RunUO Community

This is a sample guest message. Register a free account today to become a member! Once signed in, you'll be able to participate on this site by adding your own topics and posts, as well as connect with other members through your own private inbox!

SpyUO - a C# UO packet hooker

arul

Sorceror
pinco:
Haven't tested them, but they should work fine:
Code:
444E1BA9: "5.0.2 3D"        48EE02 6 5 4A0920 2 6

Makar20:
I suggest you start by reading some assembly tutorials, then read this tutorial
 

Attachments

  • cfg.rar
    4.2 KB · Views: 136

BladeWise

Wanderer
Uhmm... I used the tutorial with client 5.0.2b.
I tried to follow tre tutorial (both the difficult and the easy part), but I found these problems:
1. With "hard" part I can follow him until he says encrypted data size should be 0x3E... my size is 4... moreover I don't know where I should read the TOS value... (my bad!)
2. With the easy part, I found that the address containing the "], 33h" is at 0041A826, and is into the subroutine at address 0041A810... 0041A6FD is the address in the above routine for "push ebp", so why is it?. About the SendBuffer, the tutorial says we need to find the "mov bp, ax"... I found it 0041A6FD, and the corresponding routine is 0041A6D0...
so... can anyone explain me what's wrong?
 

arul

Sorceror
yeah, the tutorial seems to be outdated a bit... TOS stands for Top of the stack.
"push ebp" at 0041A6D pushes the address of the buffer onto the stack.
 

BladeWise

Wanderer
Oh, I know the meaning of TOS, but I don't know where I can read it :D
So, could you please explain (even in brief) what kind of addresses we need?
 

HannibalX

Wanderer
Is there a more up to date tutorial? I was trying to find the hooks for the 5.0.2f client... having a hard time with the old tutorial.
 

HannibalX

Wanderer
Thanks Arul.

Based on your new values... I compared the 5.0.2f dasm against 5.0.2g... and here are the values for client 5.0.2g 2D (one again... unchanged offsets, wierd! however, these are tested and working)

Code:
44B30695: "5.0.2g 2D"        41A6FD 5 7 4342C0 7 6
 

jaynigs

Wanderer
Client 5.0.4d 2D

Code:
450882B1: "5.0.4d 2D"        41A85D 5 7 434590 7 6

Client 5.0.4d 3D

Code:
45088348: "5.0.4d 3D"        48E330 6 5 4A0B10 2 6
 
Top