Jerrith's UO Packets Guide

Jerrith's UO Packets Guide

Historical note: This packet guide has been created and maintained by Jerrith 1998-2000
Since 2000 it's maintained by me (LB), Punt and Krrios

Original (Jerrith's) intro:

Note: This is still an early version of this document, which I am currently planning to revise significantly. I'm letting people have this version now due to popular demand. Items that I have not touched from the original can be noted by their further back modification date, and the fact that the modification date contains a time, which I have dropped.

This guide is based on the UOPackets.doc document "UOX Protocol" prepared by Damian. The information contained within come from the UOX source code, the FUSE source code, various message board postings, various programs I've written, and other sources, including information from Fallo & FUSE source, and Uziel and Rhad from NWO.

For simplicity, bytes are used, throughout this document. If the size of a piece of data is larger than a byte, the size will be written afterwards, enclosed in []'s. In the case of variable length data, attempts will be made to supply formulas to determine the width of pieces of data.

Also, seeing as how the number of "hack" programs available for UO has grown as of late, notes have been attached regarding checks to perform regarding the data, to insure it is unaltered.

Finally, before the specifications, just under this, you'll find a list of some common variables, and what they represent.

Layers:

0x01 - One handed weapon

0x02 - Two handed weapon, shield, or misc.

0x03 - Shoes

0x04 - Pants

0x05 - Shirt

0x06 - Helm/Hat

0x07 - Gloves

0x08 - Ring

0x09 - Unused

0x0A - Neck

0x0B - Hair

0x0C - Waist (half apron)

0x0D - Torso (inner) (chest armor)

0x0E - Bracelet

0x0F - Unused (backpack, but backpacks go to 0x15)

0x10 - Facial Hair

0x11 - Torso (middle) (sircoat, tunic, full apron, sash)

0x12 - Earrings

0x13 - Arms

0x14 - Back (cloak)

0x15 - Backpack

0x16 - Torso (outer) (robe)

0x17 - Legs (outer) (skirt/kilt)

0x18 - Legs (inner) (leg armor)

0x19 - Mount (horse, ostard, etc)

0x1A - NPC Buy Restock container

0x1B - NPC Buy no restock container

0x1C - NPC Sell container

0x1D - PC Bank Box

Direction:

0x00 - North

0x01 - Northeast

0x02 - East

0x03 - Southeast

0x04 - South

0x05 - Southwest

0x06 - West

0x07 - Northwest

If running, dir = dir|0x80 (so dirs become 0x80, 0x81, etc…)

Speech Types:

0x00 - Regular

0x01 - Broadcast

0x02 - Emote (adds *'s as part of text)

0x06 - Label (You see: )

0x07 Emphasis (clears previous messages)

0x08 - Whisper

0x09 - Yell

0x0a - spell

Flags:

0x0* - Unicode

0xc* - Ascii

Speech Fonts:

0x0000 - Bold Text

0x0001 - Text with shadow

0x0002 - Bold+Shadow

0x0003 - Normal

0x0004 - Gothic

0x0005 - Italic Script

0x0006 - Small Dark Letters

0x0007 - Colorful Font (Buggy?)

0x0008 - Rune font (Only use capital letters with this!)

0x0009 - Small Light Letters

Speech Trigger Words:

0x0000 *withdrawal *

0x0001 *balance*

0x0001 *statement*

0x0002 *bank*

0x0003 *check *

0x0004 *join*

0x0004 *member*

0x0005 *quit*

0x0005 *resign*

0x0006 *guild*

………………

for all of them see speech.mul ;)

Mobile Flag Byte:

0x00 - None

0x02 - Female

0x04 - Poisoned

0x08 - YellowHits // healthbar gets yellow
0x10 - FactionShip // unsure why client needs to know

0x20 - Movable if normally not

0x40 - War mode

0x80 - Hidden

Skill List:

(1 indexed version. Some messages use it 0 indexed)

1 - Alchemy

2 - Anatomy

3 - Animal Lore

4 - Item ID (Appraise)

5 - Arms Lore

6 - Parrying (Battle Defense)

7 - Begging

8 - Blacksmithing

9 - Bowcraft

10 - Peacemaking (Calming)

11 - Camping

12 - Carpentry

13 - Cartography

14 - Cooking

15 - Detect Hidden

16 - Enticement

17 - Evaluate Intelligence

18 - Healing

19 - Fishing

20 - Forensic Evaluation

21 - Herding

22 - Hiding

23 - Provocation

24 - Inscription

25 - Lockpicking

26 - Magery

27 - Magic Resistance

28 - Tactics

29 - Snooping

30 - Musicianship

31 - Poisoning

32 - Archery

33 - Spirit Speak

34 - Stealing

35 - Tailoring

36 - Animal Taming (Taming)

37 - Taste Identification

38 - Tinkering

39 - Tracking

40 - Veterinary

41 - Swordsmanship

42 - Mace Fighting

43 - Fencing

44 - Wrestling

45 - Lumberjacking

46 - Mining

47 - Meditation

48 - Stealth

49 - Remove Trap

50 - Necromancy

Packet Specifications

0x00 Packet

Last modified on Friday, 19-May-2000

Create Character (104 bytes)

· BYTE cmd

· BYTE[4] pattern1 (0xedededed)

· BYTE[4] pattern2 (0xffffffff)

· BYTE pattern3 (0x00)

· BYTE[30] char name

· BYTE[30] char password

· BYTE sex (0=male, 1=female)

· BYTE str

· BYTE dex

· BYTE int

· BYTE skill1

· BYTE skill1value

· BYTE skill2

· BYTE skill2value

· BYTE skill3

· BYTE skill3value

· BYTE[2] skinColor

· BYTE[2] hairStyle

· BYTE[2] hairColor

· BYTE[2] facial hair

· BYTE[2] facial hair color

· BYTE[2] location # from starting list

· BYTE[2] unknown1

· BYTE[2] slot

· BYTE[4] clientIP

· BYTE[2] shirt color

· BYTE[2] pants color

Note: Client Message

Note: pattern3 is set to 0xFF to early signal a Krrios' client user, where it expects a 0xF0 | 0x00 before login confirm

Notes:

Str, dex and int should always sum to 65.

Str, dex and int should always be between 10 and 45, inclusive.

Skill1, skill2, and skill3 should never be the same value.

Skill1, skill2, and skill3 should always be between 0 and 45, inclusive.

Skill1value, skill2value, and skill3value should always sum to 100.

Skill1value, skill2value, and skill3value should always be between 0 and 50, inclusive.

SkinColor should always be between 0x3EA and 0x422, exclusive.

HairColor and facialHairColor should always be between 0x44E and 0x4AD, exclusive.

HairStyle should be between 0x203B and 0x204A, exclusive, and it should also exclude 0x203D to 0x2044, exclusive.

FacialHairStyle should be between 0x203E and 0x204D

Shirt color and Pants color need bounds checking too.

0x01 Packet

Last Modified on Friday, 30-Aug-2002

Disconnect Notification (5 bytes)

· BYTE cmd

· BYTE[4] pattern (0xFFFFFFFF)

Note: Client message

Note: Sent when the user chooses to return to the main menu from the character select menu.

Note: Since the character select menu no longer has a main menu button, this message is no longer sent.
Note: It's send again in current 3.0.x clients. When player does "paper-doll logout"

0x02 Packet

Last Modified on Friday, 19-May-2000

Move Request (7 bytes)

· BYTE cmd

· BYTE direction

· BYTE sequence number

· BYTE[4] fastwalk prevention key

Note: Client Message

Note: sequence number starts at 0, after a reset. However, if 255 is reached, the next seq # is 1, not 0.

Fastwalk prevention notes: each 0x02 pops the top element from fastwalk key stack. (0xbf sub1 init. fastwalk stack, 0xbf sub2 pushes an element to stack)
If stack is empty key value is 0. (à never set keys to 0 in 0xbf sub 1/2)
Because client sometimes sends bursts of 0x02's DON'T check for a certain top stack value.
The only safe way to detect fastwalk: push a key after EACH x021, 0x22, (=send 0xbf sub 2) check in 0x02 for stack emptyness.
If empty -> fastwalk alert.
Note that actual key values are irrelevant. (just don't use 0)
Of course without perfect 0x02/0x21/0x22 synch (serverside) it's useless to use fastwalk detection.

Last but not least: fastwalk detection adds 9 bytes per step and player !

0x03 Packet

Last Modified on Friday, 20-Nov-1998

Talk Request (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE SpeechType

· BYTE[2] Color

· BYTE[2] SpeechFont

· BYTE[?] msg - Null Terminated (blockSize - 8)

Note: Client Message

0x04 Packet

Last Modified on Friday, 19-May-2000

Request (2 bytes)

· BYTE cmd

· BYTE mode (0=off, 1=on)

Note: Client Message

0x05 Packet

Last Modified on Friday, 19-May-2000

Attack Request (5 bytes)

· BYTE cmd

· BYTE[4] ID to be attacked

Note: Client Message

0x06 Packet

Last Modified on Friday, 19-May-2000

Double click (5 bytes)

· BYTE cmd

· BYTE[4] ID of double clicked object

Note: Client Message

0x07 Packet

Last Modified on Friday, 19-May-2000

Pick Up Item(s) (7 bytes)

· BYTE cmd

· BYTE[4] item id

· BYTE[2] # of items in stack

Note: Client Message

0x08 Packet

Last Modified on Friday, 19-May-2000

Drop Item(s) (14 bytes)

· BYTE cmd

· BYTE[4] item id

· BYTE[2] X Location

· BYTE[2] Y Location

· BYTE Z Location

· BYTE[4] Move Into Container ID (FF FF FF FF if normal world)

Note: Client Message

Note: 3D clients sometimes sends 2 of them (bursts) for ONE drop action.
The last one having -1's in X/Y locs.

Be very careful how to handle this odd "bursts" server side, neither always process, nor always skipping is correct.

0x09 Packet

Last Modified on Friday, 19-May-2000

Single click (5 bytes)

· BYTE cmd

· BYTE[4] ID of single clicked object

Note: Client Message

0x11 Packet

Last Modified on Sunday, 12-Feb-2003

Stat window info

· BYTE cmd

· BYTE[2] packet length

· BYTE[4] player id

· BYTE[30] playerName

· BYTE[2] currentHitpoints

· BYTE[2] maxHitpoints

· BYTE[1] name change flag (0x1 = allowed, 0 = not allowed)

· BYTE[1] flag (0x00 - no more data following (end of packet here). 0x01 - more data after this flag following,
0x03: like 1, extended info, 0x04: even more extended info (client 4.0 and above)

· BYTE sex (0=male, 1=female)

· BYTE[2] str

· BYTE[2] dex

· BYTE[2] int

· BYTE[2] currentStamina

· BYTE[2] maxStamina

· BYTE[2] currentMana

· BYTE[2] maxMana

· BYTE[4] gold

· BYTE[2] armor class

· BYTE[2] weight

· If (flag == 3 or flag==4 )

· BYTE[2] statcap

· BYTE pets current

· BYTE pets max

· If (flag == 4)

· BYTE[2] fireresist

· BYTE[2] coldresist

· BYTE [2] poisonresist

· BYTE[2] energyresist

· BYTE[2] luck

· BYTE[2] damage max

· BYTE[2] damage min

· BYTE[4] unknown

Note: Server Message

Note: For characters other than the player, currentHitpoints and maxHitpoints are not the actual values.
MaxHitpoints is a fixed value, and currentHitpoints works like a percentage.

0x12 Packet

Last Modified on Sunday, 17-May-1998 15:27:53 EDT

Request Skill/Action/Magic Usage (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE type

· 0x24 ($) - skill

· BYTE[blockSize-4] skill (null terminated strings)

· "1 0" - anatomy

· "2 0" - animal lore

· "3 0" - item identification

· "4 0" - arms lore

· "6 0" - begging

· "9 0" - peacemaking

· "12 0" - cartography

· "14 0" - detect hidden

· "15 0" - entice

· "16 0" - evaluate intelligence

· "19 0" - forensic evaluation

· "21 0" - hiding

· "22 0" - provocation

· "23 0" - inscription

· "30 0" - poisoning

· "32 0" - spirit speak

· "33 0" - stealing

· "35 0" - taming

· "36 0" - taste identification

· "38 0" - tracking

· 0x56 (V) - Macro'd Spell

· BYTE[blockSize-4] Spell (null terminated strings)

· "2" - Create Food

· "3" - Feeblemind

· "4" - Heal

· "5" - Magic Arrow

· "6" - Night Sight

· "7" - Reactive Armor

· "8" - Weaken

· "9" - Agility

· "10" - Cunning

· "11" - Cure

· "12" - Harm

· "13" - Magic Trap

· "14" - Magic Untrap

· "15" - Protection

· "16" - Strength

· "17" - Bless

· "18" - Fireball

· "19" - Magic Lock

· "20" - Poison

· "21" - Telekenisis

· "22" - Teleport

· "23" - Unlock

· "24" - Wall of Stone

· "25" - Arch Cure

· "26" - Arch Protection

· "27" - Curse

· "28" - Fire Field

· "29" - Greater Heal

· "30" - Lightning

· "31" - Mana Drain

· "32" - Recall

· "33" - Blade Spirit

· "34" - Dispel Field

· "35" - Incognito

· "36" - Reflection

· "37" - Mind Blast

· "38" - Paralyze

· "39" - Poison Field

· "40" - Summon Creature

· "41" - Dispel

· "42" - Energy Bolt

· "43" - Explosion

· "44" - Invisibility

· "45" - Mark

· "46" - Mass Curse

· "47" - Paralyze Field

· "48" - Reveal

· "49" - Chain Lightning

· "50" - Energy Field

· "51" - Flame Strike

· "52" - Gate

· "53" - Mana Vampire

· "54" - Mass Dispel

· "55" - Meteor Shower

· "56" - Polymorph

· "57" - Earthquake

· "58" - Energy Vortex

· "59" - Ressurection

· "60" - Summon Air Elemental

· "61" - Summon Daemon

· "62" - Summon Earth Elemental

· "63" - Summon Fire Elemental

· "64" - Summon Water Elemental

· 0x58 (X) - Open Door

· BYTE null termination (0x00)

· 0xc7 - action

· BYTE[blockSize-4] Action (null terminated strings)

· "bow"

· "salute"

0x13 Packet

Last Modified on Thursday, 19-Nov-1998

Drop->Wear Item (10 bytes)

· BYTE cmd

· BYTE[4] itemid

· BYTE layer (see layer list at top)

· BYTE[4] playerID

Note: The layer byte should not be trusted.

0x1A Packet

Last Modified on Saturday, 13-Apr-1999

Object Information (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] itemID

· BYTE[2] model #

· if (itemID & 0x80000000)

· BYTE[2] item count (or model # for corpses)

· if (model & 0x8000)

· BYTE Incr Counter (increment model by this #)

· BYTE[2] xLoc (only use lowest significant 15 bits)

· BYTE[2] yLoc

· if (xLoc & 0x8000)

· BYTE direction

· BYTE zLoc

· if (yLoc & 0x8000)

· BYTE[2] dye

· if (yLoc & 0x4000)

· BYTE flag byte (See top)

0x1B Packet

Last Modified on Monday, 19-August-2002

Char Location and body type (37 bytes)

· BYTE cmd

· BYTE[4] player id

· BYTE[4] unknown1 // always 0

· BYTE[2] bodyType

· BYTE[2] xLoc

· BYTE[2] yLoc

· BYTE[2] zLoc

· BYTE direction

· BYTE unknown2

· BYTE[4] unknown3

· BYTE[2] server boundry X

· BYTE[2] server boundry Y

· BYTE[2] server boundry Width

· BYTE[2] server boundry Height

· BYTE[6] // completely ignored by standard client

Note: Only send once after login. It's mandatory to send it once.
Note2: OSI calls this packet Login confirm

0x1C Packet

Last Modified on Friday, 20-Apr-1998

Send Speech (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] itemID (FF FF FF FF = system)

· BYTE[2] model (item hex # - FF FF = system)

· BYTE Type

· BYTE[2] Text Color

· BYTE[2] Font

· BYTE[30] Name

· BYTE[?] Null-Terminated Message (? = blockSize - 44)

0x1D Packet

Last Modified on Monday, 13-Apr-1998 17:06:02 EDT

Delete object (5 bytes)

· BYTE cmd

· BYTE[4] item/char id

0x20 Packet

Last Modified on Thursday, 19-Nov-1998

Draw Game Player (19 bytes)

· BYTE cmd

· BYTE[4] creature id

· BYTE[2] bodyType

· BYTE unknown1 (0)

· BYTE[2] skin color / hue

· BYTE flag byte

· BYTE[2] xLoc

· BYTE[2] yLoc

· BYTE[2] unknown2 (0)

· BYTE direction

· BYTE zLoc

Note: Only used with the character being played by the client.

0x21 Packet

Last Modified on Wednesday, 06-May-1998 23:30:37 EDT

Character Move Reject (8 bytes)

· BYTE cmd

· BYTE sequence #

· BYTE[2] xLoc

· BYTE[2] yLoc

· BYTE direction

· BYTE zLoc

0x22 Packet

Last Modified on Monday, 29-Nov-2002

Character Move ACK/ Resync Request(3 bytes)

· BYTE cmd

· BYTE sequence (matches sent sequence)

· BYTE notoriety

Note: notoriety: 0 = invalid/across server line

1 = innocent (blue)

2 = guilded/ally (green)

3 = attackable but not criminal (gray)

4 = criminal (gray)

5 = enemy (orange)

6 = murderer (red)

7 = unknown use (translucent (like 0x4000 hue))

Note: server and client packet. Server side it's move ack for 0x02.
Whenever client thinks it's out of synch (basicly: sequence doesn't fit) it sends a 0x22 0 0 / Resync request. (server should resend items / npcs / etc around)

0x23 Packet

Last Modified on Sunday, 17-May-1998 13:33:54 EDT

Dragging of Items (26 bytes)

· BYTE cmd

· BYTE[2] model #

· BYTE[3] unknown1

· BYTE[2] stack count

· BYTE[4] Source ID

· BYTE[2] Source xLoc

· BYTE[2] Source yLoc

· BYTE Source zLoc

· BYTE[4] Target id

· BYTE[2] Target xLoc

· BYTE[2] Target yLoc

· BYTE Target zLoc

0x24 Packet

Last Modified on Tuesday, 14-Apr-1998 20:53:33 EDT

Draw Container (7 bytes)

· BYTE cmd

· BYTE[4] item id

· BYTE[2] model-Gump

· 0x003c = backpack

0x25 Packet

Last Modified on Saturday, 02-May-1998 16:05:35 EDT

Add Item to Container (20 bytes)

· BYTE cmd

· BYTE[4] item id to add

· BYTE[2] model

· BYTE unknown1 (0)

· BYTE[2] # of items

· BYTE[2] xLoc in container

· BYTE[2] yLoc in container

· BYTE[4] itemID of container

· BYTE[2] color

0x26 Packet

Last Modified on Friday, 19-May-2000

Kick Player (5 bytes)

· BYTE cmd

· BYTE[4] ID of GM who issued kick?

Note: Server Message

0x27 Packet

Last Modified on Friday, 19-May-2000

Reject Request to Move Items (2 bytes)

· BYTE cmd

· BYTE unknown1 (0x00)

Note: Server Message

0x28 Packet

Last Modified on Friday, 19-May-2000

Clear Square (5 bytes)

· BYTE cmd

· BYTE[2] xLoc

· BYTE[2] yLoc

Note: Server Message

0x29 Packet

Last Modified on Friday, 19-May-2000

Paperdoll Clothing Added(1 bytes)

· BYTE cmd

Note: Server Message

0x2C Packet

Last Modified on Friday, 19-May-2000

Resurrection Menu Choice (2 bytes)

· BYTE cmd

· BYTE action (2=ghost, 1=resurrect, 0=from server)

Note: Client and Server Message

Note: Resurrection menu has been removed from UO.

0x2D Packet

Last Modified on Wednesday, 28-Aug-2002

Mobile Attributes (17 bytes)

· BYTE cmd

· BYTE[4] serial

· BYTE[2] hitsMax

· BYTE[2] hitsCurrent

· BYTE[2] manaMax

· BYTE[2] manaCurrent

· BYTE[2] stamMax

· BYTE[2] stamCurrent

0x2E Packet

Last Modified on Thursday, 19-Nov-1998

Worn Item (15 bytes)

· BYTE cmd

· BYTE[4] itemid (always starts 0x40 in my data)

· BYTE[2] model (item hex #)

· BYTE (0x00)

· BYTE layer

· BYTE[4] playerID

· BYTE[2] color/hue

0x2F Packet

Last Modified on Saturday, 1-May-1999

Fight Occurring (10 bytes)

· BYTE cmd

· BYTE unknown1 (0)

· BYTE[4] ID of attacker

· BYTE[4] ID of attacked

This packet is sent when there is a fight going on somewhere on screen.

0x33 Packet

Last Modified on Thursday, 19-Nov-1998

Pause/Resume Client (2 bytes)

· BYTE cmd

· BYTE pause/resume (0=pause, 1=resume)

0x34 Packet

Last modified on Thursday, 19-Nov-1998

Get Player Status (10 bytes)

· BYTE cmd

· BYTE[4] pattern (0xedededed)

· BYTE getType

· 0x04 - Basic Stats (Packet 0x11 Response)

· 0x05 = Request Skills (Packet 0x3A Response)

· BYTE[4] playerID

0x38 Packet

Last modified on Monday, 19-Aug-2002

Drunken Coder (7 bytes)

· BYTE cmd

· BYTE[2] x

· BYTE[2] y

· BYTE[2] z

Note: Official name is pathfinding.
Only works for player played by client.

x,y,z have to be in "0xc8 range" from player's current location
packet has to be send 19 times(!!!) or more in a raw, otherwise it doesn't do anything

if all this satisfied it does a pathfind like action.

location of destination is displayed above players head (can't be disabled)

0x3A Packet

Last modified on Friday, 26-Jul-2002

Server Version - Send Skills (Variable)

· BYTE cmd

· BYTE[2] blockSize

· BYTE Type (0x00= full list, 0xFF = single skill update, 0x02 full list with skillcap, 0xDF single skill update with cap) -

· Repeat next until done - 46 skills

· BYTE[2] id # of skill (0x01 - 0x2e)

· BYTE[2] skill Value * 10

· BYTE[2] Unmodified Value * 10

· BYTE skillLock (0=up, 1=down, 2=locked)

· If (Type==2 || Type==0xDF) BYTE[2] SkillCap

· BYTE[2] null (00 00) (ONLY IF TYPE == 0x00)

Note: Can also send just one skill, to update that skill.

Client Version - Set Skill Lock (Variable # of bytes)

BYTE cmd
BYTE[2] blockSize
BYTE[2] id# of skill
BYTE skillLock (0=up, 1=down, 2=locked)

0x3B Packet

Last Modified on Wednesday, 06-May-1998 23:30:41 EDT

Buy Item(s) (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] vendorID

· BYTE flag

· 0x00 - no items following

· 0x02 - items following

· For each item

· BYTE (0x1A)

· BYTE[4] itemID (from 3C packet)

· BYTE[2] # bought

0x3C Packet

Last Modified on Saturday, 02-May-1998 16:05:37 EDT

Items in Container (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[2] # of Item segments

· Item Segments:

· BYTE[4] itemID

· BYTE[2] model

· BYTE unknown1 (0x00)

· BYTE[2] # of items in stack

· BYTE[2] xLoc

· BYTE[2] yLoc

· BYTE[4] Container ItemID

· BYTE[2] color

0x4E Packet

Last Modified on Sunday, 17-May-1998 13:33:55 EDT

Personal Light Level (6 bytes)

· BYTE cmd

· BYTE[4] creature id

· BYTE level

0x4F Packet

Last Modified on Saturday, 14-Nov-1998

Overall Light Level (2 bytes)

· BYTE cmd

· BYTE level

· 0x00 - day

· 0x09 - OSI night

· 0x1F - Black

· Max normal val = 0x1F

0x53 Packet

Last Modified on Sunday, 13-Feb-2000

Idle Warning(2 bytes)

· BYTE cmd

· BYTE value (0x07 - idle, 0x05 - another character is online)

"Another character from this account is currently online in this world. You must either log in as that character or wait for it to time out."

0x54 Packet

Last Modified on Sunday, 13-Feb-2000

Play Sound Effect (12 bytes)

· BYTE cmd

· BYTE mode (0x00=quiet, repeating, 0x01=single normally played sound effect)

· BYTE[2] SoundModel

· BYTE[2] unknown3 (speed/volume modifier? Line of sight stuff?)

· BYTE[2] xLoc

· BYTE[2] yLoc

· BYTE[2] zLoc

0x55 Packet

Last Modified on Monday, 26-Oct-1998

· BYTE cmd

0x56 Packet

Last Modified on Friday, 26-Jul-2002

Map Related(11 bytes)

· BYTE cmd

· BYTE[4] id

· BYTE command

· 1 = add map point,

· 2 = add new pin with pin number. (insertion. other pins after the number are pushed back.)

· 3 = change pin

· 4 = remove pin

· 5 = remove all pins on the map

· 6 = toggle the 'editable' state of the map.

· 7 = return msg from the server to the request 6 of the client.

· BYTE plotting state (1=on, 0=off, valid only if command 7)

· BYTE[2] x location (relative to upper left corner of the map, in pixels, for points)

· BYTE[2] y location (relative to upper left corner of the map, in pixels, for points)

0x5B Packet

Last Modified on Saturday, 18-Apr-1998 17:49:28 EDT

Time (4 bytes)

· BYTE cmd

· BYTE hour

· BYTE minute

· BYTE second

0x5D Packet

Last Modified on Monday, 04-Aug-2002 17:06:26 EDT

· BYTE cmd

· BYTE[4] pattern1 (0xedededed)

· BYTE[30] char name (0 terminated)

· BYTE[33] unknown, mostly 0's
(Byte# 0x27, 0x28, 0x30 seem to be the only non 0's of these 33 bytes. Perhaps password data that's not send anymore)

· BYTE slot choosen (0-based)

· BYTE[4] clientIP

0x65 Packet

Last Modified on Wednesday, 24-May-2000

Set Weather (4 bytes)

· BYTE cmd

· BYTE type (0x00 - "It starts to rain", 0x01 - "A fierce storm approaches.", 0x02 - "It begins to snow", 0x03 - "A storm is brewing.", 0xFF - None (turns off sound effects), 0xFE (no effect?? Set temperature?)

· BYTE num (number of weather effects on screen)

· BYTE temperature

Note: Server Message

Note: Temperature has no effect at present.

Note: maximum number of weather effects on screen is 70.

Note: If it is raining, you can add snow by setting the num to the num of rain currently going, plus the number of snow you want.

Note: Weather messages are only displayed when weather starts.

Note: Weather will end automatically after 6 minutes without any weather change packets.

Note: You can totally end weather (to display a new message) by teleporting. I think it's either the 0x78 or 0x20 messages that reset it, though I haven't checked to be sure (other possibilities, 0x4F or 0x4E)

0x66 Packet

Last Modified on Monday, 19'th-Feb-2002

Books - Page (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] bookID

· BYTE[2] # of pages in this packet

· For each page:

· BYTE[2] page #

· BYTE[2] # of lines on page

· Repeated for each line:

· BYTE[var] null terminated line

Note:
server side: # of pages equals value given in 0x93/0xd4
EACH page # given. If empty: # lines: 0 + terminator (=3 0's)
client side: # of pages always 1. if 2 pages changed, client generates 2 packets.

0x69 Packet

Last Modified on Thursday, 23-Apr-1998 19:26:05 EDT

Change Text/Emote Color (5 bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[2] unknown1

The client sends two of these independent of the color chosen. It sends two of them in quick succession as part of the "same" packet. The unknown1 is 0x00 0x01 in the first and 0x00 0x02 in the second.

Note, this message has been removed. It is no longer used.

0x6C Packet

Last Modified on Sunday, 13-Feb-2000

Targeting Cursor Commands (19 bytes)

· BYTE cmd

· BYTE type

· 0x00 = Select Object

· 0x01 = Select X, Y, Z

· BYTE[4] cursorID

· BYTE Cursor Type

· Always 0 now

· The following are always sent but are only valid if sent by client

· BYTE[4] Clicked On ID

· BYTE[2] click xLoc

· BYTE[2] click yLoc

· BYTE unknown (0x00)

· BYTE click zLoc

· BYTE[2] model # (if a static tile, 0 if a map/landscape tile)

Note: the model # shouldn't be trusted.

0x6D Packet

Last Modified on Sunday, 17-May-1998 13:33:59 EDT

Play Midi Music (3 bytes)

· BYTE cmd

· BYTE[2] musicID

0x6E Packet

Last Modified on Monday, 19-Apr-1999

Character Animation (14 bytes)

· BYTE cmd

· BYTE[4] item/char ID

· BYTE[2] movement model

· 0x00 = walk

· 0x01 = walk faster

· 0x02 = run

· 0x03 = run (faster?)

· 0x04 = nothing

· 0x05 = shift shoulders

· 0x06 = hands on hips

· 0x07 = attack stance (short)

· 0x08 = attack stance (longer)

· 0x09 = swing (attack with knife)

· 0x0a = stab (underhanded)

· 0x0b = swing (attack overhand with sword)

· 0x0c = swing (attack with sword over and side)

· 0x0d = swing (attack with sword side)

· 0x0e = stab with point of sword

· 0x0f = ready stance

· 0x10 = magic (butter churn!)

· 0x11 = hands over head (balerina)

· 0x12 = bow shot

· 0x13 = crossbow

· 0x14 = get hit

· 0x15 = fall down and die (backwards)

· 0x16 = fall down and die (forwards)

· 0x17 = ride horse (long)

· 0x18 = ride horse (medium)

· 0x19 = ride horse (short)

· 0x1a = swing sword from horse

· 0x1b = normal bow shot on horse

· 0x1c = crossbow shot

· 0x1d = block #2 on horse with shield

· 0x1e = block on ground with shield

· 0x1f = swing, and get hit in middle

· 0x20 = bow (deep)

· 0x21 = salute

· 0x22 = scratch head

· 0x23 = 1 foot forward for 2 secs

· 0x24 = same

· BYTE unknown1 (0x00)

· BYTE direction

· BYTE[2] repeat (1 = once / 2 = twice / 0 = repeat forever)

· BYTE forward/backwards(0x00=forward, 0x01=backwards)

· BYTE repeat Flag (0 - Don't repeat / 1 repeat)

· BYTE frame Delay (0x00 - fastest / 0xFF - Too slow to watch)

0x6F Packet

Last Modified on Friday, 20-Nov-1998

Secure Trading (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE action

· BYTE[4] id1

· BYTE[4] id2

· BYTE[4] id3

· BYTE nameFollowing (0 or 1)

If (nameFollowing = 1)

BYTE[?] charName

0x70 Packet

Last Modified on Friday, 20-Nov-1998

Graphical Effect (28 bytes)

· BYTE cmd

· BYTE direction type

· 00 = go from source to dest

· 01 = lightning strike at source

· 02 = stay at current x,y,z

· 03 = stay with current source character id

· BYTE[4] character id

· BYTE[4] target id

· BYTE[2] model of the first frame of the effect

· BYTE[2] xLoc

· BYTE[2] yLoc

· BYTE zLoc

· BYTE[2] xLoc of target

· BYTE[2] yLoc of target

· BYTE zLoc of target

· BYTE speed of the animation

· BYTE duration (0=really long, 1= shortest)

· BYTE[2] unknown2 (0 works)

· BYTE adjust direction during animation (1=no)

· BYTE explode on impact

0x71 Packet

Last Modified on Wednesday, 24-May-2000

Bulletin Board Message (Variable # of bytes)

· BYTE cmd

· BYTE[2] len

· BYTE subcmd

· BYTE[len-4] submessage

Submessage 0 - Display Bulletin Board

· BYTE[4] BoardID

· BYTE[22] board name (default is "bulletin board", the rest nulls)

· BYTE[4] ID (0x402000FF)

· BYTE[4] zero (0)

Note: Server Message

Submessage 1 - Message Summary

· BYTE[4] BoardID

· BYTE[4] MessageID

· BYTE[4] ParentID (0 if top level)

· BYTE posterLen

· BYTE[posterLen] poster (null terminated string)

· BYTE subjectLen

· BYTE[subjectLen] subject (null terminated string)

· BYTE timeLen

· BYTE[timeLen] time (null terminated string with time of posting) ("Day 1 @ 11:28")

Note: Server Message

Submessage 2 - Message

· BYTE[4] BoardID

· BYTE[4] MessageID

· BYTE posterLen

· BYTE[posterLen] poster (null terminated string)

· BYTE subjectLen

· BYTE[subjectLen] subject (null terminated string)

· BYTE timeLen

· BYTE[timeLen] time (null terminated string with time of posting) ("Day 1 @ 11:28")

· BYTE[29] constant: (01 91 84 0A 06 1E FD 01 0B 15 2E 01 0B 17 0B 01 BB 20 46 04 66 13 F8 00 00 0E 75 00 00)

· BYTE numlines

For each line:

· BYTE linelen

· BYTE[linelen] body (null terminated)

Note: Server Message

Submessage 3 - Request Message

· BYTE[4] BoardID

· BYTE[4] MessageID

Note: Client Message

Submessage 4 - Request Message Summary

· BYTE[4] BoardID

· BYTE[4] MessageID

Note: Client Message

Submessage 5 - Post a message

· BYTE[4] BoardID

· BYTE[4] Replying to ID (0 if this is a top level / non-reply post)

· BYTE subjectLen (length of the subject, includes null termination)

· BYTE[subjectLen] subject (null terminated)

· BYTE numlines

For each line:

· BYTE linelen

· BYTE[linelen] body (null terminated)

Note: Client Message

Submessage 6 - Remove Posted Message

· BYTE[4] BoardID

· BYTE[4] MessageID

Note: Client Message

0x72 Packet

Last Modified on Saturday, 14-Nov-1998

Request War Mode Change/Send War Mode status (5 bytes)

· BYTE cmd

· BYTE flag

· 0x00 - Normal

· 0x01 - Fighting

· BYTE[3] unknown1 (always 00 32 00 in testing)

Server replies with 0x77 packet

0x73 Packet

Last Modified on Friday, 20-Nov-1998

Ping message (2 bytes)

· BYTE cmd

· BYTE seq

0x74 Packet

Last Modified on Sunday, 03-May-1998 22:52:07 EDT

Open Buy Window (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] (vendorID | 0x40000000)

· BYTE # of items

· # of items worth of item segments

· BYTE[4] price

· BYTE length of text description

· BYTE[text length] item description

NOTE: This packet is always preceded by a describe contents packet (0x3c) with the container id as the (vendorID | 0x40000000) and then an open container packet (0x24?) with the vendorID only and a model number of 0x0030 (probably the model # for the buy screen)

0x75 Packet

Last Modified on Sunday, 13-Feb-2000

Rename Character (35 bytes)

· BYTE cmd

· BYTE[4] id

· BYTE[30] new name

0x76 Packet

Last Modified on Monday, 19-Aug-2002

New Subserver (16 bytes)

· BYTE cmd

· BYTE[2] xLoc

· BYTE[2] yLoc

· BYTE[2] zLoc

· BYTE unknown /always 0

· BYTE[2] server boundry X

· BYTE[2] server boundry Y

· BYTE[2] server boundry Width

· BYTE[2] server boundry Height

0x77 Packet

Last Modified on Sunday, 13-Feb-2000

Update Player (17 bytes)

· BYTE cmd

· BYTE[4] player id

· BYTE[2] model

· BYTE[2] xLoc

· BYTE[2] yLoc

· BYTE zLoc

· BYTE direction

· BYTE[2] hue/skin color

· BYTE flag (bit field)

· BYTE highlight color

0x78 Packet

Last Modified on Tuesday, 13-April-1999

Draw object (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] itemID/playerID

· BYTE[2] model (item hex #)

· if (itemID & 0x80000000)

· BYTE[2] amount/Corpse Model Num

· BYTE[2] xLoc (only 15 lsb)

· BYTE[2] yLoc

· if (xLoc & 0x8000)

· BYTE direction

· BYTE zLoc

· BYTE direction

· BYTE[2] dye/skin color

· BYTE flag

· BYTE notoriety (2's complement signed)

· if (BYTE[4] == 0x00 0x00 0x00 0x00)

· DONE

· else loop this until above if statement is satisified

· BYTE[4] itemID

· BYTE[2] model (item hex # - only 15 lsb)

· BYTE layer

· if (model & 0x8000)

· BYTE[2] hue

0x7C Packet

Last Modified on Thursday, 03-Sep-2002

Open Dialog Box (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] dialogID (echo'd back to the server in 7d)

· BYTE[2] menuid (echo'd back to server in 7d)

· BYTE length of question

· BYTE[length of question] question text

· BYTE # of responses

· Then for each response:

· BYTE[2] model id # of shown item (if grey menu -- then always 0x00 as msb)

· BYTE[2] color of shown item

· BYTE response text length

· BYTE[response text length] response text

0x7D Packet

Last Modified on Thursday, 03-Sept-2002

Client Response To Dialog (13 bytes)

· BYTE cmd

· BYTE[4] dialogID (echoed back from 7C packet)

· BYTE[2] menuid (echoed back from 7C packet)

· BYTE[2] 1-based index of choice

· BYTE[2] model # of choice

· BYTE[2] color

0x80 Packet

Last Modified on Monday, 13-Apr-1998 17:06:30 EDT

· BYTE cmd

· BYTE[30] userid

· BYTE[30] password

· BYTE unknown1 (not usually 0x00 - so not NULL)

0x82 Packet

Last Modified on Monday, 13-Apr-1998 17:06:32 EDT

· BYTE cmd

· BYTE why

· 0x00 = unknown user

· 0x01 = account already in use

· 0x02 = account disabled

· 0x03 = password bad

· 0x04 and higher = communications failed

0x83 Packet

Last Modified on Wednesday, 06-May-1998 23:30:42 EDT

Delete Character (39 bytes)

· BYTE cmd

· BYTE[30] password

· BYTE[4] charIndex

· BYTE[4] clientIP

0x86 Packet

Last Modified on Saturday, 18-Apr-1998 17:49:37 EDT

Resend Characters After Delete (304 bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE # of characters

· Following repeated 5 times

· BYTE[30] character name

· BYTE[30] character password

0x88 Packet

Last Modified on Saturday, 18-Apr-1998 17:49:39 EDT

Open Paperdoll (66 bytes)

· BYTE cmd

· BYTE[4] charid

· BYTE[60] text

· BYTE flag byte

0x89 Packet

Last Modified on Saturday, 14-Nov-1998

Corpse Clothing (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] corpseID

· BYTE itemLayer

· BYTE[4] itemID

· BYTE terminator (0x00)

Followed by a 0x3C message with the contents.

0x8C Packet

Last Modified on Monday, 13-Apr-1998 17:06:42 EDT

Connect to Game Server (11 bytes)

· BYTE cmd

· BYTE[4] gameServer IP

· BYTE[2] gameServer port

· BYTE[4] new key

0x90 Packet

Last Modified on Sunday, 2-May-1999

Map message(19 bytes)

· BYTE cmd

· BYTE[4] key used

· BYTE[2] gump art id (0x139D)

· BYTE[2] upper left x location

· BYTE[2] upper left y location

· BYTE[2] lower right x location

· BYTE[2] lower right y location

· BYTE[2] gump width in pixels

· BYTE[2] gump height in pixels

0x91 Packet

Last Modified on Monday, 13-Apr-1998 17:06:45 EDT

Game Server Login (65 bytes)

· BYTE cmd

· BYTE[4] key used

· BYTE[30] sid

· BYTE[30] password

0x93 Packet

Last Modified on Wednesday, 2-Feb-2000

Books - Title Page (99 bytes)

· BYTE cmd

· BYTE[4] bookID

· BYTE write flag

· 0x00 - non-writable

· 0x01 - writable

· BYTE new flag

· BYTE[2] # of pages

· BYTE[60] title

· BYTE[30] author

Client sends a 0x93 message on book close… Look into this. J

Client Ver:

Books - Update Title Page (99 bytes)

· BYTE cmd

· BYTE[4] bookID

· BYTE[4] unknown (0)

· BYTE[60] title (zero terminated, garbage after terminator)

· BYTE[30] author (zero terminated, garbage after terminator)

0x95 Packet

Last Modified on Thursday, 30-Apr-1998 18:34:08 EDT

Dye Window (9 bytes)

· BYTE cmd

· BYTE[4] itemID of dye target

· BYTE[2] ignored on send, model on return

· BYTE[2] model on send, color on return (default on server send is 0x0FAB)

NOTE: This packet is sent by both the server and client

0x97 Packet

Last Modified on Wednesday, 28-Aug-2002

Move player (2 bytes)

· BYTE cmd

· BYTE direction

Note: Server message.
Moves player played by client one step in requested direction.
Doesn't move if there are obstacles.

0x98 Packet

Last Modified on Monday, 04-Aug-2002 18:34:08 EDT

All-names "3D" (Variable # of Bytes)

· BYTE cmd

· BYTE[2] blocksize

· BYTE[4] ID

· If (server-reply) BYTE[30] name (0 terminated)

NOTE: Only 3D clients send this packet
Server and client packet.

Client asks for name of object with ID x.
Server has to reply with ID + name
Client automatically knows names of items.
Hence it only asks only for NPC/Player names nearby, but shows bars of items plus NPC's.

Client request has 7 bytes, server-reply 37
Triggered by Crtl + Shift.

0x99 Packet

Last Modified on Friday, 20-Nov-1998

Bring Up House/Boat Placement View (26 bytes)

· BYTE cmd

· BYTE request (0x01 from server, 0x00 from client)

· BYTE[4] ID of deed

· BYTE[12] unknown (all 0)

· BYTE[2] multi model (item model - 0x4000)

· BYTE[6] unknown (all 0)

0x9A Packet

Last Modified on Sunday, 15-Nov-1998

Console Entry Prompt(16 bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] objectID

· BYTE[4] prompt#

· BYTE[4] 0=request/esc, 1=reply

· BYTE[?] textstring (optional)

· BYTE terminator (0x00)

0x9B Packet

Last Modified on Wednesday, 06-May-1998 23:30:45 EDT

Request Help (258 bytes)

· BYTE cmd

· BYTE[257] (0x00)

0x9E Packet

Last Modified on Sunday, 15-May-1998

Sell List (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] shopkeeperID

· BYTE[2] numItems

For each item, a structure containing:

· BYTE[4] itemID

· BYTE[2] itemModel

· BYTE[2] itemHue/Color

· BYTE[2] itemAmount

· BYTE[2] value

· BYTE[2] nameLength

· BYTE[?] name

0x9F Packet

Last Modified on Friday, 28-May-1999

Sell Reply (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] shopkeeperID

· BYTE[2] itemCount

For each item, a structure containing:

· BYTE[4] itemID

· BYTE[2] quantity

0xA0 Packet

Last Modified on Monday, 13-Apr-1998 17:06:46 EDT

Select Server (3 bytes)

· BYTE cmd

· BYTE[2] server # chosen

0xA1 Packet

Last Modified on Tuesday, 20-Apr-1999

Update Current Health (9 bytes)

· BYTE cmd

· BYTE[4] playerID

· BYTE[2] maxHealth

· BYTE[2] currentHealth

0xA2 Packet

Last Modified on Tuesday, 21-Apr-1998 20:45:30 EDT

Update Current Mana (9 bytes)

· BYTE cmd

· BYTE[4] playerID

· BYTE[2] maxMana

· BYTE[2] currentMana

0xA3 Packet

Last Modified on Tuesday, 21-Apr-1998 20:45:32 EDT

Update Current Stamina (9 bytes)

· BYTE cmd

· BYTE[4] playerID

· BYTE[2] maxStamina

· BYTE[2] currentStamina

0xA4 Packet

Last Modified on Friday, 15-May-2000

Spy on Client (149 bytes)

· BYTE cmd

· BYTE[148] Unknown (previously, this has had info such as your graphics card name, free HD space, number of processors, etc.)

0xA5 Packet

Last Modified on Wednesday, 06-May-1998 23:30:48 EDT

Open Web Browser (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[blockSize-3] null terminated full web address

0xA6 Packet

Last Modified on Wednesday, 28-Aug-2002

Tips/Notice window (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE flag

· 0x00 - tips window

· 0x01 - ignored

· 0x02 - updates

· BYTE[4] tip #

· BYTE[2] msgSize

· BYTE[msgSize] message // ascii, not null terminated

0xA7 Packet

Last Modified on Wednesday, 06-May-1998 23:30:53 EDT

Request Tips/Notice (4 bytes)

· BYTE cmd

· BYTE[2] last tip #

· BYTE flag

· 0x00 - tips window

· 0x01 - notice window

0xA8 Packet

Last Modified on Monday, 13-Apr-1998 17:06:50 EDT

Game Server List (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE System Info Flag

· 0xCC - Don't send

· 0x64 - Send Video card

· ?? -

· BYTE[2] # of servers

· Then each server --

· BYTE[2] serverIndex (0-based)

· BYTE[32] serverName

· BYTE percentFull

· BYTE timezone

· BYTE[4] pingIP

0xA9 Packet

Last Modified on Sunday, 12-Feb-2003

Characters / Starting Locations (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE # of characters

· Following repeated 5 times

· BYTE[30] character name

· BYTE[30] character password

· BYTE number of starting locations

· Following for as many locations as you have

· BYTE locationIndex (0-based)

· BYTE[31] town (general name)

· BYTE[31] exact name

· BYTE[4] Flags (0x02 = send config/req logout (IGR?), 0x04 = single character (siege), 0x08 = enable npcpopup menus, 0x10 = unknown,
0x20: enable common AOS features (tooltip thing/fight system book, but not AOS monsters/map/skills)

0xAA Packet

Last Modified on Thursday, 16-Apr-1998 19:52:14 EDT

OK / Not OK To Attack (5 bytes)

· BYTE cmd

· BYTE[4] CharID being attacked

ID is set to 00 00 00 00 when attack is refused.

0xAB Packet

Last Modified on Friday, 20-Nov-1998

Gump Text Entry Dialog (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] id

· BYTE parentID

· BYTE buttonID

· BYTE textlen

· BYTE[?] text

· BYTE cancel (0=disable, 1=enable)

· BYTE style (0=disable, 1=normal, 2=numerical)

· BYTE[4] format (if style 1, max text len, if style2, max numeric value)

· BYTE text2len

· BYTE[?] text2

0xAC Packet

Last Modified on Saturday, 19-Feb-2000

Gump Text Entry Dialog Reply (Variable # of bytes)

· BYTE cmd

· BYTE[2] length

· BYTE[4] ID

· BYTE type

· BYTE index

· BYTE[3] unk

· BYTE[?] reply

0xAD Packet

Last Modified on Monday, 18-Feb-2002

Unicode/Ascii speech request (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE Type

· BYTE[2] Color

· BYTE[2] Font

· BYTE[4] Language (Null Terminated)

· "enu" - United States English

· "des" - German Swiss

· "dea" - German Austria

· "deu" - German Germany

· ... for a complete list see langcode.iff

· if (Type & 0xc0)

· BYTE[1,5] Number of distinct Trigger words (NUMWORDS).
12 Bit number, Byte #13 = Bit 11…4 of NUMWORDS, Hi-Nibble of Byte #14 (Bit 7…4) = Bit 0…3 of NUMWORDS

· BYTE[1,5] Index to speech.mul
12 Bit number, Low Nibble of Byte #14 (Bits 3…0) = Bits 11..8 of Index, Byte #15 = Bits 7…0 of Index

· UNKNOWNS = ( (NUMWORDS div 2) *3 ) + (NUMWORDS % 2) - 1
div = Integeger division, % = modulo operation, NUMWORDS >= 1
examples: UNKNOWNS(1)=0, UNKNOWNS(2)=2, UNKNOWNS(3)=3, UNKNOWNS(4)=5, UNKNOWNS(5)=6,
UNKNOWNS(6)=8, UNKNOWNS(7)=9, UNKNOWNS(8)=11, UNKNOWNS(9)=12

· BYTE[UNKNOWNS]
Idea behind this is getting speech parsing load client side.
Thus this contains data OSI server use for easier parsing.
It's client side hardcoded and exact details are unkown.

· BYTE[?] Ascii Msg - Null Terminated (blockSize - (15+UNKNOWNS) )

· else

· BYTE[?][2] Unicode Msg - Null Terminated (blockSize - 12)

Note1: For pre 2.0.7 clients Type is always < 0xc0

Note2: Uox based emus convert post 2.0.7 data of this packet to pre 2.0.7 data if Type >=0xc0

Note3: (different view of it)

If Mode&0xc0 then there are keywords (from speech.mul) present.

Keywords:

The first 12 bits = the number of keywords present. The keywords are included right after this, each one is 12 bits also.

The keywords are padded to the closest byte. For example, if there are 2 keywords, it will take up 5 bytes. 12bits for the number, and 12 bits for each keyword. 12+12+12=36. Which will be padded 4 bits to 40 bits or 5 bytes.

0xAE Packet

Last Modified on Wednesday, 11-Nov-1998

Unicode Speech message(Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] ID

· BYTE[2] Model

· BYTE Type

· BYTE[2] Color

· BYTE[2] Font

· BYTE[4] Language

· BYTE[30] Name

· BYTE[?][2] Msg - Null Terminated (blockSize - 48)

0xAF Packet

Last Modified on Tuesday, 20-Apr-1999

Display Death Action (13 bytes)

· BYTE cmd

· BYTE[4] player id

· BYTE[4] corpse id

· BYTE[4] unknown (all 0)

0xB0 Packet

Last Modified on Tuesday, 20-Apr-1999

Send Gump Menu Dialog (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] id

· BYTE[4] gumpid

· BYTE[4] x

· BYTE[4] y

· BYTE[2] command section length

· BYTE[?] commands (zero terminated)

· BYTE[2] numTextLines

· BYTE[2] text length (in unicode (2 byte) characters.)

· BYTE[?] text (in unicode)

0xB1 Packet

Last Modified on Sunday, 28-Jul-2002

Gump Menu Selection (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] id (first Id in 0xb0)

· BYTE[4] gumpId (second Id in 0xb0)

· BYTE[4] buttonId (which button perssed ? 0 if closed)

· BYTE[4] switchcount (response info for radio buttons and checkboxes, any switches listed here are switched on)

For each switch

· BYTE[4] SwitchId

BYTE[4] textcount (response info for textentries)

For each textentry

· BYTE[2] textId

· BYTE[2] textlength

· BYTE[length*2] Unicode text (not nullterminated)

0xB2 Packet

Last Modified on Friday, 10-Oct-1998 18:42:09 EDT

Chat Message (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[2] messageType

If message type==0x03EB (Display Enter Username window)

· BYTE[8] unknown (all 0's)

If message type==0x03ED (Username accepted, display window)

· BYTE[4] unknown (all 0's)

· BYTE[?][2] unicode username

· BYTE[4] unknown (all 0's)

If message type==0x03E8

· BYTE[4] unknown (all 0's)

· BYTE[?][2] unicode channel name

· BYTE[2] unknown (0x0000)

· BYTE[2] unknown (0x0030)

· BYTE[2] unknown (0x0000)

0xB5 Packet

Last Modified on Friday, 10-Oct-1998 18:42:09 EDT

Open Chat window (64 bytes)

· BYTE cmd

· BYTE[63] chatname, if known by client (all 00 if unknown) (name in unicode)

This message is very incomplete. From the server, just know that it is 0xB5 len len, and pass the data through as is appropriate.

0xB6 Packet

Last Modified on Thursday, 12-Nov-1998

Send Help/Tip Request (9 bytes)

· BYTE cmd

· BYTE[4] id

· BYTE[1] language # (1 for enu)

· BYTE[3] language name (enu for English - United states)

0xB7 Packet

Last Modified on Thursday, 19-Nov-1998

Help/Tip Data (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE[4] id

· BYTE[?][2] message, in unicode

· BYTE[2] null terminator (0x0000)

· BYTE[2] message terminator (0x3300)

0xB8 Packet

Last Modified on Monday, 02-Sep-2002

Request Char Profile (Variable # of bytes)

· BYTE cmd

· BYTE[2] blockSize

· BYTE mode (CLIENT ONLY! Does not exist in server message.)

· BYTE[4] id

If request, ends here.

If Update request

· BYTE[2] cmdType (0x0001 - Update)

· BYTE[2] msglen (# of unicode characters)

· BYTE[msglen][2] new profile, in unicode, not null terminated.

Else If from server

· BYTE[?] title (not unicode, null terminated.)

· BYTE[?][2] static profile ( unicode string can't be edited )

· BYTE[2] (0x0000) (static profile terminator)

· BYTE[?][2] profile (in unicode, can be edited)

· BYTE[2] (0x0000) (profile terminator)

0xB9 Packet

Last Modified on Wednesday 12-Feb-2003

Enable locked client features (3 bytes)

· BYTE cmd

· BYTE[2] feature#
if (MSB not set)
Bit# 1 T2A upgrade, enables chatbutton,
Bit# 2 enables LBR update. (of course LBR installation is required)
(plays MP3 instead of midis, 2D LBR client shows new LBR monsters,…)
if (MSB set)
Bit# 3 T2A upgrade, enables chatbutton,
Bit# 4 enables LBR update.
Bit#5 enables AOS update (Aos monsters/map (AOS installation required for that) ,
AOS skills/necro/paladin/fight book stuff - works for ALL clients 4.0 and above)

Server Message

Note1: this message is send immediately after login.
Note2: on OSI servers this controls features OSI enables/disables via "upgrade codes."

Note3: a 3 doesn't seem to "hurt" older (NON LBR) clients.

0xBA Packet

Last Modified on Sunday, 13-Feb-2000

Quest Arrow (6 bytes)

· BYTE cmd

· BYTE active (1=on, 0=off)

· BYTE[2] xLoc

· BYTE[2] yLoc

Server Message

0xBB Packet

Last Modified on Sunday, 30-Jan-2000

Ultima Messenger (9 bytes)

· BYTE cmd

· BYTE[4] id1

· BYTE[4] id2

Note: This is both a client and server message.

0xBC Packet

Last Modified on Friday, 19-May-2000

Seasonal Information(3 bytes)

· BYTE cmd

· BYTE id1

· BYTE id2

Note: Server message

Note: if id2 = 1, then this is a season change.

Note: if season change, then id1 = (0=spring, 1=summer, 2=fall, 3=winter, 4 = desolation)

0xBD Packet

Last Modified on Wednesday, 28-Aug-2002

Client Version Message (Variable # of bytes)

· BYTE cmd

· BYTE[2] len

· If (client-version of packet)
BYTE[len-3] string stating the client version (0 terminated) (like: "1.26.4")

Note: Client + Server Message
Client version : client sends its version string (e.g "3.0.8j")
Server version : 0xbd 0x0 0x3 (client replies with client version of this packet)

Note2: clients sends a client version of this packet ONCE at login (without server request.)

0xBE Packet

Last Modified on Wednesday, 28-Aug-2002

Assist Version (Variable # of bytes)

· BYTE cmd

· BYTE[2] len

· If (client-version of packet)

· BYTE[4] Assist version (numeric)

· BYTE[?] string stating the client version (0 terminated) (like: "1.26.4")

· If (server-version of packet) BYTE[4] Allowed Assist version (numeric)

Note: server requests assist version via server side version of this packet, client replies with client side version of packet.
If it's a client without Assist, allowed Assists version from server is relayed in client version packet.
Because assist never has assist version 0, that would be a way to disallow it.

0xBF Packet

Last Modified on Sunday,28-Feb-20002

The 0xBF packet starts off with a cmd byte, followed by two bytes for the length. After that is a two byte value which is a subcmd, and the message varies after that.

General Info (5 bytes, plus specific message)

· BYTE cmd

· BYTE[2] len

· BYTE[2] subcmd

· BYTE[len-5] submessage

Note: Client & Server message

Subcommand 1: Initialize Fast Walk Prevention

· BYTE[4] key1

· BYTE[4] key2

· BYTE[4] key3

· BYTE[4] key4

· BYTE[4] key5

· BYTE[4] key6

Note: Server Message

Note: This sets up stack on the client and whenever it moves, it takes the top value from this stack and uses it. (key1 starts at the top, key6 at the bottom).

Subcommand 2: Add key to Fast Walk Stack

· BYTE[4] newkey

Note: Server Message

Note: This key is added to the top of the stack. In other words, it's the one that will be used next. Basically, the other 5 only get used when the client is sending moves faster than the server is responding.

Subcommand 4: "Close Generic Gump"

BYTE[4] dialogID // which gump to destroy (second ID in 0xB0 packet)
BYTE[4] buttonId // response buttonID for packet 0xB1

Subcommand 5: Screen size

· BYTE[2] unknown1 , always 0 ?

· BYTE[2] X

· BYTE[2] Y

· BYTE[2] unknown2

Note: Client Message

Subcommand 6: Party System (YES! Subsubcommands)

· BYTE subsubcommand #

Subsubcommand 1: Add a party member (4 bytes)

· BYTE[4] id (if 0, a targeting cursor appears)

Note: Client Message

Subsubcommand 1: Add party member(s) (1+ numMembers*4)

· BYTE numMembers (total number of members in the party)

Then, for each member in numMembers:

· BYTE[4] id

Note: Server Message

Subsubcommand 2: Remove a party member (4 bytes)

· BYTE[4] id (if 0, a targeting cursor appears)

Note: Client message

Subsubcommand 2: Remove a party member (? Bytes)

· BYTE numMembers (total number of members in the new party)

· BYTE[4] idofPlayerRemoved

Then, for each member in numMembers:

· BYTE[4] id

Note: Server message

Subsubcommand 3: Tell party member a message (Variable # of bytes)

· BYTE[4] id (of target, from client, of source, from server)

· BYTE[n][2] Null terminated Unicode message.

Note: Client & Server Message

Subsubcommand 4: Tell full party a message (Variable # of bytes)

· BYTE[n][2] Null terminated Unicode message.

Note: Client Message.

Subsubcommand 4: Tell full party a message (Variable # of bytes)

· BYTE[4] id (of source)

· BYTE[n][2] Null terminated Unicode message.

Note: Server Message

Subsubcommand 6: Party Can Loot Me? (1 byte)

· BYTE canloot (0=no, 1=yes)

Note: Client message

Subsubcommand 8: Accept join party invitation (4 bytes)

· BYTE[4] id (party leader's id)

Note: Client message

Subsubcommand 9: Decline join party invitation (4 bytes)

· BYTE[4] id (party leader's id)

Note: Client message

Subcommand 8: Set cursor hue / Set MAP

· BYTE hue (0 = Felucca, unhued / BRITANNIA map. 1 = Trammel, hued gold / BRITANNIA map, 2 = (switch to) ILSHENAR map)

Note: Server Message

Subcommand 0x0a: wrestling stun

Subcommand 0x0b: Client Language

· BYTE[3] language (ENU, for English)

Note: Client Message, send once at login

Subcommand 0x0c: Closed Status Gump

· BYTE[4] id (character id)

Note: Server Message

Subcommand 0x0f: unknown , send once at login, client message

· BYTE[5] unknown (0a 00 00 00 07) here

Subcommand 0x13: Request popup menu

· BYTE[4] id (character id)

Note: Client Message

Subcommand 0x14: Display Popup menu

BYTE[2] Unknown(always 00 01)
BYTE[4] Serial
BYTE Number of entries in the popup
For each Entry

· BYTE[2] Entry Tag (this will be returned by the client on selection)

· BYTE[2] Text ID ID is the file number for intloc#.language e.g intloc6.enu and the index into that

· BYTE[2] Flags 0x01 = locked, 0x02 = arrow, 0x20 = color

· If (Flags &0x20)

BYTE[2] color; // rgb 1555 color (ex, 0 = transparent, 0x8000 = solid black, 0x1F = blue, 0x3E0 = green, 0x7C00 = red)

Note: Server Side Message

TextID is broken into two decimal parts:

stringID / 1000: intloc fileID
stringID % 1000: text index

So, say you want the 123rd text entry of intloc06, the stringID would be 6123

Subcommand 0x15: Popup Entry Selection

BYTE[4] Character ID
BYTE[2] Entry Tag for line selected provided in subcommand 0x14

Subcommand 0x17: Codex of wisdom

BYTE unknown, always 1. if not 1, packet seems to have no effect
BYTE[4] msg number
BYTE presentation (0: "?" flashing, 1: directly opening)

Note: server side packet.
Shows codex of wisdom's text #msg. (msg is linearised (including sub indices) index number starting with 1)

Subcommand 0x18: Enable map-diff (files)

BYTE[4] Number of maps

For each map

· BYTE[4] Number of map patches in this map

· BYTE[4] Number of static patches in this map

Note: server side packet, number of maps: currently 3 (0 = Fellucca, 1 = Trammel, and 2 = Ilshenar)

This packet is sent by the server to the client, telling the client to use the mapdif* and stadif* files for patching map and statics.

Subcommand: 0x19: Extended stats

BYTE type // always 2 ? never seen other value
BYTE[4] serial
BYTE unknown // always 0 ?
BYTE lockBits // Bits: XXSS DDII (s=strength, d=dex, i=int), 0 = up, 1 = down, 2 = locked

Note:server side packet
Send after 0x11

Subcommand: 0x1a: Extended stats

BYTE stat // 0: str, 1: dex, 2:int
BYTE status // 0: up, 1:down, 2: locked

Note:client side packet, send if player changed stats (lock) status

Subcommand 0x1b: New Spellbook

BYTE[2] unknown, always 1
BYTE[4] Spellbook serial
BYTE[2] Item Id
BYTE[2] scroll offset // 1==regular, 101=necro, 201=paladin
BYTE[8] spellbook content // first bit of first byte = spell #1, second bit of first byte = spell #2, first bit of second byte = spell #8, etc

Note: related packet: subcommand 1c, client side

Subcommand 0x1c: Spell selected, client side

BYTE[4] serial // player
BYTE[2] selected spell // 4=heal, 5=magic arrow etc

Subcommand 0x21: (AOS) Ability icon confirm.

Note: no data, just (bf 0 5 21), server side packet
Send after 0xd7. exact purpose unknown

Subcommand 0x22: Damage

BYTE[2] unknown, always 1
BYTE[4] Serial
BYTE Damage // how much damage was done ?

Note: displays damage above the npc/player's head.

0xC0 Packet

Last Modified on Friday, 26-Jul-2002

(yet another) Graphical Effect (36 Bytes)

BYTE cmd
BYTE type
BYTE[4] sourceSerial
BYTE[4] targetSerial
BYTE[2] itemID
BYTE[2] xSource
BYTES[2] ySource
BYTE zSource
BYTE[2] xTarget
BYTE[2] yTarget
BYTE zTarget
BYTE speed
BYTE duration
BYTE[2] unk // On OSI, flamestrikes are 0x0100
BYTE fixedDirection
BYTE explodes
BYTE[4] hue
BYTE[4] renderMode

Server message

0xC1 Packet

Last Modified on Monday, 4'th-August-20002

Predefined Message (localized Message) (Variable # of bytes )

· BYTE cmd

· BYTE[2] length

· BYTE[4] id (0xffff for system message)

· BYTE[2] body (0xff for system message)

· BYTE type (6 - lower left, 7 on player)

· BYTE[2] hue

· BYTE[2] font

· BYTE[4] Message number

· BYTE[0x20] - speaker's name

· BYTE[?*2] - arguments // _little-endian_ unicode string, tabs ('\t') seperate the arguments

Server message

Argument example:

take number 1042762:

"Only ~1_AMOUNT~ gold could be deposited. A check for ~2_CHECK_AMOUNT~ gold was returned to you."

the arguments string may have "100 thousand\t25 hundred", which in turn would modify the string:

"Only 100 thousand gold could be deposited. A check for 25 hundred gold was returned to you."

0xC2 Packet

Last Modified on Friday, 30'th-August-20002

Textentry Unicode (Variable # of bytes )

· BYTE cmd

· BYTE[2] length

· BYTE[4] player id

· BYTE[4] message id

· If (server_version of this packet) BYTE[10] all 0's .. have to be there, otherwise client crash

· If (client_version)

· BYTE[4] unknown, always 1

· BYTE[3] language code, i.e. DEA, ENU …

· BYTE[ ?] unicode Text

Note : protocol : server starts with a server side 0xc2. server can pick any message id to identify it.

The next text entry from client after 0xc2 server side -> client replies with a 0xc2 client side.
(first 11 bytes relayed from server packet, plus 0 0 0 1 plus 3 bytes language code + Unicode text)
Server side packet always has length 0x15.

0xC4 Packet

Last Modified on Monday, 4'th-Augst-2002

Semivisible, 6 Bytes

BYTE cmd
BYTE[4] ID
BYTE intensity ?

Note: Server Message
It has been never encountered in the wild (=on OSI servers)
What this effect is supposed to do is completely unknown.
It sets target more or less blue (dependant on intensity value).
Only for 2d clients, for 3d clients it does nothing.
Perhaps implementation client side not finished ?

0xC7 Packet

Last Modified on Sunday, 28-Jul-2002

3D client particle effect (49 Bytes)

BYTE cmd
BYTE[35]…. Preamble … exactly like 0xC0
BYTE[2] effect # (see particleffect subdir!)
BYTE[2] explode effect # (0 if no explosion)
BYTE[2] additional effect # that's only used for moving effects, 0 otherwise
BYTE[4] if target is item (type 2) that's itemId, 0 otherwise
BYTE layer (of the character, e.g left hand, right hand, … 0-4, 0xff: moving effect or target is no char)
BYTE [2] yet another (unknown) additional effect that's only set for moving effect, 0 otherwise

Note: 2d clients understand it as well, but default to "old effects".

0xC8 Packet

Last Modified on Monday, 4'th-Sep-2002

Client view range (2 Bytes)

BYTE cmd
BYTE range

Note: client+server packet.
Range: how far away client wants to see (=get send) items/npcs

Update: since client 3.0.8o it actually got activated.(in a useful way)
When increase/decrease macro send, client sends a 0xc8.
If and only if server "relays" the packet (sending back the same data) range stuff gets activated client side.
"Greying" has no packet, purely client internal.
Minimal value:5, maximal: 18

0xC9 Packet

Last Modified on Monday, 19'th-Aug-2002

Get area server ping (6 Bytes)

BYTE cmd
BYTE sequence // initially 1, wraps after 255 to 0
BYTE [4] tickcount

Note: Client sends packet with it's tick count

Server replies with same packetID/sequence and it's own tick count

Over a few packets, the client can deduct a reasonably accurate ping number.

Currently only used/ implemented in god client

0xCA Packet

Last Modified on Monday, 19'th-Aug-2002

Get user server ping (6 Bytes)

BYTE cmd
BYTE sequence // initially 1, wraps after 255 to 0
BYTE [4] tickcount

Note: see 0xc9

0xCB Packet

Last Modified on Friday, 30'th-Aug-2002

GQ count (7 Bytes)

BYTE cmd
BYTE [2] unknown
BYTE [4] count

Note: displays a message:" There are currently [count] available calls in the global queue

0xCC Packet

Last Modified on Monday, 4'th-August-20002

"Localized Message Affix" (variable length)

· BYTE cmd

· BYTE[2] length

· BYTE[4] id (0xffff for system message)

· BYTE[2] body (0xff for system message)

· BYTE type (6 - lower left, 7 on player)

· BYTE[2] hue

· BYTE[2] font

· BYTE[4] Message number

· BYTE flags
0x02 is unknown.
0x04 signals the message doesn't move on screen.
(flags & 0x1) == 0 signals affix is appended to the localization string, (flags & 0x1) == 1 signals to prepend.

· BYTE[0x20] - speaker's name

· BYTE[?] affix / null terminated

· BYTE[?]*2] arguments; // _big-endian_ unicode string, tabs ('\t') seperate arguments, see 0xC1 for argument example

0xD0 Packet

Last Modified on Sunday, 28-Jul-2002

"Configuration File" (dynamic length)

BYTE cmd
BYTE[2] length;
BYTE type; // file type, not sure of precise values
BYTE[length-4] unknown; // encoded in some form

Note, sent if (flag & 0x02) in packet 0xA9
Note: (probably) Used for saving client configuration files server side.
OSI used it for the IGR shard only that is not anymore.
Not sure what configuration files are, perhaps those in /desktop/player dir

Encoding/(compression?) completely unknown
Note: there's a client and server version of it.
If on, client sends them 5 times (5 files) at login.
After logout (0xd1) it expects server versions of 0xd0 and finally a server version of 0xd1

0xD1 Packet

Last Modified on Sunday, 28-Jul-2002

"Logout Status" 2 Byte length

BYTE cmd
BYTE unknown // always 1

Note, client sends on logout if (flag & 0x02) in packet 0xA9,
when server responds with same packet, client finishes logging out

0xD2 Packet

Last Modified on Sunday, 30-Aug-2002

"Extended 0x20" 25 Byte length

BYTE cmd
Preamble: Exactly like 0x20
BYTE[2] unknown 1
BYTE[2] unknown 2
BYTE[2] unknown 3

Note: currently unknown's don't seem to do anything.
That packet has never been sighted on OSI servers as well.
We probably have to wait till OSI activates it/finishes implementation., to see what it does.

0xD3 Packet

Last Modified on Sunday, 30-Aug-2002

"Extended 0x78" dynamic length

BYTE cmd
Preamble: Exactly like 0x78
BYTE[2] unknown 1
BYTE[2] unknown 2
BYTE[2] unknown 3

Note: see 0xd2 notes

0xD4 Packet

Last Modified on Monday, 19'th-Aug-2002

"new Book Header" (Variable# Bytes)

BYTE cmd
BYTE[2] length
BYTE[4] book ID
BYTE flag1
BYTE flag2
BYTE[2] number of pages
BYTE[2] length of author string (0 terminator included)
BYTE[?] author (ASCII, 0 terminated)
BYTE[2] length of title string (0 terminator included)
BYTE[?] title string

Note: replaced 0x93 on OSI servers, "0xd4 books" are rendered differently
clients still understand "old" 0x93

Note1
server and client packet.

server side: opening book writeable: flag1+flag2 both 1
(opening readonly book: flag1+flag2 0, unverified though)

client side: flag1+flag2 both 0, number of pages 0.

Note2

Opening books goes like this:
open book ->
server sends 0xd4(title + author)
server sends 0x66 with all book data "beyond" title + author

if title + author changed: client side 0xd4 send

if other book pages changed: 0x66 client side send.

0xD6 Packet

Last Modified on Wednesday, 12'th-Feb-2003

"AOS tooltip/Object property list" (Variable# Bytes)

BYTE cmd
BYTE[2] length
BYTE[2] unknown1, always 1
BYTE[4] serial
BYTE unknown2, always 0
BYTE unknown3, always 0
BYTE[4] list ID (see notes)
Loop
BYTE[4] Localization#
if (Localization#==0) break loop
BYTE[2] text length
BYTE[text length] little endian Unicode text, not 0 terminated

Note1: The "tooltip thing" that displays object data send via this packet is only active if common AOS is activated via 0xA9

Note2: server side packet only

Note3: Also related to 0xD6: 0xbf sub 0x10

Server version of 0xbf: Query client (do you need tooltip data for Object x ? ) , sends list ID+Object-ID

Client version: If it needs it (cache-miss), replies with a client 0xbf 0x10 (sends Object Id)
Note4: Actual 0xd6's are send AFTER n>=1 pairs of server/client 0xbf 0x10's
Note5: The text is to fill in the localized message arguments.
It works like the other argument-based localized message packets.
The strings are tab-delimited.

Take the localized message:

1050044 "~1_COUNT~ items, ~2_WEIGHT~ stones".

The entry might be be:

int localizationnumber = 1050044;

string text = "5\t10"; // 5 items, 10 stones

The localization string they use for NPC tooltips is:

1050045 "~1_PREFIX~~2_NAME~~3_SUFFIX~"

0xD7 Packet

Last Modified on Wednesday, 12'th-Feb-2003

"Fight book/system" (Variable# Bytes)

BYTE cmd
BYTE[2] length
BYTE[4] serial // player
BYTE[2] unknown, always 0x19
BYTE[4] unknown, always 0
BYTE selected ability (icon) // 1 armor ignore, 2 bleed attack … 13 whirlwind attack
BYTE unknown, always 7

Note: when weapon is changed, ability icons automatically change, but client does NOT notify server.

Note2: Fightbook only appearing when common AOS activated via 0xa9

0xD8 Packet

Last Modified on Wednesday, 12'th-Feb-2003

"Custom house" (Variable# Bytes)

BYTE cmd
BYTE[2] length
BYTE unknown1
BYTE unknown2
BYTE [4] multi serial
BYTE [4] cache-ID
BYTE [2] itemcount
BYTE[2] (compressed) buffer length
BYTE[buffer length] item list, compressed. Compression scheme unknown yet.

Note: server side packet

0xF0 Packet

Last Modified on Monday, 4'th-Aug-2002

Krrios client special

· BYTE cmd

· BYTE[2] len

· BYTE subcmd

· BYTE[len - 4] data

Subcommand 0: Acknowledge login (1 byte (for 5 total))

· BYTE ack (0 = Rejected, unauthorized. 1 = Accepted, GM priviledges. 2 = Accepted, player priviledges)

Note: Server Message

Note: GM priviledges unlock movement rate configurations