v83 Client Hack Addresses

[Morty]

Hello,

I'm currently attempting to edit the HD Client provided on the forums because it is missing client hacks such as Text Spam,UFJ,Damage Cap Removal but I have searched everywhere on the forums and haven't found anyone that has posted them.

I've already figured out how to add Unlimited Flash Jump but I'm not sure what I can do for the others. Also, for some reason the client doesn't have a capped speed so that means you can have speed hacks if you have max speed.


I'm wondering if someone could help me on this I would very much appreciate it.

 

[izarooni]

If you want help figuring out how to find the addresses for those, STREDIT helps a lot by telling us the address of where certain StringPools are used.

You can find the restrictions for text spam in CChatHelper::TryChat and CField::SendChatMsg
The StringPool to find these are

891	Repeating the same line over and over\r\ncan negatively affect other users.	False	False	Unknown	-
892	Too much chatting can disrupt\r\nother players' ability to play the game.	False	False	Unknown	-
893	You are currently blocked from chatting.	False	True	GetStringW	0049051A

The 891 and 892 addresses are unspecific however, StringPools are typically called by the push instruction (specifically opcode 68) and the StringPool ID in big-endian format followed by a StringPool::GetString call. We can use IDA to find the AOB (array of bytes) for these via Search > sequence of bytes (ALT+B) and make sure Hex is selected. Now searching for 68 7B 03 00 00 gives me two results. They would typically just be named after the addresses they're located at however I have them named.

After double-clicking on a result to go to that location you'll see that after the push 37Bh instruction there is an immediate jmp to a StringPool::GetInstance call. All we have to do is change the jmp destination address to prevent the "Repeating the same line over and over\r\ncan negatively affect other users." popup dialogue.

As for damage capacity, the value is stored as a double at the address 00AFE8A0. The easy way to find this is to figure out what your damage cap is (easiest way probably being using some cheat engine table or trainer if those still exist) then search then using something like

To view the content, you need to sign in or register

, check "Swap endianness" and enter your damage capacity into the "Double value" text box. If for example your max damage is 1,333,333,337 then your hex value should be 0x0000405643ded341 and if correct, in your client it should look like: 00 00 40 56 43 DE D3 41. Change the value to whatever you like.

 

[Morty]

If you want help figuring out how to find the addresses for those, STREDIT helps a lot by telling us the address of where certain StringPools are used.

You can find the restrictions for text spam in CChatHelper::TryChat and CField::SendChatMsg
The StringPool to find these are

891	Repeating the same line over and over\r\ncan negatively affect other users.	False	False	Unknown	-
892	Too much chatting can disrupt\r\nother players' ability to play the game.	False	False	Unknown	-
893	You are currently blocked from chatting.	False	True	GetStringW	0049051A

The 891 and 892 addresses are unspecific however, StringPools are typically called by the push instruction (specifically opcode 68) and the StringPool ID in big-endian format followed by a StringPool::GetString call. We can use IDA to find the AOB (array of bytes) for these via Search > sequence of bytes (ALT+B) and make sure Hex is selected. Now searching for 68 7B 03 00 00 gives me two results. They would typically just be named after the addresses they're located at however I have them named.

After double-clicking on a result to go to that location you'll see that after the push 37Bh instruction there is an immediate jmp to a StringPool::GetInstance call. All we have to do is change the jmp destination address to prevent the "Repeating the same line over and over\r\ncan negatively affect other users." popup dialogue.

As for damage capacity, the value is stored as a double at the address 00AFE8A0. The easy way to find this is to figure out what your damage cap is (easiest way probably being using some cheat engine table or trainer if those still exist) then search then using something like

To view the content, you need to sign in or register

, check "Swap endianness" and enter your damage capacity into the "Double value" text box. If for example your max damage is 1,333,333,337 then your hex value should be 0x0000405643ded341 and if correct, in your client it should look like: 00 00 40 56 43 DE D3 41. Change the value to whatever you like.

Oh sweet, I actually managed to figure out the damage cap thing on my own. Also I just added the spam chat address and tested it, thank you!


If I may, another thing that I can't figure out is the speed/jump cap. For some reason the more speed you have the faster your player will go...I'm wondering if it's possible to cap it at the average max speed? Image:

To view the content, you need to sign in or register

Thank you again.

 

[izarooni]

I'm not entirely sure but you may wanna check the double values being retrieved in the function 009CB992.
This is entirely my assumption but according to the encoded movement packets in v83 for example type 0, the first 8 bytes are encoded as follows:

COutPacket::Encode2(v4, *(v9 + 1));
COutPacket::Encode2(v4, *(v9 + 2));
COutPacket::Encode2(v4, *(v9 + 3));
COutPacket::Encode2(v4, *(v9 + 4));
COutPacket::Encode2(v4, *(v9 + 6));

Where the first 2 Encode2 calls is the location of the character and the next 2 is (under my assumption and testing) the velocity. The v9 variable is a pointer to a CMovePath structure

v9 = *(this + 28);

therefore my assumption is the velocity of the character is around the structure offset of 30 bytes.

After some x-referencing some functions of CMovePath I got to a function located at 009CB992 and modifying the value at 009CB9C9 changes the velocity that my character moves in game. I don't really know what's going on but I might suggest looking around there using cmp instructions and setting max values.

 

[Angxl]

I too wondered the same when it came to the HeavenMS client so I did some quick research and found these.

//Speed Cap
00780743 - C7 45 08 E7030000     - mov [ebp+08],000003E7 { 999 }
008C4286 - BE E7030000           - mov esi,000003E7 { 999 }


//Jump Cap
00780797 - 83 F8 7F              - cmp eax,7F { 127 }
0078079C - 6A 7F                 - push 7F { 127 }
008C42A3 - 83 F8 7F              - cmp eax,7F { 127 }
008C42A8 - 6A 7F                 - push 7F { 127 }

If decreasing these does nothing then it wouldn't be a huge surprise to me; when I increased the speed & jump cap at these addresses on my own client it was still capped, so other than these I wouldn't know. I'm not too huge on client editing but it's all I could find/would care to try and find.

 

[Morty]

I'm not entirely sure but you may wanna check the double values being retrieved in the function 009CB992.
This is entirely my assumption but according to the encoded movement packets in v83 for example type 0, the first 8 bytes are encoded as follows:

COutPacket::Encode2(v4, *(v9 + 1));
COutPacket::Encode2(v4, *(v9 + 2));
COutPacket::Encode2(v4, *(v9 + 3));
COutPacket::Encode2(v4, *(v9 + 4));
COutPacket::Encode2(v4, *(v9 + 6));

Where the first 2 Encode2 calls is the location of the character and the next 2 is (under my assumption and testing) the velocity. The v9 variable is a pointer to a CMovePath structure

v9 = *(this + 28);

therefore my assumption is the velocity of the character is around the structure offset of 30 bytes.

After some x-referencing some functions of CMovePath I got to a function located at 009CB992 and modifying the value at 009CB9C9 changes the velocity that my character moves in game. I don't really know what's going on but I might suggest looking around there using cmp instructions and setting max values.

I think it has more to do with the client capping the speed to 77777% instead of the original cap 124% (if I remember correctly). I'm not good at client-editting as I've only started working on the client yesterday but I do have all hack addresses on my client now and the only thing missing right now is this speed/jump issue.

I've tried comparing the addresses you've given me with other clients and didn't see anything that would help. I'm still having trouble finding where exactly this value is in the client.



Update: I fixed it and as I expected it turns out it did have to do with the client capping it at 77x%....Still a weird fix.

Also for anyone else reading this and want the addresses for speed. (use HxD for this)

00380746
4C4287
54D91F

Thanks to all who helped.

 

[Morty]

@Angxl izarooni

One last thing if you guys can help me with or anyone else, there's the party pop-up that appears whenever you level up. Ex:

To view the content, you need to sign in or register

I've tried following what Eric posted here http://forum.ragezone.com/f923/request-v83-popup-removal-1131339/#post8785880 and removing the nodes just removes the name of the party quest when it popups up and it also crashes you when you press "O" to open it.

So it makes me think that it's more of a client-sided issue, I'm not sure how I would get the address for them. :/

 

[Angxl]

@Angxl @izarooni

One last thing if you guys can help me with or anyone else, there's the party pop-up that appears whenever you level up. Ex:

To view the content, you need to sign in or register

I've tried following what @Eric posted here http://forum.ragezone.com/f923/request-v83-popup-removal-1131339/#post8785880 and removing the nodes just removes the name of the party quest when it popups up and it also crashes you when you press "O" to open it.

So it makes me think that it's more of a client-sided issue, I'm not sure how I would get the address for them. :/

Well usually I like to keep things private but since it's something pretty basic and something that I feel should already be public:

005241B3 -> nop
005241E2 -> nop

Kinda strange to me since any client based on localhost by databus has these addresses untouched, but it's what I found so here ya go

 

[Morty]

Well usually I like to keep things private but since it's something pretty basic and something that I feel should already be public:

005241B3 -> nop
005241E2 -> nop

Kinda strange to me since any client based on localhost by databus has these addresses untouched, but it's what I found so here ya go

Sweet. I think I have every address needed in the client now.

Thank you again!

 

[PirateKing]

About the party quest pop up removal, when checking the addresses:

005241B3
005241E2

Both makes reference to CALL to another memory address so I'm not able to nop them. For example, address 005241B3
makes reference to CALL 0051F93D and 0051F93D has PUSH EB.

I tried to check a databus localhost based and it makes reference to the same memory addresses as my current local host. Any suggestion? Should I try something different?

Thank you.

 

[Feras]

About the party quest pop up removal, when checking the addresses:

005241B3
005241E2

Both makes reference to CALL to another memory address so I'm not able to nop them. For example, address 005241B3
makes reference to CALL 0051F93D and 0051F93D has PUSH EB.

I tried to check a databus localhost based and it makes reference to the same memory addresses as my current local host. Any suggestion? Should I try something different?

Thank you.

Try A1FED4 -> jmp A1FF18

 

[PirateKing]

Repeated post from the below one.

 

[PirateKing]

About removing the "spam chat" verification, I've successfully found the address just like izarooni showed the way and understood why we have to change the memory address of the jmp. I'm just kind lost on how do I find out which memory address should I replace with the existing jmp destination?

My first thought was follow the current jmp destination and get the last action done in this routine and replace with this address. But I couldn't make it work. Basically, this is the memory addresses related to what I want to update:

push    37Bh
jmp     loc_490586 ; This is  the current jmp destination

And this is the jump destination:

loc_490586:
push    eax
call    sub_79E805 ; I believe this is something related to StringPool (?)
mov     ecx, eax 
call    sub_406455 ; Not sure, but also something related to StringPool (?)
call    sub_9929DD ; I believe this is where the message is called to be displayed (?)
add     esp, 14h
xor     esi, esi
jmp     loc_49068B ; This is where I tried to use to replace the current jmp destination

So, what I've tried to do is change loc_490586 (current one) to loc_49068B but I couldn't make it work.

Can anyone help me find another way to figure it out or share a different line of reasoning to deal with the issue?

Thank you.

 

[Darter]

About removing the "spam chat" verification, I've successfully found the address just like izarooni showed the way and understood why we have to change the memory address of the jmp. I'm just kind lost on how do I find out which memory address should I replace with the existing jmp destination?

My first thought was follow the current jmp destination and get the last action done in this routine and replace with this address. But I couldn't make it work. Basically, this is the memory addresses related to what I want to update:

push    37Bh
jmp     loc_490586 ; This is  the current jmp destination

And this is the jump destination:

loc_490586:
push    eax
call    sub_79E805 ; I believe this is something related to StringPool (?)
mov     ecx, eax 
call    sub_406455 ; Not sure, but also something related to StringPool (?)
call    sub_9929DD ; I believe this is where the message is called to be displayed (?)
add     esp, 14h
xor     esi, esi
jmp     loc_49068B ; This is where I tried to use to replace the current jmp destination

So, what I've tried to do is change loc_490586 (current one) to loc_49068B but I couldn't make it work.

Can anyone help me find another way to figure it out or share a different line of reasoning to deal with the issue?

Thank you.

Try this I cant test right. Let me know results if it works ill explain

	*((BYTE*)0x004905EB) = 0xEB;

 

[PirateKing]

Try this I cant test right. Let me know results if it works ill explain

    *((BYTE*)0x004905EB) = 0xEB;

Edit: It worked, thank you!