Jump to content

Recommended Posts

Posted (edited)

I create this, in 2011.  Used with bot I also create (never release)

L2 Enumeration

Some will find useful, others will not understand.

SDK for more new version, not free... (meaning, you pay - and enough for me to care)

This is generated using the Unreal 2 engine, which is what Lineage II use.  If you share elsewhere, give me credit; not pretend you make it.

http://fyyre.ru/l2/ct2p3_sdk.rar

Edited by Fyyre
Posted
4 minutes ago, Designatix said:

With this i can find the packets used so i can change something i want?

Someone told me here if i can debug packets i can get what i want or something

 

Try UNetworkHandler, engine.dll -- however, SDK not for packets so much.  Already many tools to meddle with packets...

Posted
1 hour ago, Fyyre said:

 

Try UNetworkHandler, engine.dll -- however, SDK not for packets so much.  Already many tools to meddle with packets...

Alright, thank you mate

Posted (edited)
12 hours ago, lordofdest said:

Great work, Fyyre!

Maybe another tool can be useful for someone:

https://github.com/KN4CK3R/UnrealEngineSDKGenerator

Thanks for the link, lordofdest!  Getting all of this working was a massive headache, hopefully this make easier for people.

 

To the other fellow regarding packets, to be specific.  You can find more or less all you need via (this is Gracia Final, v83 client .. however, the point remains the same no matter client):

.text:1079D42C ; Exported entry 3846. ??_7UNetworkHandler@@6BUObject@@@
.text:1079D42C                 public const UNetworkHandler::`vftable'{for `UObject'}
.text:1079D42C const UNetworkHandler::`vftable'{for `UObject'} dd offset loc_103FCF0E
.text:1079D42C                                         ; DATA XREF: UNetworkHandler::~UNetworkHandler(void)+1Fo
.text:1079D42C                                         ; UNetworkHandler::UNetworkHandler(void)+2Eo ...
.text:1079D430                 dd offset UObject::AddRef(void)
.text:1079D434                 dd offset UObject::Release(void)
.text:1079D438                 dd offset sub_1038CE10
.text:1079D43C                 dd offset UObject::ProcessEvent(UFunction *,void *,void *)
.text:1079D440                 dd offset UObject::ProcessDelegate(FName,FScriptDelegate *,void *,void *)
.text:1079D444                 dd offset UObject::ProcessState(float)
.text:1079D448                 dd offset UObject::ProcessRemoteFunction(UFunction *,void *,FFrame *)
.text:1079D44C                 dd offset UObject::Modify(void)
.text:1079D450                 dd offset UObject::PostLoad(void)
.text:1079D454                 dd offset UNetworkHandler::Destroy(void)
.text:1079D458                 dd offset UObject::Serialize(FArchive &)
.text:1079D45C                 dd offset FArchive::GetCriticalSection(void)
.text:1079D460                 dd offset UObject::GotoState(FName)
.text:1079D464                 dd offset UObject::GotoLabel(FName)
.text:1079D468                 dd offset UObject::InitExecution(void)
.text:1079D46C                 dd offset UObject::ShutdownAfterError(void)
.text:1079D470                 dd offset UObject::PostEditChange(void)
.text:1079D474                 dd offset UObject::CallFunction(FFrame &,void * const,UFunction *)
.text:1079D478                 dd offset UObject::ScriptConsoleExec(ushort const *,FOutputDevice &,UObject *)
.text:1079D47C                 dd offset UObject::Register(void)
.text:1079D480                 dd offset UObject::LanguageChange(void)
.text:1079D484                 dd offset FFileStream::~FFileStream(void)
.text:1079D488                 dd offset FArchive::CountBytes(ulong,ulong)
.text:1079D48C                 dd offset UObject::Rename(ushort const *,UObject *)
.text:1079D490                 dd offset FArchive::AttachLazyLoader(FLazyLoader *)
.text:1079D494                 dd offset UObject::IsLoaded(void)
.text:1079D498                 dd offset UNetworkHandler::Tick(float)
.text:1079D49C                 dd offset UNetworkHandler::Init(int,UGameEngine *)
.text:1079D4A0                 dd offset UNetworkHandler::ServerPacketCountStart(void)
.text:1079D4A4                 dd offset UNetworkHandler::ServerPacketCountStop(void)
.text:1079D4A8                 dd offset UNetworkHandler::ServerExPacketCountStart(void)
.text:1079D4AC                 dd offset UNetworkHandler::ServerExPacketCountStop(void)
.text:1079D4B0                 dd offset UNetworkHandler::DispatchNetworkQueue(NetworkPacket * *)
.text:1079D4B4                 dd offset UNetworkHandler::AddNetworkQueue(NetworkPacket *)
.text:1079D4B8                 dd offset UNetworkHandler::GetServerID(void)
.text:1079D4BC                 dd offset UNetworkHandler::GetPetInfo(void)
.text:1079D4C0                 dd offset UNetworkHandler::GetUser(ushort *)
.text:1079D4C4                 dd offset UNetworkHandler::GetUser(int)
.text:1079D4C8                 dd offset UNetworkHandler::GetUserByNpcID(int)
.text:1079D4CC                 dd offset UNetworkHandler::SetMatchedStore(ushort *)
.text:1079D4D0                 dd offset UNetworkHandler::GetStaticObject(int)
.text:1079D4D4                 dd offset UNetworkHandler::GetItem(int)
.text:1079D4D8                 dd offset UNetworkHandler::GetVehicle(int)

This is the UNetworkHandler VMT.  It is exported from engine.dll, so finding it is always very easy... just look for:

??_7UNetworkHandler@@6BUObject@@@

 

Edited by Fyyre

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Posts

    • To use this exploit you have to:   1) Have access to the castle vault, aka you have to own a castle. 2) Send through Adrenaline Engine.BypassToServer(Bypass) as emommy said 3) In the crafted packet you will put a negative amount eg -100000000 What this does is it multiplies it by -1 so it becomes positive. 4) You won't see anything in your inventory, but if you open the castle vault through the Chamberlain you will see that the warehouse now has 10000000 adena. The negative became positive. 5) Withdraw the adena normally and you now have all the adena you need.   I wouldn't bother explaining how to do it, but this idiot (Galagard) wanted to challenge me. And from what I can see, they haven't patched the exploit even if I reported it to them a week ago so it's obvious that people will start sharing it around.   Maybe I should start positing here instead of the official channels.   All public versions of L2JMobius for all chronicles are vulnerable and not patched yet.   And thanks to this idiot (Galagard), everyone now knows.   Baldurian. EDIT:    Ok I just got informed that Mobius decided to accept the fix in the public repo.   So I will now post a proof of the exploit as Galagard requested. Normally I don't do so, but my good friend Galagard who has his nose so far stuck up his asshole, insulted me, and challenged me to show proof:     And to be fair to everyone, this is not an L2JMobius issue as the thread claims. It's L2JServer leftover, so if you have L2JServer derivative packs, you should patch too. 
    • Already fixed in subscriber version, but this bug report is classified as "Invalid" because since the author did not explain the method in detail, the validation flaw does indeed exist—but that alone does not prove it is possible to duplicate adena or any other item by exploiting said flaw. It looks like yet another AI hallucinating a vulnerability, then deducing that it could be used to exploit a different vulnerability. No have proofs in video or a detailed way to reproduce the potential failure Go find something else to do, Baldurian; you don’t even know how to exploit the flaw you reported yourself.
    • Interface sources for P196 (Secret of Empire 2 or aka Fafurion) for Main/Classic. This protocol is commonly used for classic interlude. You can use the xdat editors which support this protocol from my other shares.   NWindow + Interface UC + L2Editor Compiler   Download  
    • Interface sources for P166 (Secret of Empire 1) for Main/Classic. This protocol is commonly used for classic interlude. You can use the xdat editors which support this protocol from my other shares.   NWindow + Interface UC + L2Editor Compiler   Download  
    • You can manually send the bypass (if this is a bypass not a packet function) using:   Engine.BypassToServer(Bypass); Click the red circle to record game actions (it should capture bypasses) and then you can manipulate it as such with a simple script begin Engine.BypassToServer(Bypass); end.  
  • Topics

×
×
  • Create New...

Important Information

This community uses essential cookies to function properly. Non-essential cookies and third-party services are used only with your consent. Read our Privacy Policy and We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue..