MySEQ and p1999

[aimon]

Does MySEQ work on current version of P1999?

[BlueAdept]

Moved post to MySEQ instead of SEQ.

[eqmule]

yes it does as long as you have the offsets for whatever client that server uses. I was under the impression there are like 5 different supported with titanium being the most common?

[aimon]

I've been out of the game for awhile, last version I used was 2.3.1.0 but no longer works. What version works and what offsets now?

[eqmule]

I would have to know what version of eqgame.exe you are using to answer that.

[jmac]

yes it does as long as you have the offsets for whatever client that server uses. I was under the impression there are like 5 different supported with titanium being the most common?

p99 only supports titanium client, perhaps you mean the general eqemu servers? Also p99 encrypts the packets so I believe its more than just the eqgame.exe offsets? It's weird because I thought myseq just reads from memory and doesn't do anything with packets

There is a version on RGs from 2013, and aimon's post about version 2.3.1.0 is also from 2013, which I believe is after the encryption update. So the question remains, anyone have working myseq or showeq for p99 in 2015?

edit* ShowEQ Help Deskappears some users have it working

[eqmule]

I'm a bit busy today but now that I know you are using the titanium client I should be able to get offsets that work for it, if u don't hear from me within 48 hours send me a pm or bump this post.

[eqmule]

ok here you go, these are for the titanium client: paste these into myseqserver.ini and run with latest myseq see my signature for download location
don't forget to start both server and myseq.exe as admin.


#
# Copyright (C) 2006, 2007 All developers at http://sourceforge.net/projects/seq
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
#

[File Info]
PatchDate=10/31/2005

[Port]
port=5555

[Memory Offsets]
ZoneAddr=0x923a20
TargetAddr=0x905d04
CharInfo=0x905ce4
SpawnHeaderAddr=0x905ce4
ItemsAddr=0x905cc8
WorldAddr=0x905cc0

[WorldInfo Offsets]
worldHourOffset=4
WorldMinuteOffset=5
WorldDayOffset=6
WorldMonthOffset=7
WorldYearOffset=8

[SpawnInfo Offsets]
NameOffset=0x120
NextOffset=0x220
PrevOffset=0x214
LevelOffset=0x24c
XOffset=0x30
YOffset=0x34
ZOffset=0x38
LastnameOffset=0x1
RaceOffset=0x260
HideOffset=0x250
ClassOffset=0x252
TypeOffset=0x244
SpeedOffset=0x48
HeadingOffset=0x4c
SpawnIDOffset=0x258
PrimaryOffset=0x1fc
OffhandOffset=0x200

[GroundItem Offsets]
PrevOffset=0x00
NextOffset=0x04
NameOffset=0x2c
IdOffset=0x08
DropIdOffset=0x0c
XOffset=0x28
YOffset=0x24
ZOffset=0x20

# Using the new Debug CLI
# =======================
# To start the server in debug mode, run the server with the 'debug' argument:
#
# myseqserver debug
#
# You will see the menu, which looks like this:
#
# Debug Menu
# =======================
# d) display current offsets
# r) reload all offsets from INI file
# spo) set a primary offset (index/name) (hex value)
# sso) set a secondary offset (index/name) (hex value)
# ez) examine raw data using pZone
# et) examine raw data using pTarget
# ew) examine raw data using pWorld
# fz) find zonename using pZone (zonename)
# ft) find spawnname using pTarget (spawnname)
# fs) find spawnname using pSelf (spawnname)
# ps) process a spawn entity using pSelf
# pt) process a spawn entity using pTarget
# sp) scan process names (process name)
# sft) scan for floating point using pTarget (X,Y,Z)
# sfa) scan for floating point using Address (X,Y,Z,Address)
# sfw) scan for world offsets using game date (mm/dd/yyyy)
# sg) scan for ground items
# ws) walk the spawnlist (reverse) using pSelf
# wt) walk the spawnlist (reverse) using pTarget
# vs) walk the spawnlist (forward) using pSelf
# vt) walk the spawnlist (forward) using pTarget
# x) exit
#
# >
#
#
# To select a command, type it in and press Enter. Some commands require
# arguments, which are indicated in parenthesis.
#
# If you are having troubling just accessing the EQ process, first try the 'scan process names' command:
# > sp
#
# You can provide an optional process name to attempt to scan for and access, but if you do not provide
# any arguments, then it will default to 'eqgame'. You will see a list of processes detected on your system
# and if a match is found, it will try and access it, providing feedback on the results. Prior to server v1.19.1,
# this was a case-sensitive match. For server v1.19.1 and higher, the check is case-insensitive. We had some
# problems on a Win2K system regarding this.
#
# When new offsets are needed, you can start the server in debug mode and it will use the
# old offsets as starting points to locate the new offsets.
#
# The first thing is to locate the zonename. Just enter a zone that you know the name of, like the Bazaar,
# and use the "fz" command along with the appropriate shortname for the zone:
# > fz Bazaar
#
# You should see a list of matches. Anyone of them could potentially be a valid pZone value. Select one and
# place it in the INI file above under ZoneAddr. Now press 'r' to reload the INI file into the debug server.
# Press 'd' to verify your change was actually loaded.
#
# Next we want to locate the pTarget value, stored above as TargetAddr. Inside the game, select any target NPC
# or PC other than yourself. It is best to select a uniquely named NPC, like "Boss Hogg". Do not select an NPC
# with a re-used name, like "a rat". Now you need to determine the hidden name of that NPC. To do this, replace
# any spaces in the name with underscores, and stick a 00 on the end. So "Boss Hogg" becomes "Boss_Hogg00".
# Use this hidden name as the sole argument to the 'ft' command:
# > ft Boss_Hogg00
#
# You should see a list of matches. Anyone of them could potentially be a valid pTarget. Select one and
# place it in the INI file above under TargetAddr. Press 'r' to reload the INI file.
#
# Next we want to locate the pSpawnlist value, stored above as SpawnHeaderAddr. This is very easy once you have
# pTarget done above. Simply select any target in the game and use the 'wt' command:
# > wt
#
# You should see a long list of spawn information dump out. At the end, we do an automatic scan looking for
# where that entry point pointer lives. You should see a list of matches. Anyone of them could potentially be
# a valid pSpawnlist. Select one and place it in the INI file above under SpawnHeaderAddr. Press 'r' to reload
# the INI file.
#
# Next we want to locate the pSelf value, store above as CharInfo. Inside the game, select yourself as the
# target (press F1) and use the 'ft' command along with your characters first name:
# > ft Yourfirstname
#
# You should see a list of matches. Anyone of them could potentially be a valid pSelf. Select one and
# place it in the INI file above under CharInfo. Press 'r' to reload the INI file.
#
# Last we want to locate the pGroundItems value, stored above as ItemsAddr. Just use the 'sg' command and
# look for matched pointers that look like 'ITxxxxx_ACTORDEF', where xxxxx is any 3 or 5 digit number.
# > sg
# Scanning for 'IT' from 0x7d62c4 to 0x9d62c4
# Pointer match found at 0x8d62c4. Full string is IT10805_ACTORDEF
# Pointer match found at 0x9bc648. Full string is ITORTOKEN
#
# Of course the first one here looks good. Put it in the INI file above under ItemsAddr. Press 'r' to
# reload the INI file.
#
# You can now exit the server (press 'x') and restart it in normal mode. Try attaching the client to it.
# As long as none of the secondary offsets have changed, it should work. If it only works for a short time
# and then stops working, repeat the above procedure, but this time make different selections in the match
# lists.
#
# If the secondary offsets have changed, or the basic design of how they obtain spawn information, the server
# may need to be updated. The other debug options can be used to aid in locating secondary offsets, but it
# is so involved that it is probably best to use a full blown RAM editor. Please visit our forums to learn
# how to help ( http://www.showeq.net/ and look for the MySEQ subforums).
#
# Notes:
# - All string searches are case sensitive!
# - As you get matches, write them all down! If a function works for a minute or so and then stops working, try the
# next match in the list.
# - If you use the spo/sso functions, the changes are NOT made in the INI file. Once you exit, those changes are lost.
# - Only reverse walks (wt/ws) will scan for entry point pointers. Forward walks will just show the spawns and return.

[eqmule]

Something to note about p99 is that it scan process names as well as window titles so if you are going to use mySEQ make sure you rename the executables and change window titles.

[jmac]

is that really all that needs to be done to circumvent p99 detection for mySEQ?

[eqmule]

For now yes I see no evidence of anything else than that being done so if you rename it to notepad.exe they would have no reason to believe it's nothing but notepad.exe running... On the other hand even if you where running myseq.exe who is to say you're not running it to see the map of a live eqgame session you are running on another machine? Anyway they can ban on pure suspicion as well so it's not exactly a benefit of the doubt and fair situation here... I know I run multiple boxes for live at the same time as I run boxes for test so if I where to fire up a p99 as well I guess that would put me at risk...

[eqmule]

The best thing is obviously to build your own version cause then the md5 on the exe won't match if they decided to do hash checking on every running process on your system, that's kinda nice when dealing with open source... You can build your own version and name it anything u want...

[eqmule]

I suppose hex editing just one byte or changing the version with some version change tool or even sign it with your own cert would change md5 too if you feel that building it from scratch is too much of a pain.

[jmac]

ok thanks for the info eqmule, i'll build from source and use it and let this thread know if i ever get banned.

*edit ok yea im too lazy to build from source lol

I edited a couple bytes inside the server and client which generated different/new md5 checksums

I renamed the .exe's

I wrote a c++ program to open the client and change the window title from "MySEQ Open" to something else.


*edit whoops looks like when you log your character on the client changes the title to "MySEQ Open - CharacterName" so...

if i look at task manager, i have my renamed_server.exe and renamed_client.exe just fine... but if i look at the applications tab (which shows processes by window title) i see "MySEQ Open - CharacterName"

How should I handle that? Wouldn't changing the title after I'm already in game be too late?

[eqmule]

Yes that is too late then uhm let me think on it some I could add a window title setting to the Ini unless one already exist?

[jmac]

Yes that is too late then uhm let me think on it some I could add a window title setting to the Ini unless one already exist?

any luck on this? I myself couldn't find an ini setting for window title

[eqmule]

There has been so many patches the last weeks I haven't had time to look into this I'll see what I can do thanks for the reminder

[squirreldog]

So technically if I only open the program while im in the zone its also undetectable in 1999? As long as I don't zone with in on?

[eqmule]

No they can scan at any time

[jmac]

banned.

I had recompiled the client and server source myself changing all instances of the word "MySEQ" or "EqMule". Edited the source to changed window title, changed assembly information, removed the title from showing character name. I used it for about 3 months fine, however the first month I used the default port of 5555. I want to believe the port is what got me caught.

anyone else know what I could have missed?