sorry, been MIA for a while :(
To answer your question, yes getting 13 is possible. If you've ever cheated the dice roll back in the day through CE
(see here), you would do so by manipulating the randomizer to always return the index of the stat (e.g 0 = str, 1 = dex, etc). What this did was when the client processes through the RNG, the value will always be added to that stat index +1 (all stats are always initialized to 4).
The way it works:
1. Initializes STR/DEX/INT/LUK to 4/4/4/4.
2. Executes a 9-iteration forloop.
3. Within the forloop, an index is randomized: rand() / 4, rand() % 4.
4. On the chosen index, add to the stat base +1.
Therefore, if you have 4 different stats, and can increase the stat 9 additional times, then to roll a 13 is a 1 in 36 chance (1/36 => 0.02%)
(see here). Not sure where your friend got 0.14 or 0.0014 from, of which is either too high or too low. Unless Nexon changed it at some other point in time, 1/36/2 = 0.0138 = 0.014, but idk.
EDIT: Confirmed same formula from v1-v63. It's the same from v62 down to v49 down to v28, so it's never changed across versions.
Since you're working with v62 @
Kimberly in case you're curious, the address to dice roll processing in the client is
005827AB.
Pseudocode:
PHP Code:
int __thiscall CUINewCharAvatarSelect::OnDiceRoll(int this)
{
int v1; // esi@1
signed int v2; // edi@1
int v3; // eax@2
int result; // eax@2
int v5; // edx@2
signed __int64 v6; // qtt@2
int v7; // edx@3
int v8; // edx@4
unsigned int v9; // eax@6
unsigned int v10; // eax@7
unsigned int v11; // eax@8
unsigned int v12; // eax@9
signed int v13; // [sp+10h] [bp-4h]@1
v1 = this;
v2 = this + 148;
*(this + 156) = ZtlSecureTear_int_(4, this + 148);// STR
*(v1 + 168) = ZtlSecureTear_int_(4, v1 + 160);// DEX
*(v1 + 180) = ZtlSecureTear_int_(4, v1 + 172);// INT
*(v1 + 192) = ZtlSecureTear_int_(4, v1 + 184);// LUK
v13 = 9;
do
{
v3 = rand();
v6 = v3;
result = v3 / 4;
v5 = v6 % 4;
if ( v5 )
{
v7 = v5 - 1;
if ( v7 )
{
v8 = v7 - 1;
if ( v8 )
{
if ( v8 == 1 )
{
v9 = ZtlSecureFuse_int_(v1 + 184, *(v1 + 192));
result = ZtlSecureTear_int_(v9 + 1, v1 + 184);
*(v1 + 192) = result;
}
}
else
{
v10 = ZtlSecureFuse_int_(v1 + 172, *(v1 + 180));
result = ZtlSecureTear_int_(v10 + 1, v1 + 172);
*(v1 + 180) = result;
}
}
else
{
v11 = ZtlSecureFuse_int_(v1 + 160, *(v1 + 168));
result = ZtlSecureTear_int_(v11 + 1, v1 + 160);
*(v1 + 168) = result;
}
}
else
{
v12 = ZtlSecureFuse_int_(v2, *(v1 + 156));
result = ZtlSecureTear_int_(v12 + 1, v2);
*(v1 + 156) = result;
}
--v13;
}
while ( v13 );
return result;
}
I agree though, would be cool to see someone who's gotten this legitimately; that's crazy lucky! Anywho, hope this helps :)
