[Exploit] Summon any monster at any server without gm account

[sarkoplata]

Originally Posted by gigola123

So after some research, you can change the monster type which appear but you've to change your GameServer, here offset to change:

004192FD ::: MOV BYTE PTR DS:[EAX],3

Just change "3" at the end by what you want, here a list of all type:

00 General
01 Champion
02 Unknow ???
03 Unique
04 Giant
05 Titan
06 Elite Giant
07 Elite
08 Unique but without notification of spawn and kill ?
09 Unknow ???
10 General Party

Well unknow has some strange behavior, missing name + hp


This modification will not impact other unique spawn, only unique spawn by /spawnunique_all command.

That's basically the "Rarity" of the object.

The function you show finally leads to something like this:

PHP Code:

static void* CGameWorldMgr::SpawnNPC(AURefObjChar* mob, unsigned int mobType, unsigned short RegionID, unsigned short WorldID, float X, float Y, float Z); 


Which is completely wrong param-wise, I know. (ushort regionid??), there are some pointers to NestData etc. too. I just pass them as 0.

[gigola123]

Originally Posted by sarkoplata

That's basically the "Rarity" of the object.

The function you show finally leads to something like this:

PHP Code:

static void* CGameWorldMgr::SpawnNPC(AURefObjChar* mob, unsigned int mobType, unsigned short RegionID, unsigned short WorldID, float X, float Y, float Z); 


Which is completely wrong param-wise, I know. (ushort regionid??), there are some pointers to NestData etc. too. I just pass them as 0.

Yup exactly ! Actually if someone want more information, 34BB will call 04190C0. 04190C0 function is the one which I change here, it's only triggered by the packet 34BB (as far as I know), and like said sarkoplata, it'll call 05F6EB0 (spawn function).

Oh interessting about the NestData, I didn't notice that, it's probably about the auto respawn after mob dead, some time ago I tried to call this function, had some parameter which I didn't understand like 10001 (65537) which look like to be the current WorldID. Always though that the first param was the reference of gameworld haha, I'm still a big noob at reverse, thanks for the information ! It's 5F6EB0 right ?

[sarkoplata]

Originally Posted by gigola123

Yup exactly ! Actually if someone want more information, 34BB will call 04190C0. 04190C0 function is the one which I change here, it's only triggered by the packet 34BB (as far as I know), and like said sarkoplata, it'll call 05F6EB0 (spawn function).

Oh interessting about the NestData, I didn't notice that, it's probably about the auto respawn after mob dead, some time ago I tried to call this function, had some parameter which I didn't understand like 10001 (65537) which look like to be the current WorldID. Always though that the first param was the reference of gameworld haha, I'm still a big noob at reverse, thanks for the information ! It's 5F6EB0 right ?

Yep, it's 0x5F6EB0.

I'm not entirely sure about the WorldID stuff. The GameServer sometimes shows some logs like 'WorldID[1,1]', it's probably a second layer or something. This is how I append my WorldID:

PHP Code:

unsigned int WorldIDData = 0x10000;
WorldIDData += WorldID; 


The NestData is probably how the monster will act after spawn, for example, how far they will chase, etc... For example you can't lure the original auto-spawn uniques beyond some point, but /loadmonster'ed uniques can be lured to wherever you want. A database editor should know much better.

I'm using the ASM way to call this function (because for some reason it uses EDI as 'this' instead of ecx, due to optimization i guess) and I can't call it the C++ way. So my function signature was actually just a wrapper. xD

[gigola123]

Originally Posted by sarkoplata

Yep, it's 0x5F6EB0.

I'm not entirely sure about the WorldID stuff. The GameServer sometimes shows some logs like 'WorldID[1,1]', it's probably a second layer or something. This is how I append my WorldID:

PHP Code:

unsigned int WorldIDData = 0x10000;
WorldIDData += WorldID; 


The NestData is probably how the monster will act after spawn, for example, how far they will chase, etc... For example you can't lure the original auto-spawn uniques beyond some point, but /loadmonster'ed uniques can be lured to wherever you want. A database editor should know much better.

I'm using the ASM way to call this function (because for some reason it uses EDI as 'this' instead of ecx, due to optimization i guess) and I can't call it the C++ way. So my function signature was actually just a wrapper. xD

Oh got it about the world ID, look like jmx take the first bit and last bit, and the last bit stand for the worldID.

Thanks for all those information ! I'll give a try again so

[bende16]

Originally Posted by gigola123

So after some research, you can change the monster type which appear but you've to change your GameServer, here offset to change:

004192FD ::: MOV BYTE PTR DS:[EAX],3

This modification will not impact other unique spawn, only unique spawn by /spawnunique_all command.

Thanks

[Isoline*]

Can someone share the packet structure ?

[bimbum*]

Originally Posted by Isoline*

Can someone share the packet structure ?

[Isoline*]

Originally Posted by bimbum*

Thanks buddy.

[kotsh23]

There is someone spwan many uniques at same time
like titans
any idea what is the packet of this please

Originally Posted by sarkoplata

use /addrallypoint...

Please ,
There is someone Spawn Unique at Titan Places or normal uniques places

its spawn at same sec like titans

[sarkoplata]

Originally Posted by kotsh23

There is someone spwan many uniques at same time
like titans
any idea what is the packet of this please



Please ,
There is someone Spawn Unique at Titan Places or normal uniques places

its spawn at same sec like titans

/spawnunique_all ?

[kotsh23]

i dont know really but somehow he do something and there is another uniques not titans spawn at the same place of titans

[Devsome]

Originally Posted by kotsh23

There is someone spwan many uniques at same time
like titans
any idea what is the packet of this please



Please ,
There is someone Spawn Unique at Titan Places or normal uniques places

its spawn at same sec like titans

Originally Posted by bimbum*

did you readed the 2 post above?

[kotsh23]

Originally Posted by Devsome

did you readed the 2 post above?

yea i fixed it already but read my post again
he do it by other way
he spawn more than 27 unique at uniques spots at same time ,
not 1 by 1 and not at same place

[Devsome]

Originally Posted by kotsh23

yea i fixed it already but read my post again
he do it by other way
he spawn more than 27 unique at uniques spots at same time ,
not 1 by 1 and not at same place

Then run that Packet 27 times with other Coordinates or using a filter if he owns the server.

[gigola123]

Originally Posted by kotsh23

yea i fixed it already but read my post again
he do it by other way
he spawn more than 27 unique at uniques spots at same time ,
not 1 by 1 and not at same place

I think your shard does «*unique event*». Take a look on auto event from shard