[WPE PRO] Change a portal's destination

[Killarena]

Hey here, I call here your support to help me to fix a "problem" I get with WPE .

First, I modified some of the packet you send / receive when you cross a portal (Simply changing the Hexa Value of the "Map ID" to another one). For example, when I use the Prison instance portal (Map Hex Value 0022) : I'm instantly teleported in the Hall of Champions (Map Hex Value 01C1)


Everything until now is okay, I'm in the hall of champions, I can move and everything is fine...

But there is a problem (otherwise, I wouldn't be here ), there is absolutly NOT ANY NPC.

Relogging while WPE is still active teleport doesn't change anything and if I relog with WPE off, I'm teleported where I should be in normal time : In the prison.

So, I don't know if someone know how to fix that, how to "send" or receive the correct packets to display Npcs (or at least their inventory ;P)... any help is welcome !

[LegacyAX]

Sounds like your only there client sided.... Could ya tell us how you are decrypting the packets? Sounds very cool btw

[Killarena]

Yeah this is what I think too, only the client recognize the map change and the server still believe I'm in the original portal.

Moreover, I get the "Welcome message" when I go inside like "Welcome in the instance xxx, this instance will be reset the xx:xx ..." so I don't know if what I'm looking for exist / is possible (Even if I saw on another topic some things about loading instance etc...)

And for the packet, I simply use the Map ID hex value + look for it inside the packets list and use some filters.

[MasterGold]

Hall Of Champions has been "removed", you can enter it without an instance, maybe that's the problem that you don't see any NPC?

[Killarena]

Hi,

This is not for official retail but for a private one and in this one, you need an item to go inside the Hall, I checked the MapId + coord x.y.z of the Hall on that server, this is the same than on official when the Hall was still here.

And, I also tried with others instance like teleporting myself to Durotar, Uldaman ... using the prison portal and this is the same problem : "Welcome to the prison etc..."

(Thanks for your help )

[LegacyAX]

Hi,

This is not for official retail but for a private one and in this one, you need an item to go inside the Hall, I checked the MapId + coord x.y.z of the Hall on that server, this is the same than on official when the Hall was still here.

And, I also tried with others instance like teleporting myself to Durotar, Uldaman ... using the prison portal and this is the same problem : "Welcome to the prison etc..."

(Thanks for your help )

\
lol no wonder.. because the new 3.1 blizz servers use RC4 encryption on their packets so i was wonderin how you were decrypting them with WPE. Now i understand, Just open up olly and bypass the check for Worldport lua function, then you dont need any packets, you can port yourself anywhere

I did this on wow beez 3.0.9 server

[BoogieManTM]

\
lol no wonder.. because the new 3.1 blizz servers use RC4 encryption on their packets so i was wonderin how you were decrypting them with WPE. Now i understand, Just open up olly and bypass the check for Worldport lua function, then you dont need any packets, you can port yourself anywhere

I did this on wow beez 3.0.9 server

they only use rc4 on the packet headers, so it's still pretty easy to identify and alter the packet body (for very specific packets, anyways), without touching the header.

[Killarena]

Hey and thanks for all of your answers, I already downloaded OllyDbg + looked everywhere I could (wow offsets and pointers for example) to find "How to see the correct value to modify" but I just get something like this :



... I'm a bit lost ;(

I would know what I should modify to bypass the WorldPort fonction like you said and how could I teleport inside the 449 map Id

Thanks again for you help !

[BoogieManTM]

I don't know why you're PM'ing me about this. You need to match the body of the packet's body with a specified structure, and replace it with your desired values..

The packet is as follows:

Length - ushort - Constant: 0x1C
Opcode - uint - Constant: 0x8
Timestamp - uint - Variable - Should be the system ticks count
MapID - uint - whatever the mapid is
Position - Vector3(float, float, float) - whatever the destination x/y/z is
Heading - float - whatever the destination heading is.


Check all client->server packets for the matching mapid, position vector and heading, and change it with whatever you want? I have no idea if this works, but that would be my guess as to what the LUA worldport is doing

As for how do to this in WPE, i don't have a clue. And as I said, the opcode/length (header) is encrypted, so you can't match that - but the size of the packet is static, the direction is static, and you can match the last 16 bytes or so of the packet with ease.

P.S, I do believe you're wasting your time with this.