Not only that, but the LookAtCreature packet requires the creature's ID to even work. Even if the server didn't check if the player can see that position, what are they going to do, spam the server with every possible value that could fit in an unsigned 32-bit integer? Even worse, the Look packet requires a coordinate and stack-position. Couldn't imagine not getting banned trying to spam the server like that.
Alternately, the client includes asset files that contain the names of all monsters and bosses. Something like
GitHub - marcosvf132/Canary-monster-editor: - Tool created to view and manipulate Tibia client 12x /assets/ data related to monsters and bosses. Writen in C# WPF framework. Author: @Marcosvf132 (https://github.com/marcosvf132/Canary-monster-editor) can extract them for you. The protobuffer description of the staticdata file is here:
Canary-monster-editor/Canary monster editor/staticdata.proto at main · marcosvf132/Canary-monster-editor (https://github.com/marcosvf132/Canary-monster-editor/blob/main/Canary%20monster%20editor/staticdata.proto)
thanks for answering, so i have additional question, so how did item names was possible? How it differs from the lookatmonster?
And so it means that now all possible ingame monsters (with bosses) names are coded on frontside of client, meaning there is no possible way of some of monsters still being hidden on serverside?
Given, I've ran the above marcosvf132 solution, but it lacks monsters such as
Thief
Thief (Creature) (https://tibia.fandom.com/wiki/Thief_(Creature))
Also, this is true for monsters, but I don't see NPC names there. where they are coming from then?
Thank you for your answers and time on this I really appreciate your knowledge regarding the topic.
why would you do that if you have tibia wiki with all the names and sprites?
*all known names and sprites for tibia wiki... This is not everything that is inside game. This was the case of boss named
Samael
, that was digged out of partyfinder. My idea is that there are more creatures and bosses that apperance may look the same as other monster, yet their name is unknown, as they weren't seen yet inside game, yet exist on serverside. This is more important for NPCs case also, where there could be hidden npcs existing ingame.
My idea is to elevate a mechanic of game where if you are example standing in Ancient temple in thais and you look at rotworm -2 levels below you get
You see a rotworm.
message. You can obtain same when you look at NPC that results his name.
spam the server with every possible value that could fit in an unsigned 32-bit integer
I mean... Sure? Aren't creatureids just generated in simple terms like:
JavaScript:
{name: 'necromancer', id: 9}
{name: 'orc berserker', id: 8}
{name: 'orc warrior', id: 7}
{name: 'orc shaman', id: 6}
{name: 'orc', id: 5}
{name: 'orc rider', id: 4}
{name: 'war wolf', id: 3}
{name: 'orc warlord', id: 2}
(see attached)
this is from the staticdata, the creatureIds are here already as starting point, and as you can see there many ids not present there, that could be starting point. Given, there are ids from
id:2 orc warlord
all up to sugar mommy
id:2580 sugar mommy
, but in total there are
1162
monsters (including bosses) meaning there are
1418+-2
not used ids between them that are potentially not used ids, or hidden monsters
I've combined that with 7.7 files to atleast some of missing ids that arent in staticfiles, yet are ingame.
This resulted in revealing 14 names of previously unknown names from staticfiles:
human, gamemaster, mimic, flamethrower, plaguethrower, shredderthrower, magicthrower, deathslicer, demon, Bazir, The Halloween Hare, Infernatil, Apocalypse, butterfly
As I assume, the
creatureId: 1
is human, which is creatureId for NPC, and players as well. Meaning it will derive from that class, so I assume the packet for looking at Player, or at NPC is different than lookatcreature?
Also eventually in this thread, people did spammed server thru lookat item to obtain all item names and their ids.
Following the above, with
Thief
example, if we look at update 8.1
Updates/8.10 (https://tibia.fandom.com/wiki/Updates/8.10) (look at monsters&bosses) when it was added to game, we find monsters that are located here in the txt i attached:
JSON:
{
"name": "poacher",
"id": 376
},
{
"name": "goblin leader",
"id": 377
},
{
"name": "_____UNKNOWN_____",
"id": 378
},
{
"name": "dwarf henchman",
"id": 379
},
{
"name": "Mad Technomancer",
"id": 380
},
{
"name": "_____UNKNOWN_____",
"id": 381
},
{
"name": "_____UNKNOWN_____",
"id": 382
},
{
"name": "dryad",
"id": 383
},
{
"name": "squirrel",
"id": 384
},
{
"name": "dragon hatchling",
"id": 385
},
{
"name": "dragon lord hatchling",
"id": 386
},
{
"name": "cat",
"id": 387
},
{
"name": "undead jester",
"id": 388
},
{
"name": "cyclops smith",
"id": 389
},
{
"name": "_____UNKNOWN_____",
"id": 390
},
{
"name": "cyclops drone",
"id": 391
},
{
"name": "troll champion",
"id": 392
},
{
and so on, so any of those not used ids i marked as
unknown
can be
thief
or example
Mad Sheep (https://tibia.fandom.com/wiki/Mad_Sheep) that is also not visible in staticdata, yet exist ingame, and few others monsters from that update that doesnt exist in staticdata, yet were added in 8.1, and yet looking at staticdata missing ids, they fit in that exact place when sorted by ids. Meaning roughly I could guess that
Thief
creatureId is one of those ids visible there.