Packet Name: Follow
Last Modified: 2009-02-22 12:36:34
Modified By: MuadDib

Packet: 0x15
Sent By: Both
Size: 9 bytes

Packet Build
BYTE[1] Command
BYTE[4] Serial of what is being followed.
BYTE[4] Serial of who is doing the following.

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Character Move ACK/ Resync Request
Last Modified: 2009-02-22 12:36:24
Modified By: MuadDib

Packet: 0x22
Sent By: Both
Size: 3 bytes

Packet Build
BYTE[1] Command
BYTE[1] sequence (matches sent sequence)
BYTE[1] notoriety

Subcommand Build
N/A

Notes
Notoriety

0 = invalid/across server line
1 = innocent (blue)
2 = guilded/ally (green)
3 = attackable but not criminal (gray)
4 = criminal (gray)
5 = enemy (orange)
6 = murderer (red)
7 = unknown use (translucent (like 0x4000 hue))

---

Packet Name: Resurrection Menu
Last Modified: 2009-02-22 12:37:18
Modified By: MuadDib

Packet: 0x2C
Sent By: Both
Size: 2 bytes

Packet Build
BYTE[1] Command
BYTE[1] Action

Subcommand Build
N/A

Notes
The only use on OSI for this packet is now sending "2C02" for the "You Are Dead" screen upon character death.

Action
0: Server sent
1: Resurrect
2: Ghost

---

Packet Name: Remove (Group)
Last Modified: 2009-02-17 20:21:53
Modified By: MuadDib

Packet: 0x39
Sent By: Both
Size: 9 bytes

Packet Build
BYTE[1] Command
BYTE[4] Player serial
BYTE[4] Target serial

Subcommand Build
N/A

Notes
Outdated packet, no longer seen to be in use on OSI recently.

If player serial is zeroed, then it removes the target serial from a group?

If player serial and target serial are the same, it reports removed from group to the client.

---

Packet Name: Send Skills
Last Modified: 2009-03-02 05:23:55
Modified By: Turley

Packet: 0x3A
Sent By: Both
Size: Variable

Packet Build
Server Version:
BYTE[1] Command
BYTE[2] Length
BYTE[1] Type
Repeat next for each skill

• BYTE[2] Skill ID Number
• BYTE[2] Skill Value * 10
• BYTE[2] Unmodified Value * 10
• BYTE[1] Skill Lock

If (Type==2 || Type==0xDF)

• BYTE[2] Skill Cap

BYTE[2] Null Terminated(0000) (ONLY IF TYPE == 0x00)

Client Version (sets skill lock states):
BYTE[1] Command
BYTE[2] Length
BYTE[2] Skill ID Number
BYTE[1] Skill Lock State

Subcommand Build
N/A

Notes
Type

0x00: Full List of skills
0xFF: Single skill update
0x02: Full List of skills with skill cap for each skill
0xDF: Single skill update with skill cap for skill

Skill Lock State
0x0: Up
0x1: Down
0x2: Locked

---

Packet Name: Map Packet (cartography/treasure)
Last Modified: 2009-02-28 17:07:06
Modified By: Turley

Packet: 0x56
Sent By: Both
Size: 11 Bytes

Packet Build
BYTE[1] cmd
BYTE[4] id
BYTE[1] command
1 = add map point.
2 = add new pin with pin number.(insertion. other pins after the number are pushed back.)
3 = change pin
4 = remove pin
5 = remove all pins on the map
6 = toggle the 'editable' state of the map.
7 = return msg from the server to the request 6 of the client.
BYTE[1] plotting state (1=on, 0=off, valid only if command 7)
BYTE[2] x location (relative to upper left corner of the map, in pixels, for points)
BYTE[2] y location (relative to upper left corner of the map, in pixels, for points)

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Books (Pages, Old Packet)
Last Modified: 2009-03-01 08:02:30
Modified By: Turley

Packet: 0x66
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] bookID
BYTE[2] # of pages in this packet

For each page:

• BYTE[2] page #
• BYTE[2] # of lines on page
• Repeated for each line:
• • BYTE[var] null terminated line

Subcommand Build
N/A

Notes
server side: # of pages equals value given in 0x93/0xd4

EACH page # given. If empty: # lines: 0 + terminator (=3 0's)

client side: # of pages always 1. if 2 pages changed, client generates 2 packets.

---

Packet Name: Target Cursor Commands
Last Modified: 2009-03-01 08:04:21
Modified By: Turley

Packet: 0x6C
Sent By: Both
Size: 19 Bytes

Packet Build
BYTE[1] cmd
BYTE[1] type

• 0x00 = Select Object
• 0x01 = Select X, Y, Z

BYTE[4] cursorID
BYTE[1] Cursor Type

• 0 = ?
• 1 = ?
• 2 = ?
• 3 = Cancel current targetting

The following are always sent but are only valid if sent by client

• BYTE[4] Clicked On ID
• BYTE[2] click xLoc
• BYTE[2] click yLoc
• BYTE unknown (0x00)
• BYTE click zLoc
• BYTE[2] model # (if a static tile, 0 if a map/landscape tile)

Subcommand Build
N/A

Notes
The model # should never be trusted.

Once the server requests the client to target something, the server can undo this also. You can "kill" the targetting cursor faithfully and without any bugs. Send another Packet with Type set to 0 (Object), Cursor ID 00000000, and Cursor Type as 3. The client will respond to this by sending a response to the original request just as if the user had hit ESC to cancel targetting.

---

Packet Name: Secure Trading
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x6F
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] blockSize
BYTE[1] action
BYTE[4] id1
BYTE[4] id2
BYTE[4] id3
BYTE[1] nameFollowing (0 or 1)
If (nameFollowing = 1)
BYTE[?] charName

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Bulletin Board Messages
Last Modified: 2009-03-01 08:09:45
Modified By: Turley

Packet: 0x71
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] len
BYTE[1] subcmd
BYTE[len-4] submessage

Subcommand Build
Subcommand 0 - Display Bulletin Board (Server)
BYTE[4] BoardID
BYTE[22] board name (default is "bulletin board", the rest nulls)
BYTE[4] ID (0x402000FF)
BYTE[4] zero (0)

Subcommand 1 - Message Summary (Server)
BYTE[4] BoardID
BYTE[4] MessageID
BYTE[4] ParentID (0 if top level)
BYTE[1] posterLen
BYTE[posterLen] poster (null terminated string)
BYTE[1] subjectLen
BYTE[subjectLen] subject (null terminated string)
BYTE[1] timeLen
BYTE[timeLen] time (null terminated string with time of posting) ("Day 1 @ 11:28")

Subcommand 2 - Message (Server)
BYTE[4] BoardID
BYTE[4] MessageID
BYTE[1] posterLen
BYTE[posterLen] poster (null terminated string)
BYTE[1] subjectLen
BYTE[subjectLen] subject (null terminated string)
BYTE[1] timeLen
BYTE[timeLen] time (null terminated string with time of posting) ("Day 1 @ 11:28")
BYTE[29] constant: (01 91 84 0A 06 1E FD 01 0B 15 2E 01 0B 17 0B 01 BB 20 46 04 66 13 F8 00 00 0E 75 00 00)
BYTE[1] numlines
For each line:
BYTE[1] linelen
BYTE[linelen] body (null terminated)

Subcommand 3 - Request Message (Client)
BYTE[4] BoardID
BYTE[4] MessageID

Subcommand 4 - Request Message Summary (Client)
BYTE[4] BoardID
BYTE[4] MessageID

Subcommand 5 - Post a message (Client)
BYTE[4] BoardID
BYTE[4] Replying to ID (0 if this is a top level / non-reply post)
BYTE[1] subjectLen (length of the subject, includes null termination)
BYTE[subjectLen] subject (null terminated)
BYTE[1] numlines
For each line:

• BYTE linelen
• BYTE[linelen] body (null terminated)

Subcommand 6 - Remove Posted Message (Client)
BYTE[4] BoardID
BYTE[4] MessageID

Notes
N/A

---

Packet Name: Books (Title Page, Old Packet)
Last Modified: 2009-03-01 08:10:43
Modified By: Turley

Packet: 0x93
Sent By: Both
Size: 99 Bytes

Packet Build
Server Version:
BYTE[1] cmd
BYTE[4] bookID
BYTE[1] write flag

• 0x00 - non-writable
• 0x01 - writable

BYTE[1] new flag
BYTE[2] # of pages
BYTE[60] title
BYTE[30] author

Client Version:
BYTE[1] cmd
BYTE[4] bookID
BYTE[4] unknown (0)
BYTE[60] title (zero terminated, garbage after terminator)
BYTE[30] author (zero terminated, garbage after terminator)

Subcommand Build
N/A

Notes
Client sends a 0x93 message on book close. Tis an Update packet for the server to handle changes etc for this.

---

Packet Name: Dye Window
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x95
Sent By: Both
Size: 9 Bytes

Packet Build
BYTE[1] cmd
BYTE[4] itemID of dye target
BYTE[2] ignored on send, model on return
BYTE[2] model on send, color on return from client (default on server send is 0x0FAB)

Subcommand Build
N/A

Notes
N/A

---

Packet Name: All Names (3D Client Only)
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x98
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] blocksize
BYTE[4] ID
If (server-reply)
BYTE[30] name (0 terminated)

Subcommand Build
N/A

Notes
Only 3D clients send this packet. Server and client packet.
Unsure as of when, 2D client added this ability also.

Client asks for name of object with ID x. Server has to reply with ID + name. Client automatically knows names of items. Hence it only asks only for NPC/Player names nearby, but shows bars of items plus NPCs.

Client request has 7 bytes, server-reply 37. Triggered by Crtl + Shift.

---

Packet Name: Give Boat/House Placement View
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x99
Sent By: Both
Size: 26 Bytes

Packet Build
BYTE[1] cmd
BYTE[1] request (0x01 from server, 0x00 from client)
BYTE[4] ID of deed
BYTE[12] unknown (all 0)
BYTE[2] multi model (item model - 0x4000)
BYTE[6] unknown (all 0)

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Chat Text
Last Modified: 2008-10-11 09:57:22
Modified By: Pierce

Packet: 0xB3
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] Length
BYTE[3] Unicode Language
BYTE[2] UnKNOWN(00 00)
BYTE[1] Text/Command Type

Subcommand Build
Type 0x41 (Change Password):
BYTE[?] Unicode Password
BYTE[2] Null Terminator (00 00)

Type 0x58 (Close):
BYTE[2] Null Terminator (00 00)

Type 0x61 (Message):
BYTE[?] Unicode Message
BYTE[2] Null Terminator (00 00)

Text 0x62 (Join Conference):
BYTE[2] Holder (0x0022)
BYTE[?] Unicode conference name
BYTE[2] Holder (0x0022)
BYTE[2] Holder (0x0020)
BYTE[?] Unicode password if pass req'd
BYTE[2] Null Teriminator (0x0000)

Text 0x63 (Create New Conference):
BYTE[?] Unicode conference name
BYTE[2] Holder (0x007b) if pass entered
BYTE[?] Unicode conference pass if pass entered
BYTE[2] Holder (0x007d) if pass entered
BYTE[2] Null Teriminator (0x0000)

Text 0x64 (Rename Conference):
BYTE[?] Unicode conference name (all text after /rename )
BYTE[2] Null Teriminator (0x0000)

Text 0x65 (Send Private Message):
BYTE[?] Unicode name (all text after /msg )
BYTE[2] Null Teriminator (0x0000)

Text 0x66 (Ignore):
BYTE[?] Unicode name (all text after +ignore )
BYTE[2] Null Teriminator (0x0000)

Text 0x67 (Stop Ignoring):
BYTE[?] Unicode name (all text after -ignore )
BYTE[2] Null Teriminator (0x0000)

Text 0x68 (Toggle Ignore):
BYTE[?] Unicode name (all text after /ignore )
BYTE[2] Null Teriminator (0x0000)

Text 0x69 (Grant Speaking Priveleges):
BYTE[?] Unicode name (all text after +voice )
BYTE[2] Null Teriminator (0x0000)

Text 0x6A (Remove Speaking Priveleges):
BYTE[?] Unicode name (all text after -voice )
BYTE[2] Null Teriminator (0x0000)

Text 0x6B (Toggle Speaking Priveleges):
BYTE[?] Unicode name (all text after /voice )
BYTE[2] Null Teriminator (0x0000)

Text 0x6C (Grant Moderator Status):
BYTE[?] Unicode name (all text after +ops )
BYTE[2] Null Teriminator (0x0000)

Text 0x6D (Remove Moderator Status):
BYTE[?] Unicode name (all text after -ops )
BYTE[2] Null Teriminator (0x0000)

Text 0x6E (Toggle Moderator Status):
BYTE[?] Unicode name (all text after /ops )
BYTE[2] Null Teriminator (0x0000)

Text 0x6F (not receiving messages):
BYTE[2] Null Teriminator (0x0000)

Text 0x70 (receiving messages):
BYTE[2] Null Teriminator (0x0000)

Text 0x71 (Toggle receiving messages):
BYTE[2] Null Teriminator (0x0000)

Text 0x72 (show my character name):
BYTE[2] Null Teriminator (0x0000)

Text 0x73 (don't show my character name):
BYTE[2] Null Teriminator (0x0000)

Text 0x74 (Toggle showing my character name):
BYTE[2] Null Teriminator (0x0000)

Text 0x75 (Who is this player?):
BYTE[?] Unicode text (all text after /whois )
BYTE[2] Null Teriminator (0x0000)

Text 0x76 (Kick out of the conference?):
BYTE[?] Unicode text (all text after /kick )
BYTE[2] Null Teriminator (0x0000)

Text 0x77 (only moderators have speaking priveleges by default):
BYTE[2] Null Teriminator (0x0000)

Text 0x78 (everyone has speaking priveleges by default):
BYTE[2] Null Teriminator (0x0000)

Text 0x79 (Toggle default speaking priveleges):
BYTE[2] Null Teriminator (0x0000)

Text 0x7A (emote)
BYTE[?] Unicode text (all text after /emote or /em ):
BYTE[2] Null Teriminator (0x0000)

Notes
N/A

---

Packet Name: Request/Char Profile
Last Modified: 2009-03-01 08:15:24
Modified By: Turley

Packet: 0xB8
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] length
BYTE[1] mode (CLIENT ONLY! Does not exist in server message.)
BYTE[4] id
If request, ends here.
If Update request

• BYTE[2] cmdType (0x0001 - Update)
• BYTE[2] msglen (# of unicode characters)
• BYTE[msglen][2] new profile, in unicode, not null terminated.

Else If from server

• BYTE[?] title (not unicode, null terminated.)
• BYTE[?][2] static profile ( unicode string can't be edited )
• BYTE[2] (0x0000) (static profile terminator)
• BYTE[?][2] profile (in unicode, can be edited)
• BYTE[2] (0x0000) (profile terminator)

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Ultima Messenger
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0xBB
Sent By: Both
Size: 9 Bytes

Packet Build
BYTE[1] cmd
BYTE[4] id1
BYTE[4] id2

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Client Version
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0xBD
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] length
If (client-version of packet)
BYTE[len-3] string stating the client version (0 terminated) (like: "1.26.4")

Subcommand Build
N/A

Notes
Client version : client sends its version string (e.g "3.0.8j")
Server version : 0xbd 0x0 0x3 (client replies with client version of this packet)

Clients sends a client version of this packet ONCE at login (without server request.)

---

Packet Name: Assist Version
Last Modified: 2009-03-01 08:36:37
Modified By: Turley

Packet: 0xBE
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] length
If (client-version of packet)

• BYTE[4] Assist version (numeric)
• BYTE[?] string stating the client version (0 terminated) (like: "1.26.4")

If (server-version of packet)

• BYTE[4] Allowed Assist version (numeric)

Subcommand Build
N/A

Notes
Server requests assist version via server side version of this packet, client replies with client side version of packet. If it's a client without Assist, allowed Assists version from server is relayed in client version packet. Because assist never has assist version 0, that would be a way to disallow it.

---

Packet Name: General Information Packet
Last Modified: 2009-03-23 07:33:46
Modified By: Tomi

Packet: 0xBF
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] length
BYTE[2] subcmd
BYTE[length-5] submessage/commands

Subcommand Build
Subcommand 1: Initialize Fast Walk Prevention
BYTE[4] key1
BYTE[4] key2
BYTE[4] key3
BYTE[4] key4
BYTE[4] key5
BYTE[4] key6

Subcommand 2: Add key to Fast Walk Stack
BYTE[4] newkey

Subcommand 4: "Close Generic Gump"
BYTE[4] dialogID // which gump to destroy (second ID in 0xB0 packet)
BYTE[4] buttonId // response buttonID for packet 0xB1

Subcommand 5: Screen size
BYTE[2] unknown1 , always 0 ?
BYTE[2] X
BYTE[2] Y
BYTE[2] unknown2

---- Start of Subcommand 0x6 ----
Subcommand 6: Party System
Subsubcommands for 6:
Subsubcommand 1: Add a party member (4 bytes)
BYTE[4] id (if 0, a targeting cursor appears)Client Message

Subsubcommand 1: Add party member(s) (1+ numMembers*4)
BYTE[1] number of Members (total number of members in the party)
Then, for each member in numMembers:
BYTE[4] id
Server Message

Subsubcommand 2: Remove a party member (4 bytes)
BYTE[4] id (if 0, a targeting cursor appears)
Client message

Subsubcommand 2: Remove a party member (? Bytes)
BYTE[1] number of Members (total number of members in the new party)
BYTE[4] idofPlayerRemoved
Then, for each member in numMembers:
BYTE[4] id
Server message

Subsubcommand 3: Tell party member a message (Variable # of bytes)
BYTE[4] id (of target, from client, of source, from server)
BYTE[n][2] Null terminated Unicode message.
Client & Server Message

Subsubcommand 4: Tell full party a message (Variable # of bytes)
BYTE[n][2] Null terminated Unicode message.
Client Message.

Subsubcommand 4: Tell full party a message (Variable # of bytes)
BYTE[4] id (of source)
BYTE[n][2] Null terminated Unicode message.
Server Message

Subsubcommand 6: Party Can Loot Me? (1 byte)
BYTE[1] canloot (0=no, 1=yes)
Client message

Subsubcommand 7: party invitation?
BYTE[4] serial (party leader)

Subsubcommand 8: Accept join party invitation (4 bytes)
BYTE[4] serial (party leader)
Client message

Subsubcommand 9: Decline join party invitation (4 bytes)
BYTE[4] serial (party leader)
Client message
---- End of Subcommand 0x6 ----

Subcommand 8: Set cursor hue / Set MAP
BYTE[1] hue (0 = Felucca, unhued / BRITANNIA map. 1 = Trammel, hued gold / BRITANNIA map, 2 = (switch to) ILSHENAR map)

Subcommand 0x0a: wrestling stun
Sent by using the client Wrestle Stun Macro key in Options. This is no longer used since AoS was introduced. The Macro selection that used it was removed.

Subcommand 0x0b: Client Language
BYTE[3] language (ENU, for English)

Subcommand 0x0c: Closed Status Gump
BYTE[4] id (character id)

Subcommand 0x0e: 3D Client Action
BYTE[4] Animation ID. See Notes for list.

Subcommand 0x0f: unknown , send once at login
BYTE[5] unknown (0a 00 00 00 07) here

Subcommand 0x10: unknown, related to 0xD6 Mega Cliloc somehow
BYTE[4] Item ID
BYTE[4] Unknown

Subcommand 0x13: Request popup menu
BYTE[4] id (character id)

Subcommand 0x14: Display Popup/context menu (2D and KR)
BYTE[1] unknown (0x00)
BYTE[1] subsubcommand (0x01 for 2D, 0x02 for KR)
BYTE[4] Serial
BYTE[1] Number of entries in the popup/context

2D-client:
loop Entries
BYTE[2] Entry Tag (this will be returned by the client on selection)
BYTE[2] Text ID ID is the file number for intloc#.language e.g intloc6.enu and the index into that
BYTE[2] Flags 0x00=enabled, 0x01=disabled, 0x02=arrow, 0x20 = color
If (Flags = 0x20)
BYTE[2] color/hue; // rgb 1555 color (ex, 0 = transparent, 0x8000 = solid black, 0x1F = blue, 0x3E0 = green, 0x7C00 = red)
Endif
endloop(entries)

KR-client:
loop Entries
BYTE[4] Text ID Number?
BYTE[2] Index of entry (entry tag)?
BYTE[2] Flags 0x00=enabled, 0x01=disabled, 0x04 = highlighted
endloop(entries)

Subcommand 0x15: Popup Entry Selection
BYTE[4] Character ID
BYTE[2] Entry Tag for line selected provided in subcommand 0x14

Subcommand 0x17: Codex of wisdom
BYTE[1] unknown, always 1. if not 1, packet seems to have no effect
BYTE[4] msg number
BYTE[1] presentation (0: flashing, 1: directly opening)

Subcommand 0x18: Enable map-diff (files)
BYTE[4] Number of maps
For each map

• BYTE[4] Number of map patches in this map
• BYTE[4] Number of static patches in this map

Subcommand: 0x19: Extended stats
BYTE[1] subsubcommand (0x2 for 2D client, 0x5 for KR client)
BYTE[4] serial
BYTE[1] unknown (always 0)
BYTE[1] Lock flags (0 = up, 1 = down, 2 = locked, FF = update mobile status animation ( KR only )

Lock flags = 00SSDDII ( in binary )
00 = up
01 = down
10 = locked

If(subsubcommand = 0x05 (KR))

If(Lock flags = 0xFF) //Update mobile status animation
BYTE[1] Status // Unveryfied if lock flags == FF the locks will be handled here
BYTE[1] unknown (0x00)
BYTE[1] Animation
BYTE[1] unknown (0x00)
BYTE[1] Frame
else
BYTE[1] unknown (0x00)
BYTE[4] unknown (0x00000000)
endif

endif

Subcommand: 0x1a: Extended stats
BYTE[1] stat // 0: str, 1: dex, 2:int
BYTE[1] status // 0: up, 1:down, 2: locked

Subcommand 0x1b: New Spellbook
BYTE[2] unknown, always 1
BYTE[4] Spellbook serial
BYTE[2] Item Id
BYTE[2] scroll offset // 1==regular, 101=necro, 201=paladin, 401=bushido, 501=ninjitsu, 601=spellweaving
BYTE[8] spellbook content // first bit of first byte = spell #1, second bit of first byte = spell #2, first bit of second byte = spell #8, etc

Subcommand 0x1c: Spell selected, client side
BYTE[2] unknown, always 2
BYTE[2] selected spell(0-indexed)+scroll offset from sub 0x1b

Subcommand 0x1D: Send House Revision State
byte[4] houseserial
byte[4] revision state

Subcommand 0x1E:
byte[4] houseserial

Subcommand 0x21: (AOS) Ability icon confirm.
Note: no data, just (bf 00 05 21)

Subcommand 0x22: Damage
BYTE[2] unknown, always 1
BYTE[4] Serial
BYTE[1] Damage // how much damage was done ?

Subcommand 0x24: UnKnown
BYTE[1] unknown. UOSE Introduced

Subcommand 0x25: SE Ability Change
BYTE[1] Ability ID
BYTE[1] 0/1 On/Off

Subcommand 0x26: Mount Speed
BYTE[1] 0=normal,1=fast,2=slow, >2=Hybrid movement?

Subcommand 0x2A: Change Race Request (only 2D, Server packet)
BYTE[1] Female (1=true, 0=false)
BYTE[1] Race (1=human, 2=elf, 255=error)

Subcommand 0x2A: Change Race Response (only 2D, Client packet)
BYTE[2] Skin color
BYTE[2] Hair style
BYTE[2] Hair color
BYTE[2] Beard style
BYTE[2] Beard color

Subcommand 0x2C: Use targeted item (client side packet)
Byte[4] Item Serial
Byte[4] Target Serial

Subcommand 0x2D: Cast targeted spell (client side packet)
Byte[2] Spell ID
Byte[4] Target Serial

Subcommand 0x2E: Use targeted skill (client side packet)
Byte[2] Skill ID (1 to 55, if Skill Id = 0 -> last skill)
Byte[4] Target Serial

Subcommand 0x2F: KR House Menu Gump
todo: there are a lot of subsub commands...

Notes
Subcommand 1: Server Sent. This sets up stack on the client and whenever it moves, it takes the top value from this stack and uses it. (key1 starts at the top, key6 at the bottom)

Subcommand 2: Server Sent. This key is added to the top of the stack. In other words, it's the one that will be used next. Basically, the other 5 only get used when the client is sending moves faster than the server is responding.

Subcommand 4: Server Sent.

Subcommand 5: Client Sent.

Subcommand 6: Sent by both. Contains subcommands for 0x6 for the party system. Be sure you check the packet listing good before attempting these.

Subcommand 8: Server Sent.

Subcommand a: Read above. Client Sent.

Subcommand b: Client Sent once at login of character.

Subcommand c: Client Sent when they close their status bar.

Subcommand e: Client Sent. Server responds with Play Animation packets.
List of animation IDs:
00 00 00 06 - Yawn
00 00 00 15 - Faint
00 00 00 20 - Bow
00 00 00 21 - Salute
00 00 00 64 - Applaud
00 00 00 66 - Argue
00 00 00 68 - Blow Kiss
00 00 00 69 - Formal Bow
00 00 00 6B - Cover Ears
00 00 00 6C - Curtsey
00 00 00 6D - Jig
00 00 00 6E - Folk Dance
00 00 00 6F - Dance
00 00 00 70 - Tribal Dance
00 00 00 71 - Fold Arms
00 00 00 72 - Impatient
00 00 00 73 - Lecture
00 00 00 74 - Nod
00 00 00 75 - Point
00 00 00 77 - Greet Salute
00 00 00 79 - Shake Head
00 00 00 7B - Victory
00 00 00 7C - Celebrate
00 00 00 7D - Wave
00 00 00 7E - Two Handed Wave
00 00 00 7F - Long Distance Wave
00 00 00 80 - What?

Subcommand f: Client Sent.

Subcommand 13: Client Sent.

Subcommand 14: Server Sent. TextID is broken into two decimal parts:
stringID / 1000: intloc fileID
stringID % 1000: text index

So, say you want the 123rd text entry of intloc06, the stringID would be 6123

Subcommand 15: Client Sent.

Subcommand 17: Server Sent. Shows codex of wisdom's text #msg. (msg is linearised (including sub indices) index number starting with 1).

Subcommand 18: Server Sent. Number of maps: currently 3 (0 = Fellucca, 1 = Trammel, and 2 = Ilshenar). This packet is sent by the server to the client, telling the client to use the mapdif* and stadif* files for patching map and statics.

Subcommand 19: Server Sent. Is sent after the 0x11 packet to enable the stat locks and show their states on 4.x+ clients.

Subcommand 1a: Client Sent. Stat Lock change packet. Sent when client changes the lock state for a stat on the status bar.

Subcommand 1b: Server Sent. Related to new spell packet 0xBF Subcommand 0x1C.

Subcommand 1c: Client Sent. Related to new spellbook packet 0xBF Subcommand 0x1b.

Subcommand 1d: Server Sent. Part of AoS Custom Housing. Sends a house Revision number for handling client multi cache. If revision is newer than what client has it asks for the new multi packets to cache it.

Subcommand 1e: Client Sent. Part of AoS Custom Housing. Sends a houses ID number back after recieving the 0x1D subcommand

Subcommand 21: Server Sent. This is sent to reset the color of the icons, and also sent when the server denies the ability attempt (not enough skill or mana).

Subcommand 22: Server Sent. Packet for displaying damage dealt above the mobs head.

Subcommand 24: Client Sent. Unknown.

Subcommand 0x25: Server Sent. Toggles SE Abilities.

Subcommand 0x26: Server Sent. Toggles Running at mount speed, even when not mounted.

Subcommand 0x2C: Client Sent. For use with the new Bandage Self client macro. Introduced in 5.0.4x

Subcommand 0x2D: Spell Ids
0x01 - 0x40 - Mage Spells
0x65 - 0x75 - Necromancer Spells
0xC9 - 0xD2 - Paladin Spells
0x91 - 0x96 - Samurai Spells
0xF5 - 0xFC - Ninja Spells
0x59 - 0x68 - Spellweaving Spells

---

Packet Name: Unicode TextEntry
Last Modified: 2009-03-01 07:58:48
Modified By: Turley

Packet: 0xC2
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] length
BYTE[4] player id
BYTE[4] message id
If (server_version of this packet)

• BYTE[10] all 0's .. have to be there, otherwise client crash

If (client_version)

• BYTE[4] unknown, always 1
• BYTE[3] language code, i.e. DEA, ENU etc.
• BYTE[?] unicode Text

Subcommand Build
N/A

Notes
Client version is the reply packet. Server starts with a server side 0xc2. server can pick any message id to identify it. The next text entry from client after 0xc2 server side is client reply with a 0xc2 sent back. First 11 bytes relayed from server packet, plus 0 0 0 1 plus 3 bytes language code + Unicode text. Server side packet always has length 0x15.

---

Packet Name: Client View Range
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0xC8
Sent By: Both
Size: 2 Bytes

Packet Build
BYTE[1] cmd
BYTE[1] range

Subcommand Build
N/A

Notes
Range: how far away client wants to see (=get send) items/npcs
Since client 3.0.8o it actually got activated.(in a useful way) When increase/decrease macro send, client sends a 0xc8. If and only if erver "relays" the packet (sending back the same data) range stuff gets activated client side.

"Greying" has no packet, purely client internal.

Minimal value:5, maximal: 18

---

Packet Name: Get Area Server Ping
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0xC9
Sent By: Both
Size: 6 Bytes

Packet Build
BYTE[1] cmd
BYTE[1] sequence // initially 1, wraps after 255 to 0
BYTE[4] tickcount

Subcommand Build
N/A

Notes
Client sends packet with it's tick count. Server replies with same packetID/sequence and it's own tick count. Over a few packets, the client can deduct a reasonably accurate ping number. Currently only used/ implemented in god client

---

Packet Name: Get User Server Ping
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0xCA
Sent By: Both
Size: 6 Bytes

Packet Build
BYTE[1] cmd
BYTE[1] sequence // initially 1, wraps after 255 to 0
BYTE[4] tickcount

Subcommand Build
N/A

Notes
See 0xC9

---

Packet Name: Configuration File
Last Modified: 2009-03-01 08:40:15
Modified By: Turley

Packet: 0xD0
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] length
BYTE[1] type - file type, not sure of precise values
BYTE[length-4] unknown encoded in some form

Subcommand Build
N/A

Notes
Sent if (flag & 0x02) in packet 0xA9
Probably used for saving client configuration files server side. OSI used it for the IGR shard only that is not anymore. Not sure what configuration files are, perhaps those in /desktop/player dir

Encoding/(compression?) completely unknown
Note: there's a client and server version of it.
If on, client sends them 5 times (5 files) at login.
After logout (0xd1) it expects server versions of 0xd0 and finally a server version of 0xd1

---

Packet Name: Logout Status
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0xD1
Sent By: Both
Size: 2 bytes

Packet Build
BYTE[1] cmd
BYTE[1] unknown // always 1

Subcommand Build
N/A

Notes
Client sends on logout if (flag & 0x02) in packet 0xA9,
when server responds with same packet, client finishes logging out

---

Packet Name: *New* Book Header
Last Modified: 2009-03-01 08:40:56
Modified By: Turley

Packet: 0xD4
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] length
BYTE[4] book ID
BYTE[1] flag1
BYTE[1] flag2
BYTE[2] number of pages
BYTE[2] length of author string (0 terminator included)
BYTE[?] author (ASCII, 0 terminated)
BYTE[2] length of title string (0 terminator included)
BYTE[?] title string

Subcommand Build
N/A

Notes
Packet sent from server when opening a book: opening book writeable: flag1+flag2 both 1 (opening readonly book: flag1+flag2 0, unverified though)

client side: flag1+flag2 both 0, number of pages 0.

Example::
Opening books goes like this:
open book ->
server sends 0xd4(title + author)
server sends 0x66 with all book data "beyond" title + author

if title + author changed: client side 0xd4 send

if other book pages changed: 0x66 client side send.

---

Packet Name: Generic AOS Commands
Last Modified: 2009-03-06 04:46:05
Modified By: MuadDib

Packet: 0xD7
Sent By: Both
Size: Variable

Packet Build
BYTE[1] Command
BYTE[2] Length
BYTE[4] Player Serial
BYTE[2] SubCommand to Follow

Subcommand Build
SubCommand 0x02: Backup
BYTE[1] 07

SubCommand 0x03: Restore
BYTE[1] 07

SubCommand 0x04: Commit
BYTE[1] 07

SubCommand 0x05: DeleteItem
BYTE[1] unknown (0)
BYTE[2] unknown (0)
BYTE[2] item graphic
BYTE[1] unknown (0)
BYTE[4] X Pos
BYTE[1] unknown (0)
BYTE[4] Y Pos
BYTE[1] unknown (0)
BYTE[4] z Pos (7)
BYTE[1] terminator (0x07)

SubCommand 0x06: AddItem
BYTE[1] unknown (0)
BYTE[2] unknown (0)
BYTE[2] itemGraphic
BYTE[1] unknown (0)
BYTE[4] XPos
BYTE[1] unknown (0)
BYTE[4] YPos
BYTE[1] terminator (0x07)

SubCommand 0x0C: Exit House Tool
BYTE[1] unknwon (0x07)

SubCommand 0x0D: Change Stairs
BYTE[1] unknown (0x00)
BYTE[2] X Position (Relative to center of house)
BYTE[1] unknown (0x00)
BYTE[2] Y Position (Relative to center of house)
BYTE[1] unknown (0x00)

SubCommand 0x0E: Synch Button
BYTE[1] Unknown (0x07)

SubCommand 0x10: Clear Button
BYTE[1] Unknown (0x07)

SubCommand 0x12: ChangeFloor
BYTE[4] unknown (0)
BYTE[1] Floor#
BYTE[1] terminator (0x07)

SubCommand 0x1A: Revert Button
BYTE[1] Unknown (0x07)

SubCommand 0x19: Combat Book Abilities
BYTE[4] 00 00 00 00 = Unknown. Always like this in all my testing
BYTE[1] The ability "number" used
BYTE[1] 0A

SubCommand 0x28: Guild Button
BYTE[1] Unknown (0x07)

SubCommand 0x32: Quest Button
BYTE[1] Unknown (0x07)

Notes
Submitted information. untested and unverified.

Subcommand 0x02: This is sent when the client pushed the Backup button in the customization screen. Unsure what it triggers on the server since house building is totally handled client side until submitted.

SubCommand 0x03: Sent when client pushes the Restore button in the customization menu. Will need testing to see exact purpose of 2 and 3 subs. Possible the server could request current "layout" that is not yet commited to save the design without commiting to be later restored with this command.

SubCommand 0x04: Sent when client pushes the Commit Button.

SubCommand 0x05: Sent when client chooses to destroy items.

SubCommand 0x06: Sent when client Chooses to add items.

SubCommand 0x0C: Sent when client pushes the Exit Button.

SubCommand 0x0D: Sent when client adds stairs to the multi in edit mode.

SubCommand 0x0E: Sent when client pushes the Synch Button.

SubCommand 0x10: Sent when client pushes the Clear Button.

SubCommand 0x12: Sent when client pushes the Change Floor Buttons.

SubCommand 0x1A: Sent when client pushes the Revert Button.

SubCommand 0x19: Sent when client pushes the icones from the combat book.
The server uses an 0xBF Subcommand 0x21 Packet to cancel the red color of
icons, and reset the status of them on client.
Valid Ability Numbers:
0x00 = Cancel Ability Attempt
0x01 = Armor Ignore
0x02 = Bleed Attack
0x03 = Concusion Blow
0x04 = Crushing Blow
0x05 = Disarm
0x06 = Dismount
0x07 = Double Strike
0x08 = Infecting
0x09 = Mortal Strike
0x0A = Moving Shot
0x0B = Paralyzing Blow
0x0C = Shadow Strike
0x0D = Whirlwind Attack
0x0E = Riding Swipe
0x0F = Frenzied Whirlwind
0x10 = Block
0x11 = Defense Mastery
0x12 = Nerve Strike
0x13 = Talon Strike
0x14 = Feint
0x15 = Dual Wield
0x16 = Double shot
0x17 = Armor Peirce
0x18 = Bladeweave
0x19 = Force Arrow
0x1A = Lightning Arrow
0x1B = Psychic Attack
0x1C = Serpent Arrow
0x1D = Force of Nature

SubCommand 0x28: Sent when client pushes the Guild Button on the paperdoll.

SubCommand 0x32: Sent when client pushes the Quest Button on the paperdoll.

---

Packet Name: Freeshard List
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0xF1
Sent By: Both
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] Length
BYTE[1] Sub command

Subcommand Build
Subcommand 0xFF:
From Client (UOG or CUO):

From Server:

Notes
N/A

---

Packet Name: Ping Message
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x73
Sent By: Both?
Size: 2 Bytes

Packet Build
BYTE[1] cmd
BYTE[1] seq

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Console Entry Prompt
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x9A
Sent By: Both?
Size: 16 Bytes

Packet Build
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] objectID
BYTE[4] prompt#
BYTE[4] 0=request/esc, 1=reply
BYTE[?] textstring (optional)
BYTE terminator (0x00)

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Create Character
Last Modified: 2009-02-26 15:30:12
Modified By: MuadDib

Packet: 0x00
Sent By: Client
Size: 104 bytes

Packet Build
BYTE[1] Command
BYTE[4] pattern1 (0xedededed)
BYTE[4] pattern2 (0xffffffff)
BYTE[1] pattern3 (0x00)
BYTE[30] char name
BYTE[30] char password
BYTE[1] sex (see notes)
BYTE[1] str
BYTE[1] dex
BYTE[1] int
BYTE[1] skill1
BYTE[1] skill1value
BYTE[1] skill2
BYTE[1] skill2value
BYTE[1] skill3
BYTE[1] skill3value
BYTE[2] skinColor
BYTE[2] hairStyle
BYTE[2] hairColor
BYTE[2] facial hair
BYTE[2] facial hair color
BYTE[2] location # from starting list
BYTE[2] unknown1 (Usually 0x00 in testing)
BYTE[2] slot
BYTE[4] clientIP
BYTE[2] shirt color
BYTE[2] pants color

Subcommand Build
N/A

Notes
Note: pattern3 is set to 0xFF to early signal a Krrios client user, where it expects a 0xF0 | 0x00 before login confirm

Sex: 0=Male Human, 1=Female Human, 2=Male Elf, 3=Female Elf
Str, dex and int should always sum to 65.
Str, dex and int should always be between 10 and 45, inclusive.
Skill1, skill2, and skill3 should never be the same value.
Skill1, skill2, and skill3 should always be between 0 and 45, inclusive.
Skill1value, skill2value, and skill3value should always sum to 100.
Skill1value, skill2value, and skill3value should always be between 0 and 50, inclusive.
SkinColor should always be between 0x3EA and 0x422, exclusive.
HairColor and facialHairColor should always be between 0x44E and 0x4AD, exclusive.
HairStyle should be between 0x203B and 0x204A, exclusive, and it should also exclude 0x203D to 0x2044, exclusive.
FacialHairStyle should be between 0x203E and 0x204D
Shirt color and Pants color need bounds checking too.

---

Packet Name: Disconnect Notification
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x01
Sent By: Client
Size: 5 bytes

Packet Build
BYTE[1] cmd
BYTE[4] 0xFFFFFFFF

Subcommand Build
N/A

Notes
Sent only when client selects "Log Off" ingame, and returns to the main menu.

---

Packet Name: Move Request
Last Modified: 2009-03-02 03:46:22
Modified By: Turley

Packet: 0x02
Sent By: Client
Size: 7 bytes

Packet Build
BYTE[1] cmd
BYTE[1] direction
BYTE[1] sequence number
BYTE[4] fastwalk prevention key

Subcommand Build
N/A

Notes
Sequence number starts at 0, after a reset. However, if 255 is reached, the next seq # is 1, not 0.

Fastwalk prevention notes: each 0x02 pops the top element from fastwalk key stack. (0xbf sub1 init. fastwalk stack, 0xbf sub2 pushes an element to stack)
If stack is empty key value is 0. (-> never set keys to 0 in 0xbf sub 1/2)
Because client sometimes sends bursts of 0x02's DON'T check for a certain top stack value.
The only safe way to detect fastwalk: push a key after EACH 0x21, 0x22, (=send 0xbf sub 2) check in 0x02 for stack emptyness.

If empty -> fastwalk alert.
Note that actual key values are irrelevant. (just don't use 0)
Of course without perfect 0x02/0x21/0x22 synch (serverside) it's useless to use fastwalk detection.
Last but not least: fastwalk detection adds 9 bytes per step and player !

Direction Notes:
0x00 - North
0x01 - Northeast
0x02 - East
0x03 - Southeast
0x04 - South
0x05 - Southwest
0x06 - West
0x07 - Northwest

Running affects the Direction number also. When running, it is Direction|0x80. Therefore direction becomes 0x80, 0x81, and so on.

---

Packet Name: Talk Request
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x03
Sent By: Client
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] length
BYTE[1] SpeechType
BYTE[2] Color
BYTE[2] SpeechFont
BYTE[?] msg - Null Terminated (blockSize - 8)

Subcommand Build
N/A

Notes
The various types of text is as follows:
0x00 - Normal
0x01 - Broadcast/System
0x02 - Emote
0x06 - System/Lower Corner
0x07 - Message/Corner With Name
0x08 - Whisper
0x09 - Yell
0x0A - Spell
0x0D - Guild Chat
0x0E - Alliance Chat
0x0F - Command Prompts
0xC0 - Encoded Commands

---

Packet Name: Request God Mode (God Client)
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x04
Sent By: Client
Size: 2 bytes

Packet Build
BYTE[1] cmd
BYTE[1] mode (0=off, 1=on)

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Request Attack
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x05
Sent By: Client
Size: 5 bytes

Packet Build
BYTE[1] cmd
BYTE[4] ID to be attacked

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Double Click
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x06
Sent By: Client
Size: 5 bytes

Packet Build
BYTE[1] cmd
BYTE[4] ID of double clicked object

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Pick Up Item
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x07
Sent By: Client
Size: 7 bytes

Packet Build
BYTE[1] CMD
BYTE[4] Item Serial
BYTE[2] # of items in stack

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Drop Item
Last Modified: 2009-03-02 03:49:49
Modified By: Turley

Packet: 0x08
Sent By: Client
Size: 15 bytes

Packet Build
BYTE[1] CMD
BYTE[4] Item Serial
BYTE[2] X Location
BYTE[2] Y Location
BYTE[1] Z Location
BYTE[1] Backpack grid index (see notes)
BYTE[4] Move Into Container Serial (FF FF FF FF drop to ground)

Subcommand Build
N/A

Notes
The backpack grid index exists since 6.0.1.7 2D and 2.45.5.6 KR.
Older clients are sending 14 bytes without this grid index byte!

Older Notes:
3D clients sometimes sends 2 of them (bursts) for ONE drop action. The last one having -1's in X/Y locs.

Be very careful how to handle this odd "bursts" server side, neither always process, nor always skipping is correct.

---

Packet Name: Single Click
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x09
Sent By: Client
Size: 5 bytes

Packet Build
BYTE[1] cmd
BYTE[4] ID of single clicked object

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Edit (God Client)
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x0A
Sent By: Client
Size: 11

Packet Build
BYTE[1] Cmd
BYTE[1] Subcommand
BYTE[2] The new object's x-axis position. If Command is HackMove Request, this will be a boolean value (still 16-bit) representing the requested mode.
BYTE[2] The new object's y-axis position.
BYTE[2] The new object's id. If Command is Add New NPC, this is the template number.
BYTE[1] The new object's z-axis position.
BYTE[2] Hue/Color.

Subcommand Build
Subcommand 4: Add New Dynamic Item.
Subcommand 6: Hackmove Request.
Subcommand 7: Add New NPC.
Subcommand A: Add New Static Item.

Notes
N/A

---

Packet Name: Request Skill etc use
Last Modified: 2009-03-02 04:21:47
Modified By: Turley

Packet: 0x12
Sent By: Client
Size: Variable

Packet Build
BYTE cmd
BYTE[2] blockSize
BYTE[1] type
Types Listed:

0x24 ($) - skill
• BYTE[blockSize-4] skill (null terminated strings)
• "1 0" - anatomy
• "2 0" - animal lore
• "3 0" - item identification
• "4 0" - arms lore
• "6 0" - begging
• "9 0" - peacemaking
• "12 0" - cartography
• "14 0" - detect hidden
• "15 0" - entice
• "16 0" - evaluate intelligence
• "19 0" - forensic evaluation
• "21 0" - hiding
• "22 0" - provocation
• "23 0" - inscription
• "30 0" - poisoning
• "32 0" - spirit speak
• "33 0" - stealing
• "35 0" - taming
• "36 0" - taste identification
• "38 0" - tracking
• 0x56 (V) - Macro'd Spell
• BYTE[blockSize-4] Spell (null terminated strings)
• "2" - Create Food
• "3" - Feeblemind
• "4" - Heal
• "5" - Magic Arrow
• "6" - Night Sight
• "7" - Reactive Armor
• "8" - Weaken
• "9" - Agility
• "10" - Cunning
• "11" - Cure
• "12" - Harm
• "13" - Magic Trap
• "14" - Magic Untrap
• "15" - Protection
• "16" - Strength
• "17" - Bless
• "18" - Fireball
• "19" - Magic Lock
• "20" - Poison
• "21" - Telekenisis
• "22" - Teleport
• "23" - Unlock
• "24" - Wall of Stone
• "25" - Arch Cure
• "26" - Arch Protection
• "27" - Curse
• "28" - Fire Field
• "29" - Greater Heal
• "30" - Lightning
• "31" - Mana Drain
• "32" - Recall
• "33" - Blade Spirit
• "34" - Dispel Field
• "35" - Incognito
• "36" - Reflection
• "37" - Mind Blast
• "38" - Paralyze
• "39" - Poison Field
• "40" - Summon Creature
• "41" - Dispel
• "42" - Energy Bolt
• "43" - Explosion
• "44" - Invisibility
• "45" - Mark
• "46" - Mass Curse
• "47" - Paralyze Field
• "48" - Reveal
• "49" - Chain Lightning
• "50" - Energy Field
• "51" - Flame Strike
• "52" - Gate
• "53" - Mana Vampire
• "54" - Mass Dispel
• "55" - Meteor Shower
• "56" - Polymorph
• "57" - Earthquake
• "58" - Energy Vortex
• "59" - Ressurection
• "60" - Summon Air Elemental
• "61" - Summon Daemon
• "62" - Summon Earth Elemental
• "63" - Summon Fire Elemental
• "64" - Summon Water Elemental
• 0x58 (X) - Open Door
• BYTE[1] null termination (0x00)
• 0xc7 - action
• BYTE[blockSize-4] Action (null terminated strings)
• "bow"
• "salute"

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Drop->Wear Item
Last Modified: 2009-03-02 05:08:35
Modified By: Turley

Packet: 0x13
Sent By: Client
Size: 10 bytes

Packet Build
BYTE cmd
BYTE[4] itemid
BYTE layer (layer of player)
BYTE[4] playerID

Subcommand Build
N/A

Notes
1.) The Layer should not be trusted.

---

Packet Name: Send Elevation (God Client)
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x14
Sent By: Client
Size: 6

Packet Build
BYTE[1] Cmd
BYTE[2] Map X Coord
BYTE[2] Map Y Coord
BYTE[1] Z Amount to alter the map tile's elevation by

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Request Script Names
Last Modified: 2008-10-11 09:57:22
Modified By: MuadDib

Packet: 0x16
Sent By: Client
Size: 1

Packet Build
BYTE[1] Cmd

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Get Player Status
Last Modified: 2009-02-17 20:13:39
Modified By: MuadDib

Packet: 0x34
Sent By: Client
Size: 10 bytes

Packet Build
BYTE[1] Command
BYTE[4] Unknown(0xedededed)
BYTE[1] Type
BYTE[4] Mobile Serial

Subcommand Build
N/A

Notes
Types:
0x00: God Client (packet unknown)
0x04: Basic Status (Packet 0x11)
0x05: Request Skills (Packet 0x3A)

---

Packet Name: Add Resource (God Client)
Last Modified: 2009-02-17 20:14:52
Modified By: MuadDib

Packet: 0x35
Sent By: Client
Size: 653

Packet Build
BYTE[1] Command
BYTE[1] 0 (Unknown)
BYTE[1] 1 (Unknown)
BYTE[2] Tile Type to attach new resource too. If 0x8000+ is for map tiles.
BYTE[127] Internal Resource Name.
BYTE[1] 00 Null Terminator.
BYTE[127] Food Resource Name.
BYTE[1] 00 Null Terminator.
BYTE[127] Shelter Resource Name.
BYTE[1] 00 Null Terminator.
BYTE[127] Desire Resource Name.
BYTE[1] 00 Null Terminator.
BYTE[127] Production Resource Name.
BYTE[1] 00 Null Terminator.
BYTE[4] If set to one, then make a consumer if excess in world.
BYTE[4] If set to one, then make a producer if excess in bank.

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Move Item (God Client)
Last Modified: 2009-02-17 20:17:31
Modified By: MuadDib

Packet: 0x37
Sent By: Client
Size: 8

Packet Build
BYTE[1] Command
BYTE[4] Serial to move
BYTE[1] Z To alter by ?
BYTE[1] Y to alter by ?
BYTE[1] X to alter by ?

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Pathfinding in Client
Last Modified: 2009-02-17 20:20:54
Modified By: MuadDib

Packet: 0x38
Sent By: Client
Size: 7 Bytes

Packet Build
BYTE[1] Command
BYTE[2] X
BYTE[2] Y
BYTE[2] Z

Subcommand Build
N/A

Notes
Only works for player played by client.
x,y,z have to be in range (check packet 0xc8 for range details) from players current location. Packet has to be sent 19 times or more in a row, otherwise it does not do anything, relatively speaking, on OSI servers.

If all this satisfied it does a path finding like action for the character.

location of destination is displayed above players head (cannot be disabled).

---

Packet Name: Buy Item(s)
Last Modified: 2009-03-02 04:23:47
Modified By: Turley

Packet: 0x3B
Sent By: Client
Size: Variable

Packet Build
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] vendorID
BYTE[1] flag

• 0x00 - no items following
• 0x02 - items following

For each item

• BYTE[1] (0x1A)
• BYTE[4] itemID (from 3C packet)
• BYTE[2] # bought

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Login Character
Last Modified: 2009-03-02 04:24:27
Modified By: Turley

Packet: 0x5D
Sent By: Client
Size: 73 Bytes

Packet Build
BYTE[1] cmd
BYTE[4] pattern1 (0xedededed)
BYTE[30] char name (0 terminated)
BYTE[33] unknown, mostly 0's
(Byte# 0x27, 0x28, 0x30 seem to be the only non 0's of these 33 bytes. Perhaps password data that's not send anymore)
BYTE slot choosen (0-based)
BYTE[4] clientIP

Subcommand Build
N/A

Notes
N/A

---

Packet Name: Change Text/Emote Colors
Last Modified: 2009-03-02 05:09:03
Modified By: Turley

Packet: 0x69
Sent By: Client
Size: 5 Bytes

Packet Build
BYTE[1] cmd
BYTE[2] blockSize
BYTE[2] unknown1

Subcommand Build
N/A

Notes
The client sends two of these independent of the color chosen. It sends two of them in quick succession as part of the "same" packet. The unknown1 is 0x00 0x01 in the first and 0x00 0x02 in the second.

This message has been removed. It is no longer used.

---

Packet Name: Request War Mode
Last Modified: 2009-03-02 05:05:48
Modified By: Turley

Packet: 0x72
Sent By: Client
Size: 5 Bytes

Packet Build
BYTE[1] cmd
BYTE[1] flag

• 0x00 - Normal
• 0x01 - Fighting

BYTE[3] unknown1 (always 00 32 00 in testing)

Subcommand Build
N/A

Notes
Server replies with 0x77 packet

---

Packet Name: Rename Character
Last Modified: 2009-03-02 05:09:22
Modified By: Turley

Packet: 0x75
Sent By: Client
Size: 35 Bytes

Packet Build
BYTE[1] cmd
BYTE[ /> iwrlUnknown)his R />

Last 8a3=a However, if 255 is>

"57" - Earthq>PackBoxr replies with 0x77 packe>
N/A

---

[^]

Packet Name: Lo1in Character
Last Modified: 2009-03-02 04:24:27
Modifie
Pacag BY4] Mr/> <7l>

0x
< BY4] Mr/> <7l>

0x
<1y 0's

< movl>PackerlUifense 7 BYTE[2] unknown1 (Usually 0x00 in testing)
BYTE[2] slot
BYTE[4] Build
BYTE[1] cmd
BYTE[ /> iwrlUnknown)his R /800)

Subcommand Build
ingame, and returns to the main men2-28

42:5>

[^8P'>[^]

Packet Name: Crea6>Ping Message
Last Modified: 2008-10-11 09:57:22
Modfied By: MuadDib AcBR />es of text Dib P BYTE[3ed By: Turley BYTE[4] If set to one, then make a consumer if excess in world.
BYTE[4] If set to one, then make a producer if excess in b8l>

Subcommand Build Server replies with 0x77 packet

---

[^]

Packet Name: Dr39e Character
Last Modified: 2009-03-02 05:09:22
Modified By: Turle /> p BYTE[3ed By: Turl45D
<
(Byte# 0x27, 0x28, 0x30 seem to be the only non 0's of these 33 bytes. Perhaps password data that's not send anymore)
BYTE slot choosen (0-based)
BYTE[4] clie8

Last 8a3=a However, if 255 is>

Serve

---

[^]

Packet Name: Lo146Character
Last Modified: 2009-02-26 15:30:12
Modifieddified By: Turley<
BR />

P>

Packet: 0x00
n a row,

>n a row,
BYTE[1] Button BYTE[4] profmmand
BYTE[4] d Build BYTE[4] g blor (0xFF=0, f 0xFF=1> Size: 104 bytes< roe (he: p=0, elf=1)
BYTE[4] s

BYTE[4] > "
BYTE[4] - peacemakingd By: Turley< ill1[1] skill3value Button
skill3value Button
skill3value1y< ill0] char name
Bill0] cBYTE[1] str
BTE[1] sex (see notesTE[1] BYTE[1] str
BTE[1] dex
BYTETE[1] BYTE[1] str
BTE[1]41] str
BTE[1]41int
BYTE[1] 5]b>Button
skill3value1y< (0x00)
Bag1
BYTE[1kill2 s
BYTE[1] skBYTE[1] skill3value1y< (0x00)
C> skill3value Button
skill3value1y< (0x00)
Dag1
BYTE[1ki BYTE[2] g1
BYTE[1ki BYTE[BR /e toBR /?skill3value1y< (0x00)
Fag1
BYTE[1kifroe 2] g1
BYTE[1kifroe ID?skill3value1y< (0x00)
BYTE[1kibes ths
BYTE[1] skbes thng list
BYTE[2] unknown1 (Usually 0x00 in testing)
BYTE[2] slot
BYTE[4] KRack grid irmincurre
hes a row, BYFR /s = and1 /e 0x3F?ed.
ydeperach 0ailding lk aleepe 00 Nuoff/> Bs: eacr/> <
ldin>
BYTE[1] Unkwn (0x07!!st
BYTE[> Packet Build
BYTE[1] cmd
BYTE[1] ld be between 0x203E and 0x204D
Shirt colorG

Fight

---

Packet Name: Disconnect 6me Character
Last Modified: 2009-03-02 05:09:22
Modified By: Turley
SubC[1] sR />

p BYTE[3ed By:0 seem to be the only non 0's of these 33 bytes. Perhaps password data that's not send anymore)
BYTE slot choosen (0-based)
BYTE[4] clie9.

location of destination is displayee has beHelpr replies with 0x77 packet

10:0/>

---

[^]

Packet Name: Last Modified: 2009-03-02 05:09:03
Modified By: Turle57]br/> BYTE[2] blockSize
BYTE[4] objectID
BYTE[4] prompt#
BYTE[4] 0=request/esc, 1=reply
BYTE[?] textstring (optional)
BYTE terminator (09Fuild
N/A

Notes>inR /> replies with 0x77 packet

---

[^]

Packet Name: Buy Item(s)
Last Modified: 2009-03-02 04:23:47
Modified By: Turley

wn (0)therwiseE[1] cmd
,0ais "3c4] Iteing:BYTE[2] blockSize
BE[1] flag00 - no items follquant

0x02 - items following

For each item

• BYTE[1] (0x1A)
• BYTE[4] itemID (from 3C packet)
• BYTE[2] # bought
  
  

  Subcommand BuildSB> Fighr replies with 0x77 packet
  

  10:R/>

  ---

  
  
  [^]
  Packet Name: Creain Character
  Last Modified: 2009-03-02 04:24:27
  Modified By: Turle2]ents som#E[2] unTE[2] blockSize
  BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=reply
  BYTE[?] textstring (optional)
  BYTE terminator (0ACmd
  
  
  

  Subcommand Buildbr/> BYSp/> replies with 0x77 packe>
  N/A

  
  

  ---

  
  
  [^]
  Packet Name: Get Pb>Buy Item(s)
  Last Modified: 2009-03-02 04:23:47
  Modified By: Turle148ility "numbA"dinato, free HD s 0x02et: (bursors,> BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=reply
  BYTE[?] textstring (optional)
  BYTE terminator (0Ank.
  
  
  

  Subcommand Builde has beTip/colooe W/P>ow> replies with 0x77 packet
  

  ---

  
  
  [^]AC='#TOP'>[^]
  Packet Name: Buy Item(s)
  Last Modified: 2009-03-02 04:23:47
  Modified By: Turley
  
  
  ib
  P07)
  
  iP> <
  (Byte: 5 By"nu?skill3value?]
  
  items following

For each item

• BYTE[1] (0x1A)
• BYTE[4] itemID (from 3C packet)
• BYTE[2] # bought Last 8a3=a However, if 255 is>
  
  [^]ATOP'>[^]
  Packet Name: LoTalk Request
  Last Modified: 2008-10-11 09:57:22
  Modified By: MuadDib
  
  
  

  cket: 0x03
  Sen: 0x03
  

  P)>

  
  <"enureballiE[1]rialesN/Aglish>0x72
  0x72
  0x72
  0x72
  BYld
  BYTEif (cket:&

  al BY,5]t book. do ai>PacBRiTrigssioTE[3ss( 0x0,n Cha #13 <0. 0x0,nLow Nib> <,n Cha #15 1. cket=E[1] gessiockeiand , %t=< moulo opee= 1. exampkus: UNKNOWNS(1)=0, UNKNOWNS(2)=2, UNKNOWNS(3)=3, UNKNOWNS(4)=5, UNKNOWNS(5)=6, UNKNOWNS(6)=8, UNKNOWNS(7)=9, UNKNOWNS(8)=11, UNKNOWNS(9)=12 00 - no items fUNKNOWNS]tIdea behimincurre /> etd
  Bimand0 - nThchFohn. Th] Ites0] chaor range dk aler1] cmsi,

  Bima es t With >

  By"nu] 00 Nul items f?] Ascii M

  
  

  Pcket Build
  

  Packet Build0x72

For each item

• BYTE[1] (0x1A)
<[1] A
<

a. Uox 0's .=

a.therwise it (> Fastwemov&

a] Prodeperac

keyTE[3ss( skinCacech.mul) [1] Cmd.: 0x03 book. do keyTE[3ss[1] Cmd.:eyntkeyTE[3ssh a knand fd r

b 1/2) /rr, cmd 2 bitss - Easmpty keyntkeyTE[3ssh a padding lk
l] uey vCha. [1] cxampku preveperac

2tkeyTE[3s- Sou
Single . 12bitssr more i > 0x0,n> 2 bitssf1] cmd BYTE[?] msg - Null Terminated (blockSize - 8)





Subcommand Build
N/A




Notes
The various types of text is as follows:
0x00 - Normal
0x01 - Broadcast/System
0x02 -/Emote
0x06 - System/Lower Corner
0x07 - MessaBYTE[4] itemID (from 3C packet)

• BYTE[2] # bought Shirt colorGump Menu SB> menu.
  2:1/>
  
  [^]B/a>
  Packet Name: Disconnect Talk Request
  Last Modified: 2008-10-11 09:57:22
  Modified By: MuadDib
  
  
  y
  (Byte# 0gumpIdr(dent osIdrom fas0
  (Byte# 0buttonIdr(wl] u
  (Byte# 0switchBR />e (r"57" - Eld BSB>Subcdiobbuttonsn> boxes,n> y0switch < perac

  switch d

  PaeE[1] cmd BE[1SwitchIdClient
  Size4>

  BR />e (r"57" - Eld BSB>Su

  BYTaeE[1] cmd B2>

  IdClient B2>

  R /> BR /> <*

For each item

• BYTE[1] (0x1A)
• BYTE[4] itemID (from 3C packet)
• BYTE[2] # bought
  N/A
  
  

  Notesummon Sys W/P>ow> replies with 0x77 packet
  

  10:50>
  
  [^]B>
  Packet Name: Add Resource ( Character
  Last Modified: 2009-02-26 15:30:12
  Modifiied By: MuadDi635Dl/> E(( BYTE[2] Y Location
  BYTE[1] Z Location
  BYTE[1] Backpack grid index (see notes)
  BR /BR /,n>
• BYTE[2] # bought
  
  

  Subcommand BuildBR />Help/Tip ingame, and returns to the main menu.
  2:5>

  ---

  
  
  [^]D/a>
  Packet Name: Change Textb>Buy Item(s)
  Last Modified: 2009-03-02 04:23:47
  Modified By: Turle1] (0x00)
  ese indmy BYTEsd By: TurleyUOd By: Turley ufacli>"nt By: ClienyFami />
  ClienyMmovl>>
  ClienyC dd By: Turle1] CPU>Quant

• Clieny
  Clieny
  y
  y
  d d By: Turle "diDete intell/P>
  y"diVPacke "diDevioe IDb07)
  "diMemori>
  Clien1dd By: Turle1] PartR />Inssiall>dd By: Turle1] ity "nuVariable BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=r/>
  
  N3 wasr/> B de140)
  R /> <,Packreasrnees:

  <> . Packet BuiYTE[?] textstring (optional)
  BYTE terminator (0E00)
  

  
  

  Subcommand BuildBuckinRli> aKR not be trusted.
  

  menu.
  
  
  

  ---

  
  
  [^]
  Packet Name: Creav>Buy Item(s)
  Last Modified: 2009-03-02 04:23:47
  Modified By: Turle2]
  BR />
  (Byte: 5 Bi Wit languIt d By: Turle1] (0x00)
  BYTE[2] Turle2] Buckceprgoriuild
  BYTEbr/[*] BuckDete intell indUni WitTE[2] blockSize
  BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=rBuckceprgoriknown(0xededr/> W00 NmEbviron Subcommand N/Ay It- Messagenot lCombastwalk detectiUItwalk det5> asdds 9 byte> N/Atu> Se0xtell- Messagenas fPerflocknoe
  0x00 - NPC- MessagenA> "- MessagenBs fPe - Message0C" - ous seTE[2] t/SysteLewt IP> SubcomEi> istem/Lower CorOeper Packet BuiYTE[?] textstring (optional)
  BYTE terminator (0Eld be between 0x203E and 0x204D
  Shirt color /> Serve R />>UpdepreaKR not be trusted.
  
  menu.
  4R/>

  ---

  
  
  Packet Name: Disconnect 9b>Drop Item
  Last Modified: 2009-03-02 03:49:49
  Modified By: Turle2]
  BR />
  (Byte2] (0x00)
  B01
  (Byte# 0KRack grid BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=rProba/>ydKRabr/> BYFR /s />
  x2)res: Bf/e 0x8D
  Packet BuiYTE[?] textstring (optional)
  BYTE terminator (0ECd be between 0x203E and 0x204D
  Shirt colorEquip
  menu.
  5:1/>
  
  [^]EC='#TOP'>[^]
  Packet Name: Buy Item(s)
  Last Modified: 2009-03-02 04:23:47
  Modified By: Turle2] LR />
  (Byte2] > N/ACR />therwiR /> Sent By: ze
  BE[1R />

For each item

• BYTE[1] (0x1A)
• BYTE[4] itemID (from 3C packet)
• BYTE[2] # bought Last 8a3=a However, if 255 is>
  menu.
  5:/>

  ---

  
  
  [^]
  Packet Name: LoTalk Request
  Last Modified: 2008-10-11 09:57:22
  Modiffied By: Turle2] LR />
  (Byte1]id
  therwid
  Sent By: ze
  B1]id
  
For each item

• BYTE[1] (0x1A)
• BYTE[4] itemID (from 3C packet)
• BYTE[2] # bought
  N/A
  
  

  Notes BY
  ddot be trusted.
  

  8-12-> 7A

  ---

  
  
  Last ModifieD4" href='#TEF='#TOP'>[^]
  Packet Name: Last Modified: 2008-10-11 09:57:22
  Modified By: MuadDibli
  l ipd By: MuadDib< the i mmjensex sell/P>
  y
  y
  yPaex sell/P>
For each item

• BYTE[1] (0x1A)

l ipl this sNew

2.48.0.3+eaKR n>

Subthis s /rre
t one having -1's in X/Y locs.

Be very careful how to han.

location of destination is displayeDamIt dot be trusted.


8-1N/A



---



[^]
Fighr replime: [^]> Last Modified: 2008-10-11 09:57:22
Modiffied B ly spe.
For each item

• BYTE[1] (0x1A)
. wasrintesourcd indewperac <

Be very careful how to ha1ld be between 0x203E and 0x204D
Shirt colorrial
men2-28
27:0/>

[1/a>
Packet Na> Fighr replime: Last Modified: 2008-10-11 09:57:22
Modiffied By: MuadDib

(Bytey N/A


< /> P> N/A

xRHitd BYTE[4]rial

BYTE[4]s Bui0=0xFF, 1=f 0xFFYTE[2] Turle2] e d By: Turle (Byte2] >- peacemaki text Dib "ad By: Turle>

xRS

• "ad By: Turle>
  

  xR d By: Turley > BYTETE[4] d By: Turle>

• Rath B2> P>xRWe
  
  BYTEIf ( B2> rialcap/0 - no items fY] F - NuSI s(Pe -x00 - no items fY] F - NuSI sP>xRd.
  es(Pe -x00 - no /> BYTEIf ( B2> Fbr/> BYisl/0 - no items f Sd> BYisl/0 - no items f BYisl/0 - no items f <0 - no items f (Pala>Su Book-x00 - no /> BYTEIf ( B2> Hitd
  d Inc ReIt "a Ret Physi> l DamIt d0 - no items f >incoex b<0 - no items f />
  
  Cosl/0 - no items f Inc Inc - peacemaki>Inc "a Inc "a Inc
  For each item
  
  • BYTE[1] (0x1A)
  <[1] a row, s clien to ndepenon OSI,/b/P> > xRHit 0"R />>rxRHit 0"R />h 0aifix>d s: ea,n> > BYTEt 19 t Of c />> BYT jli>"55"s YTE[2] bldededenolayer ] chaket Buildb>end2et: Notes
  

  SubUOMLrintesourcd. 5.0?ds 9 byte>:dKRaju[1] 00 Null Termi's in X/Y locs.
  
  Be very careful how to ha1nk.
  

  
  

  Subcommand Build <> bar]sial

  men2-28:26R/>
  Packet N> Fighr replime: 2 bDrop Item
  Last Modified: 2009-03-02 03:49:49
  Modifed By: MuadDib BR />
  (Byte4 < ment B01 By: MuadDib bar]2] g(1=grtwo, 2=yet Bu, >2=re3?)
  BYTE[4]FR / bar]2] , 1=En ReqBh <> bar]2] > BYTE[2] Y Location
  BYTE[1] Z Location
  BYTE[1] Backpack grid index (see notes)
  id irminco bcli 2Dn> bar), nown(0xed: of thes<, 1:s< BRvel/P> ) oex rides yet Bu
  bcli

  <> yet Bu] ppea s c
  
  Be very careful how to ha1Aand Build
  N/A

  
  

  Notesubjli>

  men3-> 17:26R30>
  
  Last ModifieD4" href='#T1Aa>
  Packet Na> Fighr replime: Last Modified: 2008-10-11 09:57:22
  Modified By: MuadDibPa/P> >>>>)BYTE[2] blockSo items f e( playovl>Paf/e corpse-x00 - o /> BYTEIf (ayovl>&
  )th Ele2] blockSo it ems Inc /CR />or (inc me i myovl>by) /rr #
  
  Size BYTE[1yLoce/P> )th Ele2] blockSo it ems di
  • "55" - Me
    Siz zLoce/P> )th Ele2] blockSo it ems TE[1dye" - Me
    >>)BYTE[2] blockSo it ems
    BY] Y Location
    BYTE[1] Z Location
    BYTE[1] Backpack grid index (see notes) BYckSo itnated (blne - Me
    ed - Me
    bar]ge - yet Bu/0 - o /> BYckSo itna1ed (Ftimes Ships//Bun
    < - Me
    BY] Y Loc's in X/Y locs.
    
    Be very careful how to ha1.
    
    location of destination is displaye /> /BR> len> replies with 0x77 packe>
    N/A
    
    

    ---

    
    
    [^]
    Fighr replime: Last Modified: 2009-02-17 20:20:54
    Modiied By: MuadDit By: CliBtoBR / By: MuadDit B (0x00).0a>
    0 By: MuadDibP07)
    BYTE[1yLoce/P> 0 By: MuadDi1] zLoce/P> d By: Turle4 d By: Turle1 d By: Turle2]ents somb
    
    2 d By: Turle4 d By: Y] Y Location
    BYTE[1] Z Location
    BYTE[1] Backpack grid index (see notes) onfir0xtell".:eyrre
    m 0x2/> Only bynependeralk cdur sentoR /> />or h ppe:th fuSly] 00 Null Termi's in X/Y locs.
    
    Be very careful how to ha1Cd be between 0x203E and 0x204D
    Shirt colorBR />Sacech> replies with 0x77 packe>
    N/A
    
    

    ---

    
    
    [^]
    Fighr replime: Last Modified: 2008-10-11 09:57:22
    Modified By: MuadDib BR d By: Turley
    ag1
    BYTE[1myovl>(R fl>Pa- FF FF = s
    ag1
    BYT

    cket:et:N/A<1
    BYTE[1N/ASen: 0x03
    N
    BYTE?]
    

    PaM BR /> a- 44> BYTE[2] Y Location
    BYTE[1] Z Location
    BYTE[1] Backpack grid index (see notes)
    POL/ al>
    lick hesPacen:NPC-.:eyrreissa m chduyer optime: d methodYTE[1] Tyse: ) to ndOSI's methodYbr/ a sen0xCt: 0x69< 0x69E[2] SpeechFont
    BYTE[?] msg - Null Terminated (blockSize - 8)
    

    
    

    Subcommand Build
    N/A

    
    

    Notes
    The various types of text is as follows:
    0x00 - Normal
    0x01 - Broadcast/System
    0x02 -/Emote
    0x06 - System/Lower Corner
    0x07 - MessaBYTE[4] itemID (from 3C packet)

  • BYTE[2] # bought Last 8a3=a However, if 255 is> not be trusted.
    
    menu.
    11:3/>

    ---

    
    
    [^]
    > Fighr replime: Last Modified: 2009-03-02 03:49:49
    ified By: Turley <
    BYTE slot choosen (0-based)
    BYTE[4] clie200)
    
    
    

    Subcommand BuildDraw G N/A> replies with 0x77 packe>
    N/A

    
    

    ---

    
    
    [^]
    Pa> Fighr replime: 9b>Drop Item
    Last Modified: 2009-03-02 03:49:49
    ified By: Turley"BR />
    P07)
    
    Bytes
    
    BYTE[1yLoc/P>
    2"55 By: MuadDi1] zLoced By:0 seem to be the only non 0's of these 33 bytes. Perhaps password data that's not sO
    in 9 br/> BYTE
    li PackldmalesNmR />eB> Pepend edeSousia/> Bepend
  • BYTE[2] # bought Shirt color />
    menu.
    11:5>
    

    ---

    
    
    Packet Na> Fighr replime: Drop Item
    Last Modified: 2009-03-02 03:49:49
    ified By: Turle[4]s qumaki>#07)
    BYTE[1yLoc/P>
    1] di
  • "55 By: MuadDi1] zLoced By:0 seem to be the only non 0's of these 33 bytes. Perhaps password data that's not send anymore)
    BYTE slot choosen (0-based)
    BYTE[4] clie2l>
  
  

  Subcommand Build < replies with 0x77 packe>
  N/A

  
  

  ---

  
  
  [^]
  > Fighr replime: Last Modified: 2009-02-26 15:30:12
  ModifiCed By: MuadDibPVariable
  Packet: 0x69Turle2] it4] McR />therwiTurleywn b] ShelxLoc1
  BYTE[1b] ShelyLoc/P>
  1] b] ShelzLoc/P>
  4Senarg/> id By: MuadDib xLoc1
  BYTE[1narg/> yLoc/P>
  1] narg/> zLoced By:0 seem to be the only non 0's of these 33 bytes. Perhaps password data that's not seyrrex,y,z havacli lbr/ thesepenr/> ,0SouH 0x2ively s/>> >> >0xtell] 00 Null Termi's in X/Y locs.
  
  Be very careful how to ha2Cmd
  
  
  

  Subcommand BuildDraw Ch] Iteghr replies with 0x77 packet
  

  12:2>
  
  [^]
  Pac> Fighr replime: Last Modified: 2009-03-02 03:49:49
  ified By: Turley BR s By: MuadDib B3c

  YTETE[4] YTE[2] blockSize
  BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=reply
  BYTE[?] textstring (optional)
  BYTE terminator (02mand Build
  N/A

  
  

  NotesAdd R /> To Ch] Iteghr replies with 0x77 packe
  

  ---

  
  
  Packet Name> Fighr replime: Last Modified: 2008-10-11 09:57:22
  Modified By: MuadDib Bs
  Bag<(objont YTE[2] Turle1] (0x00) BamR />therwiTurle BYTE[1yLocel1[1]] Iteghr
  BYT1] TETE[4] gri
  
  BYTEurley BYTE[2] unknown1 (Usually 0x00 in testing)
  BYTE[2] slot
  BYTE[4] E[2]TETE[4] gri
  l (F1.7 2Dn>
  
  
  BYTE[> Packet Build
  BYTE[1] cmd
  BYTE[1]2 by
  
  
  

  Subcommand BuildKick P> N/A> replies with 0x77 packe>
  N/A

  
  

  ---

  
  
  Packet> Fighr replime: Last Modified: 2009-03-02 03:49:49
  Modiied By: MuadDit BIDbr/>GMsu/> kick?TE[2] blockSize
  BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=reply
  BYTE[?] textstring (optional)
  BYTE terminator (02nk.
  
  
  

  Subcommand Builde jli><
  ingame, and returns to the main men2-17 20:00:20>
  

  Packet N> Fighr replime: Last Modified: 2009-03-02 03:49:49
  Modifedr
  BYT1] Reali> r/> BYTE[2] blockSize
  BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=rKx00) in Cl Terminat: Can havliftsepenr/> Termina1: OuB> Termina2: OuB> Pa0x4: Already ho>
  Packet BuiYTE[?] textstring (optional)
  BYTE terminator (028md
  
  
  

  Subcommand BuildDrop R /> Fant Squ

  (Godabr/> B? not be trusted.
  

  men2-17 20:05:2>

  ---

  
  
  Packet> Fighr replime: Last Modified: 2009-03-02 03:49:49
  of IP> Sub2] Y Location
  BYTE[1] Z Location
  BYTE[1] Backpack grid index (see notes)
  >o> E[1] Ty - Evaccor
  guiman BeccwsiYnepen
  ld BSB>Su/hotory/b>Sent
  BYT1] ied By: MuadDib BYTE[1yLoc Packet BuiYTE[?] textstring (optional)
  BYTE terminator (02dle this odd "bursts" server side, neither alwayPaperdoll>C replies with 0x77 packe>
  N/A
  
  

  ---

  
  
  Packet Na> Fighr replime: Last Modified: 2009-03-02 03:49:49
  Modifedr
  BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=reply
  BYTE[?] textstring (optional)
  BYTE terminator (02Aand Build
  N/A
  
  

  NotesBlooddot be trusted.
  

  men2-17 20:07:5BR/>
  Packet Na> Fighr replime: Last Modified: 2009-03-02 03:49:49
  BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=reply
  BYTE[?] textstring (optional)
  BYTE terminator (02.
  
  location of destination is displayeGodaMmov>(Godabr/> B not be trusted.
  
  
  

  ---

  
  
  [^]
  Fighr replime: Last Modified: 2009-03-02 03:49:49
  Modifedr
  Modi0/1 [1] DveIf a/En ReqBGodaMmov>in/>li BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=rSrmincurre
  b 1/2)receivin 9a ingame,BGodaMmov>
  t one having -1's in X/Y locs.
  
  Be very careful how to ha2
  Last 8a3=a However, if 255 is>
  
  

  ---

  
  
  [^]
  > Fighr replime: Last Modified: 2009-03-02 03:49:49
  Modified By: MuadDib BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=reply
  BYTE[?] textstring (optional)
  BYTE terminator (02E
  Last 8a3=a However, if 255 is> < replies with 0x77 packet
  
  12:4BR/>
  [^]2EOP'>[^]
  > Fighr replime: Last Modified: 2009-03-02 03:49:49
  ifie
  starts indmy ] chag1
  BYTE[1myovl>(R fl>hex # <
  Modir/> BY <
  Modi> N/A>By: MuadDit By: Cliag< By: MuadDib BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=reply
  BYTE[?] textstring (optional)
  BYTE terminator (02Fuild
  N/A
  
  

  NotesOccur se< replies with 0x77 packet
  
  

  [^2F='#TOP'>[^]
  Fighr replime: Last Modified: 2009-03-02 03:49:49
  Modified By: MuadDib0> d By: Turle4att4] e skill3value att4] edr
  BYTE[4] objectID
  BYTE[4] prompt#
  BYTE[4] 0=request/esc, 1=reply
  BYTE[?] textstring (optional)
  BYTE terminator (0300)
  
  
  

  Subcommand BuildAtt4] Ok> replies with 0x77 packet
  1>
  

  ---

  
  

  ='doc-anchor'>[^3P'>[^]