Introduction

Welcome to the Conquer Online server development and client modifications wiki. This wiki is hosted publicly using Git, published using mdBook, and maintained by the open source community. Pages on this wiki cover topics such as server-client message types, cryptography, client file formats, constants, system overviews, and more.

To participate in this collaborative effort to document Conquer Online development, the following rules must be followed:

• Articles must be written from a neutral point of view.
• Authors must respect each other, and not engage in personal attacks.
• Authors must not publish pirated programs.

Please read up on the code of conduct found in the root of the repository.

Verification

Statuses are used to indicate how reliable a page is / what the source of information is. Specifically, if information has been gathered from a community source, such as a private server project, then the status should be unverified until the server is run and the behavior can be at least observed.

• 🚩 Incomplete: The source is unknown and the information is incomplete.
• ❓ Unverified: The source is unknown or cannot be verified.
• ☑️ Assumed (Observed): Assumed by observing the behavior in the client.
• ☑️ Assumed (Soul): Assumed by reading the leaked client source code from TQ.
• ✅ Verified (Client): Confirmed by reverse engineering the client binary.
• ✅ Verified (Server): Confirmed by reverse engineering the leaked server binaries.

Sections

This wiki is broken up into multiple sections:

• Algorithms: Calculations made for attacks, rates, skill distances, and more.
• Constants: Hard-coded constants found in and across messages and the client.
• Features: In-game systems & mechanics and how they work on the server and client.
• Files: File formats and definitions for various content types.
• Network: Message structures and client-server networking.
• Renderers: System descriptions for rendering content in the client.
• Security: Cryptography and security around networking and content.
• Strings: Details on strings and restrictions on inputs.

Algorithms

This section documents algorithms and calculations for attacks, movement, and more.

Conquer Online's client and server both utilize Microsoft's rand function for random number generation. This can be seen when generating a seed for RC5 in later patches of the client. Algorithms documented by this section that reference rand are assumed to use the Microsoft C implementation.

Subsections

• Calculations: Algorithms used in calculating distance, damage, etc.
• Rates: Descriptions of random rates for various systems.

Calculations

Attributes

Damage

Direction

Enlightenment

Item Durability

Role View

Rates

Item Composition

Item Sockets

Constants

Action

Actions are emotes a role can perform. Not all roles can perform all types of actions. For monsters and players, this is determined by the 3dmotion.ini file. For NPCs, this is determined by npc.ini, which links with 3dmotion.ini for ACTION_STANDBY, ACTION_REST1, and ACTION_SAYHELLO.

Table of Contents

• Patch 4267

Patch 4267

☑️ Assumed (Observed) - Soul

enum ActionType {

    ACTION_DANCE1 = 1;
    ACTION_DANCE2 = 2;
    ACTION_DANCE3 = 3;
    ACTION_DANCE4 = 4;
    ACTION_DANCE5 = 5;
    ACTION_DANCE6 = 6;
    ACTION_DANCE7 = 7;
    ACTION_DANCE8 = 8;
    ACTION_STANDBY = 100;
    ACTION_REST1 = 101;
    ACTION_REST2 = 102;
    ACTION_REST3 = 103;
    ACTION_STANDBY_I = 105;
    ACTION_WALKL = 110;
    ACTION_WALKR = 111;
    ACTION_WALKL_I = 115;
    ACTION_WALKR_I = 116;
    ACTION_RUNL = 120;
    ACTION_RUNR = 121;
    ACTION_TRANSFORM = 122;
    ACTION_RUNL_I = 125;
    ACTION_RUNR_I = 126;
    ACTION_JUMP = 130;
    ACTION_JUMP_BACK = 131;
    ACTION_JUMP_RUN = 132;
    ACTION_JUMP_ATK = 140;
    ACTION_JUMP_ATKEND = 141;
    ACTION_LAUGH = 140;
    ACTION_GUFFAW = 151;
    ACTION_FURY = 160;
    ACTION_SAD = 150;
    ACTION_SALUTE = 160;
    ACTION_GENUFLECT = 170;
    ACTION_EXCITEMENT = 180;
    ACTION_SAYHELLO = 190;
    ACTION_FAINT = 190;
    ACTION_LIE = 200;
    ACTION_KNEEL = 220;
    ACTION_COOL = 230;
    ACTION_COOLPOSE = 231;
    ACTION_SWIM = 240;
    ACTION_SITDOWN = 250;
    ACTION_SITDOWN_STATIC = 251;
    ACTION_ZAZEN = 260;
    ACTION_ZAZENCOOL = 261;
    ACTION_PICKUP = 262;
    ACTION_ALERT_I = 305;
    ACTION_DODGE0 = 311;
    ACTION_BRUISE0 = 321;
    ACTION_BRUISE1 = 321;
    ACTION_POPOFF = 321;
    ACTION_DIE0 = 330;
    ACTION_BODY0 = 331;
    ACTION_DIE1 = 332;
    ACTION_BODY1 = 333;
    ACTION_DIE2 = 334;
    ACTION_BODY2 = 335;
    ACTION_DIE3 = 336;
    ACTION_BODY3 = 337;
    ACTION_ALERT = 340;
    ACTION_DIEFLY = 340;
    ACTION_DIEFLYEND = 341;
    ACTION_WALKBACK = 342;
    ACTION_ATTACK0 = 350;
    ACTION_ATTACK1 = 351;
    ACTION_ATTACK2 = 352;
    ACTION_MINE = 360;
    ACTION_INTONE = 390;
    ACTION_INTONE_DURATION = 391;
    ACTION_INTONE_LAUNCH = 392;
    ACTION_RELIVE = 400;
    ACTION_PUNCTURE = 451;
    ACTION_AIRSTRIKE = 452;
    ACTION_TORNADO = 453;
    ACTION_BODYSHIELD = 460;
    ACTION_GODBELIEVE = 465;
    ACTION_BUMP = 470;
    ACTION_FLY_STANDBY = 501;
    ACTION_FLY_ALERT = 502;
    ACTION_FLY_MOVE = 510;
    ACTION_FLY_ATTACK = 520;
    ACTION_FLY_DOWN = 530;
    ACTION_FLY_UP = 540;
    ACTION_FLY_DIE = 550;
    ACTION_FLY_WOUND = 560;
    ACTION_JUMPBACK_SHOOT = 610;
    ACTION_FAST_SHOOT = 620;
    ACTION_CHARGEUP_BEGIN = 630;
    ACTION_CHARGEUP_END = 631;
    ACTION_TM_FAST_SHOOT = 800;
    ACTION_TM_DISPERSION_SHOOT = 801;
}

Gem

Gems can be socketed into equipment to grant bonuses. Equipment can have up to two socket slots, each holding one gem.

Gems come in three quality grades: Normal, Refined, and Super.

Table of Contents

• Patch 5517

Patch 5517

Gem Item IDs

Gem item IDs fall in the range 700000–709999, identified by the client via CItem::IsGem. The last digit of the ID encodes the Gems Quality.

Gem Types

The gem type and quality can be determined by floor(item_id % 10000 / 10). For example, 700011 = type 1 (Dragon), quality 1 (Normal).

Socket Encoding

The socket byte value is stored in MsgItemInfo (Socket 1 / Socket 2 fields) and is derived from the gem's item ID:

socket_byte = item_id % 1000

For example, Super Dragon Gem (700013): 700013 % 1000 = 13.

Socket Values

enum SocketedGem {
  NO_SOCKET        = 0;

  PHOENIX_NORMAL   = 1;
  PHOENIX_REFINED  = 2;
  PHOENIX_SUPER    = 3;

  DRAGON_NORMAL    = 11;
  DRAGON_REFINED   = 12;
  DRAGON_SUPER     = 13;

  FURY_NORMAL      = 21;
  FURY_REFINED     = 22;
  FURY_SUPER       = 23;

  RAINBOW_NORMAL   = 31;
  RAINBOW_REFINED  = 32;
  RAINBOW_SUPER    = 33;

  KYLIN_NORMAL     = 41;
  KYLIN_REFINED    = 42;
  KYLIN_SUPER      = 43;

  VIOLET_NORMAL    = 51;
  VIOLET_REFINED   = 52;
  VIOLET_SUPER     = 53;

  MOON_NORMAL      = 61;
  MOON_REFINED     = 62;
  MOON_SUPER       = 63;

  TORTOISE_NORMAL  = 71;
  TORTOISE_REFINED = 72;
  TORTOISE_SUPER   = 73;

  THUNDER_NORMAL   = 101;
  THUNDER_REFINED  = 102;
  THUNDER_SUPER    = 103;

  GLORY_NORMAL     = 121;
  GLORY_REFINED    = 122;
  GLORY_SUPER      = 123;

  EMPTY_SOCKET     = 255;
}

NO_SOCKET = 0 means the equipment has no socket in that slot. EMPTY_SOCKET = 255 means the socket exists in the equipment but has no gem socketed.

Hairstyles

The HairStyle value encodes both hair color and style in a single numeric type.

HairStyle = (HairColor × 100) + Style
HairColor = HairStyle ÷ 100             // integer division
Style = HairStyle % 100                // modulo

Examples:

• 537 = Color 3 (Black), Style 30 (New)
• 515 = Color 5 (Red), Style 15 (Nostalgic)
• 625 = Color 6 (Brown), Style 25 (Special)

Note: VIP styles (70-90) have a static appearance and the color formula does not affect their visual look.

Client File References

• ini/NpcX.ini: Contains 145+ Hair= entries with values ranging from 0 to 678, used to define NPC hairstyles

Hair Colors

enum HairColor {
    HAIR_COLOR_BLACK = 3;
    HAIR_COLOR_WHITE = 4;
    HAIR_COLOR_RED = 5;
    HAIR_COLOR_BROWN = 6;
    HAIR_COLOR_GREEN = 7;
    HAIR_COLOR_BLUE = 8;
    HAIR_COLOR_VIOLET = 9;
}

Hair Styles

enum HairStyle {
    // Bald
    BALD_NO_HAIR = 0;

    // Nostalgic - 10-16
    HAIR_STYLE_NOSTALGIC_1 = 10;
    HAIR_STYLE_NOSTALGIC_2 = 11;
    HAIR_STYLE_NOSTALGIC_3 = 12;
    HAIR_STYLE_NOSTALGIC_4 = 13;
    HAIR_STYLE_NOSTALGIC_5 = 14;
    HAIR_STYLE_NOSTALGIC_6 = 15;
    HAIR_STYLE_NOSTALGIC_7 = 16;
    
    // Special - 21-25
    HAIR_STYLE_SPECIAL_1 = 21;
    HAIR_STYLE_SPECIAL_2 = 22;
    HAIR_STYLE_SPECIAL_3 = 23;
    HAIR_STYLE_SPECIAL_4 = 24;
    HAIR_STYLE_SPECIAL_5 = 25;
    
    // New - 30-41
    HAIR_STYLE_NEW_1 = 30;
    HAIR_STYLE_NEW_2 = 31;
    HAIR_STYLE_NEW_3 = 32;
    HAIR_STYLE_NEW_4 = 33;
    HAIR_STYLE_NEW_5 = 34;
    HAIR_STYLE_NEW_6 = 35;
    HAIR_STYLE_NEW_7 = 36;
    HAIR_STYLE_NEW_8 = 37;
    HAIR_STYLE_NEW_9 = 38;
    HAIR_STYLE_NEW_10 = 39;
    HAIR_STYLE_NEW_11 = 40;
    HAIR_STYLE_NEW_12 = 41;
    
    // VIP Level 4 - 70-74
    HAIR_STYLE_VIP4_1 = 70;
    HAIR_STYLE_VIP4_2 = 71;
    HAIR_STYLE_VIP4_3 = 72;
    HAIR_STYLE_VIP4_4 = 73;
    HAIR_STYLE_VIP4_5 = 74;
    
    // VIP Level 5 - 75-90
    HAIR_STYLE_VIP5_1 = 75;
    HAIR_STYLE_VIP5_2 = 76;
    HAIR_STYLE_VIP5_3 = 77;
    HAIR_STYLE_VIP5_4 = 78;
    HAIR_STYLE_VIP5_5 = 79;
    HAIR_STYLE_VIP5_6 = 80;
    HAIR_STYLE_VIP5_7 = 81;
    HAIR_STYLE_VIP5_8 = 82;
    HAIR_STYLE_VIP5_9 = 83;
    HAIR_STYLE_VIP5_10 = 84;
    HAIR_STYLE_VIP5_11 = 85;
    HAIR_STYLE_VIP5_12 = 86;
    HAIR_STYLE_VIP5_13 = 87;
    HAIR_STYLE_VIP5_14 = 88;
    HAIR_STYLE_VIP5_15 = 89;
    HAIR_STYLE_VIP5_16 = 90;
}

Hero Look

Hero Profession

Item ID

Item IDs are structured integers that encode information such as the item's category, type, level and quality directly in the number.

ItemType.dat is the file the client uses to find the details about an item id.

Table of Contents

• Patch 5517

Patch 5517

Fields

Three fields can always be extracted from any Item ID:

Item Quality Grade

For equipment and gems, the last digit of the item ID is the quality, where a higher quality digit means increased stats. The exception is quality digit 0 (Fixed) which applies to low-level equipment (level < 52) & stats can exceed Super quality but the item cannot be upgraded.

For all other item types, the last digit sometimes acts as a variant identifier or isn't used.

Equipment Quality

🔵 There is only one item with quality digit 2: 131052 (Lv57 Warrior ChainedArmor). There is no explanation for this, it is suspected to be a developer mistake.

Gems Quality

Overall Item ID Ranges

There is a single item that falls outside these ranges: ID: 50000 Name: Speed Arrow, but this item has an invalid icon & the real Speed Arrow ID is: 1050002. This is an invalid (perhaps legacy) record.

Equipment Ranges

Weapon Ranges

Single-hand (4xxxxx & 6xxxxx):

Two-hand (5xxxxx):

Look Face

The look face of a player or monster is the mesh calculation for the 3D role. While the monster look face is rather simple (just the monster type), the look face of a player is more complicated and follows this equation:

Look = Body + (Avatar x 10000) + (Transformation x 10000000)

PK Mode

Role Type

Roles in Conquer Online are entities such as NPCs, Monsters, and Heroes (the players). Depending on the role, the game client interprets left click actions differently. The server may use these constants to determine how MsgInteract is processed, or how an NPC is spawned using MsgNpcInfo.

Table of Contents

• Patch 4267

Patch 4267

☑️ Assumed (Soul)

enum RoleType {

    ROLE_NPC_NONE = 0;
    ROLE_SHOPKEEPER_NPC = 1;
    ROLE_TASK_NPC = 2;
    ROLE_STORAGE_NPC = 3;
    ROLE_TRUNK_NPC = 4;
    ROLE_FACE_NPC = 5;
    ROLE_FORGE_NPC = 6;
    ROLE_EMBED_NPC = 7;
    ROLE_STATUARY_NPC = 9;
    ROLE_SYNFLAG_NPC = 10;

    ROLE_PLAYER = 11,
    ROLE_HERO = 12,
    ROLE_MONSTER = 13,

    ROLE_BOOTH_NPC = 14,
    SYN_TRANSPORT_NPC = 15,
    ROLE_BOOTH_FLAG_NPC = 16,
    ROLE_MOUSE_NPC = 17,
    ROLE_MAGICITEM = 18,
    ROLE_DICE_NPC = 19,
    ROLE_WEAPONGOAL_NPC = 21,
    ROLE_MAGICGOAL_NPC = 22,
    ROLE_BOWGOAL_NPC = 23,
    ROLE_TARGET_NPC = 24,
    ROLE_FURNITURE_NPC = 25,
    ROLE_CITY_GATE_NPC = 26,
    ROLE_NEIGHBOR_DOOR = 27,
    ROLE_CALL_PET = 28,
    TRAINPLACE_NPC = 29,
    AUCTION_NPC = 30,
    ROLE_STONE_MINE = 31,
    ROLE_PKGAME_NPC = 32,
    ROLE_3DFURNITURE_NPC = 101,
    ROLE_CITY_WALL_NPC = 102,
    ROLE_CITY_MOAT_NPC = 103,
}

Files

This section documents file formats and provides definitions for various content types.

Files in the Conquer Online game client follow some consistency in format, but are largely different between files. Some files are encrypted by various ciphers, and some files are packed in compressed archives.

Subsections

• Compression: File types meant for compressing content into a single file.
• Content: File types specific to content needed for the client renderers.
• Formats: Formats for how to read various file types.

Compression

Content

3DEffect.ini

3DMotion.ini

Action.dat

This file was used in Conquer 1.0 (patches 4267 & below). Although this file is distributed with Conquer 2.0, the code that consumes it is dead code in the client binary, so it is not used in Conquer 2.0.

It maps some ActionType to specify the length of each animation frame in milliseconds.

Table of Contents

• Patch 4267

Patch 4267

☑️ Assumed (Soul)

File Header

Record Structure

Each record is 20 bytes. There are three checksum fields computed using the value of the Action Index and its position i, starting from zero.

Checksum1 = (ActionIndex * 2) + (FrameInterval + i)
Checksum2 = (i * Checksum1) + (ActionIndex * FrameInterval) - i
Checksum3 = (Checksum1 * ActionIndex) + (Checksum2 * 7) + (FrameInterval * i)

The client errors on checksum mismatch. The checksums are likely anti-tamper protection against manipulating animation speeds.

Action Index Structure

ActionIndex is made up of three components as a single integer:

ActionIndex = (LookFace * 1000000) + (WeaponType * 1000) + ActionType

When any component is set to 999, the code has specific logic as match-any, effectively a wildcard.

As an example: 999999110

• Digits 7-9 = 999 = Match any LookType (Male / Female / Transform)
• Digits 4-6 = 999 = Match any WeaponType (Bow / Club / Dual-Wield / Shield etc.)
• Digits 1-3 = 110 = Matches ActionType ACTION_WALKL (Walk Left)

For 999999110, the frame interval is 25, so each frame in the animation has a 25ms delay.

Example Entries

Parsing Script

The following is a simple python script which reads and parses Action.dat.

Pass the filepath as the first arg & it will print each action index alongside its time interval. Checksums won't be printed. Example: python3 action_decode.py Action.dat

import struct, sys

with open(sys.argv[1], "rb") as f:
    count, = struct.unpack("<I", f.read(4))  # Little-Endian uint32 - Header (Record Count)
    for i in range(count):
        # checksum1, action_index, checksum2, frame_interval, checksum3
        _, action_index, _, frame_interval, _ = struct.unpack("<IIIII", f.read(20))
        print(f"{action_index}: {frame_interval}ms")

AutoAllot.dat

Although this file was distributed with the client, it is never referenced or used in any known version (at least 4217 to 6090). It was most likely moved to the server side database (table: cq_point_allot) and the file was never removed from the client. It maps the distribution of Strength (Force), Agility (Speed), Vitality (Health), and Spirit (Soul) attribute points for each level before first Rebirth and up to level 120.

Table of Contents

• Patch 4267

Patch 4267

☑️ Assumed (Soul)

File Header

Profession Index

After the header is an array of ProfessionType. i is the array index, starting from zero:

Data Records

Then an array of ProfessionCount * LevelCount records, ordered by ProfessionType then level:

Level is not stored, it is implicit from the position in the array.

Example Entries

Parsing Script

The following Python script decodes AutoAllot.dat and prints the allocation table for every profession and level.

Pass the filepath as the first argument. Example: python3 autoallot_decode.py AutoAllot.dat

import struct, sys

with open(sys.argv[1], "rb") as f:
    prof_count, level_count = struct.unpack("<II", f.read(8))
    index = struct.unpack(f"<{prof_count}I", f.read(prof_count * 4))

    for i in range(prof_count):
        prof_type = index[i]
        for level in range(1, level_count + 1):
            strength, agility, vitality, spirit = struct.unpack("<IIII", f.read(16))
            print(f"ProfessionType={prof_type}, Level {level}: "
                  f"Strength={strength} Agility={agility} Vitality={vitality} Spirit={spirit}")

AutoPatch.dat

chatContribute.Ani

Cn_Res.ini

CodePage.ini

Sets the Windows code page (character set) used by graphic.dll to decode multibyte character strings for font rendering. Read by client immediately after font.ini.

This file does not exist by default with the English distribution, but can be created.

Table of Contents

• Patch 5517

Patch 5517

✅ Verified (Client)

Located at ini/CodePage.ini.

Example Entries

936

The first line is read as an integer and used by C3_CORE_DLL font functions to convert multibyte sequences to Unicode before FreeType rendering.

Common code page values

If this file is absent, multibyte characters will not decode correctly, preventing non-ASCII text from rendering.

Control.Ani

font.ini

Tells graphic.dll which font file to load via FreeType and at what size. Read by the client at startup.

Used as a fallback if FontSetting.ini is not present or its values are not set or invalid.

Table of Contents

• Patch 5517

Patch 5517

✅ Verified (Client)

Located at ini/font.ini.

The file contains a single line in the format:

<fontname> <size>

Examples

Load simsun.ttf from the client root folder at size 14:

simsun.ttf 14

FontSetting.ini

Configures the fonts used for in-game text rendering. Read once at startup by the client. If the file or font does not exist, it falls back to the value in font.ini.

This file does not exist by default with the English distribution, but can be created.

Table of Contents

• Patch 5517

Patch 5517

✅ Verified (Client)

Located at ini/FontSetting.ini.

[FontSetting]
ChatFontSize=12
ChatFont=simsun.ttf
GUIFont=simsun.ttf

fuse.ini

GameMap.dat

This file is loaded when the client starts. It maps the Map IDs to either the DMap or, in later clients, its compressed archive equivalent (.7z files).

Table of Contents

• Patch 5517

Patch 5517

File Header

Record Structure

Example Entries

Parsing Script

The following is a simple python script which reads and parses the GameMap.dat. Pass the filepath as the first arg & it will output each map ID alongside its path. Example: python3 gamemap_decode.py GameMap.dat

import struct, sys

with open(sys.argv[1], "rb") as f:
    count, = struct.unpack("<I", f.read(4)) # Little-Endian uint32 - Header (Record Count)
    for idx in range(count):
        map_id, name_len = struct.unpack("<II", f.read(8)) # Read ID & Length of Map Name
        name = f.read(name_len).decode("ascii") # Read the map name
        f.read(4) # Puzzle Size (value always 256), don't need to print it
        print(f"{map_id}: {name}")

gui.ini

ItemType.dat

This file is loaded when the client starts. It defines every item in the game such as equipment, weapons, consumables, mounts, soul/purification, garments, crafting materials, and more.

Records in itemtype.dat are the default values for the item, MsgItemInfo can be used to supply some of the dynamic values (such as the socketed gems, expiration time, durability and more)

See Item ID for the full breakdown of how Item IDs encodes information such category, weapon type, item level & quality for equipment.

Table of Contents

• Patch 5517

Patch 5517

In Patch 5517, this file is encrypted with TQ File Cipher with seed: 9527 (0x2537).

File Format

After decryption, the file is plain-text with an item record-per-line. Each field is separated by @@ and ends with a trailing @@\r\n.

~ is used as space characters and backticks (`) used as apostrophe in fields such as item name and description.

Record Structure

Parsing Script (To CSV)

You must first decrypt itemtype.dat using TQ File Cipher with seed: 9527 (0x2537). Then you can use this python script to parse the file and output it as a CSV file.

Pass the decrypted itemtype.dat path as the first arg & it will output a csv called itemtype.csv. This script has no error handling, checks or dependencies as it is intentionally kept minimal for readability.

Example: python3 itemtype_decode.py itemtype_decrypted.dat

import csv, sys

# NOTE: This script has only been tested on client 5517 itemtype.dat. Other patches may have a different amount of fields so this script will not work
FIELDS_PATCH_5517 = [
    "id", "name", "req_profession", "req_weaponskill", "req_level", "req_sex",
    "req_force", "req_speed", "req_health", "req_soul", "monopoly", "weight",
    "price", "id_action", "attack_max", "attack_min", "defense", "agility",
    "dodge", "life", "mana", "durability", "durability_limit", "identified",
    "gem1", "gem2", "magic1", "magic2", "n_amount", "data", "magic_atk",
    "magic_def", "atk_range", "atk_speed", "fray_mode", "repair_mode", "type_mask",
    "emoney_price", "emoney_bound_price", "expiry_time", "soul_atk_1", "soul_atk_2",
    "soul_def_1", "soul_atk_3", "soul_def_2", "soul_atk_4", "soul_def_3",
    "max_stack_size", "elem_res_metal", "elem_res_wood", "elem_res_water",
    "elem_res_fire", "elem_res_earth", "item_type", "description",
    "quality_color", "dragonsoul_phase", "dragonsoul_req", "crop_quality",
]

input_path  = sys.argv[1]
output_path = sys.argv[2] if len(sys.argv) > 2 else "itemtype.csv"

# Some items have chinese characters (gbk encoding) & mark unknown characters with '?'
with open(input_path, "r", encoding="gbk", errors="replace") as f_in, \
     open(output_path, "w", newline="", encoding="utf-8") as f_out:

    writer = csv.writer(f_out)
    writer.writerow(FIELDS_PATCH_5517)
    skipped = 0
    rows_extracted = 0

    for line in f_in:
        line = line.strip()
        if not line:
            continue
        parts = line.split("@@")
        if parts[-1] == "":
            parts = parts[:-1]
        if len(parts) != len(FIELDS_PATCH_5517):
            skipped += 1
            continue
        writer.writerow(parts)
        rows_extracted += 1

    if skipped > 0:
        print(f"Warning: {skipped} rows were skipped as they had an incorrect amount of fields.")

print(f"Completed {rows_extracted} extracted from {input_path} to {output_path}")
    

LevelExp.dat

This file was used in Conquer 1.0 and some early Conquer 2.0 patches (superseded by LevExp.dat)

It maps each level to the experience points required to reach the next level.

Table of Contents

• Patch 4267

Patch 4267

☑️ Assumed (Soul)

File Structure

The file is a flat array of UInt32 values, one per level. Levels start at 1, where i is the zero-based array index:

Encryption

Each UInt32 in the file is XOR-encrypted using a hardcoded 27-byte Chinese string: ★就这样被你蒸熟★.

In bytes, this UTF-8 string is: E2 98 85 E5 B0 B1 E8 BF 99 E6 A0 B7 E8 A2 AB E4 BD A0 E8 92 B8 E7 86 9F E2 98 85 which is used as the XOR key (each byte treated as a signed char).

Example Entries

Parsing Script

The following Python script decodes LevelExp.dat and prints each level alongside its EXP requirement.

Pass the filepath as the first argument. Example: python3 levelexp_decode.py LevelExp.dat

import struct, sys, math

KEY = bytes.fromhex("E29885E5B0B1E8BF99E6A0B7E8A2ABE4BDA0E892B8E7869FE29885")

with open(sys.argv[1], "rb") as f:
    data = f.read()

    count = math.floor(len(data) / 4) # Find number of levels based on file size
    values = struct.unpack(f"<{count}I", data)

    for level in range(1, count + 1):
        key_byte = KEY[(level - 1) % len(KEY)]
        mask = (key_byte | 0xFFFFFF00) if key_byte > 0x7F else key_byte # Signed Byte
        exp = (values[level - 1] ^ mask) & 0xFFFFFFFF
        print(f"Level {level}: {exp} EXP")

levexp.dat

Magic Type

magictypeop.dat

MapDestination.dat

MapMagicItem.ini

This file is loaded on client role data initialization, and utilized by MsgMapItem to show magical effects on the map floor. These effects play as "moments" that the client iterates through: starting with "start" and ending with "end". If any of the moment TMEs are "0" in the file, then that moment will be skipped.

The "look" described in MsgMapItem is the type key in the INI file.

Table of Contents

• Patch 4267

Patch 4267

☑️ Assumed (Soul)

Below is an example entry using the definition above:

[Type10]
Start=rain01.TME
Last=windblade7-1.TME
End=line05.TME

Monster.dat

Monster Type

mounttype.dat

MyAnimate.dat

Npc.ini

This file defines the 3D model, animations, and rendering properties for each NPC type. The server references NPCs by their type ID in MsgNpcInfo the client uses this file to know how to render them.

Table of Contents

• Patch 5517

Patch 5517

✅ Verified (Client)

Each section header follows the format:

[NpcTypeX]

Where X is the NPC type ID. The client parses it by stripping the NpcType prefix and reading the int.

Below is an example entry using the definition above:

[NpcType1]
Name=Storekeeper
SimpleObjID=0211
StandByMotion=9990010100
BlazeMotion=9990010190
RestMotion=9990010101
Effect=none
ASB=5
ADB=6
FixDir=0

NpcX.ini

This file defines the appearance for NPC types that are rendered as full character models with equipment, rather than the simple 3D objects.

These are NPCs which are the class promotion NPCs and dressed with weapons and armor.

Table of Contents

• Patch 5517

Patch 5517

✅ Verified (Client)

Each section header follows the format:

[X]

Where X is the NPC type ID. Unlike npc.ini, there is no NpcType prefix.

Below is an example entry using the definition above:

[5000]
Name=WarriorGod
AddSize=1
Scale=120
FixDir=0
Look=500
Head=0
Hair=0
Armet=111300
Armor=0
RWeapon=560439
LWeapon=900309
Misc=0
Mount=0
Effect=foot03

Peerage.ini

This file defines the icons & 3DEffects for the Nobility system.

Table of Contents

• Patch 5517

Patch 5517

✅ Verified (Client)

The ini-heading is a number that follows the formula:

(Rank Number * 10) + Gender

Gender (calculated by the client from the hero's mesh) is 1 for Male or 2 for Female.

The Peerage ranks are:

For example, ini-heading [72] is the female (2) version of the 7th Rank (70) = Duchess.

Below is an example entry using the definition above:

[71]
Name=Duke
Icon16=nob_Marquis16
Icon32=nob_Marquis32
Icon64=nob_Marquis64
Font16=nob_MarquisFont16
Font32=nob_MarquisFont32
Font64=nob_MarquisFont64
StatusIconID=40
StatusIconEffect=InsigniaNoble05s
Effect1=letter5
Effect2=coronet2
Button=checont_shiremarquis
ChatIcon=nob_MarquisJPG
ChatFont=nob_MarquisFontJPG

ProfessionalName.ini

This file maps each ProfessionType identifier to its display name.

Table of Contents

• Patch 4267

Patch 4267

☑️ Assumed (Soul)

ProfessionType Structure

The leading digits identify the class and the trailing digit is the promotion rank within that class:

File Format

This is a plain-text file with one entry per line, comma-separated:

<ProfessionType>,<Name>

Example Entries

Play.dat

RaceTrackProp.dat

Res.dat

role.dat

Server.dat

Shop.dat

showhandlayout.dat

ShowHandTable.dat

slient.dat

start.dat

start-facebook.dat

StatusEffect.ini

This file is used to map effects to player statuses for MsgUserInfo. The index mapping can be found on that page, but the file structure for mapping those effects can be found below. Though labeled as an INI file, it doesn't follow the syntax. Each entry is space delimitated and line separated.

Table of Contents

• Patch 4267

Patch 4267

✅ Verified (Client)

StrRes.ini

A key-value string resource file used by the client to look up UI text, system messages, and error strings by integer ID. Read at client startup.

Table of Contents

• Patch 5517

Patch 5517

✅ Verified (Client)

Located at ini/StrRes.ini.

Each line is in the format:

<StringID>=<String>

String values may contain printf-style format specifiers (%d, %s, %f, %I64u) and escape sequences (\n for newline). Both English and GBK-encoded Chinese strings are supported in the same file.

ID Ranges

A comment at the top of the file (written in Chinese) documents the intended ID ranges.

suittype.dat

Tips.dat

Title.ini

tqist.dat

UserHelpInfo.dat

UserHelpInfo.ini.dat

version.dat

VipTrans.ini

This file defines the teleport destinations available to VIP players. It is read by the client to populate the City Teleport (VIP Level 2+) & Portal Teleport (VIP Level 3+) dialog buttons.

City Teleport is the major cities such as TwinCity, PhoenixCastle, ApeCity, DesertCity & BirdIsland

Portal Teleport is a section of the map, for example: WindPlain-Turtledove - for the Turtledove section of Windplain.

Table of Contents

• Patch 5517

Patch 5517

✅ Verified (Client)

Each line contains three space-separated fields:

<Index> <Group> <LocationName>

WeaponSkillLevelExp.ini

This file maps weapon skill levels to experience required to obtain the level. Similarly to WeaponSkillName.ini, this file is not an INI file. It's a CSV file where each new line in the list is a weapon skill level, and each entry has comma delimited fields.

Table of Contents

• Patch 4267

Patch 4267

✅ Verified (Client)

WeaponSkillName.ini

This file maps weapon skill types to their names. Though labeled as an INI file, it's actually a CSV file where each new line in the list is a weapon skill entry, and each entry has comma delimited fields.

Table of Contents

• Patch 4267

Patch 4267

✅ Verified (Client)

Formats

DAT

A DAT file is generic data. DAT files are either plain-text, binary-encoded, or encrypted. This page lists the DAT files in the client patch version and an overview of how to read them. For an explanation of what each file does, see its individual linked page.

DAT File Formats Summary

• TQ File Cipher: Files which are marked as encrypted by TQ File Cipher. These files can be decrypted & re-encrypted. The seed for each file is listed in brackets.

• RSA: Files which are marked RSA have been encrypted by a TQ 2048-bit RSA private key. The public key is baked and obfuscated in the client binary. While it's possible to extract the public key from the binary to decrypt the file, it is not possible to re-encrypt without the private key.

• SWF: Files which are marked SWF are actually a SWF file (Shockwave Flash). Rename the extension to SWF. jpexs-decompiler is a good & free decompiler for this file type.

• Binary Encoded: The file is unencrypted, but has a binary structure. A hex editor can be used to inspect the raw binary contents but a dedicated parser is required to read it correctly. See the individual linked dat file for more information.

• Unencrypted - Plain Text: The file is unencrypted, you should be able to open the file in notepad without issues.

Patch 5517

DMAP

TME

Network

This section documents network procedures and message types for client-server communication.

Conquer Online uses TCP/IPv4 for network communication between the game servers and client. Messages are received as a stream, and ordering must be preserved for the correct processing of requests. Message encryption relies on the previous message, either as a counter or using cipher feedback; therefore, if the messages are encrypted and decrypted out of order, the client and server will desynchronize.

Protocol

Conquer Online uses Little-endian for the byte ordering of words and multi-byte sequences.

Games developed by TQ Digital Entertainment employ a custom binary protocol in this endianness, and contain a message header and sometimes a message footer. Messages are written to the binary protocol using custom encoding rules that change between versions of the client. These changes are documented in the Messages section.

Subsections

• Messages: Definitions for how the client and server communicate.

Identifiers

Unique identifiers in Conquer Online are 32-bit unsigned integers split into incremental ranges. Due to the small size of identifiers, some must be recycled and reused, such as monster identifiers. The easiest method of recycling these identifiers is to create reservations per spawn area.

⚠️ WARNING

Incremental IDs, such as account IDs and item IDs, can be too predictable and lead to exposing account information of your PM / first created accounts on the server, or items in the database. Consider using a linear-feedback shift register for a pseudo-random identifier that is deterministic for counting, but obfuscated for general security use.

Table of Contents

• Account Server
• Game Server

Account Server

Account IDs can be any number in the range of a 32-bit unsigned integer.

Game Server

The game server has the following ranges statically defined.

Some identifiers, such as items, are incremental across a 32-bit unsigned integer range.

Messages

This subsection organizes messages by the name found in the assembly of the macOS game client. See the table below for a mapping from message type to message definition.

Message Header

The table below defines TQ's message header. The header is written to all messages first and contains the size of the message (aka. the message length minus the size of the footer) and the message type (a constant identifier for handling the message on the client and server).

Message Footer

The message footer in Conquer Online was added in patch 5018. The footer contains an 8-byte string identifying the sender of the message. If the client sent the message, the footer would be "TQClient"; else, it would be "TQServer".

Message Types

The table below is an abstract and directory of message types used in various patches of Conquer Online.

For some message types, in later client versions the message type changed to a 5-digit value. These are noted in the table in brackets, see the individual message documentation for which patch version applies.

Msg2ndPsw

MsgAccount

This client message is sent to the account server to request authentication. There have been multiple message types over the years for handling authentication requests from the client. MsgAccount is the first, but was later replaced by MsgAccountSRP6 and MsgAccountSRP6Ex in versions 5532+.

In this message, the player's password is encrypted using RC5.

⚠️ WARNING

The password in this message is encrypted using a static key in earlier versions of the client. Although later versions start to use a generated key, that key is exchanged using MsgEncryptCode and does not protect against proxies employing a man-in-the-middle attack. This was patched in version 5532 with the use of SRP6, which also added additional complexity for clientless bot creation.

Table of Contents

• Patch 4267
• Patch 5165

Patch 4267

Message Definition

☑️ Assumed (Observed) - CoFuture + Soul

Patch 5165

Message Definition

✅ Verified (Client)

MsgAccountKalydo

MsgAccountSoftKb

MsgAccountSRP6

This client message is sent to the account server to request authentication using SRP6 as an augmented password-authenticated key exchange, replacing the previous MsgAccount message that used an RC5 encrypted password in patch 5532. The messages are similar, but the password field has been removed.

Before handling this message, an account needs to be created using a password verifier and salt rather than a password. The account server is expected look up the account's password verifier in the database to send MsgLoginChallengeS in response to this message.

Table of Contents

• Patch 5635

Patch 5635

Message Definition

☑️ Assumed (Observed)

MsgAccountSRP6Ex

This client message is sent to the account server to request authentication using SRP6 as an augmented password-authenticated key exchange, replacing the previous MsgAccountSRP6 message. It combines MsgAccountSRP6, MsgConnect, MsgEncryptCode, and MsgPCNum into a single message, and implements a random buffer used as a key derivation function (KDF) in SRP6.

Before handling this message, an account needs to be created using a password verifier and salt rather than a password. The account server is expected look up the account's password verifier in the database to send MsgLoginChallengeS in response to this message.

Table of Contents

• Patch 5635

Patch 5635

Message Definition

❓ Unverified

MsgAchievement

MsgAction

This message is received by the game server or game client as a general action request. The server responds to MsgAction with either a specific action message (such as a spawn that was missing or with item details) or with the MsgAction message itself (such as for the login messages). The client may or may not respond with the MsgAction in response to a server MsgAction message.

MsgAction is used for a variety of actions, such as configuring the client during login, changing maps, requesting inventory and friends lists, setting the hero's location on login, jumping, and more.

Table of Contents

• Patch 4267
• Patch 5017

Patch 4267

Message Definition

☑️ Assumed (Soul)

Action Type

☑️ Assumed (Soul)

🔶 Response data

Patch 5017

Message Definition

☑️ Assumed (Observed) - Redux

Action Type

☑️ Assumed (Observed) - COPSv6

🔶 Response data

MsgAllot

This message is sent by the client to allot attribute points.

⚠️ WARNING

Although the client checks the number of attribute points that can be allotted, a modified client can easily spoof this message with values beyond what is available. Ensure that your game server checks the number of attribute points that can be allotted before saving.

Table of Contents

• Patch 4267

Patch 4267

Message Definition

☑️ Assumed (Soul)

MsgAnnounceInfo

MsgAnnounceList

MsgArenicScore

MsgArenicWitness

MsgAuction

MsgAuctionItem

MsgAuctionQuery

MsgAura

MsgAuraGroup

MsgBattleEffectiveness

Undocumented

MsgCampFight

MsgCampFightInfo

MsgChangeName

MsgCheatingProgram

MsgCompleteRank

MsgConfirmKeyLogin

MsgConfirmKeyLoginMobile

MsgConnect

This client message is first sent to the account server after receiving MsgConnectEx, and then sent to the game server after the client disconnects from the account server and connects to the game server specified in MsgConnectEx. The game server is expected to respond to this connection attempt with MsgTalk (see this message type for details on that interaction).

The account ID in the account server MsgConnect message is copied from MsgConnectEx, and the account ID and data fields in the game server MsgConnect message are also copied from MsgConnectEx.

⚠️ WARNING

A serious exploit is possible using this message on some servers. If a deterministic key is used, such as the account ID, an encrypted account ID, or incrementor, then it may be possible for any bad actor to log into any character in the game (bypassing the account server).

The following are some example fixes employed in various server projects for replacing the two 32-bit fields:

• Short-lived access token sent from the account server to the game server over RPC, paired with the connector's IP address and account ID.
• Short-lived connection request record stored in a shared database containing the connector's IP address and account ID.

Table of Contents

• Patch 4267
• Patch 4343
• Patch 5065

Patch 4267

Account Server Message Definition

☑️ Assumed (Observed) - Comet

Game Server Message Definition

☑️ Assumed (Observed) - Comet

Patch 4343

Account Server Message Definition

☑️ Assumed (Observed) - Comet

Game Server Message Definition

☑️ Assumed (Observed) - Comet

Patch 5065

Account Server Message Definition

☑️ Assumed (Observed) - Comet

Game Server Message Definition

☑️ Assumed (Observed) - Comet

MsgConnectEx

This account server message is sent to the client to provide connection details for the selected game server. If authentication failed on the account server, then this message will contain a rejection code and message. In older versions of the client, the rejection message is in Chinese but not actually used by the client besides for validation. It was later removed.

The client also validates the IP address and will reject localhost (127.x.x.x). The game server IP address can be a local (10.x.x.x or 192.x.x.x) or public IP address.

Table of Contents

• Patch 4267
• Patch 5017
• Patch 5517

Patch 4267

Accept Message Definition

☑️ Assumed (Observed) - Comet

Reject Message Definition

☑️ Assumed (Observed) - Comet

Rejection Type

☑️ Assumed (Observed) - Comet

Patch 5017

Accept Message Definition

☑️ Assumed (Observed) - Comet

Reject Message Definition

☑️ Assumed (Observed) - Comet

Rejection Type

☑️ Assumed (Observed) - Comet

Patch 5517

Accept Message Definition

❓ Unverified

Reject Message Definition

❓ Unverified

Rejection Type

✅ Verified (Client)

The following mapping is copied from Cn_Res.ini.

000=Changing Map
001=Invalid Account ID or Password
006=Point Card Expired
007=Monthly Card Expired
010=Server maintenance. Please try again later!
011=Please try again later.
012=This account has been banned.
013=Net cafe mode. Invalid Account ID or Password.
014=Net cafe mode. No more accounts can be logged, at this time.
020=Server is busy.
021=Server is busy. Please try again, later.
022=Your account has been locked. Please contact GM for more help.
024=This account has been banned.
025=This account has been banned.
026=This account has been banned.
027=This account has been banned.
028=This account has been banned.
030=This account has not been activated.
031=Failed to activate the account.
040=Invalid Input
041=Invalid Info
042=Timed Out
043=Please recheck the serial number or retrieve a new one.
044=Invalid Sub-password
045=Please input Sub-password.
046=Unbound
050=Non-cooperator Account
051=Sorry, but you have used up your login attempts. Please wait 30 minutes and try again.
052=Failed to login
053=The same server
054=Database Error
055=Failed to connect to the database.
056=Failed to connect
057=Invalid Account ID
058=Validation timed out.
059=Servers are not configured correctly.
060=Passpod Server Disconnected
061=Failed to process Passpod return
062=Passpod Password Expired
063=Passpod Verification Failed
064=Passpod Certification Expired
065=Passpod Certification Disabled
066=Failed to find the user.
067=Passpod Server Error
068=Passpod has not been input.
070=Server Locked
071=Login has been restricted. Please check the login limit, and try again.
072=Account Locked by Phone
073=Authentication Protocol is invalid or expired.
501=The account has not been bound to any phone
502=The key is wrong. Please rebind it.
504=The sub-key is wrong.
506=Please input the sub-key.
507=Failed to call.
508=Failed to login QQ account
999=Database Error

MsgConnectFaceBook

MsgConnectLegalitySpec

MsgConnectWithBgp

MsgContribute

MsgCrossFlagWar

MsgCrossFlagWarAltar

MsgCrossFlagWarFlag

MsgCrossFlagWarMerit

MsgCrossFlagWarRank

MsgCrossSwitch

MsgData

This message is sent by the game server to update the client interface with a series of integer values. The main usage of this message is to sync the client with the date and time of the server, and was introduced with the watercolor client. In later versions of the client, it was used again for displaying mount vigor.

Table of Contents

• Patch 5031
• Patch 5165

Patch 5031

Message Definition

☑️ Assumed (Observed) - Chimera

Data Type

☑️ Assumed (Observed) - Chimera

Patch 5165

Message Definition

☑️ Assumed (Observed) - Chimera

Data Type

☑️ Assumed (Observed) - Chimera

MsgDataArray

MsgDeadMark

MsgDetainItemInfo

This message is sent to the client to show an item in the detained items window. Along with a summary of the item's details (similar to MsgItemInfo), it also contains the cost of reclaiming the item, days remaining until the hunter is rewarded, and the name and identifier of the original owner and hunter.

Table of Contents

• Patch 5103

Patch 5103

Message Definition

❓ Unverified

MsgDice

One of the first street gambling games introduced in Conquer Online was the dice game hosted by DiceKing in the Market. The game revolves around the NPC rolling four dice and the player making bets on the outcome. The outcome can be high or low, three of a kind, or specific values.

Interestingly, results of the game are broadcast to all participants using the MsgName message rather than a server message via MsgTalk. MsgName is also used to add players to the game.

The game is split into three phases: a 30 second phase where players can bet (Amount is set to 30 for BEGINCHIP), followed by a 5 second phase where all bets are in (ENDCHIP), followed by the result (DICE).

Table of Contents

• Patch 4267

Patch 4267

Message Definition

☑️ Assumed (Soul)

Action Type

☑️ Assumed (Soul)

Dice Data

☑️ Assumed (Soul)

Dice Values

☑️ Assumed (Soul)

enum DiceValues {

    DICE_VALUE_SMALL = 0;
    DICE_VALUE_BIG = 1;
    DICE_VALUE_111 = 2;
    DICE_VALUE_222 = 3;
    DICE_VALUE_333 = 4;
    DICE_VALUE_444 = 5;
    DICE_VALUE_555 = 6;
    DICE_VALUE_666 = 7;
    DICE_VALUE_4 = 8;
    DICE_VALUE_5 = 9;
    DICE_VALUE_6 = 10;
    DICE_VALUE_7 = 11;
    DICE_VALUE_8 = 12;
    DICE_VALUE_9 = 13;
    DICE_VALUE_10 = 14;
    DICE_VALUE_11 = 15;
    DICE_VALUE_12 = 16;
    DICE_VALUE_13 = 17;
    DICE_VALUE_14 = 18;
    DICE_VALUE_15 = 19;
    DICE_VALUE_16 = 20;
    DICE_VALUE_17 = 21;
    DICE_VALUE_ALL = 22;
}

MsgDisconnect

MsgDominateTeamName

MsgDominateTeamPopPkName

MsgDutyMinContri

MsgElitePKArenic

MsgElitePKGameRankInfo

MsgElitePKScore

MsgEncryptCode

This message is sent from the account server to the client when it first connects to initialize the RC5 cipher used for encrypting the player's password. The client then responds to this message with MsgAccount. In later versions of the client, this message is sent but never utilized. This is to keep the account server compatible with older versions of the client / different games.

Table of Contents

• Patch 5187

Patch 5187

Message Definition

✅ Verified (Client)

MsgEnemyList

Undocumented

MsgEquipLock

MsgFacebookAccount

MsgFactionChiefBase

MsgFactionMatch

MsgFactionMatchWitness

MsgFactionRankInfo

MsgFamily

This message is received by the game server or game client as an action for managing a clan. It allows a clan leader to manage allies and enemies, and for family members to query for clan information.

Table of Contents

• Patch 5187

Patch 5187

Message Definition

❗ Incomplete

Alternative:

Clan Action Type

❗ Incomplete

🔶 Response data

MsgFamilyOccupy

MsgFlower

MsgFlushExp

This game server message is sent to the client to update the interface with new weapon skill, magic, XP skill, or other types of experience.

Table of Contents

• Patch 4267

Patch 4267

Message Definition

☑️ Assumed (Soul)

Action Type

☑️ Assumed (Soul)

MsgFMMatch

MsgFMRoundRobin

MsgFriend

This message is sent by clients to manage friend requests and their friend and enemy lists. It's also sent by the game server to populate those lists on sign-on, update online statuses, after accepting a friend request, and after a player kill.

The level parameter that once appeared at offset 10 was removed during the alpha for Conquer Online in favor of the MsgFriendInfo message.

Table of Contents

• Patch 4267
• Patch 5017
• Patch 5615

Patch 4267

Message Definition

☑️ Assumed (Observed) - Soul + CoFuture

Action Type

☑️ Assumed (Soul)

enum FriendActionTypes {

    FRIEND_APPLY = 10;
    FRIEND_ACCEPT = 11;
    FRIEND_ONLINE = 12;
    FRIEND_OFFLINE = 13;
    FRIEND_BREAK = 14;
    FRIEND_GETINFO = 15;

    ENEMY_ONLINE = 16;
    ENEMY_OFFLINE = 17;
    ENEMY_DELETE = 18;
    ENEMY_ADD = 19;
}

Patch 5017

Message Definition

❓ Unverified

Action Type

☑️ Assumed (Soul)

enum FriendActionTypes {

    FRIEND_APPLY = 10;
    FRIEND_ACCEPT = 11;
    FRIEND_ONLINE = 12;
    FRIEND_OFFLINE = 13;
    FRIEND_BREAK = 14;
    FRIEND_GETINFO = 15;

    ENEMY_ONLINE = 16;
    ENEMY_OFFLINE = 17;
    ENEMY_DELETE = 18;
    ENEMY_ADD = 19;
}

Patch 5615

Message Definition

❓ Unverified

Action Type

☑️ Assumed (Soul)

enum FriendActionTypes {

    FRIEND_APPLY = 10;
    FRIEND_ACCEPT = 11;
    FRIEND_ONLINE = 12;
    FRIEND_OFFLINE = 13;
    FRIEND_BREAK = 14;
    FRIEND_GETINFO = 15;

    ENEMY_ONLINE = 16;
    ENEMY_OFFLINE = 17;
    ENEMY_DELETE = 18;
    ENEMY_ADD = 19;
}

MsgFriendInfo

MsgFuse

This message is sent by the client to request fusing materials to an item. Though the system isn't officially used by non-Chinese Conquer Online or translated in the interface, it is implemented in the client and can be utilized by private servers. Fuse rates come from fuse.ini, and successfully fused items result in a +1 stone (according to unverified sources).

Some private servers have repurposed this interface to quickly attempt a socket on an included item using meteor scrolls and other loose meteors.

Table of Contents

• Patch 4267

Patch 4267

Message Definition

❓ Unverified

MsgGameServerShutDown

This message is sent by the game server to the client to request a polite disconnect. Sending this message to the client causes an error state and spawns a message.

Table of Contents

• Patch 5635

Patch 5635

Message Definition

❓ Unverified

Shutdown Action

❓ Unverified

enum ShutdownAction {

    DEFAULT = 0;
}

MsgGemEmbed

This message is sent by the client to request embedding or removing a gem in an item.

⚠️ WARNING

Ensure that the identifier of the gem is a valid gem. It's possible that a modified game client can send a message containing a gem ID that's the same as the item identifier. In that case, a poorly validated server could add a gem based on the item type (could be deterministic).

Table of Contents

• Patch 4267

Patch 4267

Message Definition

☑️ Assumed (Soul)

Action Type

☑️ Assumed (Soul)

enum GemEmbedActionType {

    GEM_EMBED_ACTION_EMBED = 0;
    GEM_EMBED_ACTION_REMOVE = 1;
}

MsgGLChampionList

MsgGLHeroDetail

MsgGLInteractive

MsgGLLastSeasonTopScore

MsgGLRankingList

MsgGodExp

Undocumented

MsgGuide

MsgGuideInfo

MsgHangUp

MsgInstance

MsgInteract

This message is used to request an interaction with another player or broadcast an interaction to surrounding players. Some example interactions include physical and magical attacks, proposing, and killing a player.

Magic attacks in Conquer Online are obfuscated using bit rotations and XORs. See the example below from Soul.

#define ENCODE_MAGICATTACK(idUser, usType, idTarget, usPosX, usPosY)                           \
{                                                                                              \
    usType = (::ExchangeShortBits((usType - 0x14BE), 3) ^ (idUser) ^ 0x915D);                  \
    idTarget = ::ExchangeLongBits(((idTarget - 0x8B90B51A) ^ (idUser) ^ 0x5F2D2463), 32 - 13); \
    usPosX = (::ExchangeShortBits((usPosX - 0xDD12), 1) ^ (idUser) ^ 0x2ED6);                  \
    usPosY = (::ExchangeShortBits((usPosY - 0x76DE), 5) ^ (idUser) ^ 0xB99B);                  \
}

#define DECODE_MAGICATTACK(idUser, usType, idTarget, usPosX, usPosY)                          \
{                                                                                             \
    usType = 0xFFFF & (::ExchangeShortBits(((usType) ^ (idUser) ^ 0x915D), 16 - 3) + 0x14BE); \
    idTarget = (::ExchangeLongBits((idTarget), 13) ^ (idUser) ^ 0x5F2D2463) + 0x8B90B51A;     \
    usPosX = 0xFFFF & (::ExchangeShortBits(((usPosX) ^ (idUser) ^ 0x2ED6), 16 - 1) + 0xDD12); \
    usPosY = 0xFFFF & (::ExchangeShortBits(((usPosY) ^ (idUser) ^ 0xB99B), 16 - 5) + 0x76DE); \
}

inline unsigned int ExchangeShortBits(unsigned long nData, int nBits)
{
    MYASSERT(nBits >= 0 && nBits < 16);
    nData &= 0xFFFF;
    return ((nData >> nBits) | (nData << (16 - nBits))) & 0xFFFF;
}

inline unsigned int ExchangeLongBits(unsigned long nData, int nBits)
{
    MYASSERT(nBits >= 0 && nBits < 32);
    return (nData >> nBits) | (nData << (32 - nBits));
}

Similar to other messages, MsgInteract also contains types that overlap with other types in other messages. For example, aborting magic was handled in MsgInteract, but is instead duplicated and utilized in MsgAction.

Table of Contents

• Patch 4267
• Patch 5017

Patch 4267

Message Definition

☑️ Assumed (Observed) - CoFuture + Soul

Interaction Type

☑️ Assumed (Observed) - CoFuture + Soul

🔶 Response data

Patch 5017

Message Definition

☑️ Assumed (Observed) - COPSv6

Interaction Type

☑️ Assumed (Observed) - COPSv6

🔶 Response data

MsgInviteTrans

MsgItem

This message is received by the game server as a client request to use or act on an item. Item actions can be buying, selling, equipping, repairing, dropping, upgrading, and more. A miscellaneous function of this message is as a ping response. The client sends this message once every 10 seconds to show the latency to the server in the client.

The message can also be sent to the client for specific actions such as force unequipping, force dropping, updating the durability of an item, or updating the amount of an item.

⚠️ WARNING

Ensure that the item type for item improvements matches the consumption item type when improving items. If composing two items together, ensure that the fuel item is also different than the improved item. In all cases, location should also be validated (you cannot upgrade an item from any distance or from any map, same with vending items at player booths). If showing an item, generate a new sharing identifier rather than exposing the item's unique identifier.

Requests

Requests can be of multiple sizes, not necessarily always containing an amount or additional fields past the system time. When processing these request messages, this should be taken into account so not to use fields that have been unspecified.

Responses

Most item actions are initiated by the player. Each request expects a response of either MsgItem (this message) with a filled data field, or a MsgItemInfo of the resulting item (like from a shop purchase).

Table of Contents

• Patch 4267
• Patch 5017
• Patch 5517

Patch 4267

Message Definition

☑️ Assumed (Observed) - CoFuture + Soul

Item Action

☑️ Assumed (Observed) - CoFuture + Soul

🔶 Response data

Patch 5017

Message Definition

☑️ Assumed (Observed) - ApexConquer