How to change quest rewards

[Eliana Gherbaz]

I searched on forum to see if this was answered before, I found 2 threads that ask for help on how to do it:
http://forum.ragezone.com/f400/help-...2/#post7317425
http://forum.ragezone.com/f400/drop-...-quest-883589/

none of them got an accuracy answer and because those threads are from 2012 and @xonote request me for help on this in a PM, I decided to make a new thread instead of revive one of those threads.

the request is as follow:
Hii.. Eliana,
...... I want to edit main quest reward but, I dont know where and what I suppose to do. Can you help me?

Thank you before,

So if we talk about Quest, we have TUTORIAL,MAIN, and SCROLL quests.
Changing rewards for Scroll ones is as simple as editing/adding on the Pay tab of the HTScrollQuestSystem.xml. If you are adding new lines on the Pay tab, then you have to put the iNo of the Pay you created in the iPay column of the QuestMain tab in the step where you want the reward to be given.

Changing TUTORIAL,MAIN quest rewards unfortunately is not that simple, because the rewards for those quest are hard coded in the ZoneSrv.exe, meaning that you do not have a xml file to edit, you must edit the ZoneSrv.exe, so in this tuto I will explain how I found in the ZoneSrv.exe the lines that needs to be change. As I always say: my offsets probably are not the same as yours, so dont change yours if they do not contains same opcode than mine, if the opcode is not the same, then just find your own offset same way I will show I did to find mines. Of course I will not example changing all the quest rewards because they are a lot, I will just example 1 of them.

Things you need to know before doing the search:
1- which is the NPC ID who gives the reward
2- the reward(s) ID and the amount

Lets explain some basic things for understanding ASM opcodes
- when a method require parameters/arguments ASM opcodes will look this way:
PUSH some
CALL method address
so if there is only 1 PUSH before the CALL means that method only have 1 argument/parameter
in high level code that is same as:

public void methodName(object arg1)
{
code here of what this method do......
}
if there are more PUSH then means that the method have more args, for example with 2 PUSH the method will be like this:
public void methodName(object arg1,object arg2)
{
code here of what this method do......
}

So, when server gives the rewards for a quest, it needs :
if the reward is an item:
arg1= the user connection ID
arg2= the item ID
arg3= the amount of that item that will be given
(then we need at least 3 PUSH before the CALL)

if it is money (ruphias):
arg1= the user connection ID
arg2= the amount of rups.
(then we need at least 2 PUSH before the CALL)

if it is pranas (exp)
arg1= the amount of pranas

So lets put in action the search with the quest #32 = Test of Destruction
what I know about the quest:
1- I need to talk with Monk Iddungddashu in Jina, ID for Monk Iddungddashu=1128 in Hex=468
2- Monk Iddungddashu will give me the item Test Proof, ID=8070, Hex= 1F86, amount 1.
3- and on the step 5, server will remove the items 8063,8064,8065 (1F7F,1F80,1F81) and will give me a Broken Sword, ID=8066, Hex=1F82, amount 1.

Because the method on the server controls the quest with a switch on the NPC ID and then another switch on the quest step, my first try on the search will be with "Case 468 of switch" and repeat the search to see if there is more than 1 offset that contains that text, after ensure that there is only 1 offset with that search, then I will go down on the code to find the offset for the next switch, and because I know that the reward is on the step 5 I will look on the code to find some like "Case 5 of switch ADDRESS", moving down on the code from that point I will search for PUSH 1F82 and that will give you the offset of the reward. For those who didn't read my post: http://forum.ragezone.com/f786/advan...9/#post8734531 read it so you will know what i do to dump a module to a txt file to simplify the search, in that post is a video where I dump htlauncher, in this case you need to dump ZoneSrv.exe not HTLauncher.exe, so open Ollydbg, then File/Open and search for your ZoneSrv.exe, after is opened be sure to change View to the Module ZONESRV2, then make the dump.

I always say that changing things on the .exe files w/o knowing if the change may cause problems, is not a good practice, in this case (quests) changing a reward for another one, may cause a problem if there is another quest that require that Item. for example in this specific quest, the Broken Sword is required in another quest, so if you decide to change a reward for another one be sure to replace it too on the offset that removes it from your inventory.

For those that, prefer a visual way to learn things instead of reading, I will record a video showing the search I explained here.

- - - Updated - - -

In advance sorry for my English audio, my native language is Spanish so dont be rude with me on that

[MentaL]

[xonote]

Owhh thank you for this,
Do you know about Tantra Surya? They have changed the main quest reward with x5 gold and 5x Prana Exp.
Of course, your tutorial is very nice but, if I looking at what Tantra Surya did it's looks impossible to do. There are a lot of quest right?
And if they did as you did, I have to say they are very diligently. It's can be very hard work to edit all of main quest reward.

Is it there possibility an easier way?

[Eliana Gherbaz]

Owhh thank you for this,
Do you know about Tantra Surya? They have changed the main quest reward with x5 gold and 5x Prana Exp.
Of course, your tutorial is very nice but, if I looking at what Tantra Surya did it's looks impossible to do. There are a lot of quest right?
And if they did as you did, I have to say they are very diligently. It's can be very hard work to edit all of main quest reward.

Is it there possibility an easier way?

Hi, I dont know what they did, but as I said to you on one PM, the rewards (items, pranas, rups) are hard coded in the ZoneSrv.exe, so for me, there are 4 ways to change them:

1.- by Hex editing the PUSHs in the ZoneSrv.exe
2.- by making a custom .dll that override the actual server code.
3.- by adding opcodes lines to the .exe that multiply the amount before the CALL is done.
4.- by making a tool that replaces the values for me.

See, it is not hard when you know exactly what you are looking for, let me show you:


That is a part of the opcodes for the quest #36 Entry To Jina Fortress, on that quest in my server you will receive x60 (3C) Utara Panaka 7010 (1B62) + 50000 rups (0C350) + 20000 pranas (4E20)
as you may see below the:
PUSH 1B62 there is a call to a method address: in my server that is:
CALL ZONESRV2.0043E250 so this is for give item

below PUSH 0C350 there is a call to a method address: in my server that is:
CALL ZONESRV2.0043E760 so this is for give ruphias

below PUSH 4E20 there is a call to a method address: in my server that is:
CALL ZONESRV2.00413F20 so this is for give pranas

So if I want to change Item rewards I can just search for every place where CALL ZONESRV2.0043E250 is then look up for the PUSH and change it.

If I want to change ruphias reward then I can just search for every place where CALL ZONESRV2.0043E760 is and if the CALL is within the method offset*(begin and end, that in my case begins on 4403c0 and ends in 45261c) then look up for the PUSH and change it.

And the same for pranas*.

Of course if I was you and want to change ALL the rups/pranas rewards, I will not waste my time by Hex editing the .exe one by one, I will just make a tool which do that for me, by binary reading the ZoneSrv.exe, finding the places where the change have to go, replacing the values, and binary saving the modified ZoneSrv

*this is because those methods are used too in other places not just on the quest rewards.

[A v a r a]

Hi, I dont know what they did, but as I said to you on one PM, the rewards (items, pranas, rups) are hard coded in the ZoneSrv.exe, so for me, there are 4 ways to change them:

1.- by Hex editing the PUSHs in the ZoneSrv.exe
2.- by making a custom .dll that override the actual server code.
3.- by adding opcodes lines to the .exe that multiply the amount before the CALL is done.
4.- by making a tool that replaces the values for me.

See, it is not hard when you know exactly what you are looking for, let me show you:


That is a part of the opcodes for the quest #36 Entry To Jina Fortress, on that quest in my server you will receive x60 (3C) Utara Panaka 7010 (1B62) + 50000 rups (0C350) + 20000 pranas (4E20)
as you may see below the:
PUSH 1B62 there is a call to a method address: in my server that is:
CALL ZONESRV2.0043E250 so this is for give item

below PUSH 0C350 there is a call to a method address: in my server that is:
CALL ZONESRV2.0043E760 so this is for give ruphias

below PUSH 4E20 there is a call to a method address: in my server that is:
CALL ZONESRV2.00413F20 so this is for give pranas

So if I want to change Item rewards I can just search for every place where CALL ZONESRV2.0043E250 is then look up for the PUSH and change it.

If I want to change ruphias reward then I can just search for every place where CALL ZONESRV2.0043E760 is and if the CALL is within the method offset*(begin and end, that in my case begins on 4403c0 and ends in 45261c) then look up for the PUSH and change it.

And the same for pranas*.

Of course if I was you and want to change ALL the rups/pranas rewards, I will not waste my time by Hex editing the .exe one by one, I will just make a tool which do that for me, by binary reading the ZoneSrv.exe, finding the places where the change have to go, replacing the values, and binary saving the modified ZoneSrv

*this is because those methods are used too in other places not just on the quest rewards.

Weird, My ZoneSRV don't have this kind of comments in the right that says "Case..." Why?

[Eliana Gherbaz]

Weird, My ZoneSRV don't have this kind of comments in the right that says "Case..." Why?

Ctrl+A on Ollydbg CPU

[A v a r a]

Ctrl+A on Ollydbg CPU

Btw where do I start if I want to change the level or at least regulate the Master Disciple feature? Thanks for your response.

[Eliana Gherbaz]

To change the lvl just search for the restriction of lvl 60 and change it.
Dont know what else you mean with regulate it.

[A v a r a]

To change the lvl just search for the restriction of lvl 60 and change it.
Dont know what else you mean with regulate it.

So for "60" that is equal to "3C" and what NPC should I search in order for me to accurately change this in my ZONE.EXE?

[Eliana Gherbaz]

See ... that is why I say "changing w/o knowing", if you are asking for which NPC controls the Master Disciple, means that you dont even know how it works.

There is no NPC, it is a request from a client to another client, server handles the request and if the requester and the requested meets the requirements server process the request and dispatch it to the other client for the approval.

So what you need to search is for the request.

[A v a r a]

So what you need to search is for the request.

Uhmm...could be the request coming from the NPC.xml?

[Eliana Gherbaz]

NO NO you are not understanding me. Master and Disciple have nothing to do with NPC.xml

As I said it is a request, a request is when the client ask some to server to do, for example: drop is a request, start a quest is a request, start a trade is a request and so on, so what you need to find is the request ID on the server, then follow the code till you find the CMP opcode that compares with 60 and then change that is that is what you want to change (the lvl requirement for approval the request)

[A v a r a]

NO NO you are not understanding me. Master and Disciple have nothing to do with NPC.xml

As I said it is a request, a request is when the client ask some to server to do, for example: drop is a request, start a quest is a request, start a trade is a request and so on, so what you need to find is the request ID on the server, then follow the code till you find the CMP opcode that compares with 60 and then change that is that is what you want to change (the lvl requirement for approval the request)

Oh ok...so in order for me to get the request ID I need to use another program is that what you mean? or the request ID is located somewhere else in the files?

[Eliana Gherbaz]

you can find it by searching for the "Case" that contains the ID you are searching for, or by debugging the server on the switch that controls all the client requests.

[A v a r a]

Is this it?

Case 3C ('<') of switch 0044D917

[Eliana Gherbaz]

No is not

I think you need to learn first what code means, for example:
this is what a switch is:
https://msdn.microsoft.com/en-us/library/06tc147t.aspx

Then... in the game, the player makes request to server like this way:
switch (PlayerRequest)
{
case RequestCharList:
{ code to run };
break;
case RequestCharCreation:
{ code to run };
break;
.
.
.
.
.
case RequestMasterDisciple: <---------------this is the one you need to find
{
................ if(player.lvl <=60) --------> CMP xxx,3C <----------this is what you need to change if you want to change the lvl requirement, otherwhise, change the jumps.

}