but once it's casting had finished it still failed with an error, so there must be another restriction to that item somewhere close. There were a few more numbers around, but none of them seemed to make much sense from what i was looking for, think i also saw the 46, which makes me wonder if it's for something other than Kanos as it has no restrictions, as far as i know.. maybe movements only allowed in that map, if you are in the map (i believe that was with PR/VR though, not Kanos)

sominus · 09/26/2014, 21:30

Is this the block?

Code:

cmp word ptr [edi+1A],0F
jmp game.exe+XXXXX

(there are more lines but I just posted those two)

Truth1010 · 09/26/2014, 23:34

Yes, that is the block. Mine is slightly different, which may be because i'm working from a 5.4 release.. but they look close enough to be the same

Code:

CMP WORD PTR DS:[ESI+1A],0F
JA SHORT game.xxxxxxx

sominus · 09/27/2014, 00:01

My problem is, I set breakpoints to that block, and I use the 2 available summon stones, but the BP doesn't get triggered. (tried in CE and Olly).

I asume those are the 'level limits', not the 'Restricted Maps' list.

[Dev]Matheus · 09/27/2014, 00:18

Quote:

Originally Posted by nubness

Most things are handled by the server. Those which aren't (but should) lead to exploits which we all have seen over the years.

As for your questions about an FFA map, think about it. You kill someone without requesting a battle with them. Do you get a kill or a victory ? The answer is obvious.

Locking maps for certain levels is not too difficult. There's multiple ways of doing it.
The easy way is to find the pre-built function which is called every time you get summoned or move to someone or upon other certain events. That function is a short one, and contains a few assembly instructions meant to check if you're on the default maps with a level cap, map18 -> lv15, map30, 31, 32 -> lv30, CR2, AR2 -> lv35.
Once you found that function you may need to jump to a code cave and add your own level-map checks.

Good luck !

Are basically talking about the FFA and so set up for when the player enters the battle map is already activated?

nubness · 09/27/2014, 00:30

Quote:

Originally Posted by [Dev]Matheus

Are basically talking about the FFA and so set up for when the player enters the battle map is already activated?

English please.

[Dev]Matheus · 09/27/2014, 00:34

Quote:

Originally Posted by [Dev]Matheus

Are basically talking about the FFA and so set up for when the player enters the battle map is already activated?

Another issue that tou in doubt is where edit, why put to skip confirmation battle in game.exe is necessary edits ps_game.exe?