Here are my findings for the 5517 client.
Code: Select all
00764CE7 = tmpnam
00764D9A = DeleteFileA (Call)
007B714F = Push EDX
007B7150 = FOPEN
007B7149 = Should be changed from JGE to JMP.
007B7158 = MOV EDX [FILE THAT WILL BECOME THE SERVER.DAT] (i used: MOV EDX, 00940450 // ini/ItemtypeSub.dat )
007B715E = JMP 007B714F
00765716 = JE Conquer-.007657A0 > This JE should be changed to JNZ
I've been private messaging with Adrian about removing the blacknull check from the client, since you can't find it with string reference.
Adrian found out that you can find it in the HEX window in OllyDBG, so from that point he was able to play around with the jumps around that opcode. (Thanks for the help with that).
After that i've been following the guide in the first post of this topic, from which i posted my opcodes up here.
The issue with this is that i am not able to change the row amount or names in the outerserver.xml, so for example you have server names like Lucky7
, you can change it to Lucky8 or Tests1 but if you use a name which is longer or shorter it won't load the servers anymore.
Its the same with the rows in the XML file, if you remove rows, to keep only 1 server group and 1 server, the 'custom' server.dat won't load, you will see an empty server list.
If anybody else know the answer to this problem, feel free to post it :-), for now this is the start of my try.
My guess here is that the client loads the original server.dat and saves the row count and the names somewhere in the memory, to check those later.
I'm still debugging the client, but for now i've got no new info, when i have, i'll post it here.
I added the last OPCode in the code tags of this post which should be changed to make it work.
After i changed that last one, i was able to load my own serverlist.