Teleporting help

[lanman92]

Okay, so I'm sending the right packets to the server to get to my destination. I'm only going short distances right now. I'm sending a move_forward packet, a heartbeat packet, and a stop packet. I'm getting to my destination and the server seems to accept my packets, but when I move I get DC'd. I log back in and I'm not teleported. I know I'm sending my packets(using a hook on CNet_send...). I'd really appreciate it if someone could provide help on what I've got to change. I think the issue is modifying the tickcount. No clue on how I could make it correct though...

EDIT: On a unrelated side-note... C# injection ****ING ROCKS! Mmmmmmm.... Pointers......

[kynox]

The server is extremely sensitive to changes. The timestamps in each movement packet have to be perfect.

[lanman92]

Is this why process speeding was so accurate? The same between each time. So, any tips? Does warden scan the IAT or the GetTiming function at 0x46E4C0?

Also, why doesn't the server kick me immediately if it doesn't like my timestamps?

[namreeb]

Are you only sending the packets, or are you also updating your location locally? I don't believe any acknowledgment of the heartbeat or move start/end packets include a server telling you where it thinks you are, so unless you also update the client's idea of where you are, the next time the game sends a legitimate movement packet it will use your old location (which the server will boot you for)

.. at least, I think.

[lanman92]

I'm updating After the server thinks I'm at the distant location though. Make it go faster due to easier rendering + less object loading.

[namreeb]

Wait, are you only sending ONE heartbeat packet?

[lanman92]

Yes, but the distance is only 10 yards. So, I guess I could find the actual number of heartbeats needed, but I was kind of just eyeballing it.

[namreeb]

What I did when I was trying this is I walked at normal speed for 60 seconds or so to figure out how much time elapsed between heartbeat packets, and how much distance I traveled. I then figured out how far I needed to go, and what my new frequency for heartbeat packets had to be to achieve this. For example if I wanted to move twice as fast I would send heartbeat packets twice as often, traveling the same distance between packets. Note that by frequency I am referring to the time elapsed in the tick count param of the packet, NOT the actual live-time frequency of their transmission.

[lanman92]

It's 500ms between each packet tick count. I know that for sure, it was constant for the whole test I just did. The problem with this that I see, is when you turn the speedhack off, you will D/C. The tick count will be off by a LOT by then. Maybe hooking the timing function so that the change becomes added to the 'tickcount' before the client can send it. I'll share an idea I had now...

I thought maybe to hold back each movement packet/packet containing a timestamp and keep them in a queue while I move a certain distance. When I get to my destination, flush all the packets through with an increased Z. The idea is to prevent aggroing anything. Think this will work? If not, I won't try it.

[namreeb]

I'm pretty sure that is what WoWX does, which is what someone (I think it was kynox) said in another thread will get you banned after some unpredictable delay.

[lanman92]

I know speeding has something to do with the 0x2CE opcodes though. At least the way WI does it. They just increase the rate of heartbeat packets going out of the client. Same 500ms delay, but faked, so they're coming out every 250ms, or 125ms... etc.

From what I see in IDA, the opcode above just sends the op and the local guid, or some unknown guid. I have it named MovementGUID, no clue what it's there for.

[namreeb]

That is CMSG_MOVE_TIME_SKIPPED, it basically allows for synchronizing the client's time with the server (or perhaps the other way around? not sure.)

[lanman92]

Any help why my packets aren't being accepted? Just a hint? I'm sending the actual tickcount, then for the following packets the first tickcount + (numPackets * 500). Shouldn't this work? On a side note, I'm only sending ~3 packets, so the tickcount will be caught back up by the time I jump(you would think) after the teleport finishes. I'm just not seeing why it won't accept the packets.

[namreeb]

What do you mean by not accepting the packets? What is it doing?

[lanman92]

It disconnects me whenever I send the next movement packet after my teleport. Doesn't make much sense. I'll post a log in a second.

Logging started...
Time sync: 391    5    32795846
Warden...
Movement:  BB    1000    3279767F    10335.545898    831.223938    1326.180664
Movement:  EE    1000    32797873    10335.545898    831.223938    1327.747070
Actual TickCount: 32797882
Movement:  C9    0    327979B8    10335.545898    831.223938    1326.181152
Time sync: 391    6    32797DEE
Movement:  DA    0    32799B2E    10335.545898    831.223938    1326.181152
Movement:  DA    0    3279A32A    10335.545898    831.223938    1326.181152
Time sync: 391    7    3279A3A7
Movement:  B5    1    3279ACBB    10335.545898    831.223938    1326.181152
Movement:  EE    1    3279AEAF    10335.545898    831.223938    1330.181152
Actual TickCount: 3279ACBB
Movement:  EE    1    3279B0A3    10335.545898    831.223938    1334.181152
Actual TickCount: 3279ACBB
Movement:  B7    0    3279B297    10335.545898    831.223938    1338.181152
Movement:  B5    1    3279B8AD    10335.545898    831.223938    1338.181152

The last set of Start+stop is my teleport, as you can see by the higher tickcount. Still, shouldn't the server accept this?