Idea for hack.

05/15/2008 15:55 kthx#16
gameguard dosnt block wpe? oO
05/15/2008 16:37 -= Re@p3r =-#17
You have to bypass it ;)
05/15/2008 16:41 Nebular#18
Did i missed something?...WPE does only capture game packets, it doesn't decrypt/encrypt them, so how it is possible to change anything?
05/15/2008 17:32 so2easy#19
You find item ID.. put it in a hex calculator.. like the one in the windows... you hex-it, and turn the number (grr i dont know the word) backwards.
Something like.. 2859 before hex = 76A1 after hex = final = A176

You catch buying packet of something.. like potion, you change the potion ID with "A176" start the WPE function.. buy another potion.. and you get your item.
05/15/2008 18:44 Nebular#20
It will not work....at least with plain WPE...PACKETS ARE ENCRYPTED! Moreover, there's a checksum in each packet, so even if encrypted item's ID stays constant across packets (which will NOT be equal item's ID from data.pak for sure), and you're going to alter packet data you also have to correct checksum, otherwise server will reject it

General packet structure looks like this:

._________Header (16bytes always)_____________ .__Data(optional)(packetsize-16b)_
/.............................................\/.................................\
12 34 56 78 12 00 48 00 AB CD EF 00 00 00 0D 05 XX XX XX XX XX XX XX XX...
|...........|.....|.....|...........|
|...........|.....|.....|...........\-Command ID (4b)
|...........|.....|......\-timestamp (4b)
|...........|......\- packet size 2b (including header)
|............\- packet number(2b)
\-Checksum (4b)

I don't see anything like that in WPE logs, because of encryption
05/20/2008 07:16 riotmaker#21
I guess it's kind of impossible to edit the item like u want...

first step is to decrypter the packets... what i couldn't do till now...

=/

any1 did it?
05/20/2008 09:22 Nebular#22
Yes, i was able reverse packets encryption algorithm. It's actually quite simple: bytewise XOR against 1024byte table of values and a special value send by server at the beginning of each session (some kind of key) + header bytes is swapped
05/20/2008 16:30 riotmaker#23
simple hum? lol ^^ so is that easy to get the packet from wpe decrypt and change to what u want and encrypt it back?