Packet Breakdown
BYTE[1] cmd
BYTE[4] pattern1 (0xedededed)
BYTE[4] pattern2 (0xffffffff)
BYTE[1] pattern3 (0x00)
BYTE[30] char name
BYTE[30] char password
BYTE[1] sex (0=male, 1=female)
BYTE[1] str
BYTE[1] dex
BYTE[1] int
BYTE[1] skill1
BYTE[1] skill1value
BYTE[1] skill2
BYTE[1] skill2value
BYTE[1] skill3
BYTE[1] skill3value
BYTE[2] skinColor
BYTE[2] hairStyle
BYTE[2] hairColor
BYTE[2] facial hair
BYTE[2] facial hair color
BYTE[2] location # from starting list
BYTE[2] unknown1
BYTE[2] slot
BYTE[4] clientIP
BYTE[2] shirt color
BYTE[2] pants color

Notes
Note: pattern3 is set to 0xFF to early signal a Krrios' client user, where it expects a 0xF0 | 0x00 before login confirm

Str, dex and int should always sum to 65.
Str, dex and int should always be between 10 and 45, inclusive.
Skill1, skill2, and skill3 should never be the same value.
Skill1, skill2, and skill3 should always be between 0 and 45, inclusive.
Skill1value, skill2value, and skill3value should always sum to 100.
Skill1value, skill2value, and skill3value should always be between 0 and 50, inclusive.
SkinColor should always be between 0x3EA and 0x422, exclusive.
HairColor and facialHairColor should always be between 0x44E and 0x4AD, exclusive.
HairStyle should be between 0x203B and 0x204A, exclusive, and it should also exclude 0x203D to 0x2044, exclusive.
FacialHairStyle should be between 0x203E and 0x204D
Shirt color and Pants color need bounds checking too.

Packet ID: 0x01
Packet Name: Disconnect Notification
Packet Size: 5 bytes
Sent By: Client
Submitted: MuadDib

Description
No longer Active.

Packet Breakdown
BYTE[1] cmd
BYTE[4] pattern (0xFFFFFFFF)

Packet ID: 0x02
Packet Name: Move Request
Packet Size: 7 bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] direction
BYTE[1] sequence number
BYTE[4] fastwalk prevention key

Notes
Sequence number starts at 0, after a reset. However, if 255 is reached, the next seq # is 1, not 0.

Fastwalk prevention notes: each 0x02 pops the top element from fastwalk key stack. (0xbf sub1 init. fastwalk stack, 0xbf sub2 pushes an element to stack)
If stack is empty key value is 0. (-> never set keys to 0 in 0xbf sub 1/2)
Because client sometimes sends bursts of 0x02�s DON�T check for a certain top stack value.
The only safe way to detect fastwalk: push a key after EACH x021, 0x22, (=send 0xbf sub 2) check in 0x02 for stack emptyness.

If empty -> fastwalk alert.
Note that actual key values are irrelevant. (just don�t use 0)
Of course without perfect 0x02/0x21/0x22 synch (serverside) it�s useless to use fastwalk detection.
Last but not least: fastwalk detection adds 9 bytes per step and player !

Packet ID: 0x03
Packet Name: Talk Request
Packet Size: Variable
Sent By: Client
Submitted: MuadDib

Description
No longer active.

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[1] SpeechType
BYTE[2] Color
BYTE[2] SpeechFont
BYTE[?] msg - Null Terminated (blockSize - 8)

Packet ID: 0x04
Packet Name: Request God Mode (God Client)
Packet Size: 2 bytes
Sent By: Client
Submitted: MuadDib

Description
This is sent by the god client after it logs in until it receives a God mode packet. No longer active.

Packet Breakdown
BYTE[1] cmd
BYTE[1] mode (0=off, 1=on)

Packet ID: 0x05
Packet Name: Request Attack
Packet Size: 5 bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] ID to be attacked

Packet ID: 0x06
Packet Name: Double Click
Packet Size: 5 bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] ID of double clicked object

Packet ID: 0x07
Packet Name: Pick Up Item
Packet Size: 7 bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd

BYTE[4] item id

BYTE[2] # of items in stack

Packet ID: 0x08
Packet Name: Drop Item
Packet Size: 14 bytes
Sent By: Client
Submitted: MuadDib-

Packet Breakdown
BYTE[1] cmd

BYTE[4] item id

BYTE[2] X Location

BYTE[2] Y Location

BYTE[1] Z Location

BYTE[4] Move Into Container ID (FF FF FF FF if normal world)

Notes
3D clients sometimes sends 2 of them (bursts) for ONE drop action. The last one having �1�s in X/Y locs.

Be very careful how to handle this odd �bursts� server side, neither always process, nor always skipping is correct.

Packet ID: 0x09
Packet Name: Single Click
Packet Size: 5 bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] ID of single clicked object

Packet ID: 0x0A
Packet Name: Edit (God Client)
Packet Size: 11
Sent By: Client
Submitted: MuadDib

Description
No longer active.

Packet Breakdown
BYTE[1] Cmd
BYTE[1] Subcommand
BYTE[2] The new object's x-axis position. If Command is HackMove Request, this will be a boolean value (still 16-bit) representing the requested mode.
BYTE[2] The new object's y-axis position.
BYTE[2] The new object's id. If Command is Add New NPC, this is the template number.
BYTE[1] The new object's z-axis position.
BYTE[2] Unknown.

Sub Commands
Subcommand 4: Add New Dynamic Item.
Subcommand 6: Hackmove Request.
Subcommand 7: Add New NPC.
Subcommand A: Add New Static Item.

Packet ID: 0x0B
Packet Name: Damage
Packet Size: 0x07
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] CMD
BYTE[4] Serial to display above
BYTE[2] Damage dealt. 0xFFFF is max damage that can be displayed.

Notes
New damage dealt packet to display damage above a mob's head. This packet was introduced somewhere around 4.0.7a

Packet ID: 0x0C
Packet Name: Edit Tile Data (God Client)
Packet Size: variable
Sent By: Both
Submitted: MuadDib

Description
No longer active.

Packet Breakdown
BYTE[1] Cmd
BYTE[2] Length
BYTE[2] Tile Number to edit. If number is 0x8000+, then it is a map tile.
BYTE[4] Tile data Flags for the item.
BYTE[1] Weight of item.
BYTE[1] Quality of item.
BYTE[2] Unknown.
BYTE[1] Unknown.
BYTE[1] Quantity.
BYTE[2] Frame number of the animation.
BYTE[1] Unknown.
BYTE[1] Hue.
BYTE[1] Unknown.
BYTE[1] Value of item.
BYTE[1] Height.
BYTE[20] Item's Name.

Packet ID: 0x11
Packet Name: Status Bar Info
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] packet length
BYTE[4] player id
BYTE[30] playerName
BYTE[2] currentHitpoints
BYTE[2] maxHitpoints
BYTE[1] name change flag (0x1 = allowed, 0 = not allowed)
BYTE[1] flag (0x00 � no more data following (end of packet here).� 0x01 � more data after this flag following,� 0x03: like 1, extended info, 0x04: even more extended info (client 4.0 and above), 0x05: Unknown, UOML introduced. Maybe to do with introduced at client 5.0?
BYTE[1] sex (0=male, 1=female)
BYTE[2] str
BYTE[2] dex
BYTE[2] int
BYTE[2] currentStamina
BYTE[2] maxStamina
BYTE[2] currentMana
BYTE[2] maxMana
BYTE[4] gold
BYTE[2] armor class
BYTE[2] weight
BYTE[1] Unknown * UOML Introduced?
If (flag == 3 or flag==4 )
� BYTE[2]� statcap
� BYTE[1]� pets current
� BYTE[1] pets max
If (flag == 4)
� BYTE[2]� fireresist
� BYTE[2]� coldresist
� BYTE [2] poisonresist
� BYTE[2]� energyresist
� BYTE[2]� luck
� BYTE[2] damage minimum
� BYTE[2] damage maximum
� BYTE[4] titching points

Notes
For characters other than the player, currentHitpoints and maxHitpoints are not the actual values. MaxHitpoints is a fixed value, and currentHitpoints works like a percentage.

Packet ID: 0x12
Packet Name: Request Skill etc use
Packet Size: Variable
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE cmd
BYTE[2] blockSize
BYTE[1] type
Types Listed:
� 0x24 ($) - skill
� � BYTE[blockSize-4] skill (null terminated strings)
� � � "1 0" - anatomy
� � � "2 0" - animal lore
� � � "3 0" - item identification
� � � "4 0" - arms lore
� � � "6 0" - begging
� � � "9 0" - peacemaking
� � � "12 0" - cartography
� � � "14 0" - detect hidden
� � � "15 0" - entice
� � � "16 0" - evaluate intelligence
� � � "19 0" - forensic evaluation
� � � "21 0" - hiding
� � � "22 0" - provocation
� � � "23 0" - inscription
� � � "30 0" - poisoning
� � � "32 0" - spirit speak
� � � "33 0" - stealing
� � � "35 0" - taming
� � � "36 0" - taste identification
� � � "38 0" - tracking
� 0x56 (V) - Macro'd Spell
� � BYTE[blockSize-4] Spell (null terminated strings)
� � � "2" - Create Food
� � � "3" - Feeblemind
� � � "4" - Heal
� � � "5" - Magic Arrow
� � � "6" - Night Sight
� � � "7" - Reactive Armor
� � � "8" - Weaken
� � � "9" - Agility
� � � "10" - Cunning
� � � "11" - Cure
� � � "12" - Harm
� � � "13" - Magic Trap
� � � "14" - Magic Untrap
� � � "15" - Protection
� � � "16" - Strength
� � � "17" - Bless
� � � "18" - Fireball
� � � "19" - Magic Lock
� � � "20" - Poison
� � � "21" - Telekenisis
� � � "22" - Teleport
� � � "23" - Unlock
� � � "24" - Wall of Stone
� � � "25" - Arch Cure
� � � "26" - Arch Protection
� � � "27" - Curse
� � � "28" - Fire Field
� � � "29" - Greater Heal
� � � "30" - Lightning
� � � "31" - Mana Drain
� � � "32" - Recall
� � � "33" - Blade Spirit
� � � "34" - Dispel Field
� � � "35" - Incognito
� � � "36" - Reflection
� � � "37" - Mind Blast
� � � "38" - Paralyze
� � � "39" - Poison Field
� � � "40" - Summon Creature
� � � "41" - Dispel
� � � "42" - Energy Bolt
� � � "43" - Explosion
� � � "44" - Invisibility
� � � "45" - Mark
� � � "46" - Mass Curse
� � � "47" - Paralyze Field
� � � "48" - Reveal
� � � "49" - Chain Lightning
� � � "50" - Energy Field
� � � "51" - Flame Strike
� � � "52" - Gate
� � � "53" - Mana Vampire
� � � "54" - Mass Dispel
� � � "55" - Meteor Shower
� � � "56" - Polymorph
� � � "57" - Earthquake
� � � "58" - Energy Vortex
� � � "59" - Ressurection
� � � "60" - Summon Air Elemental
� � � "61" - Summon Daemon
� � � "62" - Summon Earth Elemental
� � � "63" - Summon Fire Elemental
� � � "64" - Summon Water Elemental
� 0x58 (X) - Open Door
� � BYTE[1] null termination (0x00)
� 0xc7 - action
� � BYTE[blockSize-4] Action (null terminated strings)
� � � "bow"
� � � "salute"

Packet ID: 0x13
Packet Name: Drop->Wear Item
Packet Size: 10 bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE cmd

BYTE[4] itemid

BYTE layer (layer of player)

BYTE[4] playerID

Notes
1.) The Layer should not be trusted.

Packet ID: 0x14
Packet Name: Send Elevation (God Client)
Packet Size: 6
Sent By: Client
Submitted: MuadDib

Description
No longer active.

Packet Breakdown
BYTE[1] Cmd
BYTE[2] Map X Coord
BYTE[2] Map Y Coord
BYTE[1] Z Amount to alter the map tile's elevation by

Packet ID: 0x15
Packet Name: Follow
Packet Size: 9
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] Cmd
BYTE[4] Serial of what is being followed.
BYTE[4] Serial of who is doing the following.

Packet ID: 0x16
Packet Name: Request Script Names
Packet Size: 1
Sent By: Client
Submitted: MuadDib

Description
No longer active.

Packet Breakdown
BYTE[1] Cmd

Packet ID: 0x1A
Packet Name: Object Info
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] itemID
BYTE[2] model #
if (itemID & 0x80000000)
� BYTE[2] item count (or model # for corpses)
if (model & 0x8000)
� BYTE Incr Counter (increment model by this #)
BYTE[2] xLoc (only use lowest significant 15 bits)
BYTE[2] yLoc
if (xLoc & 0x8000)
� BYTE direction
BYTE zLoc
if (yLoc & 0x8000)
� BYTE[2] dye
if (yLoc & 0x4000)
� BYTE flag byte (See top)

Packet ID: 0x1B
Packet Name: Char Locale & Body
Packet Size: 37 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE cmd

BYTE[4] player id

BYTE[4] unknown1 // always 0

BYTE[2] bodyType

BYTE[2] xLoc

BYTE[2] yLoc

BYTE[2] zLoc

BYTE[1] direction

BYTE[1] unknown2

BYTE[4] unknown3

BYTE[2] server boundry X

BYTE[2] server boundry Y

BYTE[2] server boundry Width

BYTE[2] server boundry Height

BYTE[6] // completely ignored by standard client

Notes
Also known as "Login Confimation". This packet must be sent by the server once during login in order to confirm the login happened fully.

Packet ID: 0x1C
Packet Name: Send Speech
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] Packet len
BYTE[4] itemID (FF FF FF FF = system)
BYTE[2] model (item # - FF FF = system)
BYTE[1] Type of Text
BYTE[2] Text Color
BYTE[2] Font
BYTE[30] Name
BYTE[?] Null-Terminated Msg (? = Packet length - 44)

Notes
This is the packet POL uses to send names when you single click on items or NPCs. This is a much more optimized method (packet size) than OSI's method by using 0xC1

The various types of text is as follows:
0x00 - Normal
0x01 - Broadcast
0x02 - Emote
0x06 - System
0x07 - Message
0x08 - Whisper
0x09 - Yell

Packet ID: 0x1D
Packet Name: Delete Object
Packet Size: 5 bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE cmd

BYTE[4] item/char id

Packet ID: 0x20
Packet Name: Draw Game Player
Packet Size: 19 bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE cmd
BYTE[4] creature id
BYTE[2] bodyType
BYTE[1] unknown1 (0)
BYTE[2] skin color / hue
BYTE[1] flag byte
BYTE[2] xLoc
BYTE[2] yLoc
BYTE[2] unknown2 (0)
BYTE[1] direction
BYTE[1] zLoc

Notes
Only used with the character being played by the client.

Packet ID: 0x21
Packet Name: Char Move Rejection
Packet Size: 8 bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE cmd

BYTE[1] sequence #

BYTE[2] xLoc

BYTE[2] yLoc

BYTE[1] direction

BYTE[1] zLoc

Packet ID: 0x22
Packet Name: Character Move ACK/ Resync Request
Packet Size: 3 bytes
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE cmd

BYTE[1] sequence (matches sent sequence)

BYTE[1] notoriety

Notes
Notoriety

0 = invalid/across server line
1 = innocent (blue)
2 = guilded/ally (green)
3 = attackable but not criminal (gray)
4 = criminal (gray)
5 = enemy (orange)
6 = murderer (red)
7 = unknown use (translucent (like 0x4000 hue))

Packet ID: 0x23
Packet Name: Dragging Of Item
Packet Size: 26 bytes
Sent By: Server
Submitted: MuadDib

Description
This is sent by the server to display an item being dragged from one place to another.

Packet Breakdown
BYTE[1] Cmd
BYTE[2] model #
BYTE[3] unknown1
BYTE[2] stack count
BYTE[4] Source ID
BYTE[2] Source xLoc
BYTE[2] Source yLoc
BYTE[1] Source zLoc
BYTE[4] Target id
BYTE[2] Target xLoc
BYTE[2] Target yLoc
BYTE[1] Target zLoc

Notes
This does not actually move the item, it just displays an animation.

Packet ID: 0x24
Packet Name: Draw Container
Packet Size: 7 bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE cmd

BYTE[4] item id

BYTE[2] model-Gump (0x003c is backpack)

Packet ID: 0x25
Packet Name: Add Item To Container
Packet Size: 20 bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE cmd

BYTE[4] item id to add

BYTE[2] model

BYTE[1] unknown (0)

BYTE[2] # of items

BYTE[2] xLoc in container

BYTE[2] yLoc in container

BYTE[4] itemID of container

BYTE[2] color

Packet ID: 0x26
Packet Name: Kick Player
Packet Size: 5 bytes
Sent By: Server
Submitted: MuadDib

Description
No longer active.

Packet Breakdown
BYTE[1] cmd
BYTE[4] ID of GM who issued kick?

Packet ID: 0x27
Packet Name: Reject Move Item Request
Packet Size: 2 bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE cmd

BYTE unknown1 (0x00)

Packet ID: 0x28
Packet Name: Clear Square (God Client?)
Packet Size: 5 bytes
Sent By: Server
Submitted: MuadDib

Description
No longer active.

Packet Breakdown
BYTE[1] cmd
BYTE[2] xLoc
BYTE[2] yLoc

Packet ID: 0x29
Packet Name: Paperdoll Clothing Add Ack
Packet Size: 1 byte
Sent By: Server
Submitted: MuadDib

Description
No longer active.

Packet Breakdown
BYTE[1] Cmd

Packet ID: 0x2B
Packet Name: God Mode (God Client)
Packet Size: 2
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] Cmd
BYTE[1] 0/1 For Disable/Enable God Mode in client.

Notes
Send this packet after receiving a Request God Mode packet.

Packet ID: 0x2C
Packet Name: Resurrection Menu
Packet Size: 2 bytes
Sent By: Both
Submitted: MuadDib

Sub Commands
BYTE cmd

BYTE action (2=ghost, 1=resurrect, 0=from server)

Notes
The only use on OSI for this packet is now sending "2C02" for the You Are Dead screen upon character death.

Packet ID: 0x2D
Packet Name: Mob Attributes
Packet Size: 17 bytes
Sent By: Server
Submitted: MuadDib

Description
No longer active.

Packet Breakdown
BYTE[1] cmd
BYTE[4] serial
BYTE[2] hitsMax
BYTE[2] hitsCurrent
BYTE[2] manaMax
BYTE[2] manaCurrent
BYTE[2] stamMax
BYTE[2] stamCurrent

Packet ID: 0x2E
Packet Name: Worn Item
Packet Size: 15 bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE cmd

BYTE[4] itemid (always starts 0x40 in my data)

BYTE[2] model (item hex #)

BYTE[1] (0x00)

BYTE[1] layer

BYTE[4] playerID

BYTE[2] color/hue

Packet ID: 0x2F
Packet Name: Fight Occuring
Packet Size: 10 bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE cmd

BYTE unknown1 (0)

BYTE[4] ID of attacker

BYTE[4] ID of attacked

Packet ID: 0x30
Packet Name: Attack Ok
Packet Size: 5
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] Cmd
BYTE[4] Serial being attacked

Packet ID: 0x32
Packet Name: Unknown
Packet Size: 2 Bytes
Sent By: Server
Submitted: MuadDib

Description
IN OLD GOLD CLIENTS: This packet enables or disables "hack moving" for the god client.
If enabled, the god client will ignore impassable static/map tiles.

This should be sent after receiving a hack move request in the Edit packet.

REINTRODUCED IN AOS NORMAL CLIENT:
Not Yet Implemented on OSI servers but already in use?

Packet Breakdown
BYTE[1] cmd
BYTE[1] 0x0

Packet ID: 0x33
Packet Name: Pause Client
Packet Size: 2 bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] pause/resume (1=pause, 0=resume)

Notes
Unpause does not seem to work.

Packet ID: 0x34
Packet Name: Get Player Status
Packet Size: 10 bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE cmd

BYTE[4] pattern (0xedededed)

BYTE[1] getType

� 0x04 - Basic Stats (Packet 0x11 Return)

� 0x05 = Skills (Packet 0x3A Return)

BYTE[4] playerID

Packet ID: 0x35
Packet Name: Add Resource (God Client)
Packet Size: 653
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] Cmd
BYTE[1] 0 (Unknown)
BYTE[1] 1 (Unknown)
BYTE[2] Tile Type to attach new resource too. If 0x8000+ is for map tiles.
BYTE[127] Internal Resource Name.
BYTE[1] 00 Null Terminator.
BYTE[127] Food Resource Name.
BYTE[1] 00 Null Terminator.
BYTE[127] Shelter Resource Name.
BYTE[1] 00 Null Terminator.
BYTE[127] Desire Resource Name.
BYTE[1] 00 Null Terminator.
BYTE[127] Production Resource Name.
BYTE[1] 00 Null Terminator.
BYTE[4] If set to one, then make a consumer if excess in world.
BYTE[4] If set to one, then make a producer if excess in bank.

Packet ID: 0x37
Packet Name: Move Item (God Client)
Packet Size: 8
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] Cmd
BYTE[4] Serial to move.
BYTE[1] Z To alter by ?
BYTE[1] Y to alter by ?
BYTE[1] X to alter by ?

Packet ID: 0x38
Packet Name: Drunken Coder
Packet Size: 7 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] x
BYTE[2] y
BYTE[2] z

Notes
Only works for player played by client.
x,y,z have to be in �0xc8 range� from player�s current location. Packet has to be send 19 times(!!!) or more in a row, otherwise it doesn�t do anything.

if all this satisfied it does a pathfind like action.

location of destination is displayed above players head (can�t be disabled).

Packet ID: 0x39
Packet Name: Remove (Unknown)
Packet Size: 9
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] player serial
BYTE[4] target's serial

Notes
Outdated packet, no longer seen to be in use on OSI recently.

If player serial is zeroed, then it removes the target serial from a group?

If player serial and target serial are the same, it reports removed from group to the client.

Packet ID: 0x3A
Packet Name: Send Skills
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
Server Version:
BYTE[1] cmd
BYTE[2] blockSize
BYTE[1] Type (0x00= full list, 0xFF = single skill update, 0x02 full list with skillcap, 0xDF single skill update with cap) Repeat next until done - 46 skills
BYTE[2] id # of skill (0x01 - 0x2e)
BYTE[2] skill Value * 10
BYTE[2] Unmodified Value * 10
BYTE skillLock (0=up, 1=down, 2=locked)
If (Type==2 || Type==0xDF)
� BYTE[2] SkillCap
BYTE[2] null (00 00) (ONLY IF TYPE == 0x00)

Client Version (sets skill lock states):
BYTE[1] cmd
BYTE[2] blockSize
BYTE[2] id# of skill
BYTE skillLock (0=up, 1=down, 2=locked)

Notes
Server can also send just one skill, to update that skill only.

Packet ID: 0x3B
Packet Name: Buy Item(s)
Packet Size: Variable
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] vendorID
BYTE[1] flag
� 0x00 - no items following
� 0x02 - items following
For each item
� BYTE[1] (0x1A)
� BYTE[4] itemID (from 3C packet)
� BYTE[2] # bought

Packet ID: 0x3C
Packet Name: Items In Container
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[2] # of Item segments
Item Segments:
� BYTE[4] itemID
� BYTE[2] model
� BYTE unknown1 (0x00)
� BYTE[2] # of items in stack
� BYTE[2] xLoc
� BYTE[2] yLoc
� BYTE[4] Container ItemID
� BYTE[2] color

Packet ID: 0x3E
Packet Name: Versions (God Client)
Packet Size: 37
Sent By: Server
Submitted: Kair

Packet Breakdown
BYTE[1] Cmd
BYTE[4] Unknown
BYTE[4] Unknown
BYTE[4] Unknown
BYTE[4] Unknown
BYTE[4] Unknown
BYTE[4] Unknown
BYTE[4] Unknown
BYTE[4] Unknown
BYTE[4] Unknown

Packet ID: 0x3F
Packet Name: Update Statics (God Client)
Packet Size: variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] Cmd
BYTE[2] Length
BYTE[4] The block number of the statics grid. This can be derived by the following formula: Block_Num = X / 8 * MapHeight + Y / 8 .... MapHeight is equal to the total number of tiles in the Y-axis divided by eight (0x0200 for map0.mul).
BYTE[4] # of static items in grid.
BYTE[4] "Extra" Value in statics index file.
Item Loop:
� BYTE[2] Item ID
� BYTE[1] Item's X pos relative to top left corner of grid.
� BYTE[1] Item's Y pos relative to top left corner of grid.
� BYTE[1] Item's Z pos.
� BYTE[2] Item's Hue.

Packet ID: 0x4E
Packet Name: Personal Light Level
Packet Size: 6 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] creature id
BYTE[1] level

Packet ID: 0x4F
Packet Name: Overall Light Level
Packet Size: 2 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] level
� 0x00 - day
� 0x09 - OSI night
� 0x1F - Black
� Max normal val = 0x1F

Packet ID: 0x53
Packet Name: Idle Warning
Packet Size: 2 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] value (0x07 � idle, 0x05 � another character is online)

Packet ID: 0x54
Packet Name: Play Sound Effect
Packet Size: 12 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] mode (0x00=quiet, repeating, 0x01=single normally played sound effect)
BYTE[2] SoundModel
BYTE[2] unknown3 (speed/volume modifier? Line of sight stuff?)
BYTE[2] xLoc
BYTE[2] yLoc
BYTE[2] zLoc

Packet ID: 0x55
Packet Name: Login Complete
Packet Size: 1 byte
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd

Packet ID: 0x56
Packet Name: Map Packet (cartography/treasure)
Packet Size: 11 Bytes
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] id
BYTE[1] command
� 1 = add map point.
� 2 = add new pin with pin number.(insertion. other pins after the number are pushed back.)
� 3 = change pin
� 4 = remove pin
� 5 = remove all pins on the map
� 6 = toggle the 'editable' state of the map.
� 7 = return msg from the server to the request 6 of the client.
BYTE[1] plotting state (1=on, 0=off, valid only if command 7)
BYTE[2] x location (relative to upper left corner of the map, in pixels, for points)
BYTE[2] y location (relative to upper left corner of the map, in pixels, for points)

Packet ID: 0x5B
Packet Name: Time
Packet Size: 4 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] hour
BYTE[1] minute
BYTE[1] second

Packet ID: 0x5D
Packet Name: Login Character
Packet Size: 73 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] pattern1 (0xedededed)
BYTE[30] char name (0 terminated)
BYTE[33] unknown, mostly 0�s
(Byte# 0x27, 0x28, 0x30 seem to be the only non 0�s of these 33 bytes. Perhaps password data that�s not send anymore)
BYTE slot choosen (0-based)
BYTE[4] clientIP

Packet ID: 0x65
Packet Name: Set Weather
Packet Size: 4 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] type (See Notes)
BYTE[1] num (number of weather effects on screen)
BYTE[1] temperature

Notes
Types: 0x00 � �It starts to rain�, 0x01 � �A fierce storm approaches.�, 0x02 � �It begins to snow�, 0x03 - �A storm is brewing.�, 0xFF � None (turns off sound effects), 0xFE (no effect?? Set temperature?)

Maximum number of weather effects on screen is 70.
If it is raining, you can add snow by setting the num to the num of rain currently going, plus the number of snow you want.
Weather messages are only displayed when weather starts.
Weather will end automatically after 6 minutes without any weather change packets.
You can totally end weather (to display a new message) by teleporting. I think it�s either the 0x78 or 0x20 messages that reset it, though I haven�t checked to be sure (other possibilities, 0x4F or 0x4E)

Packet ID: 0x66
Packet Name: Books (Pages, Old Packet)
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] bookID
BYTE[2] # of pages in this packet
� For each page:
� BYTE[2] page #
� BYTE[2] # of lines on page
� Repeated for each line:
� � BYTE[var] null terminated line

Notes
server side: # of pages equals value given in 0x93/0xd4
EACH page # given. If empty: # lines: 0 + terminator (=3 0�s)
client side: # of pages always 1. if 2 pages changed, client generates 2 packets.

Packet ID: 0x69
Packet Name: Change Text/Emote Colors
Packet Size: 5 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[2] unknown1

Notes
The client sends two of these independent of the color chosen. It sends two of them in quick succession as part of the "same" packet. The unknown1 is 0x00 0x01 in the first and 0x00 0x02 in the second.
This message has been removed. It is no longer used.

Packet ID: 0x6C
Packet Name: Target Cursor Commands
Packet Size: 19 Bytes
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] type
� 0x00 = Select Object
� 0x01 = Select X, Y, Z
BYTE[4] cursorID
BYTE[1] Cursor Type
� 0 = ?
� 1 = ?
� 2 = ?
� 3 = Cancel current targetting
The following are always sent but are only valid if sent by client
� BYTE[4] Clicked On ID
� BYTE[2] click xLoc
� BYTE[2] click yLoc
� BYTE unknown (0x00)
� BYTE click zLoc
� BYTE[2] model # (if a static tile, 0 if a map/landscape tile)

Notes
The model # should never be trusted.

Once the server requests the client to target something, the server can undo this also. You can "kill" the targetting cursor faithfully and without any bugs. Send another Packet with Type set to 0 (Object), Cursor ID 00000000, and Cursor Type as 3. The client will respond to this by sending a response to the original request just as if the user had hit ESC to cancel targetting.

Packet ID: 0x6D
Packet Name: Play Midi Music
Packet Size: 3 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] musicID

Packet ID: 0x6E
Packet Name: Character Animation
Packet Size: 14 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] item/char ID
BYTE[2] movement model
� 0x00 = walk
� 0x01 = walk faster
� 0x02 = run
� 0x03 = run (faster?)
� 0x04 = nothing
� 0x05 = shift shoulders
� 0x06 = hands on hips
� 0x07 = attack stance (short)
� 0x08 = attack stance (longer)
� 0x09 = swing (attack with knife)
� 0x0a = stab (underhanded)
� 0x0b = swing (attack overhand with sword)
� 0x0c = swing (attack with sword over and side)
� 0x0d = swing (attack with sword side)
� 0x0e = stab with point of sword
� 0x0f = ready stance
� 0x10 = magic (butter churn!)
� 0x11 = hands over head (balerina)
� 0x12 = bow shot
� 0x13 = crossbow
� 0x14 = get hit
� 0x15 = fall down and die (backwards)
� 0x16 = fall down and die (forwards)
� 0x17 = ride horse (long)
� 0x18 = ride horse (medium)
� 0x19 = ride horse (short)
� 0x1a = swing sword from horse
� 0x1b = normal bow shot on horse
� 0x1c = crossbow shot
� 0x1d = block #2 on horse with shield
� 0x1e = block on ground with shield
� 0x1f = swing, and get hit in middle
� 0x20 = bow (deep)
� 0x21 = salute
� 0x22 = scratch head
� 0x23 = 1 foot forward for 2 secs
� 0x24 = same
BYTE[1] unknown1 (0x00)
BYTE[1] direction
BYTE[2] repeat (1 = once / 2 = twice / 0 = repeat forever)
BYTE[1] forward/backwards(0x00=forward, 0x01=backwards)
BYTE[1] repeat Flag (0 - Don't repeat / 1 repeat)
BYTE[1] frame Delay (0x00 - fastest / 0xFF - Too slow to watch)

Packet ID: 0x6F
Packet Name: Secure Trading
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[1] action
BYTE[4] id1
BYTE[4] id2
BYTE[4] id3
BYTE[1] nameFollowing (0 or 1)
If (nameFollowing = 1)
BYTE[?] charName

Packet ID: 0x70
Packet Name: Graphical Effect
Packet Size: 28 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] direction type
� 00 = go from source to dest
� 01 = lightning strike at source
� 02 = stay at current x,y,z
� 03 = stay with current source character id
BYTE[4] character id
BYTE[4] target id
BYTE[2] model of the first frame of the effect
BYTE[2] xLoc
BYTE[2] yLoc
BYTE zLoc
BYTE[2] xLoc of target
BYTE[2] yLoc of target
BYTE[1] zLoc of target
BYTE[1] speed of the animation
BYTE[1] duration (0=really long, 1= shortest)
BYTE[2] unknown2 (0 works)
BYTE[1] adjust direction during animation (1=no)
BYTE[1] explode on impact

Packet ID: 0x71
Packet Name: Bulletin Board Messages
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] len
BYTE[1] subcmd
BYTE[len-4] submessage

Sub Commands
Subcommand 0 � Display Bulletin Board (Server)
BYTE[4] BoardID
BYTE[22] board name (default is �bulletin board�, the rest nulls)
BYTE[4] ID (0x402000FF)
BYTE[4] zero (0)

Subcommand 1 � Message Summary (Server)
BYTE[4] BoardID
BYTE[4] MessageID
BYTE[4] ParentID (0 if top level)
BYTE[1] posterLen
BYTE[posterLen] poster (null terminated string)
BYTE[1] subjectLen
BYTE[subjectLen] subject (null terminated string)
BYTE[1] timeLen
BYTE[timeLen] time (null terminated string with time of posting) (�Day 1 @ 11:28�)

Subcommand 2 � Message (Server)
BYTE[4] BoardID
BYTE[4] MessageID
BYTE[1] posterLen
BYTE[posterLen] poster (null terminated string)
BYTE[1] subjectLen
BYTE[subjectLen] subject (null terminated string)
BYTE[1] timeLen
BYTE[timeLen] time (null terminated string with time of posting) (�Day 1 @ 11:28�)
BYTE[29] constant: (01 91 84 0A 06 1E FD 01 0B 15 2E 01 0B 17 0B 01 BB 20 46 04 66 13 F8 00 00 0E 75 00 00)
BYTE[1] numlines
For each line:
BYTE[1] linelen
BYTE[linelen] body (null terminated)

Subcommand 3 � Request Message (Client)
BYTE[4] BoardID
BYTE[4] MessageID

Subcommand 4 � Request Message Summary (Client)
BYTE[4] BoardID
BYTE[4] MessageID

Subcommand 5 � Post a message (Client)
BYTE[4] BoardID
BYTE[4] Replying to ID (0 if this is a top level / non-reply post)
BYTE[1] subjectLen (length of the subject, includes null termination)
BYTE[subjectLen] subject (null terminated)
BYTE[1] numlines
For each line:
� BYTE linelen
� BYTE[linelen] body (null terminated)

Subcommand 6 � Remove Posted Message (Client)
BYTE[4] BoardID
BYTE[4] MessageID

Packet ID: 0x72
Packet Name: Request War Mode
Packet Size: 5 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] flag
� 0x00 - Normal
� 0x01 - Fighting
BYTE[3] unknown1 (always 00 32 00 in testing)

Notes
Server replies with 0x77 packet

Packet ID: 0x73
Packet Name: Ping Message
Packet Size: 2 Bytes
Sent By: Both?
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] seq

Packet ID: 0x74
Packet Name: Open Buy Window
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] (vendorID | 0x40000000)
BYTE[1] # of items
# of items worth of item segments
� BYTE[4] price
� BYTE length of text description
� BYTE[text length] item description

Notes
This packet is always preceded by a describe contents packet (0x3c) with the container id as the (vendorID | 0x40000000) and then an open container packet (0x24?) with the vendorID only and a model number of 0x0030 (probably the model # for the buy screen)

Packet ID: 0x75
Packet Name: Rename Character
Packet Size: 35 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] id
BYTE[30] new name

Packet ID: 0x76
Packet Name: New Subserver
Packet Size: 16 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] xLoc
BYTE[2] yLoc
BYTE[2] zLoc
BYTE[1] unknown (always 0)
BYTE[2] server boundry X
BYTE[2] server boundry Y
BYTE[2] server boundry Width
BYTE[2] server boundry Height

Packet ID: 0x77
Packet Name: Update Player
Packet Size: 17 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] player id
BYTE[2] model
BYTE[2] xLoc
BYTE[2] yLoc
BYTE[1] zLoc
BYTE[1] direction
BYTE[2] hue/skin color
BYTE[1] flag (bit field)
BYTE[1] highlight color

Packet ID: 0x78
Packet Name: Draw Object
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] itemID/playerID
BYTE[2] model (item hex #)
BYTE[2] xLoc (only 15 lsb)
BYTE[2] yLoc
BYTE[1] zLoc
BYTE[1] direction
BYTE[2] dye/skin color
BYTE[1] Status flag
BYTE[1] notoriety (2's complement signed)
if (BYTE[4] == 0x00 0x00 0x00 0x00)
� DONE
else loop this until above if statement is satisified
� BYTE[4] itemID
� BYTE[2] model (item hex # - only 15 lsb)
� BYTE[1] layer
� if (model & 0x8000)
� � BYTE[2] hue

Notes
// Status Options:
// 0x00 Normal
// 0x01 Unknown
// 0x02 CanAlterPaperdoll
// 0x04 Poisoned
// 0x08 GoldenHealth
// 0x10 Unknown
// 0x20 Unknown
// 0x40 WarMode
//
//
// Noto Options:
// 0x1 Innocent (Blue)
// 0x2 Friend (Green)
// 0x3 Grey (Grey - Animal)
// 0x4 Criminal (Grey)
// 0x5 Enemy (Orange)
// 0x6 Murderer (Red)
// 0x7 Invulnerable (Yellow)

Packet ID: 0x7C
Packet Name: Open Dialog Box
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] dialogID (echo'd back to the server in 7d)
BYTE[2] menuid (echo'd back to server in 7d)
BYTE[1] length of question
BYTE[length of question] question text
BYTE[1] # of responses
Then for each response:
� BYTE[2] model id # of shown item (if grey menu -- then always 0x00 as msb)
� BYTE[2] color of shown item
� BYTE response text length
� BYTE[response text length] response text

Packet ID: 0x7D
Packet Name: Response To Dialog Box
Packet Size: 13 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] dialogID (echoed back from 7C packet)
BYTE[2] menuid (echoed back from 7C packet)
BYTE[2] 1-based index of choice
BYTE[2] model # of choice
BYTE[2] color

Packet ID: 0x80
Packet Name: Login Request
Packet Size: 62 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[30] userid
BYTE[30] password
BYTE[1] unknown1 (not usually 0x00 - so not NULL)

Packet ID: 0x82
Packet Name: Login Denied
Packet Size: 2 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] why
� 0x00 = unknown user
� 0x01 = account already in use
� 0x02 = account disabled
� 0x03 = password bad
� 0x04 and higher = communications failed

Packet ID: 0x83
Packet Name: Delete Character
Packet Size: 39 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[30] password
BYTE[4] charIndex
BYTE[4] clientIP

Packet ID: 0x86
Packet Name: Resend Characters After Delete
Packet Size: 304 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[1] # of characters
Following repeated 5 times
� BYTE[30] character name
� BYTE[30] character password

Packet ID: 0x88
Packet Name: Open Paperdoll
Packet Size: 66 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] charid
BYTE[60] text
BYTE[1] flag byte

Notes
If Flag Byte is 0x02 It allows you to alter someone else's paperdoll in regards to clothing, etc.

Packet ID: 0x89
Packet Name: Corpse Clothing
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] corpseID
BYTE[1] itemLayer
BYTE[4] itemID
BYTE[1] terminator (0x00)

Notes
Followed by a 0x3C message with the contents.

Packet ID: 0x8C
Packet Name: Connect To Game Server
Packet Size: 11 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] gameServer IP
BYTE[2] gameServer port
BYTE[4] new key

Packet ID: 0x90
Packet Name: Map Message
Packet Size: 19 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] key used
BYTE[2] gump art id (0x139D)
BYTE[2] upper left x location
BYTE[2] upper left y location
BYTE[2] lower right x location
BYTE[2] lower right y location
BYTE[2] gump width in pixels
BYTE[2] gump height in pixels

Packet ID: 0x91
Packet Name: Game Server Login
Packet Size: 65 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] key used
BYTE[30] sid
BYTE[30] password

Packet ID: 0x93
Packet Name: Books (Title Page, Old Packet)
Packet Size: 99 Bytes
Sent By: Both
Submitted: MuadDib

Packet Breakdown
Server Version:
BYTE[1] cmd
BYTE[4] bookID
BYTE[1] write flag
� 0x00 - non-writable
� 0x01 - writable
BYTE[1] new flag
BYTE[2] # of pages
BYTE[60] title
BYTE[30] author

Client Version:
BYTE[1] cmd
BYTE[4] bookID
BYTE[4] unknown (0)
BYTE[60] title (zero terminated, garbage after terminator)
BYTE[30] author (zero terminated, garbage after terminator)

Notes
Client sends a 0x93 message on book close. Tis an Update packet for the server to handle changes etc for this.

Packet ID: 0x95
Packet Name: Dye Window
Packet Size: 9 Bytes
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] itemID of dye target
BYTE[2] ignored on send, model on return
BYTE[2] model on send, color on return from client (default on server send is 0x0FAB)

Packet ID: 0x97
Packet Name: Move Player
Packet Size: 2 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] direction

Notes
Moves player played by client one step in requested direction. Doesn�t move if there are obstacles.

Packet ID: 0x98
Packet Name: All Names (3D Client Only)
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blocksize
BYTE[4] ID
If (server-reply)
BYTE[30] name (0 terminated)

Notes
Only 3D clients send this packet. Server and client packet.

Client asks for name of object with ID x. Server has to reply with ID + name. Client automatically knows names of items. Hence it only asks only for NPC/Player names nearby, but shows bars of items plus NPC�s.

Client request has 7 bytes, server-reply 37. Triggered by Crtl + Shift.

Packet ID: 0x99
Packet Name: Give Boat/House Placement View
Packet Size: 26 Bytes
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] request (0x01 from server, 0x00 from client)
BYTE[4] ID of deed
BYTE[12] unknown (all 0)
BYTE[2] multi model (item model - 0x4000)
BYTE[6] unknown (all 0)

Packet ID: 0x9A
Packet Name: Console Entry Prompt
Packet Size: 16 Bytes
Sent By: Both?
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] objectID
BYTE[4] prompt#
BYTE[4] 0=request/esc, 1=reply
BYTE[?] textstring (optional)
BYTE terminator (0x00)

Packet ID: 0x9B
Packet Name: Request Help
Packet Size: 258 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[257] (0x00)

Packet ID: 0x9E
Packet Name: Sell List
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] shopkeeperID
BYTE[2] numItems
For each item, a structure containing:
� BYTE[4] itemID
� BYTE[2] itemModel
� BYTE[2] itemHue/Color
� BYTE[2] itemAmount
� BYTE[2] value
� BYTE[2] nameLength
� BYTE[?] name

Packet ID: 0x9F
Packet Name: Sell List Reply
Packet Size: Variable
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] shopkeeperID
BYTE[2] itemCount
For each item, a structure containing:
� BYTE[4] itemID
� BYTE[2] quantity

Packet ID: 0xA0
Packet Name: Select Server
Packet Size: 3 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] server # chosen

Packet ID: 0xA1
Packet Name: Update Current Health
Packet Size: 9 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] playerID
BYTE[2] maxHealth
BYTE[2] currentHealth

Packet ID: 0xA2
Packet Name: Update Current Mana
Packet Size: 9 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] playerID
BYTE[2] maxMana
BYTE[2] currentMana

Packet ID: 0xA3
Packet Name: Update Current Stamina
Packet Size: 9 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] playerID
BYTE[2] maxStamina
BYTE[2] currentStamina

Packet ID: 0xA4
Packet Name: Client Spy
Packet Size: Variable
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[148] Unknown (previously, this has had info such as your graphics card name, free HD space, number of processors, etc.)

Packet ID: 0xA5
Packet Name: Open Web Browser
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[blockSize-3] null terminated full web address

Packet ID: 0xA6
Packet Name: Tip/Notice Window
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[1] flag
� 0x00 - tips window
� 0x01 � ignored
� 0x02 - updates
BYTE[4] tip #
BYTE[2] msgSize
BYTE[msgSize] message (ascii, not null terminated)

Packet ID: 0xA7
Packet Name: Request Tip/Notice Window
Packet Size: 4 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] last tip #
BYTE[1] flag
� 0x00 - tips window
� 0x01 - notice window

Packet ID: 0xA8
Packet Name: Game Server List
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE cmd
BYTE[2] blockSize
BYTE System Info Flag
� 0xCC - Don't send
� 0x64 - Send Video card
� ?? -
BYTE[2] # of servers
Then each server --
� BYTE[2] serverIndex (0-based)
� BYTE[32] serverName
� BYTE percentFull
� BYTE timezone
� BYTE[4] pingIP

Packet ID: 0xA9
Packet Name: Characters / Starting Locations
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE cmd
BYTE[2] blockSize
BYTE # of characters

Following repeated 5 times
BYTE[30] character name
BYTE[30] character password
BYTE number of starting locations

Following for as many locations as you have
BYTE locationIndex (0-based)
BYTE[31] town (general name)
BYTE[31] exact name

BYTE[4] Flags (see notes)

Notes
Flags list:
0x02 = send config/req logout (IGR?)
0x04 = single character (siege)
0x08 = enable npcpopup menus
0x10 = unknown
0x20: enable common AOS features (tooltip thing/fight system book, but not AOS monsters/map/skills)

Flags can be comined as literals to view. Such as to have NPC Popup Menus AND Common AOS Features, send as 0x28, not 0x8 plus 0x20 form.

Packet ID: 0xAA
Packet Name: Allow/Refuse Attack
Packet Size: 5 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] CharID being attacked

Notes
ID is set to 00 00 00 00 when attack is refused.

Packet ID: 0xAB
Packet Name: Gump Text Entry Dialog
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] id
BYTE[1] parentID
BYTE[1] buttonID
BYTE[1] textlen
BYTE[?] text
BYTE[1] cancel (0=disable, 1=enable)
BYTE[1] style (0=disable, 1=normal, 2=numerical)
BYTE[4] format (if style 1, max text len, if style2, max numeric value)
BYTE[1] text2 length
BYTE[?] text2

Packet ID: 0xAC
Packet Name: Gump Text Entry Dialog Reply
Packet Size: Variable
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[4] ID
BYTE[1] type
BYTE[1] index
BYTE[3] unkown?
BYTE[?] reply

Packet ID: 0xAD
Packet Name: Unicode/Ascii speech request
Packet Size: Variable
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[1] Type
BYTE[2] Color
BYTE[2] Font
BYTE[4] Language (Null Terminated)
� �enu� - United States English
� �des� - German Swiss
� �dea� - German Austria
� �deu� - German Germany
� ... for a complete list see langcode.iff
if (Type & 0xc0)
� BYTE[1,5] Number of distinct Trigger words (NUMWORDS). 12 Bit number, Byte #13 = Bit 11�4 of NUMWORDS, Hi-Nibble of Byte #14 (Bit 7�4) = Bit 0�3 of NUMWORDS
� BYTE[1,5] Index to speech.mul. 12 Bit number, Low Nibble of Byte #14 (Bits 3�0) = Bits 11..8 of Index, Byte #15 = Bits 7�0 of Index
� UNKNOWNS = ( (NUMWORDS div 2) *3 ) + (NUMWORDS % 2) � 1. div = Integeger division, % = modulo operation, NUMWORDS >= 1. examples: UNKNOWNS(1)=0, UNKNOWNS(2)=2, UNKNOWNS(3)=3, UNKNOWNS(4)=5, UNKNOWNS(5)=6, UNKNOWNS(6)=8, UNKNOWNS(7)=9, UNKNOWNS(8)=11, UNKNOWNS(9)=12
� BYTE[UNKNOWNS] Idea behind this is getting speech parsing load client side.
Thus this contains data OSI server use for easier parsing. It�s client side hardcoded and exact details are unkown.
� BYTE[?] Ascii Msg � Null Terminated(blockSize � (15+UNKNOWNS) )
else
� BYTE[?][2] Unicode Msg - Null Terminated (blockSize - 12)

Notes
For pre 2.0.7 clients Type is always < 0xc0. Uox based emus convert post 2.0.7 data of this packet to pre 2.0.7 data if Type >=0xc0.

(different view of it)
If Mode&0xc0 then there are keywords (from speech.mul) present.
Keywords:
The first 12 bits = the number of keywords present. The keywords are included right after this, each one is 12 bits also.
The keywords are padded to the closest byte. For example, if there are 2 keywords, it will take up 5 bytes. 12bits for the number, and 12 bits for each keyword. 12+12+12=36. Which will be padded 4 bits to 40 bits or 5 bytes.

Packet ID: 0xAE
Packet Name: Unicode Speech message
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[4] ID
BYTE[2] Model
BYTE[1] Type
BYTE[2] Color
BYTE[2] Font
BYTE[4] Language
BYTE[30] Name
BYTE[?][2] Msg � Null Terminated (blockSize � 48)

Packet ID: 0xAF
Packet Name: Display Death Action
Packet Size: 13 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] player id
BYTE[4] corpse id
BYTE[4] unknown (all 0)

Packet ID: 0xB0
Packet Name: Send Gump Menu Dialog
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] blockSize
BYTE[4] id
BYTE[4] gumpid
BYTE[4] x
BYTE[4] y
BYTE[2] command section length
BYTE[?] commands (zero terminated)
BYTE[2] numTextLines
� BYTE[2] text length (in unicode (2 byte) characters.)
� BYTE[?] text (in unicode)

Notes
In gump packets, and with any EMU (POL for sure) the "ID" is the # of the script's PID that fired the gump. This can be used via specific 0xBF packets to send the ID to the client to force closing of the gump from the server. When this is done, the client Auto Responds as if it had "exited" the menu normally so the serverside script will handle it as such.

Packet ID: 0xB1
Packet Name: Gump Menu Selection
Packet Size: Variable
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[4] id (first Id in 0xb0)
BYTE[4] gumpId (second Id in 0xb0)
BYTE[4] buttonId (which button perssed ? 0 if closed)
BYTE[4] switchcount (response info for radio buttons and checkboxes, any switches listed here are switched on)
For each switch
� BYTE[4] SwitchId
BYTE[4] textcount (response info for textentries)
For each textentry
� BYTE[2] textId
� BYTE[2] textlength
� BYTE[length*2] Unicode text (not nullterminated)

Packet ID: 0xB2
Packet Name: Chat Message
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[2] messageType
Messagetypes will be listed as Subcommands.

Sub Commands
Messagetypes 0x0001 - 0x0024:
BYTE[4] unknown (00 00 00 00)
BYTE[len-9] Unicode for %1 if the message type has a %1 variable for inputting text.
BYTE[2] Null Terminator if there is a %2 Unicode element. (00 00)
BYTE[len-(2+%1+9)] Unicode for %2 if the message type has a %2 variable for inputting text.
BYTE[2] Null Terminator for Packet (00 00)

Messagetypes 0x0028 - 0x002C:
BYTE[4] unknown (00 00 00 00)
BYTE[len-9] Unicode for %1 if the message type has a %1 variable for inputting text.
BYTE[2] Null Terminator if there is a %2 Unicode element. (00 00)
BYTE[len-(2+%1+9)] Unicode for %2 if the message type has a %2 variable for inputting text.
BYTE[2] Null Terminator for Packet (00 00)

MessageType 0x0025 (Message), 0x0026 (Emote), 0x0027 (OOC):
BYTE[3] Language Code (ENU for english)
BYTE[1] Null Terminator (00)
BYTE[2] Message from (see notes)
BYTE[?] Username in Unicode
BYTE[2] Null Terminator for Username (00 00)
BYTE[?] Unicode Message Sent
BYTE[2] Null Terminator for Message

MessageType 0x03E8 (create conference):
BYTE[4] Unknown (00 00 00 00)
BYTE[?] Unicode Channel Name
BYTE[2] Null Terminator for Channel Name (00 00)
BYTE[2] Password Setting (00 30 = No Pass, 00 31 = Password required)
BYTE[2] Null Terminator for packet (00 00)

MessageType 0x03E9 (Destroy conference):
BYTE[4] Unknown (00 00 00 00)
BYTE[?] Unicode Channel Name
BYTE[4] Unknown (00 00 00 00)

MessageType 0x03EB (Display Enter Username window):
BYTE[8] Unknown (00 00 00 00 00 00 00 00)

MessageType 0x03EC (Close Chat):
BYTE[8] Unknown (00 00 00 00 00 00 00 00)

MessageType 0x03ED (Username accepted, display chat):
BYTE[4] Unknown (00 00 00 00)
BYTE[?] Unicode Username
BYTE[4] Null Terminator (00 00 00 00)

MessageType 0x03EE (Add User):
BYTE[4] Unknown (00 00 00 00)
BYTE[2] User Type (see notes)
BYTE[?] Unicode Username
BYTE[2] Null Terminator (00 00)

MessageType 0x03EF (Remove User):
BYTE[2] Unknown (00 00)
BYTE[?] Unicode Username
BYTE[2] Null Terminator (00 00)

MessageType 0x03F0 (Clear All Players):
BYTE[8] Unknown (00 00 00 00 00 00 00 00)

MessageType 0x03F1 (You have joined the %1 Conference):
BYTE[4] Unknown (00 00 00 00)
BYTE[?] Unicode Conference Name (%1)
BYTE[4] Unknown (00 00 00 00)

Notes
MessageTypes 0x0001 - 0x0024 and 0x0028 - 0x002C: Directly from Chat.enu file:
0x0001: You are already ignoring the maximum number of peolpe.
0x0002: You are already ignoring %1.
0x0003: You are now ignoring %1.
0x0004: You are no longer ignoring %1.
0x0005: You are not ignoring %1.
0x0006: You are no longer ignoring anyone.
0x0007: That is not a valid conference name.
0x0008: There is already a conference of that name.
0x0009: You must have operator status to do this.
0x000A: Conference %1 renamed to %2.
0x000B: You must be in a conference to do this. To join a conference, select one from the Conference menu.
0x000C: There is no player named '%1'.
0x000D: There is no conference named '%1'.
0x000E: That is not the correct password.
0x000F: %1 has chosen to ignore you. None of your messages to them will get through.
0x0010: The moderator of this conference has not given you speaking privileges.
0x0011: You can now receive private messages.
0x0012: You will no longer receive private messages. Those who send you a message will be notified that you are blocking incoming messages.
0x0013: You are now showing your character name to any players who inquire with the whois command.
0x0014: You are no longer showing your character name to any players who inquire with the whois command.
0x0015: %1 is remaining anonymous.
0x0016: %1 has chosen to not receive private messages at the moment.
0x0017: %1 is known in the lands of Britannia as %2.
0x0018: %1 has been kicked out of the conference.
0x0019: %1, a conference moderator, has kicked you out of the conference.
0x001A: You are already in the conference '%1'.
0x001B: %1 is no longer a conference moderator.
0x001C: %1 is now a conference moderator.
0x001D: %1 has removed you from the list of conference moderators.
0x001E: %1 has made you a conference moderator.
0x001F: %1 no longer has speaking privileges in this conference.
0x0020: %1 now has speaking privileges in this conference.
0x0021: %1, a conference moderator, has removed your speaking privileges for this conference.
0x0022: %1, a conference moderator, has granted you speaking privileges in this conference.
0x0023: From now on, everyone in the conference will have speaking privileges by default.
0x0024: From now on, only moderators will have speaking privileges in this conference by default.
0x0028: The password to the conference has been changed.
0x0029: Sorry--the conference named '%1' is full and no more players are allowed in.
0x002A: You are banning %1 from this conference.
0x002B: %1, a conference moderator, has banned you from the conference.
0x002C: You have been banned from this conference.

MessageTypes 0025, 0026, and 0027: Message from is as follows:
0x0030 = user, 0x0031 = moderator, 0x0032 = muted, 0x0034 = me, 0x0035 = system

MessageType 03EE: User types are 0030 for User, 0031 for Moderator, and 0032 for Muted User.

Packet ID: 0xB3
Packet Name: Chat Text
Packet Size: Variable
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] Length
BYTE[4] Language
BYTE[2] UnKNOWN(00 00)
BYTE[1] Text/Command Type

Sub Commands
Type 0x41 (Change Password):
BYTE[?] Unicode Password
BYTE[2] Null Terminator (00 00)

Type 0x58 (Close):
BYTE[2] Null Terminator (00 00)

Type 0x61 (Message):
BYTE[?] Unicode Message
BYTE[2] Null Terminator (00 00)

Text 0x62 (Join Conference):
BYTE[2] Holder (0x0022)
BYTE[?] Unicode conference name
BYTE[2] Holder (0x0022)
BYTE[2] Holder (0x0020)
BYTE[?] Unicode password if pass req'd
BYTE[2] Null Teriminator (0x0000)

Text 0x63 (Create New Conference):
BYTE[?] Unicode conference name
BYTE[2] Holder (0x007b) if pass entered
BYTE[?] Unicode conference pass if pass entered
BYTE[2] Holder (0x007d) if pass entered
BYTE[2] Null Teriminator (0x0000)

Text 0x64 (Rename Conference):
BYTE[?] Unicode conference name (all text after /rename )
BYTE[2] Null Teriminator (0x0000)

Text 0x65 (Send Private Message):
BYTE[?] Unicode name (all text after /msg )
BYTE[2] Null Teriminator (0x0000)

Text 0x66 (Ignore):
BYTE[?] Unicode name (all text after +ignore )
BYTE[2] Null Teriminator (0x0000)

Text 0x67 (Stop Ignoring):
BYTE[?] Unicode name (all text after -ignore )
BYTE[2] Null Teriminator (0x0000)

Text 0x68 (Toggle Ignore):
BYTE[?] Unicode name (all text after /ignore )
BYTE[2] Null Teriminator (0x0000)

Text 0x69 (Grant Speaking Priveleges):
BYTE[?] Unicode name (all text after +voice )
BYTE[2] Null Teriminator (0x0000)

Text 0x6A (Remove Speaking Priveleges):
BYTE[?] Unicode name (all text after -voice )
BYTE[2] Null Teriminator (0x0000)

Text 0x6B (Toggle Speaking Priveleges):
BYTE[?] Unicode name (all text after /voice )
BYTE[2] Null Teriminator (0x0000)

Text 0x6C (Grant Moderator Status):
BYTE[?] Unicode name (all text after +ops )
BYTE[2] Null Teriminator (0x0000)

Text 0x6D (Remove Moderator Status):
BYTE[?] Unicode name (all text after -ops )
BYTE[2] Null Teriminator (0x0000)

Text 0x6E (Toggle Moderator Status):
BYTE[?] Unicode name (all text after /ops )
BYTE[2] Null Teriminator (0x0000)

Text 0x6F (not receiving messages):
BYTE[2] Null Teriminator (0x0000)

Text 0x70 (receiving messages):
BYTE[2] Null Teriminator (0x0000)

Text 0x71 (Toggle receiving messages):
BYTE[2] Null Teriminator (0x0000)

Text 0x72 (show my character name):
BYTE[2] Null Teriminator (0x0000)

Text 0x73 (don't show my character name):
BYTE[2] Null Teriminator (0x0000)

Text 0x74 (Toggle showing my character name):
BYTE[2] Null Teriminator (0x0000)

Text 0x75 (Who is this player?):
BYTE[?] Unicode text (all text after /whois )
BYTE[2] Null Teriminator (0x0000)

Text 0x76 (Kick out of the conference?):
BYTE[?] Unicode text (all text after /kick )
BYTE[2] Null Teriminator (0x0000)

Text 0x77 (only moderators have speaking priveleges by default):
BYTE[2] Null Teriminator (0x0000)

Text 0x78 (everyone has speaking priveleges by default):
BYTE[2] Null Teriminator (0x0000)

Text 0x79 (Toggle default speaking priveleges):
BYTE[2] Null Teriminator (0x0000)

Text 0x7A (emote)
BYTE[?] Unicode text (all text after /emote or /em ):
BYTE[2] Null Teriminator (0x0000)

Packet ID: 0xB5
Packet Name: Open Chat Window
Packet Size: 64 bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[63] chatname, if known by client (all 00 if unknown) (name in unicode)

Notes
This message is very incomplete. From the server, just know that it is 0xB5 len len, and pass the data through as is appropriate.

Packet ID: 0xB6
Packet Name: Send Help/Tip Request
Packet Size: 9 Bytes
Sent By: Client
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] id
BYTE[1] language # (1 for enu)
BYTE[3] language name (enu for English � United states)

Packet ID: 0xB7
Packet Name: Help/Tip Data
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[4] id
BYTE[?][2] message, in unicode
BYTE[2] null terminator (0x0000)
BYTE[2] message terminator (0x3300)

Packet ID: 0xB8
Packet Name: Request/Char Profile
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[1] mode (CLIENT ONLY! Does not exist in server message.)
BYTE[4] id
If request, ends here.
If Update request
� BYTE[2] cmdType (0x0001 � Update)
� BYTE[2] msglen (# of unicode characters)
� BYTE[msglen][2] new profile, in unicode, not null terminated.
Else If from server
� BYTE[?] title (not unicode, null terminated.)
� BYTE[?][2] static profile ( unicode string can't be edited )
� BYTE[2] (0x0000) (static profile terminator)
� BYTE[?][2] profile (in unicode, can be edited)
� BYTE[2] (0x0000) (profile terminator)

Packet ID: 0xB9
Packet Name: Enable locked client features
Packet Size: 3 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] feature #

Notes
if (MSB not set)
Bit# 1 T2A upgrade, enables chatbutton
Bit# 2 enables LBR update. (of course LBR installation is required)(plays MP3 instead of midis, 2D LBR client shows new LBR monsters,�)
if (MSB set)
Bit# 3 T2A upgrade, enables chatbutton
Bit# 4 enables LBR update
Bit#5 enables AOS update (Aos monsters/map (AOS installation required for that) , AOS skills/necro/paladin/fight book stuff � works for ALL clients 4.0 and above)

Examples:
AOS-7AV: B9803B
AOS: B9801B
LBR: B90003

Packet ID: 0xBA
Packet Name: Quest Arrow
Packet Size: 6 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] active (1=on, 0=off)
BYTE[2] xLoc
BYTE[2] yLoc

Packet ID: 0xBB
Packet Name: Ultima Messenger
Packet Size: 9 Bytes
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] id1
BYTE[4] id2

Packet ID: 0xBC
Packet Name: Seasonal Information
Packet Size: 3 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] id1
BYTE[1] id2

Notes
If id2 = 1, then this is a season change. If season change, then id1 = (0=spring, 1=summer, 2=fall, 3=winter, 4 = desolation)

Packet ID: 0xBD
Packet Name: Client Version
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
If (client-version of packet)
BYTE[len-3] string stating the client version (0 terminated) (like: �1.26.4�)

Notes
Client version : client sends its version string (e.g �3.0.8j�)
Server version : 0xbd 0x0 0x3 (client replies with client version of this packet)

Clients sends a client version of this packet ONCE at login (without server request.)

Packet ID: 0xBE
Packet Name: Assist Version
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
If (client-version of packet)
� BYTE[4] Assist version (numeric)
� BYTE[?] string stating the client version (0 terminated) (like: �1.26.4�)
If (server-version of packet)
� BYTE[4] Allowed Assist version (numeric)

Notes
Server requests assist version via server side version of this packet, client replies with client side version of packet. If it�s a client without Assist, allowed Assists version from server is relayed in client version packet. Because assist never has assist version 0, that would be a way to disallow it.

Packet ID: 0xBF
Packet Name: General Information Packet
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[2] subcmd
BYTE[length-5] submessage/commands

Sub Commands
Subcommand 1: Initialize Fast Walk Prevention
BYTE[4] key1
BYTE[4] key2
BYTE[4] key3
BYTE[4] key4
BYTE[4] key5
BYTE[4] key6

Subcommand 2: Add key to Fast Walk Stack
BYTE[4] newkey

Subcommand 4: "Close Generic Gump"
BYTE[4] dialogID // which gump to destroy (second ID in 0xB0 packet)
BYTE[4] buttonId // response buttonID for packet 0xB1

Subcommand 5: Screen size
BYTE[2] unknown1 , always 0 ?
BYTE[2] X
BYTE[2] Y
BYTE[2] unknown2

---- Start of Subcommand 0x6 ----
Subcommand 6: Party System
Subsubcommands for 6:
Subsubcommand 1: Add a party member (4 bytes)
� BYTE[4] id (if 0, a targeting cursor appears)Client Message

Subsubcommand 1: Add party member(s) (1+ numMembers*4)
� BYTE[1] number of Members (total number of members in the party)
Then, for each member in numMembers:
� BYTE[4] id
Server Message

Subsubcommand 2: Remove a party member (4 bytes)
� BYTE[4] id (if 0, a targeting cursor appears)
Client message

Subsubcommand 2: Remove a party member (? Bytes)
� BYTE[1] number of Members (total number of members in the new party)
� BYTE[4] idofPlayerRemoved
Then, for each member in numMembers:
� BYTE[4] id
Server message

Subsubcommand 3: Tell party member a message (Variable # of bytes)
� BYTE[4] id (of target, from client, of source, from server)
� BYTE[n][2] Null terminated Unicode message.
Client & Server Message

Subsubcommand 4: Tell full party a message (Variable # of bytes)
� BYTE[n][2] Null terminated Unicode message.
Client Message.

Subsubcommand 4: Tell full party a message (Variable # of bytes)
� BYTE[4] id (of source)
� BYTE[n][2] Null terminated Unicode message.
Server Message

Subsubcommand 6: Party Can Loot Me? (1 byte)
� BYTE[1] canloot (0=no, 1=yes)
Client message

Subsubcommand 8: Accept join party invitation (4 bytes)
� BYTE[4] id (party leader�s id)
Client message

Subsubcommand 9: Decline join party invitation (4 bytes)
� BYTE[4] id (party leader�s id)
Client message
---- End of Subcommand 0x6 ----

Subcommand 8: Set cursor hue / Set MAP
BYTE[1] hue (0 = Felucca, unhued / BRITANNIA map. 1 = Trammel, hued gold / BRITANNIA map, 2 = (switch to) ILSHENAR map)

Subcommand 0x0a: wrestling stun
Sent by using the client's Wrestle Stun Macro key in Options. This is no longer used since AoS was introduced. The Macro selection that used it was removed.

Subcommand 0x0b: Client Language
BYTE[3] language (ENU, for English)

Subcommand 0x0c: Closed Status Gump
BYTE[4] id (character id)

Subcommand 0x0e: 3D Client Action
BYTE[4] Animation ID. See Notes for list.

Subcommand 0x0f: unknown , send once at login
BYTE[5] unknown (0a 00 00 00 07) here

Subcommand 0x10: unknown, related to 0xD6 Mega Cliloc somehow
BYTE[4] Item ID
BYTE[4] Unknown

Subcommand 0x13: Request popup menu
BYTE[4] id (character id)

Subcommand 0x14: Display Popup menu
BYTE[2] Unknown(always 00 01)
BYTE[4] Serial
BYTE[1] Number of entries in the popup
For each Entry
� BYTE[2] Entry Tag (this will be returned by the client on selection)
� BYTE[2] Text ID ID is the file number for intloc#.language e.g intloc6.enu and the index into that
� BYTE[2] Flags 0x01 = locked, 0x02 = arrow, 0x20 = color
� If (Flags &0x20)
� BYTE[2] color; // rgb 1555 color (ex, 0 = transparent, 0x8000 = solid black, 0x1F = blue, 0x3E0 = green, 0x7C00 = red)

Subcommand 0x15: Popup Entry Selection
BYTE[4] Character ID
BYTE[2] Entry Tag for line selected provided in subcommand 0x14

Subcommand 0x17: Codex of wisdom
BYTE[1] unknown, always 1. if not 1, packet seems to have no effect
BYTE[4] msg number
BYTE[1] presentation (0: �?� flashing, 1: directly opening)

Subcommand 0x18: Enable map-diff (files)
BYTE[4] Number of maps
For each map
� BYTE[4] Number of map patches in this map
� BYTE[4] Number of static patches in this map

Subcommand: 0x19: Extended stats
BYTE[1] type // always 2 ? never seen other value
BYTE[4] serial
BYTE[1] unknown // always 0 ?
BYTE[1] lockBits // Bits: XXSS DDII (s=strength, d=dex, i=int), 0 = up, 1 = down, 2 = locked

Subcommand: 0x1a: Extended stats
BYTE[1] stat // 0: str, 1: dex, 2:int
BYTE[1] status // 0: up, 1:down, 2: locked

Subcommand 0x1b: New Spellbook
BYTE[2] unknown, always 1
BYTE[4] Spellbook serial
BYTE[2] Item Id
BYTE[2] scroll offset // 1==regular, 101=necro, 201=paladin, 401=bushido, 501=ninjitsu, 601=spellweaving
BYTE[8] spellbook content // first bit of first byte = spell #1, second bit of first byte = spell #2, first bit of second byte = spell #8, etc

Subcommand 0x1c: Spell selected, client side
BYTE[2] unknown, always 2
BYTE[2] selected spell(0-indexed)+scroll offset from sub 0x1b

Subcommand 0x1D: Send House Revision State
byte[4] houseserial
byte[4] revision state

Subcommand 0x1E:
byte[4] houseserial

Subcommand 0x21: (AOS) Ability icon confirm.
Note: no data, just (bf 00 05 21)

Subcommand 0x22: Damage
BYTE[2] unknown, always 1
BYTE[4] Serial
BYTE[1] Damage // how much damage was done ?

Subcommand 0x24: UnKnown
BYTE[1] unknown. UOSE Introduced

Notes
Subcommand 1: Server Sent. This sets up stack on the client and whenever it moves, it takes the top value from this stack and uses it. (key1 starts at the top, key6 at the bottom)

Subcommand 2: Server Sent. This key is added to the top of the stack. In other words, it�s the one that will be used next. Basically, the other 5 only get used when the client is sending moves faster than the server is responding.

Subcommand 4: Server Sent.

Subcommand 5: Client Sent.

Subcommand 6: Sent by both. Contains subcommands for 0x6 for the party system. Be sure you check the packet listing good before attempting these.

Subcommand 8: Server Sent.

Subcommand a: Read above. Client Sent.

Subcommand b: Client Sent once at login of character.

Subcommand c: Server Sent.

Subcommand e: Client Sent. Server responds with Play Animation packets.
List of animation IDs:
00 00 00 06 - Yawn
00 00 00 15 - Faint
00 00 00 20 - Bow
00 00 00 21 - Salute
00 00 00 64 - Applaud
00 00 00 66 - Argue
00 00 00 68 - Blow Kiss
00 00 00 69 - Formal Bow
00 00 00 6B - Cover Ears
00 00 00 6C - Curtsey
00 00 00 6D - Jig
00 00 00 6E - Folk Dance
00 00 00 6F - Dance
00 00 00 70 - Tribal Dance
00 00 00 71 - Fold Arms
00 00 00 72 - Impatient
00 00 00 73 - Lecture
00 00 00 74 - Nod
00 00 00 75 - Point
00 00 00 77 - Greet Salute
00 00 00 79 - Shake Head
00 00 00 7B - Victory
00 00 00 7C - Celebrate
00 00 00 7D - Wave
00 00 00 7E - Two Handed Wave
00 00 00 7F - Long Distance Wave
00 00 00 80 - What?

Subcommand f: Client Sent.

Subcommand 13: Client Sent.

Subcommand 14: Server Sent. TextID is broken into two decimal parts:
stringID / 1000: intloc fileID
stringID % 1000: text index

So, say you want the 123rd text entry of intloc06, the stringID would be 6123

Subcommand 15: Client Sent.

Subcommand 17: Server Sent. Shows codex of wisdom�s text #msg. (msg is linearised (including sub indices) index number starting with 1).

Subcommand 18: Server Sent. Number of maps: currently 3 (0 = Fellucca, 1 = Trammel, and 2 = Ilshenar). This packet is sent by the server to the client, telling the client to use the mapdif* and stadif* files for patching map and statics.

Subcommand 19: Server Sent. Is sent after the 0x11 packet to enable the stat locks and show their states on 4.x+ clients.

Subcommand 1a: Client Sent. Stat Lock change packet. Sent when client changes the lock state for a stat on the status bar.

Subcommand 1b: Server Sent. Related to new spell packet 0xBF Subcommand 0x1C.

Subcommand 1c: Client Sent. Related to new spellbook packet 0xBF Subcommand 0x1b.

Subcommand 1d: Server Sent. Part of AoS Custom Housing. Sends a house's Revision number for handling client's multi cache. If revision is newer than what client has it asks for the new multi packets to cache it.

Subcommand 1e: Client Sent. Part of AoS Custom Housing. Sends a house's ID number back after recieving the 0x1D subcommand

Subcommand 21: Server Sent. This is sent to reset the color of the icons, and also sent when the server denies the ability attempt (not enough skill or mana).

Subcommand 22: Server Sent. Packet for displaying damage dealt above the mob's head.

Subcommand 24: Client Sent. Unknown.

Packet ID: 0xC0
Packet Name: Graphical Effect
Packet Size: 36 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] type
BYTE[4] sourceSerial
BYTE[4] targetSerial
BYTE[2] itemID
BYTE[2] xSource
BYTE[2] ySource
BYTE[1] zSource
BYTE[2] xTarget
BYTE[2] yTarget
BYTE[1] zTarget
BYTE[1] speed
BYTE[1] duration
BYTE[2] unk // On OSI, flamestrikes are 0x0100
BYTE[1] fixedDirection
BYTE[1] explodes
BYTE[4] hue
BYTE[4] renderMode

Notes
Packet seems to work fine with even 2.0.0 clients

Packet ID: 0xC1
Packet Name: Cliloc Message
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[4] id (0xffff for system message)
BYTE[2] body (0xff for system message)
BYTE[1] type (6 � lower left, 7 on player)
BYTE[2] hue
BYTE[2] font
BYTE[4] Message number
BYTE[32] � speaker�s name
BYTE[?*2] � arguments // _little-endian_ unicode string, tabs ('\t') seperate the arguments

Notes
Argument example:
take number 1042762:
"Only ~1_AMOUNT~ gold could be deposited. A check for ~2_CHECK_AMOUNT~ gold was returned to you."
the arguments string may have "100 thousand\t25 hundred", which in turn would modify the string:
"Only 100 thousand gold could be deposited. A check for 25 hundred gold was returned to you."

Packet ID: 0xC2
Packet Name: Unicode TextEntry
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[4] player id
BYTE[4] message id
If (server_version of this packet)
� BYTE[10] all 0�s .. have to be there, otherwise client crash
If (client_version)
� BYTE[4] unknown, always 1
� BYTE[3] language code, i.e. DEA, ENU etc.
� BYTE[ ?] unicode Text

Notes
Client version is the reply packet. Server starts with a server side 0xc2. server can pick any message id to identify it. The next text entry from client after 0xc2 server side is client reply with a 0xc2 sent back. First 11 bytes relayed from server packet, plus 0 0 0 1 plus 3 bytes language code + Unicode text. Server side packet always has length 0x15.

Packet ID: 0xC4
Packet Name: Semivisible (Smurf it!)
Packet Size: 6 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[4] ID
BYTE[1] intensity ?

Notes
It sets target more or less blue (dependant on intensity value). Only for 2d clients, for 3d clients it does nothing in last attempts (pre-4.x client test)

Packet ID: 0xC6
Packet Name: Invalid Map Enable
Packet Size: 0x1
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] CMD

Notes
Sent to client to let it know it tried to enable/use an invalid map. Exact purpose unknown to myself.

Packet ID: 0xC7
Packet Name: 3D Particle Effect
Packet Size: 49 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[35]�. Preamble � exactly like 0xC0
BYTE[2] effect # (tile ID)
BYTE[2] explode effect # (0 if no explosion)
BYTE[2] additional effect # that�s only used for moving effects, 0 otherwise
BYTE[4] if target is item (type 2) that�s itemId, 0 otherwise
BYTE[1] layer (of the character, e.g left hand, right hand, � 0-4, 0xff: moving effect or target is no char)
BYTE[2] yet another (unknown) additional effect that�s only set for moving effect, 0 otherwise

Packet ID: 0xC8
Packet Name: Client View Range
Packet Size: 2 Bytes
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] range

Notes
Range: how far away client wants to see (=get send) items/npcs
Since client 3.0.8o it actually got activated.(in a useful way) When increase/decrease macro send, client sends a 0xc8. If and only if erver �relays� the packet (sending back the same data) range stuff gets activated client side.
�Greying� has no packet, purely client internal.

Minimal value:5, maximal: 18

Packet ID: 0xC9
Packet Name: Get Area Server Ping
Packet Size: 6 Bytes
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] sequence // initially 1, wraps after 255 to 0
BYTE[4] tickcount

Notes
Client sends packet with it's tick count. Server replies with same packetID/sequence and it's own tick count. Over a few packets, the client can deduct a reasonably accurate ping number. Currently only used/ implemented in god client

Packet ID: 0xCA
Packet Name: Get User Server Ping
Packet Size: 6 Bytes
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] sequence // initially 1, wraps after 255 to 0
BYTE[4] tickcount

Notes
See 0xC9

Packet ID: 0xCB
Packet Name: Global Que Count
Packet Size: 7 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] unknown
BYTE[4] count

Notes
displays the message: There are currently [count] available calls in the global queue

Packet ID: 0xCC
Packet Name: Cliloc Message Affix
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[4] id (0xffff for system message)
BYTE[2] body (0xff for system message)
BYTE[1] type (6 � lower left, 7 on player)
BYTE[2] hue
BYTE[2] font
BYTE[4] Message number
BYTE[1] flags (0x02 is unknown, 0x04 signals the message doesn't move on screen) (flags & 0x1) == 0 signals affix is appended to the localization string, (flags & 0x1) == 1 signals to prepend.
BYTE[0x20] � speaker�s name
BYTE[?] affix / null terminated
BYTE[?]*2] arguments; // _big-endian_ unicode string, tabs ('\t') seperate arguments, see 0xC1 for argument example

Packet ID: 0xD0
Packet Name: Configuration File
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[1] type - file type, not sure of precise values
BYTE[length-4] unknown encoded in some form

Notes
Sent if (flag & 0x02) in packet 0xA9
Probably used for saving client configuration files server side. OSI used it for the IGR shard only that is not anymore. Not sure what configuration files are, perhaps those in /desktop/player dir

Encoding/(compression?) completely unknown
Note: there�s a client and server version of it.
If on, client sends them 5 times (5 files) at login.
After logout (0xd1) it expects server versions of 0xd0 and finally a server version of 0xd1

Packet ID: 0xD1
Packet Name: Logout Status
Packet Size: 2 bytes
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[1] unknown // always 1

Notes
Client sends on logout if (flag & 0x02) in packet 0xA9,
when server responds with same packet, client finishes logging out

Packet ID: 0xD2
Packet Name: Extended 0x20
Packet Size: 25 Bytes
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
Preamble: Exactly like 0x20
BYTE[2] unknown 1
BYTE[2] unknown 2
BYTE[2] unknown 3

Packet ID: 0xD3
Packet Name: Extended 0x78
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
Preamble: Exactly like 0x78
BYTE[2] unknown 1
BYTE[2] unknown 2
BYTE[2] unknown 3

Packet ID: 0xD4
Packet Name: *New* Book Header
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[4] book ID
BYTE[1] flag1
BYTE[1] flag2
BYTE[2] number of pages
BYTE[2] length of author string (0 terminator included)
BYTE[?] author (ASCII, 0 terminated)
BYTE[2] length of title string (0 terminator included)
BYTE[?] title string

Notes
Packet sent from server when opening a book: opening book writeable: flag1+flag2 both 1 (opening readonly book: flag1+flag2 0, unverified though)

client side: flag1+flag2 both 0, number of pages 0.

Example::
Opening books goes like this:
open book ->
server sends 0xd4(title + author)
server sends 0x66 with all book data �beyond� title + author

if title + author changed: client side 0xd4 send

if other book pages changed: 0x66 client side send.

Packet ID: 0xD6
Packet Name: Mega Cliloc
Packet Size: vaiable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] Cmd
BYTE[2] Length of packet
BYTE[2] 0001
BYTE[4] Serial of item/creature
BYTE[2] 0000
BYTE[4] Serial of item/creature in all tests. This could be the serial of the item the entry to appear over.

Loop of all the item/creature's properties to display in the order to display them. The name is always the first entry.
BYTE[4] Cliloc ID
BYTE[2] Length of (if any) Text to add into/with the cliloc
BYTE[?] Unicode text to be added into the cliloc. Not sent if Length of text above is 0

BYTE[4] 00000000 - Sent as end of packet/loop

Packet ID: 0xD7
Packet Name: Generic AOS Commands
Packet Size: Variable
Sent By: Both
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] size
BYTE[4] PlayerID
BYTE[2] SubCommand message

Sub Commands
SubCommand 0x02: Backup
BYTE[1] 07

SubCommand 0x03: Restore
BYTE[1] 07

SubCommand 0x04: Commit
BYTE[1] 07

SubCommand 0x05: DeleteItem
BYTE[1] unknown (0)
BYTE[2] unknown (0)
BYTE[2] item graphic
BYTE[1] unknown (0)
BYTE[4] X Pos
BYTE[1] unknown (0)
BYTE[4] Y Pos
BYTE[1] unknown (0)
BYTE[4] z Pos (7)
BYTE[1] terminator (0x07)

SubCommand 0x06: AddItem
BYTE[1] unknown (0)
BYTE[2] unknown (0)
BYTE[2] itemGraphic
BYTE[1] unknown (0)
BYTE[4] XPos
BYTE[1] unknown (0)
BYTE[4] YPos
BYTE[1] terminator (0x07)

SubCommand 0x0C: Exit House Tool
BYTE[1] unknwon (0x07)

SubCommand 0x0D: Change Stairs
BYTE[1] unknown (0x00)
BYTE[2] X Position (Relative to center of house)
BYTE[1] unknown (0x00)
BYTE[2] Y Position (Relative to center of house)
BYTE[1] unknown (0x00)

SubCommand 0x0E: Synch Button
BYTE[1] Unknown (0x07)

SubCommand 0x10: Clear Button
BYTE[1] Unknown (0x07)

SubCommand 0x12: ChangeFloor
BYTE[4] unknown (0)
BYTE[1] Floor#
BYTE[1] terminator (0x07)

SubCommand 0x1A: Revert Button
BYTE[1] Unknown (0x07)

SubCommand 0x19: Combat Book Abilities
BYTE[4] 00 00 00 00 = Unknown. Always like this in all my testing
BYTE[1] The ability "number" used
BYTE[1] 0A

SubCommand 0x28: Guild Button
BYTE[1] Unknown (0x07)

SubCommand 0x32: Quest Button
BYTE[1] Unknown (0x07)

Notes
Submitted information. untested and unverified.

Subcommand 0x02: This is sent when the client pushed the Backup button in the customization screen. Unsure what it triggers on the server since house building is totally handled client side until submitted.

SubCommand 0x03: Sent when client pushes the Restore button in the customization menu. Will need testing to see exact purpose of 2 and 3 subs. Possible the server could request current "layout" that is not yet commited to save the design without commiting to be later restored with this command.

SubCommand 0x04: Sent when client pushes the Commit Button.

SubCommand 0x05: Sent when client chooses to destroy items.

SubCommand 0x06: Sent when client Chooses to add items.

SubCommand 0x0C: Sent when client pushes the Exit Button.

SubCommand 0x0D: Sent when client adds stairs to the multi in edit mode.

SubCommand 0x0E: Sent when client pushes the Synch Button.

SubCommand 0x10: Sent when client pushes the Clear Button.

SubCommand 0x12: Sent when client pushes the Change Floor Buttons.

SubCommand 0x1A: Sent when client pushes the Revert Button.

SubCommand 0x19: Sent when client pushes the icones from the combat book.
The server uses an 0xBF Subcommand 0x21 Packet to cancel the red color of
icons, and reset the status of them on client.
Valid Ability Numbers:
0x00 = Cancel Ability Attempt
0x01 = Armor Ignore
0x02 = Bleed Attack
0x03 = Concusion Blow
0x04 = Crushing Blow
0x05 = Disarm
0x06 = Dismount
0x07 = Double Strike
0x08 = Infecting
0x09 = Mortal Strike
0x0A = Moving Shot
0x0B = Paralyzing Blow
0x0C = Shadow Strike
0x0D = Whirlwind Attack
0x0E = Riding Swipe
0x0F = Frenzied Whirlwind
0x10 = Block
0x11 = Defense Mastery
0x12 = Nerve Strike
0x13 = Talon Strike
0x14 = Feint
0x15 = Dual Wield
0x16 = Double shot
0x17 = Armor Peirce
0x18 = Bladeweave
0x19 = Force Arrow
0x1A = Lightning Arrow
0x1B = Psychic Attack
0x1C = Serpent Arrow
0x1D = Force of Nature

SubCommand 0x28: Sent when client pushes the Guild Button on the paperdoll.

SubCommand 0x32: Sent when client pushes the Quest Button on the paperdoll.

Packet ID: 0xD8
Packet Name: Send Custom House
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length
BYTE[1] CompressionType (0=nothing, 3=zlib)
BYTE[1] unknown (0)
BYTE[4] HouseSerial
BYTE[4] Revision State
BYTE[2] Number of Tiles
BYTE[2] Buffer length (Number of tiles * 5)
For Each Component
� BYTE[2] component graphic
� BYTE[1] X
� BYTE[1] Y
� BYTE[1] Z

X/Y of this packet is probably wrong. May be 2 Byte portions instead of 1. Information was submitted and as of yet untested.

Packet ID: 0xD9
Packet Name: Spy On Client
Packet Size: Variable
Sent By: Client
Submitted: MuadDib

Description
Sends information related to client pc's hardware, operating system, direct x, etc. Full packet information is still unknown.

Packet Breakdown
BYTE[1] cmd
BYTE[1] unknown (02) Always 0x02 in my tests
BYTE[4] Unique Instance ID of UO
BYTE[4] OS Major
BYTE[4] OS Minor
BYTE[4] OS Revision
BYTE[1] CPU Manufacturer
BYTE[4] CPU Family
BYTE[4] CPU Model
BYTE[4] CPU Clock Speed
BYTE[1] CPU Quantity
BYTE[4] Memory
BYTE[4] Screen Width
BYTE[4] Screen Height
BYTE[4] Screen Depth
BYTE[2] Direct X Version
BYTE[2] Direct X Minor
BYTE[76?] Video Card Description
BYTE[4] Video Card Vendor ID
BYTE[4] Video Card Device ID
BYTE[4] Video Card Memory
BYTE[1] Distribution
BYTE[1] Clients Running
BYTE[1] Clients Installed
BYTE[1] Partial Insstalled
BYTE[1] Unknown
BYTE[4] Language Code
BYTE[67] Unknown Ending

Notes
Older clients, from mid-late 2003 was set at 149 bytes length, whereas newest clients 4.01+ are set to 199 ??

Packet ID: 0xDB
Packet Name: Character Transfer Log
Packet Size: variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] cmd
BYTE[2] length of packet
BYTE[4] Unknown, always 000000BB in my testing.
BYTE[?] Length - 7 of packet
BYTE[4] Transfer ID
BYTE[4] Unknown, all zeros
BYTE[4] Unknown, all zeros
For each item in transfer log, this loop is performed:
BYTE[4] Item's Serial
BYTE[4] Size of next loop (Big Endian)
BYTE[4] The cliloc of the item's name or property. If zero, defaults to 'Transfer Crate.'
BYTE[1] Length of Cliloc Addon Text
BYTE[?] Text to affix/insert into the cliloc
BYTE[2] 0009 - Ends the loop for cliloc addon text and item

Notes
When a character transfer is confirmed, the server sends this to create a log of all the items being included in the transfer.
This log is saved to translog.txt.
Item properties are also included in this packet.

Packet ID: 0xDC
Packet Name: SE Introduced Revision
Packet Size: 9
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] CMD
BYTE[4] Item/Mob Serial
BYTE[4] Item Revision Hash

Notes
Newer packet as of late 2004. Is now used on OSI to handle the Revision of Tooltips instead of the original 0xBF methods it appears.

Packet ID: 0xDD
Packet Name: Compressed Gump
Packet Size: variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[1] Cmd
BYTE[2] len
BYTE[4] Player Serial
BYTE[4] Gump ID
BYTE[4] x
BYTE[4] y
BYTE[4] Compressed Gump Layout Length (CLen)
BYTE[4] Decompressed Gump Layout Length (DLen)
BYTE[CLen] Gump Data, zlib compressed
BYTE[4] Number of text lines
BYTE[4] Compressed Text Line Length (CTxtLen)
BYTE[4] Decompressed Text Line Length (DTxtLen)
BYTE[CTxtLen] Gump's Compressed Text data, zlib compressed

Packet ID: 0xDF
Packet Name: Buff/Debuff System
Packet Size: variable
Sent By: Server
Submitted: Turley

Packet Breakdown
BYTE[1] Cmd
BYTE[2] Length
BYTE[4] Serial of player
BYTE[1] 0x4 (show?)
BYTE[1] Icon Number to show
BYTE[2] 0x1 = Show, 0x0 = Remove. On remove byte, packet ends here.
BYTE[1] 0x4 (show?)
BYTE[1] Icon Number to show.
BYTE[2] 0x1 = Show, 0x0 = Remove. On remove byte, packet ends here.
BYTE[2] Time in seconds before icon auto-removes itself
BYTE[4] Cliloc ID of title of icon.
BYTE[4] Cliloc ID 1049644. Used for the Description of the icon.
BYTE[2] Length of Description text for Cliloc Description
BYTE[len(description)*2] Unicode String (" "+str) First String will be ignored so I just add a space. In my tests simple moving the startpoint 41 to 42/43 doesn't worked.. a bit strange

Notes
This is a submitted packet, information here is yet to be verified. Use at own risk.

Packet ID: 0xF0
Packet Name: Krrios client special
Packet Size: Variable
Sent By: Server
Submitted: MuadDib

Packet Breakdown
BYTE[2] len
BYTE[1] subcmd
BYTE[len - 4] data

Notes
Subcommand 0: Acknowledge login (1 byte (for 5 total))
BYTE[1] ack (0 = Rejected, unauthorized. 1 = Accepted, GM priviledges. 2 = Accepted, player priviledges)

Note: GM priviledges unlock movement rate configurations