Jump to content

Recommended Posts

Posted (edited)

Hi, here is the 100% decompiled CItem::EnchantItem function

 

Config::ExceptionMailing: it is never false

 

L2Server.exe C4 In case anyone needs it.

 

 

bool CItem::EnchantItem(CItem *scroll, CItem *pItem, User* pUser)
{
  pUser_ = pUser;
  pItem_ = pItem;
  scroll_ = scroll;

  if ( !pItem_ )
  {
    return false;
  }
  pSID = pItem_->d.pSID;
  nEnchantLevel = pSID->nEnchantLevel;
  SlotType = (pSID->nSlotType >> 15) & 1;
  if ( !(pItem_->vtable->base.Config::ExceptionMailing))
  {
    if ( nEnchantLevel < 3 )
      goto SUCCESS;
    if ( nEnchantLevel >= 20 )
    {
      prob = 0.0;
    }
    else
    {
      if ( SlotType )
        chance = WeaponEnchantTable[nEnchantLevel] * 100.0;
      else
        chance = ArmorEnchantTable[nEnchantLevel] * 100.0;
      prob = 100.0 - chance;
    }
    if ( nEnchantLevel >= 15 )
      prob = prob * 0.5;
    random = rand();
    dice = 100.0 - 0.0;
    if ( nEnchantLevel < 20 && prob >= random / 32767.0 * (100.0 - 0.0) + 0.0 )
    {
      CLog::Add(&g_winlog, LOG_REQUEST, L"armor enchant success, prev enchanted[%d], dice[%f], prob[%f]", nEnchantLevel, random / 32767.0 * dice + 0.0, prob);
      goto SUCCESS;
    }
    CLog::Add(&g_winlog, LOG_REQUEST, L"armor enchant fail, prev enchanted[%d], dice[%f], prob[%f]", nEnchantLevel, random / 32767.0 * dice + 0.0, prob);
    goto FAIL;
  }
  pII = pItem_->d.pII;
  if ( pII->nCrystalType < CrystalC || !LOBYTE(pII->magicWeapon) )
  {
    prob_1 = 70.0;
    if ( nEnchantLevel < 3 )
      goto SUCCESS;
    if ( nEnchantLevel >= 15 )
      prob_1 = 35.0;
    random_1 = rand();
    if ( prob_1 >= random_1 / 32767.0 * (100.0 - 0.0) + 0.0 )
    {
      CLog::Add(&g_winlog, LOG_REQUEST, L"weapon enchant success, prev enchanted[%d], dice[%f], prob[%f]", nEnchantLevel, random_1 / 32767.0 * (100.0 - 0.0) + 0.0, prob_1);
      goto SUCCESS;
    }
    CLog::Add(&g_winlog, LOG_REQUEST, L"weapon enchant fail, prev enchanted[%d], dice[%f], prob[%f]", nEnchantLevel, random_1 / 32767.0 * (100.0 - 0.0) + 0.0, prob_1);
    goto FAIL;
  }
  prob_2 = 40.0;
  if ( nEnchantLevel >= 3 )
  {
    if ( nEnchantLevel >= 15 )
      prob_2 = 20.0;
    random_2 = rand();
    if ( prob_2 >= random_2 / 32767.0 * (100.0 - 0.0) + 0.0 )
    {
      CLog::Add(&g_winlog, LOG_REQUEST, L"magic weapon enchant success, prev enchanted[%d], dice[%f], prob[%f]", nEnchantLevel, random_2 / 32767.0 * (100.0 - 0.0) + 0.0, prob_2);
      goto SUCCESS;
    }
    CLog::Add(&g_winlog, LOG_REQUEST, L"magic weapon enchant fail, prev enchanted[%d], dice[%f], prob[%f]", nEnchantLevel, random_2 / 32767.0 * (100.0 - 0.0) + 0.0, prob_2);
FAIL:
    etcType = scroll_->d.pII->etcType;
    if ( etcType == EtcItemBlessedScrollEnchantWeapon || etcType == EtcItemBlessedScrollEnchantArmor )
    {
      User::SendSystemMessage(pUser_->socket, id_1517__Fallo_en_el_encantamiento_blessed_El_valor_del_encantamiento_del_item_se_convirtio_a_0);
      CDB::RequestEnchantItem(&g_CDB, scroll_, pItem_, 0, pUser_);
    }
    else
    {
      CSocket::Send(pUser_->socket, "cdddddd", 100i64);
      CDB::RequestEnchantItemFail(&g_CDB, scroll_, pItem_, pUser_);
    }
    goto END;
  }
SUCCESS:
  if ( nEnchantLevel )
  {
    CSocket::Send(pUser_->socket, "cdddddd", 100i64);
  }
  else
  {
    v25 = 3;
    v24 = 1;
    CSocket::Send(pUser_->socket, "cdddd", 100i64, 62i64, v24, v25, pItem_->d.pSID->nItemID);
  }
  CDB::RequestEnchantItem(&g_CDB, scroll_, pItem_, nEnchantLevel + 1, pUser_);
END:
  return false;
}




WeaponEnchantTable dq 0                 ; DATA XREF: CItem__EnchantItem+27Br
.rdata:0000000000A06B88                 align 20h
.rdata:0000000000A06BA0                 dq 0.3333333333333333
.rdata:0000000000A06BA8                 dq 0.6666666666666666
.rdata:0000000000A06BB0                 dq 0.75
.rdata:0000000000A06BB8                 dq 0.8
.rdata:0000000000A06BC0                 dq 0.8333333333333334
.rdata:0000000000A06BC8                 dq 0.8571428571428571
.rdata:0000000000A06BD0                 dq 0.875
.rdata:0000000000A06BD8                 dq 0.8888888888888888
.rdata:0000000000A06BE0                 dq 0.9
.rdata:0000000000A06BE8                 dq 0.9090909090909091
.rdata:0000000000A06BF0                 dq 0.9166666666666666
.rdata:0000000000A06BF8                 dq 0.9230769230769231
.rdata:0000000000A06C00                 dq 0.9285714285714286
.rdata:0000000000A06C08                 dq 0.9333333333333333
.rdata:0000000000A06C10                 dq 0.9375
.rdata:0000000000A06C18                 dq 0.9411764705882353

.rdata:0000000000A06AE0 ArmorEnchantTable dq 0                  ; DATA XREF: CItem__EnchantItem:loc_628E83r
.rdata:0000000000A06AE8                 dq 0
.rdata:0000000000A06AF0                 dq 0
.rdata:0000000000A06AF8                 dq 0.3333333333333333
.rdata:0000000000A06B00                 dq 0.6666666666666666
.rdata:0000000000A06B08                 dq 0.75
.rdata:0000000000A06B10                 dq 0.8
.rdata:0000000000A06B18                 dq 0.8333333333333334
.rdata:0000000000A06B20                 dq 0.8571428571428571
.rdata:0000000000A06B28                 dq 0.875
.rdata:0000000000A06B30                 dq 0.8888888888888888
.rdata:0000000000A06B38                 dq 0.9
.rdata:0000000000A06B40                 dq 0.9090909090909091
.rdata:0000000000A06B48                 dq 0.9166666666666666
.rdata:0000000000A06B50                 dq 0.9230769230769231
.rdata:0000000000A06B58                 dq 0.9285714285714286
.rdata:0000000000A06B60                 dq 0.9333333333333333
.rdata:0000000000A06B68                 dq 0.9375
.rdata:0000000000A06B70                 dq 0.9411764705882353
.rdata:0000000000A06B78                 dq 0.9444444444444444

 

Edited by guytis
Posted

really good share,  i dont understand why there is exeptionmailing.

I ve trying to find magic critical damage multipler address with IDA but i cant find it  you have idea? or know the address where is that value? 

Posted
3 hours ago, Nevermind25 said:

really good share,  i dont understand why there is exeptionmailing.

I ve trying to find magic critical damage multipler address with IDA but i cant find it  you have idea? or know the address where is that value? 

yes

 

0x69B2FD

 

v12= ???

 

double CAttackAction::CalcDamage(double dPAttack, double dRandDamageBonus, double dPDefend, double dShieldDefense, double dAttrBonus, double dCriticalBonus, double dCriticalDamageBonusPer, double dCriticalDamageBonusDiff)
{
  defsh = 1.0;
  
  if ( dShieldDefense + dAttrBonus >= 1.0 )
    defsh = dShieldDefense + dAttrBonus;

  return (dRandDamageBonus * dPDefend * dCriticalDamageBonusPer * dCriticalDamageBonusDiff + v12) * 70.0 / defsh * dCriticalBonus;
}

 

Posted

v12 is dPAtack i think, it matches to the dmg formula shared in older forums, so this function is for Phisical damage only

 

I'm searching for Magic Critical, to down the damage power from x4 to another value i want, let me know if you find it :)

Posted
5 hours ago, Nevermind25 said:

v12 is dPAtack i think, it matches to the dmg formula shared in older forums, so this function is for Phisical damage only

 

I'm searching for Magic Critical, to down the damage power from x4 to another value i want, let me know if you find it :)

 

 

I am not very sure and the function is not very well decompiled ...

 

0x7A8C20

 

in some other skills there is also like the CSkillEffect_i_hp_drain

 

void __stdcall CSkillEffect_i_m_attack::Instant(CSkillEffect_i_m_attack *this, CCreature *pCreature, CCreature *pTarget, CSkillInfo *pSkillInfo, CSkillAction *pAction, double distance)
{
  CSkillInfo *pSkillInfo_; // r13
  CCreature *pTarget_; // rdi
  CCreature *pCreature_; // rsi
  CSkillEffect_i_m_attack *this_; // r15
  __int64 v10; // r12
  __int64 v11; // r8
  __int64 v12; // rcx
  __int64 v13; // rax
  __int64 v14; // rax
  double fMAtk_F; // xmm6_8
  CCreature *pTarget__1; // rbp
  CDoor *door; // r14
  __int64 *v18; // rbx
  CreatureSharedData *pSD; // r11
  double fMAtk; // xmm14_8
  double StatWIT; // xmm15_8
  int attributeType; // eax
  unsigned int level; // ebx
  User *pUser; // rax
  __int64 v25; // r8
  __int64 v26; // r8
  User *pUser_1; // rax
  User *pUser_2; // rax
  User *pUser_3; // rax
  double v30; // r8
  __int64 v31; // rax
  int dmgFlag; // [rsp+20h] [rbp-128h]
  double _unkn610; // [rsp+160h] [rbp+18h]

  pSkillInfo_ = pSkillInfo;
  pTarget_ = pTarget;
  pCreature_ = pCreature;
  this_ = this;
  if ( !(dword_E418450 & 1) )
  {
    dword_E418450 |= 1u;
    dword_E41844C = guard(L"CSkillEffect_i_m_attack::Instant()");
  }
  v10 = TlsIndex;
  v11 = *(*(__readgsqword(0x58u) + 8i64 * TlsIndex) + 311640i64);
  v12 = g_CallStackIndex[v11 + 0x100000];
  g_CallStackIndex[v11 + 0x100000] = v12 + 1;
  g_CallStackName[0][v12 + 1000 * v11] = L"CSkillEffect_i_m_attack::Instant()";
  if ( pTarget_ )
  {
    if ( pTarget_->vtable->base.base.base.IsCreature(pTarget_) || (pTarget_->vtable->base.CCreature__GetLevel)(pTarget_) || (pTarget_->vtable->base.sub_29)(pTarget_) || (pTarget_->vtable->base.sub_33)(pTarget_) )
    {
      if ( !pTarget_->vtable->base.base.base.IsCreature(pTarget_) || (*&pTarget_->vtable->gap1D8[120])(pTarget_) )
      {
        fMAtk_F = 0.0;
        pTarget__1 = 0i64;
        door = 0i64;
        v18 = (&unk_1112190 + 320008 * *(*(__readgsqword(0x58u) + 8 * v10) + 311640i64));
        if ( *(v18 + 80000) >= 10000 )
          CLog::Add(&g_winlog, LOG_ERROR, L"Lock stack is small?? -_-;;; kuooo");
        v18[4 * *(v18 + 80000)] = 0i64;
        v18[4 * *(v18 + 80000) + 1] = 0i64;
        v18[4 * *(v18 + 80000) + 2] = L".\\SkillFxFunc.cpp";
        v18[4 * *(v18 + 80000) + 3] = 1766i64;
        _InterlockedIncrement(v18 + 80000);
        CriticalSection::Lock(pCreature_->d.lpSharedDataLock, L"d:\\work\\l2server\\creature.h", 1349);
        pSD = pCreature_->d.pSD;
        fMAtk = pSD->fMAtk;
        if ( LOBYTE(pSD->bSpiritshot) )
          fMAtk_F = fMAtk * pSD->dSpiritShotPower;
        StatWIT = pCreature_->vtable->CCreature::GetBaseStatWIT(pCreature_);
        _unkn610 = *&pCreature_->d._unkn610;
        CCreature::ReadUnlock(pCreature_);
        if ( pTarget_->vtable->base.base.base.IsCreature(pTarget_) )
        {
          pTarget__1 = pTarget_;
          CCreature::ReadLock(pTarget_, L".\\SkillFxFunc.cpp", 1779);
          attributeType = pSkillInfo_->d.attributeType;
          if ( attributeType >= 0 && attributeType < 34 )
            CCreature::GetAttributeBonus(pTarget_, pCreature_);
          pTarget_->vtable->CCreature::GetBaseStatWIT(pTarget_);
          level = (pTarget_->vtable->CCreature::GetLevel)(pTarget_);
          CCreature::ReadUnlock(pTarget_);
        }
        else if ( (pTarget_->vtable->base.sub_26)(pTarget_) )
        {
          door = (pTarget_->vtable->base.sub_38)(pTarget_);
          CriticalSection::Lock(door->d.pLock, L".\\SkillFxFunc.cpp", 1793);
          (door->vtable->base.unknown_libname_2001_120)(door);
          level = 0;
          CriticalSection::Unlock(door->d.pLock, 0i64, 0);
        }
        else
        {
          level = LODWORD(_unkn610);
        }
        if ( StatWIT * 0.5 * pCreature_->d.magicCriticalRatePER + pCreature_->d.magicCriticalRateDIFF > rand() / 32767.0 * (100.0 - 0.0) + 0.0 && pCreature_->vtable->base.base.base.IsUser(pCreature_) )
        {
          pUser = (pCreature_->vtable->base.base.base.MemoryObject__CastUser)(pCreature_);
          User::SendSystemMessage_0(pUser->_unkn2700[5], id_1280__Golpe_Critico_Magico);
        }
        sub_916C50(fMAtk + fMAtk_F);
        if ( pTarget_->vtable->base.base.base.IsUser(pTarget_) )
          (pCreature_->vtable->base.base.base.MemoryObject__CastCreature)(pCreature_);
        if ( (this_->base->CSkillEffect_i__CheckResisted)(this_, level, v25, pSkillInfo_->d.nMagicLevel, COERCE_DOUBLE(*&StatWIT), 7.0, -130.0, 95.0, 0i64, 0i64, COERCE_DOUBLE(*&_unkn610))
          || (this_->base->CSkillEffect_i__CheckResisted)(this_, level, v26, pSkillInfo_->d.nMagicLevel, COERCE_DOUBLE(*&StatWIT), 7.0, -100.0, 95.0, 1.0, 0i64, COERCE_DOUBLE(*&_unkn610)) )
        {
          if ( pCreature_->vtable->base.base.base.IsUser(pCreature_) )
          {
            pUser_1 = (pCreature_->vtable->base.base.base.MemoryObject__CastUser)(pCreature_);
            *&dmgFlag = 0i64;
            CSocket::Send(pUser_1->socket, "cdd", 100i64);// id_158__Tu_ataque_ha_fallado = 0x9E,
          }
          if ( pTarget_->vtable->base.base.base.IsCreature(pTarget_) && pTarget__1->vtable->base.base.base.IsUser(pTarget__1) )
          {
            if ( pCreature_->vtable->base.base.base.IsUser(pCreature_) )
            {
              (pCreature_->vtable->base.base.base.MemoryObject__CastUser)(pCreature_);
              pUser_2 = (pTarget__1->vtable->base.base.base.MemoryObject__CastUser)(pTarget__1);
              dmgFlag = 1;
              CSocket::Send(pUser_2->socket, "cdddS", 100i64);//   id_159__Has_resistido_el_hechizo_de_s1 = 0x9F,
            }
            else if ( (pCreature_->vtable->base.sub_8)(pCreature_) )
            {
              pUser_3 = (pTarget__1->vtable->base.base.base.MemoryObject__CastUser)(pTarget__1);
              dmgFlag = 1;
              CSocket::Send(pUser_3->socket, "cdddd", 100i64);//   id_159__Has_resistido_el_hechizo_de_s1 = 0x9F,
            }
          }
        }
        if ( pTarget_->vtable->base.base.base.IsCreature(pTarget_) )
        {
          LOBYTE(dmgFlag) = 1;
          (pTarget__1->vtable->CCreature::GotDamageBy)(pTarget__1, pCreature_, *&v30, 1i64, *&dmgFlag);
        }
        else if ( (pTarget_->vtable->base.sub_26)(pTarget_) )
        {
          (door->vtable->base.unknown_libname_2001_118)(door, pCreature_);
        }
        v31 = *(*(__readgsqword(0x58u) + 8 * v10) + 311640i64);
        --g_CallStackIndex[v31 + 0x100000];
      }
      else
      {
        v14 = *(*(__readgsqword(0x58u) + 8 * v10) + 311640i64);
        --g_CallStackIndex[v14 + 0x100000];
      }
    }
    else
    {
      v13 = *(*(__readgsqword(0x58u) + 8 * v10) + 311640i64);
      --g_CallStackIndex[v13 + 0x100000];
    }
  }
  else
  {
    --g_CallStackIndex[v11 + 0x100000];
  }
}

 

Posted
9 hours ago, Nevermind25 said:

v12 is dPAtack i think, it matches to the dmg formula shared in older forums, so this function is for Phisical damage only

 

I'm searching for Magic Critical, to down the damage power from x4 to another value i want, let me know if you find it :)

.text:00000000007A882A movlpd  xmm13, cs:qword_9CCFB0
.text:00000000007A9071 movlpd  xmm10, cs:qword_9CCFB0
.text:00000000007A98DA movlpd  xmm9, cs:qword_9CCFB0
.text:00000000007AA14B movlpd  xmm10, cs:qword_9CCFB0
.text:00000000007AFED5 movlpd  xmm12, cs:qword_9CCFB0
.text:00000000007B274E movlpd  xmm9, cs:qword_9CCFB0

 

have fun

Posted

with little steps i found this, for sure im wrong because i have no much idea 

 

545280 sub_545280      proc near               ; CODE XREF: sub_81DF00+6ECp
.text:0000000000545280                                         ; sub_81DF00+74Cp ...
.text:0000000000545280                 movlpd  xmm2, cs:qword_988780
.text:0000000000545288                 movlpd  xmm1, cs:qword_9CCFB0
.text:0000000000545290                 lea     eax, [rcx-1]
.text:0000000000545293                 cvtsi2sd xmm0, eax
.text:0000000000545297                 mulsd   xmm0, cs:qword_9CCFA8
.text:000000000054529F                 subsd   xmm2, xmm0
.text:00000000005452A3                 comisd  xmm2, xmm1
.text:00000000005452A7                 ja      short loc_5452AD
.text:00000000005452A9                 movsd   xmm2, xmm1
.text:00000000005452AD
.text:00000000005452AD loc_5452AD:                             ; CODE XREF: sub_545280+27j
.text:00000000005452AD                 divsd   xmm2, cs:qword_98E5A0
.text:00000000005452B5                 xorpd   xmm0, xmm0
.text:00000000005452B9                 lea     rdx, unk_9CCB50
.text:00000000005452C0                 movsxd  rcx, ecx
.text:00000000005452C3                 mov     eax, [rdx+rcx*4] //<-- HERE IS? 
.text:00000000005452C6                 sub     eax, [rdx+rcx*4-4]
.text:00000000005452CA                 cvtsi2sd xmm1, eax
.text:00000000005452CE                 mulsd   xmm1, xmm2
.text:00000000005452D2                 subsd   xmm0, xmm1
.text:00000000005452D6                 retn
.text:00000000005452D6 sub_545280 

 

Posted

oh boy you're definitely wrong, what i posted is the exact addresses you need to edit, they are all

 

"mov xmm*, 4.0"

 

lemme show a specific example from one of them, 0x7A882A

 

image.thumb.png.95ee3c3d88c1d3ccc09b54f953cb1f9a.png

 

then way way way further down in that function xmm13 is used as the multiplier to the damage value

 

image.png.b96a0853ed2f2621ddc030ddbc3300fa.png

 

this is why it pays to know the asm rather than just pressing F5 in ida and looking at c-like code cuz you'd be hard press to spot this in all of that crap, but if you know the asm you know exactly what to look for

 

so what you need to do to edit the crit rate from 4.0 to some other value, is you need to change all of those addresses I put in the previous post

 

.text:00000000007A882A movlpd  xmm13, cs:qword_9CCFB0
.text:00000000007A9071 movlpd  xmm10, cs:qword_9CCFB0
.text:00000000007A98DA movlpd  xmm9, cs:qword_9CCFB0
.text:00000000007AA14B movlpd  xmm10, cs:qword_9CCFB0
.text:00000000007AFED5 movlpd  xmm12, cs:qword_9CCFB0
.text:00000000007B274E movlpd  xmm9, cs:qword_9CCFB0

 

overwrite the address they're pulling the 4.0 modifier from with the address to your own modifier double, if you're using vanganth's you'd do it like this


double dMageCritPowerModifier = 2.0;

g_HookManager.WriteRelativeAddress(0x7A882A, 3, &dMageCritPowerModifier, 0);

 

 

  • Upvote 3
Posted
7 hours ago, Anarchy said:

double dMageCritPowerModifier = 2.0;

g_HookManager.WriteRelativeAddress(0x7A882A, 3, &dMageCritPowerModifier, 0);

im trying but is not simple as you put xD 

 

double g_MagicCriticalMultipler = 4.0;
g_MagicCriticalMultipler = GetPrivateProfileDouble(_T("SkillFactory"), _T("MagicCriticalMultipler"), 4.0, g_ConfigFile);
	g_HookManager.WriteRelativeAddress(0x7A882A, 3, &g_MagicCriticalMultipler, 0);
	g_HookManager.WriteRelativeAddress(0x7A9071, 3, &g_MagicCriticalMultipler, 0);
	g_HookManager.WriteRelativeAddress(0x7A98DA, 3, &g_MagicCriticalMultipler, 0);
	g_HookManager.WriteRelativeAddress(0x7AA14B, 3, &g_MagicCriticalMultipler, 0);
	g_HookManager.WriteRelativeAddress(0x7AFED5, 3, &g_MagicCriticalMultipler, 0);
	g_HookManager.WriteRelativeAddress(0x7B274E, 3, &g_MagicCriticalMultipler, 0);

 

when i launch a magic critical server stops working  or crash

 

linerror

 

GuardInfo : 

IOThread [0][47] (good):  void IOThread_common(void *arglist)
    Lock Stack  : 

IOThread [1][0] (ahehe):  void IOThread_common(void *arglist) -> void CIOObject::TimerDispatch(bool bRootLoop) -> void CThreadLocalTimer::Dispath -> void CCreatureController::TimerExpired(int id) -> inline void AddExecutable(MemoryObject *Matrix, Native Func, CExecutionArgument* Arg) -> add exec - func call -> ASYNCHRONOUS_SERIALIZE_IMPL1(CCreatureController, AsyncTimerExpired, int, id) -> bool CSkillAction2::OnTick() -> skillaction_ontick_SKL_HITTIME -> skillaction_ontick_SKL_HITTIME_2 -> skillaction_ontick_SKL_HITTIME_2_3 -> CSkillInfo::ActivateSkill -> CSkillEffect_i_m_attack::Instant()
    Lock Stack  : 

IOThread [2][16] (good):  void IOThread_common(void *arglist)
    Lock Stack  : 

IOThread [3][16] (good):  void IOThread_common(void *arglist)
    Lock Stack  : 

ListenThread [13][31] (good):  void ListenThread_common() -> unsigned __stdcall WaitThread(void *)
    Lock Stack  : 

MainThread [12][592] (good):      Lock Stack  : 

GuardInfo end 


 

Posted (edited)
23 hours ago, Nevermind25 said:

im trying but is not simple as you put xD 

 


double g_MagicCriticalMultipler = 4.0;
g_MagicCriticalMultipler = GetPrivateProfileDouble(_T("SkillFactory"), _T("MagicCriticalMultipler"), 4.0, g_ConfigFile);
	g_HookManager.WriteRelativeAddress(0x7A882A, 3, &g_MagicCriticalMultipler, 0);
	g_HookManager.WriteRelativeAddress(0x7A9071, 3, &g_MagicCriticalMultipler, 0);
	g_HookManager.WriteRelativeAddress(0x7A98DA, 3, &g_MagicCriticalMultipler, 0);
	g_HookManager.WriteRelativeAddress(0x7AA14B, 3, &g_MagicCriticalMultipler, 0);
	g_HookManager.WriteRelativeAddress(0x7AFED5, 3, &g_MagicCriticalMultipler, 0);
	g_HookManager.WriteRelativeAddress(0x7B274E, 3, &g_MagicCriticalMultipler, 0);

 

when i launch a magic critical server stops working  or crash

 

linerror

 


GuardInfo : 

IOThread [0][47] (good):  void IOThread_common(void *arglist)
    Lock Stack  : 

IOThread [1][0] (ahehe):  void IOThread_common(void *arglist) -> void CIOObject::TimerDispatch(bool bRootLoop) -> void CThreadLocalTimer::Dispath -> void CCreatureController::TimerExpired(int id) -> inline void AddExecutable(MemoryObject *Matrix, Native Func, CExecutionArgument* Arg) -> add exec - func call -> ASYNCHRONOUS_SERIALIZE_IMPL1(CCreatureController, AsyncTimerExpired, int, id) -> bool CSkillAction2::OnTick() -> skillaction_ontick_SKL_HITTIME -> skillaction_ontick_SKL_HITTIME_2 -> skillaction_ontick_SKL_HITTIME_2_3 -> CSkillInfo::ActivateSkill -> CSkillEffect_i_m_attack::Instant()
    Lock Stack  : 

IOThread [2][16] (good):  void IOThread_common(void *arglist)
    Lock Stack  : 

IOThread [3][16] (good):  void IOThread_common(void *arglist)
    Lock Stack  : 

ListenThread [13][31] (good):  void ListenThread_common() -> unsigned __stdcall WaitThread(void *)
    Lock Stack  : 

MainThread [12][592] (good):      Lock Stack  : 

GuardInfo end 

 

 

 

 

 

Edited by guytis
Posted
double g_MagicCriticalMultipler = 4.0;

void SetMagicCriticalMultipler()
{
    g_HookManager.WriteRelativeAddress(0x7A882A, 5, &g_MagicCriticalMultipler, 0);    //CSkillEffect_i_hp_drain::Instant()
    g_HookManager.WriteRelativeAddress(0x7A9071, 5, &g_MagicCriticalMultipler, 0);    //CSkillEffect_i_m_attack::Instant()
    g_HookManager.WriteRelativeAddress(0x7A98DA, 5, &g_MagicCriticalMultipler, 0);    //CSkillEffect_i_m_attack_by_hp::Instant()
    g_HookManager.WriteRelativeAddress(0x7AA14B, 5, &g_MagicCriticalMultipler, 0);    //CSkillEffect_i_m_attack_by_dist::Instant()
    g_HookManager.WriteRelativeAddress(0x7AFED5, 5, &g_MagicCriticalMultipler, 0);    //CSkillEffect_i_death_link::Instant()
    g_HookManager.WriteRelativeAddress(0x7B274E, 5, &g_MagicCriticalMultipler, 0);    //CSkillEffect_i_m_attack_over_hit::Instant()
}

 

Posted
On 12/31/2019 at 9:36 AM, Anarchy said:

oh boy you're definitely wrong, what i posted is the exact addresses you need to edit, they are all

 

"mov xmm*, 4.0"

 

lemme show a specific example from one of them, 0x7A882A

 

image.thumb.png.95ee3c3d88c1d3ccc09b54f953cb1f9a.png

 

then way way way further down in that function xmm13 is used as the multiplier to the damage value

 

image.png.b96a0853ed2f2621ddc030ddbc3300fa.png

 

this is why it pays to know the asm rather than just pressing F5 in ida and looking at c-like code cuz you'd be hard press to spot this in all of that crap, but if you know the asm you know exactly what to look for

 

so what you need to do to edit the crit rate from 4.0 to some other value, is you need to change all of those addresses I put in the previous post

 

 


.text:00000000007A882A movlpd  xmm13, cs:qword_9CCFB0
.text:00000000007A9071 movlpd  xmm10, cs:qword_9CCFB0
.text:00000000007A98DA movlpd  xmm9, cs:qword_9CCFB0
.text:00000000007AA14B movlpd  xmm10, cs:qword_9CCFB0
.text:00000000007AFED5 movlpd  xmm12, cs:qword_9CCFB0
.text:00000000007B274E movlpd  xmm9, cs:qword_9CCFB0

 

 

overwrite the address they're pulling the 4.0 modifier from with the address to your own modifier double, if you're using vanganth's you'd do it like this

 


double dMageCritPowerModifier = 2.0;

g_HookManager.WriteRelativeAddress(0x7A882A, 3, &dMageCritPowerModifier, 0);

 

 

 

 

 

 

Do you know if there is any arrangement that can be made and that this appears in F5?

 

 

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Posts

    • The bot video lasts 35 minutes and not everything is shown there, if everything was shown, the video could have lasted several hours. Also, the video quality is reduced so as not to take up much space.The last minutes of the video show bots attacking each other on the event. https://dropmefiles.com/1jMi2
    • We also forgot to say that the deal will be the way you want it, we are ready for almost any of your demands. And we ask the administration to review our post as soon as possible, because several hours have passed and it still hasn't passed moderation, thank you in advance!  
    • 💥Super offer GitHub Account  (5 years)💥 ⚠️ Available to order for only $20🔥
    • Good day to all! We present to your attention our source code h5, where several projects used and achieved very good results, both in terms of online and in general for the project. (Due to confidentiality, the list of projects, the test server and what the basis of the source code will be provided only to real buyers, where they can go and check them out)   The main feature is bots, which are very animated, one to one like real players. But, in addition to bots, the build has a lot of interesting and modern things. Below will be a video showing bots and a little about the server.   As we said, the build was used on several projects, so the first thing that is there is not a single backdoor on the server, all serious and critical errors have been fixed. Races and classes are closer to the official PTS platform.   And also the server can be used as a classic server, as well as a server with add-ons, because the server has added many new things, weapons, armor, jewelry, hats, cloaks, etc.   The server has a full working community board (alt+b), working locations, quests, geodata, mechanism, working ai, in general there are no problems and complaints. In alt+b, shops, various services, buffer, player statistics, clan statistics, mail, profession change, personal account, registration for events, etc. are available.   Additional services: Premium account, visual costumes, nickname change services (for yourself and your pet), nickname and title painting service, karma/PC cleaning, expand services, weapon/armor/jewelry sharpening service, level up and down service, nobles purchase service, beauty salon (new hairstyle change from higher chronicles and face change), additional window purchase service, clan reputation purchase service, weapon augmentation purchase service.   Internal services: auto potions (acp), referral system, repair services, automatic reward delivery after n. time, additional auction, and other working systems, also many available commands, such as: exact date of epic respawn, password change directly inside the game, offline buffer, auto att, registration for castle sieges directly by entering a command and other available commands.   The server has protection (both on the server side and on the client side) that protects against free software and also several other anti-bot systems that will not give the slightest chance to bot users. But if you want people to use software, you just turn it off.   Bots. As we said, one of the main features of our server is bots, they are one to one like real players, now a little about bots and below is a link to a video about how they work: Server bots are like real players, their AI is copied from the AI ??of real characters, and therefore they get what real players get and you can also do with them everything that can be done with real characters.   They write in chats, in all chats, trade, shout, pm, clan chat, general chat. They walk around the cities, level up, farm, kill each other in pvp and pc, put on weapons, armor, jewelry, sharpen weapons. According to their level, they will choose their professions, join clans, participate in different events, use alt+b services - I'm telling you, their AI is copied and adapted like a real player's AI, so they can do everything that a real player can.   Bot control: You can set a chat and words for bots, how often or rarely they will write in chats, you can control where and how the bots will level up, you can control what events they will be at, you can control what cities they will run in, you can control where they will stand, you can even call them to you and that's not all, they are completely in your hands and you can twist them as you want. The bot video lasts 35 minutes and not everything is shown there, if everything was shown, the video could have lasted several hours. Also, the video quality is reduced so as not to take up much space.   You can check the rest yourself on the test server and we will fully show you everything that bots are capable of and you will be surprised)   Now about the price and a little about our work and what is included in this price. We do not sell only the build, we sell the source code in its entirety, so that you can adapt something for yourself. The price of the source code: 15,000 euros. What is included in this price: 1. We do not have a license, you buy it once and you can use it for the rest of your life. 2. There is no online limit and there is also no limit on running bots, the server can support as much online and bots as your VDS is powerful. 3. Client-side protection. You will not pay extra for protection, the source code already has everything. 4. All builds that we have created for projects that bought the source from us (they have ready-made servers, with their own ready-made concepts, configs, different alt+b designs, for different rates x1, x10, x20, x50, x100, x1200, x5000, there are also servers for classics and servers with add-ons, they all have configured bots for their servers) all this will be included in this price. You will receive all the builds of these projects. 5. Once a year we update and improve the source, we will also improve the bots, make different paths for them, different farming places, and revive them more and more, to get them you will have to pay 20 euros to get the updates. 6. You will receive all the bot settings from our first projects to the last, the video shows little, our last configured bots are almost indistinguishable from real players and you will see this yourself on the test server or later. (Our last setup and development of bots lasted 11 months and these works and what bots can do cannot be described in words, you yourself must see them to feel this work and power) 7. We will teach you how to control both the server and training on setting up and controlling bots. 8. We will provide you with VDS for 3 months and if necessary we will help you as much as we can until the first launch of your project! 9. Our bots move, they don't stand in one place, they walk around the cities and use a teleport, after the teleport they move on to the farming place in random places. They communicate in the chat and if you hit them, they can hit you back. They are in almost every city and farming location, near many key NPCs, instance zone managers, etc. They are automatically updated and move around the cities and farming zones. They attack those who have a flag and those who is pk. These are simply unique bots that can help you in terms of your online and your project in general! 10. As we said, our latest bot development lasted 11 months and we made 92 new farm zones for bots, more than 150,000 new paths for all locations, different methods of dressing their equipment, different methods of their behavior and more than 40,000 universal words in the chat, in different languages, where no one can even doubt that these are bots! Our contact information Telegramm: https://t.me/jg_uc Discord: j.g.u.c_dev
  • Topics

×
×
  • Create New...