Packet Encryption Guide

03/31/2012 00:21 funhacker#31
I had another look, and it seems I don't have the finished version of app I wrote that calculated the keys used in the TQ packets, but I do have a starter version of it that needs a little tweaking.
It may help you though, it comes close, it just needs some minor math adjustments.
The keydetector.rar is the source (VS2010 c#.net)
The rest are just what I could find laying around on my hard drive.

I will say this though, I know for certain they use more than just 4 different xor keys. They tend to use 32byte keys kind of contain 4byte keys that have alternating bytes on the 2nd and 4th byte which are always very close in value, however the 1st and 3rd always remain the same.

They use a new key for every 256bytes, but the keys are easily spotted especially if you stick with the aforementioned rules.

The other rar is just an excel (office 2007) with a couple keys, I can't even say these are right as these would of been the very first ones I did.

Date: 23/10/2011 (so they are about 5months old now)
03/31/2012 00:37 InfamousNoone#32
Quote:
Originally Posted by funhacker View Post
I had another look, and it seems I don't have the finished version of app I wrote that calculated the keys used in the TQ packets, but I do have a starter version of it that needs a little tweaking.
It may help you though, it comes close, it just needs some minor math adjustments.
The keydetector.rar is the source (VS2010 c#.net)
The rest are just what I could find laying around on my hard drive.

I will say this though, I know for certain they use more than just 4 different xor keys. They tend to use 32byte keys kind of contain 4byte keys that have alternating bytes on the 2nd and 4th byte which are always very close in value, however the 1st and 3rd always remain the same.

They use a new key for every 256bytes, but the keys are easily spotted especially if you stick with the aforementioned rules.

The other rar is just an excel (office 2007) with a couple keys, I can't even say these are right as these would of been the very first ones I did.

Date: 23/10/2011 (so they are about 5months old now)
I meant they use four 256-byte xor keys that they cycle through. Alas, it seems you don't account for the SetKey() exchange that happens after the 41C gets sent Client->Server so I'll begin reversing that now. Here's a proper implementation of the current encryption w/ out the set-keys method:

The keys are repetitive, so I took only first segment of each and just modulate.