This map covers every chat opcode processed byDocumentation Index
Fetch the complete documentation index at: https://mintlify.com/ThalissonTMora/shaiya-chat-native-re/llms.txt
Use this file to discover all available pages before exploring further.
Game.exe and ps_game.exe in Shaiya Core V9. For each opcode you will find the client handler virtual address, the vtable slot it dispatches through, the decompiled .c file path in this repository, and the resulting UI effect. The companion PACKET_SPEC.md documents the wire layouts; this file focuses on routing, function addresses, and code evidence. Base address for all VAs: 0x00400000.
| Binary | MD5 |
|---|---|
Game.exe | c1edd96639ad81835624b9c4516ac781 |
ps_game.exe | 91b212afbe6623382713772489dc82ce |
Repository Layout
| Folder / file | Contents |
|---|---|
docs/ | All .md specs (PACKET_SPEC, WIRE_CRYPTO, CHAR21_SITES, …) |
game-chat-native/ | Client .c decompiles + game-chat-functions.manifest |
psgame-chat-native/ | World server .c decompiles + psgame-chat-functions.manifest |
pslogin-chat-native/ | Login 0xA101 send path (15 .c files) |
tools/ghidra/ | Canonical manifests + decompile scripts |
Key Globals
| Global | VA / value |
|---|---|
| Chat singleton | DAT_022fa2f0 |
Vtable (.rdata) | 0x00747544 |
Regenerate client .c | ./tools/ghidra/decompile-game-chat.sh (binaries in bin/) |
| Client manifest | game-chat-native/game-chat-functions.manifest |
| Server manifest | psgame-chat-native/psgame-chat-functions.manifest |
Flow Overview
| Direction | Main steps |
|---|---|
| Send | InputCapture → SubmitChatInput → PacketSend_* → NetworkSend |
| Recv | GameSocketWndProc → decrypt → PacketDispatcher → handler → vtable → buffer / format → DrawText / SysMsg → ChatWindow_Render |
| World / entity | Notify (0xE05 / 0xE06), speech balloon (4126D0), nameplate (56C650), position FX |
Received Packets — All Opcodes
Routing source:game-chat-native/recv/PacketDispatcher_005f1e10.c (chat opcodes ~L917; crypto 0xA101 ~L1193).
All handler VAs and vtable offsets are confirmed from
game-chat-functions.manifest and cross-checked against decompiled .c files. Entries marked “stub vfn” have a ret 4 body with no UI output.| Opcode | Channel | Handler VA | Handler file | VTable offset / VA | VTable file | Main effect |
|---|---|---|---|---|---|---|
0x0E05 | Notify A | 005E5000 | handlers/Handler_ChatNotify_E05_005e5000.c | +0x31C / 00595690 | vtable/ChatNotify_vfn_0x31C_00595690.c | Entity FX / position (no chat box) |
0x0E06 | Notify B | 005E5070 | handlers/Handler_ChatNotify_E06_005e5070.c | +0x320 / 005957E0 | vtable/ChatNotify_vfn_0x320_005957e0.c | Entity FX / position (no chat box) |
0x0F02 | Admin monitor | 005E4E30 | handlers/Handler_AdminChatMonitor_005e4e30.c | +0x308 / 00595570 | vtable/AdminChatMonitor_vfn_0x308_00595570.c | Monitor flag or SysMsg |
0x0502 | Entity spawn | 005E0CF0 | handlers/Handler_Packet_0502_005e0cf0.c | +0xF0 / 00593970 | vtable/ChatEntitySpawn_vfn_0xF0_00593970.c | World entity update (no chat box) |
0xA101 | Key material | 005E3D60 | handlers/Handler_Packet_A101_KeyMaterial_005e3d60.c | +0x254 / 005A4D50 | crypto/Connection_OnKeyMaterial_005a4d50.c | Crypto handshake (see WIRE_CRYPTO.md) |
0x1101 | Normal | 005E50E0 | handlers/Handler_ChatNormal_005e50e0.c | +0x324 / 0059C380 | vtable/ChatNormalParty_vfn_0x324_0059c380.c | Chat box + 3D balloon |
0x1102 | Whisper | 005E5180 | handlers/Handler_ChatWhisper_005e5180.c | +0x328 case 0 / 0059BDB0 | vtable/ChatWhisperTradeGuildZoneMega_vfn_0x328_0059bdb0.c | Chat box + whisper highlight |
0x1103 | Trade | 005E5250 | handlers/Handler_ChatTrade_005e5250.c | +0x328 case 1 | same | Chat box (SysMsg) |
0x1104 | Guild | 005E5310 | handlers/Handler_ChatGuild_005e5310.c | +0x328 case 2 | same | Chat box (SysMsg) |
0x1105 | Party | 005E53D0 | handlers/Handler_ChatParty_005e53d0.c | +0x324 / 0059C380 | vtable/ChatNormalParty_vfn_0x324_0059c380.c | Chat box + 3D balloon |
0x1106 | Error | 005E5470 | handlers/Handler_ChatError_005e5470.c | +0x340 / 0059ABA0 | vtable/ChatError_vfn_0x340_0059aba0.c | Chat box (fixed SysMsg) |
0x1107 | Shout | 005E54A0 | handlers/Handler_ChatShout_005e54a0.c | +0x32C / 0059AA10 | vtable/ChatShout_vfn_0x32C_0059aa10.c | Chat box + 3D balloon |
0x1108 | Megaphone | 005E5540 | handlers/Handler_ChatMegaphone_005e5540.c | +0x328 case 3 | vtable/ChatWhisperTradeGuildZoneMega_vfn_0x328_0059bdb0.c | Chat box (SysMsg) |
0x1109 | Zone | 005E5600 | handlers/Handler_ChatZone_005e5600.c | +0x328 case 4 / 5 | same | Chat box (DrawText) |
0x110A | Union | 005E56F0 | handlers/Handler_ChatUnion_005e56f0.c | +0x34C / 0059A940 | vtable/ChatUnion_vfn_0x34C_0059a940.c | Chat box (DrawText + GetMsg name) |
0x110B | Channel link | 005E5740 | handlers/Handler_Chat_110B_005e5740.c | +0x350 / 0059A9D0 | vtable/ChatChannel_vfn_0x350_0059a9d0.c | Text → entity nameplate (56C650) |
0x1111 | Area (alt) | 005E57D0 | handlers/Handler_Chat_Area_1111_005e57d0.c | +0x330 / 0059A900 | vtable/ChatArea_vfn_0x330_0059a900.c | Chat box (SysMsg 0x31) |
0x1112 | Long text | 005E88D0 | handlers/Handler_Chat_LongText_1112_005e88d0.c | +0x578 / 0059BD00 | vtable/ChatLongMsg_vfn_0x578_0059bd00.c | Chat box (SysMsg, buf 0x400) |
0xF101 | Party notify | 005E5880 | handlers/Handler_Chat_PartyNotify_F101_005e5880.c | +0x324 / 0059C380 | vtable/ChatNormalParty_vfn_0x324_0059c380.c | Party chat box (param_1=1) |
0xF102 | Admin whisper | 005E5920 | handlers/Handler_Chat_Admin_F102_005e5920.c | +0x328 / 0059BDB0 | vtable/ChatWhisperTradeGuildZoneMega_vfn_0x328_0059bdb0.c | Pattern C · SysMsg 0x162 / highlight |
0xF103 | Admin trade/shout | 005E59F0 | handlers/Handler_Chat_Admin_F103_005e59f0.c | +0x328 case 1 | same | Pattern B · SysMsg 0x163 |
0xF104 | Admin guild | 005E5AB0 | handlers/Handler_Chat_Admin_F104_005e5ab0.c | +0x328 case 2 | same | Pattern B · SysMsg 0x172 |
0xF105 | Admin party | 005E5B70 | handlers/Handler_Chat_Admin_F105_005e5b70.c | +0x324 / 0059C380 | vtable/ChatNormalParty_vfn_0x324_0059c380.c | Pattern A · party SysMsg |
0xF106 | Admin long / sys | 005E5C10 | handlers/Handler_Chat_Admin_F106_005e5c10.c | +0x334 / 0059ABC0 | vtable/ChatAdminLong_vfn_0x334_0059abc0.c | u16le len · text (max 0x7D0) · SysMsg 0x164 · optional EVENTMSG- prefix |
0xF107 | Whisper target set | 005DE950 | handlers/Handler_Chat_Admin_F107_005de950.c | +0x344 / 0056BCB0 | vtable/ChatWhisperTarget_vfn_0x344_0056bcb0.c | S→C Pattern H char[21] · stub vfn · server sets CUser+0x5810 · client no UI |
0xF109 | Whisper target clear | 005DE9B0 | handlers/Handler_Chat_Admin_F109_005de9b0.c | +0x348 / 0056BCB0 | same (alias slot) | S→C Pattern H · dual notify · server clears CUser+0x5810 · client no UI |
0xF10A | Admin long | 005E88D0 | handlers/Handler_Chat_LongText_1112_005e88d0.c | +0x578 | ChatLongMsg_vfn | Same handler as 0x1112 |
Shared Vtable +0x328 Sub-Channel Dispatch
The shared vtable function at +0x328 (0x0059BDB0) — ChatWhisperTradeGuildZoneMega_vfn — handles six different channels via its param_3 argument.
| case | Channel | Called functions |
|---|---|---|
0 | Whisper | AppendSuffix 0x420C10, SysMsg 0x423150, opt. WhisperHighlight 0x47F970 |
1 | Trade | AppendSuffix, SysMsg |
2 | Guild | AppendSuffix, SysMsg |
3 | Megaphone | AppendSuffix, SysMsg |
4 | Zone | lookup + DrawText 0x422B90 |
5 | Zone (alt) | lookup + DrawText 0x422B90 |
Admin Recv Wire Details — 0xF102–0xF109
Evidence: game-chat-native/handlers/Handler_Chat_Admin_F*.c
| Opcode | Mirror | Payload (after opcode) | Handler read sequence |
|---|---|---|---|
0xF102 | 0x1102 | C u8 dir · char[21] · u8 len · text[len] | Scalar×1 · String 0x15 · Scalar×1 · String len |
0xF103 | 0x1103 | B char[21] · u8 len · text[len] | String 0x15 · Scalar×1 · String len |
0xF104 | 0x1104 | B (same as F103) | same |
0xF105 | 0x1105 / 0xF101 | A u32 id · u8 len · text[len] | Scalar×4 · Scalar×1 · String len |
0xF106 | (unique) | u16le len · text[len] (buf 0x7D0) | Scalar×2 · String (len & 0xFFFF) |
0xF107 | server whisper bind | H char[21] | String 0x15 only → stub vfn |
0xF109 | server whisper clear | H char[21] | String 0x15 only → stub vfn |
Admin Whisper Bind — 0xF107 / 0xF108 / 0xF109
CONFIRMED May 2026. Server state field
CUser+0x5810 holds the bound partner’s id (CUser+0x128 of the whisper partner). Full send chain: psgame-chat-native/send/Chat_AdminWhisper_F107_F109_chain.md.| Direction | Opcode | Plaintext size | Evidence |
|---|---|---|---|
| C→S bind | 0xF107 | 0x17 | AdminChat_ProcessIncoming @ 0x0048038E; clears packet+0x16 before World_FindUserByName @ 0x00414D40 |
| C→S clear | 0xF109 | 2 (opcode only) | case @ L317 — Chat_AdminWhisperHelper @ 0x0047F350; no body read |
| S→C bind notify | 0xF107 | 0x17 | mov $0xF107 @ 0x004803C7 — dual SConnection_Send: target gets admin name, admin gets target name |
| S→C clear notify | 0xF109 | 0x17 | mov $0xF109 @ 0x0047F390 — dual send from Chat_AdminWhisperHelper |
| C→S relay | 0xF108 | len + 3 | AdminChat_ProcessIncoming case @ asm 0x00480462; requires CUser+0x5810 != 0 |
| S→C relay (partner) | 0xF102 | len + 0x19 | Pattern C dir=0 · admin name @ CUser+0x184 |
| S→C relay (echo) | 0xF102 | len + 0x19 | Pattern C dir=1 · partner name |
0xF108 — Bound Admin Whisper Relay
| Aspect | Detail |
|---|---|
| Client recv | Not routed — PacketDispatcher @ 0x005F1E10 jumps F107 → F109 (no F108 case) |
| Client send | Absent — zero mov $0xF108 in Game.exe |
| Server handler | AdminChat_ProcessIncoming case @ asm 0x00480462 |
| C→S wire | Pattern I: u16 + u8 len + text[len] (plain len + 3) |
| S→C relay | Dual 0xF102 Pattern C (dir=0 partner / dir=1 admin) — never emits 0xF108 downstream |
| Prerequisite | CUser+0x5810 must be set by a prior C→S 0xF107 |
| Full doc | docs/ADMIN_F108_WHISPER_RELAY.md |
Send Path (Client → Server)
Client Send Functions
| Symbol | VA | File | Notes |
|---|---|---|---|
NetworkSend | 005EA9A0 | send/NetworkSend_005ea9a0.c | Final wire (__cdecl) |
PacketSend_Chat | 005ED060 | send/PacketSend_Chat_005ed060.c | Normal / shout vanilla |
PacketSend_Whisper | 005ED160 | send/PacketSend_Whisper_005ed160.c | Only send function with char[21] |
PacketSend_Guild | 005ED220 | send/PacketSend_Guild_005ed220.c | |
PacketSend_Party | 005ED2B0 | send/PacketSend_Party_005ed2b0.c | |
PacketSend_Zone | 005ED340 | send/PacketSend_Zone_005ed340.c | |
ChatWindow_FormatOutgoing | 005663B0 | send/ChatWindow_FormatOutgoing_005663b0.c | Builds payload |
ChatWindow_SubmitChatInput | 0047A4B0 | ui/ChatWindow_SubmitChatInput_0047a4b0.c | Enter / submit |
Send Opcode → Channel
| Send function | Opcode sent | Channel |
|---|---|---|
PacketSend_Chat(0, 0, …) | 0x1101 | Normal |
PacketSend_Chat(0, 1, …) | 0x1103 | Trade |
PacketSend_Chat(0, 2, …) | 0x1104 | Guild |
PacketSend_Chat(0, 3, …) | 0x1105 | Party |
PacketSend_Chat(0, 4, …) | 0x1107 | Shout |
PacketSend_Whisper | 0x1102 / 0xF102 | Whisper |
PacketSend_Guild | 0x1104 | Guild (direct) |
PacketSend_Party | 0x1103 / 0x1105 | Trade / Party send |
PacketSend_Zone | 0x1111 | Zone / Area |
PacketSend_Chat(1, …) | 0xF101–0xF105 | Admin channels |
Server-Side Handlers (ps_game.exe)
| Symbol | VA | Description |
|---|---|---|
Chat_ProcessIncoming | 0x0047F400 | Main C→S dispatch for 0x1101–0x1112 |
AdminChat_ProcessIncoming | 0x0047FD10 | C→S dispatch for 0xF101–0xF10A |
Chat_BroadcastNormal | (cells mode 7) | Normal chat S→C broadcast |
Chat_BroadcastTrade | 0x004192F0 | Trade S→C queue |
Chat_BroadcastGuild | 0x00432530 | Guild + 0x0812 alliance S→C |
Chat_BroadcastShout | (mode 5) | Shout radius broadcast |
Chat_BroadcastNamed | 0x004D55B0 | Megaphone / name-bearing S→C |
Chat_BroadcastZone | 0x00427090 | Zone / area fanout |
CParty_BroadcastPacket | 0x0044E950 | Party member broadcast |
Chat_AdminWhisperHelper | 0x0047F350 | Clears CUser+0x5810; sends F109 dual notify |
SConnection_Send | 0x004ED0E0 | Final TCP send to one connection |
World_FindUserByName | 0x00414D40 | Name → CUser* lookup |
World_FindUserById | 0x00414D10 | Id → CUser* lookup |
Chat_LogGameLogB | 0x0047F190 | Monitor session logging (optional) |
Chat Object Vtable (DAT_022fa2f0, base 0x00747544)
| Offset | Symbol | VA | File | Used by |
|---|---|---|---|---|
+0xF0 | ChatEntitySpawn_vfn | 00593970 | vtable/ChatEntitySpawn_vfn_0xF0_00593970.c | 0x0502 |
+0x254 | Connection_OnKeyMaterial_vfn | 005A4D50 | crypto/Connection_OnKeyMaterial_005a4d50.c | 0xA101 |
+0x308 | AdminChatMonitor_vfn | 00595570 | vtable/AdminChatMonitor_vfn_0x308_00595570.c | 0x0F02 |
+0x31C | ChatNotify_vfn | 00595690 | vtable/ChatNotify_vfn_0x31C_00595690.c | 0x0E05 |
+0x320 | ChatNotify_vfn | 005957E0 | vtable/ChatNotify_vfn_0x320_005957e0.c | 0x0E06 |
+0x324 | ChatNormalParty_vfn | 0059C380 | vtable/ChatNormalParty_vfn_0x324_0059c380.c | 0x1101, 0x1105, 0xF101 |
+0x328 | ChatWhisperTradeGuildZoneMega_vfn | 0059BDB0 | vtable/ChatWhisperTradeGuildZoneMega_vfn_0x328_0059bdb0.c | 0x1102–0x1104, 0x1108, 0x1109 |
+0x32C | ChatShout_vfn | 0059AA10 | vtable/ChatShout_vfn_0x32C_0059aa10.c | 0x1107 |
+0x330 | ChatArea_vfn | 0059A900 | vtable/ChatArea_vfn_0x330_0059a900.c | 0x1111 |
+0x334 | ChatAdminLong_vfn | 0059ABC0 | vtable/ChatAdminLong_vfn_0x334_0059abc0.c | 0xF106 |
+0x340 | ChatError_vfn | 0059ABA0 | vtable/ChatError_vfn_0x340_0059aba0.c | 0x1106 |
+0x344 | ChatWhisperTarget_vfn | 0056BCB0 | vtable/ChatWhisperTarget_vfn_0x344_0056bcb0.c | 0xF107 (stub) |
+0x348 | ChatWhisperTarget_vfn (alias) | 0056BCB0 | same | 0xF109 (stub) |
+0x34C | ChatUnion_vfn | 0059A940 | vtable/ChatUnion_vfn_0x34C_0059a940.c | 0x110A |
+0x350 | ChatChannel_vfn | 0059A9D0 | vtable/ChatChannel_vfn_0x350_0059a9d0.c | 0x110B |
+0x578 | ChatLongMsg_vfn | 0059BD00 | vtable/ChatLongMsg_vfn_0x578_0059bd00.c | 0x1112, 0xF10A |
+0x680 | ChatObject_PacketUnderflow | 00598DC0 | vtable/ChatObject_PacketUnderflow_vfn680_00598dc0.c | generic recv |
+0x684 | ChatObject_GenericPacketHandler | 00599C30 | vtable/ChatObject_GenericPacketHandler_vfn684_00599c30.c | generic recv |
Cross-Reference
| Document | Contents |
|---|---|
PACKET_SPEC.md | Wire packet layouts, field offsets, pattern tables |
CHAR21_SITES.md | All fixed 21-byte name field read/write sites |
WIRE_CRYPTO.md | AES-CTR cipher, envelope, handshake |
CHAT_RE_GAPS.md | Lacunas P0/P1/P2, balloon gates, admin recv |
psgame-chat-native/ | Server .c decompiles |
tools/ghidra/*.manifest | Full VA list for all decompiled functions |