Reverse engineering

Quote:

Originally Posted by joshdoe yo is need for speed world open again yet? :D omg if it does im gonna advertise like no mans business!

Quote:

Originally Posted by michaelmikhalev I am not super good but I can do it too if ya want.

Quote:

Originally Posted by leorblx Focusing on packet validation right now. I'm going to try and figure out the actual data of packets a bit later. Okay, I need a little help here. Does anyone (@berkay2578, @[Only registered and activated users can see links. Click Here To Register...] ???) know for sure what type of encryption the game uses for packets? Is it AES-256 or something else?

Quote:

Originally Posted by leorblx  Spoiler sub_767B80 = where it begins sub_5AAA40 = first new function that's called from sub_767B80, if a condition is true (won't go into detail) sub_767960 = I'm not quite sure sub_7676B0 = Also not sure about this one sub_5B20E0 = simple helper function, returns the input value plus 12, as a DWORD pointer sub_59AEB0 = I don't even want to talk about it. It's just insane. sub_767650 = Seems to return the 2nd parameter? Not sure off the top of my head if it does anything with it sub_5AC320 = Yet another helper, returns input + 4 as a DWORD pointer sub_59B120 = Not sure. sub_59AA30 = References OpenSSL a few times. Not quite sure what it does yet, though sub_59AB90 = Haven't investigated yet.

767D0F                 mov     eax, [ebp+var_48]
767D12                 mov     edx, [ebp+arg_8]
767D15                 push    eax             ; int
767D16                 lea     ecx, [ebp+Src]
767D19                 push    ecx             ; Src
767D1A                 sub     edx, esi
767D1C                 push    edx             ; int
767D1D                 push    esi             ; int
767D1E                 push    ebx             ; int
767D1F                 push    esi             ; Dst
767D20                 lea     ecx, [edi+8]
767D23                 call    767B80

//function start -->

.text:00767B80 ; int __stdcall sub_767B80(void *Dst, int, int, int, void *Src, int)
.text:00767B80 ; don't be fooled into thinking that these 'int' declarations were intended, these are compiled and optimized fields, which is why everything is a dword and why the code directly uses registers like eax. 
.text:00767B80 ; asm loads the stack like so:
// https://en.wikibooks.org/wiki/X86_Disassembly/Functions_and_Stack_Frames
// dword ptr -4 means push [local_variable_1], -8 means push [local_variable_2] etc. these are members defined within the function, that means the parameters do not directly modify them
// dword ptr +8 means push [parameter_1], in this case Dst. +C(12) is push [parameter_2] etc. 
// i don't think i have to say this but dwords are 4 bytes and qwords are 8 bytes; and since this is compiled code, you will eventually see a "cdq" function, preceded by two "mov"s.
// this site will help you greatly if you don't know what's happening: https://en.wikibooks.org/wiki/X86_Disassembly
.text:00767B80 var_8           = dword ptr -8
.text:00767B80 var_4           = dword ptr -4
.text:00767B80 Dst             = dword ptr  8
.text:00767B80 arg_4           = dword ptr  0Ch
.text:00767B80 arg_8           = dword ptr  10h
.text:00767B80 arg_C           = dword ptr  14h
.text:00767B80 Src             = dword ptr  18h
.text:00767B80 arg_14          = dword ptr  1Ch

Quote:

Originally Posted by fabx24 nothing is impossible, they saw nfsw offline was impossible but is out and it's more better like first, if the offline was not impossible, the online is possible too, keep up the great work man, if you are there now, this mean's is not impossible.

Quote:

Originally Posted by leorblx I'm thinking about streaming "tinkering sessions" where I just mess around with stuff to see if I can make something happen. Would anyone be interested?

Quote:

Originally Posted by leorblx Why can only one player can see the other player?

Quote:

Originally Posted by leorblx Why does the current freeroam implementation only work with two players?

Quote:

Originally Posted by leorblx I think I can probably sort out the lag issue. I think the current server just sends packets too quickly for the client to handle.

Quote:

Originally Posted by berkay2578 please don't. Not that nobody would watch it, but you will pretty much get an instant c&d from EA. Sync issue in the udp relay. Openfire needs a custom written plugin to generate p2p pings, udp relay needs to read the p2p pings and send the packets accordingly. Because Nilzao had just enough time and support only for the 2 player lobbies. NFS:W changes a lot of stuff in the packets when it's 2+ players. We have a recorded team-escape relay with 4 players, contact Nilzao if you want to help with that. Need proper ping calculations and latency management, you basically need to revamp everything if you wanna do that. A funny issue, however, is that when I was on a 3mbps network @[Only registered and activated users can see links. Click Here To Register...] could connect to me with literally no latency. It's the reason I just gave up on the UDP cracking, that function inside the game is just cancer. Here are the recorded sessions:

Quote:

Originally Posted by leorblx Thank you guys for all the support :D

Quote:

Originally Posted by leorblx - Why can only one player can see the other player?

Quote:

Originally Posted by leorblx - Why does the current freeroam implementation only work with two players?

Quote:

Originally Posted by leorblx I think I can probably sort out the lag issue. I think the current server just sends packets too quickly for the client to handle.

Quote:

Originally Posted by leorblx I'm excited for anything that may happen in the future. If I get this to work, I will be extremely happy. Who knows... maybe it'll happen sooner than I think.

Quote:

Originally Posted by leorblx @[Only registered and activated users can see links. Click Here To Register...] Also, Berkay mentioned that you had a recorded 4-player team escape relay. Would you mind giving me that so I can investigate how the packets differ from 2-player team escape packets? It might help with this.