• You've discovered RedGuides, an EverQuest multi-boxing and scripting community 🧙‍♀️⚙️. We want you to play several EQ characters at once, come join us and say hello! 👋

  • A TLP without truebox has thawed (Very Vanilla ready)
    Frostreaver

MQ2Vanguard (Makes Warp A Wee Bit Safer) Beta 1.1

TeachersPet

Well-known member
Joined
Jul 27, 2005
RedCents
71¢
This plugin protects people from being banned by using warp by setting all movement deltas to zero. That is SoE's primary detection method of players using warp so this should keep people a lot safer. However, I make no promises as you can still get banned using warp, just GM's can't track you nearly as easily.

Usage: Just load this plugin and use your regular warping plugin

Update 10/22/06 at 1:59PM: Now only zeroes deltas if they are greater than 7

Rich (BB code):
/*	
	MQ2Vanguard by TeachersPet
	
	OnSendPacket borrowed from randomguy_01's MQ2Ghost
	
	This plugin protects people using warp from being banned
	by ensuring Movement deltas are set to zero.  That is SoE's
	primary red flag for warp and their only method of telling
	to my knowledge without actually witnessing the act.
*/

#include "../MQ2Plugin.h"

PreSetup("MQ2Vanguard");

DWORD memchecks_addr = (DWORD)GetProcAddress(ghModule, "memchecks");

#define OP_Movement 0x178a

// THIS STRUCT WAS MOST DEFINITELY NOT STOLEN FROM ODESSA (I think maybe please?)
typedef struct _MovePacket {
     unsigned short SpawnID;
     unsigned short TimeStamp;
     int ZHeading:12;
     unsigned int HeadingRemainder:2;
     unsigned int Heading:10;
     unsigned int paddingHeading:8;
     float DeltaY;
     unsigned int Animation:10;
     unsigned int paddingAnimation:22;
     float DeltaX;
     float Y;
     int DeltaHeading:10;
     int paddingDeltaHeading:22;
     float DeltaZ;
     float Z;
     float X;
} MovePacket, *PMovePacket;

BOOL PluginsSendPacket(DWORD Type, PVOID Packet, DWORD Size)
{
	typedef BOOL (__cdecl *fMQSendPacket)(DWORD, PVOID, DWORD);
	bool bSend = true;
	PMQPLUGIN pPlugin = pPlugins;
	while(pPlugin)
	{
		fMQSendPacket SendPacket = (fMQSendPacket)GetProcAddress(pPlugin->hModule, "OnSendPacket");
		if (SendPacket)
		{
			if (!SendPacket(Type, Packet, Size)) bSend = false;
		}
		pPlugin = pPlugin->pNext;
	}
	return bSend;
}

DETOUR_TRAMPOLINE_EMPTY(VOID memchecks_trampoline(PVOID, DWORD, PCHAR, DWORD, BOOL));
VOID memchecks_detour(PVOID A, DWORD B, PCHAR C, DWORD D, BOOL E)
{
	if (PluginsSendPacket(B, C, D)) memchecks_trampoline(A, B, C, D, E);
}

PLUGIN_API BOOL OnSendPacket(DWORD Type, PVOID Packet, DWORD Size)
{
	if (Type == OP_Movement)
	{
		PMovePacket MovePkt = (PMovePacket)Packet;
		if(MovePkt->DeltaX > 7 || MovePkt->DeltaX < -7)
			MovePkt->DeltaX = 0;
		if(MovePkt->DeltaY > 7 || MovePkt->DeltaY < -7)
			MovePkt->DeltaY = 0;
		if(MovePkt->DeltaZ > 7 || MovePkt->DeltaZ < -7)
			MovePkt->DeltaZ = 0;
	}
	return true;
}

PLUGIN_API VOID InitializePlugin(VOID)
{
	EzDetour(memchecks_addr, memchecks_detour, memchecks_trampoline);
}

PLUGIN_API VOID ShutdownPlugin(VOID)
{
	RemoveDetour(memchecks_addr);
}
 
Last edited:
Re: MQ2Vanguard (Makes Warp Safer)

Thumbs up and a red cent for you. =-) Nice work. Now I just gotta learn how to complie this thing
 
Re: MQ2Vanguard (Makes Warp Safer)

Not bad at all. Let me see if I can understand this. U load this plugin with also mq2rwarp? This plugin not a warp plugin itself?

Sorta like mq2pax is like for mq2speed and such
 
Re: MQ2Vanguard (Makes Warp Safer)

<----- need to spread rep to others before giving to TP at this time...

your getting a few for this one.
 
Re: MQ2Vanguard (Makes Warp Safer)

lol same i just gave tp one for the other one last night
 
Re: MQ2Vanguard (Makes Warp Safer)

anyone have a quick rundown of what needs to be done to run this and warp safely?

You have given out too much Reputation in the last 24 hours, try again later. Sorry Teepee
 
Re: MQ2Vanguard (Makes Warp Safer)

Giraffe said:
anyone have a quick rundown of what needs to be done to run this and warp safely?

You have given out too much Reputation in the last 24 hours, try again later. Sorry Teepee

from looking at it, all you need to do is compile/load the plugin. once loaded it modifies outgoing movement packets before they are sent to the server
 
Re: MQ2Vanguard (Makes Warp Safer)

Devlin said:
Nice work TP, keep up the awesome plugin development and the likes;

Zeroing out delta's does not make warping safer.
 
Re: MQ2Vanguard (Makes Warp Safer)

It does indeed. I know this because I have other quotes from GM correspondance directly stating the method they use (accidently of course).

Christine McCoard aka GM Darcfae said:
Our logs indicate a significant change in deltas on numerous occaisions including several times on 8/16/06 in Old Sebilis at and around 10:20 PM PDT you moving to the spawnpoint of "blood of chottal" and back to the zone-in. This is a clear violation of the EverQuest EULA and we will be taking appropriate action against your account.

I had a working movement struct that would work just fine for this from JSniff. This one however has the correct section for determining heading thanks to a certain somebody in the #macroquest channel (because I needed to hack headings for one of my plugin requests). I doubt he'd want his name shown here but I'll ask him if he wants credit. I assure you it wasn't odessa because odessa thinks I'm a douche.

P.S. When I got the struct it had the bytes commented at the left so odessa and I must read each others minds when it comes to formatting our structs.
 
Re: MQ2Vanguard (Makes Warp Safer)

TeachersPet said:
If they added in a 0 check then anyone extremely lagging and dropping every packet saying that they are moving until they are done would be banned.

Correct. It's all about patterns. If the server never, ever receives delta data other than zero.. I don't care how much you lag, that's impossible.

Also they have other packets that track movement during lag. And thus the reason why that GM said in his message to you:

In some cases characters on the accounts have crossed some of the largest zones in the game between one data packet and the next; in others they have crossed from a zone entrance directly to a notable point or NPC within the zone in the same amount of time. No router issue, lag spike, or dual-core processor can produce the kind of data our logs are generating when your accounts are queried.

This packet contains data about where you are every tick. All they have to do is sort through the data and check how far you moved from point a to b and then mark you. That's assuming they are even doing that.
 
Re: MQ2Vanguard (Makes Warp Safer)

Here's an example of a lag spike move packet and the tracking packet:

Rich (BB code):
>> Send    [ Type: 6026 (0X178A) Size: 40 b(s) Time: 21:09:09 ]
------------------------------------------------------------------
C8 6B A8 12 | B2 C7 13 05 | D5 51 31 3F | 29 DC 12 00 | : 16
56 4F F3 3E | FC 9C 52 45 | 00 50 49 1B | 00 00 00 00 | : 32
D6 5D D9 41 | D4 70 70 44 | 3D 00 00 00 | 00 00 00 00 | : 48
------------------------------------------------------------------

>> Send    [ Type:  (0X) Size: 341 b(s) Time: 21:09:09 ]
------------------------------------------------------------------
7A 9B 52 45 | 05 68 70 44 | 00 91 E8 41 | 02 86 51 81 | : 16
12 FC 9C 52 | 45 D4 70 70 | 44 09 91 E8 | 41 01 F7 52 | : 32
A7 12 FC 9C | 52 45 D4 70 | 70 44 09 91 | E8 41 02 FE | : 48
52 A8 12 71 | 9F 52 45 2E | 7F 70 44 E6 | 93 E8 41 01 | : 64
01 53 A9 12 | CD A2 52 45 | C8 92 70 44 | 85 98 E8 41 | : 80
01 0C 53 AA | 12 E1 A5 52 | 45 C2 A4 70 | 44 D7 9E E8 | : 96
41 01 15 53 | AB 12 89 A9 | 52 45 17 BA | 70 44 A9 A4 | : 112
E8 41 01 1F | 53 AC 12 56 | AD 52 45 44 | D0 70 44 8C | : 128
AB E8 41 01 | 29 53 AD 12 | D6 B0 52 45 | B2 E4 70 44 | : 144
AF B2 E8 41 | 01 32 53 AE | 12 C8 B4 52 | 45 BB FB 70 | : 160
44 42 B9 E8 | 41 01 3D 53 | AF 12 7E B7 | 52 45 8D 0B | : 176
71 44 A4 C0 | E8 41 01 47 | 53 B0 12 07 | B9 52 45 84 | : 192
14 71 44 D0 | C5 E8 41 01 | 51 53 B1 12 | FB B9 52 45 | : 208
19 1A 71 44 | A9 C8 E8 41 | 01 5B 53 B2 | 12 83 BA 52 | : 224
45 36 1D 71 | 44 7F CA E8 | 41 01 64 53 | B3 12 E0 BA | : 240
52 45 5B 1F | 71 44 84 CB | E8 41 01 6E | 53 B4 12 19 | : 256
BB 52 45 AD | 20 71 44 48 | CC E8 41 01 | 78 53 B5 12 | : 272
37 BB 52 45 | 65 21 71 44 | BA CC E8 41 | 01 81 53 B6 | : 288
12 4D BB 52 | 45 EE 21 71 | 44 0C CD E8 | 41 01 8C 53 | : 304
B7 12 58 BB | 52 45 36 22 | 71 44 4A CD | E8 41 01 96 | : 320
53 B8 12 5E | BB 52 45 5D | 22 71 44 75 | CD E8 41 01 | : 336
A0 53 B9 12 | 85 9B 00 00 | 00 00 00 00 | 00 00 00 00 | : 352
------------------------------------------------------------------

And three seconds later, no lag spike:

Rich (BB code):
>> Send    [ Type: 6026 (0X178A) Size: 40 b(s) Time: 21:09:11 ]
------------------------------------------------------------------
C8 6B A8 13 | 5E D7 7E 05 | 00 00 00 00 | 00 DC 12 00 | : 16
00 00 00 00 | 63 B6 52 45 | 00 50 49 1B | 00 00 00 00 | : 32
7E 9E DA 41 | 27 7A 72 44 | 19 00 00 00 | 00 00 00 00 | : 48
------------------------------------------------------------------

>> Send    [ Type:  (0X) Size: 18 b(s) Time: 21:09:12 ]
------------------------------------------------------------------
63 B6 52 45 | 27 7A 72 44 | B1 D1 E9 41 | 02 4F 5D A8 | : 16
13 63 B6 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | : 32
------------------------------------------------------------------

Same packet, different amounts of data. I won't go into the structure of the packet, but it contains everything that the client is doing movement wise.

Everything we do is an assumption, no one can say FACT this or that. We are just guessing, some more educated than others.
 
Re: MQ2Vanguard (Makes Warp Safer)

someone needs to make a plugin to summon npcs to your location....now you don't have to move.... bet they don't log npc movement.......yet
 
Re: MQ2Vanguard (Makes Warp Safer)

TeachersPet said:
It does always zero out deltas but I could add in a fix for that very easily. If you look at the time I posted this it was just a WEE bit late at night and I made it in about 10 minutes beforehand.

It's not like it will make any difference though, the only known purpose for Movement deltas is to catch hackers and if you find me someone who can prove otherwise I'll send them $20 from the money I made selling powerlevels.

TP, I actually believe that zeroing deltas on warp will work (in your case you are zeroing all deltas and to me that's an easy catch on sony's side). It's just the way you go about this. You don't know any of this for sure but you talk like you do. Yes it is possible that you hit a lag spike all the way to your warp location and then you stopped there and waited for one more packet which will have deltas of zeroes. It all makes sense but if there's one thing I learend in life it's not to sign your name under anything you are not sure about. You always do just that. It's probably just ignorance but you have to work on that, a small disclaimer - 'Here it is guys, no idea if it actually works, here's my experience but use at your own risk' - goes a long way.
 
Re: MQ2Vanguard (Makes Warp Safer)

solitarytaco said:
someone needs to make a plugin to summon npcs to your location....now you don't have to move.... bet they don't log npc movement.......yet

You can do that easily by just changing the coords of the xyz in the spawn packets, but you'll never be able to kill it, the server knows where you are in relation to the spawn and won't allow you to interact/hit it.
 
Re: MQ2Vanguard (Makes Warp Safer)

Keep us posted, I look forward to your results.

For me using various methods: 360,012 warps (yes I'm tracking them), on a test account using a simple macro and various conditions, no bans yet.
 
Re: MQ2Vanguard (Makes Warp Safer)

Well i have serious doubt about this solution, i'm not sure that this actually will make you safer at all, well zeroing some deltas information might look right in theorie but well what happends if actually sony send ya a packet with false delta on it (that might look suspicious) you gonna return them a packets fills with 0's at end? Humm it's like returning them yes i hack and i use Macroquest ... ROFL

s0rCieR
 
Re: MQ2Vanguard (Makes Warp Safer)

Well, the way I did it now should only trigger and zero out if you excede max selos, which means you'd already be hacking.
 
Re: MQ2Vanguard (Makes Warp Safer)

im not sure if its related but in frostcryp pulling i lost aggro suddenly no reason no fade no nada. Is it from FC or delta 0 makes it happen? Not all the time tho, not with selos, run 8
 
Re: MQ2Vanguard (Makes Warp Safer)

Oceanrescue said:
im not sure if its related but in frostcryp pulling i lost aggro suddenly no reason no fade no nada. Is it from FC or delta 0 makes it happen? Not all the time tho, not with selos, run 8
I have had mobs de-agro automatically without Feigning or Fading, too. It's happened so much to me that I usually expect it to happen, when I'm in charge of pulling.

I think it might be a TSS thing.
 
Re: MQ2Vanguard (Makes Warp Safer)

Thx TP for releasing this in a effort to help the average person here at RG.

I am confused a little about some of the responses to this. On one hand there is Cobalt very upset about where the original code came from and that it should not have been released to the general public. On the other hand there is Odessa saying yes it is his work but it will not help.

If the code does not work and the goal is to protect the masses then why not just say that. Even if the code is not perfect, it seems there must be some promise in this method or why else would someone with the skill level of Odessa be working on it?

If someone were to give me inside info and did not care if I spread it around, of course I would share it here. If someone were to give me inside info and said this is Top Secret, I would not even tell my kids who play with me. That is how this site is supposed to work.

In short I think Odessa and TP have both given alot to this community (I for one am grateful to both) and I am sure neither of them shares everything they know here which is understandable.
 
Re: MQ2Vanguard (Makes Warp Safer)

On one hand there is Cobalt very upset about where the original code came from and that it should not have been released to the general public.

If the original author wants to release the exact way to prevent warp detection, or the exact way to dupe any item, that's his/her choice. If someone rips it off and posts it without permission, that sucks. If I was really angry, you'd know. I'm just annoyed that we have a leak. :)
 
Re: MQ2Vanguard (Makes Warp Safer)

Even if the code is not perfect, it seems there must be some promise in this method or why else would someone with the skill level of Odessa be working on it?

You misunderstand. What Odessa did was the struct. While it is being used here, the struct is the same thing that is used in Csum, gank, piggyzone, etc...everything that manipulates MovePkt uses that struct. Odessa's work was to completely define what all of the parts of the struct do. That kind of work can be applied to many different types of plugins. TP just chose to apply it here.
 
Re: MQ2Vanguard (Makes Warp Safer)

Personally i'd change it to say for each of the delta's... but thats just me.

if(MovePkt->DeltaZ > 7) MovePkt->DeltaZ = 7;

if(MovePkt->DeltaZ < -7) MovePkt->DeltaZ = -7;
 
Re: MQ2Vanguard (Makes Warp Safer)

looks neat can't wait to try it out today :)
 
Re: MQ2Vanguard (Makes Warp Safer)

So what would the packet look like with all the delta zeroed? all zeros?

If they are using some type of sniffer program if the deltas are zeroed then their program would miss it, if they are set to look for a movement bigger than X? I can not believe some GM is sitting going through this stuff, cuz that job would suck.

Will wait to see what pops up in this thread, great debate guys thanks for taking the time to show us both sides of the coin and for Siddi for editing the flames although those do make for great reading. lol

thanks
 
Re: MQ2Vanguard (Makes Warp Safer)

Why not just use random num generator for delta 0 to 7 instead of a specific number. Not that I ever get enough time to know why when working 50 to 60 hr. Disregard if it is wrong idea.
 
Re: MQ2Vanguard (Makes Warp Safer)

tledgend said:
Why not just use random num generator for delta 0 to 7 instead of a specific number. Not that I ever get enough time to know why when working 50 to 60 hr. Disregard if it is wrong idea.
I actually like that idea more than either the set it to 0 or set it to 7...
 
Re: MQ2Vanguard (Makes Warp Safer)

thez said:
You misunderstand. What Odessa did was the struct. While it is being used here, the struct is the same thing that is used in Csum, gank, piggyzone, etc...everything that manipulates MovePkt uses that struct. Odessa's work was to completely define what all of the parts of the struct do. That kind of work can be applied to many different types of plugins. TP just chose to apply it here.

But isn't that what many of us do here with macros? It seems to me most of the macros around are modified versions of someone else macro. Granted most of the time the original author is credited at the top but this is not always the case. When I decide to start coding plugins I would definately want to start with modifying one that was written by someone like Odessa.

If the main issue is whether or not TP knowingly took work that Odessa did not want public and posted it anyway, then I am inclined to take TP's word that he got this from someone else, modified it and posted it.
 
Re: MQ2Vanguard (Makes Warp Safer)

Odessa creates a plugin that makes warping safer for all MQ2 Users

Odessa keeps it secret?

Whos the asshat?

Nice job TP for trying to help the redguides community at least, One reason why i always like what you do , and because that sig you use is so damn sweet!
 
Re: MQ2Vanguard (Makes Warp Safer)

Spunge16 said:
Odessa creates a plugin that makes warping safer for all MQ2 Users

Odessa keeps it secret?

Whos the asshat?

Nice job TP for trying to help the redguides community at least, One reason why i always like what you do , and because that sig you use is so damn sweet!

1. Nobody is obligated to give anything away that they have worked on.
2. Odessa figured out a structure which includes a LOT more than just what you see here.
3. A lot of people could get banned with this plugin if SOE figures out a way to differentiate the hackers from the non hackers.
4. And it's "WHO'S" as in "WHO IS" the asshat, which would be you.
 
Re: MQ2Vanguard (Makes Warp Safer)

Spunge16 said:
Odessa creates a plugin that makes warping safer for all MQ2 Users

Odessa keeps it secret?

Whos the asshat?

Nice job TP for trying to help the redguides community at least, One reason why i always like what you do , and because that sig you use is so damn sweet!

Dude, do I owe you something or you are just talking out of your ass?
 
Re: MQ2Vanguard (Makes Warp Safer)

Not to derail this topic, although the question will seem in left field to begin with.

Has anyone messed around with the Path to NPC or Path to PC functions of the UI?

The reason I ask is that if we could intercept the coordinates from the "path to" functions then we could hop along it without worrying about zone barriers and obstructions.

I've notice when warping that the near by mobs take a few ticks to realize you're there. I suppose it's the time it takes the server to get your new coordinates and apply it to other location positioning checks.

So...if we could hop quickly enough along the "path" then we may defeat the server side proximity checks without tripping the delta check or having to resort to spoofing the packets.

Just a thought....
 
Re: MQ2Vanguard (Makes Warp Safer)

Yes its been thought of, but it would be a large drain on the server and as such VERY noticible. Even if you could get it to work.
 
Re: MQ2Vanguard (Makes Warp Safer)

Whats the packet report when your summoned a great distance? Is there a check in the packet that confirms a summoned "warp"
 
MQ2Vanguard (Makes Warp A Wee Bit Safer) Beta 1.1

Users who are viewing this thread

Back
Top
Cart