[Release] Functions SendMsg - Halloween Gift

[Laag#82]

Hello friends

MsgStreamBuffer, Functions To Use:

PHP Code:

#pragma once

#include <new>
#include <string>

class CMsgStreamBuffer
{
protected:
    struct SMsgStreamNode
    {
        SMsgStreamNode *next_node; //0x0000
        char N00012EE8[4096]; //0x0004
        char *N00012EE9; //0x1004
        char pad_1008[4]; //0x1008

        SMsgStreamNode()
        {
            next_node = 0;
            N00012EE9 = &N00012EE8[0];
        }

        void* operator new(std::size_t sz)
        {
            return reinterpret_cast<void*(__thiscall*)(int)>(0x425400)(0x00EECD98);
        }
    }; //Size: 0x100C


public:
    CMsgStreamBuffer(short msgid)
        : msgid(msgid), field3(0), _begin(0), _end(0)
    {
        buffer = node_current = new SMsgStreamNode;
    }

    virtual ~CMsgStreamBuffer()
    {
        /*
        CheckMsgNotCompletelyUsed();

        while (node_current) {
            SMsgStreamNode *node = node_current;
            node_current = node_current->next_node;

            delete node;
            node->next_node = 0xFEEEFEEE;
        }
        */

        reinterpret_cast<void(__thiscall*)(CMsgStreamBuffer*)>(0x005097A0)(this);
    }


    void FlushRemaining()
    {
        _begin = _end;
    }

    template <typename T>
    CMsgStreamBuffer& operator>>(T& value)
    {
        Read(value);
        return *this;
    }


    template <typename T>
    void Read(T& value)
    {
        Read(&value, sizeof(T));
    }


    void Read(void* value, size_t numBytes)
    {
        reinterpret_cast<void(__thiscall*)(CMsgStreamBuffer*, void*, size_t)>(0x004F7220)(this, value, numBytes);

#if 0
        if ((buffer_end - current_buffer_ptr) < numBytes)
        {
            requireBytes(numBytes);
        }

        // Copy bytes
        memcpy(value, current_buffer_ptr, numBytes);

        // Move buffer forward
        current_buffer_ptr += numBytes;
#endif
    }



    /*
     *++++++ WRITE +++++++++++++
     */

    template <typename T>
    void Write(const T* const data, size_t size)
    {
        reinterpret_cast<void(__thiscall*)(CMsgStreamBuffer*, const void* const, size_t)>(0x00508FE0)(this, reinterpret_cast<const void* const>(data), size);
    }

    template <typename T>
    void Write(const T& value)
    {
        Write(&value, sizeof(T));
    }

    template <typename T>
    CMsgStreamBuffer& operator<<(const T& value)
    {
        Write(value);
        return *this;
    }

    CMsgStreamBuffer& operator<<(const std::string& str)
    {
        *this << static_cast<short>(str.length());
        Write(str.c_str(), str.length());

        return *this;
    }


public:
    int _begin;
    int _end;
    int field3;
    SMsgStreamNode* buffer;
    SMsgStreamNode* node_current;
    unsigned short msgid;
    char _gap[4];

}; 


PHP Code:

#define SendMsg(x) reinterpret_cast<void (__cdecl *)(CMsgStreamBuffer&)>(0x008418D0)(x) 


Example:-

PHP Code:

CMsgStreamBuffer buf(0x7001);
buf << std::string(Charname); // CharName
SendMsg(buf); 


 Spoiler

Microsoft Visual C++ and 80 is the version used with Visual Studio 2005.

Special thanks to: florian0

[modyuasty3]

What is features ?!

[Laag#82]

Originally Posted by modyuasty3

What is features ?!

Hi

You can send any packet from client to server (C-> S)

[kanift]

hmm this was how i used to communicate with client from server side and im pretty sure that the structure is same for client also

CMsg

 Spoiler

.h

class CMsg
{
public:
//get
USHORT GetMsgSize();
USHORT GetMsgID();

//set
void SetMsgID(USHORT usMsgID);

//buffer
void WriteDataToMsgStream(void* data, size_t data_size);
void WriteStringToMsgStream(std::string str);

template <typename t>
void WriteDataToMsgStream(t data)
{
WriteDataToMsgStream(reinterpret_cast<void*>(&data ), sizeof(t));
}
};

.cpp

USHORT CMsg::GetMsgSize()
{
return *reinterpret_cast<USHORT*>(*reinterpret_cast<DWORD *>(reinterpret_cast<DWORD>(this) + 0x1054) + 0x0);
}

USHORT CMsg::GetMsgID()
{
return *reinterpret_cast<USHORT*>(*reinterpret_cast<DWORD *>(reinterpret_cast<DWORD>(this) + 0x1054) + 0x2);
}

void CMsg::SetMsgID(USHORT usMsgID)
{
**reinterpret_cast<USHORT**>(reinterpret_cast<DWOR D>(this) + 0x1050) = usMsgID;
}

void CMsg::WriteDataToMsgStream(void* data, size_t data_size)
{
auto msg_buffer = reinterpret_cast<DWORD*>(reinterpret_cast<DWORD>(t his) + 0x1034);
auto msg_cur_size = reinterpret_cast<USHORT*>(reinterpret_cast<DWORD>( this) + 0x103E);
auto msg_max_size = reinterpret_cast<USHORT*>(reinterpret_cast<DWORD>( this) + 0x104C);

if (data_size + *msg_cur_size > *msg_max_size || *msg_cur_size - 6 > 0x7FFF)
return;

memcpy(reinterpret_cast<void*>(*msg_buffer + *msg_cur_size), data, data_size);

*msg_cur_size += data_size;

**reinterpret_cast<USHORT**>(reinterpret_cast<DWOR D>(this) + 0x1054) = static_cast<USHORT>(static_cast<USHORT>(**reinterp ret_cast<USHORT* *>(reinterpret_cast<DWORD>(this) + 0x1054) & 0x8000) | *msg_cur_size - 6);
}

void CMsg::WriteStringToMsgStream(std::string str)
{
auto msg_cur_size = *reinterpret_cast<USHORT*>(reinterpret_cast<DWORD> (this) + 0x103E);
auto msg_max_size = *reinterpret_cast<USHORT*>(reinterpret_cast<DWORD> (this) + 0x104C);

auto str_len = str.length();

if ((2 + str_len) + msg_cur_size > msg_max_size || msg_cur_size - 6 > 0x7FFF)
return;

//str_size
WriteDataToMsgStream(&str_len, 2);
//str_data
WriteDataToMsgStream(&str[0], str_len);
}

CNetEngine

 Spoiler

h.

class CNetEngine
{
public:
static CNetEngine* GetInstance();
CMsg* CreateMsg(bool bIsEncrypted);
int FreeMsg(CMsg* pMsg);
int SendMsg(UINT uiID, CMsg* pMsg);
};

.cpp

CNetEngine* CNetEngine::GetInstance()
{
return *reinterpret_cast<CNetEngine**>(0xC8258C);
}

CMsg* CNetEngine::CreateMsg(bool bIsEncrypted)
{
return CallVirtual<CMsg*(__stdcall*)(CNetEngine*, bool)>(this, 18)(this, bIsEncrypted);
}

int CNetEngine::FreeMsg(CMsg* pMsg)
{
return CallVirtual<int(__stdcall*)(CNetEngine*, CMsg*)>(this, 19)(this, pMsg);
}

int CNetEngine::SendMsg(UINT uiID, CMsg* pMsg)
{
return CallVirtual<int(__stdcall*)(CNetEngine*, UINT, CMsg*)>(this, 20)(this, uiID, pMsg);
}

also on server side there are functions in CGObjPC that u can create & send msg to targeted user

 Spoiler

CMsg* CGObjPC::AllocMsgForPeer(USHORT usMsgID)
{
return CallVirtual<CMsg*(__thiscall*)(CGObjPC*, USHORT)>(this, 158)(this, usMsgID);
}

void CGObjPC::SendMsgToPeer(CMsg* pMsg)
{
CallVirtual<void(__thiscall*)(CGObjPC*, CMsg*)>(this, 159)(this, pMsg);
}