Quote:
Originally Posted by lolkop
well its encrypted but the sro-db team is able to decrypt it (wouldn't make much sense to recyve useless data). dunno if they are saving the login informations or if the systems just checks if they are valid.
if the data gets saved, all the users may get scammed soon.
|
Hmm i know exactly how their bot works, and what it sends to the server, actually it sends only the connected charname, during the first loading before entering the world. They cannot do anything with the charname.
It's already the second time i say it but a md5 hash cannot be cracked or decrypted, it can be de-hashed with a database such as the one Maciupka posted, but the string corresponding to the hash must be in the database, otherwise, it won't return anything. Furthermore, i really doubt that silkroad players charnames are in this database, then having a charname with up and lower case such as JuMaLaUtA and the database cannot find anything.
md5 hashed are used by most of forum databases out there such as vbulletin and phpbb and password have always been secured.
And as u said lolkop, "wouldn't make much sense to recyve useless data", md5 hashes aren't made to be decrypted (cuz it's impossible) but to be compared.
I'll explain you how the check function of the bot works, when you buy it, you have to send your charname to the admin, he takes it and generate a md5 hash of the charname you gave him then he adds it to the auth server database. (He knows which username corresponds to the md5 hash because he generated it..)
Then when you use the bot, once you are logged in, you select you char and the bot generate a md5 hash corresponding to the charname you've selected and send it to the server. The server gets this md5 hash and compare it to all the md5 hashes he has in his database, if he find a correspondence, it means that the char is authorized, otherwise it closes teh bot and u're screwed. But the admin cannot read what charname has been sent by the bot because it's hashed by md5.
Understood?