SpyUO - a C# UO packet hooker

[Kenko]

<3 to those who posted keys..

 

[MalGanis]

New keys, hope they work

4587197A: "5.0.7.1 2D"       41AA70 5 1 434910 7 6

 

[MuadDib]

Kudos on the key work mates. I run a packet list site that also has a download for UOLog that Folko made before SpyUO (where the clients.cfg comes from), this has been a very helpful thread for me to keep the clients.cfg download updated.

Thanks for all your hard work

 

[MalGanis]

And new keys for 3D:

45871A30: "5.0.7.1 3D"        48E1F2 6 1 4A0A23 2 6

 

[HellRazor]

Awesome. I don't like or use the 3D client but I don't begrudge anyone who does and its nice to see keys being posted for it. SpyUO somehow seems incomplete without both 2D and 3D client keys.

 

[mordero]

thanks!

 

[Kenko]

what is key for 5.0.7.2? thx a lot <3

 

[arul]

Try those ..

45AD77EE: "5.0.7.2 2D"        41AA8D 5 1 434910 7 6

Anyway, here's an experimental version of SpyUO that heuristically retrieves the locations of sen/rec buffers when the client starts. Sources coming soon.

 

[Makar20]

anyone got the keys for the new one?

 

[Makar20]

That release is good Arul. You forgot to include the zlib dll in the package though ;-) Theres a bug. it wont attach when the client just starts up. it has to be attached when your already in the game

 

[Jeff]

"5.0.8.2 2D"
Key1 = 2F53257D, Key2 = A2BF527F

 

[HellRazor]

Thanks Jeff!

 

[Smjert]

Sorry i'm a bit confused.. how i have to use Jeff's keys?

These keys are written in a different way:

45AD77EE: "5.0.7.2 T2A"       41AA8D 5 1 434910 7 6

And how i can get the timestamp?

(i followed Folko's guide, he said "Open client.exe in UltraEdit and search the PE header. It is on top of the file and starts with "PE", in 4.0.0l it's at 0x0138. Skip the next WORD and the next DWORD and you'll have the TimeStamp in Little Endian. To convert it to human readable Big Endian, reverse the bytes")

Then i found the letters PE in line 00000120h, but how can i skip WORD and DWORD??

 

[Jeff]

Sorry i'm a bit confused.. how i have to use Jeff's keys?

These keys are written in a different way:

45AD77EE: "5.0.7.2 T2A"       41AA8D 5 1 434910 7 6

And how i can get the timestamp?

(i followed Folko's guide, he said "Open client.exe in UltraEdit and search the PE header. It is on top of the file and starts with "PE", in 4.0.0l it's at 0x0138. Skip the next WORD and the next DWORD and you'll have the TimeStamp in Little Endian. To convert it to human readable Big Endian, reverse the bytes")

Then i found the letters PE in line 00000120h, but how can i skip WORD and DWORD??

"5.0.8.2 2D"     2F5325 7 D A2BF52 7 F

Better?

anyway, skipping a WORD by just counting 2 bytes or 16 bits,

WORD = 16bit
DWORD = 32bit

 

[Smjert]

Code:

"5.0.8.2 2D"     2F5325 7 D A2BF52 7 F

Better?

Ah wow.. I thought that it had to begin with a 4 or something like that XD

Edit:
I found the timestamp, added this line

45D23436: "5.0.8.2 T2A" 2F5325 7 D A2BF52 7 F

and i got: Error reading Clients.cfg--->System.FormatException: One of the identified items was in an invalid format

 

[Kenko]

but what is the full line please?

 

[Smjert]

That is the full line (the line i added).

Edit: the error or the line i added?

 

[jaynigs]

Try this

45D23436: "5.0.8.2 2D"       41A97D 5 7 4347D0 7 6

 

[Smjert]

Thnx now it works!

 

[jaynigs]

Thanks for confirming they work,

Perhaps you could try these for 3D also?

45D234F2: "5.0.8.2 3D"       48E1F2 6 1 4A0A23 2 6

Thanks