MuadDib's UO Packet Reference
Author: MuadDib

Welcome to MuadDib's UO Packet Guide.
Here you will find layouts on the Ultima Online client packets.

Packets Sent By Client
0x00 - Create Character
0x01 - Disconnect Notification
0x02 - Move Request
0x03 - Talk Request
0x04 - Request God Mode (God Client)
0x05 - Request Attack
0x06 - Double Click
0x07 - Pick Up Item
0x08 - Drop Item
0x09 - Single Click
0x0A - Edit (God Client)
0x12 - Request Skill etc use
0x13 - Drop->Wear Item
0x14 - Send Elevation (God Client)
0x16 - Request Script Names
0x34 - Get Player Status
0x35 - Add Resource (God Client)
0x37 - Move Item (God Client)
0x38 - Drunken Coder
0x3B - Buy Item(s)
0x5D - Login Character
0x69 - Change Text/Emote Colors
0x72 - Request War Mode
0x75 - Rename Character
0x7D - Response To Dialog Box
0x80 - Login Request
0x83 - Delete Character
0x91 - Game Server Login
0x9B - Request Help
0x9F - Sell List Reply
0xA0 - Select Server
0xA4 - Client Spy
0xA7 - Request Tip/Notice Window
0xAC - Gump Text Entry Dialog Reply
0xAD - Unicode/Ascii speech request
0xB1 - Gump Menu Selection
0xB3 - Chat Text
0xB5 - Open Chat Window
0xB6 - Send Help/Tip Request
0xD9 - Spy On Client
Packets Sent By Server
0x0B - Damage
0x11 - Status Bar Info
0x1A - Object Info
0x1B - Char Locale & Body
0x1C - Send Speech
0x1D - Delete Object
0x20 - Draw Game Player
0x21 - Char Move Rejection
0x23 - Dragging Of Item
0x24 - Draw Container
0x25 - Add Item To Container
0x26 - Kick Player
0x27 - Reject Move Item Request
0x28 - Clear Square (God Client?)
0x29 - Paperdoll Clothing Add Ack
0x2B - God Mode (God Client)
0x2D - Mob Attributes
0x2E - Worn Item
0x2F - Fight Occuring
0x30 - Attack Ok
0x32 - Unknown
0x33 - Pause Client
0x3C - Items In Container
0x3E - Versions (God Client)
0x3F - Update Statics (God Client)
0x4E - Personal Light Level
0x4F - Overall Light Level
0x53 - Idle Warning
0x54 - Play Sound Effect
0x55 - Login Complete
0x5B - Time
0x65 - Set Weather
0x6D - Play Midi Music
0x6E - Character Animation
0x70 - Graphical Effect
0x74 - Open Buy Window
0x76 - New Subserver
0x77 - Update Player
0x78 - Draw Object
0x7C - Open Dialog Box
0x82 - Login Denied
0x86 - Resend Characters After Delete
0x88 - Open Paperdoll
0x89 - Corpse Clothing
0x8C - Connect To Game Server
0x90 - Map Message
0x97 - Move Player
0x9E - Sell List
0xA1 - Update Current Health
0xA2 - Update Current Mana
0xA3 - Update Current Stamina
0xA5 - Open Web Browser
0xA6 - Tip/Notice Window
0xA8 - Game Server List
0xA9 - Characters / Starting Locations
0xAA - Allow/Refuse Attack
0xAB - Gump Text Entry Dialog
0xAE - Unicode Speech message
0xAF - Display Death Action
0xB0 - Send Gump Menu Dialog
0xB2 - Chat Message
0xB7 - Help/Tip Data
0xB9 - Enable locked client features
0xBA - Quest Arrow
0xBC - Seasonal Information
0xC0 - Graphical Effect
0xC1 - Cliloc Message
0xC4 - Semivisible (Smurf it!)
0xC6 - Invalid Map Enable
0xC7 - 3D Particle Effect
0xCB - Global Que Count
0xCC - Cliloc Message Affix
0xD2 - Extended 0x20
0xD3 - Extended 0x78
0xD6 - Mega Cliloc
0xD8 - Send Custom House
0xDB - Character Transfer Log
0xDC - SE Introduced Revision
0xDD - Compressed Gump
0xDF - Buff/Debuff System
0xF0 - Krrios client special
Packets Sent By Both (BiDirectional)
0x0C - Edit Tile Data (God Client)
0x15 - Follow
0x22 - Character Move ACK/ Resync Request
0x2C - Resurrection Menu
0x39 - Remove (Unknown)
0x3A - Send Skills
0x56 - Map Packet (cartography/treasure)
0x66 - Books (Pages, Old Packet)
0x6C - Target Cursor Commands
0x6F - Secure Trading
0x71 - Bulletin Board Messages
0x93 - Books (Title Page, Old Packet)
0x95 - Dye Window
0x98 - All Names (3D Client Only)
0x99 - Give Boat/House Placement View
0xB8 - Request/Char Profile
0xBB - Ultima Messenger
0xBD - Client Version
0xBE - Assist Version
0xBF - General Information Packet
0xC2 - Unicode TextEntry
0xC8 - Client View Range
0xC9 - Get Area Server Ping
0xCA - Get User Server Ping
0xD0 - Configuration File
0xD1 - Logout Status
0xD4 - *New* Book Header
0xD7 - Generic AOS Commands

===================================================================================

Packet Information Section
Packet ID: 0x00 Packet Name: Create Character Packet Size: 104 bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] pattern1 (0xedededed) BYTE[4] pattern2 (0xffffffff) BYTE[1] pattern3 (0x00) BYTE[30] char name BYTE[30] char password BYTE[1] sex (0=male, 1=female) BYTE[1] str BYTE[1] dex BYTE[1] int BYTE[1] skill1 BYTE[1] skill1value BYTE[1] skill2 BYTE[1] skill2value BYTE[1] skill3 BYTE[1] skill3value BYTE[2] skinColor BYTE[2] hairStyle BYTE[2] hairColor BYTE[2] facial hair BYTE[2] facial hair color BYTE[2] location # from starting list BYTE[2] unknown1 BYTE[2] slot BYTE[4] clientIP BYTE[2] shirt color BYTE[2] pants color Notes Note: pattern3 is set to 0xFF to early signal a Krrios' client user, where it expects a 0xF0 | 0x00 before login confirm Str, dex and int should always sum to 65. Str, dex and int should always be between 10 and 45, inclusive. Skill1, skill2, and skill3 should never be the same value. Skill1, skill2, and skill3 should always be between 0 and 45, inclusive. Skill1value, skill2value, and skill3value should always sum to 100. Skill1value, skill2value, and skill3value should always be between 0 and 50, inclusive. SkinColor should always be between 0x3EA and 0x422, exclusive. HairColor and facialHairColor should always be between 0x44E and 0x4AD, exclusive. HairStyle should be between 0x203B and 0x204A, exclusive, and it should also exclude 0x203D to 0x2044, exclusive. FacialHairStyle should be between 0x203E and 0x204D Shirt color and Pants color need bounds checking too.
Packet ID: 0x01 Packet Name: Disconnect Notification Packet Size: 5 bytes Sent By: Client Submitted: MuadDib Description No longer Active. Packet Breakdown BYTE[1] cmd BYTE[4] pattern (0xFFFFFFFF)
Packet ID: 0x02 Packet Name: Move Request Packet Size: 7 bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] direction BYTE[1] sequence number BYTE[4] fastwalk prevention key Notes Sequence number starts at 0, after a reset. However, if 255 is reached, the next seq # is 1, not 0. Fastwalk prevention notes: each 0x02 pops the top element from fastwalk key stack. (0xbf sub1 init. fastwalk stack, 0xbf sub2 pushes an element to stack) If stack is empty key value is 0. (-> never set keys to 0 in 0xbf sub 1/2) Because client sometimes sends bursts of 0x02’s DON’T check for a certain top stack value. The only safe way to detect fastwalk: push a key after EACH x021, 0x22, (=send 0xbf sub 2) check in 0x02 for stack emptyness. If empty -> fastwalk alert. Note that actual key values are irrelevant. (just don’t use 0) Of course without perfect 0x02/0x21/0x22 synch (serverside) it’s useless to use fastwalk detection. Last but not least: fastwalk detection adds 9 bytes per step and player !
Packet ID: 0x03 Packet Name: Talk Request Packet Size: Variable Sent By: Client Submitted: MuadDib Description No longer active. Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[1] SpeechType BYTE[2] Color BYTE[2] SpeechFont BYTE[?] msg - Null Terminated (blockSize - 8) Notes The various types of text is as follows: 0x00 - Normal 0x01 - Broadcast/System 0x02 - Emote 0x06 - System/Lower Corner 0x07 - Message/Corner With Name 0x08 - Whisper 0x09 - Yell 0x0A - Spell 0x0D - Guild Chat 0x0E - Alliance Chat 0x0F - Command Prompts
Packet ID: 0x04 Packet Name: Request God Mode (God Client) Packet Size: 2 bytes Sent By: Client Submitted: MuadDib Description This is sent by the god client after it logs in until it receives a God mode packet. No longer active. Packet Breakdown BYTE[1] cmd BYTE[1] mode (0=off, 1=on)
Packet ID: 0x05 Packet Name: Request Attack Packet Size: 5 bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] ID to be attacked
Packet ID: 0x06 Packet Name: Double Click Packet Size: 5 bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] ID of double clicked object
Packet ID: 0x07 Packet Name: Pick Up Item Packet Size: 7 bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] item id BYTE[2] # of items in stack
Packet ID: 0x08 Packet Name: Drop Item Packet Size: 14 bytes Sent By: Client Submitted: MuadDib- Packet Breakdown BYTE[1] cmd BYTE[4] item id BYTE[2] X Location BYTE[2] Y Location BYTE[1] Z Location BYTE[4] Move Into Container ID (FF FF FF FF if normal world) Notes 3D clients sometimes sends 2 of them (bursts) for ONE drop action. The last one having –1’s in X/Y locs. Be very careful how to handle this odd “bursts” server side, neither always process, nor always skipping is correct.
Packet ID: 0x09 Packet Name: Single Click Packet Size: 5 bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] ID of single clicked object
Packet ID: 0x0A Packet Name: Edit (God Client) Packet Size: 11 Sent By: Client Submitted: MuadDib Description No longer active. Packet Breakdown BYTE[1] Cmd BYTE[1] Subcommand BYTE[2] The new object's x-axis position. If Command is HackMove Request, this will be a boolean value (still 16-bit) representing the requested mode. BYTE[2] The new object's y-axis position. BYTE[2] The new object's id. If Command is Add New NPC, this is the template number. BYTE[1] The new object's z-axis position. BYTE[2] Unknown. Sub Commands Subcommand 4: Add New Dynamic Item. Subcommand 6: Hackmove Request. Subcommand 7: Add New NPC. Subcommand A: Add New Static Item.
Packet ID: 0x0B Packet Name: Damage Packet Size: 0x07 Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] CMD BYTE[4] Serial to display above BYTE[2] Damage dealt. 0xFFFF is max damage that can be displayed. Notes New damage dealt packet to display damage above a mob's head. This packet was introduced somewhere around 4.0.7a
Packet ID: 0x0C Packet Name: Edit Tile Data (God Client) Packet Size: variable Sent By: Both Submitted: MuadDib Description No longer active. Packet Breakdown BYTE[1] Cmd BYTE[2] Length BYTE[2] Tile Number to edit. If number is 0x8000+, then it is a map tile. BYTE[4] Tile data Flags for the item. BYTE[1] Weight of item. BYTE[1] Quality of item. BYTE[2] Unknown. BYTE[1] Unknown. BYTE[1] Quantity. BYTE[2] Frame number of the animation. BYTE[1] Unknown. BYTE[1] Hue. BYTE[1] Unknown. BYTE[1] Value of item. BYTE[1] Height. BYTE[20] Item's Name.
Packet ID: 0x11 Packet Name: Status Bar Info Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] packet length BYTE[4] player id BYTE[30] playerName BYTE[2] currentHitpoints BYTE[2] maxHitpoints BYTE[1] name change flag (0x1 = allowed, 0 = not allowed) BYTE[1] flag (0x00 – no more data following (end of packet here). 0x01 – more data after this flag following, 0x03: like 1, extended info, 0x04: even more extended info (client 4.0 and above), 0x05: Unknown, UOML introduced. Maybe to do with introduced at client 5.0? BYTE[1] sex (0=male, 1=female) BYTE[2] str BYTE[2] dex BYTE[2] int BYTE[2] currentStamina BYTE[2] maxStamina BYTE[2] currentMana BYTE[2] maxMana BYTE[4] gold BYTE[2] armor class BYTE[2] weight BYTE[1] Unknown * UOML Introduced? If (flag == 3 or flag==4 ) · BYTE[2] statcap · BYTE[1] pets current · BYTE[1] pets max If (flag == 4) · BYTE[2] fireresist · BYTE[2] coldresist · BYTE [2] poisonresist · BYTE[2] energyresist · BYTE[2] luck · BYTE[2] damage minimum · BYTE[2] damage maximum · BYTE[4] titching points Notes For characters other than the player, currentHitpoints and maxHitpoints are not the actual values. MaxHitpoints is a fixed value, and currentHitpoints works like a percentage.
Packet ID: 0x12 Packet Name: Request Skill etc use Packet Size: Variable Sent By: Client Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[2] blockSize BYTE[1] type Types Listed: · 0x24 ($) - skill · · BYTE[blockSize-4] skill (null terminated strings) · · · "1 0" - anatomy · · · "2 0" - animal lore · · · "3 0" - item identification · · · "4 0" - arms lore · · · "6 0" - begging · · · "9 0" - peacemaking · · · "12 0" - cartography · · · "14 0" - detect hidden · · · "15 0" - entice · · · "16 0" - evaluate intelligence · · · "19 0" - forensic evaluation · · · "21 0" - hiding · · · "22 0" - provocation · · · "23 0" - inscription · · · "30 0" - poisoning · · · "32 0" - spirit speak · · · "33 0" - stealing · · · "35 0" - taming · · · "36 0" - taste identification · · · "38 0" - tracking · 0x56 (V) - Macro'd Spell · · BYTE[blockSize-4] Spell (null terminated strings) · · · "2" - Create Food · · · "3" - Feeblemind · · · "4" - Heal · · · "5" - Magic Arrow · · · "6" - Night Sight · · · "7" - Reactive Armor · · · "8" - Weaken · · · "9" - Agility · · · "10" - Cunning · · · "11" - Cure · · · "12" - Harm · · · "13" - Magic Trap · · · "14" - Magic Untrap · · · "15" - Protection · · · "16" - Strength · · · "17" - Bless · · · "18" - Fireball · · · "19" - Magic Lock · · · "20" - Poison · · · "21" - Telekenisis · · · "22" - Teleport · · · "23" - Unlock · · · "24" - Wall of Stone · · · "25" - Arch Cure · · · "26" - Arch Protection · · · "27" - Curse · · · "28" - Fire Field · · · "29" - Greater Heal · · · "30" - Lightning · · · "31" - Mana Drain · · · "32" - Recall · · · "33" - Blade Spirit · · · "34" - Dispel Field · · · "35" - Incognito · · · "36" - Reflection · · · "37" - Mind Blast · · · "38" - Paralyze · · · "39" - Poison Field · · · "40" - Summon Creature · · · "41" - Dispel · · · "42" - Energy Bolt · · · "43" - Explosion · · · "44" - Invisibility · · · "45" - Mark · · · "46" - Mass Curse · · · "47" - Paralyze Field · · · "48" - Reveal · · · "49" - Chain Lightning · · · "50" - Energy Field · · · "51" - Flame Strike · · · "52" - Gate · · · "53" - Mana Vampire · · · "54" - Mass Dispel · · · "55" - Meteor Shower · · · "56" - Polymorph · · · "57" - Earthquake · · · "58" - Energy Vortex · · · "59" - Ressurection · · · "60" - Summon Air Elemental · · · "61" - Summon Daemon · · · "62" - Summon Earth Elemental · · · "63" - Summon Fire Elemental · · · "64" - Summon Water Elemental · 0x58 (X) - Open Door · · BYTE[1] null termination (0x00) · 0xc7 - action · · BYTE[blockSize-4] Action (null terminated strings) · · · "bow" · · · "salute"
Packet ID: 0x13 Packet Name: Drop->Wear Item Packet Size: 10 bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[4] itemid BYTE layer (layer of player) BYTE[4] playerID Notes 1.) The Layer should not be trusted.
Packet ID: 0x14 Packet Name: Send Elevation (God Client) Packet Size: 6 Sent By: Client Submitted: MuadDib Description No longer active. Packet Breakdown BYTE[1] Cmd BYTE[2] Map X Coord BYTE[2] Map Y Coord BYTE[1] Z Amount to alter the map tile's elevation by
Packet ID: 0x15 Packet Name: Follow Packet Size: 9 Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] Cmd BYTE[4] Serial of what is being followed. BYTE[4] Serial of who is doing the following.
Packet ID: 0x16 Packet Name: Request Script Names Packet Size: 1 Sent By: Client Submitted: MuadDib Description No longer active. Packet Breakdown BYTE[1] Cmd
Packet ID: 0x1A Packet Name: Object Info Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[4] itemID BYTE[2] model # if (itemID & 0x80000000) · BYTE[2] item count (or model # for corpses) if (model & 0x8000) · BYTE Incr Counter (increment model by this #) BYTE[2] xLoc (only use lowest significant 15 bits) BYTE[2] yLoc if (xLoc & 0x8000) · BYTE direction BYTE zLoc if (yLoc & 0x8000) · BYTE[2] dye if (yLoc & 0x4000) · BYTE flag byte (See top)
Packet ID: 0x1B Packet Name: Char Locale & Body Packet Size: 37 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[4] player id BYTE[4] unknown1 // always 0 BYTE[2] bodyType BYTE[2] xLoc BYTE[2] yLoc BYTE[2] zLoc BYTE[1] direction BYTE[1] unknown2 BYTE[4] unknown3 BYTE[2] server boundry X BYTE[2] server boundry Y BYTE[2] server boundry Width BYTE[2] server boundry Height BYTE[6] // completely ignored by standard client Notes Also known as "Login Confimation". This packet must be sent by the server once during login in order to confirm the login happened fully.
Packet ID: 0x1C Packet Name: Send Speech Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] Packet len BYTE[4] itemID (FF FF FF FF = system) BYTE[2] model (item # - FF FF = system) BYTE[1] Type of Text BYTE[2] Text Color BYTE[2] Font BYTE[30] Name BYTE[?] Null-Terminated Msg (? = Packet length - 44) Notes This is the packet POL uses to send names when you single click on items or NPCs. This is a much more optimized method (packet size) than OSI's method by using 0xC1 The various types of text is as follows: 0x00 - Normal 0x01 - Broadcast/System 0x02 - Emote 0x06 - System/Lower Corner 0x07 - Message/Corner With Name 0x08 - Whisper 0x09 - Yell 0x0A - Spell 0x0D - Guild Chat 0x0E - Alliance Chat 0x0F - Command Prompts
Packet ID: 0x1D Packet Name: Delete Object Packet Size: 5 bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[4] item/char id
Packet ID: 0x20 Packet Name: Draw Game Player Packet Size: 19 bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[4] creature id BYTE[2] bodyType BYTE[1] unknown1 (0) BYTE[2] skin color / hue BYTE[1] flag byte BYTE[2] xLoc BYTE[2] yLoc BYTE[2] unknown2 (0) BYTE[1] direction BYTE[1] zLoc Notes Only used with the character being played by the client.
Packet ID: 0x21 Packet Name: Char Move Rejection Packet Size: 8 bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[1] sequence # BYTE[2] xLoc BYTE[2] yLoc BYTE[1] direction BYTE[1] zLoc
Packet ID: 0x22 Packet Name: Character Move ACK/ Resync Request Packet Size: 3 bytes Sent By: Both Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[1] sequence (matches sent sequence) BYTE[1] notoriety Notes Notoriety 0 = invalid/across server line 1 = innocent (blue) 2 = guilded/ally (green) 3 = attackable but not criminal (gray) 4 = criminal (gray) 5 = enemy (orange) 6 = murderer (red) 7 = unknown use (translucent (like 0x4000 hue))
Packet ID: 0x23 Packet Name: Dragging Of Item Packet Size: 26 bytes Sent By: Server Submitted: MuadDib Description This is sent by the server to display an item being dragged from one place to another. Packet Breakdown BYTE[1] Cmd BYTE[2] model # BYTE[3] unknown1 BYTE[2] stack count BYTE[4] Source ID BYTE[2] Source xLoc BYTE[2] Source yLoc BYTE[1] Source zLoc BYTE[4] Target id BYTE[2] Target xLoc BYTE[2] Target yLoc BYTE[1] Target zLoc Notes This does not actually move the item, it just displays an animation.
Packet ID: 0x24 Packet Name: Draw Container Packet Size: 7 bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[4] item id BYTE[2] model-Gump (0x003c is backpack)
Packet ID: 0x25 Packet Name: Add Item To Container Packet Size: 20 bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[4] item id to add BYTE[2] model BYTE[1] unknown (0) BYTE[2] # of items BYTE[2] xLoc in container BYTE[2] yLoc in container BYTE[4] itemID of container BYTE[2] color
Packet ID: 0x26 Packet Name: Kick Player Packet Size: 5 bytes Sent By: Server Submitted: MuadDib Description No longer active. Packet Breakdown BYTE[1] cmd BYTE[4] ID of GM who issued kick?
Packet ID: 0x27 Packet Name: Reject Move Item Request Packet Size: 2 bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE cmd BYTE unknown1 (0x00)
Packet ID: 0x28 Packet Name: Clear Square (God Client?) Packet Size: 5 bytes Sent By: Server Submitted: MuadDib Description No longer active. Packet Breakdown BYTE[1] cmd BYTE[2] xLoc BYTE[2] yLoc
Packet ID: 0x29 Packet Name: Paperdoll Clothing Add Ack Packet Size: 1 byte Sent By: Server Submitted: MuadDib Description No longer active. Packet Breakdown BYTE[1] Cmd
Packet ID: 0x2B Packet Name: God Mode (God Client) Packet Size: 2 Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] Cmd BYTE[1] 0/1 For Disable/Enable God Mode in client. Notes Send this packet after receiving a Request God Mode packet.
Packet ID: 0x2C Packet Name: Resurrection Menu Packet Size: 2 bytes Sent By: Both Submitted: MuadDib Sub Commands BYTE cmd BYTE action (2=ghost, 1=resurrect, 0=from server) Notes The only use on OSI for this packet is now sending "2C02" for the You Are Dead screen upon character death.
Packet ID: 0x2D Packet Name: Mob Attributes Packet Size: 17 bytes Sent By: Server Submitted: MuadDib Description No longer active. Packet Breakdown BYTE[1] cmd BYTE[4] serial BYTE[2] hitsMax BYTE[2] hitsCurrent BYTE[2] manaMax BYTE[2] manaCurrent BYTE[2] stamMax BYTE[2] stamCurrent
Packet ID: 0x2E Packet Name: Worn Item Packet Size: 15 bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[4] itemid (always starts 0x40 in my data) BYTE[2] model (item hex #) BYTE[1] (0x00) BYTE[1] layer BYTE[4] playerID BYTE[2] color/hue
Packet ID: 0x2F Packet Name: Fight Occuring Packet Size: 10 bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE cmd BYTE unknown1 (0) BYTE[4] ID of attacker BYTE[4] ID of attacked
Packet ID: 0x30 Packet Name: Attack Ok Packet Size: 5 Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] Cmd BYTE[4] Serial being attacked
Packet ID: 0x32 Packet Name: Unknown Packet Size: 2 Bytes Sent By: Server Submitted: MuadDib Description IN OLD GOLD CLIENTS: This packet enables or disables "hack moving" for the god client. If enabled, the god client will ignore impassable static/map tiles. This should be sent after receiving a hack move request in the Edit packet. REINTRODUCED IN AOS NORMAL CLIENT: Not Yet Implemented on OSI servers but already in use? Packet Breakdown BYTE[1] cmd BYTE[1] 0x0
Packet ID: 0x33 Packet Name: Pause Client Packet Size: 2 bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] pause/resume (1=pause, 0=resume) Notes Unpause does not seem to work.
Packet ID: 0x34 Packet Name: Get Player Status Packet Size: 10 bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[4] pattern (0xedededed) BYTE[1] getType · 0x04 - Basic Stats (Packet 0x11 Return) · 0x05 = Skills (Packet 0x3A Return) BYTE[4] playerID
Packet ID: 0x35 Packet Name: Add Resource (God Client) Packet Size: 653 Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] Cmd BYTE[1] 0 (Unknown) BYTE[1] 1 (Unknown) BYTE[2] Tile Type to attach new resource too. If 0x8000+ is for map tiles. BYTE[127] Internal Resource Name. BYTE[1] 00 Null Terminator. BYTE[127] Food Resource Name. BYTE[1] 00 Null Terminator. BYTE[127] Shelter Resource Name. BYTE[1] 00 Null Terminator. BYTE[127] Desire Resource Name. BYTE[1] 00 Null Terminator. BYTE[127] Production Resource Name. BYTE[1] 00 Null Terminator. BYTE[4] If set to one, then make a consumer if excess in world. BYTE[4] If set to one, then make a producer if excess in bank.
Packet ID: 0x37 Packet Name: Move Item (God Client) Packet Size: 8 Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] Cmd BYTE[4] Serial to move. BYTE[1] Z To alter by ? BYTE[1] Y to alter by ? BYTE[1] X to alter by ?
Packet ID: 0x38 Packet Name: Drunken Coder Packet Size: 7 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] x BYTE[2] y BYTE[2] z Notes Only works for player played by client. x,y,z have to be in “0xc8 range” from player’s current location. Packet has to be send 19 times(!!!) or more in a row, otherwise it doesn’t do anything. if all this satisfied it does a pathfind like action. location of destination is displayed above players head (can’t be disabled).
Packet ID: 0x39 Packet Name: Remove (Unknown) Packet Size: 9 Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] player serial BYTE[4] target's serial Notes Outdated packet, no longer seen to be in use on OSI recently. If player serial is zeroed, then it removes the target serial from a group? If player serial and target serial are the same, it reports removed from group to the client.
Packet ID: 0x3A Packet Name: Send Skills Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown Server Version: BYTE[1] cmd BYTE[2] blockSize BYTE[1] Type (0x00= full list, 0xFF = single skill update, 0x02 full list with skillcap, 0xDF single skill update with cap) Repeat next until done - 46 skills BYTE[2] id # of skill (0x01 - 0x2e) BYTE[2] skill Value * 10 BYTE[2] Unmodified Value * 10 BYTE skillLock (0=up, 1=down, 2=locked) If (Type==2 || Type==0xDF) · BYTE[2] SkillCap BYTE[2] null (00 00) (ONLY IF TYPE == 0x00) Client Version (sets skill lock states): BYTE[1] cmd BYTE[2] blockSize BYTE[2] id# of skill BYTE skillLock (0=up, 1=down, 2=locked) Notes Server can also send just one skill, to update that skill only.
Packet ID: 0x3B Packet Name: Buy Item(s) Packet Size: Variable Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[4] vendorID BYTE[1] flag · 0x00 - no items following · 0x02 - items following For each item · BYTE[1] (0x1A) · BYTE[4] itemID (from 3C packet) · BYTE[2] # bought
Packet ID: 0x3C Packet Name: Items In Container Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[2] # of Item segments Item Segments: · BYTE[4] itemID · BYTE[2] model · BYTE unknown1 (0x00) · BYTE[2] # of items in stack · BYTE[2] xLoc · BYTE[2] yLoc · BYTE[4] Container ItemID · BYTE[2] color
Packet ID: 0x3E Packet Name: Versions (God Client) Packet Size: 37 Sent By: Server Submitted: Kair Packet Breakdown BYTE[1] Cmd BYTE[4] Unknown BYTE[4] Unknown BYTE[4] Unknown BYTE[4] Unknown BYTE[4] Unknown BYTE[4] Unknown BYTE[4] Unknown BYTE[4] Unknown BYTE[4] Unknown
Packet ID: 0x3F Packet Name: Update Statics (God Client) Packet Size: variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] Cmd BYTE[2] Length BYTE[4] The block number of the statics grid. This can be derived by the following formula: Block_Num = X / 8 * MapHeight + Y / 8 .... MapHeight is equal to the total number of tiles in the Y-axis divided by eight (0x0200 for map0.mul). BYTE[4] # of static items in grid. BYTE[4] "Extra" Value in statics index file. Item Loop: · BYTE[2] Item ID · BYTE[1] Item's X pos relative to top left corner of grid. · BYTE[1] Item's Y pos relative to top left corner of grid. · BYTE[1] Item's Z pos. · BYTE[2] Item's Hue.
Packet ID: 0x4E Packet Name: Personal Light Level Packet Size: 6 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] creature id BYTE[1] level
Packet ID: 0x4F Packet Name: Overall Light Level Packet Size: 2 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] level · 0x00 - day · 0x09 - OSI night · 0x1F - Black · Max normal val = 0x1F
Packet ID: 0x53 Packet Name: Idle Warning Packet Size: 2 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] value (0x07 – idle, 0x05 – another character is online)
Packet ID: 0x54 Packet Name: Play Sound Effect Packet Size: 12 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] mode (0x00=quiet, repeating, 0x01=single normally played sound effect) BYTE[2] SoundModel BYTE[2] unknown3 (speed/volume modifier? Line of sight stuff?) BYTE[2] xLoc BYTE[2] yLoc BYTE[2] zLoc
Packet ID: 0x55 Packet Name: Login Complete Packet Size: 1 byte Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd
Packet ID: 0x56 Packet Name: Map Packet (cartography/treasure) Packet Size: 11 Bytes Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] id BYTE[1] command · 1 = add map point. · 2 = add new pin with pin number.(insertion. other pins after the number are pushed back.) · 3 = change pin · 4 = remove pin · 5 = remove all pins on the map · 6 = toggle the 'editable' state of the map. · 7 = return msg from the server to the request 6 of the client. BYTE[1] plotting state (1=on, 0=off, valid only if command 7) BYTE[2] x location (relative to upper left corner of the map, in pixels, for points) BYTE[2] y location (relative to upper left corner of the map, in pixels, for points)
Packet ID: 0x5B Packet Name: Time Packet Size: 4 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] hour BYTE[1] minute BYTE[1] second
Packet ID: 0x5D Packet Name: Login Character Packet Size: 73 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] pattern1 (0xedededed) BYTE[30] char name (0 terminated) BYTE[33] unknown, mostly 0’s (Byte# 0x27, 0x28, 0x30 seem to be the only non 0’s of these 33 bytes. Perhaps password data that’s not send anymore) BYTE slot choosen (0-based) BYTE[4] clientIP
Packet ID: 0x65 Packet Name: Set Weather Packet Size: 4 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] type (See Notes) BYTE[1] num (number of weather effects on screen) BYTE[1] temperature Notes Types: 0x00 – “It starts to rain”, 0x01 – “A fierce storm approaches.”, 0x02 – “It begins to snow”, 0x03 - “A storm is brewing.”, 0xFF – None (turns off sound effects), 0xFE (no effect?? Set temperature?) Maximum number of weather effects on screen is 70. If it is raining, you can add snow by setting the num to the num of rain currently going, plus the number of snow you want. Weather messages are only displayed when weather starts. Weather will end automatically after 6 minutes without any weather change packets. You can totally end weather (to display a new message) by teleporting. I think it’s either the 0x78 or 0x20 messages that reset it, though I haven’t checked to be sure (other possibilities, 0x4F or 0x4E)
Packet ID: 0x66 Packet Name: Books (Pages, Old Packet) Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[4] bookID BYTE[2] # of pages in this packet · For each page: · BYTE[2] page # · BYTE[2] # of lines on page · Repeated for each line: · · BYTE[var] null terminated line Notes server side: # of pages equals value given in 0x93/0xd4 EACH page # given. If empty: # lines: 0 + terminator (=3 0’s) client side: # of pages always 1. if 2 pages changed, client generates 2 packets.
Packet ID: 0x69 Packet Name: Change Text/Emote Colors Packet Size: 5 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[2] unknown1 Notes The client sends two of these independent of the color chosen. It sends two of them in quick succession as part of the "same" packet. The unknown1 is 0x00 0x01 in the first and 0x00 0x02 in the second. This message has been removed. It is no longer used.
Packet ID: 0x6C Packet Name: Target Cursor Commands Packet Size: 19 Bytes Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] type · 0x00 = Select Object · 0x01 = Select X, Y, Z BYTE[4] cursorID BYTE[1] Cursor Type · 0 = ? · 1 = ? · 2 = ? · 3 = Cancel current targetting The following are always sent but are only valid if sent by client · BYTE[4] Clicked On ID · BYTE[2] click xLoc · BYTE[2] click yLoc · BYTE unknown (0x00) · BYTE click zLoc · BYTE[2] model # (if a static tile, 0 if a map/landscape tile) Notes The model # should never be trusted. Once the server requests the client to target something, the server can undo this also. You can "kill" the targetting cursor faithfully and without any bugs. Send another Packet with Type set to 0 (Object), Cursor ID 00000000, and Cursor Type as 3. The client will respond to this by sending a response to the original request just as if the user had hit ESC to cancel targetting.
Packet ID: 0x6D Packet Name: Play Midi Music Packet Size: 3 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] musicID
Packet ID: 0x6E Packet Name: Character Animation Packet Size: 14 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] item/char ID BYTE[2] movement model · 0x00 = walk · 0x01 = walk faster · 0x02 = run · 0x03 = run (faster?) · 0x04 = nothing · 0x05 = shift shoulders · 0x06 = hands on hips · 0x07 = attack stance (short) · 0x08 = attack stance (longer) · 0x09 = swing (attack with knife) · 0x0a = stab (underhanded) · 0x0b = swing (attack overhand with sword) · 0x0c = swing (attack with sword over and side) · 0x0d = swing (attack with sword side) · 0x0e = stab with point of sword · 0x0f = ready stance · 0x10 = magic (butter churn!) · 0x11 = hands over head (balerina) · 0x12 = bow shot · 0x13 = crossbow · 0x14 = get hit · 0x15 = fall down and die (backwards) · 0x16 = fall down and die (forwards) · 0x17 = ride horse (long) · 0x18 = ride horse (medium) · 0x19 = ride horse (short) · 0x1a = swing sword from horse · 0x1b = normal bow shot on horse · 0x1c = crossbow shot · 0x1d = block #2 on horse with shield · 0x1e = block on ground with shield · 0x1f = swing, and get hit in middle · 0x20 = bow (deep) · 0x21 = salute · 0x22 = scratch head · 0x23 = 1 foot forward for 2 secs · 0x24 = same BYTE[1] unknown1 (0x00) BYTE[1] direction BYTE[2] repeat (1 = once / 2 = twice / 0 = repeat forever) BYTE[1] forward/backwards(0x00=forward, 0x01=backwards) BYTE[1] repeat Flag (0 - Don't repeat / 1 repeat) BYTE[1] frame Delay (0x00 - fastest / 0xFF - Too slow to watch)
Packet ID: 0x6F Packet Name: Secure Trading Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[1] action BYTE[4] id1 BYTE[4] id2 BYTE[4] id3 BYTE[1] nameFollowing (0 or 1) If (nameFollowing = 1) BYTE[?] charName
Packet ID: 0x70 Packet Name: Graphical Effect Packet Size: 28 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] direction type · 00 = go from source to dest · 01 = lightning strike at source · 02 = stay at current x,y,z · 03 = stay with current source character id BYTE[4] character id BYTE[4] target id BYTE[2] model of the first frame of the effect BYTE[2] xLoc BYTE[2] yLoc BYTE zLoc BYTE[2] xLoc of target BYTE[2] yLoc of target BYTE[1] zLoc of target BYTE[1] speed of the animation BYTE[1] duration (0=really long, 1= shortest) BYTE[2] unknown2 (0 works) BYTE[1] adjust direction during animation (1=no) BYTE[1] explode on impact
Packet ID: 0x71 Packet Name: Bulletin Board Messages Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] len BYTE[1] subcmd BYTE[len-4] submessage Sub Commands Subcommand 0 – Display Bulletin Board (Server) BYTE[4] BoardID BYTE[22] board name (default is “bulletin board”, the rest nulls) BYTE[4] ID (0x402000FF) BYTE[4] zero (0) Subcommand 1 – Message Summary (Server) BYTE[4] BoardID BYTE[4] MessageID BYTE[4] ParentID (0 if top level) BYTE[1] posterLen BYTE[posterLen] poster (null terminated string) BYTE[1] subjectLen BYTE[subjectLen] subject (null terminated string) BYTE[1] timeLen BYTE[timeLen] time (null terminated string with time of posting) (“Day 1 @ 11:28”) Subcommand 2 – Message (Server) BYTE[4] BoardID BYTE[4] MessageID BYTE[1] posterLen BYTE[posterLen] poster (null terminated string) BYTE[1] subjectLen BYTE[subjectLen] subject (null terminated string) BYTE[1] timeLen BYTE[timeLen] time (null terminated string with time of posting) (“Day 1 @ 11:28”) BYTE[29] constant: (01 91 84 0A 06 1E FD 01 0B 15 2E 01 0B 17 0B 01 BB 20 46 04 66 13 F8 00 00 0E 75 00 00) BYTE[1] numlines For each line: BYTE[1] linelen BYTE[linelen] body (null terminated) Subcommand 3 – Request Message (Client) BYTE[4] BoardID BYTE[4] MessageID Subcommand 4 – Request Message Summary (Client) BYTE[4] BoardID BYTE[4] MessageID Subcommand 5 – Post a message (Client) BYTE[4] BoardID BYTE[4] Replying to ID (0 if this is a top level / non-reply post) BYTE[1] subjectLen (length of the subject, includes null termination) BYTE[subjectLen] subject (null terminated) BYTE[1] numlines For each line: · BYTE linelen · BYTE[linelen] body (null terminated) Subcommand 6 – Remove Posted Message (Client) BYTE[4] BoardID BYTE[4] MessageID
Packet ID: 0x72 Packet Name: Request War Mode Packet Size: 5 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] flag · 0x00 - Normal · 0x01 - Fighting BYTE[3] unknown1 (always 00 32 00 in testing) Notes Server replies with 0x77 packet
Packet ID: 0x73 Packet Name: Ping Message Packet Size: 2 Bytes Sent By: Both? Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] seq
Packet ID: 0x74 Packet Name: Open Buy Window Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[4] (vendorID | 0x40000000) BYTE[1] # of items # of items worth of item segments · BYTE[4] price · BYTE length of text description · BYTE[text length] item description Notes This packet is always preceded by a describe contents packet (0x3c) with the container id as the (vendorID | 0x40000000) and then an open container packet (0x24?) with the vendorID only and a model number of 0x0030 (probably the model # for the buy screen)
Packet ID: 0x75 Packet Name: Rename Character Packet Size: 35 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] id BYTE[30] new name
Packet ID: 0x76 Packet Name: New Subserver Packet Size: 16 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] xLoc BYTE[2] yLoc BYTE[2] zLoc BYTE[1] unknown (always 0) BYTE[2] server boundry X BYTE[2] server boundry Y BYTE[2] server boundry Width BYTE[2] server boundry Height
Packet ID: 0x77 Packet Name: Update Player Packet Size: 17 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] player id BYTE[2] model BYTE[2] xLoc BYTE[2] yLoc BYTE[1] zLoc BYTE[1] direction BYTE[2] hue/skin color BYTE[1] flag (bit field) BYTE[1] highlight color
Packet ID: 0x78 Packet Name: Draw Object Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[4] itemID/playerID BYTE[2] model (item hex #) BYTE[2] xLoc (only 15 lsb) BYTE[2] yLoc BYTE[1] zLoc BYTE[1] direction BYTE[2] dye/skin color BYTE[1] Status flag BYTE[1] notoriety (2's complement signed) if (BYTE[4] == 0x00 0x00 0x00 0x00) · DONE else loop this until above if statement is satisified · BYTE[4] itemID · BYTE[2] model (item hex # - only 15 lsb) · BYTE[1] layer · if (model & 0x8000) · · BYTE[2] hue Notes // Status Options: // 0x00 Normal // 0x01 Unknown // 0x02 CanAlterPaperdoll // 0x04 Poisoned // 0x08 GoldenHealth // 0x10 Unknown // 0x20 Unknown // 0x40 WarMode // // // Noto Options: // 0x1 Innocent (Blue) // 0x2 Friend (Green) // 0x3 Grey (Grey - Animal) // 0x4 Criminal (Grey) // 0x5 Enemy (Orange) // 0x6 Murderer (Red) // 0x7 Invulnerable (Yellow)
Packet ID: 0x7C Packet Name: Open Dialog Box Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[4] dialogID (echo'd back to the server in 7d) BYTE[2] menuid (echo'd back to server in 7d) BYTE[1] length of question BYTE[length of question] question text BYTE[1] # of responses Then for each response: · BYTE[2] model id # of shown item (if grey menu -- then always 0x00 as msb) · BYTE[2] color of shown item · BYTE response text length · BYTE[response text length] response text
Packet ID: 0x7D Packet Name: Response To Dialog Box Packet Size: 13 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] dialogID (echoed back from 7C packet) BYTE[2] menuid (echoed back from 7C packet) BYTE[2] 1-based index of choice BYTE[2] model # of choice BYTE[2] color
Packet ID: 0x80 Packet Name: Login Request Packet Size: 62 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[30] userid BYTE[30] password BYTE[1] unknown1 (not usually 0x00 - so not NULL)
Packet ID: 0x82 Packet Name: Login Denied Packet Size: 2 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] why · 0x00 = unknown user · 0x01 = account already in use · 0x02 = account disabled · 0x03 = password bad · 0x04 and higher = communications failed
Packet ID: 0x83 Packet Name: Delete Character Packet Size: 39 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[30] password BYTE[4] charIndex BYTE[4] clientIP
Packet ID: 0x86 Packet Name: Resend Characters After Delete Packet Size: 304 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[1] # of characters Following repeated 5 times · BYTE[30] character name · BYTE[30] character password
Packet ID: 0x88 Packet Name: Open Paperdoll Packet Size: 66 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] charid BYTE[60] text BYTE[1] flag byte Notes If Flag Byte is 0x02 It allows you to alter someone else's paperdoll in regards to clothing, etc.
Packet ID: 0x89 Packet Name: Corpse Clothing Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[4] corpseID BYTE[1] itemLayer BYTE[4] itemID BYTE[1] terminator (0x00) Notes Followed by a 0x3C message with the contents.
Packet ID: 0x8C Packet Name: Connect To Game Server Packet Size: 11 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] gameServer IP BYTE[2] gameServer port BYTE[4] new key
Packet ID: 0x90 Packet Name: Map Message Packet Size: 19 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] key used BYTE[2] gump art id (0x139D) BYTE[2] upper left x location BYTE[2] upper left y location BYTE[2] lower right x location BYTE[2] lower right y location BYTE[2] gump width in pixels BYTE[2] gump height in pixels
Packet ID: 0x91 Packet Name: Game Server Login Packet Size: 65 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] key used BYTE[30] sid BYTE[30] password
Packet ID: 0x93 Packet Name: Books (Title Page, Old Packet) Packet Size: 99 Bytes Sent By: Both Submitted: MuadDib Packet Breakdown Server Version: BYTE[1] cmd BYTE[4] bookID BYTE[1] write flag · 0x00 - non-writable · 0x01 - writable BYTE[1] new flag BYTE[2] # of pages BYTE[60] title BYTE[30] author Client Version: BYTE[1] cmd BYTE[4] bookID BYTE[4] unknown (0) BYTE[60] title (zero terminated, garbage after terminator) BYTE[30] author (zero terminated, garbage after terminator) Notes Client sends a 0x93 message on book close. Tis an Update packet for the server to handle changes etc for this.
Packet ID: 0x95 Packet Name: Dye Window Packet Size: 9 Bytes Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] itemID of dye target BYTE[2] ignored on send, model on return BYTE[2] model on send, color on return from client (default on server send is 0x0FAB)
Packet ID: 0x97 Packet Name: Move Player Packet Size: 2 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] direction Notes Moves player played by client one step in requested direction. Doesn’t move if there are obstacles.
Packet ID: 0x98 Packet Name: All Names (3D Client Only) Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blocksize BYTE[4] ID If (server-reply) BYTE[30] name (0 terminated) Notes Only 3D clients send this packet. Server and client packet. Client asks for name of object with ID x. Server has to reply with ID + name. Client automatically knows names of items. Hence it only asks only for NPC/Player names nearby, but shows bars of items plus NPC’s. Client request has 7 bytes, server-reply 37. Triggered by Crtl + Shift.
Packet ID: 0x99 Packet Name: Give Boat/House Placement View Packet Size: 26 Bytes Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] request (0x01 from server, 0x00 from client) BYTE[4] ID of deed BYTE[12] unknown (all 0) BYTE[2] multi model (item model - 0x4000) BYTE[6] unknown (all 0)
Packet ID: 0x9A Packet Name: Console Entry Prompt Packet Size: 16 Bytes Sent By: Both? Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[4] objectID BYTE[4] prompt# BYTE[4] 0=request/esc, 1=reply BYTE[?] textstring (optional) BYTE terminator (0x00)
Packet ID: 0x9B Packet Name: Request Help Packet Size: 258 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[257] (0x00)
Packet ID: 0x9E Packet Name: Sell List Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[4] shopkeeperID BYTE[2] numItems For each item, a structure containing: · BYTE[4] itemID · BYTE[2] itemModel · BYTE[2] itemHue/Color · BYTE[2] itemAmount · BYTE[2] value · BYTE[2] nameLength · BYTE[?] name
Packet ID: 0x9F Packet Name: Sell List Reply Packet Size: Variable Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[4] shopkeeperID BYTE[2] itemCount For each item, a structure containing: · BYTE[4] itemID · BYTE[2] quantity
Packet ID: 0xA0 Packet Name: Select Server Packet Size: 3 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] server # chosen
Packet ID: 0xA1 Packet Name: Update Current Health Packet Size: 9 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] playerID BYTE[2] maxHealth BYTE[2] currentHealth
Packet ID: 0xA2 Packet Name: Update Current Mana Packet Size: 9 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] playerID BYTE[2] maxMana BYTE[2] currentMana
Packet ID: 0xA3 Packet Name: Update Current Stamina Packet Size: 9 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] playerID BYTE[2] maxStamina BYTE[2] currentStamina
Packet ID: 0xA4 Packet Name: Client Spy Packet Size: Variable Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[148] Unknown (previously, this has had info such as your graphics card name, free HD space, number of processors, etc.)
Packet ID: 0xA5 Packet Name: Open Web Browser Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[blockSize-3] null terminated full web address
Packet ID: 0xA6 Packet Name: Tip/Notice Window Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[1] flag · 0x00 - tips window · 0x01 – ignored · 0x02 - updates BYTE[4] tip # BYTE[2] msgSize BYTE[msgSize] message (ascii, not null terminated)
Packet ID: 0xA7 Packet Name: Request Tip/Notice Window Packet Size: 4 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] last tip # BYTE[1] flag · 0x00 - tips window · 0x01 - notice window
Packet ID: 0xA8 Packet Name: Game Server List Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[2] blockSize BYTE System Info Flag · 0xCC - Don't send · 0x64 - Send Video card · ?? - BYTE[2] # of servers Then each server -- · BYTE[2] serverIndex (0-based) · BYTE[32] serverName · BYTE percentFull · BYTE timezone · BYTE[4] pingIP
Packet ID: 0xA9 Packet Name: Characters / Starting Locations Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE cmd BYTE[2] blockSize BYTE # of characters Following repeated 5 times BYTE[30] character name BYTE[30] character password BYTE number of starting locations Following for as many locations as you have BYTE locationIndex (0-based) BYTE[31] town (general name) BYTE[31] exact name BYTE[4] Flags (see notes) Notes Flags list: 0x02 = send config/req logout (IGR?) 0x04 = single character (siege) 0x08 = enable npcpopup menus 0x10 = unknown 0x20: enable common AOS features (tooltip thing/fight system book, but not AOS monsters/map/skills) Flags can be comined as literals to view. Such as to have NPC Popup Menus AND Common AOS Features, send as 0x28, not 0x8 plus 0x20 form.
Packet ID: 0xAA Packet Name: Allow/Refuse Attack Packet Size: 5 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] CharID being attacked Notes ID is set to 00 00 00 00 when attack is refused.
Packet ID: 0xAB Packet Name: Gump Text Entry Dialog Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[4] id BYTE[1] parentID BYTE[1] buttonID BYTE[1] textlen BYTE[?] text BYTE[1] cancel (0=disable, 1=enable) BYTE[1] style (0=disable, 1=normal, 2=numerical) BYTE[4] format (if style 1, max text len, if style2, max numeric value) BYTE[1] text2 length BYTE[?] text2
Packet ID: 0xAC Packet Name: Gump Text Entry Dialog Reply Packet Size: Variable Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[4] ID BYTE[1] type BYTE[1] index BYTE[3] unkown? BYTE[?] reply
Packet ID: 0xAD Packet Name: Unicode/Ascii speech request Packet Size: Variable Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[1] Type BYTE[2] Color BYTE[2] Font BYTE[4] Language (Null Terminated) · “enu“ - United States English · “des” - German Swiss · “dea” - German Austria · “deu” - German Germany · ... for a complete list see langcode.iff if (Type & 0xc0) · BYTE[1,5] Number of distinct Trigger words (NUMWORDS). 12 Bit number, Byte #13 = Bit 11…4 of NUMWORDS, Hi-Nibble of Byte #14 (Bit 7…4) = Bit 0…3 of NUMWORDS · BYTE[1,5] Index to speech.mul. 12 Bit number, Low Nibble of Byte #14 (Bits 3…0) = Bits 11..8 of Index, Byte #15 = Bits 7…0 of Index · UNKNOWNS = ( (NUMWORDS div 2) *3 ) + (NUMWORDS % 2) – 1. div = Integeger division, % = modulo operation, NUMWORDS >= 1. examples: UNKNOWNS(1)=0, UNKNOWNS(2)=2, UNKNOWNS(3)=3, UNKNOWNS(4)=5, UNKNOWNS(5)=6, UNKNOWNS(6)=8, UNKNOWNS(7)=9, UNKNOWNS(8)=11, UNKNOWNS(9)=12 · BYTE[UNKNOWNS] Idea behind this is getting speech parsing load client side. Thus this contains data OSI server use for easier parsing. It’s client side hardcoded and exact details are unkown. · BYTE[?] Ascii Msg – Null Terminated(blockSize – (15+UNKNOWNS) ) else · BYTE[?][2] Unicode Msg - Null Terminated (blockSize - 12) Notes For pre 2.0.7 clients Type is always < 0xc0. Uox based emus convert post 2.0.7 data of this packet to pre 2.0.7 data if Type >=0xc0. (different view of it) If Mode&0xc0 then there are keywords (from speech.mul) present. Keywords: The first 12 bits = the number of keywords present. The keywords are included right after this, each one is 12 bits also. The keywords are padded to the closest byte. For example, if there are 2 keywords, it will take up 5 bytes. 12bits for the number, and 12 bits for each keyword. 12+12+12=36. Which will be padded 4 bits to 40 bits or 5 bytes. The various types of text is as follows: 0x00 - Normal 0x01 - Broadcast/System 0x02 - Emote 0x06 - System/Lower Corner 0x07 - Message/Corner With Name 0x08 - Whisper 0x09 - Yell 0x0A - Spell 0x0D - Guild Chat 0x0E - Alliance Chat 0x0F - Command Prompts
Packet ID: 0xAE Packet Name: Unicode Speech message Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[4] ID BYTE[2] Model BYTE[1] Type BYTE[2] Color BYTE[2] Font BYTE[4] Language BYTE[30] Name BYTE[?][2] Msg – Null Terminated (blockSize – 48) Notes The various types of text is as follows: 0x00 - Normal 0x01 - Broadcast/System 0x02 - Emote 0x06 - System/Lower Corner 0x07 - Message/Corner With Name 0x08 - Whisper 0x09 - Yell 0x0A - Spell 0x0D - Guild Chat 0x0E - Alliance Chat 0x0F - Command Prompts
Packet ID: 0xAF Packet Name: Display Death Action Packet Size: 13 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] player id BYTE[4] corpse id BYTE[4] unknown (all 0)
Packet ID: 0xB0 Packet Name: Send Gump Menu Dialog Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] blockSize BYTE[4] id BYTE[4] gumpid BYTE[4] x BYTE[4] y BYTE[2] command section length BYTE[?] commands (zero terminated) BYTE[2] numTextLines · BYTE[2] text length (in unicode (2 byte) characters.) · BYTE[?] text (in unicode) Notes In gump packets, and with any EMU (POL for sure) the "ID" is the # of the script's PID that fired the gump. This can be used via specific 0xBF packets to send the ID to the client to force closing of the gump from the server. When this is done, the client Auto Responds as if it had "exited" the menu normally so the serverside script will handle it as such.
Packet ID: 0xB1 Packet Name: Gump Menu Selection Packet Size: Variable Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[4] id (first Id in 0xb0) BYTE[4] gumpId (second Id in 0xb0) BYTE[4] buttonId (which button perssed ? 0 if closed) BYTE[4] switchcount (response info for radio buttons and checkboxes, any switches listed here are switched on) For each switch · BYTE[4] SwitchId BYTE[4] textcount (response info for textentries) For each textentry · BYTE[2] textId · BYTE[2] textlength · BYTE[length*2] Unicode text (not nullterminated)
Packet ID: 0xB2 Packet Name: Chat Message Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[2] messageType Messagetypes will be listed as Subcommands. Sub Commands Messagetypes 0x0001 - 0x0024: BYTE[4] unknown (00 00 00 00) BYTE[len-9] Unicode for %1 if the message type has a %1 variable for inputting text. BYTE[2] Null Terminator if there is a %2 Unicode element. (00 00) BYTE[len-(2+%1+9)] Unicode for %2 if the message type has a %2 variable for inputting text. BYTE[2] Null Terminator for Packet (00 00) Messagetypes 0x0028 - 0x002C: BYTE[4] unknown (00 00 00 00) BYTE[len-9] Unicode for %1 if the message type has a %1 variable for inputting text. BYTE[2] Null Terminator if there is a %2 Unicode element. (00 00) BYTE[len-(2+%1+9)] Unicode for %2 if the message type has a %2 variable for inputting text. BYTE[2] Null Terminator for Packet (00 00) MessageType 0x0025 (Message), 0x0026 (Emote), 0x0027 (OOC): BYTE[3] Language Code (ENU for english) BYTE[1] Null Terminator (00) BYTE[2] Message from (see notes) BYTE[?] Username in Unicode BYTE[2] Null Terminator for Username (00 00) BYTE[?] Unicode Message Sent BYTE[2] Null Terminator for Message MessageType 0x03E8 (create conference): BYTE[4] Unknown (00 00 00 00) BYTE[?] Unicode Channel Name BYTE[2] Null Terminator for Channel Name (00 00) BYTE[2] Password Setting (00 30 = No Pass, 00 31 = Password required) BYTE[2] Null Terminator for packet (00 00) MessageType 0x03E9 (Destroy conference): BYTE[4] Unknown (00 00 00 00) BYTE[?] Unicode Channel Name BYTE[4] Unknown (00 00 00 00) MessageType 0x03EB (Display Enter Username window): BYTE[8] Unknown (00 00 00 00 00 00 00 00) MessageType 0x03EC (Close Chat): BYTE[8] Unknown (00 00 00 00 00 00 00 00) MessageType 0x03ED (Username accepted, display chat): BYTE[4] Unknown (00 00 00 00) BYTE[?] Unicode Username BYTE[4] Null Terminator (00 00 00 00) MessageType 0x03EE (Add User): BYTE[4] Unknown (00 00 00 00) BYTE[2] User Type (see notes) BYTE[?] Unicode Username BYTE[2] Null Terminator (00 00) MessageType 0x03EF (Remove User): BYTE[2] Unknown (00 00) BYTE[?] Unicode Username BYTE[2] Null Terminator (00 00) MessageType 0x03F0 (Clear All Players): BYTE[8] Unknown (00 00 00 00 00 00 00 00) MessageType 0x03F1 (You have joined the %1 Conference): BYTE[4] Unknown (00 00 00 00) BYTE[?] Unicode Conference Name (%1) BYTE[4] Unknown (00 00 00 00) Notes MessageTypes 0x0001 - 0x0024 and 0x0028 - 0x002C: Directly from Chat.enu file: 0x0001: You are already ignoring the maximum number of peolpe. 0x0002: You are already ignoring %1. 0x0003: You are now ignoring %1. 0x0004: You are no longer ignoring %1. 0x0005: You are not ignoring %1. 0x0006: You are no longer ignoring anyone. 0x0007: That is not a valid conference name. 0x0008: There is already a conference of that name. 0x0009: You must have operator status to do this. 0x000A: Conference %1 renamed to %2. 0x000B: You must be in a conference to do this. To join a conference, select one from the Conference menu. 0x000C: There is no player named '%1'. 0x000D: There is no conference named '%1'. 0x000E: That is not the correct password. 0x000F: %1 has chosen to ignore you. None of your messages to them will get through. 0x0010: The moderator of this conference has not given you speaking privileges. 0x0011: You can now receive private messages. 0x0012: You will no longer receive private messages. Those who send you a message will be notified that you are blocking incoming messages. 0x0013: You are now showing your character name to any players who inquire with the whois command. 0x0014: You are no longer showing your character name to any players who inquire with the whois command. 0x0015: %1 is remaining anonymous. 0x0016: %1 has chosen to not receive private messages at the moment. 0x0017: %1 is known in the lands of Britannia as %2. 0x0018: %1 has been kicked out of the conference. 0x0019: %1, a conference moderator, has kicked you out of the conference. 0x001A: You are already in the conference '%1'. 0x001B: %1 is no longer a conference moderator. 0x001C: %1 is now a conference moderator. 0x001D: %1 has removed you from the list of conference moderators. 0x001E: %1 has made you a conference moderator. 0x001F: %1 no longer has speaking privileges in this conference. 0x0020: %1 now has speaking privileges in this conference. 0x0021: %1, a conference moderator, has removed your speaking privileges for this conference. 0x0022: %1, a conference moderator, has granted you speaking privileges in this conference. 0x0023: From now on, everyone in the conference will have speaking privileges by default. 0x0024: From now on, only moderators will have speaking privileges in this conference by default. 0x0028: The password to the conference has been changed. 0x0029: Sorry--the conference named '%1' is full and no more players are allowed in. 0x002A: You are banning %1 from this conference. 0x002B: %1, a conference moderator, has banned you from the conference. 0x002C: You have been banned from this conference. MessageTypes 0025, 0026, and 0027: Message from is as follows: 0x0030 = user, 0x0031 = moderator, 0x0032 = muted, 0x0034 = me, 0x0035 = system MessageType 03EE: User types are 0030 for User, 0031 for Moderator, and 0032 for Muted User.
Packet ID: 0xB3 Packet Name: Chat Text Packet Size: Variable Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] Length BYTE[4] Language BYTE[2] UnKNOWN(00 00) BYTE[1] Text/Command Type Sub Commands Type 0x41 (Change Password): BYTE[?] Unicode Password BYTE[2] Null Terminator (00 00) Type 0x58 (Close): BYTE[2] Null Terminator (00 00) Type 0x61 (Message): BYTE[?] Unicode Message BYTE[2] Null Terminator (00 00) Text 0x62 (Join Conference): BYTE[2] Holder (0x0022) BYTE[?] Unicode conference name BYTE[2] Holder (0x0022) BYTE[2] Holder (0x0020) BYTE[?] Unicode password if pass req'd BYTE[2] Null Teriminator (0x0000) Text 0x63 (Create New Conference): BYTE[?] Unicode conference name BYTE[2] Holder (0x007b) if pass entered BYTE[?] Unicode conference pass if pass entered BYTE[2] Holder (0x007d) if pass entered BYTE[2] Null Teriminator (0x0000) Text 0x64 (Rename Conference): BYTE[?] Unicode conference name (all text after /rename ) BYTE[2] Null Teriminator (0x0000) Text 0x65 (Send Private Message): BYTE[?] Unicode name (all text after /msg ) BYTE[2] Null Teriminator (0x0000) Text 0x66 (Ignore): BYTE[?] Unicode name (all text after +ignore ) BYTE[2] Null Teriminator (0x0000) Text 0x67 (Stop Ignoring): BYTE[?] Unicode name (all text after -ignore ) BYTE[2] Null Teriminator (0x0000) Text 0x68 (Toggle Ignore): BYTE[?] Unicode name (all text after /ignore ) BYTE[2] Null Teriminator (0x0000) Text 0x69 (Grant Speaking Priveleges): BYTE[?] Unicode name (all text after +voice ) BYTE[2] Null Teriminator (0x0000) Text 0x6A (Remove Speaking Priveleges): BYTE[?] Unicode name (all text after -voice ) BYTE[2] Null Teriminator (0x0000) Text 0x6B (Toggle Speaking Priveleges): BYTE[?] Unicode name (all text after /voice ) BYTE[2] Null Teriminator (0x0000) Text 0x6C (Grant Moderator Status): BYTE[?] Unicode name (all text after +ops ) BYTE[2] Null Teriminator (0x0000) Text 0x6D (Remove Moderator Status): BYTE[?] Unicode name (all text after -ops ) BYTE[2] Null Teriminator (0x0000) Text 0x6E (Toggle Moderator Status): BYTE[?] Unicode name (all text after /ops ) BYTE[2] Null Teriminator (0x0000) Text 0x6F (not receiving messages): BYTE[2] Null Teriminator (0x0000) Text 0x70 (receiving messages): BYTE[2] Null Teriminator (0x0000) Text 0x71 (Toggle receiving messages): BYTE[2] Null Teriminator (0x0000) Text 0x72 (show my character name): BYTE[2] Null Teriminator (0x0000) Text 0x73 (don't show my character name): BYTE[2] Null Teriminator (0x0000) Text 0x74 (Toggle showing my character name): BYTE[2] Null Teriminator (0x0000) Text 0x75 (Who is this player?): BYTE[?] Unicode text (all text after /whois ) BYTE[2] Null Teriminator (0x0000) Text 0x76 (Kick out of the conference?): BYTE[?] Unicode text (all text after /kick ) BYTE[2] Null Teriminator (0x0000) Text 0x77 (only moderators have speaking priveleges by default): BYTE[2] Null Teriminator (0x0000) Text 0x78 (everyone has speaking priveleges by default): BYTE[2] Null Teriminator (0x0000) Text 0x79 (Toggle default speaking priveleges): BYTE[2] Null Teriminator (0x0000) Text 0x7A (emote) BYTE[?] Unicode text (all text after /emote or /em ): BYTE[2] Null Teriminator (0x0000)
Packet ID: 0xB5 Packet Name: Open Chat Window Packet Size: 64 bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[63] chatname, if known by client (all 00 if unknown) (name in unicode) Notes This message is very incomplete. From the server, just know that it is 0xB5 len len, and pass the data through as is appropriate.
Packet ID: 0xB6 Packet Name: Send Help/Tip Request Packet Size: 9 Bytes Sent By: Client Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] id BYTE[1] language # (1 for enu) BYTE[3] language name (enu for English – United states)
Packet ID: 0xB7 Packet Name: Help/Tip Data Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[4] id BYTE[?][2] message, in unicode BYTE[2] null terminator (0x0000) BYTE[2] message terminator (0x3300)
Packet ID: 0xB8 Packet Name: Request/Char Profile Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[1] mode (CLIENT ONLY! Does not exist in server message.) BYTE[4] id If request, ends here. If Update request · BYTE[2] cmdType (0x0001 – Update) · BYTE[2] msglen (# of unicode characters) · BYTE[msglen][2] new profile, in unicode, not null terminated. Else If from server · BYTE[?] title (not unicode, null terminated.) · BYTE[?][2] static profile ( unicode string can't be edited ) · BYTE[2] (0x0000) (static profile terminator) · BYTE[?][2] profile (in unicode, can be edited) · BYTE[2] (0x0000) (profile terminator)
Packet ID: 0xB9 Packet Name: Enable locked client features Packet Size: 3 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] feature # Notes if (MSB not set) Bit# 1 T2A upgrade, enables chatbutton Bit# 2 enables LBR update. (of course LBR installation is required)(plays MP3 instead of midis, 2D LBR client shows new LBR monsters,…) if (MSB set) Bit# 3 T2A upgrade, enables chatbutton Bit# 4 enables LBR update Bit#5 enables AOS update (Aos monsters/map (AOS installation required for that) , AOS skills/necro/paladin/fight book stuff – works for ALL clients 4.0 and above) Examples: ML: B980FB AOS-7AV: B9803B AOS: B9801B LBR: B90003
Packet ID: 0xBA Packet Name: Quest Arrow Packet Size: 6 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] active (1=on, 0=off) BYTE[2] xLoc BYTE[2] yLoc
Packet ID: 0xBB Packet Name: Ultima Messenger Packet Size: 9 Bytes Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] id1 BYTE[4] id2
Packet ID: 0xBC Packet Name: Seasonal Information Packet Size: 3 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] id1 BYTE[1] id2 Notes If id2 = 1, then this is a season change. If season change, then id1 = (0=spring, 1=summer, 2=fall, 3=winter, 4 = desolation)
Packet ID: 0xBD Packet Name: Client Version Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length If (client-version of packet) BYTE[len-3] string stating the client version (0 terminated) (like: “1.26.4”) Notes Client version : client sends its version string (e.g “3.0.8j”) Server version : 0xbd 0x0 0x3 (client replies with client version of this packet) Clients sends a client version of this packet ONCE at login (without server request.)
Packet ID: 0xBE Packet Name: Assist Version Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length If (client-version of packet) · BYTE[4] Assist version (numeric) · BYTE[?] string stating the client version (0 terminated) (like: “1.26.4”) If (server-version of packet) · BYTE[4] Allowed Assist version (numeric) Notes Server requests assist version via server side version of this packet, client replies with client side version of packet. If it’s a client without Assist, allowed Assists version from server is relayed in client version packet. Because assist never has assist version 0, that would be a way to disallow it.
Packet ID: 0xBF Packet Name: General Information Packet Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[2] subcmd BYTE[length-5] submessage/commands Sub Commands Subcommand 1: Initialize Fast Walk Prevention BYTE[4] key1 BYTE[4] key2 BYTE[4] key3 BYTE[4] key4 BYTE[4] key5 BYTE[4] key6 Subcommand 2: Add key to Fast Walk Stack BYTE[4] newkey Subcommand 4: "Close Generic Gump" BYTE[4] dialogID // which gump to destroy (second ID in 0xB0 packet) BYTE[4] buttonId // response buttonID for packet 0xB1 Subcommand 5: Screen size BYTE[2] unknown1 , always 0 ? BYTE[2] X BYTE[2] Y BYTE[2] unknown2 ---- Start of Subcommand 0x6 ---- Subcommand 6: Party System Subsubcommands for 6: Subsubcommand 1: Add a party member (4 bytes) · BYTE[4] id (if 0, a targeting cursor appears)Client Message Subsubcommand 1: Add party member(s) (1+ numMembers*4) · BYTE[1] number of Members (total number of members in the party) Then, for each member in numMembers: · BYTE[4] id Server Message Subsubcommand 2: Remove a party member (4 bytes) · BYTE[4] id (if 0, a targeting cursor appears) Client message Subsubcommand 2: Remove a party member (? Bytes) · BYTE[1] number of Members (total number of members in the new party) · BYTE[4] idofPlayerRemoved Then, for each member in numMembers: · BYTE[4] id Server message Subsubcommand 3: Tell party member a message (Variable # of bytes) · BYTE[4] id (of target, from client, of source, from server) · BYTE[n][2] Null terminated Unicode message. Client & Server Message Subsubcommand 4: Tell full party a message (Variable # of bytes) · BYTE[n][2] Null terminated Unicode message. Client Message. Subsubcommand 4: Tell full party a message (Variable # of bytes) · BYTE[4] id (of source) · BYTE[n][2] Null terminated Unicode message. Server Message Subsubcommand 6: Party Can Loot Me? (1 byte) · BYTE[1] canloot (0=no, 1=yes) Client message Subsubcommand 8: Accept join party invitation (4 bytes) · BYTE[4] id (party leader’s id) Client message Subsubcommand 9: Decline join party invitation (4 bytes) · BYTE[4] id (party leader’s id) Client message ---- End of Subcommand 0x6 ---- Subcommand 8: Set cursor hue / Set MAP BYTE[1] hue (0 = Felucca, unhued / BRITANNIA map. 1 = Trammel, hued gold / BRITANNIA map, 2 = (switch to) ILSHENAR map) Subcommand 0x0a: wrestling stun Sent by using the client's Wrestle Stun Macro key in Options. This is no longer used since AoS was introduced. The Macro selection that used it was removed. Subcommand 0x0b: Client Language BYTE[3] language (ENU, for English) Subcommand 0x0c: Closed Status Gump BYTE[4] id (character id) Subcommand 0x0e: 3D Client Action BYTE[4] Animation ID. See Notes for list. Subcommand 0x0f: unknown , send once at login BYTE[5] unknown (0a 00 00 00 07) here Subcommand 0x10: unknown, related to 0xD6 Mega Cliloc somehow BYTE[4] Item ID BYTE[4] Unknown Subcommand 0x13: Request popup menu BYTE[4] id (character id) Subcommand 0x14: Display Popup menu BYTE[2] Unknown(always 00 01) BYTE[4] Serial BYTE[1] Number of entries in the popup For each Entry · BYTE[2] Entry Tag (this will be returned by the client on selection) · BYTE[2] Text ID ID is the file number for intloc#.language e.g intloc6.enu and the index into that · BYTE[2] Flags 0x01 = locked, 0x02 = arrow, 0x20 = color · If (Flags &0x20) · BYTE[2] color; // rgb 1555 color (ex, 0 = transparent, 0x8000 = solid black, 0x1F = blue, 0x3E0 = green, 0x7C00 = red) Subcommand 0x15: Popup Entry Selection BYTE[4] Character ID BYTE[2] Entry Tag for line selected provided in subcommand 0x14 Subcommand 0x17: Codex of wisdom BYTE[1] unknown, always 1. if not 1, packet seems to have no effect BYTE[4] msg number BYTE[1] presentation (0: “?” flashing, 1: directly opening) Subcommand 0x18: Enable map-diff (files) BYTE[4] Number of maps For each map · BYTE[4] Number of map patches in this map · BYTE[4] Number of static patches in this map Subcommand: 0x19: Extended stats BYTE[1] type // always 2 ? never seen other value BYTE[4] serial BYTE[1] unknown // always 0 ? BYTE[1] lockBits // Bits: XXSS DDII (s=strength, d=dex, i=int), 0 = up, 1 = down, 2 = locked Subcommand: 0x1a: Extended stats BYTE[1] stat // 0: str, 1: dex, 2:int BYTE[1] status // 0: up, 1:down, 2: locked Subcommand 0x1b: New Spellbook BYTE[2] unknown, always 1 BYTE[4] Spellbook serial BYTE[2] Item Id BYTE[2] scroll offset // 1==regular, 101=necro, 201=paladin, 401=bushido, 501=ninjitsu, 601=spellweaving BYTE[8] spellbook content // first bit of first byte = spell #1, second bit of first byte = spell #2, first bit of second byte = spell #8, etc Subcommand 0x1c: Spell selected, client side BYTE[2] unknown, always 2 BYTE[2] selected spell(0-indexed)+scroll offset from sub 0x1b Subcommand 0x1D: Send House Revision State byte[4] houseserial byte[4] revision state Subcommand 0x1E: byte[4] houseserial Subcommand 0x21: (AOS) Ability icon confirm. Note: no data, just (bf 00 05 21) Subcommand 0x22: Damage BYTE[2] unknown, always 1 BYTE[4] Serial BYTE[1] Damage // how much damage was done ? Subcommand 0x24: UnKnown BYTE[1] unknown. UOSE Introduced Subcommand 0x25: SE Ability Change BYTE[1] Ability ID BYTE[1] 0/1 On/Off Subcommand 0x26: Mount Speed BYTE[1] 0/1 On/Off Notes Subcommand 1: Server Sent. This sets up stack on the client and whenever it moves, it takes the top value from this stack and uses it. (key1 starts at the top, key6 at the bottom) Subcommand 2: Server Sent. This key is added to the top of the stack. In other words, it’s the one that will be used next. Basically, the other 5 only get used when the client is sending moves faster than the server is responding. Subcommand 4: Server Sent. Subcommand 5: Client Sent. Subcommand 6: Sent by both. Contains subcommands for 0x6 for the party system. Be sure you check the packet listing good before attempting these. Subcommand 8: Server Sent. Subcommand a: Read above. Client Sent. Subcommand b: Client Sent once at login of character. Subcommand c: Client Sent when they close their status bar. Subcommand e: Client Sent. Server responds with Play Animation packets. List of animation IDs: 00 00 00 06 - Yawn 00 00 00 15 - Faint 00 00 00 20 - Bow 00 00 00 21 - Salute 00 00 00 64 - Applaud 00 00 00 66 - Argue 00 00 00 68 - Blow Kiss 00 00 00 69 - Formal Bow 00 00 00 6B - Cover Ears 00 00 00 6C - Curtsey 00 00 00 6D - Jig 00 00 00 6E - Folk Dance 00 00 00 6F - Dance 00 00 00 70 - Tribal Dance 00 00 00 71 - Fold Arms 00 00 00 72 - Impatient 00 00 00 73 - Lecture 00 00 00 74 - Nod 00 00 00 75 - Point 00 00 00 77 - Greet Salute 00 00 00 79 - Shake Head 00 00 00 7B - Victory 00 00 00 7C - Celebrate 00 00 00 7D - Wave 00 00 00 7E - Two Handed Wave 00 00 00 7F - Long Distance Wave 00 00 00 80 - What? Subcommand f: Client Sent. Subcommand 13: Client Sent. Subcommand 14: Server Sent. TextID is broken into two decimal parts: stringID / 1000: intloc fileID stringID % 1000: text index So, say you want the 123rd text entry of intloc06, the stringID would be 6123 Subcommand 15: Client Sent. Subcommand 17: Server Sent. Shows codex of wisdom’s text #msg. (msg is linearised (including sub indices) index number starting with 1). Subcommand 18: Server Sent. Number of maps: currently 3 (0 = Fellucca, 1 = Trammel, and 2 = Ilshenar). This packet is sent by the server to the client, telling the client to use the mapdif* and stadif* files for patching map and statics. Subcommand 19: Server Sent. Is sent after the 0x11 packet to enable the stat locks and show their states on 4.x+ clients. Subcommand 1a: Client Sent. Stat Lock change packet. Sent when client changes the lock state for a stat on the status bar. Subcommand 1b: Server Sent. Related to new spell packet 0xBF Subcommand 0x1C. Subcommand 1c: Client Sent. Related to new spellbook packet 0xBF Subcommand 0x1b. Subcommand 1d: Server Sent. Part of AoS Custom Housing. Sends a house's Revision number for handling client's multi cache. If revision is newer than what client has it asks for the new multi packets to cache it. Subcommand 1e: Client Sent. Part of AoS Custom Housing. Sends a house's ID number back after recieving the 0x1D subcommand Subcommand 21: Server Sent. This is sent to reset the color of the icons, and also sent when the server denies the ability attempt (not enough skill or mana). Subcommand 22: Server Sent. Packet for displaying damage dealt above the mob's head. Subcommand 24: Client Sent. Unknown. Subcommand 0x25: Server Sent. Toggles SE Abilities. Subcommand 0x26: Server Sent. Toggles Running at mount speed, even when not mounted.
Packet ID: 0xC0 Packet Name: Graphical Effect Packet Size: 36 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] type BYTE[4] sourceSerial BYTE[4] targetSerial BYTE[2] itemID BYTE[2] xSource BYTE[2] ySource BYTE[1] zSource BYTE[2] xTarget BYTE[2] yTarget BYTE[1] zTarget BYTE[1] speed BYTE[1] duration BYTE[2] unk // On OSI, flamestrikes are 0x0100 BYTE[1] fixedDirection BYTE[1] explodes BYTE[4] hue BYTE[4] renderMode Notes Packet seems to work fine with even 2.0.0 clients
Packet ID: 0xC1 Packet Name: Cliloc Message Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[4] id (0xffff for system message) BYTE[2] body (0xff for system message) BYTE[1] type (6 – lower left, 7 on player) BYTE[2] hue BYTE[2] font BYTE[4] Message number BYTE[30] – speaker’s name BYTE[?*2] – arguments // _little-endian_ unicode string, tabs ('\t') seperate the arguments. Null Terminated 0x0000 Notes Argument example: take number 1042762: "Only ~1_AMOUNT~ gold could be deposited. A check for ~2_CHECK_AMOUNT~ gold was returned to you." the arguments string may have "100 thousand\t25 hundred", which in turn would modify the string: "Only 100 thousand gold could be deposited. A check for 25 hundred gold was returned to you."
Packet ID: 0xC2 Packet Name: Unicode TextEntry Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[4] player id BYTE[4] message id If (server_version of this packet) · BYTE[10] all 0’s .. have to be there, otherwise client crash If (client_version) · BYTE[4] unknown, always 1 · BYTE[3] language code, i.e. DEA, ENU etc. · BYTE[ ?] unicode Text Notes Client version is the reply packet. Server starts with a server side 0xc2. server can pick any message id to identify it. The next text entry from client after 0xc2 server side is client reply with a 0xc2 sent back. First 11 bytes relayed from server packet, plus 0 0 0 1 plus 3 bytes language code + Unicode text. Server side packet always has length 0x15.
Packet ID: 0xC4 Packet Name: Semivisible (Smurf it!) Packet Size: 6 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[4] ID BYTE[1] intensity ? Notes It sets target more or less blue (dependant on intensity value). Only for 2d clients, for 3d clients it does nothing in last attempts (pre-4.x client test)
Packet ID: 0xC6 Packet Name: Invalid Map Enable Packet Size: 0x1 Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] CMD Notes Sent to client to let it know it tried to enable/use an invalid map. Exact purpose unknown to myself.
Packet ID: 0xC7 Packet Name: 3D Particle Effect Packet Size: 49 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[35]…. Preamble … exactly like 0xC0 BYTE[2] effect # (tile ID) BYTE[2] explode effect # (0 if no explosion) BYTE[2] additional effect # that’s only used for moving effects, 0 otherwise BYTE[4] if target is item (type 2) that’s itemId, 0 otherwise BYTE[1] layer (of the character, e.g left hand, right hand, … 0-4, 0xff: moving effect or target is no char) BYTE[2] yet another (unknown) additional effect that’s only set for moving effect, 0 otherwise
Packet ID: 0xC8 Packet Name: Client View Range Packet Size: 2 Bytes Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] range Notes Range: how far away client wants to see (=get send) items/npcs Since client 3.0.8o it actually got activated.(in a useful way) When increase/decrease macro send, client sends a 0xc8. If and only if erver “relays” the packet (sending back the same data) range stuff gets activated client side. ”Greying“ has no packet, purely client internal. Minimal value:5, maximal: 18
Packet ID: 0xC9 Packet Name: Get Area Server Ping Packet Size: 6 Bytes Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] sequence // initially 1, wraps after 255 to 0 BYTE[4] tickcount Notes Client sends packet with it's tick count. Server replies with same packetID/sequence and it's own tick count. Over a few packets, the client can deduct a reasonably accurate ping number. Currently only used/ implemented in god client
Packet ID: 0xCA Packet Name: Get User Server Ping Packet Size: 6 Bytes Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] sequence // initially 1, wraps after 255 to 0 BYTE[4] tickcount Notes See 0xC9
Packet ID: 0xCB Packet Name: Global Que Count Packet Size: 7 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] unknown BYTE[4] count Notes displays the message: There are currently [count] available calls in the global queue
Packet ID: 0xCC Packet Name: Cliloc Message Affix Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[4] id (0xffff for system message) BYTE[2] body (0xff for system message) BYTE[1] type (6 – lower left, 7 on player) BYTE[2] hue BYTE[2] font BYTE[4] Message number BYTE[1] flags (0x02 is unknown, 0x04 signals the message doesn't move on screen) (flags & 0x1) == 0 signals affix is appended to the localization string, (flags & 0x1) == 1 signals to prepend. BYTE[30] – speaker’s name BYTE[?] affix / null terminated BYTE[?]*2] arguments; // _big-endian_ unicode string, tabs ('\t') seperate arguments, see 0xC1 for argument example
Packet ID: 0xD0 Packet Name: Configuration File Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[1] type - file type, not sure of precise values BYTE[length-4] unknown encoded in some form Notes Sent if (flag & 0x02) in packet 0xA9 Probably used for saving client configuration files server side. OSI used it for the IGR shard only that is not anymore. Not sure what configuration files are, perhaps those in /desktop/player dir Encoding/(compression?) completely unknown Note: there’s a client and server version of it. If on, client sends them 5 times (5 files) at login. After logout (0xd1) it expects server versions of 0xd0 and finally a server version of 0xd1
Packet ID: 0xD1 Packet Name: Logout Status Packet Size: 2 bytes Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[1] unknown // always 1 Notes Client sends on logout if (flag & 0x02) in packet 0xA9, when server responds with same packet, client finishes logging out
Packet ID: 0xD2 Packet Name: Extended 0x20 Packet Size: 25 Bytes Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd Preamble: Exactly like 0x20 BYTE[2] unknown 1 BYTE[2] unknown 2 BYTE[2] unknown 3
Packet ID: 0xD3 Packet Name: Extended 0x78 Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd Preamble: Exactly like 0x78 BYTE[2] unknown 1 BYTE[2] unknown 2 BYTE[2] unknown 3
Packet ID: 0xD4 Packet Name: *New* Book Header Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[4] book ID BYTE[1] flag1 BYTE[1] flag2 BYTE[2] number of pages BYTE[2] length of author string (0 terminator included) BYTE[?] author (ASCII, 0 terminated) BYTE[2] length of title string (0 terminator included) BYTE[?] title string Notes Packet sent from server when opening a book: opening book writeable: flag1+flag2 both 1 (opening readonly book: flag1+flag2 0, unverified though) client side: flag1+flag2 both 0, number of pages 0. Example:: Opening books goes like this: open book -> server sends 0xd4(title + author) server sends 0x66 with all book data “beyond” title + author if title + author changed: client side 0xd4 send if other book pages changed: 0x66 client side send.
Packet ID: 0xD6 Packet Name: Mega Cliloc Packet Size: vaiable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] Cmd BYTE[2] Length of packet BYTE[2] 0001 BYTE[4] Serial of item/creature BYTE[2] 0000 BYTE[4] Serial of item/creature in all tests. This could be the serial of the item the entry to appear over. Loop of all the item/creature's properties to display in the order to display them. The name is always the first entry. BYTE[4] Cliloc ID BYTE[2] Length of (if any) Text to add into/with the cliloc BYTE[?] Unicode text to be added into the cliloc. Not sent if Length of text above is 0 BYTE[4] 00000000 - Sent as end of packet/loop
Packet ID: 0xD7 Packet Name: Generic AOS Commands Packet Size: Variable Sent By: Both Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] size BYTE[4] PlayerID BYTE[2] SubCommand message Sub Commands SubCommand 0x02: Backup BYTE[1] 07 SubCommand 0x03: Restore BYTE[1] 07 SubCommand 0x04: Commit BYTE[1] 07 SubCommand 0x05: DeleteItem BYTE[1] unknown (0) BYTE[2] unknown (0) BYTE[2] item graphic BYTE[1] unknown (0) BYTE[4] X Pos BYTE[1] unknown (0) BYTE[4] Y Pos BYTE[1] unknown (0) BYTE[4] z Pos (7) BYTE[1] terminator (0x07) SubCommand 0x06: AddItem BYTE[1] unknown (0) BYTE[2] unknown (0) BYTE[2] itemGraphic BYTE[1] unknown (0) BYTE[4] XPos BYTE[1] unknown (0) BYTE[4] YPos BYTE[1] terminator (0x07) SubCommand 0x0C: Exit House Tool BYTE[1] unknwon (0x07) SubCommand 0x0D: Change Stairs BYTE[1] unknown (0x00) BYTE[2] X Position (Relative to center of house) BYTE[1] unknown (0x00) BYTE[2] Y Position (Relative to center of house) BYTE[1] unknown (0x00) SubCommand 0x0E: Synch Button BYTE[1] Unknown (0x07) SubCommand 0x10: Clear Button BYTE[1] Unknown (0x07) SubCommand 0x12: ChangeFloor BYTE[4] unknown (0) BYTE[1] Floor# BYTE[1] terminator (0x07) SubCommand 0x1A: Revert Button BYTE[1] Unknown (0x07) SubCommand 0x19: Combat Book Abilities BYTE[4] 00 00 00 00 = Unknown. Always like this in all my testing BYTE[1] The ability "number" used BYTE[1] 0A SubCommand 0x28: Guild Button BYTE[1] Unknown (0x07) SubCommand 0x32: Quest Button BYTE[1] Unknown (0x07) Notes Submitted information. untested and unverified. Subcommand 0x02: This is sent when the client pushed the Backup button in the customization screen. Unsure what it triggers on the server since house building is totally handled client side until submitted. SubCommand 0x03: Sent when client pushes the Restore button in the customization menu. Will need testing to see exact purpose of 2 and 3 subs. Possible the server could request current "layout" that is not yet commited to save the design without commiting to be later restored with this command. SubCommand 0x04: Sent when client pushes the Commit Button. SubCommand 0x05: Sent when client chooses to destroy items. SubCommand 0x06: Sent when client Chooses to add items. SubCommand 0x0C: Sent when client pushes the Exit Button. SubCommand 0x0D: Sent when client adds stairs to the multi in edit mode. SubCommand 0x0E: Sent when client pushes the Synch Button. SubCommand 0x10: Sent when client pushes the Clear Button. SubCommand 0x12: Sent when client pushes the Change Floor Buttons. SubCommand 0x1A: Sent when client pushes the Revert Button. SubCommand 0x19: Sent when client pushes the icones from the combat book. The server uses an 0xBF Subcommand 0x21 Packet to cancel the red color of icons, and reset the status of them on client. Valid Ability Numbers: 0x00 = Cancel Ability Attempt 0x01 = Armor Ignore 0x02 = Bleed Attack 0x03 = Concusion Blow 0x04 = Crushing Blow 0x05 = Disarm 0x06 = Dismount 0x07 = Double Strike 0x08 = Infecting 0x09 = Mortal Strike 0x0A = Moving Shot 0x0B = Paralyzing Blow 0x0C = Shadow Strike 0x0D = Whirlwind Attack 0x0E = Riding Swipe 0x0F = Frenzied Whirlwind 0x10 = Block 0x11 = Defense Mastery 0x12 = Nerve Strike 0x13 = Talon Strike 0x14 = Feint 0x15 = Dual Wield 0x16 = Double shot 0x17 = Armor Peirce 0x18 = Bladeweave 0x19 = Force Arrow 0x1A = Lightning Arrow 0x1B = Psychic Attack 0x1C = Serpent Arrow 0x1D = Force of Nature SubCommand 0x28: Sent when client pushes the Guild Button on the paperdoll. SubCommand 0x32: Sent when client pushes the Quest Button on the paperdoll.
Packet ID: 0xD8 Packet Name: Send Custom House Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length BYTE[1] CompressionType (0=nothing, 3=zlib) BYTE[1] unknown (0) BYTE[4] HouseSerial BYTE[4] Revision State BYTE[2] Number of Tiles BYTE[2] Buffer length (Number of tiles * 5) For Each Component · BYTE[2] component graphic · BYTE[1] X · BYTE[1] Y · BYTE[1] Z X/Y of this packet is probably wrong. May be 2 Byte portions instead of 1. Information was submitted and as of yet untested.
Packet ID: 0xD9 Packet Name: Spy On Client Packet Size: Variable Sent By: Client Submitted: MuadDib Description Sends information related to client pc's hardware, operating system, direct x, etc. Full packet information is still unknown. Packet Breakdown BYTE[1] cmd BYTE[1] unknown (02) Always 0x02 in my tests BYTE[4] Unique Instance ID of UO BYTE[4] OS Major BYTE[4] OS Minor BYTE[4] OS Revision BYTE[1] CPU Manufacturer BYTE[4] CPU Family BYTE[4] CPU Model BYTE[4] CPU Clock Speed BYTE[1] CPU Quantity BYTE[4] Memory BYTE[4] Screen Width BYTE[4] Screen Height BYTE[4] Screen Depth BYTE[2] Direct X Version BYTE[2] Direct X Minor BYTE[76?] Video Card Description BYTE[4] Video Card Vendor ID BYTE[4] Video Card Device ID BYTE[4] Video Card Memory BYTE[1] Distribution BYTE[1] Clients Running BYTE[1] Clients Installed BYTE[1] Partial Insstalled BYTE[1] Unknown BYTE[4] Language Code BYTE[67] Unknown Ending Notes Older clients, from mid-late 2003 was set at 149 bytes length, whereas newest clients 4.01+ are set to 199 ??
Packet ID: 0xDB Packet Name: Character Transfer Log Packet Size: variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] cmd BYTE[2] length of packet BYTE[4] Unknown, always 000000BB in my testing. BYTE[?] Length - 7 of packet BYTE[4] Transfer ID BYTE[4] Unknown, all zeros BYTE[4] Unknown, all zeros For each item in transfer log, this loop is performed: BYTE[4] Item's Serial BYTE[4] Size of next loop (Big Endian) BYTE[4] The cliloc of the item's name or property. If zero, defaults to 'Transfer Crate.' BYTE[1] Length of Cliloc Addon Text BYTE[?] Text to affix/insert into the cliloc BYTE[2] 0009 - Ends the loop for cliloc addon text and item Notes When a character transfer is confirmed, the server sends this to create a log of all the items being included in the transfer. This log is saved to translog.txt. Item properties are also included in this packet.
Packet ID: 0xDC Packet Name: SE Introduced Revision Packet Size: 9 Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] CMD BYTE[4] Item/Mob Serial BYTE[4] Item Revision Hash Notes Newer packet as of late 2004. Is now used on OSI to handle the Revision of Tooltips instead of the original 0xBF methods it appears.
Packet ID: 0xDD Packet Name: Compressed Gump Packet Size: variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[1] Cmd BYTE[2] len BYTE[4] Player Serial BYTE[4] Gump ID BYTE[4] x BYTE[4] y BYTE[4] Compressed Gump Layout Length (CLen) BYTE[4] Decompressed Gump Layout Length (DLen) BYTE[CLen] Gump Data, zlib compressed BYTE[4] Number of text lines BYTE[4] Compressed Text Line Length (CTxtLen) BYTE[4] Decompressed Text Line Length (DTxtLen) BYTE[CTxtLen] Gump's Compressed Text data, zlib compressed
Packet ID: 0xDF Packet Name: Buff/Debuff System Packet Size: variable Sent By: Server Submitted: Turley Packet Breakdown BYTE[1] Cmd BYTE[2] Length BYTE[4] Serial of player BYTE[2] Icon Number to show BYTE[2] 0x1 = Show, 0x0 = Remove. On remove byte, packet ends here. BYTE[2] Icon Number to show. BYTE[2] 0x1 = Show BYTE[2] Time in seconds before icon auto-removes itself BYTE[4] 0x00000000 BYTE[2] Time in seconds (simple countdown without automatic remove) BYTE[4] 0x00000000 BYTE[4] Cliloc ID of title of icon. BYTE[4] Cliloc ID 1049644. Used for the Description of the icon. If no arguments for cliloc, packet ends here. BYTE[6] 000000000000 Always this in current testing. BYTE[2] Length of Description text for Cliloc Description BYTE[len(str)*2] Unicode String ("\t"+str) (To seperate the entrys add "\t") Notes This is a submitted packet, information here is yet to be verified. Use at own risk. List of current Icon Names: 1001: Dismount 1002: Disarm 1005: Nightsight 1006: Death Strike 1007: Evil Omen 1008: ? GumpID 0x7556 1009: ? GumpID 0x753A 1010: Divine Fury 1011: Enemy Of One 1012: Stealth 1013: Active Meditation 1014: Blood Oath caster 1015: Blood Oath curse 1016: Corpse Skin 1017: Mindrot 1018: Pain Spike 1019: Strangle 1020: Gift of Renewal 1021: Attune Weapon 1022: Thunderstorm 1023: Essence of Wind 1024: Ethereal Voyage 1025: Gift Of Life 1026: Arcane Empowerment 1027: Mortal Strike 1028: Reactive Armor 1029: Protection 1030: Arch Protection 1031: Magic Reflection 1032: Incognito 1033: Disguised 1034: Animal Form 1035: Polymorph 1036: Invisibility 1037: Paralyze 1038: Poison 1039: Bleed 1040: Clumsy 1041: Feeble Mind 1042: Weaken 1043: Curse 1044: Mass Curse 1045: Agility 1046: Cunning 1047: Strength 1048: Bless
Packet ID: 0xF0 Packet Name: Krrios client special Packet Size: Variable Sent By: Server Submitted: MuadDib Packet Breakdown BYTE[2] len BYTE[1] subcmd BYTE[len - 4] data Notes Subcommand 0: Acknowledge login (1 byte (for 5 total)) BYTE[1] ack (0 = Rejected, unauthorized. 1 = Accepted, GM priviledges. 2 = Accepted, player priviledges) Note: GM priviledges unlock movement rate configurations