Levitate

[smithers138]

If this is Accepted I would like access to the everquest 1 forums

This is a quick guide to memory editing, I will add different uses to this thread as time passes, I hope to use some information in the members forum to help create different uses for this.

Getting Started:

Step 1: You will need this application

http://www.artmoney.ru/e_download_se.htm[/url] it is a memory editor
To install this program follow the prompts, it is fairly straight forward. If cant install it please stop here because this is the easiest step. Or you could plug on and read the support forums on the same site that I linked above.


Step 2: Important settings

The 2 most important settings can be accessed as follows:
- From the top menu click Search
- Select options from this menu
- Click on the additional tab
- In this section you will notice 2 very improtant settings, Refresh Time and Freeze Time.
- Refresh time is how often the program checks the value of a spot in memory, this is not as important as Freeze time
- Freeze time is how often the program updates said segemnt of memory to a specific value.

Example: if you happen to find your Z coordinates in memory and you want to levitate you would want this number (freeze time) to be very low otherwise you may and up falling to the ground before it refreshes(this also has to do with how often your client updates to the server, if your client update happens a couple times in a row where your value isnt in the locked state the server would think your falling and probably 20k you).


Searching and filtering a value:

Step 1: Open Everquest, a few notes

- Have everquest openned and running in a zone where theres not to many people to notice you, also do not have levitate on or move your charachter except where this guide tells you. Levitate could constantly change the value of Z, and if this value changes by even the smallest number while we are searching this will not work, although once you have finished the searching and filtering process i would strongly reccoment some for of levitate. If you dont have levitate and are at a Z location of 1500 and your computer lags for a few seconds that is a really long fall.


Step 2: Selecting the correct process

Open Art Money (the above program) and ensure your freeze time is set to 20ms, and in the Select Process drop down box select everquest.


Step 3: Obtaining the value to search for

on your everquest charachter type /loc and take note of the third value (do not move your charachter from this location or it will not work.
Note: if you are unsure the third value is the virticle location fo your charachter.


Step 4: Executing the search

Back to Art Money Follow these steps
- Click Search
- Search = Exact Value
- Value = the third number from your /loc (must be exact including the decimal and negative sign if there is one)
- Type = Float (Standard)
- Adress Range = All
- Now click ok to begin the search process
Note: This is the longest step especially if you have a sub par computer.


Step 5: Filtering

Now you have noticed this pulls a whole lot of values, we need to filter through these and see which one we actually need. So follow these steps for filtering:


Step 6: Changing a value in memory to obtain a comparison value

- On your everquest screen move your charachter to a location thats is either higher or lower then it was at when you did the last search and type /loc take note of the third value exactly how it appears with decimal and negative sign if there is one, once again dont move your charachter from this location.


Step 7: Applying the value to a filter in Art Money

- Click Filter, the only thing that needs to change here is the value, change it from the previous value to the value we just obtained from the everquest screen (Step 6) and click ok. Now you may think we have alot of of values left but not really, from my experience one of the first 15 values is always the Z co-ordinates.


Step 8: Final filtering

- Double click on the first 15 values in the left segemnt of art money to add them to the right segment. Take note of the F column this is where you will put a check mark on each value to "Freeze" it, do this for all 15 of the values.
- move your charachter to a different spot in that zone that is on a different elevation, you will notice it will start to get a bit bouncy... this is good it means that one of those 15 values is your Z co-ordinate.
- uncheck each of the 15 values individually switching back to the everquest screen after each one to see if your charachter stops "bounching", when it does stop bouncing the value you just unchecked is your Z axis, rename this value to Z in the description field, and remove all the others by right clicking on them and delete.


Step 9: Changing the value

- Freeze the value in the table that we called Z by putting a check mark in the F column.
- Change the value, try increasing it by increments of 50, you will notice your charachter lifting off the ground.


Some important notes:

- Warping from ground level to 500 in front of people would be stupid and get you reported.
- I use a http://everquest.allakhazam.com/db/item.html?item=1039 to make my levitate look much more natural.
- I also dont just change my Z from 50 to 1000, I change it in increments of 50, so that EQ staff dont get the big flag movemnt > the so much
- as you can imagine there are many other uses for this type of stuff, you could try the above listed steps using different values, ie. X or Y coordinates.
- Always unfreeze this value before you zone... if you dont you will get 20k'd, of course if you wanna suicide somewhere unckeck freeze the value when you dont have levitate on and your high in the air..... the outcome is suicide by fall


If you have any questions post here ill try to answer them.

 

[x333]

Hmm, wouldn't this be client side only? Since it is a memory edit on your side, other players will see you as still being on the ground. I imagine KOS mobs will still attack you and you wouldn't be able to retaliate since your client thinks you are much further away than the server. Just a guess.

 

[smithers138]

Nope, that is why there are several values exactly the same in different locations, the one we are editing is the one that is sent to eq servers.... so that means you are actually at that location and you dont have to push any packets (IE the client sends the data to EQ, but you change the data its sending). I have tested this... alot, and it works not only for this but many other things, the trick is knowing that values that are sent to EQ's servers have to be stored in memory in some form or another.... exploiting that number without getting busted is the key. if you wish to test it have another person you know watch you while you do it, you will dissapear from there screen and leave a fancy little target ring.

 

[()===D====>]

if this works, then definite yes

 

[smithers138]

if it works = DD, i wouldnt post it if it didn't work, the key things to remember are dont move your toon while your doing the searches, this would change the number we are looking for, and also the final step requires a bit of work checking 15 values, but once you get the location in memory you can do whatever you wanted. I wish there was an easier way to filter so that only the value you wanted was left, but the same value is stored in memory about 100 times and only one of them is the one sent to the EQ servers. If you wish to also try soemthing else with this value you could do this, i am not going to be quite as detailed on this one, but anyoen who could do the first part should eb able to do this aswell.

Once you have obtained the Z Address:

lolloc:
- lock the Z value at ground level with a freeze refresh of 20ms
- open a second instance of Art money and copy the adress and value of the Z value to its Table.
- Lock this value at -800 (or 800 below your other z value) with a refresh of 10ms
- in your eq window take a few steps back and forth.
- unlock both values (the neg one first then the ground one a few seconds later)
outcome:
- walk around the zone and mobs wont aggro you, you also will not be able to hit them and you wont be able click on anything, but you will be able to zone(aslong as its not a click zone), if you camp like this you will relog in the location you bugged at lolloc:, but if you go to a location you want to be at (ie. past a bunch of see invis mobs) and repeat the steps under lolloc: and camp there you will reload there, past the see invis mobs.

Have Fun

 

[smithers138]

Not worth Access???

 

[sebastienjuly]

If you are accepted:

1.Your post will be moved to the appropriate forum
2.You will receive a PM about your free access
3.You will be able to access the forum that you specified in your thread for the specified amount of time in your PM for free.

If ANY of these things did not happen please PM either Creed or Redsquirrel.

If you'd rather pay to get access, do the following:
Register and subscribe to get access now.

If you have any questions about the free submissions forum please PM Creed or Redsquirrel..


something i dug up for you hope this helps. I think its cool if it works but im to lazy to even try it all out lol.

 

[smithers138]

Yea thats the bad thing about it, it takes a bit of effort to make it work, but if you dont want to run MQ memory editing is the best option. this is just one of many things you can do with it, it works with the X and Y axis aswell as Z, but there is a bit of fudging to do if there is an object in your way on the X and Y axis. Also if your lvling a caster toon you can levitate say above Split paw and dot/ nuke mobs without getting hit, but this onyl works in old world zones due to the huge non aggro regen of new world mobs.

 

[RedBema]

I need someone from EQ to verify this as working.

 

[Dragondoom]

if it works = DD, i wouldnt post it if it didn't work.

Just so you know you can't verify your own attempt at access, there are many great people from RedGuides that play EQ and this will be looked into. For something like this that may take a few attempts to get to work you may have to wait for verification.. Hope this helps.

 

[Jigs21]

I spent a few minutes playing with this, it deffinately works. I'd like to see you clean up your post a bit and make it neat. If this happens to make it inside before you edit it, I'd ask you still please take the time to edit it and make it more organized, structured, etc.


Confirmed.

 

[smithers138]

I can do that

 

[RedBema]

Nice edit.

Welcome to the Redguides, hope you enjoy your stay.

 

[smithers138]

Thanks

 

[smithers138]

Hey guys,

I have been getting a few messages asking what else you can do with memory editing, there are a few things I really want to figure out but I need some info first.

1) I want to modify run speed, I am pretty sure this is stored client side but I have no clue what the opcode i am searching for would be, if this is not stored server side does anyone know if current buffs are, could adjust the run speed by tricking the client into thinking it has selos. I think this has definate potential if I could just get a bit more information.

2) Someone asked me if Plat could be changed, I am 99 percent sure it cant you can find your platinum value in memory by searching for the amount you have then taking a few platinum out of it and searching for the new value, but the second you change it you CTD. Note: I have tested this with trade window bank and inventory window, I have also tested it with pvp points, CTD on changing it. I have also tried searching for different ways platinum could be stored.

 

[Pugs]

Yes you can offset run speed but you will crash that is why we have a plugin that speeds you up for a few ticks then slows you down and the speeds you up ...ad nausem.

plat is stored server side and if the client gets out of sync it will kick you, so the best you can do is change the display value.

 

[smithers138]

Easy Way To Get X Y Z all at once.
Uses: warp underground using Z then change X + Y to go to the location you want to go to, then use Z to return yourself to ground level. Somtimes you may need to warp outside a wall then down then to your location adn back up. Play with it

Using Art money Like before we want to do a search and filter, this time there is less filtering.

- Open Art Money and Select the everquest Process
- Click the search button
--Search = Sequence of numbers
-- Number of Values = 3
--Type = Float(standard)
-- Address Range = all
- Click OK

- On your everquest Screen type /loc and you will get 3 values, X, Y Z
- Enter these values in the Input of sequence Screen (1=X, 2=Y, 3=Z) the order is very impotant.
- Click ok, this will take a while because its searching for 3 floating point values.
- Once complete on the left side of Art Money you should have a list of addresses, when you double click on one it will add three values to your table.
- usually one of the first 5 sets of 3 is your location X Y Z, lock them one set at a time and go to your everquest screen and see if you can move, if your character does the walking motion but doesnt move you have the correct set. For more information on filtering and locking check my first post in this thread.

 

[Czarman]

Hey guys,

I have been getting a few messages asking what else you can do with memory editing, there are a few things I really want to figure out but I need some info first.

1) I want to modify run speed, I am pretty sure this is stored client side but I have no clue what the opcode i am searching for would be, if this is not stored server side does anyone know if current buffs are, could adjust the run speed by tricking the client into thinking it has selos. I think this has definate potential if I could just get a bit more information.

2) Someone asked me if Plat could be changed, I am 99 percent sure it cant you can find your platinum value in memory by searching for the amount you have then taking a few platinum out of it and searching for the new value, but the second you change it you CTD. Note: I have tested this with trade window bank and inventory window, I have also tested it with pvp points, CTD on changing it. I have also tried searching for different ways platinum could be stored.

Actually the more recent speed plugins would check for a certain OpCode (0x2221) and return False when it was detected. You could run all day long at any speed you wanted (provided no one else saw you). But the important thing was the OPCODE which now is pretty messed up. (see below)

Plat is serverside. So you can make believe that you are changing it clientside, but once you try and trade or drop it you'll mostlikely crash.

04/20/07 EQGAME.EXE

.text:004D9DB6                 push    offset aSendingLogout_ ; "Sending Logout."
.text:004D9DBB                 call    sub_61A170      ; Call Procedure
.text:004D9DC0                 mov     edx, dword_9762E8
.text:004D9DC6                 mov     ecx, dword_737260
.text:004D9DCC                 add     esp, 4          ; Add
.text:004D9DCF                 push    1
.text:004D9DD1                 push    esi
.text:004D9DD2                 dec     edx             ; Decrement by 1
.text:004D9DD3                 push    2221h <---- SpeedCrash OpCode
.text:004D9DD8                 mov     dword_9762E8, edx
.text:004D9DDE                 call    CObfuscator__doit ; New Packet Screwer Upper
.text:004D9DE3                 push    eax
.text:004D9DE4                 push    offset __gWorld
.text:004D9DE9                 push    esi
.text:004D9DEA                 push    esi
.text:004D9DEB                 call    __SendMessage   ; SendEQMessage

 

[Roguish]

Aren't all the docracks simply memory tweaks like this one?

http://www.redguides.com/community/showthread.php?t=16828 is the most recent list of docracks, I'm going to copy and past two of them here.

[BagSize]
Description="Place any size items in any container"
Version="2007.04.20"
Address0=4DF694
Normal0="74"
crack0="EB"

[BankAnywhere]
Descrition="Right Click PC/NPC Shows Bank"
Version="2007.04.20"
Address0=4D222A
Normal0="75 4B"
Crack0="90 90"

So that means you could open up your nifty memory editor and check out this list right here and enter in the numbers. For BagSize you go to address 4DF694, where you can normally find a 74 and switch it to EB. Same goes for BankAnywhere, all the information you need is there, go stright to 4D222A and change the 75 4B which is there to 90 90.

I've not tried any of this or know if that's all the info you need but you might try it out.

 

[smithers138]

Hello All,

I have been really busy since I posted this and havent really had time to check back much. Has anyone found this usefull at all, or found anything new to do with this?? I have a bit of spare time next week sof i anyone has any good ideas post em and ill messa round with it.

 

[Lichd2]

Hmm, i know i am gonna get flamed but w/e. Try making a version of NoDelay with this? I am not sure if weapon delays are stored clientside, but who knows.

 

[Siddin]

They used to be client side (had that one working for about 3 months) but they're server side now.