need door help packet structure

[lion228]

hello can someone check this and correct it for me the door is not clickable .
packet is

packet : (0x71) F_CREATE_STATIC Size = 64

|00 3D 71 06 90 00 00 00 00 1F E3 00 0C E3 29 00 |.=q...........).|
|0E 59 90 FF FF 1E 00 00 00 35 F3 00 03 04 00 00 |.Y.......5......|
|00 00 64 78 B2 02 B1 00 00 00 00 0F 45 6D 70 69 |..dx........Empi|
|72 65 20 42 61 72 20 44 6F 6F 72 04 06 AB DD 00 |re Bar Door.....|


and structure is
PacketOut Out = new PacketOut((byte)Opcodes.F_CREATE_STATIC);
Out.WriteUInt16(Oid);
Out.WriteUInt16(0);

Out.WriteUInt16((UInt16)Spawn.WorldO);
Out.WriteUInt16((UInt16)Spawn.WorldZ);
Out.WriteUInt32((UInt32)Spawn.WorldX);
Out.WriteUInt32((UInt32)Spawn.WorldY);
Out.WriteUInt16((ushort)Spawn.DisplayID);

Out.WriteUInt16(Spawn.GetUnk(0));
Out.WriteUInt16(Spawn.GetUnk(1));
Out.WriteUInt16(Spawn.GetUnk(2));
Out.WriteByte(Spawn.Unk1);

int flags = Spawn.GetUnk(3);
Loot Loots = LootsMgr.GenerateLoot(this, Plr);
if (Loots != null && Loots.IsLootable())
{
flags = flags | 4;
}

Out.WriteUInt16((ushort)flags);
Out.WriteByte(Spawn.Unk2);
Out.WriteUInt32(Spawn.Unk3);
Out.WriteUInt16(Spawn.GetUnk(4));
Out.WriteUInt16(Spawn.GetUnk(5));
Out.WriteUInt32(Spawn.Unk4);

Out.WritePascalString(Name);
Out.WriteByte(0);

Plr.SendPacket(Out);

[HunabKu]

Code: Select all

/door show

- can you clic on after ?
- if yes you will asked for add it on database.

[Leodagan]

Code: Select all

/door show

- can you clic on after ?
- if yes you will asked for add it on database.

Hi HunabKu

Lion228 is talking about WAR packet code...

He's asking for support here because WAR lacks an active emulator project

Anyway even if I can recognize this is not a DAOC packet I can't help him much either

[HunabKu]

wow i missed sorry

[lion228]

yep, its somthing to do with theses last bites, 04 06 AB DD 00 not sure what theses are

[Leodagan]

We can't help you much with "ONE" packet and no documentation about reverse engineering...

What is the "Header" of WAR packets ? is the header included in your packet extract ?

There is a 0x71 at position 2 that is matching packet opcode (0x71) is this the header ?

When I tag your code to match packet value I don't understand the structure compared to your packet code...

Code: Select all

PacketOut Out = new PacketOut((byte)Opcodes.F_CREATE_STATIC); // Headers and what else ?? Out.WriteUInt16(Oid); //Size: 2 Out.WriteUInt16(0); //Size: 4 Out.WriteUInt16((UInt16)Spawn.WorldO); //Size: 6 Out.WriteUInt16((UInt16)Spawn.WorldZ); //Size: 8 Out.WriteUInt32((UInt32)Spawn.WorldX); //Size: 12 Out.WriteUInt32((UInt32)Spawn.WorldY); //Size: 16 Out.WriteUInt16((ushort)Spawn.DisplayID); //Size: 18 Out.WriteUInt16(Spawn.GetUnk(0)); //Size: 20 Out.WriteUInt16(Spawn.GetUnk(1)); //Size: 22 Out.WriteUInt16(Spawn.GetUnk(2)); //Size: 24 Out.WriteByte(Spawn.Unk1); //Size: 25 int flags = Spawn.GetUnk(3); Loot Loots = LootsMgr.GenerateLoot(this, Plr); if (Loots != null && Loots.IsLootable()) { flags = flags | 4; } Out.WriteUInt16((ushort)flags); //Size: 27 Out.WriteByte(Spawn.Unk2); //Size: 28 Out.WriteUInt32(Spawn.Unk3); //Size: 32 Out.WriteUInt16(Spawn.GetUnk(4)); //Size: 34 Out.WriteUInt16(Spawn.GetUnk(5)); //Size: 36 Out.WriteUInt32(Spawn.Unk4); //Size: 40 Out.WritePascalString(Name); //Size: 56 (1 byte size + 15 byte length with : Empire Bar Door) // We are missing 4 bytes here your : "04 06 AB DD", the 0x00 is the last byte on next line... Out.WriteByte(0); //Size: 57 // Maybe 61 ? with 4 bytes missing ? Is the header size 3 bytes too ?

Your packet is 64 byte size, I count 57 byte, or 61 with 4 unknown missing bytes...

If the header is really the 3 bytes until we find "0x71" this match your error and question about the 4 missing bytes

The header would look like "00 3D 71", first 2 byte is UInt16 = Size (0x003D = 61 !) and the 3rd byte is opcode (0x71 match your door opcode !)

So you should update your code with :

Code: Select all

Out.WritePascalString(Name); Out.WriteUInt32(0); // Unknown 4 missing bytes... Out.WriteByte(0);

And you're lucky I'm getting bored at office don't expect other analysis like this

[lion228]

I have loads of packets. The 3D is the header = 61 71 is the opcode =F_CREATE_STATIC for game objects.I added the UInt32 before but door still not clickable,this is a mailbox packet which is working and clickable

[Server] packet : (0x71) F_CREATE_STATIC Size = 52
|------------------------------------------------|----------------|
|00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F |0123456789ABCDEF|
|------------------------------------------------|----------------|
|00 31 71 07 8D 00 00 06 4F 1E A8 00 0C E7 B1 00 |.1q.....O.......|
|0E 56 9A 0D 7D 1E 41 00 00 C7 20 00 01 04 00 00 |.V..}.A... .....|
|00 00 64 00 05 9D AC 00 00 00 00 07 4D 61 69 6C |..d.........Mail|
|62 6F 78 00 |.... | just the doors that not seem to work

[Leodagan]

And do you have any idea why there is only "4 bytes" after your door "name" in this other packet ?

In the first one you provided there was "5 bytes" at end of packet...

Before trying anything you have to understand the packet structure... then you'll need to research what the values means (if they are binary flag or integer values or strings...) and you may have to build a packet "debugger" that can send arbitrary values to the client until you can match "values" with "behavior"

[lion228]

all door packets have these bites but the normal game objects dont heres a normal door which is same as the empire bar door
.The structure that i posted was made by someone else how you geting the size
//size //2 size 4 ?
Out.WriteUInt16(Oid); //Size: 2
Out.WriteUInt16(0); //Size: 4

[Server] packet : (0x71) F_CREATE_STATIC Size = 53
|------------------------------------------------|----------------|
|00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F |0123456789ABCDEF|
|------------------------------------------------|----------------|
|00 32 71 06 68 00 00 00 00 1A 98 00 0C CA 38 00 |.2q.h.........8.|
|0E 44 88 FF FF 1E 01 00 00 35 CD 00 03 20 00 00 |.D.......5... ..|
|00 00 64 7B 36 25 2F 00 00 00 00 04 44 6F 6F 72 |..d{6%/.....Door|
|04 06 AD BE 00 |..... |
-------------------------------------------------------------------

and this one is crypt gate

[Server] packet : (0x71) F_CREATE_STATIC Size = 59
|------------------------------------------------|----------------|
|00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F |0123456789ABCDEF|
|------------------------------------------------|----------------|
|00 38 71 37 8A 00 00 0F 77 22 A8 00 00 82 32 00 |.8q7....w"....2.|
|03 80 D9 FF FF 1E 00 00 00 96 95 00 00 04 00 00 |................|
|00 00 64 8C A4 DF 9F 00 00 00 00 0A 43 72 79 70 |..d.........Cryp|
|74 20 47 61 74 65 04 0B 00 AA 00 |........... |



OK i added these to the structure and then i did a new sniff

Out.WritePascalString(Name);
Out.WriteByte(0);

Out.WriteUInt16(0);
Out.WriteUInt16(0);



new sniff
[Server] packet : (0x71) F_CREATE_STATIC Size = 64
|------------------------------------------------|----------------|
|00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F |0123456789ABCDEF|
|------------------------------------------------|----------------|
|00 3D 71 00 7F 00 00 00 00 1F E3 00 0C E3 29 00 |.=q...........).|
|0E 59 90 FF FF 1E 00 00 00 35 F3 00 03 04 00 00 |.Y.......5......|
|00 00 64 78 B2 02 B1 00 00 00 00 0F 45 6D 70 69 |..dx........Empi|
|72 65 20 42 61 72 20 44 6F 6F 72 00 00 00 00 00 |re Bar Door.....|
-------------------------------------------------------------------

[Leodagan]

I'm counting bytes to get the size :p

UInt16 = Short Int = 2 bytes
UInt32 = Integer = 4 bytes
...
1 byte = 1 char = 8 bits

Both packets you posted "Door" and "Cryp" one, have 5 bytes at the end after the "name"

Name is prefixed with one byte (Pascal String) to give the length of the string...

In your "Cryp" Packet, the "Cryp" Name is prefixed with 0x0A (= 10) and even if there is no more characters after "Cryp" there is still 10 bytes before we encounter the last "5 bytes"

the lines you added :

Out.WriteUInt16(0);
Out.WriteUInt16(0);

Are just here to match the packet structure, but I can't "guess" what data is needed there...

All the packets you gave except "Mail" have 0x04 value just after the "Pascal Name", maybe client is expecting the third "bit" to be set to "on" for some reason... maybe its in other part of the packet...

You have to convert data from Hexadecimal to Binary (use Win7 Programmer Calc) and check which "bit" is enable or not, and "Guess" what they could do !

You may need to code specific "Game Object" on which you can update these unknown number with any values, and try any value with your client ready to test what is changing ! (start by enabling bits one by one, which mean decimal values : 1,2,4,8,16,32,64 etc...)

Do you have any Binary/Boolean Algebra knowledge ?

... And by the way, definitely all packet ends with 0x00 (1 byte) value...

[lion228]

Do you have any Binary/Boolean Algebra knowledge ? Ive only used windows scientifc calculator for some packets to get x y z ect hex to dec. That Cryp packet is crypt gate it dont always show the full name on packets

43 72 79 70 74 20 47 61 74 65
c r y p t g a t e

i can send the full packet with packet sender but it dont seem to do anything

[Leodagan]

You must use the "Developer" Calc and not the "Scientific" Calc :

devcalc.png (18.12 KiB) Viewed 4277 times

You can view the "Binary" representation of the number you type in this Calc...

And you can "Enable" or "Disable" Binary Bits by Clicking them !

This way you can check some "numeric" value that in fact represent an "Array of Bit" (byte value = array of 8 bits)

In the example above, decimal value 32 means that only the 6th bit is set, if the decimal value is 40 it mean 6th bit and 4th bit are set (32 => 6th bit ; 8 => 4th bit ; 40 in decimal)

But don't confuse with 0x40 (Hexadecimal) which is 64 in decimal, and only enable the 7th bit !

Game client may use these as "Flag" value, looking only for a specific "bit" in the "row" (array of bit) to enable or disable some behavior (example on DAOC packet this can enable Mob to be targeted by player or not...)

They are some "shortcut" that you must keep in mind while working on these, 0xFF = All bits set ! (255 in decimal), 256 in decimal can't fit in a byte, you must use an UInt16 which will enable only the 9th bit or the 16 bits array, all "power of 2" values are enabling only 1 bit (32;64;128;256;512 etc..)

You really need to learn how to change numeric "base" (I don't know the word in english)

0 1 2 3 4 5 6 7 8 9 = decimal base, the one you use everyday; 9 + 1 = 10
0 1 2 3 4 5 6 7 8 9 A B C D E F = hexadecimal base; 0xA = 10, 0xB = 11 etc, 0xF + 0x1 = 0x10 (16 in decimal...)
0 1 2 3 4 5 6 7 = Octal base; 07 + 01 = 010 (8 in decimal)
0 1 = Binary/Boolean base; 0+1 = 1; 1+1 = 10 (2 in decimal); 10+1 = 11 (3 in decimal); 11 + 1 = 100 (4 in decimal) etc...

You will have a hard time trying to mimic the Packet Values if you can't handle this

And do some research on "Unary" operators like '&' or '|' these are needed to filter bits or enable bits...

$(value) & 0x0F => will disable the 4 first bits (and will keep the last 4 bits in the same state)
$(value) | 0x04 => will enable the 3rd bit !
$(value) | 0x03 => will enable the 1st and 2nd bit...

These operators can be found on the Dev Calc : "And" => &; "Or" => |; "Xor" => ^; you can try some on your calc before coding them.

[lion228]

were i get that from my windows is vista
im useing the last updated open src but doors are not working https://github.com/WarEmu/WarEmu

[Leodagan]

And who is working on this project ?

You should try to contact them...

[lion228]

no they very bad dev, this was open src . while you work on it then stole all your hard work and went private.and release nothing in return so they used peoples hard work and time. just hope some one takes this over and releses open src then there server will have no players .Also alot of people carnt connect to there server with living in difrent country
Theres a load of packets logs here http://www.sixpiwan.com/ftp/WAR/
and u need the ExtractHere.rar zones folder from here http://subversion.assembla.com/svn/allp ... n/Release/
then u need to download the 1.4.8 client