I was able to reproduce what you found out about the packets, i'm exited :-)

For the --world cmdArg, i saw that it makes the client send the C2L_UNIVERSE_SELECTED immediately with the id you append to the cmdArg instead of the C2L_QUERY_UNIVERSE first.

 

can you share, what you send in S2C_WORLD_LOGIN? or better, a little insight on how you trace a packet through IDA and olly (would help immensely)?

I'm having a very hard time finding things through IDA (sometimes i think i found something, but i don't really know how to put everything in relation).