How to find offsets

[ZoneZ]

The guides I've looked through either require win98, programs that don't exist anymore, or functionality that is no longer relevant.I've got the time and drive to find these things if there's someone out there that can help point me in the right direction. Hell, I'll make an updated guide to doing it if that helps.

[pgoesinya]

Hello.

Did you follow the steps that are in the myseqserver.ini file? Last time I messed with this about 2 years ago it still worked, is just a bit time consuming:

# When new offsets are needed, you can start the server in debug mode and it will use the
# old offsets as starting points to locate the new offsets.
#
# The first thing is to locate the zonename. Just enter a zone that you know the name of, like the Bazaar,
# and use the "fz" command along with the appropriate shortname for the zone:
# > fz Bazaar
#
# You should see a list of matches. Anyone of them could potentially be a valid pZone value. Select one and
# place it in the INI file above under ZoneAddr. Now press 'r' to reload the INI file into the debug server.
# Press 'd' to verify your change was actually loaded.
#
# Next we want to locate the pTarget value, stored above as TargetAddr. Inside the game, select any target NPC
# or PC other than yourself. It is best to select a uniquely named NPC, like "Boss Hogg". Do not select an NPC
# with a re-used name, like "a rat". Now you need to determine the hidden name of that NPC. To do this, replace
# any spaces in the name with underscores, and stick a 00 on the end. So "Boss Hogg" becomes "Boss_Hogg00".
# Use this hidden name as the sole argument to the 'ft' command:
# > ft Boss_Hogg00
#
# You should see a list of matches. Anyone of them could potentially be a valid pTarget. Select one and
# place it in the INI file above under TargetAddr. Press 'r' to reload the INI file.
#
# Next we want to locate the pSpawnlist value, stored above as SpawnHeaderAddr. This is very easy once you have
# pTarget done above. Simply select any target in the game and use the 'wt' command:
# > wt
#
# You should see a long list of spawn information dump out. At the end, we do an automatic scan looking for
# where that entry point pointer lives. You should see a list of matches. Anyone of them could potentially be
# a valid pSpawnlist. Select one and place it in the INI file above under SpawnHeaderAddr. Press 'r' to reload
# the INI file.
#
# Next we want to locate the pSelf value, store above as CharInfo. Inside the game, select yourself as the
# target (press F1) and use the 'ft' command along with your characters first name:
# > ft Yourfirstname
#
# You should see a list of matches. Anyone of them could potentially be a valid pSelf. Select one and
# place it in the INI file above under CharInfo. Press 'r' to reload the INI file.
#
# Last we want to locate the pGroundItems value, stored above as ItemsAddr. Just use the 'sg' command and
# look for matched pointers that look like 'ITxxxxx_ACTORDEF', where xxxxx is any 3 or 5 digit number.
# > sg
# Scanning for 'IT' from 0x7d62c4 to 0x9d62c4
# Pointer match found at 0x8d62c4. Full string is IT10805_ACTORDEF
# Pointer match found at 0x9bc648. Full string is ITORTOKEN
#
# Of course the first one here looks good. Put it in the INI file above under ItemsAddr. Press 'r' to
# reload the INI file.
#
# You can now exit the server (press 'x') and restart it in normal mode. Try attaching the client to it.
# As long as none of the secondary offsets have changed, it should work. If it only works for a short time
# and then stops working, repeat the above procedure, but this time make different selections in the match
# lists.
#
# If the secondary offsets have changed, or the basic design of how they obtain spawn information, the server
# may need to be updated. The other debug options can be used to aid in locating secondary offsets, but it
# is so involved that it is probably best to use a full blown RAM editor. Please visit our forums to learn
# how to help ( http://www.showeq.net/ and look for the MySEQ subforums).
#
# Notes:
# - All string searches are case sensitive!
# - As you get matches, write them all down! If a function works for a minute or so and then stops working, try the
# next match in the list.
# - If you use the spo/sso functions, the changes are NOT made in the INI file. Once you exit, those changes are lost.
# - Only reverse walks (wt/ws) will scan for entry point pointers. Forward walks will just show the spawns and return.

[coloradoderek]

I spent a few hours yesterday trying to use the instructions in the .ini file but it wouldn't work.
It would detect my character, the map, corpses and item but not any other spawns and other data was wrong too like my character name in the server list, etc.

I couldn't get anything working with any instructions found on any post or .ini file.
That's not to say its not me that is the problem, but I would also really like someone to make a more recent post about how to do it, or work with me to show me how to do it, and like the OP said, I could handle the writing of the instructions after I know how.

Thanks.

[cys]

Yep, these dont work for years already...

[pgoesinya]

Ok, as I said, has been some years and I had success back then, but I don't even remember how long it was, I was guesstimating it... :)

Let's ping a few of the guys that do post them with PM and see if we can get a response on a current working model of how this is accomplished...

Pete

[retsuc]

I agree. Knowing how the offset posters find the information would be great to know. I don't know about the rest of you, but I've been sitting here hitting refresh waiting for somebody to post the 12/19/2017 ones. lol

[BlueAdept]

If someone posts a guide or program to finding the offsets, I can pin them to the top of the forum.

[ZoneZ]

I spent a few hours yesterday trying to use the instructions in the .ini file but it wouldn't work.It would detect my character, the map, corpses and item but not any other spawns and other data was wrong too like my character name in the server list, etc.I couldn't get anything working with any instructions found on any post or .ini file.That's not to say its not me that is the problem, but I would also really like someone to make a more recent post about how to do it, or work with me to show me how to do it, and like the OP said, I could handle the writing of the instructions after I know how.Thanks.This was my experience exactly.

[Hidron]

What would be nice would be if someone could fix the offset finder built into the program. Someone posted an update to fix it the first time it broke years ago, although it had to be added to the source code and recompiled ourselves.

There was also an external offset finder released as source only I could never get to compile, so never got to check it out. I think it prompted the original author to add the rest of the offsets to the built-in code.

I never did learn to find any of the secondary offsets (listed in the ini as [SpawnInfo Offsets]) aside from eqmules tip to use the macroquest2 source files.

[EQPlayer]

fo​r anyone trying the steps in the ini file remember to do this on a 32bit single core PC or it will not work.

[coloradoderek]

fo​r anyone trying the steps in the ini file remember to do this on a 32bit single core PC or it will not work.

Can you simulate that some how?
I don't know where I'd find something like that.
Do you think it would work if I ran it in a virtual machine with those specs?

[EQPlayer]

I don't know you would have to ask EQmule about trying to simulate it.

all I know is it wont work on 64 bit duel or quad core machines due to the way they allocate memory.

it has to be done on a 32 bit single core PC using a 32bit OS

[ZoneZ]

Booted up an old box of mine to see if it was single core - it wasn't, but I tried loading EQ on it anyway.


The launcher said that my computer couldn't handle it.How could any dual-core+ computer not handle EQ?


The reason I'm posting here is if I find a single core craputer, and it can't run EQ, how do you find the offsets?

[BlueAdept]

Can someone try on a single core virtual machine with windows xp or 32bit win7. Maybe that will work.

[coloradoderek]

i am working on building a 32 bit win 7 virtual box machine atm.
wont be ready until next week though since its at work and its friday :)
hopefully can figure out how to get the offsets then!

[coloradoderek]

Well, no luck from my end.

I successfully installed EQ in a VM (virtual box), windows 7, 32 bit.
Installed MySEQ and got stuck at the same point as before.

when i type "wt" while targeting something, it never finds the spawn address.

either way, I'm done figuring this out. If people don't want to give instructions on how THEY do it, then i'll just have to wait till they post the answers :)

I have to say though, EQPlayer posted them like 2 minutes after server up this last time.... makes my quest to learn how to do it seem pointless. Until he quits playing EQ anyway...

Unsure if the program works in a VM at this point. There is no way I'll be able to locate an actual single core PC to install EQ onto. If I do, i'll let you guys know what I find out and if I can successfully do it, i'll post detailed instructions on how I do it.

Thanks.

[rakz]

I don't have any issues figuring out the primary offsets generally, but the secondary are harder... ive tried messing w/ Cheat Engine like one of the guides suggested but im not entirely sure what I am supposed to be doing with it :(

[wxh]

So, I'm using Windows 10 64-bit (not happy about it, but there we are), and I'm able to follow the directions in the comment block at the end of the .ini file to find most of the primary addresses (note: all commands below are enclosed in quotes, but obviously don't include the quotes when entering the commands yourself):

In the guild lobby:
1: Use the command "fz guildlobby". This step takes a long time, and usually returns a couple of different values, which I write down. Usually, one of them is closer to the previous correct value for ZoneAddr, so I pick that one, update the .ini file, and use the "r" command to reload the offsets. I also figure out the delta between each of the returned values and the old value for ZoneAddr by subtracting the new values from the previous correct one.

2: Target Guardian Rooksis (the Erudite guard standing to the right of the archway you pass through to get to the PoK zoneline), and use the command "ft Guardian_Rooksis00". This one happens much more quickly than the fz command, and again, usually comes up with 3 or fewer hits (today, it's returning 2). I write them down, then pick the one that seems to be closest to the one that I picked from the fz command results, update the .ini file, and use the "r" command to reload. Usually, this result will have the same (or nearly the same) delta from the previous correct value for TargetAddr and the value from step one did from the previous correct value for ZoneAddr.

3: Target myself and use the command "ft (my toon's first name here)". This one returns more hits than the one in step 2 here (today, it's returning 4), but we can ignore the ones that are the same as the ones in step 2. I then pick the one that has the same (or closest) delta from the previous correct value for CharInfo, update the .ini file, and use the "r" command to reload, but I write down all of the possibilities.

4: In game, use the /ti command to get current game time. Note the IN-GAME date (e.g., May 25, 3174). Use the sfw command, including the in-game date (e.g., "sfw 05/25/3174") . For me, this generally only returns one result, which is the correct value for WorldAddr. Update the .ini file and use the "r" command to reload.

5: This part is a bit tedious: With Guardian Rooksis targeted, use the command "es". This will produce 128 lines of output, each consisting of an address followed by 16 bytes of hex data, followed by the ASCII representation of the hex data. Scan through the output, looking for hex values that match your character level (ie., if you're level 85, look for the value 55). Write down the offsets associated with each match. Next, use the command "et". As before, you'll get 128 lines of output, but this time, the output is related to Guardian Rooksis. Since she's level 70, check all of the offsets you wrote down before for the hex value 46. If only one matches, then congratulations, you've found the correct value for LevelOffset in the [SpawnInfo Offsets] section. If more than one matches, then cross out all of the ones that don't, and save them for later.

6: Here's where it gets dicey. I target Guardian Rooksis again and use the "wt" command. This takes awhile and generates a lot of output, most of which is superfluous, and the rest of which I don't understand how to use. In the end, though, it comes up with a list of pointer matches, but in my experience, none of them are the correct value for SpawnHeaderAddr, so I'm still working on figuring this one out. That said, we'll *maybe* get a good value for SpawnHeaderAddr later on, so don't despair.

Now, zone to PoK:

7: If you didn't get a single result for the possible value of LevelOffset in step 5, target Clayton Teek and use the command "et" again. Since he's level 100, check all of the addresses you didn't eliminate in step 5 for a value of 64. Hopefully, there will be only one, and it will be the correct value for LevelOffset.

8: Use the command "sg". This will return a small number of results for pointers that may be pointing at ground spawns, one of which hopefully includes the text "_ACTORDEF". This should be the value for ItemsAddr. If you get more than one hit that includes "_ACTORDEF", try each one.

At this point, we should have all of the primary addresses except for SpawnHeaderAddr. This one can sometimes be found by starting the non-debug version of the MySEQ server and clicking the "Offset Finder" button. You'll need to click on "Find EQgame.exe" and navigate to where your EQgame.exe file is, then click "Scan Primary". Update the .ini with the address that it comes up with, fire up the MySEQ client, and if all has gone well, you'll at least have skittles, ground spawns, and a spawn list, but some of the info (such as class, primary, secondary, and invis status) for the individual spawns may be incorrect.

Unfortunately, that's as far as I can get, because I can't make the commands that scan for UINTs and floats work- they always return an error saying that the value I wanted to scan for seems to be invalid, and I don't know how to format the commands to make the debugger happy. If the commands WOULD work, though, the process that I'd expect to work for finding the primary and secondary offsets would be to target yourself. Then, at lucy.allakhazam.com, look up the weapon you're holding in your primary hand and click on "raw". Scroll down and look at the value of the "idfile" field- this should be in the format "ITnnnnn", where "nnnnn" is a 1 to 5 digit number, which I expect needs to be expressed in hex. Let's say for example that you're a druid and you have Nature Walkers Scimitar equipped...looking that up on Lucy, we see that the value for idfile is "IT150", so you'd want to search for a hex value of 96, and in theory, the command for that SHOULD be "sfu 96", but when I try that with myself or an NPC targeted, I always getting an error saying that 96 seems to be an invalid value, and if I try it with no target, I get no hits. If it were to return a good result, though, that would be the value for PrimaryOffset. You could repeat the process using the item that you have equipped in your secondary slot (or your range slot if that's what's currently visible), but in all cases going back to October 2012, the OffhandOffset has been equal to the Primary offset plus 14 hex.

You could then search for your race and class by using the sfu command to look for the appropriate values for your race and class, and these can be determined by looking at the Classes.txt and Races.txt files in the cfg subdirectory of your MySEQ directory. The values to search for are the line number of the relevant file on which your race or class appears, minus one. So, if you were a halfling druid, you'd look for a value of 0b for race ("halfling" is on line 12, 12-1=11, 11 in hex is 0b), and a value of 06 for class ("druid" in on line 7, 7-1=6).

I'm sure that a similar approach would work for HideOffset, but I don't know what the various values there mean.

I have no idea how to determine what to search for to find SpawnIDOffset, OwnerIDOffset, and Type (unless Type corresponds to the values in the BodyTypes.txt file).

Fortunately, the X, Y, Z, speed, and heading offsets haven't changed in a very long time, but for X, Y, and Z, I'd expect that in game, you'd do a /loc, then use the sfs command, keeping in mind that the values returned by /loc are Y,X,Z, but the command expects them in the order X,Y,Z.

So, that's where I've gotten. It's far from perfect, and I'm not sure how to proceed from here, but there we are. Let's keep this going.