Latest Updates

Signed-off-by: Moh

- Add reverse_engineered.md section 47 covering the full

CMsgMagicEffect_Process -> CMsgMagicEffect_DispatchVisual ->

CMagicEffectNewArrow_ctor pipeline. Twelve subsections:

packet field layout, the Process call flow with the

CMagicData_FindSpell gate, the caster-only PlaySpellAnimationOnSelf

hot path, the full ClientRepresent (property 10) -> effect file

case dispatch table for sub_95B2DD, the case 97 NewArrow observer

filter root cause + 1-byte fix, why MagicEffect.ini edits did not

fix it, the off_CC8B08 property name table dump (46 entries),

the IsAOEHaloSpell hardcoded allowlist, an SQL cross-check showing

LevelHu2 is universally 0 in the reference DB so matching it is

parity-only and not a fix for observer-blindness, and a complete

binary address table

- Rewrite PACKET_MIGRATION_6609.md section 2.3 (MsgMagicEffect 1105)

with the binary-verified layout. Document the per-target stride

bug, the Eff2 typo, and the SpellEffect = 1 footgun that were

fixed during the RE work. Note the new IReadOnlyList

API. Cross-link to reverse_engineered.md section 47 for the

case 97 client patch

- Rewrite the stale 03_PACKETS/Combat.md MsgMagicEffect section

(was: 12-byte targets, max 55, count at offset 16) with the

actual 6609 layout, the per-target slot table, the new MagicTarget

struct API note, and warnings about the SoulLevel byte and the

case-97 filter

- Add reverse_engineered.md section 29.7 documenting the BatchHideUnhide retargeting: sub_771FB8 has two paths (a2=1 smart filter via CheckEntityHide, a2=0 unconditional SetEntityVisible(entity, 0) loop), the Tab key handler at 0x6EFB60 calls both based on master state, and the previous ReadHidePlayerFlag patch only neutralized the a2=1 path leaving Tab broken from master-ON state

- Add SetEntityVisible caller inventory (only 3 callers, all tab-hide-related) proving invisibility status does NOT route through entity[0x64]

- Add new section 45 with the full CMsgUserAttrib case 25 dispatch walkthrough: jump table at 0x8F667B (not the IDA label 0x8F265C which is the JMP instruction), case 25 idx 0x18 -> handler 0x8F401C, self path at 0x8F4051+ with hardcoded buff bit checks (102, 104, 106, ...), non-self path at loc_8F4888 with sub_7527D6 + vtable[51], convergence point and the asymmetric vtable[51] alpha-fade-only-on-set bug

- Document entity layout: +0x28-0x2B color RGBA bytes, +0xAC 28-byte status flag buffer, +0xD5C buff list head

- Document the invis_unstuck.cpp hook strategy including why writing alpha before vtable[51] runs is safe and why a single hook on sub_7527D6 covers both self and non-self via the convergence

- Add new section 46 with the CItem::GetSellPrice (sub_85A12B) decompile, field offsets (+0x4C Price, +0x64 AmountLimit, +0x258 Amount via sub_8596F0), the sole caller in sub_683EFB at 0x6841E4 (item tooltip via string ID 10103), the server-vs-client formula mismatch, and the single-byte patch

- Update the Index with entries for the three new sections

- Uncomment Creature.HandleKillerBonus to grant the killer 5%-of-MaxHP bonus

exp (color-adjusted via AdjustCharExperienceGain) on top of the

damage exp from the final blow

- Rewire it into Creature.Die after the team-share loop so it runs for

both solo and team killers, and for both melee and magic kills

- Send a "You got X exp points by killing a monster." sysmsg mirroring

the original STR_KILL_EXPERIENCE notice

- Change WorldClient.Mine() interact value from (InteractActionType)28 to InteractActionType.Chop after observing that 28 plays the attack-with-weapon animation in 6609 (the value was renumbered between 5095 and 6609 — 5095 had INTERACT_MINE=28, 6609 maps 28 to a Shoot2 attack variant)

- Chop is the next probe candidate because UpdateJar uses it successfully for jar smashing in 6609, the closest functional analog of mine (player swings tool against an object)

- Document the probe history in the comment so the next iteration knows which values have been ruled out

- Add a Vision.SendToScreen of MsgInteract.Create(UID, UID, X, Y, (InteractActionType)28, 0) inside WorldClient.Mine() alongside the existing MsgAction(Mine) broadcast

- The 6609 client's mining animation is triggered by MsgInteract with action 28 (the old 5095 INTERACT_MINE slot, named Shoot2 in FrostEmu's enum because the surrounding values were renumbered) — without the interact the player got sound + ore but no visible animation

- Also populate the existing MsgAction(Mine) X and Y instead of (0,0) so the client receive handler at loc_86FE89 has packet coords if it gates animation on them

- Cast through (InteractActionType) on the literal 28 because the FrostEmu enum's Shoot2 name no longer reflects the original semantics

- New Radar EvoScript dispatches a single MsgAction with DataAction.Radar

at the player's coordinates, bypassing the 10s Abyss radar cooldown

- Optional args: /radar [icon] [durationMs] [x] [y] for ad-hoc pings at

custom coords with arbitrary icon ids

- Lets the ClientModifications radar_ping.cpp patch be exercised from any

map without waiting on ClientTask.cs throttling

PrimalLauncher 0.9.3 Release Notes

Features:
- 6609 EffectHandler in place
- Remember last selected server on startup

Fixes:
- Effectivised startup logic to have a faster boot
- Moved news read to happen after startup
- UI fixes

- Document the three April 2026 status flag bugs: missing FromStatusId

mappings, equip-while-flowing fallout, and DoubleExpTime slot misalignment

- Record the reverse-engineered CMsgUserAttrib::Process layout: 32-byte

entry stride, slot0..slot6 uint32 fields, the slot0 vs slot1 dispatcher

split, and the inventory of slot1-only update types

- Inventory every MagicType Status > 50 spell that the broken FromStatusId

table was silently dropping into ClientEffectType.None

- Add section 30.8 documenting the CPackageMgr client-side manager class with subsections for methods (GetSingletonPtr, FindPackage, SendDeposit, SendWithdraw, SendListItems), CPackage object layout (this[9]/[10]/[12]), CDlgDepot/CDlgVipDepot field offsets for npcId/whType, the three drop-deposit drag-drop receiver handlers, and the CItem field-72 bit predicates

- Document the __thiscall calling-convention trap on CPackageMgr_SendDeposit (0x7E9D1D) and CPackageMgr_SendWithdraw (0x7E9DAF) — both auto-typed as __stdcall by IDA but the inner FindPackage relies on __EH_prolog3 preserving ECX

- Add the verified 6609 grid owner ID table to section 43.5 (DLG_MPCGOODS=12, DLG_DEPOT=16, DLG_VIPDEPOT=61)

- Extend section 43.6 (CHero::SellItem trap) with a note about the same trap being hit again on CPackageMgr methods, plus a heuristic for spotting it (retn 0Ch + IDA __stdcall + check the call site for mov ecx, ...)

- Update the index with the new 30.8.1 through 30.8.5 entries