Jump to content

Recommended Posts

Posted

Well i made this tutorial so that i can help at this part of client side modification.I know those all that i write have been already said in forum but well i hope this is more compiled and it can help both new and old members.Anyway there it goes...

 

1) Download the DecPack from HERE

 

2) Patch the system with patcher

 

3) Now we will decrypt the desired file.Lets say for example systemmsg-e.dat

Opem cmd.exe and type: l2encdec.exe -s systemmsg-e.dat

15vf3.jpg

 

and u will get this

 

width=640 height=294http://img212.imageshack.us/img212/8793/22du2.jpg[/img]

 

Now u will have a file named dec-systemmsg-e

 

4) Delete the systemmsg-e.dat and rename the dec-systemmsg-e.dat to systemmsg-e.dat

 

5) Now from the following part there are 3 ways to decode/encode the dat files,the two are with L2clientdat and the other with L2asm/disasm

 

 

Way 1

 

We will do this with L2Clientdat_en or L2Clientdatfull (its the same thing)

 

a) Open the L2ClientDat_en (of the pack folder) and do Decode of systemmsg-e.dat.Now u will get a txt file with name systemmsg-e.

 

32fy.jpg

 

b) Open the txt and change whatever u want

 

width=640 height=59http://img55.imageshack.us/img55/5774/47zv.jpg[/img]

 

c) Do your changes and save the txt

 

d) Open again L2ClientDat_en ,choose systemmsg-e and press encode

 

58yt.jpg

 

                              -----------------

Way 2

 

On way 2 we will use L2ClientDat.exe.

 

a) With the pack there are 2 folders with names "cn"and "en".There are the txt of some .dat files.Lets say u want to change something in the systemmsg-e.dat.

 

b) Open the txt inside the en folder and change the thing u want in the systemmsg-e.txt and save it

 

c) Open now the L2ClientDat.exe and choose from english the systemmsg-e.dat

 

asda8fv.jpg

 

d) Now press restore and u are done

 

                             ----------------------

Way 3

 

Now we will use l2asm/disasm

 

a) Open cmd.exe and type: l2disasm.exe -d c4\zonename-e.ddf zonename-e.dat zonename.txt   and u will get this

 

asdaaaaaa5jv.th.jpg

 

b) U will have now a txt with name zonename.txt.Open it and do the changes u want and save it

 

c) Now open cmd.exe and type this: l2asm.exe -d c4\zonename-e.ddf zonename.txt zonename-e.dat

 

atas1or.th.jpg

 

                                ----------------------

 

6) Now time for the header.When u will have the encoded files (using one of the 3 ways) u open cmd.exe and type this: l2encdec.exe -h 413 systemmsg-e.dat

 

width=640 height=308http://img55.imageshack.us/img55/631/60mv.jpg[/img]

 

With this u will get a file named enc-systemmsg-e (.dat file) and its the one we want

 

7) Delete the systemmsg-e.dat file that u have and rename enc-systemmsg-e to systemmsg-e (it must be 33,9 kb)

 

Ok thats it you are done.With this way u can change whatever .dat,.ini,.int files (for the .ini or .int files u dont need to decode/encode just decrypt-change-encrypt)

 

Note:Some ppl say that for those -s doesnt work on decryption.Try -g

 

Credits:Alexandros

source:postpacific

 

URL UPDATED!

  • 1 year later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Posts

    • First of all, I never challenged you at any point.   Second, congratulations—this is what you should have done from the start: shown how it worked, how to exploit it, etc. Now, let’s look at the facts:   The flaw requires the person to be the OWNER of the castle.   It requires the use of third-party programs or a modified client—and most private servers don’t even allow the use of modified clients, thanks to their anti-cheat systems.   Are you honestly certain that a castle owner on a private server would risk losing their account just to pull off this exploit? They’d have to be a complete idiot.   You’ve spent months going on about how you discovered a bug that has ZERO impact on the actual gameplay—congratulations.   I’m not saying that flaws are bad or that they shouldn’t be fixed—in fact, the flaw *was* fixed.   What I’m saying is that you’ve been harping on the same point for months, even though the issue had already been resolved in the closed branch.   It’s the prerogative of those who maintain the code to fix things however they see fit, don’t you think?   And learn this: when you report a bug, you MUST: 1- Report the bug (obviously) 2- Explain in detail how the bug occurs 3- Prove that the bug actually happens   And instead of contributing to the project through the proper, public channels, you chose to turn this into a whole circus—I’d just like to understand why...   It’s a good thing everyone in this thread will get to see who the "asshole" is.
    • To use this exploit you have to:   1) Have access to the castle vault, aka you have to own a castle. 2) Send through Adrenaline Engine.BypassToServer(Bypass) as emommy said 3) In the crafted packet you will put a negative amount eg -100000000 What this does is it multiplies it by -1 so it becomes positive. 4) You won't see anything in your inventory, but if you open the castle vault through the Chamberlain you will see that the warehouse now has 10000000 adena. The negative became positive. 5) Withdraw the adena normally and you now have all the adena you need.   I wouldn't bother explaining how to do it, but this idiot (Galagard) wanted to challenge me. And from what I can see, they haven't patched the exploit even if I reported it to them a week ago so it's obvious that people will start sharing it around.   Maybe I should start positing here instead of the official channels.   All public versions of L2JMobius for all chronicles are vulnerable and not patched yet.   And thanks to this idiot (Galagard), everyone now knows.   Baldurian. EDIT:    Ok I just got informed that Mobius decided to accept the fix in the public repo.   So I will now post a proof of the exploit as Galagard requested. Normally I don't do so, but my good friend Galagard who has his nose so far stuck up his asshole, insulted me, and challenged me to show proof:     And to be fair to everyone, this is not an L2JMobius issue as the thread claims. It's L2JServer leftover, so if you have L2JServer derivative packs, you should patch too. 
    • Already fixed in subscriber version, but this bug report is classified as "Invalid" because since the author did not explain the method in detail, the validation flaw does indeed exist—but that alone does not prove it is possible to duplicate adena or any other item by exploiting said flaw. It looks like yet another AI hallucinating a vulnerability, then deducing that it could be used to exploit a different vulnerability. No have proofs in video or a detailed way to reproduce the potential failure Go find something else to do, Baldurian; you don’t even know how to exploit the flaw you reported yourself.
    • Interface sources for P196 (Secret of Empire 2 or aka Fafurion) for Main/Classic. This protocol is commonly used for classic interlude. You can use the xdat editors which support this protocol from my other shares.   NWindow + Interface UC + L2Editor Compiler   Download  
    • Interface sources for P166 (Secret of Empire 1) for Main/Classic. This protocol is commonly used for classic interlude. You can use the xdat editors which support this protocol from my other shares.   NWindow + Interface UC + L2Editor Compiler   Download  
  • Topics

×
×
  • Create New...

Important Information

This community uses essential cookies to function properly. Non-essential cookies and third-party services are used only with your consent. Read our Privacy Policy and We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue..