Auto Opcode Detection

[Flotsam]

Be gentle :)

I am poking around with the opcodes, having fun, and have a couple of questions. First, from everything I have read it sounds like opcode detection is a completely manual process - i.e. you evaluate the packet stream as you perform actions in the game to determine the appropriate code. Would it not be possible to create a simple utility that would extract the appropriate codes (or at least some of the easier codes like openvendor, closevendor, etc)?

Secondarily, how frequently are the code lengths changed versus just being scrambled within the packet? I have not really looked into the opcodes before.

Thanks for any help...

[high_jeeves]

There really is no reasonable way to automatically evaluate opcodes. You would have to know the precise structure of the packet and a significant portion of the possible information that could be in it. It is significantly easier to do this manually.

As for lengths, I have no idea what you are talking about. What code length? There is nothing scrambled in the packet. The opcode is 2 bytes. It is always at the front of the packet (otherwise, there would be no fast way to decide what type of packet it is). The length of the packet changes whenever more or less information is placed into it by the developers.

--Jeeves

[Flotsam]

Thanks for the notes - I know where I was mistaken - I am deleting this note to prevent others from being confused :)

[bonkersbobcat]

A packet length for a given opcode is fixed (given a specific release of EQ) You could go part way by maintaining a database of opcodes to packet lengths. The problem is that some of the opcodes could have packet lenghts that are the same. If two opcodes had a 100 byte packet, and you received a 100 byte packet, which opcode would you use? The other problem is that the lengths of the packets occasionally change from software version to software version.

Edit: Ok only some packets are fixed length... Yet another reason that opcode detection can't be fully automated

[high_jeeves]

Actually bonkers, quite a few packets are variable length. Any packet with free text in it (all the chat packets, and many of the formatted message packets) are variable length. Also, certain other packets are variable length due to part of the encryption scheme that is being used.

--Jeeves

[tmiss]

Ok, I'm going to read into this discussion a bit and see if I understand what's going on.

EQ Server -> UDP Packet -> EQ Client
SEQ sniffs UDP Packet
UDP Packet Structure:
[16 bit opcode][variable length possibly encrypted opcode related data]

I realize this would be the basics and hope it's ok to get clarification in this thread. :)

TMiss

[EQDoze]

I have some semi working code for dynamic opcodes. You create a file that has the opcode assignments in it, and SEQ loads the values from there. From that point on, you don't have to rebuild SEQ every time.

The drawback to my code is that it's more CPU intensive than the current method. I'll polish it up a bit and submit it.

On the other hand, if no one gives a shit... I'll keep it to myself.