[Guide] Proper "Proper Level" in Client

[osirus]

Hi All ^^,

Seems like the post that I made in here earlier was kinda pointless lool. Well it was a post that I wanted to make back 3 days ago, but RZ was down temporarily.

With regards to this post, this level cap thing is something I have been working on for the past 5 months now x.x. Yes, a long time I know lol. It all had its up and downs, and lots of downs. I asked around for help, but was not always answered T.T. Buttttttttt, my GF was always there to help me and give me motivation, and keep me going ^^. Bobsobol was there as well, to bounce ideas off and test my theories. And I will still say to Bob “I TOLD YOU IT WAS THE VALUES AT THE END OF TABLE” ^^. Loool, ty again for the help and putting up with my endless questions.

So I like to dedicate to this post GF for having the patience to put up with me @.@. And to Bob as well.

Let me tell you the secret that has led me to my goal: my strength lies solely in my tenacity. – Louis Pasteur

Do Unto Others As You Would Have Them Do Unto You - Matthew 7:12

I hope when the time comes and I ask one of you guys for help, I hope you will help me too ^^.

Okay now let’s start then. I will say it right now; I do not like to complicate matters. So I will tell you step by step details on what to do okay. And if you do it successfully, you will be fine. I used both StrangeFay and Microamazings guide to relocate the EXP table, and they are correct ^^. You guys have no idea how many exe I have made and trashed; I think it has been over 200+. Thank you for that StrangeFay and microamazing.

Also, I will be using the client that was posted by Macruz as a reference. The Exp table on it is already moved, but the concepts are still the same.

So lets begin.

-To fix up the level up ding.-

As mentioned before, there is a value that you will always see at the end client after a sequence of “FF FF FF FF FF FF FF FF FF”. As said before, those values are the true checksums responsible for the PROPER LEVEL UP !!!!

So if you look at the end of his client you will see this:



So the reason Macuz’s client does not have a proper “LEVEL UP” is since “53CD 9DAE 2149 6500” is not the proper checksum. So now, let’s fix this okay.

So now, place the client you are working on with your PT files where you normally load up PT. Install a copy of OllyDBG in that folder too. Next, open up your client in the OllyDBG that is in your PT Folder.

After that find your Exp Table again by using Ollydbg. Open up your client in OllyDbg. After it is loaded, right click and go to “Search For” -> “All Command Sequences”

  pop     edi
  mov     eax, 1
  pop     ebx
  retn
  push    ebp
  push    esi
  push    edi
  add     eax, 388C
  push    ebx
  push    eax

Scroll down and you should see the following code, which will be our focal point, the bolded ones in particular:

00447F68  |.  8B0D D0E45004 mov     ecx, dword ptr [450E4D0]
00447F6E  |.  3BC8          cmp     ecx, eax
00447F70  |.  75 6E         jnz     short 00447FE0
00447F72  |.  A1 D4E45004   mov     eax, dword ptr [450E4D4]
00447F77  |.  3BC2          cmp     eax, edx
00447F79  |.  75 65         jnz     short 00447FE0

So “00447F6E |. 3BC8 cmp ecx, eax” and “00447F77 |. 3BC2 cmp eax, edx” .

Okay now in Olly, go up top click the “Play” button. It looks like a typical “Play” button with a “Pause” button next to it. This should start loading up your client. Go ahead and log in and make a new character. I know a lot of you have a high xp server, but to get this right, you need to adjust your xp on your monsters to get it done fast. So I found level 5-8 easiest to do this fast ^^.

So after you logged in and level up your char so you are not over xp’ing, get your character to where your xp bar close to leveling up. Like 90% or 85% or something, such that killing the next monster will level you up. At this point, DO NOT KILL ANYTHING !!!

Now switch to olly. Click and highlight “00447F6E |. 3BC8 cmp ecx, eax” and then press F2. Bob said this is called an instructional offset. Do the same to “00447F77 |. 3BC2 cmp eax, edx” . It should look like the following.



We did this so we can catch the checksum that is generated. Now go back to your client, and kill that Hopy. And it should close out the client. Don’t panic when that happens. If you still have “00447F6E |. 3BC8 cmp ecx, eax” highlighted. You will see something in the box before like I have circled in red.



You see that ECX = AE9DCD53 while your EAX=5ED95A31 . What you need to do is to get EAX=ECX. So, the EAX is the first of your true checksum values. Now, take that and convert it to hex to become 315AD95E. Now close out Olly by going to File > Exit. Next open up your client in hex editor and apply your change.



Now boot up the client via Olly the same way as above, login, and right before level up, set the break points again at the 2 points mentioned above. Then level up again, and you will dc. This time you will see that your values for your EAX = ECX. Then exit out of Olly.

So now the first portion of your checksum is done. Now open up your client again in Olly and go back to the same point. This time our focus is “00447F77 |. 3BC2 cmp eax, edx”. So login and get your character to right before level up. But this time go back and only highlight “00447F77 |. 3BC2 cmp eax, edx” :



After level up you get what is in the image below. So this is your second value. So converting the EAX to hex you get 6A732600. Now close out of Olly and then hex edit in the value that you got.



If you want to double check, you can run it again via olly. It never hurts to double or triple check ^^.

With that, you guys are all done. Now you have a proper “Level UP” client. Sorry about the long text. But I hope I explained it all in a simple manner.

Make sure you follow StrangeFays guide prior to doing this one. If a lot of people are having issue, I may redo both StrangeFay's and mine, and combine it into a one complete guide. But I will see on what the response is. Hope this helps you guys.

[MentaL]

[bobsobol]

Thanks of this guide osirus. I think it all turned out good, but I know you've been doing this stuff for a long, long time. Longer than me. It's nice to see you getting your thoughts down on... err... pixel, and sharing them.

I asked around for help, but was not always answered T.T.

I believe that most of that lack of response was because nobody knew the right answer, or if they did, they didn't know how to put it in English words. I suspect Mazzei knew, and maybe StrangeFay, I'm sure rxacy knows too, as he suggested the checksum also, but perhaps he didn't know how it could be found? If zaharavn knows this, I suspect he is subject to some level of gaging from his team.

And I will still say to Bob “I TOLD YOU IT WAS THE VALUES AT THE END OF TABLE” ^^. Loool, ty again for the help and putting up with my endless questions.

You did, and you where right... TBH it wasn't till the word "checksum" turned up in the various posts that I understood what you where even talking about. I thought you meant the memory after the null area at the end of the table. :oops:

So I like to dedicate to this post GF for having the patience to put up with me @.@. And to Bob as well.

You are most welcome. You did a hell of a lot of grunt work here, and all I did was provide a couple of pointers and pulled you out of the quick sand when your brain was sinking... I wasn't stupid enough to jump into that mire, but you did it and survived.^_^

I hope when the time comes and I ask one of you guys for help, I hope you will help me too ^^.

I hope that this will always be the case with RZ members who share their findings.

I worked my trial on the checksum a little different... although we initially set breakpoints on the two compares, you while you where logged in and me before I start the execution, I later placed a single breakpoint after the Call, just above your listing.

The subroutine that is called returns the entire checksum in ECX and EDX... so after the call is returned, ECX and EDX already contain both parts of that 64-bit checksum, and you can fill in the memory after your table from them directly, in one pass.

That may be more difficult to explain, but it's a nice shortcut.

Other than that, this guide is great. I'm sure it will help a lot of people here out.

P.S. I should say hi to the GF while we're thanking her for the support. She is very good at that.

[Gregoo]

-----

[bobsobol]

That doesn't surprise me with your skill, but I assumed someone else actually did that in Frogg, because it's not like you not to post a quick answer, or note that a guide is in progress if you can... I guess you just missed the request.

Anyway... it's nice to see other people following your lead on the guides isn't it. I feel like we've started a movement, and, for me, the Let's Learn Together series is the start of it all. Clean guides that are easy to follow with "buckets of screenshots". FTW \o/

[zaharavn]

@orius good job. You post right about it. And i have reply private message from you. I think you don't have recived it. If you have problem. You can send e@mail to me: zahara@za-co.net or Y!M: zaharavn. See ya
@bobsobol i know it, and know how to have it. You can do with orius post it. I sure it :D

[bobsobol]

I'm just mad at people answering "Yes it's possible" without explaining, and when there's no guide posted.

Agreed. If you saw osirus posts, and knew the answer, you could have given a pointer or two, or said then that a guide was in the making. But, as I said before, you may have missed his questions.

Anyway. Teasing over. You are of course correct, a guide now exists and well done to osirus for doing the authorship.