MQ2EmulatorLib (Emulator Library)

[unknown405]

Used for all sorts of different plugins. I know there aren't many coders other than me for EQ Emu anymore, but if anyone wants to help contribute then please do. I have a ton more than this in a different library, I recently re-formatted to a new library so this isn't complete. I will be updating the rest tomorrow, figured I'd post what I got before I went to sleep.

MQ2EmulatorLib.cpp

/*	
	MQ2EmulatorLib
	Created by: UnKnoWn405 [MQ2Source.com Lead Developer, members of NotAddicted and KenetixEQ]

	This file maintains all the necessary functions and offsets for various
	plugins. This is the library I use for EQEmu, with some of my stuff private. 
	Feel free to contribute to this on www.notaddicted.com EQEmu forums. I will update
	it as I add more.
*/

#include "../MQ2Plugin.h"
#include "emulatorlib.h"

PreSetup("MQ2EmulatorLib");

DWORD memchecks_addr = (DWORD)GetProcAddress(ghModule, "memchecks");

BOOL PluginsSendPacket(DWORD Type, PVOID Packet, DWORD Size)
{
	typedef BOOL (__cdecl *fMQSendPacket)(DWORD, PVOID, DWORD);
	bool bSend = true;
	PMQPLUGIN pPlugin = pPlugins;
	while(pPlugin)
	{
		fMQSendPacket SendPacket = (fMQSendPacket)GetProcAddress(pPlugin->hModule, "OnSendPacket");
		if (SendPacket)
		{
			if (!SendPacket(Type, Packet, Size)) bSend = false;
		}
		pPlugin = pPlugin->pNext;
	}
	return bSend;
}

// calls OnGetPacket for each plugin
BOOL PluginsGetPacket(DWORD Type, PVOID Packet, DWORD Size) {
	typedef BOOL (__cdecl *fMQGetPacket)(DWORD, PVOID, DWORD);
	bool bRecv = true;
	PMQPLUGIN pPlugin = pPlugins;
	while(pPlugin) {
		fMQGetPacket GetPacket = (fMQGetPacket)GetProcAddress(pPlugin->hModule, "OnGetPacket");
		if (GetPacket) {
			if (!GetPacket(Type, Packet, Size)) bRecv = false;
		}
		pPlugin = pPlugin->pNext;
	}
	return bRecv;
}

DETOUR_TRAMPOLINE_EMPTY(VOID memchecks_trampoline(PVOID, DWORD, PCHAR, DWORD, BOOL));
VOID memchecks_detour(PVOID A, DWORD B, PCHAR C, DWORD D, BOOL E)
{
	if (PluginsSendPacket(B, C, D)) memchecks_trampoline(A, B, C, D, E);

}

PLUGIN_API VOID InitializePlugin(VOID)
{
	EzDetour(memchecks_addr, memchecks_detour, memchecks_trampoline);
}

PLUGIN_API VOID ShutdownPlugin(VOID)
{
	RemoveDetour(memchecks_addr);
}

emulatorlib.h

//				:: EQ Emulator Opcodes :: 
//					  By: UnKnoWn405
//
//	These were found using ShowEQ and in game packet sniffers.
//	I recently re-wrote it in the same format as ShowEQ opcodes 
//  with edits made to make it easier to read. My opcode library
//  before this was really sloppy and random.	

	
// Logging opcodes
#define OP_Logout                             0x61FF  //Client->World  || Not 100% sure which is
#define OP_LogoutReply                        0x48C2  //World->Client  || client or world opcodes.
#define OP_LevelUpdate                        0x6D44  //World->Client  || I believe is correct
#define OP_Camp                               0x78C1

//Petition opcodes
#define OP_Petition							  0x251F  //Send a petition
#define OP_PetitionDelete                     0x5692  //remove a petition

//Guild opcodes
#define OP_ZoneGuildList                      0x6957
#define OP_GetGuildMOTD						  0x6D5D
#define OP_GuildMemberList                    0x147D  // ALT+G memberslist
#define OP_GuildMOTD                          0x475a  // set guild MOTD?
#define OP_GuildPublicNote                    0x17A2


//GM Commands opcodes
#define OP_GMServers                          0x3387  //    /Servers
#define OP_GMBecomeNPC                        0x7864  //    /becomenpc 
#define OP_GMZoneRequest                      0x1306  //    /zone 
#define OP_GMSearchCorpse                     0x3c32  //    /searchcorpse
#define OP_GMHideMe                           0x15B2  //    /hideme
#define OP_GMGoto                             0x1CEE  //    /goto
#define OP_GMApproval                         0x0C0F  //    /approval
#define OP_GMToggle                           0x7FEA  //    /toggletell
#define OP_GMSummon                           0x1EDC  //    /summon
#define OP_GMEmoteZone                        0x39F2  //    /emotezone
#define OP_GMEmoteWorld                       0x3383  //    /emoteworld
#define OP_GMFind                             0x5930  //    /find	
#define OP_GMKick                             0x692C  //    /kick


//Class Trainer opcodes
#define OP_GMTraining                         0x238F  // when you open a trainer
#define OP_GMEndTraining                      0x613D  // when you close a trainer
#define OP_GMTrainSkill                       0x11D2  // when you train in a skill

//Other opcodes
#define OP_Animation                          0x2ACF
#define OP_MoneyUpdate                        0x267C  // Not useful for anything, I've tried
#define OP_ReadBook                           0x1496
#define OP_Dye                                0x00DD
#define OP_Consume                            0x77D7
#define OP_Begging                            0x13E7 
#define OP_InspectRequest                     0x775D
#define OP_BeginCast                          0x3990
#define OP_BuffFadeMsg                        0x0B2D
#define OP_Consent                            0x1081		
#define OP_LFGGetMatchesResponse              0x45D0			
#define OP_LootItem                           0x7081  // can be used to loot from anywhere			
#define OP_Bug                                0x7AC2  //	/bug			
#define OP_BoardBoat                          0x4298			
#define OP_Save                               0x736B			
#define OP_EndLootRequest                     0x231B			
#define OP_LoadSpellSet                       0x403E			
#define OP_AutoAttack                         0x5E55  // primary			
#define OP_Consider                           0x65CA			
#define OP_Emote                              0x547A			
#define OP_PetCommands                        0x10A1			
#define OP_WhoAllRequest                      0x5CDD			
#define OP_WhoAllResponse                     0x757B			
#define OP_AutoAttack2                        0x0701  // secondary			
#define OP_SetRunMode                         0x4ABA			
#define OP_SenseHeading                       0x05AC			
#define OP_Buff                               0x6A53  // World->Client I believe			
#define OP_LootComplete                       0x0A94 			
#define OP_EnvDamage                          0x31B3  // fall damage, etc.			
#define OP_Split                              0x4848  //	/split, can't be tricked		
#define OP_Surname                            0x4668			
#define OP_MoveItem                           0x420F			
#define OP_FaceChange                         0x0F8E  //	/facepick			
#define OP_ItemPacket                         0x3397  // Look at EQEmu source ;)			
#define OP_ClientReady                        0x5E20  // Unknown		
#define OP_ZoneChange                         0x5DD8  // Sent when requesting zone change			
#define OP_MemorizeSpell                      0x308E			
#define OP_ItemLinkClick                      0x53E5			
#define OP_SwapSpell                          0x2126			
#define OP_Forage                             0x7C33			
#define OP_ConsentResponse                    0x6380			
#define OP_BazaarSearch                       0x1EE9  			
#define OP_NewSpawn                           0x1860  // World->Client
#define OP_LeaveBoat                          0x67C9			
#define OP_Weather                            0x254D  // I believe World->Client, not sure			
#define OP_LFPGetMatchesRequest               0x35A6			
#define OP_Illusion                           0x448D  // I believe World->Client, not sure			
#define OP_TargetMouse                        0x6C47			
#define OP_InspectAnswer                      0x2403			
#define OP_GMKill                             0x6980  //	/kill 		
#define OP_MoneyOnCorpse                      0x7fE4  // World->Client			
#define OP_ClickDoor                          0x043B						
#define OP_LootRequest                        0x6F90  // Sent to server to check if you can loot			
#define OP_YellForHelp                        0x61Ef  //	/yell			
#define OP_ManaChange                         0x4839  // World->Client			
#define OP_ConsentDeny                        0x4E8c			
#define OP_LFPCommand                         0x6F82			
#define OP_RandomReply                        0x6CD5			
#define OP_DenyResponse                       0x7C66			
#define OP_ConsiderCorpse                     0x773F			
#define OP_ConfirmDelete                      0x3838			
#define OP_SkillUpdate                        0x6A93  // World->Client			
#define OP_RandomReq                          0x5534  // I don't know			
#define OP_CastSpell                          0x304B  // Client->World, can't be altered			
#define OP_Movement	                          0x14CB			
#define OP_Report                             0x7F9D  //	/report			
#define OP_GroundSpawn                        0x0F47			
#define OP_LFPGetMatchesResponse              0x45D0			
#define OP_Jump                               0x0797			
#define OP_ExpUpdate                          0x5Ecd  // World->Client			
#define OP_Death                              0x6160			
#define OP_Mend                               0x14Ef
#define OP_Damage                             0x5C78  // World->Client
#define OP_Assist                             0x7709		

//Trading opcodes
#define OP_TradeRequest                       0x3EA0			
#define OP_TradeAcceptClick                   0x0065			
#define OP_TradeRequestAck                    0x4048			
#define OP_CancelTrade                        0x2DC1

//Merchant opcodes
#define OP_ShopPlayerSell                     0x0E13  // sell item			
#define OP_ShopEnd                            0x7E03  // close window
#define OP_ShopPlayerBuy                      0x221E  // buy item		
#define OP_ShopRequest                        0x45F9  // open window

//Tradeskill opcodes
#define OP_ClickObject                        0x3BC2			
#define OP_ClickObjectAction                  0x6937
#define OP_RecipeDetails                      0x4EA2
#define OP_RecipesFavorite                    0x23F0
#define OP_RecipesSearch                      0x164D
#define OP_RecipeAutoCombine                  0x0353
#define OP_TradeSkillCombine                  0x0B40

//Dueling opcodes
#define OP_DuelResponse2                      0x1B09 // sent when you accept duel

//Tracking opcodes
#define OP_Track                              0x5011

//Tribute opcodes
#define OP_OpenTributeMaster                  0x512E // open tribute master window
#define OP_OpenTributeReply                   0x27B3 // reply to open request
#define OP_SelectTribute                      0x625D // clicking on a tribute, and text reply
#define OP_TributeItem                        0x6F6C // donating an item
#define OP_TributeMoney                       0x27B3 // donating money
#define OP_TributeToggle                      0x2688 // activating/deactivating tribute
#define OP_TributeTimer                       0x4665 //	a 4 byte tier update, 10 minutes for seconds
#define OP_TributePointUpdate                 0x6463 // pointer, 16 bytes
#define OP_SendGuildTributes                  0x5E3A // request packet, 4 bytes
#define OP_SendTributes                       0x067A // request packet, 4 bytes, migth be backwards

//Group & Raid opcodes
#define OP_GroupDisband                       0x0E76			
#define OP_GroupInvite                        0x1B48			
#define OP_GroupFollow                        0x7BC7			
#define OP_GroupUpdate                        0x2DD6
#define OP_GroupCancelInvite                  0x1F27

#define OP_RaidJoin                           0x1F21			
#define OP_RaidInvite                         0x5891			
#define OP_RaidUpdate                         0x1F21

//Button opcodes
#define OP_Taunt                              0x5E48
#define OP_CombatAbility                      0x5EE8
#define OP_Bind_Wound                         0x601D
#define OP_SenseTraps                         0x5666						
#define OP_Fishing                            0x0B36

//Task opcodes
#define OP_CompletedTasks                     0x76A2			
#define OP_TaskDescription                    0x5Ef7			
#define OP_TaskActivity                       0x682D			

//AA opcodes
#define OP_SendAATable                        0x367D			
#define OP_SendAAStats                        0x5918			
#define OP_AAAction                           0x0681			
#define OP_AAExpUpdate                        0x5F58			

//Leadership Ability opcodes
#define OP_LeadershipExpToggle                0x5B37

//Unused opcodes
#define OP_MoveLogRequest                     0x7510 // No longer exists
#define OP_ReclaimCrystals                    0x7CFE

//More opcodes
#define OP_CustomTitles                       0x2A28			
#define OP_Bandolier                          0x6F0C
#define OP_SlashAdventure                     0x571A //		/adventure
#define OP_VetRewardsAvaliable                0x0557
#define OP_PickLockSuccess                    0x40E7

//Login opcodes
#define OP_SessionReady                       0x0001
#define OP_Login							  0x0002
#define OP_ServerListRequest                  0x0004
#define OP_PlayEverquestRequest               0x000D
#define OP_PlayEverquestResponse              0x0021
#define OP_ChatMessage                        0x0016
#define OP_LoginAccepted                      0x0017
#define OP_ServerListResponse                 0x0018
#define OP_Poll                               0x0029
#define OP_EnterChat                          0x000f
#define OP_PollResponse                       0x0011

//HP opcodes
#define OP_MobHealth                          0x0695			
#define OP_HPUpdate                           0x3BCF

//				:: EQ Emulator Structures :: 
//					  By: UnKnoWn405

typedef struct _CorpseOpenPkt {
	DWORD TargetID;
} CorpseOpenPkt;

// GM /hideme structure, useless
typedef struct _HideMePkt {
	WORD TargetID;
	WORD Status;	//set to 3 for hideme
	DWORD Toggle; //1 = on, 0 = off
} HideMePkt;

typedef struct _ScribeSpellPkt {
	DWORD some_flag; //set to 0
	DWORD SpellID;
	DWORD SpellBookSlot;
	DWORD unknown0x1; //set to 0x3ff (1023)
} ScribeSpellPkt;

typedef struct _MemSpellPkt {
	DWORD SpellBookSlot;
	DWORD SpellID;
	DWORD some_flag; //set to 0
	DWORD unknown0x1; //set to 0x3ff (1023)
} MemSpellPkt;

typedef struct _CorpseLootPkt {
	WORD SpawnID;
	WORD Unknown; //0e
	WORD Unknown2; //69
	WORD Unknown3; //00
} CorpseLootPkt;

//Zippzipp's Structure
typedef struct _AASpendPkt {
/*0000*/ DWORD FunctionM; // 1 = SetAAexp 0%, 2 = SetAAexp 100%, 3 = SpendAA
/*0004*/ DWORD Index;     // AA index
/*0008*/ DWORD unk1;		// 0
		 DWORD unk2;		// 0
} AASpendPkt; // size: 0x16

typedef struct _TrainPkt {
	DWORD TargetID;
	DWORD Some_Flag; //set to 0
	DWORD SlotID; //Skill ID
} TrainPkt;

typedef struct _SplitPkt {
	DWORD Platinum;
	DWORD Gold;
	DWORD Silver;
	DWORD Copper;
} SplitPkt;

typedef struct _MoneyPkt {
	DWORD SpawnID;
	DWORD platinum;
	DWORD gold;
	DWORD silver;
	DWORD copper;
} MoneyPkt;

typedef struct _CoinsPkt {
	BYTE packet;
} CoinsPkt;

typedef struct _RequestPkt {
	DWORD TargetID;
} RequestPkt;

typedef struct _GroupInvitePkt {
	char invitee_name[64];
	char inviter_name[64];
} GroupInvitePkt, *PGroupInvitePtk;

typedef struct _GroupAcceptPkt {
/*0000*/	DWORD		action;
/*0004*/	char		yourname;
/*0068*/	char		membername;
/*0132*/	DWORD		unknown[84];
} GroupAcceptPkt, *pGroupAcceptPkt;

//When purchasing items from LDoN vendors
typedef struct _LdonPkt {	
/*000*/	DWORD	PriceCheck;	//set to 1 generally...
/*000*/	DWORD	TargetID;
/*004*/	DWORD	ItemID;
/*008*/	DWORD	PriceCheck2;
} LdonPkt;

typedef struct _DuelPkt {
	/*0000*/DWORD TargetID;
} DuelPkt;

 // Cast packet
 typedef struct _CastPkt {
  DWORD SlotNum;
  DWORD SpellID;
  DWORD Unknown_Mask; 
  DWORD TargetID; 
  DWORD APICheck;
 } CastPkt, *PCastPacket; 
   
 // Click packet
 typedef struct _ClickPkt {
  DWORD SlotNum;
  DWORD SpellID;
  DWORD Unknown_Mask; 
  DWORD SpawnID; 
  DWORD Unknown0x10;
 } ClickPkt, *PClickPacket;


typedef struct _MoneySwapPkt {
	/*0000*/ int platinum;
	/*0000*/ int gold;
	/*0000*/ int silver;
	/*0000*/ int copper;
	/*0000*/ int platinum_bank;
	/*0000*/ int gold_bank;
	/*0000*/ int silver_bank;
	/*0000*/ int copper_bank;
} MoneySwapPkt, *pMoneySwapPkt;


typedef struct _MerchantPkt {
	/*0000*/ WORD Chksum;
	/*0000*/ DWORD SpawnID;
	/*0000*/ DWORD PlayerID;
} MerchantPkt, *pMerchantPkt;

typedef struct _CombatAbilityPkt {
	/*0002*/ DWORD TargetID;
	/*0006*/ DWORD Attack;
	/*000A*/ DWORD Ability;
} CombatAbilityPkt, *pCombatAbilityPkt;

// Movement packet
typedef struct _MovePkt {
	/*0000*/ unsigned short SpawnID;
	/*0002*/ unsigned short TimeStamp;
	/*0004*/ float Y;
	/*0008*/ float DeltaZ;
	/*0012*/ float DeltaY;
	/*0016*/ float DeltaX;
	/*0020*/ int Animation:10;
	/*0020*/ int DeltaHeading:10;
	/*0020*/ int padding0020:12;
	/*0024*/ float X;
	/*0028*/ float Z;
	/*0032*/ int Heading:12;
	/*0032*/ int padding1_0032:10;
	/*0032*/ int padding2_0032:10;
} MovePkt, *pMovePkt;

// Switch Packet
typedef struct _SwitchPkt {
	/*0002*/ DWORD SwitchID;
	/*0006*/ DWORD unkn1;
	/*000A*/ DWORD unkn2;
	/*000D*/ DWORD SpawnID;
} SwitchPkt, *pSwitchPkt;

// Open Packet
typedef struct _OpenPkt {
	/*0000*/ WORD packet;
} OpenPkt, *pOpenPkt;

// Gank Packet
typedef struct _GankPkt {
	/*0002*/ DWORD DropID;
	/*0006*/ DWORD SpawnID;
} GankPkt, *pGankPkt;


//				:: EQ Emulator Functions :: 
//					  By: UnKnoWn405

// Movement function
VOID MoveTo(float x, float y, float z){ 
             PSPAWNINFO pMe = GetCharInfo()->pSpawn;

	     MovePkt mp;
	     ZeroMemory(&mp,sizeof(mp));

        mp.SpawnID = pMe->SpawnID;
        mp.Heading = pMe->Heading;
	mp.X = x;
        mp.Y = y;
        mp.Z = z;

	SendEQMessage(OP_Movement,&mp,sizeof(mp));
}

// SayTarget Function
VOID Target_Say(PCHAR szLine){
	PSPAWNINFO pMyTarget = (PSPAWNINFO)pTarget;
	PSPAWNINFO pMe = GetCharInfo()->pSpawn;
	CHAR SendMsg[MAX_STRING]={0};

        if (!pTarget || !ppTarget) return;

	MoveTo(pMyTarget->X,pMyTarget->Y,pMyTarget->Z);
	sprintf(SendMsg,"/say %s",szLine);
	DoCommand(pMe,SendMsg);
	MoveTo(pMyTarget->X,pMyTarget->Y,pMyTarget->Z);
}

-UnKnoWn

 

[unknown405]

Right now I just have basic OnSendPacket and OnGetpacket functions in the source file. I actually have a lot more than that in the normal library, with some being private obviously. I'll finish transferring to the new library when I get a chance. The reason I'm making a new library is because the one I have right now is so damn sloppy I don't know where anything is.

-UnKnoWn

 

[unknown405]

Just updated, I have almost every opcode there is including World->Client opcodes. I labeled them as best I could in the short time I had. I have all the structures, but need to sort out the private ones before I post. I may have them tonight, depending on how tired I am.

-UnKnoWn

 

[Huh]

Sweet - thanks for this list! I've been trying to use IDA to pull out some additional OpCodes, but haven't had much success. =)

 

[pushing4wardback]

Hey unkown I originally developed a private plugin back in 2005 to control mq2 from a cell phone and thus your character. I may be able to help you with some of these emu plugins.

 

[unknown405]

Hey unkown I originally developed a private plugin back in 2005 to control mq2 from a cell phone and thus your character. I may be able to help you with some of these emu plugins.

I replied to your PM before I even read this comment. That's definitely impressive, look forward to working with you. Send me an IM when you can and we'll talk about it.

-UnKnoWn

 

[unknown405]

Updated. Has just about all the opcodes, and most of the public structures I could dig up. Like I said it was a complete mess before so there might be more to come. Still haven't added some functions but that's pretty much it, also need to fix OnGetPacket because it doesn't seem to be working.

-UnKnoWn

**EDIT**
Some new addresses I've found, only one that is tested and working is SendDetour.

#define   uSendDetour              0x5E6EC0

#define __MemChecker1		 0x608C60
#define __EncryptPad1	           0x799870
#define CObfuscator__doit         0x5E3E24
#define CEverQuest__Emote	0x420860

 

[Devlin]

I love you.... I think

 

[unknown405]

I know, I know. Figured posting this would help the lazy bum coders contribute something. To all you emu coders out there that have private hacks, I promise I have either as good or better so send me a PM and tell me what you've got.

-UnKnoWn

 

[Devlin]

I have noDelay, anylevel, anyskill, changerace, summonitem, ban, and dupe.

 

[unknown405]

You sure do, Devlin

-UnKnoWn

 

[Uyndaio]

Id like to get my hands on noDelay, Summonitem, and Dupe. I will have to see what I can find, sense I have not the first clue what to do when it comes to doing it myself. and there is no sense in learning sense I goto iraq in June..

 

[Siddin]

I have noDelay, anylevel, anyskill, changerace, summonitem, ban, and dupe.

you should ban all of the GM's and Admins

 

[Devlin]

werdddd

 

[unknown405]

Devlin doesn't have that stuff lmao.. I'm working on all of that stuff, and once I get OnGetPacket working I'll let you know what the deal is. I'm not sure what OnGetPacket possibilities are on EQEmu but I have some really nice ideas.

-UnKnoWn

 

[Devlin]

unknown, log in now and then.. k?