How to Reverse Engineering NosTale?

03/17/2019 20:14 Pumba98#31
Quote:
Originally Posted by Koffy1 View Post
SOLVED, TY PUMBA :handsdown:

And now using the cryptography of Cryless~, what I am suposed to introduce as a parameter to this method? I want to put my username and password but it takes a string.
Code:
std::vector<unsigned char> encryptLoginPacket(const std::string& buf) const;
This is my code

Code:
Crypto client;
std::string username = "test";
std::string password = "1234";

client.randomNumber(0, 1000);
client.createLoginVersion();
client.createLoginHash(username);
client.encryptPasswordString(password);
client.encryptLoginPacket("I don't know what to put here") // It takes a string as parameter

int ret = send(ConnectSocket, "const char buf* of login packet?", "int len", "int flags");
[Only registered and activated users can see links. Click Here To Register...]

Look at the project or read in other threads how the login packet etc need to be build etc. You don't need the PW encrypt function
03/18/2019 13:21 Koffy1#32
Quote:
Originally Posted by Pumba98 View Post
[Only registered and activated users can see links. Click Here To Register...]

Look at the project or read in other threads how the login packet etc need to be build etc. You don't need the PW encrypt function
Is this createloginpacket outdated? When I checked the actual login packet it was a little different in terms of creating the complete string packet. I mean this code
(QString complete = beginn + " " + username + " " + passwordhash + diff + version+ " 0" + " " +loginhash;)
03/18/2019 14:03 MarsBounty#33
Quote:
Originally Posted by Koffy1 View Post
Is this createloginpacket outdated? When I checked the actual login packet it was a little different in terms of creating the complete string packet. I mean this code
(QString complete = beginn + " " + username + " " + passwordhash + diff + version+ " 0" + " " +loginhash;)
i just tried the source and it does still work if you change the hashs and version variables

But it uses the old login packet not the new gf packet which you probably compared it to.
03/19/2019 11:54 Pumba98#34
Quote:
Originally Posted by Koffy1 View Post
Is this createloginpacket outdated? When I checked the actual login packet it was a little different in terms of creating the complete string packet. I mean this code
(QString complete = beginn + " " + username + " " + passwordhash + diff + version+ " 0" + " " +loginhash;)
"NoS0575 " +randomNumber + " " + id + " " + sha512(pw) + " " + uuid + " " + loginVersion + nosVersion + " 0 " + md5(md5(NostaleClientX.exe) + md5(NostaleClient.exe) + id);
03/28/2019 17:48 Koffy1#35
How do I do this part? (ID = robert)
"md5(md5(NostaleClientX.exe) + md5(NostaleClient.exe) + id"

The MD5 of NostaleClientX.exe is = 795522c0be350c1152727163d3a8e589
And MD5 of NostaleClient.exe is = a0de15dda5134ccff9b5cd87f3249de8

It should be now md5 of (nostaleclientx.exe + nostaleclient.exe + id)
795522c0be350c1152727163d3a8e589a0de15dda5134ccff9 b5cd87f3249de8robert
and the md5 is = 13bddfcb6a8de597dcb483d87df1a694

but in my actual code there is another md5, what did I do wrong?


Code:
1018DC77     4E 6F 53 30 35 37 35 20 38 31 34 32 38 32 35   NoS0575 8142825
1018DC87  20 72 6F 62 65 72 74 20 33 36 32 37 39 30 39 41   robert 3627909A
1018DC97  32 39 43 33 31 33 38 31 41 30 37 31 45 43 32 37  29C31381A071EC27
1018DCA7  46 37 43 39 43 41 39 37 37 32 36 31 38 32 41 45  F7C9CA97726182AE
1018DCB7  44 32 39 41 37 44 44 44 32 45 35 34 33 35 33 33  D29A7DDD2E543533
1018DCC7  32 32 43 46 42 33 30 41 42 42 39 45 33 41 36 44  22CFB30ABB9E3A6D
1018DCD7  46 32 41 43 32 43 32 30 46 45 32 33 34 33 36 33  F2AC2C20FE234363
1018DCE7  31 31 44 36 37 38 35 36 34 44 30 43 38 44 33 30  11D678564D0C8D30
1018DCF7  35 39 33 30 35 37 35 46 36 30 45 32 44 33 44 30  5930575F60E2D3D0
1018DD07  34 38 31 38 34 44 37 39 20 63 35 39 34 39 34 37  48184D79 c594947
1018DD17  66 2D 64 34 61 39 2D 34 34 36 32 2D 62 35 34 35  f-d4a9-4462-b545
1018DD27  2D 61 64 37 64 64 62 66 64 37 31 61 32 20 30 30  -ad7ddbfd71a2 00
1018DD37  32 46 37 43 35 37 0B 30 2E 39 2E 33 2E 33 31 30  2F7C570.9.3.310
1018DD47  31 20 30 20 43 43 36 35 34 36 44 38 43 38 30 44  1 0 CC6546D8C80D
1018DD57  34 33 43 34 39 45 46 37 35 34 38 46 31 33 39 34  43C49EF7548F1394
1018DD67  44 32 37 46                                      D27F
03/28/2019 18:20 Pumba98#36
Quote:
Originally Posted by Koffy1 View Post
How do I do this part? (ID = robert)
"md5(md5(NostaleClientX.exe) + md5(NostaleClient.exe) + id"

The MD5 of NostaleClientX.exe is = 795522c0be350c1152727163d3a8e589
And MD5 of NostaleClient.exe is = a0de15dda5134ccff9b5cd87f3249de8

It should be now md5 of (nostaleclientx.exe + nostaleclient.exe + id)
795522c0be350c1152727163d3a8e589a0de15dda5134ccff9 b5cd87f3249de8robert
and the md5 is = 13bddfcb6a8de597dcb483d87df1a694

but in my actual code there is another md5, what did I do wrong?


Code:
1018DC77     4E 6F 53 30 35 37 35 20 38 31 34 32 38 32 35   NoS0575 8142825
1018DC87  20 72 6F 62 65 72 74 20 33 36 32 37 39 30 39 41   robert 3627909A
1018DC97  32 39 43 33 31 33 38 31 41 30 37 31 45 43 32 37  29C31381A071EC27
1018DCA7  46 37 43 39 43 41 39 37 37 32 36 31 38 32 41 45  F7C9CA97726182AE
1018DCB7  44 32 39 41 37 44 44 44 32 45 35 34 33 35 33 33  D29A7DDD2E543533
1018DCC7  32 32 43 46 42 33 30 41 42 42 39 45 33 41 36 44  22CFB30ABB9E3A6D
1018DCD7  46 32 41 43 32 43 32 30 46 45 32 33 34 33 36 33  F2AC2C20FE234363
1018DCE7  31 31 44 36 37 38 35 36 34 44 30 43 38 44 33 30  11D678564D0C8D30
1018DCF7  35 39 33 30 35 37 35 46 36 30 45 32 44 33 44 30  5930575F60E2D3D0
1018DD07  34 38 31 38 34 44 37 39 20 63 35 39 34 39 34 37  48184D79 c594947
1018DD17  66 2D 64 34 61 39 2D 34 34 36 32 2D 62 35 34 35  f-d4a9-4462-b545
1018DD27  2D 61 64 37 64 64 62 66 64 37 31 61 32 20 30 30  -ad7ddbfd71a2 00
1018DD37  32 46 37 43 35 37 0B 30 2E 39 2E 33 2E 33 31 30  2F7C570.9.3.310
1018DD47  31 20 30 20 43 43 36 35 34 36 44 38 43 38 30 44  1 0 CC6546D8C80D
1018DD57  34 33 43 34 39 45 46 37 35 34 38 46 31 33 39 34  43C49EF7548F1394
1018DD67  44 32 37 46                                      D27F
All partial hashes should be uppercase
03/28/2019 20:42 Koffy1#37
Once I created the login packet succesfully and connected to the server via socket, how do I login sending my login packet? (at least in the login screen, I don't want to be in the game) I tried this but didn't work. I checked if the account was on in the login screen with a multiclient, but it wasn't.

Code:
send(ConnectSocket, sendPacket.c_str(), packetLength, 0);
03/28/2019 20:47 Pumba98#38
Quote:
Originally Posted by Koffy1 View Post
Once I created the login packet succesfully and connected to the server via socket, how do I login sending my login packet? (at least in the login screen, I don't want to be in the game) I tried this but didn't work. I checked if the account was on in the login screen with a multiclient, but it wasn't.



Code:


send(ConnectSocket, sendPacket.c_str(), packetLength, 0);
Encrypt the packet and send it to the loginserver.
Then check what the server responds
03/28/2019 21:42 Koffy1#39
Quote:
Originally Posted by Pumba98 View Post
Encrypt the packet and send it to the loginserver.
Then check what the server responds
I've already encrypted the packet, but loginserver? Do you mean the ip of nostale and the port? I'm already connected to the loginserver, how do I send the send function?
03/29/2019 00:04 IceTrailer#40
Quote:
Originally Posted by Koffy1 View Post
I've already encrypted the packet, but loginserver? Do you mean the ip of nostale and the port? I'm already connected to the loginserver, how do I send the send function?
Are you sure that you are connected with the login server?
03/29/2019 00:15 Koffy1#41
Quote:
Originally Posted by IceTrailer View Post
Are you sure that you are connected with the login server?
Mmm... I mean I succesfully connected with sockets to the game server using the ip and the port. If that's not the login server, I don't know what is it. Could you explain me?
03/29/2019 08:37 szymek111#42
Login server and game server are two different separate connections. Login server is before selecting the server and channel and game server connection is after selecting the right server.
03/31/2019 12:41 Nortank#43
you have to check the NsTest packet after the login connection, it contains the game ip and the game port which are needed to connect to the game server.

take a look at [Only registered and activated users can see links. Click Here To Register...]
03/31/2019 20:47 Koffy1#44
Is it possible to open NosTale.exe ( The Launcher ) in OllyDbg and start the game without any crash in ollydbg? I tried to do it but it replaces the NosTale.exe into NosTale.exe.DELETE and it terminate the process.
Is the same thing running NostaleClientX.exe and the Nostale.exe launcher?
03/31/2019 21:17 WalrossGreat#45
It is, check the parameters when you run the program in normal way, when you are launching it directly from the debugger you are lacking arguments