Welcome!

Join our community of MMO enthusiasts and game developers! By registering, you'll gain access to discussions on the latest developments in MMO server files and collaborate with like-minded individuals. Join us today and unlock the potential of MMO server development!

Join Today!

Fix for the stall gold bug (Confirmed to be Working)

The Best DDoS Protected Servers
monkuar

monkuar

Newbie Spellweaver
Joined
Mar 21, 2009
Messages
10
Reaction score
0
AreJienZ said:
done making it on 2240...
thnks to ryllady for the offset xD
Click to expand...

Can you supply what you did, I nee dit for 2240 also,

Thank you

Dunno know if TyFix said ti will work on 2240's
 
F

faizbukhari

Newbie Spellweaver
10 Happy Years
Joined
Jul 9, 2010
Messages
25
Reaction score
5
If this is for gameserver.exe 2240
Code: 
0047FED9   MOV EDX,DWORD PTR SS:[ESP+18]
0047FEDD   PUSH 1
0047FEDF   SUB ESP,8
0047FEE2   MOV EAX,ESP
0047FEE4   MOV DWORD PTR DS:[EAX],EBP
0047FEE6   MOV ECX,EDI
0047FEE8   MOV DWORD PTR DS:[ESI+1C],EDX
0047FEEB   MOV BYTE PTR DS:[EAX+4],BL
0047FEEE   CALL RylGameS.00428DA0
0047FEF3   TEST AL,AL
0047FEF5   JNZ RylGameS.00480002
0047FEFB   MOV DWORD PTR SS:[ESP+30],1
0047FF03   JMP RylGameS.00480002
0047FF08   MOV ECX,DWORD PTR SS:[ESP+22]
0047FF0C   PUSH ECX

and change the following
Code: 
0047FEFB   MOV DWORD PTR SS:[ESP+30],1
0047FF03   JMP RylGameS.00480002
0047FF08   MOV ECX,DWORD PTR SS:[ESP+22]
0047FF0C   PUSH ECX

change to

Code: 
0047FEFB   JMP RylGameS.????????
0047FF03   NOP
0047FF08   NOP
0047FF0C   NOP

What i need change at
Code: 
0047FEFB   JMP RylGameS.[U]????????[/U]
 
Last edited:
R

RSP13Z

Initiate Mage
Joined
May 26, 2011
Messages
4
Reaction score
0
gameserver.exe 2240

0047FED9 MOV EDX,DWORD PTR SS:[ESP+18]
0047FEDD PUSH 1
0047FEDF SUB ESP,8
0047FEE2 MOV EAX,ESP
0047FEE4 MOV DWORD PTR DS:[EAX],EBP
0047FEE6 MOV ECX,EDI
0047FEE8 MOV DWORD PTR DS:[ESI+1C],EDX
0047FEEB MOV BYTE PTR DS:[EAX+4],BL
0047FEEE CALL RylGameS.00428DA0
0047FEF3 TEST AL,AL
0047FEF5 JNZ RylGameS.00480002
0047FEFB JMP RylGameS.0050A1D8
0047FF00 NOP
0047FF01 NOP
0047FF02 NOP
0047FF03 JMP RylGameS.00480002


0050A1D8 MOV DWORD PTR SS:[ESP+30],1
0050A1E0 MOV DWORD PTR DS:[ESI+1C],0
0050A1E7 JMP RylGameS.00480002
 
Last edited:
A

ashfan

Newbie Spellweaver
Joined
Aug 5, 2011
Messages
36
Reaction score
2
0047FED9 MOV EDX,DWORD PTR SS:[ESP+18]
0047FEDD PUSH 1
0047FEDF SUB ESP,8
0047FEE2 MOV EAX,ESP
0047FEE4 MOV DWORD PTR DS:[EAX],EBP
0047FEE6 MOV ECX,EDI
0047FEE8 MOV DWORD PTR DS:[ESI+1C],EDX
0047FEEB MOV BYTE PTR DS:[EAX+4],BL
0047FEEE CALL RylGameS.00428DA0
0047FEF3 TEST AL,AL
0047FEF5 JNZ RylGameS.00480002
0047FEFB JMP RylGameS.0050A1D8
0047FF00 NOP
0047FF01 NOP
0047FF02 NOP
0047FF03 JMP RylGameS.00480002


0050A1D8 MOV DWORD PTR SS:[ESP+30],1
0050A1E0 MOV DWORD PTR DS:[ESI+1C],0
0050A1E7 JMP RylGameS.00480002

is the fix?
 
Terabit

Terabit

Experienced Elementalist
10 Happy Years
Joined
Jun 16, 2011
Messages
216
Reaction score
16
Tyfix said:
Hey,

I'm sure most of you have seen the video by now that someone found out how to dupe gold on selling items they setup in a store by swapping items around and putting a high value then selling item to vendor for same price as they put in store.

Was looking around a 1750 server in asm and might have a solution to fix this, please keep in mind that i have not tested this at all so can make no guarantees if it will work or not, but the new code that is inserted will only run if you get the server error up so it will still work as intended on normal operation.

As i said i used a 1750 gameserver so offsets will vary if you are using a different version.

Code: 
0047D709 MOV EDX,DWORD PTR SS:[ESP+18]
0047D70D PUSH 1
0047D70F SUB ESP,8
0047D712 MOV EAX,ESP
0047D714 MOV DWORD PTR DS:[EAX],EBP
0047D716 MOV ECX,EDI
0047D718 MOV DWORD PTR DS:[ESI+1C],EDX
0047D71B MOV BYTE PTR DS:[EAX+4],BL
0047D71E CALL RylGameS.CCharacter::MoveItem
0047D723 TEST AL,AL
0047D725 JNZ RylGameS.0047D832
0047D72B MOV DWORD PTR SS:[ESP+30],1
0047D733 JMP RylGameS.0047D832

The bug here is that the price is always set on the item even if the item fails to register in stall, we're gonna change that.

To do so you'll need to find a place with some empty code space because we're gonna be adding some code and there isn't room here for this. Usually you'll want to go to the end of the file for the needed space, for 1750 i used the area 005050EE->00505101

Alright enough talking, on with the code, change the following:

Code: 
0047D72B MOV DWORD PTR SS:[ESP+30],1
NOP out, and replace with a far jump to the available codespace.
Code: 
0047D72B JMP RylGameS.005050EE
0047D730 NOP
0047D731 NOP
0047D732 NOP

Go to your free codespace and write the replacement code:
Code: 
005050EE MOV DWORD PTR SS:[ESP+30],1 ; Set error to Server Error
005050F6 MOV DWORD PTR DS:[ESI+1C],0 ; Stall Price = 0
005050FD JMP RylGameS.0047D832       ; Return to stall code

And we're done, rightclick->copy to executeable->all modifications (select copy on all) rightclick->backup->save data to file (input a new filename for instance gameserver_.exe)

A little explanation about what this mod does, it will set the stall price as usual but in case the item fails to register in stall it will overwrite the price with 0 and send a server error. As i said previously this is untested so i cannot guarantee it will work but I'm fairly sure it will, and please remember these offsets and combination of registers will only work for 1750 server, other versions WILL vary though be somewhat similar.

Enjoy.

Edit: Just got confirmation from someone that tried this that it does in fact fix the problem, so off you go fix your servers ;)
Click to expand...


How about fix stall gold bug in row?

You must be registered to see links
 
Last edited:
A

ashfan

Newbie Spellweaver
Joined
Aug 5, 2011
Messages
36
Reaction score
2
Can someone explain how to do it on a 1753 gameserver?

im sure i did all the steps right. but i wasnt able to copy to executable.
 
Last edited:
equlibrium

equlibrium

Experienced Elementalist
10 Happy Years
Joined
Dec 25, 2008
Messages
234
Reaction score
81
how how you guys are strange. Open gameserver in olydbg and start debug. Find out command where is gold outside take. Then just trun ower that take. When take out gold will deposit, i to last time that RYL GOW !!! All time only asking help some time is nice when you guys start use own brains !!!
Good luck all who work closed exe files !!!
 
A

ashfan

Newbie Spellweaver
Joined
Aug 5, 2011
Messages
36
Reaction score
2
well..i dint get to copy to executable after editing. and im sure i did everything correct.
 
R

RonaldinhoR9

Skilled Illusionist
10 Happy Years
Joined
Jan 15, 2009
Messages
332
Reaction score
11
Just to be sure : i have a 1700 client.exe (version should be 1753), and im using gameserver.exe 1,57mb. The addres is same of this?

0047D709 MOV EDX,DWORD PTR SS:[ESP+18]
0047D70D PUSH 1
0047D70F SUB ESP,8
0047D712 MOV EAX,ESP
0047D714 MOV DWORD PTR DS:[EAX],EBP
0047D716 MOV ECX,EDI
0047D718 MOV DWORD PTR DS:[ESI+1C],EDX
0047D71B MOV BYTE PTR DS:[EAX+4],BL
0047D71E CALL RylGameS.CCharacter::MoveItem????what value here?
0047D723 TEST AL,AL
0047D725 JNZ RylGameS.0047D832
0047D72B JMP RylGameS.005050EE
0047D730 NOP
0047D731 NOP
0047D732 NOP
0047D733 JMP RylGameS.0047D832

Cause i found these values in this:

0047D5B9 > 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+18]
0047D5BD . 6A 01 PUSH 1
0047D5BF . 83EC 08 SUB ESP,8
0047D5C2 . 8BC4 MOV EAX,ESP ; |
0047D5C4 . 8928 MOV DWORD PTR DS:[EAX],EBP ; |
0047D5C6 . 8BCF MOV ECX,EDI ; |
0047D5C8 . 8956 1C MOV DWORD PTR DS:[ESI+1C],EDX ; |
0047D5CB . 8858 04 MOV BYTE PTR DS:[EAX+4],BL ; |
0047D5CE . E8 1DAEFAFF CALL Map3.004283F0 ; \0047D5D3 . 84C0 TEST AL,AL
0047D5D5 . 0F85 57020000 JNZ Map3.0047D832
0047D5DB . E9 BE840800 JMP Map3.00505A9E
0047D5E0 90 NOP
0047D5E1 90 NOP
0047D5E2 90 NOP
0047D5E3 . E9 4A020000 JMP Map3.0047D832

Check this line:

0047D5D5 . 0F85 57020000 JNZ Map3.0047D832 or this 0047D6E2 ?

0047D6E2 > 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+30] ; Default case of switch 0047D53A

and the other line go to this address:

0047D832 > E9 E4000000 JMP Map1.0047D91B


I made the modificatiosn required, but not sure if is the right place. ^^( i cant test bymyself cause cant make fast the gold bug to try iy = no lag enough to make it.)
 
Last edited:
M

Muhd Amirul

Initiate Mage
Joined
Jun 22, 2012
Messages
3
Reaction score
0
hi,
047D71E CALL RylGameS.CCharacter::MoveItem
Click to expand...

About above Thing.

I Found The Words Of Call.
But Which One I should Call?

004xxxxx 33FF XOR EDI,EDI
004xxxxx DD1C24 FSTP QWORD PTR SS:[ESP]
004xxxxx 68 6CC65000 PUSH RylGameS.0050C66C ; ASCII "CCharacter::MoveItem"
004xxxxx 8BF1 MOV ESI,ECX
004xxxxx C74424 48 6CC650>MOV DWORD PTR SS:[ESP+48],RylGameS.0050C>; ASCII "CCharacter::MoveItem"
004xxxxx 897C24 38 MOV DWORD PTR SS:[ESP+38],EDI
004xxxxx 897C24 3C MOV DWORD PTR SS:[ESP+3C],EDI
004xxxxx E8 BA5AFEFF CALL RylGameS.0040DEF0
004xxxxx 8BC8 MOV ECX,EAX
004xxxxx E8 6358FEFF CALL RylGameS.0040DCA0
004xxxxx 8D4424 2C LEA EAX,DWORD PTR SS:[ESP+2C]
004xxxxx 894424 28 MOV DWORD PTR SS:[ESP+28],EAX
004xxxxx 897C24 34 MOV DWORD PTR SS:[ESP+34],EDI
004xxxxx 897C24 38 MOV DWORD PTR SS:[ESP+38],EDI
004xxxxx 0F31 RDTSC
004xxxxx 895424 24 MOV DWORD PTR SS:[ESP+24],EDX
004xxxxx 894424 20 MOV DWORD PTR SS:[ESP+20],EAX
004xxxxx 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20]
004xxxxx 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+24]
004xxxxx 894C24 2C MOV DWORD PTR SS:[ESP+2C],ECX
004xxxxx 895424 30 MOV DWORD PTR SS:[ESP+30],EDX
004xxxxx 33C0 XOR EAX,EAX
004xxxxx 8A4424 54 MOV AL,BYTE PTR SS:[ESP+54]
004xxxxx 8BCE MOV ECX,ESI
004xxxxx 897C24 4C MOV DWORD PTR SS:[ESP+4C],EDI
004xxxxx 25 0FFFFFFF AND EAX,FFFFFF0F
004xxxxx 50 PUSH EAX
004xxxxx E8 E2ECFFFF CALL RylGameS.00427160
004xxxxx 8B5C24 56 MOV EBX,DWORD PTR SS:[ESP+56]
004xxxxx 33C9 XOR ECX,ECX
004xxxxx 8ACB MOV CL,BL
004xxxxx 8BE8 MOV EBP,EAX
004xxxxx 896C24 18 MOV DWORD PTR SS:[ESP+18],EBP
004xxxxx 81E1 0FFFFFFF AND ECX,FFFFFF0F
004xxxxx 51 PUSH ECX
004xxxxx 8BCE MOV ECX,ESI
004xxxxx E8 C6ECFFFF CALL RylGameS.00427160
004xxxxx 3BEF CMP EBP,EDI
004xxxxx 894424 20 MOV DWORD PTR SS:[ESP+20],EAX
004xxxxx 0F84 5A040000 JE RylGameS.00428900
004xxxxx 3BC7 CMP EAX,EDI
004xxxxx 0F84 52040000 JE RylGameS.00428900
004xxxxx 8B4424 54 MOV EAX,DWORD PTR SS:[ESP+54]
004xxxxx 8AD0 MOV DL,AL
004xxxxx 80E2 0F AND DL,0F
004xxxxx 80FA 0B CMP DL,0B
004xxxxx 75 2C JNZ SHORT RylGameS.004284E8
004xxxxx 8BCB MOV ECX,EBX
004xxxxx 83E1 0F AND ECX,0F
Click to expand...

Anyone Please Reply.
Thanks.
 
M

Member-Hacking

Newbie Spellweaver
10 Happy Years
Joined
Jan 30, 2010
Messages
26
Reaction score
0
Tyfix said:
Hey,

I'm sure most of you have seen the video by now that someone found out how to dupe gold on selling items they setup in a store by swapping items around and putting a high value then selling item to vendor for same price as they put in store.

Was looking around a 1750 server in asm and might have a solution to fix this, please keep in mind that i have not tested this at all so can make no guarantees if it will work or not, but the new code that is inserted will only run if you get the server error up so it will still work as intended on normal operation.

As i said i used a 1750 gameserver so offsets will vary if you are using a different version.

Code: 
0047D709 MOV EDX,DWORD PTR SS:[ESP+18]
0047D70D PUSH 1
0047D70F SUB ESP,8
0047D712 MOV EAX,ESP
0047D714 MOV DWORD PTR DS:[EAX],EBP
0047D716 MOV ECX,EDI
0047D718 MOV DWORD PTR DS:[ESI+1C],EDX
0047D71B MOV BYTE PTR DS:[EAX+4],BL
0047D71E CALL RylGameS.CCharacter::MoveItem
0047D723 TEST AL,AL
0047D725 JNZ RylGameS.0047D832
0047D72B MOV DWORD PTR SS:[ESP+30],1
0047D733 JMP RylGameS.0047D832

The bug here is that the price is always set on the item even if the item fails to register in stall, we're gonna change that.

To do so you'll need to find a place with some empty code space because we're gonna be adding some code and there isn't room here for this. Usually you'll want to go to the end of the file for the needed space, for 1750 i used the area 005050EE->00505101

Alright enough talking, on with the code, change the following:

Code: 
0047D72B MOV DWORD PTR SS:[ESP+30],1
NOP out, and replace with a far jump to the available codespace.
Code: 
0047D72B JMP RylGameS.005050EE
0047D730 NOP
0047D731 NOP
0047D732 NOP

Go to your free codespace and write the replacement code:
Code: 
005050EE MOV DWORD PTR SS:[ESP+30],1 ; Set error to Server Error
005050F6 MOV DWORD PTR DS:[ESI+1C],0 ; Stall Price = 0
005050FD JMP RylGameS.0047D832       ; Return to stall code

And we're done, rightclick->copy to executeable->all modifications (select copy on all) rightclick->backup->save data to file (input a new filename for instance gameserver_.exe)

A little explanation about what this mod does, it will set the stall price as usual but in case the item fails to register in stall it will overwrite the price with 0 and send a server error. As i said previously this is untested so i cannot guarantee it will work but I'm fairly sure it will, and please remember these offsets and combination of registers will only work for 1750 server, other versions WILL vary though be somewhat similar.

Enjoy.

Edit: Just got confirmation from someone that tried this that it does in fact fix the problem, so off you go fix your servers ;)
Click to expand...

i try copy gold bug stall ingames (Map1) and i see zone12 crash in server.. can explain to me why this happens? help pls... cannot working..
(try server ryl2 v1753)
image 1:
Tyfix - Fix for the stall gold bug (Confirmed to be Working) - RaGEZONE Forums

image 2:
Tyfix - Fix for the stall gold bug (Confirmed to be Working) - RaGEZONE Forums

image 3:
Tyfix - Fix for the stall gold bug (Confirmed to be Working) - RaGEZONE Forums

image 4:
Tyfix - Fix for the stall gold bug (Confirmed to be Working) - RaGEZONE Forums
 
Last edited:
You must log in or register to reply here.

About Us

RaGEZONE® is a website dedicated to the development of massively multiplayer online role-playing games (MMORPGs).

Online statistics

Members online
164
Guests online
2,673
Total visitors
2,837
Totals may include hidden visitors.

Forum statistics

Threads
428,894
Messages
4,589,244
Members
279,639
Latest member
Bigtrosifer
Most visitors online was 8830 , on 6 Feb 2024

RaGEZONE Sponsor

    HyperFilter
Back
Top