GameServer .90 with Eng Protocol support (with GMO Client fixes) [HowTo]

[alpg07]

Hello guys,

I'll post here my sources of my research in protocols, WzStarterCore cracking and how to unlock account box in Global MU On-Line client.
(I'm using the 1.03e Official WZ Client)

Server-side code:

bool ProtocolCore(BYTE protoNum,LPBYTE aRecv,DWORD aLen,DWORD aIndex,DWORD Encrypt,int Serial )
{

    BYTE ProtocolType = aRecv[0];
    switch(ProtocolType)
    {
        case 0xC1:
            switch(BYTE(protoNum))
            {
                case 0xDB: // this is client send to server packet
                    protoNum = 0xD7; //Server Sends back to Client for that Protocol
                    aRecv[2] = 0xD7; //Server Sends Back to Client for that protocol
                break;
                case 0xF1: //Login protocol (Season 4) // The magic :)  (thx to zemattana)       
                    aRecv[1] -= 0x0A;
                    aLen = aRecv[1];
                    for(int i = 24; i<50; i++)
                       aRecv[i] = aRecv[i+10];    
                break;
            }
    }
}

BYTE ProtocolClientENG(BYTE Tipo)
{
    switch(Tipo)
    {
        case 0x1D: return 0xD4;        //Walk Protocol 100%
        case 0xD6: return 0x15;        //Skills Use Fix 100%
        case 0xDC: return 0x11;        //Attack Protocol 100%
    }
    return Tipo;
}

BYTE ProtocolServerENG(BYTE Tipo)
{
    switch(Tipo)
    {
        case 0xD4: return 0x1D;        //Walk Protocol 100%
        case 0x15: return 0xD6;        //Skills Use Fix 100%
        case 0x11: return 0xDC;        //Attack Protocol 100%
    }
    return Tipo;
}

Client-side code (Using official WebZen client: MU1_03E_full_ENG)

004639D6  /$ 55             PUSH EBP
004639D7  |. 8BEC           MOV EBP,ESP
004639D9  |. 51             PUSH ECX
004639DA  |. 894D FC        MOV DWORD PTR SS:[EBP-4],ECX
004639DD  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
004639E0  |. 83B8 E4900000 >CMP DWORD PTR DS:[EAX+90E4],0
004639E7  |. 74 18          JE SHORT main2.00463A01
004639E9  |. 8B4D FC        MOV ECX,DWORD PTR SS:[EBP-4]
004639EC  |. 83B9 E4900000 >CMP DWORD PTR DS:[ECX+90E4],1
004639F3  |. 74 0C          JE SHORT main2.00463A01
004639F5  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]
004639F8  |. 83BA E4900000 >CMP DWORD PTR DS:[EDX+90E4],3
004639FF  |. 75 02          JNZ SHORT main2.00463A03
00463A01  |> EB 21          JMP SHORT main2.00463A24
00463A03  |> 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
00463A06  |. 83B8 E4900000 >CMP DWORD PTR DS:[EAX+90E4],5
00463A0D  |. 75 02          JNZ SHORT main2.00463A11
00463A0F  |. EB 13          JMP SHORT main2.00463A24

<--- Change Tt To  ---> // To disable CMStarterCore check

004639D6  /$ 55             PUSH EBP
004639D7  |. 8BEC           MOV EBP,ESP
004639D9  |. 51             PUSH ECX
004639DA  |. 894D FC        MOV DWORD PTR SS:[EBP-4],ECX
004639DD  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
004639E0  |. 83B8 E4900000 >CMP DWORD PTR DS:[EAX+90E4],0
004639E7  |. 74 18          JE SHORT main2.00463A01
004639E9  |. 8B4D FC        MOV ECX,DWORD PTR SS:[EBP-4]
004639EC  |. 83B9 E4900000 >CMP DWORD PTR DS:[ECX+90E4],1
004639F3  |. 74 0C          JE SHORT main2.00463A01
004639F5  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]
004639F8  |. 83BA E4900000 >CMP DWORD PTR DS:[EDX+90E4],3
004639FF  |. 75 02          JNZ SHORT main2.00463A03
00463A01  |> EB 21          JMP SHORT main2.00463A24
00463A03  |> 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
00463A06  |. 83B8 E4900000 >CMP DWORD PTR DS:[EAX+90E4],5
00463A0D     90             NOP
00463A0E     90             NOP
00463A0F  |. EB 13          JMP SHORT main_tes.00463A24

------------------------------------------------------------------------------------------------

0040BFA9  /. 55             PUSH EBP
0040BFAA  |. 8BEC           MOV EBP,ESP
0040BFAC  |. 51             PUSH ECX
0040BFAD  |. 894D FC        MOV DWORD PTR SS:[EBP-4],ECX
0040BFB0  |. 6A 00          PUSH 0
0040BFB2  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
0040BFB5  |. 8B88 50030000  MOV ECX,DWORD PTR DS:[EAX+354]
0040BFBB  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]
0040BFBE  |. 8B82 50030000  MOV EAX,DWORD PTR DS:[EDX+354]
0040BFC4  |. 8B10           MOV EDX,DWORD PTR DS:[EAX]
0040BFC6  |. FF52 18        CALL DWORD PTR DS:[EDX+30]
0040BFC9  |. 6A 00          PUSH 0
0040BFCB  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
0040BFCE  |. 8B88 54030000  MOV ECX,DWORD PTR DS:[EAX+354]
0040BFD4  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]
0040BFD7  |. 8B82 54030000  MOV EAX,DWORD PTR DS:[EDX+354]
0040BFDD  |. 8B10           MOV EDX,DWORD PTR DS:[EAX]
0040BFDF  |. FF52 18        CALL DWORD PTR DS:[EDX+18]
0040BFE2  |. 8BE5           MOV ESP,EBP
0040BFE4  |. 5D             POP EBP
0040BFE5  \. C2 0800        RETN 8

<--- Change Tt To  ---> // Allow put your login on the Account box

0040BFA9  /. 55             PUSH EBP
0040BFAA  |. 8BEC           MOV EBP,ESP
0040BFAC  |. 51             PUSH ECX
0040BFAD  |. 894D FC        MOV DWORD PTR SS:[EBP-4],ECX
0040BFB0  |. 6A 00          PUSH 0
0040BFB2  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
0040BFB5  |. 8B88 50030000  MOV ECX,DWORD PTR DS:[EAX+350]
0040BFBB  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]
0040BFBE  |. 8B82 50030000  MOV EAX,DWORD PTR DS:[EDX+350]
0040BFC4  |. 8B10           MOV EDX,DWORD PTR DS:[EAX]
0040BFC6  |. FF52 18        CALL DWORD PTR DS:[EDX+18]
0040BFC9  |. 6A 00          PUSH 0
0040BFCB  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
0040BFCE  |. 8B88 54030000  MOV ECX,DWORD PTR DS:[EAX+354]
0040BFD4  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]
0040BFD7  |. 8B82 54030000  MOV EAX,DWORD PTR DS:[EDX+354]
0040BFDD  |. 8B10           MOV EDX,DWORD PTR DS:[EAX]
0040BFDF  |. FF52 18        CALL DWORD PTR DS:[EDX+18]
0040BFE2  |. 8BE5           MOV ESP,EBP
0040BFE4  |. 5D             POP EBP
0040BFE5  \. C2 0800        RETN 8

------------------------------------------------------------------------------------------------

0040BA9F     6A 01          PUSH 1
0040BAA1     6A 0A          PUSH 0A
0040BAA3     6A 0E          PUSH 0E
0040BAA5  |. 68 8C000000    PUSH 8C
0040BAAA  |. 8B0D 8CB00808  MOV ECX,DWORD PTR DS:[808B08C]
0040BAB0  |. 51             PUSH ECX
0040BAB1  |. 8B55 D8        MOV EDX,DWORD PTR SS:[EBP-28]
0040BAB4  |. 8B8A 50030000  MOV ECX,DWORD PTR DS:[EDX+350]
0040BABA  |. 8B45 D8        MOV EAX,DWORD PTR SS:[EBP-28]
0040BABD  |. 8B90 50030000  MOV EDX,DWORD PTR DS:[EAX+350]
0040BAC3  |. 8B02           MOV EAX,DWORD PTR DS:[EDX]
0040BAC5  |. FF50 2C        CALL DWORD PTR DS:[EAX+2C]

<--- Change Tt To  ---> // Turn Account box text visible (without *'s)

0040BA9F     6A 01          PUSH 0
0040BAA1     6A 0A          PUSH 0A
0040BAA3     6A 0E          PUSH 0E
0040BAA5  |. 68 8C000000    PUSH 8C
0040BAAA  |. 8B0D 8CB00808  MOV ECX,DWORD PTR DS:[808B08C]
0040BAB0  |. 51             PUSH ECX
0040BAB1  |. 8B55 D8        MOV EDX,DWORD PTR SS:[EBP-28]
0040BAB4  |. 8B8A 50030000  MOV ECX,DWORD PTR DS:[EDX+350]
0040BABA  |. 8B45 D8        MOV EAX,DWORD PTR SS:[EBP-28]
0040BABD  |. 8B90 50030000  MOV EDX,DWORD PTR DS:[EAX+350]
0040BAC3  |. 8B02           MOV EAX,DWORD PTR DS:[EDX]
0040BAC5  |. FF50 2C        CALL DWORD PTR DS:[EAX+2C]

Link to the official GMO Season4 WebZen Client:
News: Global MU Online English Client (Season 4) - GamersHell.com


I hope you enjoy! And please, respect credits!

(My MuServer with GMO Client is working perfect and I will release it soon. My GameServer have kundun drop fix and CashShop Bug fixed! Wait for it!)

Credits:
- HueyGTO (me) for the idea, research it and code it! :)
- Zemattana with the login fix for eng protocol on server side.

[MentaL]

[KarLi]

Approved ;)

[guitarsjam]

sweet job

[Crazzy]

Respect man=)

[Mulegend]

Great Y_Y

[Kiosani]

My respect for you HueyGTO and for Zemattana, 2 Legends!, and Thanks.

PS: Would it be possible, that you add to main.exe v1.03E (Eng) Global Mu Online, 3D Camera, Sky, and Mini-Maps (Radar Style such as AriethMu)?

[buffon]

(My MuServer with GMO Client is working perfect and I will release it soon. My GameServer have kundun drop fix and CashShop Bug fixed! Wait for it!)

waiting =)

[ma-3x]

Season 4.5 or Season 4.6
Anyway that's cool, thanks!

[mauka]

was posted long time ago on rz

[alpg07]

was posted long time ago on rz

Are you kidding?
This is an exclusive (first time) release. From what I know, nobody could do it ... and release it.

Enjoy :D

[SilentMu]

Nice release, waiting for complete muserver :)

[Off] Vai abrir seu server de novo agora nas férias Huey?

[alpg07]

I will release the complete muserver soon, maybe before christmas. :D

[Off] Provavelmente irei abrir um servidor hard (20x) usando esse novo protocolo e os arquivos que irei liberar aqui.

P.S.: 1.03e Eng main.exe with mini-map coded. Credits: me. Will release it soon too.

[Bason4ik]

HueyGTO,if i remember,you post this on "gameserver 1.00.90" topic...or something like this)

[alpg07]

But I dont post my sources and how to make it works. :D

[JoniverPH]

Waiting for GMO to be Season 6