Releasing Some Private Stuff

[xenn2600]

Some of these may be publicly known by now, but none are patched. So have fun
(Don't blame me for grammar mistakes. Few of these were discovered by me. Most of the people who found these are druggies or people with no education who play games all day [I wish I could do that o.O, damn my self-values]). No offense tho they're cool peeps ^^""

***I am not taking credit for all of this ^^ Just stuff I've collected, and then some.***

-----

Invulnerable Bug - 1

1. Equip set items (full is best).
2. Die (To another player or a monster).
3. Golden set bonuses remain.
4. Do not pick up your loot.
4. Works with all corpses (up to 16).
5. Only works once per set.
6. Equip your non-set stuff and kixxOr ***.
7. Pick up your corpses before leaving the game.

You can test this by equipping a set with a bonus +leech (eg. 2 Sigons items), die and hit something. You yill get a leech animation. You wont see any of the + golden stats because its a serverside bug.
This bug can make Necromancers invulnerable because of a bug in Trang Ouls set.

-----

Gold Dupe – ASM Code

#0x2F Routine -- Located in D2Client.dll
;6FAB2B88 8B5102 mov edx, dword ptr [ecx+02] <-- NPC ID
;6FAB2B8B 8A4901 mov cl, byte ptr [ecx+01]
;6FAB2B8E E8BD560400 call 6FAF8250 <-- Call send()
;6FAB2B93 C3 ret
6FAB2B88 8B51028A4901 E9XXXXXXXX90
#Capture NPC ID
;mov edx, dword ptr [ecx+02]
;mov dword ptr [NPCid_Pointer], edx
;mov cl, byte ptr [ecx+01]
;jmp @ 6FAB2B8E
#0x24 Routine -- Located in the D2Client.dll
;6FB0140B 8B530C mov edx, dword ptr [ebx+0C] <-- Item ID
;6FB0140E B124 mov cl, 24 <-- Packet type
;6FB01410 E80BC6FAFF call 6FAADA20 <-- Call send()
6FB0140B 8B530CB124 E9XXXXXXXX
#Capture Item ID
;mov edx, dword ptr [ebx+0C]
;mov dword ptr [NEWitm_ID], edx
;mov cl, 24
;jmp @ 6FB01410
#Hotkey -- Located in the D2Client.dll
6FAD5A2A 3DFFFF0000 E8XXXXXXXX
;cmp esi, byte ptr 4f
;jne @ Cleanup
;pushad
#send()
;mov dword ptr ecx, PacketData <-- PacketData
;mov byte ptr dl, 11 <-- PacketLen -- 17 bytes
;call 6FAAD850 <-- send()
;popad
#PacketData
;(PacketID) 0x33 (DWord)NPCid_Pointer (DWord)NEWitm_ID 02000000DEADC0DE
#Cleanup
;cmp eax, 0000FFFF
;ret
# T H E F I N A L P R O D U C T ! #
In .Hak format
LocateBy WindowName "Diablo II"
START "V1.10" "Paul[Le]'s Gold Dupe (Press O)"
#############################################################################
#
# How do I use this?
# Step 1.) Talk to Charsi (ANY NPC might work -- I haven't cared to check!)
# Step 2.) Pick up any potion from your belt.
# Step 3.) Sell item (Drop item in NPC Window)
# Step 4.) Buy the item you sold back.
# Step 5.) Pick up the item you bought back (It needs to be on your belt!)
# Step 6.) Press the button " O " on your keyboard!
# ** Each time you press " O " you will gain gold!
# ** Make sure you have open space on your belt!
#
#############################################################################
6FAB2B88 8B51028A4901 E9733B150090
6FC06700 000000 8B5102
6FC06703 000000000000 89153B67C06F
6FC06709 000000 8A4901
6FC0670C 0000000000 E97DC4EAFF
6FB0140B 8B530CB124 E901531000
6FC06711 000000 8B530C
6FC06714 000000000000 89153F67C06F
6FC0671A 0000 B124
6FC0671C 0000000000 E9EFACEFFF
6FAD5A2A 3DFFFF0000 E8F20C1300
6FC06721 000000 83FE4F
6FC06724 0000 750E
6FC06726 00 60
6FC06727 0000000000 B93A67C06F
6FC0672C 0000 B211
6FC0672E 0000000000 E81D71EAFF
6FC06733 00 61
6FC06734 0000000000 3DFFFF0000
6FC06739 00 C3
6FC0673A ** 33000000000000000002000000DEADC0DE
END
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#Notes to myself
#D2Client.dll -- Routine used to build 0x24!
:6FAADA20 83EC08 sub esp, 00000008 <----- Address to send all of our calls to for 0x24 packets!
:6FAADA23 884C2400 mov byte ptr [esp], cl <----- Packet type
:6FAADA27 89542401 mov dword ptr [esp+01], edx <----- Item ID
:6FAADA2B BA05000000 mov edx, 00000005 <----- Packet length
:6FAADA30 8D4C2400 lea ecx, dword ptr [esp]
:6FAADA34 E817FEFFFF call 6FAAD850 <----- Call send()
:6FAADA39 83C408 add esp, 00000008
:6FAADA3C C3 ret
#D2Client.dll -- Routine used to build ALL packets with a length of 9 bytes!
;6FAADA40 83EC0C sub esp, 0000000C <----- Address to send all of our calls to for 9 byte packets!
;6FAADA43 8B442410 mov eax, dword ptr [esp+10]
;6FAADA47 884C2400 mov byte ptr [esp], cl <----- Packet type
;6FAADA4B 89542401 mov dword ptr [esp+01], edx <----- First [DWORD]
;6FAADA4F BA09000000 mov edx, 00000009 <----- Packet length
;6FAADA54 8D4C2400 lea ecx, dword ptr [esp]
;6FAADA58 89442405 mov dword ptr [esp+05], eax <----- Second [DWORD]
;6FAADA5C E8EFFDFFFF call 6FAAD850 <----- Call send()
;6FAADA61 83C40C add esp, 0000000C
;6FAADA64 C20400 ret 0004
#Hotkey code -- D2Client.dll
;6FAD5A2A 3DFFFF0000 cmp eax, 0000FFFF <----- Hotkey value stored in ESI
#Code caves to use (Start here!) -- D2Net.dll
;6FC06708 00000000000000000000 BYTE 10 DUP(0)

-----

INVINCIBLE BARBARIAN BUG

1) Equip a flamebellow sword to gain the +to inferno bonus.
2) Set inferno on left click.
3) Set leap on right click.
4) Do inferno and leap and everything locks up and you become invincible.

-----

::removed::

-----

Waypoint PK glitch
This may have already been posted, if so please point it out so I may give credit.
1) Open up the party screen. 2) Click on a WP.
3) Just as your character hits the edge of the WP, click on hostile.
4) Kill someone

I have a module to do this with packets, makes it a lot more fun/easy. Whenever I'm bored...
Creating Game: 'Free NM Runz Come All'
"Hiya everyone ^^ Wait at the Cold Plains WP I'll be right there ^^"
<.wpgl set> <.wpgl go> <FURY Fury>"Hey wtf noob/1/?!/!!"

-----

PK in Town

You need: Necro / Druid / Zon that summons a Golem / Animal / Valk
Character with Rogue Encampment Merc. (both these characters are working together) The Necro / Druid / Zon hostiles the character with the Rogue merc.
The Necro / Druid stays in town, and casts golem / animal / Valk outside of town rapidly. The person's merc will shoot and miss the golem / animal and the arrows will travel into town hitting and damaging other hostiled players. have fun.

-----

Mephisto Stone Dupe Code (C++)

//////////////////////////////////////////////////////////////////////
// Meph stone Dupe
// -------------------------------------------------------------------
//////////////////////////////////////////////////////////////////////
#include <CLIENTCORE.CPP>// Include the backend of the module
//////////////////////////////////////////////////////////////////////
// Global stuff.
// -------------------------------------------------------------------
// This is a very convenient place to your function declarations and
// global variables.
//////////////////////////////////////////////////////////////////////
THISGAMESTRUCT* thisgame;
BOOL PRIVATE OnGameCommandSet(char** argv, int argc);
BOOL PRIVATE OnGameCommandgo(char** argv, int argc);
BOOL PRIVATE OnGameCommandstop(char** argv, int argc);
int check=0;
int check2=0;
int check3=0;
int check5=0;
int countnum=0;
int countmax=0;
BYTE getnewstones[9]={0x31,0,0,0,0,0xa7,0x02,0,0};
BYTE dropstoneinhand[5]={0x17,0,0,0,0};
BYTE pickupstonetohand[5]={0x19,0,0,0,0};
/////////////////////////////////////
// Clientinfo change things if you want
CLIENTINFO
(
0,1,
"coolspot31",
"gods-network.com",
"Mephy stone dupe",
"[email protected]"
)
/////////////////////////////////
// Commnads used in module
/////////////////////////////////
MODULECOMMANDSTRUCT ModuleCommands[]=
{
{
// The help command
"help",
OnGameCommandHelp,
"Displays help textÿc0"
},
{
// Custom command
"set",
OnGameCommandSet,
"Sets moduleÿc0"
},
{
// Custom command
"go",
OnGameCommandgo,
"Makes module go. Format is .msd go <NUMBER times>ÿc0"
},

// Custom command
{
"stop",
OnGameCommandstop,
"Emergency stopÿc0"
},
////////// End of command list /////
{NULL}
};
BOOL PRIVATE OnGameCommandSet(char** argv, int argc){
server->GamePrintInfo("ÿc1Click on cain...");
check5=1;
return true;
}
BOOL PRIVATE OnGameCommandgo(char** argv, int argc)
{
if (check2==1)
{
if (atoi(argv[2])>0)
{
countmax=atoi(argv[2]);
server->GamePrintInfo("ÿc1Duping, type .msd stop to stop the process");
check3=1;
server->GameSendPacketToServer(getnewstones, 9);
}
else
server->GamePrintInfo("Correct usage is .msd go [ammount of times]");
}
else
{
server->GamePrintInfo("Set it first");
}
return true;
}
//Edit: took out clean function, used from another one of my modules, and is completely unnecessary
BOOL PRIVATE OnGameCommandstop(char** argv, int argc){
countmax=0;
countnum=0; //resets counter
check3=0;
check=1; //prevents game from crashing when typing .msd go without a value for number of times, no clue as to why
return true;
}

DWORD EXPORT OnGamePacketBeforeSent(BYTE* aPacket, DWORD aLen)
{
if(aPacket[0]==0x13 && aPacket[1]==0x01 && check5 == 1)
{
memcpy(getnewstones+1,aPacket+5,4);
server->GamePrintInfo("ÿc3Got cain id. Type .msd go to continue");
check2=1;
check5=0;
}
return aLen;
}
DWORD EXPORT OnGamePacketBeforeReceived(BYTE* aPacket, DWORD aLen) //Keeps you from getting dropped.
{
if (aPacket[0]==0x9c && aPacket[1]==0x04 && aPacket[2] ==0x14 && check3==1 && countnum<=countmax)
{
memcpy(pickupstonetohand+1,aPacket+4,4);
memcpy(dropstoneinhand+1,aPacket+4,4);
server->GameSendPacketToServer(pickupstonetohand, 5);
countnum++;
}
if (aPacket[0]==0x9c && aPacket[1]==0x02 && aPacket[2] ==0x16 && check3==1)
{
server->GameSendPacketToServer(getnewstones, 9);
}
if (aPacket[0]==0x9d && aPacket[4]==pickupstonetohand[1] && check3==1)
{
memcpy(pickupstonetohand+1,aPacket+4,4);
server->GameSendPacketToServer(dropstoneinhand, 5);
if (countnum==countmax)
{
char t[64];
sprintf(t,"Completed %i stones.",countmax);
server->GamePrintInfo(t);
countmax=0;
countnum=0; //resets counter
check3=0;
check=1; //prevents game from crashing when typing .msd go without a value for number of times, no clue as to why
}
}
return aLen;
}

-----

Perming Dupes

The temp-perm methods will only allow you to keep your dupes for THAT game (that you did the temp-perm in). You MUST repeat every game where someone MAY possess the same dupe as you, in order for your dupes to never disappear.
If you have any questions/comments, PM me.
The Temp Perm Methods:
First Method (safest)
1.) Open a trade window with anyone who DOES NOT have any of the same dupes you are trying to perm.
2.) Put your duped item(s) you want to perm in the trade window.
3.) Save+Exit immediately after, before anybody else who has a possibility of having one of the same dupes as you leaves.
4.) The above will work everytime, just don't forget to do it every game to be safe.
Second Method (bit more risky)
*Make SURE you have a LOT of gold before you do this, and the NPC you are selling your dupe(s) to has space in their inventory.
1.) Go into a trade or trade/repair window with any NPC (Charsi/Akara for example) and sell your duped item(s).
2.) Buy it back
3.) Save+Exit the game immediately after, before anybody else who possibly has the same dupe(s) as you can leave.
*You might wonder why you would want the 2nd method... Well here's an Example Scenario:
You and a friend were in a game transferring. You had an .08 Arkaine's and so did your friend who saved+exited and said "thanks for the transfer, I gotta go." You are stuck there.. If you save+exit you lose your Valor. You look @ your friend list, nobody is on, you call your friend, he's not home... It's a private game, so nobody else can join. Wait a second! You know how to temp-perm without having a 2nd person to do it with! Dilemma Solved.
*How the methods keep the dupes from deleting (very basic explanation):
Both methods outlined above will cause the item ID to go up by ONE, temporarily, and will be reset to their actual ID as soon as you join your next game. The dupe scanner works by detecting two of the exact same item ID's in the same game, and deleting the last one that saves+exits the game with the same ID. If you change the ID by one temporarily through the methods above, the dupe scanner doesn't see your item as being a dupe, or the person who might've left before you, if they had the same dupe(s).
If you want to see how it works, you can use d2hackit, and sniff the packets of the item ID before you do a temp-perm method, and after. The last # will go up by one. (Example: Your 08 gaze's ID was: 04 00 02 03, after a temp perm it will change to:
04 00 02 04, and the next game you join, it will be 04 00 02 03 again.
Tips to remember about the dupe scanner (what items can't delete)
Currently in the 1.09d patch, the following items are NOT being detected by the dupe scanner, thus cannot be deleted, and do NOT need to be permed:
Any NON-MAGICAL item. This includes socketed items without another mod (ie, not jeweler's or of the whale, etc.). Most ed/ias and ed/max armors are non-magical, and will NOT be picked up by the dupe scanner.
Any RUNE WORD or ITH item. These are considered as non-magical items by the dupe scanner.
*IMPORTANT NOTE: DO NOT TRY AND SELL ANY RUNE-WORD TO AN NPC, AS YOU CANNOT BUY THEM BACK, REGARDLESS IF THEY HAVE ROOM OR NOT.
Any pre 1.08 (classic items). This includes most (99%) of SOJS, Godly Rares (like Corruption Grips, Raven Spirals, Soul Spurs, Rune Slippers, Soul Shanks, etc.).
Rumors
1.) Despite what anybody tells you, the dupe scanner DOES detect duped items on a merc and will delete them, even if the merc is dead.
2.) Personalizing/Socketing an item will NOT have any affect on the dupe scanner deleting/not deleting the item.
I hope this helps some of you who were unclear on how the dupe scanner works or temp-perming.

-----

Rollback Dupe Method (Is this patched by now?)

Alt-F4 Rollback Method, requires 2 persons, program(s) optional but recommended

1. Player A creates a game and does absolutely nothing.
2. Player B enters this game and does stuff like crafting/identifying. Don't waste too much time here.
3. When Player B is done, he (B) walks over to A and request a trade.
4. As soon as Player A sees Player B's traderequest, Player A exits the game by pressing Alt+F4.
-> Player B rolls back.

Rollback Method, requires D2Hackit, Trigger Module and 2 cd keys aswell as D2Loader

-----

g2g again>.>

[ReinisL]

WoW, I never thought duping something or hacking in D2 is that wierd :S

[Tool]

Hey, not bad, someone should sticky this. Although they you should get rid of the dupe part or people come and will be like, "U GEIB DUP!???!!!!11ONEONE!!!!ELVEN!~"

[xenn2600]

Hey, not bad, someone should sticky this. Although they you should get rid of the dupe part or people come and will be like, "U GEIB DUP!???!!!!11ONEONE!!!!ELVEN!~"

So true

[Ragnarhox]

So what was the one that says "removed"?

[Tool]

I don't think you should have put the code in for the gold dupe and the Soulstone dupe because most people will be like, "^.- omfg0rs whta cud thaat b3?" Besides, most people here don't know how to code. =\

[PantallicA]

Interesting stuff. I might try out that gold one.

[Tool]

Yeah, I think for that gold one you have to take that code for yourself and make it into a D2HackIt! module or something... Not sure, though. =\

[xenn2600]

Whatever>.>...

[ilikelilkids]

my brain hurts... um lol i doubt i can do any of that i almost couldnt get mh to work LMFAO

[Doono]

what program are you going to need to assemble that code into a working program?

[Tool]

Well, I didn't even know there was an ASM language so I wouldn't know for that... But for the other one, you need Microsoft C++ which is ****ing confusing as ****. It'd be better in VB.

[Doono]

well i got an assembler and everytime i try to assemble the gold dupe code i get an error on some lines about syntax so i got a little confused.

[Tool]

Oh, I see. It's probably just shitty coding on the programmer's part. Or he copy/pasted it wrong. Or you're doing something wrong.

[Juke]

The Gold Dupe is Patched, AKA Pot MAtrix, Well Maby bc Matrix is just a little defferant then yours, I'll try it though

[Doono]

meh its not a big deal im a little skeptical that its not patched sounds to similar to that health potion resell thing in d2 hackit form which is patched. If it works he could have posted these in a non code format bit strange anyone would if they have the program. Seems to much hassle just to post the source instead of the program lol.

[Juke]

He Post the Sorce so ppl like you can't use it