← Back to DevelopmentAging & Mixing viewer.dll generatorProgramsClan filesInternet Information ServiceOllyDbg tutorialsMiscellaneousSkinsLinks / Files

teleport_core_values

← Back to Miscellaneous
The original table of values for the teleport cores is located here :

OllyDbg - Client side



The values in the table are organised in groups of 3 : (map, req. level, id ?).
The map number is the same as the one used with the /field command.
I'm not quite sure if the third value is used at all.
It's easier to see when realigned.

Teleport core table - Client side



If you're using a client based on quantumfusion's 1873 client, there's this inside your client.

OllyDbg - Client side

0046C32A  |.  BE 00ED4004   MOV ESI,OFFSET xxxxxx.0440ED00
0046C32F  |.  90            NOP
0046C330  |>  0FBF05 5AA006 /MOVSX EAX,WORD PTR DS:[306A05A]
0046C337  |.  8B4E F8       |MOV ECX,DWORD PTR DS:[ESI-8]
0046C33A  |.  48            |DEC EAX
0046C33B  |.  3BC1          |CMP EAX,ECX
0046C33D  |.  75 78         |JNE SHORT 0046C3B7
(...)
0046C3B7  |>  83C6 0C       |ADD ESI,0C
0046C3BA  |.  81FE 5CEE4004 |CMP ESI,OFFSET xxxxxx.0440EE5C
0046C3C0  |.^ 0F8C 6AFFFFFF \JL 0046C330
 


This is where all the teleport core magic happens.
First we load the address of the beginning of the table in ESI.

OllyDbg - Client side

0046C32A  |.  BE 00ED4004   MOV ESI,OFFSET xxxxxx.0440ED00


We notice immediatly that this address (0440ED00) refers to the KPTTrans section. This means the teleport core table was moved (that's understandable with the new maps).
Here's the new table :

OllyDbg - Client side



Now if we realign it, we notice immediatly something :

Teleport core table - Client side



When the table was copied, the first value (14) wasn't copied. That's why when you teleport to Road to the Wind, it transfers you to Acasia forest instead.

This omission is quite easy to understand.
The address we loaded into ESI before doesn't point to the first map number. It points to the first level requirement.
The program goes back in memory (from 8 bytes) and loads the map number with that instruction :

OllyDbg - Client side

0046C337  |.  8B4E F8       |MOV ECX,DWORD PTR DS:[ESI-8]


To fix it, just replace the 0 by 14.

OllyDbg - Client side



Further in the procedure, you have a line containing the end of the table address.

OllyDbg - Client side

0046C3BA  |.  81FE 5CEE4004 |CMP ESI,OFFSET xxxxxx.0440EE5C


If you plan on adding items to the teleport core, you will probably have to change that value.