Network protocol · ClassicUO 7.x
Packets registered by Moongate’s built-in registry and Ultima plugin. Directions are relative to the server; lengths include the opcode and length header.
134 packet definitions Packet and handler guide
Move request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Direction | bitfield | 1 | Direction and running flag |
2 | Sequence | byte | 1 | Movement sequence |
3 | Fast walk key | uint | 4 | Client walk key. |
Turns or steps the character. The high direction bit marks running.
MoveRequestPacketHandler: turns or steps the character, answered with 0x22 or 0x21
ASCII speech request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Type | byte | 1 | Speech type |
4 | Hue | ushort | 2 | Text hue |
6 | Font | ushort | 2 | Font |
8 | Text | ascii | variable | ASCII text, zero terminated |
Speech typed by the player in ASCII.
SpeechRequestPacketHandler: local say or in-game dot command.
Attack request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Target serial | uint | 4 | Requested attack target. |
The player clicks a mobile to attack it. The server makes the character fight it; a refused request is answered with 0xAA and a zero serial.
AttackRequestPacketHandler: ICombatService.Attack on the mobile; a refusal clears the client's target.
Use request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Target serial | uint | 4 | Item or mobile selected by the client; the high bit (0x80000000) asks for the own paperdoll. |
A double click opens a carried container when its graphic has the Container flag, or the paperdoll of a human-bodied mobile in view range. On a creature that is a mount it rides it; on the character itself, while it rides, it gets off.
UseRequestPacketHandler: opens a container the character carries, or a paperdoll; rides a creature that is a mount, and gets off when the character double clicks itself
Lift request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Item serial | uint | 4 | Item to lift |
5 | Amount | ushort | 2 | Requested stack amount. |
Only a whole carried item can be lifted. Rejection sends 0x27.
LiftRequestPacketHandler: picks up an item the character carries or wears, or one on the ground within 2 tiles
Drop request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Item serial | uint | 4 | Held item |
5 | X | ushort | 2 | Target X coordinate |
7 | Y | ushort | 2 | Target Y coordinate |
9 | Z | sbyte | 1 | Target Z coordinate |
10 | Grid index | byte | 1 | The slot the Enhanced Client asks for in the container's grid; 0 from the classic client. |
11 | Destination serial | uint | 4 | Target object. |
Drops a held item into a carried container, onto a stack of the same kind, or on the ground within 2 tiles (destination 0xFFFFFFFF); invalid destinations bounce it back.
DropRequestPacketHandler: drops the held item into a carried container, onto a carried or ground stack of the same kind, or on the ground within 2 tiles
Look request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Target serial | uint | 4 | Object to inspect. |
A single click shows the name over the object.
LookRequestPacketHandler: shows the first tooltip line over the object (0xC1)
Damage
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Target | uint | 4 | Serial of the mobile hit |
5 | Damage | ushort | 2 | The damage, kept from 0 to 65535 |
The damage of a hit, which the client shows over the head of the one hit.
CombatService: sent to the players in the fight when display_damage_numbers is on.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Mobile serial | uint | 4 | Character identifier |
7 | Name | ascii | 30 | Fixed ASCII name |
37 | Hits | ushort | 2 | Current hit points |
39 | Max hits | ushort | 2 | Maximum hit points |
41 | Can rename | bool | 1 | Renaming permission |
42 | Status version | byte | 1 | Status layout version |
43 | Attributes | byte[] | variable | Stats and extended status values. |
Version 5 status payload (91 bytes); fields after the basic header depend on the status version. A client from 7.0.30 (not Kingdom Reborn) gets version 6 (121 bytes) while the resistances are on: fifteen shorts after the tithing points, in this order: the maximum physical, fire, cold, poison and energy resistance, the defense chance increase and its maximum (45), the hit chance, swing speed, damage, lower reagent cost, spell damage, faster cast recovery, faster casting and lower mana cost increases. For a mobile that is not the player's own the packet is compact: 43 bytes, version 0, the name and the hit points as a share of 100.
CharacterEnterWorldService: sends the player status in the world-entry sequence. MobileStateService: the answer to a 0x34 status query, whole for the character, compact for another mobile.
Text command
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Kind | byte | 1 | 0x24 uses a skill; 0x27 casts a spell of the spellbook, 0x56 casts one from a macro, 0x43 opens the spellbook; 0x58 opens a door and 0xC7 plays an action, not handled yet |
4 | Text | ascii | variable | ASCII, ended by a zero byte. For kind 0x24 it starts with the number of the skill, as "21 0" for Hiding; for 0x27 the number of the spell from 1 and maybe the serial of the book, as "5 1073741825"; for 0x56 the number of the spell; for 0x43 the kind of book, 1 for Magery |
A text command of the client. Using a skill from the skill window or a macro sends kind 0x24; casting from the spellbook or a macro sends 0x27 or 0x56, and the spellbook button of the paperdoll 0x43.
TextCommandPacketHandler: kind 0x24 runs on_use of scripts/skills/<skill>.lua after the wait between two skills; 0x27 and 0x56 go to SpellCastService.CastFromBook, 0x43 opens the first spellbook the character carries; the other kinds are ignored for now (Debug log).
Equip request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Item serial | uint | 4 | Item to equip |
5 | Layer | byte | 1 | Layer the client suggests; the server uses the item's own |
6 | Mobile serial | uint | 4 | Target character. |
Wears the held item on the own character when its layer is free and both hands fit; anything else bounces back.
EquipRequestPacketHandler: puts the held item on the character, or bounces it back
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | 12 |
3 | Serial | uint | 4 | Serial of the mobile |
7 | Bars | ushort | 2 | 1 |
9 | Kind | ushort | 2 | 1 green (poison), 2 yellow |
11 | Level | byte | 1 | The poison level plus one; 0 turns the colour off |
Turns a colour of a mobile's health bar on or off.
PoisonService: green while a mobile is poisoned, sent to it and the players around on poisoning, each tick, cure and end.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serial | uint | 4 | Item identifier; bit 0x80000000 says an amount follows |
7 | Graphic | ushort | 2 | Item graphic (14 bits) |
9 | Amount | ushort | 2 | Stack amount |
11 | X | ushort | 2 | World X |
13 | Y | ushort | 2 | World Y; bit 0x8000 says a hue follows |
15 | Z | sbyte | 1 | World Z |
16 | Hue | ushort | 2 | Item hue, only when set |
Shows an item on the ground to clients before 7.0.0.0.
WorldViewService: sent to the players in range when an item is dropped, and when they come into range of it.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Mobile serial | uint | 4 | Player identifier |
9 | Body | ushort | 2 | Body graphic |
11 | X | ushort | 2 | World X coordinate |
13 | Y | ushort | 2 | World Y coordinate |
15 | Z | short | 2 | World Z coordinate |
17 | Direction | byte | 1 | Facing direction |
27 | Map width | ushort | 2 | Map width |
29 | Map height | ushort | 2 | Map height. |
First world-entry packet; initializes the player position and map bounds.
CharacterEnterWorldService: starts the world-entry packet sequence.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Serial | uint | 4 | Entity to remove from the client. |
Removes an item or mobile from the client view.
Outgoing packet emitted by world visibility and item handling
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Mobile serial | uint | 4 | Player identifier |
5 | Body | ushort | 2 | Body graphic |
8 | Hue | ushort | 2 | Body hue |
10 | Flags | bitfield | 1 | Mobile flags: frozen 0x01, female 0x02, war mode 0x40, hidden 0x80 |
11 | X | ushort | 2 | World X |
13 | Y | ushort | 2 | World Y |
17 | Direction | byte | 1 | Facing direction |
18 | Z | sbyte | 1 | World Z. |
Updates the player mobile after world entry, and tells a teleported player where it stands.
CharacterEnterWorldService: sends the player mobile update during world entry. TeleportService: sends it to a teleported player, whose step sequence starts again. MobileStateService: sent to the mobile's own player when its flags change, and its step sequence starts again.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Sequence | byte | 1 | Rejected sequence |
2 | X | ushort | 2 | Actual X coordinate |
4 | Y | ushort | 2 | Actual Y coordinate |
6 | Direction | byte | 1 | Actual facing |
7 | Z | sbyte | 1 | Actual Z coordinate. |
Refuses a step and restores the client to the server position.
MoveRequestPacketHandler: rejects the step and restores the server position.
Resynchronize request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Request data | byte[] | 2 | Resynchronization payload. |
Recognized and ignored for now.
IgnoredPacketHandler<T>: recognised and ignored for now (Debug log)
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Sequence | byte | 1 | Accepted sequence |
2 | Notoriety | enum | 1 | Current notoriety. |
Acknowledges an accepted step.
MoveRequestPacketHandler: acknowledges an accepted step.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Container serial | uint | 4 | Opened container |
5 | Gump | ushort | 2 | Container display layout |
7 | Container type | ushort | 2 | Present in the nine-byte variant. |
Seven bytes for older clients; nine bytes from client 7.0.9.0. This version-dependent packet has no on-wire length header. The gump 0xFFFF is a spellbook: the client opens its spellbook window and the spells follow in a 0x3C.
UseRequestPacketHandler: opens a carried container, or one on the ground within reach; BankService: opens the bank box; SpellbookService: opens a spellbook with the gump 0xFFFF.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Item serial | uint | 4 | Item identifier |
5 | Graphic | ushort | 2 | Item graphic |
8 | Amount | ushort | 2 | Stack amount |
10 | X | ushort | 2 | Container X position |
12 | Y | ushort | 2 | Container Y position |
14 | Grid index | byte | 1 | The item's slot (0 to 124) in the grid the Enhanced Client shows; newer client format only. |
15 | Container serial | uint | 4 | Parent container |
19 | Hue | ushort | 2 | Item hue. |
Twenty bytes before client 6.0.1.7; newer clients receive a grid byte. This version-dependent packet has no on-wire length header.
Item handlers: refresh the item after a lift or drop, or bounce it back.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Reason | enum | 1 | Lift rejection reason. |
Rejects a lift; the host may also send an item update to restore its position.
LiftRequestPacketHandler: reports why a lift was refused.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Status | byte | 1 | 2: the character is dead. The client shows its death and the ghost view; it is sent to the player of the character that dies. |
Sent when a player dies, as ModernUO's DeathStatus. Coming back to life sends no packet of its own: the living body (0x20) and the flags tell the client.
MobileStateService.SetDead: sent to the player's own client when its character dies.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Item serial | uint | 4 | The worn item. |
5 | Graphic | ushort | 2 | Item graphic. |
7 | Layer | ushort | 2 | Layer, written as 0 then the layer byte. |
9 | Wearer serial | uint | 4 | The mobile wearing it. |
13 | Hue | ushort | 2 | Item hue. |
Shows an item worn by a mobile.
EquipRequestPacketHandler and the world view: sent when an item goes on; BankService: the bank box before it opens.
Swing
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Flag | byte | 1 | Zero. |
2 | Attacker | uint | 4 | Serial of the one who swings |
6 | Defender | uint | 4 | Serial of the target |
A swing, told to the player who swings.
CombatService: sent to the attacker's player for each swing.
Mobile query
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Pattern | uint | 4 | Always 0xEDEDEDED. |
5 | Kind | byte | 1 | 4 asks a mobile's status, 5 the character's skills. |
6 | Mobile | uint | 4 | The mobile asked about. |
Sent when the status bar or the skill window opens.
MobileQueryPacketHandler: answers the status of the character (whole) or of a mobile in sight (compact) with 0x11, and the skills with 0x3A.
Pathfind
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | X | ushort | 2 | X of the spot to walk to. |
3 | Y | ushort | 2 | Y of the spot. |
5 | Z | ushort | 2 | Height of the spot, signed. |
Tells the client to walk its character to a spot by itself, as after a double right click on the ground: the client finds the way, writes "Pathfinding!" and sends its steps one by one. The client decides whether it goes: the server is not told.
MobileModule.PathfindTo: mobile.pathfind_to(player, x, y, z).
Skill lock
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Skill | ushort | 2 | Number of the skill, 0 to 57 |
5 | Lock | enum | 1 | 0 up, 1 down, 2 locked |
The player moves the lock arrow of a skill in the skill window. Nothing is sent back: the client already shows it.
SkillLockPacketHandler: IMobileStateService.SetSkillLock on the character in the world; a skill or lock that does not exist is ignored.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Packet length. |
3 | Type | byte | 1 | 0x02 the whole list with caps, 0xDF one skill with its cap. |
4 | Skill | ushort | 2 | The skill: numbered from 1 in the whole list, from 0 for one skill. |
6 | Value | ushort | 2 | The skill in tenths of a point. |
8 | Base | ushort | 2 | The skill without bonuses, in tenths. |
10 | Lock | byte | 1 | 0 up, 1 down, 2 locked. |
11 | Cap | ushort | 2 | The cap in tenths. |
13 | End | ushort | 2 | A zero closes the whole list; one skill has none. |
The skills of the player's own character. The fields from Skill to Cap repeat for every skill of the whole list.
MobileStateService: the whole list answers a mobile query, one skill follows a change made by a script.
Vendor: buy reply
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Vendor | uint | 4 | Serial of the vendor. |
7 | Flag | byte | 1 | 2 for a purchase; anything else is a cancel. |
8 | Lines | loop | variable | Seven bytes each: layer (byte), virtual serial of the line (uint), amount (ushort). At most 100 lines. |
What the player chose in the shop window. The serials are the virtual ones the server gave the lines of the window (Serial.MinVirtual and above); they are valid while the window is open.
VendorBuyReplyPacketHandler: VendorService.Buy checks the window, the distance, the stock and the gold, and either gives everything or nothing.
Vendor: end of the shop window
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Vendor | uint | 4 | Serial of the vendor whose shop window closes. |
7 | Count | byte | 1 | Always 0. |
Closes the shop window after a purchase or a refusal. Always 8 bytes.
VendorService.Buy: sent after every reply, bought or refused.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Item count | ushort | 2 | Number of entries |
5 | Items | loop | variable | Repeated container item entries. |
Each item uses 19 bytes, or 20 with the grid byte for newer clients: the item's slot (0 to 124) in the grid the Enhanced Client shows. After a 0x24 with the gump 0xFFFF the entries are the spells of a spellbook, as the classic servers send them: the serial counts down from 0x7FFFFFFF, the graphic is 0, the amount is the number of the spell from 1 and the container is the book.
UseRequestPacketHandler: the contents of a carried container, or of one on the ground within reach; BankService: those of the bank box; SpellbookService: the spells a book holds.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Mobile serial | uint | 4 | Target mobile |
5 | Light level | byte | 1 | Personal light. |
Sets the light level for one mobile.
CharacterEnterWorldService: sends personal light 0 during world entry; StatBonusService: night sight, and 0 when it ends.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Light level | byte | 1 | Global light. |
Sets ambient world light: the day and night cycle, dungeons and jails, or .globallight.
CharacterEnterWorldService sends it during world entry; LightService resends it when the player's light changes.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Message type | enum | 1 | Popup message code. |
Sent before disconnect when character creation is refused or fails.
Game: sent before disconnecting when character creation is refused or fails
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Mode | byte | 1 | 1: play the sound once. |
2 | Sound | ushort | 2 | Sound identifier. |
4 | Volume | ushort | 2 | Always 0. |
6 | X | ushort | 2 | Where the sound plays. |
8 | Y | ushort | 2 | Where the sound plays. |
10 | Z | short | 2 | Where the sound plays. |
Plays a sound once at a location.
SpeechService: npc.play_sound of a mobile script, to the players within 15 cells. Also item.play_sound of item scripts, and WeatherService: thunder during a storm.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
Marks completion of login and world entry.
CharacterEnterWorldService: ends the login part of the world-entry sequence; only 0x5B follows.
Map command
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Serial | uint | 4 | Serial of the map item |
5 | Command | byte | 1 | 1 add, 2 insert, 3 change, 4 remove, 5 clear, 6 toggle whether the course may be changed |
6 | Number | byte | 1 | Index of the pin for insert, change and remove |
7 | X | short | 2 | Pin x in pixels of the drawing |
9 | Y | short | 2 | Pin y in pixels of the drawing |
A player's change to the course of an open map: at most 50 pins, inside the drawing.
MapCommandRequestPacketHandler: applied when the map is in the player's backpack or within 2 tiles, movable and not protected, and, but for the toggle, while the course may be changed.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Serial | uint | 4 | Serial of the map item |
5 | Command | byte | 1 | 5 shows the map, 1 adds a pin, 7 answers whether the course may be changed |
6 | Flag | byte | 1 | For 7: 1 when the course may be changed |
7 | X | ushort | 2 | Pin x in pixels of the drawing |
9 | Y | ushort | 2 | Pin y in pixels of the drawing |
Shows a map item, one pin of its course at a time, and whether its course may be changed.
MapDisplayService: sent after 0xF5 or 0x90 when a map opens, and as the answer to a toggle.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Hour | byte | 1 | Hour |
2 | Minute | byte | 1 | Minute |
3 | Second | byte | 1 | Second. |
Sent last in the world-entry sequence with the real UTC time of the server, not the game time.
CharacterEnterWorldService: sends the real UTC time at the end of world entry.
Play character
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Name | ascii | 30 | Selected character name |
33 | Client flags | bitfield | 4 | Client feature flags |
41 | Login count | uint | 4 | Client login count |
61 | Slot index | uint | 4 | Selected slot. |
Selects a character slot and starts world entry.
PlayCharacterPacketHandler: brings the chosen character into the world
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Type | byte | 1 | 0 rain, 1 storm, 2 snow, 0xFF none (WeatherKindType). |
2 | Density | byte | 1 | Number of particles, up to 70. |
3 | Temperature | sbyte | 1 | Temperature, signed. |
Sets the weather the client shows: the profile of the player's region, or dry inside a building.
WeatherService: sent at login, on a region change and when the player's weather changes; resent every minute, every game hour and after a season packet (0xBC).
Book pages request or edit
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serial | uint | 4 | Serial of the book. |
7 | Pages | ushort | 2 | How many pages follow. |
9 | Page | loop | variable | For each page: its number from 1 (ushort), its line count (ushort; 0xFFFF asks for the page and no line follows), then each line in UTF-8 ended by a zero. |
The lines a player wrote on pages of a book, or a request for a page. An edit is saved when the sender carries the book and the book is writable, within 8 lines a page and 79 characters a line; a request is not answered, since every page is sent at the opening. A packet that is not well formed changes nothing.
BookEditPacketHandler: BookDocumentService.SetPages.
Book pages
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serial | uint | 4 | Serial of the book. |
7 | Pages | ushort | 2 | How many pages follow: all of them. |
9 | Page | loop | variable | For each page: its number from 1 (ushort), how many lines it has (ushort, 8 at most), then each line in UTF-8 ended by a zero. |
The pages of a book, sent right after its header (0xD4). The saved text is split at its empty lines, and a page of more than 8 lines goes on in the next.
BookDocumentService.Open, with the pages of BookPagination.
Target response
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Cursor | enum | 1 | 0 object, 1 location |
2 | Cursor id | int | 4 | Id of the cursor answered |
6 | Flags | enum | 1 | Flags of the cursor |
7 | Serial | uint | 4 | Item or mobile picked, 0 for a spot |
11 | X | short | 2 | World X, -1 when cancelled |
13 | Y | short | 2 | World Y, -1 when cancelled |
15 | Unused | byte | 1 | Ignored. |
16 | Z | sbyte | 1 | World Z as the client sees it |
17 | Graphic | ushort | 2 | Static graphic, 0 for the ground or an object |
The player's pick for a target cursor, or a cancel.
TargetResponsePacketHandler: completes the player's pending target.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Cursor | enum | 1 | 0 object, 1 location |
2 | Cursor id | int | 4 | Id the response must carry; 0 when cancelling |
6 | Flags | enum | 1 | 0 neutral, 1 harmful, 2 beneficial, 3 cancel |
7 | Unused | byte[] | 12 | Zero. |
Shows the target cursor, or with flags 3 takes it away.
TargetService: sent when a target begins or is cancelled by the server.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Music | ushort | 2 | The track (MusicType); 0x1FFF stops the music. |
Plays a music track on the client.
MusicService: the track of the player's region, else its map's, when it changes; .music plays one.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Mobile serial | uint | 4 | The mobile that plays the animation. |
5 | Action | ushort | 2 | The action of the mobile's body |
7 | Frame count | ushort | 2 | How many frames are played |
9 | Repeat count | ushort | 2 | How many times |
11 | Reverse | bool | 1 | 1 plays it backwards |
12 | Repeat | bool | 1 | 1 repeats it |
13 | Delay | byte | 1 | Delay between frames |
Plays an animation of a mobile.
WorldViewService: mobile.animate of a script, to the mobile's own player and those who see it.
Secure trade request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length. |
3 | Command | byte | 1 | 1 closes the window, 2 ticks or unticks the player's side. |
4 | Box | uint | 4 | The trade box of the window. |
8 | Value | int | 4 | Command 2 only: not zero for ticked. |
The client's side of a secure trade: it cancels or ticks. The gold command of the newer clients (3), and any command the server does not know, is read and ignored.
SecureTradeRequestPacketHandler: cancels the trade of the box (either box of the trade), or sets the tick of the player's side; the box must be the player's own for a tick.
Secure trade
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | 47 for a display, 17 for a close or an update. |
3 | Flag | byte | 1 | 0 displays the window, 1 closes it, 2 updates the ticks. |
4 | Serial | uint | 4 | Display: the other player. Close and update: the box. |
8 | Data | byte[] | variable | Display: the two boxes, 1 and the other player's name (30 bytes). Update: the two ticks, as 4 byte numbers. |
Sent to both players of a secure trade when it opens, whenever a tick or a box changes, and when it closes.
TradeService: opens, updates and closes the windows of a secure trade.
Bulletin board request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Subcommand | byte | 1 | 0x03 asks for the text of a message, 0x04 for its summary, 0x05 posts, 0x06 removes. |
4 | Board | uint | 4 | Serial of the bulletin board item. |
8 | Message | uint | 4 | Serial of the message asked for or removed; on a post, the message it replies to, 0 for a new thread. |
12 | Subject and lines | loop | variable | On a post only: the subject as a length byte and that many bytes of UTF-8 text, a count byte, then each line the same way. The text of each ends at its first zero. |
What a client asks of a bulletin board. A request is answered only when the item is a board, the character stands within two tiles of it on its map, and the message is one of that board; game masters and above are answered from anywhere. A post whose lengths run past the packet is refused.
BulletinBoardRequestPacketHandler: answers with sub-command 0x01 or 0x02, posts (the new message enters the poster's list with 0x25) or removes (0x1D for each message gone).
Bulletin board: display
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Subcommand | byte | 1 | Value 0x00: display the board. |
4 | Board | uint | 4 | Serial of the bulletin board item. |
8 | Name | utf8 | 30 | Name of the board: at most 29 bytes of UTF-8 text, zero filled. |
Opens a bulletin board on the client. Always 38 bytes. The messages follow as the content of a container (0x3C): each message is an item 0x0EB0 inside the board, and the client asks for each summary with sub-command 0x04.
BulletinBoardService.Open: sent when a player double clicks a bulletin board (bulletin_board.lua, board.open).
Bulletin board: message summary
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Subcommand | byte | 1 | Value 0x01: message summary. |
4 | Board | uint | 4 | Serial of the bulletin board item. |
8 | Message | uint | 4 | Serial of the message. |
12 | Thread | uint | 4 | Serial of the first message of the thread this one replies to; 0 for a first message. |
16 | Poster, subject, date | loop | variable | Three strings, each a length byte, UTF-8 text and one zero; the length counts the zero. The date is the day only, in English: Oct 05, 2026. |
The line of a message in the list of a board: who posted it, what about and when.
BulletinBoardRequestPacketHandler: the answer to a client's sub-command 0x04.
Bulletin board: message
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Subcommand | byte | 1 | Value 0x02: message. |
4 | Board | uint | 4 | Serial of the bulletin board item. |
8 | Message | uint | 4 | Serial of the message. |
12 | Poster, subject, date, look, lines | loop | variable | Poster, subject and date as in the summary; then the poster's body (ushort), hue (ushort), a count byte and that many pieces worn (item id ushort, hue ushort); then a count byte and that many lines, each a length byte, UTF-8 text and two zeros, the length counting both. |
A message in full, with its poster as it looked when it posted. The two zeros after a line work around an old client bug that loses the last letter.
BulletinBoardRequestPacketHandler: the answer to a client's sub-command 0x03.
War mode request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | War mode | bool | 1 | The mode asked: 1 war, 0 peace. |
2 | Trailing bytes | byte[] | 3 | Not read. |
Sent when the player switches between war and peace.
WarModeRequestPacketHandler: sets the mode, answers with 0x72 and shows the stance to the players around.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | War mode | bool | 1 | Whether combat stance is enabled |
2 | Trailing bytes | byte[] | 3 | Fixed protocol bytes. |
Tells the client its current war mode.
CharacterEnterWorldService: peace during world entry. MobileStateService: the answer to a war mode request or to a script.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Sequence | byte | 1 | Ping sequence echoed by the host. |
Bidirectional keepalive packet.
Game: PingPacketHandler; Login: LoginRolePingPacketHandler
Vendor: buy list
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Shop container | uint | 4 | Serial of the vendor's virtual ShopBuy container (layer 0x1A). |
7 | Line count | byte | 1 | Number of lines. |
8 | Lines | loop | variable | Per line: price (uint), name length plus one (byte), name as zero-ended text. A name made only of digits is a cliloc number. |
The prices and names of the shop window, in the order of the items that 0x3C sent (0x3C writes them from the last to the first).
VendorService.OpenBuy: sent with 0x2E (the two virtual shop containers), 0x3C and 0x24 (gump 0x30).
Rename request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Mobile | uint | 4 | The creature to rename. |
5 | Name | ascii | 30 | The new name, padded with zeros. |
Sent when the player edits the name of a creature in its status bar, which the status (0x11) allows with its can rename byte.
RenameRequestPacketHandler: the owner renames its pet (1 to 16 letters, no banned word) and staff any creature they reach, within 12 tiles; a summon is refused to its owner, not to staff. A name is read as Latin-1, so a byte above 0x7F is a name the rules refuse, not a rejected packet.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Mobile serial | uint | 4 | Mobile identifier |
5 | Body | ushort | 2 | Body graphic |
7 | X | ushort | 2 | World X |
9 | Y | ushort | 2 | World Y |
11 | Z | sbyte | 1 | World Z |
12 | Direction | byte | 1 | Facing direction; bit 0x80 marks a run |
13 | Hue | ushort | 2 | Body hue |
15 | Flags | byte | 1 | Mobile flags: frozen 0x01, female 0x02, war mode 0x40, hidden 0x80 |
16 | Notoriety | enum | 1 | Notoriety |
Moves or turns a mobile the client already shows.
WorldViewService: sent to the players that already saw a mobile when it steps or turns.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Mobile serial | uint | 4 | Mobile identifier |
7 | Body | ushort | 2 | Body graphic |
9 | X | ushort | 2 | World X |
11 | Y | ushort | 2 | World Y |
13 | Z | sbyte | 1 | World Z |
14 | Direction | byte | 1 | Facing direction |
15 | Hue | ushort | 2 | Body hue |
17 | Flags | bitfield | 1 | Mobile flags: frozen 0x01, female 0x02, war mode 0x40, hidden 0x80 |
18 | Notoriety | enum | 1 | Notoriety |
19 | Worn items | loop | variable | Equipment entries terminated by zero serial. |
Introduces the mobile and its worn items; ends with a zero serial.
CharacterEnterWorldService: sends the player and worn items during world entry. WorldViewService: a mobile that comes into range, or is revealed, to the players around.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Account | ascii | 30 | Account name |
31 | Password | ascii | 30 | Password |
61 | Next login key | byte | 1 | Login handshake byte. |
Checks credentials and returns a realm list or denial.
Login: async account check, then 0xA8 list or 0x82 denial
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Reason | enum | 1 | Denial reason. |
Rejects login with a reason code.
LoginRoleAccountPacketHandler and LoginRoleServerSelectPacketHandler on the login role; GameLoginPacketHandler on the game role when the handoff ticket is refused.
Delete character
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Password bytes | byte[] | 30 | Password field |
31 | Slot index | uint | 4 | Character slot. |
Marks the selected character for deletion.
DeleteCharacterPacketHandler: marks the character for deletion
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Result | enum | 1 | Deletion result code. |
Reports the result of a deletion request.
DeleteCharacterPacketHandler: reports the result of a deletion request.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Character count | byte | 1 | Number of slots |
4 | Characters | loop | variable | Fixed-width character entries. |
Updates character slots without a full city list.
Character list update response after a character slot changes.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Mobile serial | uint | 4 | The mobile whose paperdoll opens. |
5 | Title | ascii | 60 | Name, then ', title' when the mobile has one; zero-padded. |
65 | Flags | byte | 1 | 0x01 war mode, 0x02 the viewer may take items off. |
Opens a mobile's paperdoll.
UseRequestPacketHandler: sent in answer to a double click.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Packet length. |
3 | Corpse | uint | 4 | Serial of the corpse |
7 | Items | loop | variable | For every item: its layer plus one (1 byte) and its serial (4 bytes); a zero byte ends the list |
What a corpse is drawn wearing. The items come first, in a container content (0x3C) of the corpse.
WorldViewService: sent after the corpse of a human, elf or gargoyle body, with what who died wore that is still inside, its hair and its beard.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | IPv4 address | byte[] | 4 | Realm address |
5 | Port | ushort | 2 | Realm port |
7 | Auth key | uint | 4 | One-use handoff key. |
Redirects to the selected realm after ticket issue.
Login: sent after a valid 0xA0, before closing the login connection
Create character (Enhanced Client)
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Unknown pattern | byte[] | 4 | Four bytes the server does not read |
7 | Character slot | uint | 4 | Requested slot |
11 | Name | ascii | 30 | Character name |
41 | Unused | byte[] | 30 | Thirty bytes the server does not read |
71 | Profession | byte | 1 | Profession choice |
72 | Starting city | byte | 1 | City index |
73 | Gender | enum | 1 | Gender choice |
74 | Race | enum | 1 | Race choice, sent one higher (1 for human) |
75 | Strength | byte | 1 | Chosen strength |
76 | Dexterity | byte | 1 | Chosen dexterity |
77 | Intelligence | byte | 1 | Chosen intelligence |
78 | Skin hue | ushort | 2 | Appearance hue |
80 | Unused | byte[] | 8 | Eight bytes the server does not read |
88 | Skills | loop | 8 | Four skill and value pairs |
96 | Appearance | byte[] | 50 | Hair, shirt, face and beard hues and styles, with unread bytes between them. |
Enhanced Client creation request. Only the current 146-byte layout is parsed.
CreateCharacterEnhancedPacketHandler: creates and saves the character and starting items, then brings it into the world
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Serial | uint | 4 | Serial of the map item |
5 | Gump | ushort | 2 | 0x139D, the map gump |
7 | X1 | ushort | 2 | West edge of the area, in tiles |
9 | Y1 | ushort | 2 | North edge |
11 | X2 | ushort | 2 | East edge |
13 | Y2 | ushort | 2 | South edge |
15 | Width | ushort | 2 | Width of the drawing in pixels |
17 | Height | ushort | 2 | Height of the drawing in pixels |
The area a map item shows, for clients older than 7.0.13: Felucca and Trammel only.
MapDisplayService: sent when a map opens on an older client.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Auth key | uint | 4 | Handoff key |
5 | Account | ascii | 30 | Account name |
35 | Password | ascii | 30 | Password. |
Consumes the one-use handoff ticket and starts the game session.
Game: validates and consumes the one-use handoff ticket, then sends 0xB9 and 0xA9
Book header change (old)
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Serial | uint | 4 | Serial of the book. |
5 | Skipped | uint | 4 | Flags and page count, not read. |
9 | Title | ascii | 60 | The title, Latin-1, zero filled. |
69 | Author | ascii | 30 | The author, Latin-1, zero filled. |
The title and author a player wrote, as the older clients send them. Saved as those of 0xD4.
BookEditPacketHandler: BookDocumentService.SetHeader.
Hue picker response
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Picker id | int | 4 | Id of the picker answered |
5 | Graphic | ushort | 2 | Ignored. |
7 | Hue | ushort | 2 | Hue picked; masked with 0x3FFF and kept from 2 to 1001 |
The hue the player picked in the hue picker. Nothing is sent when the picker is closed.
HuePickerResponsePacketHandler: gives the hue to the player's open picker; ignored when the id is not the one of the open picker.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Picker id | int | 4 | Id the answer must carry; the picker's own, not an item serial |
5 | Unused | ushort | 2 | Zero. |
7 | Graphic | ushort | 2 | Item graphic shown in the picker |
Opens the client's hue picker with a graphic in it.
HuePickerService: sent when a script opens a picker, as the dyes do on a dye tub.
Help request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Unused | byte[] | 257 | Filler the client sends after the opcode; zeros. |
The client sends it when the player presses the Help button of the paperdoll.
HelpRequestPacketHandler: opens the help menu gump (help_menu) of the character.
Vendor: sell list
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Vendor | uint | 4 | Serial of the vendor. |
7 | Item count | ushort | 2 | Number of items offered. |
9 | Items | loop | variable | Per item: serial (uint), graphic (ushort), hue (ushort), amount (ushort), price of a piece (ushort), name length (ushort), name as ASCII text. |
What the vendor offers to buy from the player: items the player carries that the vendor's shop buys, 250 at most. Amount and price above 65535 are sent as 65535.
VendorService.OpenSell: sent when a player picks Sell in the vendor's context menu or says vendor sell.
Vendor: sell reply
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Vendor | uint | 4 | Serial of the vendor. |
7 | Item count | ushort | 2 | Number of items chosen; the size must be 9 plus 6 times this. |
9 | Items | loop | variable | Six bytes each: serial of the item (uint), amount (ushort). |
What the player chose to sell. A count that does not match the size is refused.
VendorSellReplyPacketHandler: VendorService.Sell checks the window, the distance and the items, and either pays everything or nothing.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Server index | ushort | 2 | Selected realm. |
Selects an eligible live realm.
Login: checks realm eligibility, issues ticket and redirects
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Mobile | uint | 4 | The mobile. |
5 | Maximum | ushort | 2 | The maximum hit points. |
7 | Current | ushort | 2 | The current hit points. |
The hit points of a mobile. The players around get them as a share of 100, never the real numbers.
MobileStateService: sent when a script changes a mobile's numbers.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Mobile | uint | 4 | The mobile. |
5 | Maximum | ushort | 2 | The maximum mana. |
7 | Current | ushort | 2 | The current mana. |
The mana of a mobile, for its own player.
MobileStateService: sent when a script changes a mobile's numbers.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Mobile | uint | 4 | The mobile. |
5 | Maximum | ushort | 2 | The maximum stamina. |
7 | Current | ushort | 2 | The current stamina. |
The stamina of a mobile, for its own player.
MobileStateService: sent when a script changes a mobile's numbers.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier 0xA6. |
1 | Length | ushort | 2 | Total packet length, big endian. |
3 | Type | byte | 1 | 2 selects the native Updates window. |
4 | Tip number | uint | 4 | Zero for this update, big endian. |
8 | Text length | ushort | 2 | Message length in bytes, big endian. |
10 | Text | byte[] | variable | Windows-1252 text without a NUL terminator; line breaks use LF. |
Sent once after the enter-world sequence when ultima.show_motd_gump is true. Maximum text size is 65,525 bytes. Unsupported characters or a longer combined MOTD fall back to Unicode journal messages without truncation.
MotdService: the existing MOTD template and variables in a private native Updates scroll.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | System info | byte | 1 | Client system flag |
4 | Server count | ushort | 2 | Number of realms |
6 | Servers | loop | variable | Repeated server entries. |
Lists realms eligible for the authenticated account.
LoginRoleAccountPacketHandler: sends the eligible realms after authentication.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Character count | byte | 1 | Number of slots |
4 | Characters | loop | variable | Character slot records followed by city records and flags. |
Sends saved characters and starting cities after game login.
GameLoginPacketHandler: sends saved characters and starting cities.
Combatant
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Target | uint | 4 | Serial of the mobile the character fights; zero when it fights no one |
Highlights the target of the fight in the client. Sent when a player starts or changes a fight and when it ends or is refused.
CombatService: sent to the player who fights. AttackRequestPacketHandler: a clear target for a refused request.
Unicode speech request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Type | byte | 1 | Speech type; the bits 0xC0 mark encoded speech with keywords |
4 | Hue | ushort | 2 | Text hue |
6 | Font | ushort | 2 | Font |
8 | Language | ascii | 4 | Three letters and a zero; anything else is read as ENU |
12 | Keywords and text | byte[] | variable | Plain speech: big-endian UTF-16 text, zero terminated. Encoded speech: a 12-bit keyword count, the 12-bit keyword ids, then UTF-8 text, zero terminated. |
Speech typed by the player in Unicode, sent by every client. It is read leniently, since a refused packet disconnects the client: a missing terminator is accepted, a badly encoded character becomes U+FFFD and an odd language code becomes ENU. Only a truncated keyword list or more than 50 keywords is refused. The types guild (0x0D) and alliance (0x0E) are the guild and alliance chats.
SpeechRequestPacketHandler: speech to the players in range and dot commands; the keyword ids of encoded speech reach the on_speech of the NPCs and of the scripted items. The guild and alliance types go to the guild chat and to no one else.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serial | uint | 4 | Speaker identifier |
7 | Body | ushort | 2 | Speaker body graphic |
9 | Type | byte | 1 | Speech type |
10 | Hue | ushort | 2 | Text hue |
12 | Font | ushort | 2 | Font |
14 | Language | ascii | 4 | Language code |
18 | Name | ascii | 30 | Speaker name |
48 | Text | byte[] | variable | Unicode text (UTF-16 big endian), zero terminated |
Shows player speech and private command output in Unicode. Also carries MOTD lines when ultima.show_motd_gump is false or the native scroll cannot represent the complete text.
Player speech, private command output and MOTD delivery.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Mobile | uint | 4 | Serial of who died |
5 | Corpse | uint | 4 | Serial of its corpse, 0 when it leaves none |
9 | Unused | uint | 4 | Zero. |
Makes the client play the death of the mobile and tie it to its corpse; the client picks the animation of the body.
DeathService: sent to the players who see an NPC die, after its corpse and before its removal.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serial | uint | 4 | Gump serial, unique per gump sent. |
7 | Type id | uint | 4 | Gump type id: FNV-1a of the gump id. |
11 | X | uint | 4 | Left edge on the screen. |
15 | Y | uint | 4 | Top edge on the screen. |
19 | Layout length | ushort | 2 | Bytes of the layout, NUL included. |
21 | Layout and strings | byte[] | variable | The layout commands (such as { resizepic 0 0 9200 300 400 }) and their NUL; then a ushort string count and each string as a ushort length in characters and UTF-16 big-endian text. |
Opens a gump on clients before 5.0.0a. The layout refers to the strings by index. Readable scrolls created with the staff book command use this gump protocol when opened.
GumpService: opens a gump when the client is older than 5.0.0a.
Gump response
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serial | uint | 4 | Serial of the gump answered. |
7 | Type id | uint | 4 | Type id of the gump answered. |
11 | Button | uint | 4 | Button pressed; 0 when the gump was closed. |
15 | Switch count | uint | 4 | Checkboxes and radios that are on. |
19 | Switches and texts | loop | variable | Switch ids (uint each); then a uint text count and each text entry as ushort id, ushort length in characters and UTF-16 big-endian text. |
The answer is dropped when the gump was not sent, or offers no such button, switch or text entry, or a text is longer than 239 characters.
GumpResponsePacketHandler: hands the answer to GumpService, which checks it and calls the gump.
Open chat window
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Chat data | byte[] | 63 | Fixed chat window payload. |
The chat button. The legacy chat window is not built: the player is told which chats work.
OpenChatWindowPacketHandler: tells the player the chats that work
Character profile request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Mode | byte | 1 | 0 asks to show the profile, 1 sends an edited one. |
4 | Character serial | uint | 4 | The character whose profile is asked for or edited. |
8 | Edited profile | byte[] | variable | Only in mode 1: two bytes skipped, the number of characters and the UTF-16BE text with no terminator. Mode 0 ends after the serial. |
The Enhanced Client sends it for its own character right after entering the world. A display request is answered with the profile when it may be read (the own one always, another player's within 12 tiles on the same map); an edit changes only the sender's own profile, up to 511 characters, and gets no reply.
ProfileRequestPacketHandler: replies with 0xB8; an edit stores the cleaned text in the prop profile of the character
Character profile
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Character serial | uint | 4 | The character whose profile it is. |
7 | Header | ascii | variable | The title the paperdoll shows, in Latin-1, zero terminated. |
7 | Footer | byte[] | variable | Text under the profile that the player cannot edit: for the own profile, how many days old the character is. UTF-16BE, zero terminated. It comes before the body on the wire. Starts after the previous text. |
7 | Body | byte[] | variable | The profile text, the part the player edits. UTF-16BE, zero terminated. Starts after the previous text. |
The answer to a display request of 0xB8.
ProfileRequestPacketHandler
Enable Locked Client Features
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Feature flags | bitfield | 4 | Locked feature mask. |
Enables client features after game login.
Game: sent after a valid 0x91
Quest arrow
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Command | byte | 1 | 1 shows the arrow, 0 clears it |
2 | X | ushort | 2 | X of the spot the arrow points to; 0xFFFF when clearing |
4 | Y | ushort | 2 | Y of the spot the arrow points to; 0xFFFF when clearing |
6 | Target | uint | 4 | Serial of the mobile the arrow points to; only in the 10 byte form sent to clients from 7.0.9.0, 0 for none |
Shows or clears the quest arrow at the edge of the client's screen, which points to a spot of the map and moves as the player walks. It is 6 bytes for a client older than 7.0.9.0 (or one that has not told its version) and 10 bytes from 7.0.9.0, with the serial of the target at the end; it has no length field, so "variable" only says that the size depends on the client. The Tracking skill uses it; not tried with a real client.
ArrowModule: arrow.show(player, x, y, target) and arrow.clear(player).
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Season | enum | 1 | Season identifier |
2 | Play sound | bool | 1 | Whether the client plays the season sound. |
Sets the displayed season. The client resets its light and stops its weather on it, so 0x4F and 0x65 follow.
CharacterEnterWorldService at world entry; SeasonService on a region change or a map change to another season, a rotation and .season, followed by 0x4F light and 0x65 weather. It is sent only when the season differs from the last one sent.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Version | ascii | variable | Client version string. |
Records the client version on the session.
ClientVersionPacketHandler: records the client version on the session
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Packet length | ushort | 2 | Fixed value of three bytes. |
Requests the client version.
Registered in the built-in table; not sent by any host today.
Extended command
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Subcommand | ushort | 2 | Extended command identifier |
5 | Payload | byte[] | variable | Subcommand data. |
Subcommand 0x10 asks for one tooltip and 0x1A sets the lock of a stat (a byte for the stat, 0 strength, 1 dexterity, 2 intelligence, and a byte for the lock, 0 up, 1 down, 2 locked). Subcommand 0x13 asks for the context menu of a mobile or an item (its serial, four bytes) and 0x15 chooses an entry of it (the serial and the index of the entry, two bytes). Subcommand 0x1C casts the spell of one of the client's icons: two bytes with 1 when the serial of a spellbook follows (four bytes), then two bytes with the number of the spell from 1. Subcommand 0x06 is a party command: its first payload byte is the command (0x01 add and 0x02 remove, each with a serial or none, 0x03 a private message with its target, 0x04 a public message, 0x06 the loot flag, 0x08 accept and 0x09 decline, each with the serial of the leader). The others are ignored for now. Outgoing 0xBF/0x08, 0xBF/0x14 and 0xBF/0x19 are separate subcommands.
ExtendedCommandPacketHandler: subcommand 0x10 answers the tooltip; subcommand 0x1A sets the stat lock of the character in the world (a lock past locked reads as up); subcommands 0x13 and 0x15 go to ContextMenuService.Request and Select; subcommand 0x1C goes to SpellCastService.CastFromBook; subcommand 0x06 goes to PartyService
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Subcommand | ushort | 2 | Value 0x04 |
5 | Type id | uint | 4 | Type id of the gump to close. |
9 | Button | uint | 4 | Button the client answers with; 0. |
Extended command subcommand 0x04 closes a gump.
GumpService: closes a gump replaced by one with the same id, or closed by the server.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Subcommand | ushort | 2 | Value 0x08 |
5 | Map | enum | 1 | Map identifier. |
Extended command subcommand 0x08 changes the client map: sent on world entry and before the new position of a player teleported to another map.
CharacterEnterWorldService: sends the selected map during world entry. TeleportService: sends the new map to a player teleported across maps.
Display context menu
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Subcommand | ushort | 2 | 0x14. |
5 | Format | ushort | 2 | 2: the format every client from 6.0.0.0 takes, with the cliloc whole. |
7 | Serial | uint | 4 | Serial of the mobile or item the menu is of. |
11 | Count | byte | 1 | How many entries follow, 20 at most. |
12 | Entry | loop | variable | For each entry: its cliloc, the text the client shows (uint); its index in the menu, from 0 (ushort); its flags (ushort): 1 greyed out, 0 otherwise. |
The context menu of a mobile or an item: the server's own entries (Open Paperdoll, Open Backpack), then the ones its Lua script adds. An entry the player is out of range of, or that is not enabled, is greyed out. The client answers with 0xBF subcommand 0x15 and the index chosen. A target with no entry gets no packet.
ContextMenuService.Request, asked by the client with 0xBF subcommand 0x13.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes, 12. |
3 | Subcommand | ushort | 2 | Value 0x19 |
5 | Type | byte | 1 | 2: the locks of the stats |
6 | Serial | uint | 4 | The player's own character |
10 | Unused | byte | 1 | Zero. |
11 | Locks | bitfield | 1 | Two bits each, strength << 4, dexterity << 2, intelligence: 0 up, 1 down, 2 locked |
The arrows beside strength, dexterity and intelligence in the status window. Sent after the status when a player enters the world, and again with the three locks when one changes, as ModernUO.
CharacterEnterWorldService: sends the stat locks of the character during world entry. MobileStateService.SetStatLock: sends them again to the player when one changes.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes, 23. |
3 | Subcommand | ushort | 2 | Value 0x1B |
5 | Command | ushort | 2 | 1: the contents of a spellbook |
7 | Book | uint | 4 | The spellbook item |
11 | Graphic | ushort | 2 | The graphic of the book |
13 | First spell | ushort | 2 | The spell id the lowest bit of the mask stands for |
15 | Spells | ulong | 8 | A mask of the spells the book holds, one bit for each, the lowest byte first |
The contents of a spellbook for the newer clients, which read them from this packet instead of from the fake items the magery book is drawn from. Only the necromancer's book is sent this way; the magery book keeps 0x3C.
SpellbookService: sends the spells a necromancer's book holds when its owner opens it and when a spell is added to it.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes, 5. |
3 | Subcommand | ushort | 2 | Value 0x21 |
Tells the client that no weapon special move is selected, so that it puts its icon back.
—
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Subcommand | ushort | 2 | Value 0x06 |
5 | Command | byte | 1 | Value 0x01: the members of the party. |
6 | Count | byte | 1 | Number of members. |
7 | Members | loop | variable | Serial of each member, four bytes, the leader first. |
Party command 0x01 of the extended command 0x06: the members of the party, as the client shows them in its party window. Sent to every member when someone joins.
PartyService: sends the list to every member when a player accepts an invitation.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Subcommand | ushort | 2 | Value 0x06 |
5 | Command | byte | 1 | Value 0x02: a member left. |
6 | Remaining | byte | 1 | Number of members that remain; 0 clears the party window of the receiver. |
7 | Removed | uint | 4 | Serial of the member who left. |
11 | Members | loop | variable | Serial of each member that remains, four bytes. |
Party command 0x02 of the extended command 0x06: a member is no longer in the party. The player who left, and the survivor of a party that ends, get it with nobody remaining.
PartyService: sends it when a member leaves, is removed, logs out or the party is disbanded.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Subcommand | ushort | 2 | Value 0x06 |
5 | Command | byte | 1 | 0x03 for a private message, 0x04 for one to the whole party. |
6 | Sender | uint | 4 | Serial of the player who spoke. |
10 | Text | byte[] | variable | Big-endian UTF-16 text, ended by two zero bytes. |
Party commands 0x03 and 0x04 of the extended command 0x06: a chat message of the party. The text is trimmed and cut at ultima.party.chat_max_length.
PartyService: SendPublic sends it to every member and SendPrivate to one member.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Subcommand | ushort | 2 | Value 0x06 |
5 | Command | byte | 1 | Value 0x07: an invitation. |
6 | Leader | uint | 4 | Serial of the leader who invites. |
Party command 0x07 of the extended command 0x06 (10 bytes): an invitation to join the party of a leader. The client answers with its accept or decline buttons, which send 0xBF 0x06 0x08 and 0x09 with the same serial.
PartyService: sends it to the invited player.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Kind | enum | 1 | 0 moving, 1 lightning, 2 fixed at a point, 3 fixed on an object. |
2 | Source serial | uint | 4 | The object the effect starts from or stays on; 0 for a point. |
6 | Target serial | uint | 4 | The object a moving effect flies to; 0 otherwise. |
10 | Graphic | ushort | 2 | Art id of the animation; 0 for lightning or particles only. |
12 | From X | ushort | 2 | Where the effect starts. |
14 | From Y | ushort | 2 | Where the effect starts. |
16 | From Z | sbyte | 1 | Where the effect starts. |
17 | To X | ushort | 2 | Where a moving effect ends; the same point otherwise. |
19 | To Y | ushort | 2 | Where a moving effect ends; the same point otherwise. |
21 | To Z | sbyte | 1 | Where a moving effect ends; the same point otherwise. |
22 | Speed | byte | 1 | How fast the animation plays or moves. |
23 | Duration | byte | 1 | How long the animation lasts. |
24 | Unused | ushort | 2 | Always 0. |
26 | Fixed direction | bool | 1 | 1 keeps the graphic's direction; always 1 for an effect that stays. |
27 | Explodes | bool | 1 | 1 makes a moving effect explode when it arrives. |
28 | Hue | uint | 4 | Hue of the graphic; 0 for none. |
32 | Render mode | enum | 4 | 0 normal, 1 darken, 2 lighten, 3 lighten transparent, 4 translucent, 5 translucent colour, 6 negative, 7 negative transparent. |
Plays a graphic effect: a moving one, a lightning bolt, or an animation that stays at a point or on an object. Sent for every effect that has a graphic and for every lightning bolt, which has none; a moving effect with graphic 1, the placeholder of ModernUO scripts, counts as having no graphic. The plain 0x70 is never sent.
EffectService: the effect module of scripts, to the players of the map within the view range of the effect; a moving effect also reaches those in range of its destination.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serial | uint | 4 | The object the text is shown over. |
7 | Graphic | ushort | 2 | Its graphic or body. |
9 | Type | byte | 1 | 6, a label. |
10 | Hue | ushort | 2 | 0x3B2. |
12 | Font | ushort | 2 | 3. |
14 | Cliloc | uint | 4 | The text's cliloc number. |
18 | Name | ascii | 30 | Speaker name. |
48 | Arguments | byte[] | variable | UTF-16LE, tab-separated, null-terminated. |
A cliloc shown by the client in its language.
LookRequestPacketHandler: the name over an object. UseRequestPacketHandler: the too-far message. ItemModule: a cliloc shown by a script. SpeechService: a cliloc as a system message (mobile.message_cliloc, the food script).
Text prompt response
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Length of the whole packet. |
3 | Serial | uint | 4 | The serial the prompt was sent with. |
7 | Prompt id | int | 4 | Id of the prompt answered |
11 | Type | int | 4 | 0 escaped, 1 answered |
15 | Language | ascii | 4 | Language code of the client, such as ENU |
19 | Text | byte[] | variable | The text typed, little-endian UTF-16 |
The player's answer to a text prompt.
TextPromptResponsePacketHandler: completes the player's pending prompt; over 128 characters or another id is ignored.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Always 21. |
3 | Serial | uint | 4 | The character asked. |
7 | Prompt id | int | 4 | Id the response must carry |
11 | Unused | byte[] | 10 | Zero. |
Asks the player for a line of text, typed in the journal line.
PromptService: sent when a prompt begins.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Kind | enum | 1 | 0 moving, 1 lightning, 2 fixed at a point, 3 fixed on an object. |
2 | Source serial | uint | 4 | The object the effect starts from or stays on; 0 for a point. |
6 | Target serial | uint | 4 | The object a moving effect flies to; 0 otherwise. |
10 | Graphic | ushort | 2 | Art id of the animation; 0 for lightning or particles only. |
12 | From X | ushort | 2 | Where the effect starts. |
14 | From Y | ushort | 2 | Where the effect starts. |
16 | From Z | sbyte | 1 | Where the effect starts. |
17 | To X | ushort | 2 | Where a moving effect ends; the same point otherwise. |
19 | To Y | ushort | 2 | Where a moving effect ends; the same point otherwise. |
21 | To Z | sbyte | 1 | Where a moving effect ends; the same point otherwise. |
22 | Speed | byte | 1 | How fast the animation plays or moves. |
23 | Duration | byte | 1 | How long the animation lasts. |
24 | Unused | ushort | 2 | Always 0. |
26 | Fixed direction | bool | 1 | 1 keeps the graphic's direction; always 1 for an effect that stays. |
27 | Explodes | bool | 1 | 1 makes a moving effect explode when it arrives. |
28 | Hue | uint | 4 | Hue of the graphic; 0 for none. |
32 | Render mode | enum | 4 | 0 normal, 1 darken, 2 lighten, 3 lighten transparent, 4 translucent, 5 translucent colour, 6 negative, 7 negative transparent. |
36 | Particle | ushort | 2 | Particle effect id. |
38 | Explode particle | ushort | 2 | Particle effect played when a moving effect arrives; 1 for an effect that stays. |
40 | Explode sound | ushort | 2 | Sound played when a moving effect arrives. |
42 | Particle serial | uint | 4 | The object the particles belong to; 0 for a moving effect or a point. |
46 | Layer | enum | 1 | Body part the particles are shown at: 0 head, 1 right hand, 2 left hand, 3 waist, 4 left foot, 5 right foot, 7 centre of the feet, 255 none. |
47 | Unused | ushort | 2 | Always 0. |
The hued effect (0xC0) followed by the particle fields. Sent only to the Enhanced Client, for an effect that has a particle id; every other client gets 0xC0, or nothing when the effect has no graphic.
EffectService: the effect module of scripts, to the Enhanced Clients in range.
Update range
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Range | byte | 1 | Requested update range. |
Answered with the server's view range, whatever the client asked.
UpdateRangePacketHandler: answers with the server's view range.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Range | byte | 1 | View range in cells, from 5 to 24 |
Tells the client the server's view range.
UpdateRangePacketHandler: sent in answer to the client's 0xC8.
Localized message with affix
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serial | uint | 4 | Serial of the mobile that speaks. |
7 | Graphic | ushort | 2 | Its body. |
9 | Type | byte | 1 | Message type; 0, regular speech. |
10 | Hue | ushort | 2 | Colour of the text; 0x03B2. |
12 | Font | ushort | 2 | Font; 3. |
14 | Cliloc | uint | 4 | Number of the client text. |
18 | Affix type | byte | 1 | 0: the affix is appended to the text. |
19 | Name | ascii | 30 | Name of the speaker, zero filled. |
49 | Affix and arguments | loop | variable | The affix in ASCII ended by a zero; then the arguments of the cliloc in big-endian UTF-16, tab separated, ended by a zero of two bytes. |
A client text with a text of the server written after it: "Into your bank box I have placed a check in the amount of:" and the amount. The client shows the cliloc in its own language.
SpeechService.SayCliloc with an affix: npc.say_cliloc(npc, cliloc, args, affix), used by banker.lua.
Book header change
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serial | uint | 4 | Serial of the book. |
7 | Skipped | uint | 4 | Flags and page count, not read. |
11 | Title and author | loop | variable | The title, then the author: for each the length of its bytes (ushort), then the text in UTF-8, read up to its first zero. |
The title and author a player wrote. Saved when the sender carries the book and the book is writable, a title of 60 bytes and an author of 30 at most; the item takes the title as its name.
BookEditPacketHandler: BookDocumentService.SetHeader.
Book header
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serial | uint | 4 | Serial of the book. |
7 | Flag | byte | 1 | 1. |
8 | Writable | byte | 1 | 1 when the player who opens the book carries it and the book is one a player writes in; else 0. |
9 | Pages | ushort | 2 | How many pages the book has. |
11 | Title and author | loop | variable | The title, then the author: for each the length of its bytes with the zero that ends it (ushort), then the text in UTF-8 and its zero. The title is cut to 60 bytes and the author to 30. |
Opens the client's book on its cover. The pages follow in 0x66.
BookDocumentService.Open: sent for a document whose item template has script_id readable_book.
Query properties
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serials | byte[] | variable | Objects whose tooltips are asked, 4 bytes each, at most 500. |
Answered with one 0xD6 per object the character sees.
QueryPropertiesPacketHandler: one 0xD6 per visible object
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Unknown | ushort | 2 | Always 1. |
5 | Serial | uint | 4 | The object. |
9 | Unknown | ushort | 2 | Always 0. |
11 | Hash | uint | 4 | Revision: 26-bit hash of the lines. |
15 | Lines | byte[] | variable | Each line: cliloc (uint), arguments length in bytes (ushort), arguments in UTF-16LE; ended by a zero cliloc. |
An AOS tooltip.
QueryPropertiesPacketHandler and ExtendedCommandPacketHandler.
Encoded command
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serial | uint | 4 | The player's own character. |
7 | Subcommand | ushort | 2 | 0x19 selects a weapon special move; 0x32 is the Quest button of the paperdoll (no data). |
9 | Type | byte | 1 | Zero. |
10 | Ability | int | 4 | Subcommand 0x19: the number of the special move, 1 to 13; 0 clears the selection. |
The client's encoded command. Subcommand 0x19 (the weapon special moves) is read, and 0x32, the Quest button of the paperdoll, opens the quest log; any other subcommand and a selection cut short are kept and ignored, never disconnecting the client.
AbilityRequestPacketHandler: selects or clears a weapon special move, and hands the Quest button (0x32) to the quest engine
Client hardware information
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Client type | byte | 1 | Client family |
2 | Instance ID | uint | 4 | Client instance |
6 | OS version | byte[] | 12 | Major minor and revision values |
18 | Hardware details | byte[] | 250 | CPU memory display and video data. |
Recognized and ignored for now, in every server mode; hardware data is not stored. The Enhanced Client sends it at login.
Game: IgnoredPacketHandler<T>; Login: LoginRoleIgnoredPacketHandler<T>. Both recognise and ignore it for now (Debug log)
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Serial | uint | 4 | The object. |
5 | Revision | uint | 4 | The tooltip hash with bit 30 set. |
Tells the client the current tooltip revision.
WorldViewService and the item handlers.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Serial | uint | 4 | Gump serial, unique per gump sent. |
7 | Type id | uint | 4 | Gump type id: FNV-1a of the gump id. |
11 | X | uint | 4 | Left edge on the screen. |
15 | Y | uint | 4 | Top edge on the screen. |
19 | Layout compressed length | uint | 4 | Compressed layout bytes plus 4. |
23 | Layout length | uint | 4 | Plain layout bytes, NUL included. |
27 | Layout and strings | byte[] | variable | The zlib layout; then a uint string count, a uint compressed table length plus 4 (0 with no strings), a uint plain table length and the zlib table (each string as ushort length and UTF-16 big-endian text). |
Opens a gump on clients from 5.0.0a, compressed. Readable scrolls created with the staff book command use this gump protocol when opened.
GumpService: opens a gump on a client from 5.0.0a.
Client type
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Client type payload | byte[] | variable | Client identifier data. |
Recognized and ignored for now.
IgnoredPacketHandler<T>: recognised and ignored for now (Debug log)
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Seed | uint | 4 | Connection seed |
5 | Major | uint | 4 | Major version |
9 | Minor | uint | 4 | Minor version |
13 | Revision | uint | 4 | Revision |
17 | Patch | uint | 4 | Patch version. |
Records the client version when sent on login listeners.
LoginSeedPacketHandler; on login listeners it also records the client version, which the handoff ticket carries to the game session
Protocol extension request
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Command | byte | 1 | 0 asks where the party members are, 1 where the guild members are. |
4 | Command data | byte[] | variable | Only in command 1: one byte, 1 to ask for the places of the members too. |
The Krrios protocol extension. ClassicUO sends it every few seconds while the world map is open. Command 0 asks where the members of the party are and is answered with 0xF0 command 1 (PartyLocationsPacket); command 1, the guild, is recognized and ignored for now: there are no guilds on the map.
ProtocolExtensionPacketHandler: command 0 answers PartyService.LocationsFor; other commands are ignored (Debug log)
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Length | ushort | 2 | Total packet length in bytes. |
3 | Command | byte | 1 | Value 0x01: the places of the party members. |
4 | Members | loop | variable | Each member out of view: serial (four bytes), x and y (two bytes each, signed) and the map (one byte). |
Answer to the party query of the protocol extension 0xF0. It lists the members of the party who are out of the player's view, in the order they joined, and ends with a zero serial. Nothing is sent when every member is in view.
ProtocolExtensionPacketHandler: sends it to the player who asked
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Command | ushort | 2 | Always 0x0001. |
3 | Type | byte | 1 | 0 item, 1 mobile, 2 multi |
4 | Serial | uint | 4 | Item identifier |
8 | Graphic | ushort | 2 | Item graphic |
10 | Direction | byte | 1 | Always 0 for items |
11 | Amount | ushort | 2 | Stack amount |
13 | Amount | ushort | 2 | Stack amount again |
15 | X | ushort | 2 | World X |
17 | Y | ushort | 2 | World Y |
19 | Z | sbyte | 1 | World Z |
20 | Light | byte | 1 | Light shape (LightType) of a light source, 0 for none. |
21 | Hue | ushort | 2 | Item hue |
23 | Flags | byte | 1 | Item flags, 0 |
24 | Unknown | ushort | 2 | High Seas clients (7.0.9.0) only, 0 |
Shows an item on the ground to clients from 7.0.0.0; 26 bytes from 7.0.9.0.
WorldViewService: sent to the players in range when an item is dropped, and when they come into range of it.
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | Serial | uint | 4 | Serial of the map item |
5 | Gump | ushort | 2 | 0x139D, the map gump |
7 | X1 | ushort | 2 | West edge of the area, in tiles |
9 | Y1 | ushort | 2 | North edge |
11 | X2 | ushort | 2 | East edge |
13 | Y2 | ushort | 2 | South edge |
15 | Width | ushort | 2 | Width of the drawing in pixels |
17 | Height | ushort | 2 | Height of the drawing in pixels |
19 | Facet | ushort | 2 | Client map id: 0 Felucca to 5 Ter Mur |
The area a map item shows, with its facet, for clients 7.0.13 and newer.
MapDisplayService: sent when a map opens.
Create character
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
10 | Name | ascii | 30 | Character name |
42 | Client flags | bitfield | 4 | Client flags |
54 | Profession | byte | 1 | Profession choice |
70 | Gender and race | bitfield | 1 | Combined choice |
71 | Strength | byte | 1 | Chosen strength |
72 | Dexterity | byte | 1 | Chosen dexterity |
73 | Intelligence | byte | 1 | Chosen intelligence |
74 | Skills | loop | 8 | Four skill and value pairs |
82 | Skin hue | ushort | 2 | Appearance hue |
84 | Appearance | byte[] | 22 | Hair beard clothing and city choices. |
ClassicUO character creation request. Raw choices are validated before saving.
CreateCharacterPacketHandler: creates and saves the character and starting items, then brings it into the world
Public house content
| Offset | Name | Type | Size | Description |
|---|---|---|---|---|
0 | Opcode | byte | 1 | Packet identifier. |
1 | House data | byte[] | 1 | Public house content flag. |
Recognized and ignored for now.
IgnoredPacketHandler<T>: recognised and ignored for now (Debug log)
Select a packet to see its structure.
byte / sbyteshort / ushortint / uintlong / ulongasciiutf8boolenumbitfieldbyte[]loopMade with ❤️ by Tom
