Tips & Tricks to Identifying Packets & Files

[Emily]

Contribute ways to identify different packets and Client files


Finding Client Run Script:
Search:


200000);



Should return something such as:


static final void a(va var_va) {
a(var_va, 200000);
}



Back trace where that is used in the PacketParser or RSBuffer and bingo.


You can also search:


's'



or you can search:


Object object[]



Finding PacketParser/RSBuffer:
Search for:


invo:

or:


T1 -



Finding Animation Mask:
Search for:


int[4]



Finding Send System Update:
Search for:


* 30



Finding Send Config:
Search for:


4611686018427387905L

Refractor the method that is used by that, and find it in your PacketParser. Will also return the other config packets.


Finding sendChat Method:
Search for:


[99];

That method is the sendChat method, there are many different chats. Private/Clan/Public/ect


Finding Camera Packet::
usually consist of 4 bytes and one short.


Finding Update Server::
Search for:

modpow
should be around an inner int call is(a number)_;


Finding ByteStream:
Search for:
regular modpow method.


Finding PlayerUpdate:
Search for gpi and find the method above the runtime error, then go to the method, the last method there should be the updating class.


Finding Send Projectile:
Search for while (, The first method with 4 bytes will be it.


Finding Npc Updating:
Search for:


gnp



Finding Send Window Pane:
Search for:


2000000);

Then search the method that contains that in your PacketParser/RSBuffer


Finding Animation Class:
Search for:


|= 0x400;

What ever returns a greater number of results is the animation class.


Finding Cache File Class:
Search for:


<< 16 & 0xff0000



Finding Special Packet:
Search for:


T3



Finding Send Items Packet:
Seach for:
boolean = (_someint_ & 0x1) == 1;
[/code]
and it loops it is then sendItems ( main one)


Finding Send Hint Icon:
Search for:


((Class387) class387).anInt4729 = 256

Long value set to 256, also search for:


0xf1



Contributors:
Cjay0091
Steve
Emily
Stacx


Will add more, just getting thread started so others can contribute.

[Cjay0091]

Easier way for clientscript packet.

Object object[]

Animation mask search for int[4]

For Config find a packet with an int, byte order and search in packet parser if it has another method just like it but short, byte order.

For update server search modpow should be around an inner int call is(a number)_;

For ByteStream search for regular modpow method.

For playerUpdating search for gpi and find the method above the runtime error, then go to the method, the last method there should be the updating class.

Signlink can be found by searching for "cache"

When a method in bytestream return somesthing its a read method, when it is a void or doesn't return it is a write method.

For send projectile search for while (, The first method with 4 bytes will be it.

These are just off the top of my head.

[Emily]

Easier way for clientscript packet.

Object object[]

Animation mask search for int[4]

For Config find a packet with an int, byte order and search in packet parser if it has another method just like it but short, byte order.

For update server search modpow should be around an inner int call is(a number)_;

For ByteStream search for regular modpow method.

For playerUpdating search for gpi and find the method above the runtime error, then go to the method, the last method there should be the updating class.

Signlink can be found by searching for "cache"

When a method in bytestream return somesthing its a read method, when it is a void or doesn't return it is a write method.

These are just off the top of my head.

Send config you can search:


4611686018427387905L


=)

Added others.

[Cjay0091]

Send config you can search:


4611686018427387905L


=)

Added others.

Its the way I do it, but yea that seems simpler, I don't think you can find both using that though. I will add more once I'm assed enough to open eclipse. These are all from memory atm.

[SiniSoul]

Send config you can search:


4611686018427387905L


=)

Added others.

Do you actually know what any of these identifying marks mean?

[Cjay0091]

Do you actually know what any of these identifying marks mean?

Incorrect deobufstication? I'm not sure they(runescape) would make an integer that long. Could be wrong.

[Steve]

Packets that write x and y(for like sendObject, sendGroundItem, all those) usually use the bitmask 0x7.
Camera packets usually consist of 4 bytes and one short.
System update packet usually divides by 1.7.

[Cjay0091]

I updated my first post.

Npc Updating can be found by searching for gnp.

[SiniSoul]

Packets that write x and y(for like sendObject, sendGroundItem, all those) usually use the bitmask 0x7.
Camera packets usually consist of 4 bytes and one short.
System update packet usually divides by 1.7.

0x7 = the size of a tile chunk.

[Cjay0091]

Just realized aren't some of these very version specific? Like the sendConfig example you posted. Or the windowpane?

[Emily]

Just realized aren't some of these very version specific? Like the sendConfig example you posted. Or the windowpane?

I compared those with 647 to 657 and it worked out. And this is mostly for newer revisions so it works for the present time.

[SiniSoul]

Just realized aren't some of these very version specific? Like the sendConfig example you posted. Or the windowpane?

'T1' is found in the 317 client

[Cjay0091]

I compared those with 647 to 657 and it worked out. And this is mostly for newer revisions so it works for the present time.

Worked for me as well, I was just curious was all :0


'T1' is found in the 317 client

Didn't mean that lol. I meant the sendConfig example but turns out I was wrong.

sendItem :


boolean = (_someint_ & 0x1) == 1;

and it loops it is then sendItems ( main one)

sendHintIcon:

Very long packet filled with values being set to 256


((Class387) class387).anInt4729 = 256 also find
0xf1

[Stacx]

to find the special packets class search for T3.

[SiniSoul]

to find the special packets class search for T3.

LUL there's a 'T3'?

[Cjay0091]

LUL there's a 'T3'?

Its for special packets. It can also be a mapdata error.

[Stacx]

Its for special packets. It can also be a mapdata error.

gzip compression error.