Diablo II, Object Types, IDs, And Codes

[Win32]

Could someone please explain, or give a reference to such things? And, how are object GUID's generated, are they done server-side or client-side?

For example:

0x51
D2GS_OBJECTASIGNMENT
Lengh = 14

51 02 XX XX XX XX 25 00 59 16 A0 15 02 00
(BYTE) Object Type
(DWORD) Object ID
(WORD) Object Unique Code
(WORD) Location X
(WORD) Location Y
(BYTE) Objects State (0x00=no &HE will follow, 0x02=expect a &HE)
(BYTE) Interaction Conditions

Thanks

, Matt.

[raylu]

I'm pretty sure you don't mean GUID.

I'm also pretty sure that these IDs are generated server-side.

But I haven't even gotten my feet wet here, so just ignore me.

[Win32]

Well, I just took a wild stab that each object in the game was assigned a unique identifier, a few messages sort of implied this design.

I've seen the term "Object Type", "Object ID", "Player ID" and a whole host of other 'identification' concepts thrown around, but couldn't find any information on what there values are to be, or how I'm meant to figure them out.

So far, (and what i'm going by at the moment) is that there's a few categories of objects: Monsters/Players, NPCS, and 'general'. Then, there's an identifier for each specific category member.

I'm pretty sure the answer is going to be "Look in the MPQs" or some such, I've done that but could only find a few vauge "type ids".

(Noting, this in relation to my D2GS "open" server project).

[Ringo]

Type* would mean the eneity index, for example:
0 = Players
1 = NPC/monsters etc
2 = Objects
3 = Missiles (Managed localy)
4 = Item
5 = Doors

Code* would mean an identifyer of an entity, such as a type of NPC, character type etc.

ID* generaly means the identification number of any given entity. This is how one tells apart 2 of the same eneitys (like 2 fallen npc's, 2 players with the same character type etc)

The ID's in a open game are generated by simply adding 1 to a ID count, for each entity type. In a closed game this is done via bit shifting, making it harder for a client to guess the next ID number of somthing.

Try viewing packets between server and client and compareing them to the documentation.
Your REALLY going to need to look at the packets spat out by the server/client if you want to get anywhere.
Like I suggested before, set up a gateway between D2 and its server, so you can view all packets in reall time, as well as code parsers to brake them up, test theorys, check things, and so on.

Anyway, gl!

[Win32]

Ah, thanks for clearing that up Ringo

Yeah, I'm working on setting up a gateway so I can watch D2GS traffic locally. But, unfortunately it's proven extremely difficult as I don't have a spare computer. So I've been trying to find a loopback traffic monitor, but after a long long time of searching all I can find is CommView, which costs $140. Ethereal also doesn't support loopback capture, atleast not on Windows systems.

By the way, do you know the length (or maybe even format) of 0x5E and 0x28 S->C? I know it's quest info (which I don't really care about) but it appears the client requires it otherwise it'll just drop.

[Ringo]

Ah, thanks for clearing that up Ringo

Yeah, I'm working on setting up a gateway so I can watch D2GS traffic locally. But, unfortunately it's proven extremely difficult as I don't have a spare computer. So I've been trying to find a loopback traffic monitor, but after a long long time of searching all I can find is CommView, which costs $140. Ethereal also doesn't support loopback capture, atleast not on Windows systems.

Ah That kinda sucks.
Doesnt ethereal support some sockscap lib thingy, that can be used for this?

By the way, do you know the length (or maybe even format) of 0x5E and 0x28 S->C? I know it's quest info (which I don't really care about) but it appears the client requires it otherwise it'll just drop.

clicky for what i know about 0x5E

Some old notes on 0x28:

Code Select Expand


0x28:
(DWORD) Unknown (maybe a reassion id)
(WORD) Unknown (0x00)
(WORD) Unknown (Seen 0x00, 0x01)
For each quest:
    (BYTE) F1
    (BYTE) F2

(VOID) remaining extra mumbojumbo


Quest Index:
If ((F1 And &H1) = &H1) Then
- Quest Is Finished
- If ((F2 And &H20) = &H20) Then
---- Quest Finished
- Else
---- Quest Finished In Another Game

ElseIf ((F1 And &H2) = &H2) Then
- If ((F2 And &H2) = &H20) Or ((F2 And &H80) = &H80) Then
---- Goto Town For Reward
---- (0x20 doesnt effect all q's?)

other wise Quest is open?

The quest order seems to be:
1 = A1 Q1 (Den of evil)
2 = A1 Q2 (Kill blood raven)
3 = A1 Q5 (Kill blacksmith)
4 = A1 Q3 (Save cain)
5 = Unknown? - A1 Q4
6 = A1 Q6 (Kill Andy)
7 = ACT2 ENABLER?
8 = Unknown
9 = A2 Q1 (Sewers)
10 = A2 Q2
11 = A2 Q3
12 = A2 Q4
13 = A2 Q5
14 = A2 Q6
15 = ACT3 ENABLER?
16 = Unknown
17 = A3 Q4
18 = A3 Q3
19 = A3 Q2
20 = A3 Q1
21 = A3 Q5 (travi)
22 = A3 Q6 (mep)
23 = ACT4 ENABLER?
24 = Unknown
25 = A4 Q1
26 = A4 Q3 (A5 Enabler)
27 = A4 Q2
23 = Unknown
24 = Unknown
25 = Unknown
26 = Unknown
27 = Unknown
28 = Unknown
29 = Unknown
30 = A5 Q1
31 = A5 Q2
32 = A5 Q3
33 = A5 Q4
34 = A5 Q5 (Ancients)
35 = A5 Q6


However, none of them 2 messages are needed to get a client to load the game.

Code Select Expand


S > C - 0x59 Your char
S > C - 0x0B Your char ID
S > C - 0x03 Asign a map/area seed(s)
S > C - 0x07 Asign a map title to where char will stand (so d2 doesnt crash when you 0x15)
S > C - 0x15 Asign char to map
S > C - 0x04 Inits the act/game

Thats enough to keep D2 happy

[Win32]

Oh wow, thanks heaps!

I've done alot of packet logging (having to entice people to join my game using game names like "Free hax 4 u", lol) and it seemed the initial data sent to the client (after 0x6C) was at a minium of 500 bytes, I went through it all and encountered atleast 40 messages).

One very annoying this about this project, since it's going to require Other Multiplayer -> TCP/IP, is that clients connect twice. =|

Anyway though, thanks for all your help. I'm sure I'll need more

[Win32]

Hmm, this message has always confused me. 0x07, it mentions that the locations do not match up to the player's actual location, and I have no idea what the Floor Tile ID would be. I have a theory around the locations, I noticed that in-game the client sends 2 movement (run or walk) at a time, both being different. Every # (Cant remember exactly) of movement increments causes both message's locations (X and Y) to be the same. I guess maybe these 'breakpoints' create a grid of some sort?

Also, I couldn't find much information on 0x03 other than it's consituted of 2 'unknown' dwords and an area id and an act id.

[Win32]

Alright, I'm not sure what the problem is. But, I've narrowed it down to this is the minimum requirement for S->C to get the player in the game:

Code Select Expand


0x59, 0x02, 0x00, 0x00, 0x00, 0x01, 0x42, 0x4C, 0x41, 0x4E, 0x4B, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xAA, 0x00, 0x02, 0x00, 0x00, 0x00,
    0x0C, 0x69, 0x59, 0xF9, 0xFF, 0x1F, 0x76, 0x00, 0x02, 0x00, 0x00, 0x00, 0x94, 0x08, 0x02, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x01, 0x01, 0x00, 0x01, 0xD9, 0x00, 0x01, 0xDA, 0x00,
    0x01, 0xDB, 0x00, 0x01, 0xDC, 0x00, 0x01, 0x03, 0x00, 0x01, 0x5E, 0x01, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xB1,
    0x28, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x29, 0x00, 0x00, 0x00, 0x80, 0x00, 0x80, 0x00, 0x80,
    0x00, 0xA0, 0x00, 0x80, 0x00, 0x80, 0x00, 0x00, 0x00, 0x20, 0x00, 0xA0, 0x00, 0x00, 0x00, 0xA0,
    0x00, 0xA0, 0x00, 0x80, 0x00, 0x80, 0x00, 0x00, 0x00, 0x20, 0x00, 0xA0, 0x00, 0x80, 0x00, 0x80,
    0x00, 0x80, 0x00, 0xA0, 0x00, 0xA0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x80, 0x00, 0x80,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
    0x00, 0x80, 0x00, 0x80, 0x00, 0x80, 0x00, 0x80, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, 0x00, 0x02, 0x00, 0x00, 0x00, 0x5F, 0x01,
    0x00, 0x00, 0x00, 0x1D, 0x0C, 0x01, 0x23, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0xFF,
    0xFF, 0xFF, 0xFF, 0x23, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
    0x1D, 0x0C, 0x01, 0x03, 0x00, 0xAF, 0x99, 0xD8, 0x65, 0x01, 0x00, 0x58, 0x5E, 0xE4, 0xF4, 0x53,
    0x02, 0x00, 0x00, 0x00, 0x38, 0x0E, 0x00, 0x00, 0x00, 0x07, 0x28, 0x04, 0x50, 0x03, 0x01, 0x07,
    0x20, 0x04, 0x48, 0x03, 0x01, 0x07, 0x20, 0x04, 0x50, 0x03, 0x01, 0x07, 0x28, 0x04, 0x48, 0x03,
    0x01, 0x07, 0x30, 0x04, 0x48, 0x03, 0x01, 0x07, 0x20, 0x04, 0x58, 0x03, 0x01, 0x07, 0x28, 0x04,
    0x50, 0x03, 0x01, 0x07, 0x30, 0x04, 0x50, 0x03, 0x01, 0x07, 0x28, 0x04, 0x58, 0x03, 0x01, 0x07,
    0x30, 0x04, 0x58, 0x03, 0x01, 0x15, 0x00, 0x02, 0x00, 0x00, 0x00, 0xDF, 0x14, 0x9D, 0x10, 0x01,                                                                


After further research I've found that there's something in:

Code Select Expand


0x28, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x29, 0x00, 0x00, 0x00, 0x80, 0x00, 0x80, 0x00, 0x80,
    0x00, 0xA0, 0x00, 0x80, 0x00, 0x80, 0x00, 0x00, 0x00, 0x20, 0x00, 0xA0, 0x00, 0x00, 0x00, 0xA0,
    0x00, 0xA0, 0x00, 0x80, 0x00, 0x80, 0x00, 0x00, 0x00, 0x20, 0x00, 0xA0, 0x00, 0x80, 0x00, 0x80,
    0x00, 0x80, 0x00, 0xA0, 0x00, 0xA0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x80, 0x00, 0x80,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
    0x00, 0x80, 0x00, 0x80, 0x00, 0x80, 0x00, 0x80, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, 0x00, 0x02, 0x00, 0x00, 0x00, 0x5F, 0x01,
    0x00, 0x00, 0x00

That is required, but I was under the presumption that all of that was quest bullshit?

[Chriso]

I don't think I've ever seen so many bytes all together like that... lol

[Win32]

No matters, I got it worked out. But, I still don't exactly understand how the mapping works. Any ideas, Ringo? (Or anyone)

Also, some message's field is labeled as "(Void) Information About The Monster/Player", is information available somewhere? Or is it just unknown?

[ShadowDancer]

void means that info is in bitfield format, i dont know how much of all packets that uses bitfield are public released but 0x9c, 0x9d are mosly full knowed, also 0xaa & 0xac packets.

unfortunately it's proven extremely difficult as I don't have a spare computer. < why do u need another computer (?)