PW Packet Sniffer

Page 4 of 5

11/26/2011 17:44 asgborges#46

Quote:

Originally Posted by Sᴡoosh

Yeah, C2S is just encrypted, indeed. For the S2C, have you tried [Only registered and activated users can see links. Click Here To Register...] ?

I have not looked at compression yet, I have no use for that.

Cheers dude, keep up the nice work^^

thx...

i have already analyzed the game server file (GS).. and in fact it contain the algorithms from the RFC2118 (MPPC) but unfortunelly the game uses a modified version of them... and reversing big functions like this is not exactly easy... not for me at least.. i may be missing some lil thing.. but with the right time and patience i will get to the right algorithm hopefully :)

edit:
[Only registered and activated users can see links. Click Here To Register...]

11/26/2011 18:38 Interest07#47

Quote:

Originally Posted by asgborges

thx...

i have already analyzed the game server file (GS).. and in fact it contain the algorithms from the RFC2118 (MPPC) but unfortunelly the game uses a modified version of them... and reversing big functions like this is not exactly easy... not for me at least.. i may be missing some lil thing.. but with the right time and patience i will get to the right algorithm hopefully :)

edit:
[Only registered and activated users can see links. Click Here To Register...]

Well, as long as you find it 'fun' to do, I'm sure you'll manage it :handsdown:

I don't think I'd be very happy reversing big functions though ;)

11/30/2011 02:41 asgborges#48

as Smurfin requested i just made possible the change the Send/Recv packets.. but in another DLL.. and will explain why...

after solving the compression problem.. i figured that the server/client will disconnect you if you send modified packets the way i was trying to...
theres a check function on server-side and client-side for comparing the packets... i managed to send/recv modified and the client recognized the them... but since i dont have the "original" sliding buff that is synchronized between server/client.. the check function will disconnect me right after.. and that is a problem becos theres no way to get actual sliding buff from server :S

so i came up with a solution offered earlier by Swoosh... wich i suppose is playing with breakpoints...

How it looks like:
[Only registered and activated users can see links. Click Here To Register...]

with the function provided by Interest07 from his SendPacket thread and a function i that found for RecvPacket... i made a DLL now for MHS (Memmory Hack Software) last version, that uses breakpoints in order to modify what you want... follow bellow the instruction:

* Open the elementclient.exe on MHS
* go on Disassembler (Ctrl+D) window
* hit the menu... Tools->Breakpoint-Handler
* load the DLL PW_BPSniffer.DLL
* righ-click on some address... now Add two new breakpoints ("Breakpoints->Add Breakpoint here") for the addresses:
-> 6734C0 (SendPacket) do not active yet
-> 435C10 (RecvPacket) do not active yet
* look at the image bellow to see the configuration:
[Only registered and activated users can see links. Click Here To Register...]

Important notes:
* Some times the MHS can crash if you are "hooking" the two functions at same time.. but in genereal works fair enough...
* There will be missing some packets like Chat/Trade packets... the SendPacket function is not used for all avaliable packets... you however can use IDA to try get a better "central" function and modify the DLL as you wish.. look for a quick example:
[Only registered and activated users can see links. Click Here To Register...]
* The RecvPacket funtion that i found.. in general looks like the decompression+decryption process.. so you will be seeing the "before" and "after" buffs, but it gets obivious once you see the packets... but as far i can see it is catching all incoming packets i suppose...
* Depending on your computer resources you may experience some freezing on the game client...

Download: [Only registered and activated users can see links. Click Here To Register...] (included Source Code for Delphi XE)

11/30/2011 09:53 dumbfck#49

Hehe nice work again, sir =]

11/30/2011 19:44 +Lestat+#50

wow nice it's work :)

11/30/2011 23:01 Smurfin#51

wow, what an effort, you really push it that far, downloading it now...
that's like what happened when I used wpepro in other game back then, I changed the money value to withdraw and disconnected at that time.

what packet is safe to modify for testing ? a success refine packet to replace a bad one would be nice :D

12/01/2011 14:46 plasen#52

Hello I wonder if anyone can tell me how to get the basis of sendpacket

12/01/2011 15:18 Sᴡoosh#53

Smurfin you seem to missunderstand the concepts of a client-server architecture - doesnt matter if you modify clientside (and as soon as a packet is sent, it is clientside , because in both cases real data is on server and packet just informs client what to display), the real value wont be altered...

12/01/2011 15:35 dumbfck#54

Quote:

Originally Posted by plasen

Hello I wonder if anyone can tell me how to get the basis of sendpacket

Easiest way is to use this script :P
Place it in your element folder, open it in AutoIt (SciTE) and run it. It'll show the base address and sendPacket call address in the output console.

Spoiler

Code:

getSendPacketOffsets()

Func getSendPacketOffsets()

    $path = "elementclient.exe"
    $file = FileOpen($path, 16)
    $data = FileRead($file, FileGetSize($path))
    FileClose($file)
    $search = StringRegExp($data, '53'& _ ;             PUSH EBX
                                  '56'& _ ;             PUSH ESI
                                  '8B742410'& _ ;       MOV ESI,DWORD PTR SS:[ESP+10]
                                  '57'& _ ;             PUSH EDI
                                  '8D1CB502000000'& _ ; LEA EBX,DWORD PTR DS:[ESI*4+2]
                                  '53'& _ ;             PUSH EBX
                                  'E8.{8}'& _ ;         CALL elementc.007E90F0
                                  '8BF8'& _ ;           MOV EDI,EAX
                                  '83C404'& _ ;         ADD ESP,4
                                  '85FF'& _ ;           TEST EDI,EDI
                                  '74.{2}'& _ ;         JE SHORT elementc.0062F378
                                  '668B442410'& _ ;     MOV AX,WORD PTR SS:[ESP+10]
                                  '85F6'& _ ;           TEST ESI,ESI
                                  '668907'& _ ;         MOV WORD PTR DS:[EDI],AX
                                  '74.{2}'& _ ;         JE SHORT elementc.0062F360
                                  '8D4F02'& _ ;         LEA ECX,DWORD PTR DS:[EDI+2]
                                  '7E.{2}'& _ ;         JLE SHORT elementc.0062F360
                                  '8D442414'& _ ;       LEA EAX,DWORD PTR SS:[ESP+14]
                                  '8B5004'& _ ;         /MOV EDX,DWORD PTR DS:[EAX+4]
                                  '83C004'& _ ;         |ADD EAX,4
                                  '8911'& _ ;           |MOV DWORD PTR DS:[ECX],EDX
                                  '83C104'& _ ;         |ADD ECX,4
                                  '4E'& _ ;             |DEC ESI
                                  '75.{2}'& _ ;         \JNZ SHORT elementc.0062F352
                                  'A1(.{8})'& _ ;       MOV EAX,DWORD PTR DS:[A5B90C]  <--- base adress
                                  '53'& _ ;             PUSH EBX                       <--- code length
                                  '57'& _ ;             PUSH EDI                       <--- code position in client
                                  '8B4820'& _ ;         MOV ECX,DWORD PTR DS:[EAX+20]  <--- ecx = [base + 0x20] (char struct)
                                  'E8(.{8})'& _ ;       CALL elementc.0060E310         <--- used call
                                  '57'& _ ;             PUSH EDI
                                  'E8.{8}'& _ ;         CALL elementc.007E9100
                                  '83C404'& _ ;         ADD ESP,4
                                  '5F'& _ ;             POP EDI
                                  '5E'& _ ;             POP ESI
                                  '5B'& _ ;             POP EBX
                                  'C3', 2) ;            RETN
    $call_pos = StringInStr($data, $search[0])/2 + 0x400049
    ConsoleWrite('$base = 0x'&rev($search[1])&@CRLF)
    ConsoleWrite('$call = 0x'&Hex(Dec(rev($search[2])) + $call_pos + 5)&@CRLF)

EndFunc


Func rev($string)
    Local $all
    For $i = StringLen($string) + 1 To 1 Step -2
        $all = $all & StringMid($string, $i, 2)
    Next
    While StringLeft($all, 1) = '0'
        $all = StringTrimLeft($all, 1)
    WEnd
    Return $all
EndFunc

Short of that, you'd have to trace it back from the send function in ws2_32.dll

12/01/2011 23:10 Smurfin#55

Quote:

Originally Posted by Sᴡoosh

Smurfin you seem to missunderstand the concepts of a client-server architecture - doesnt matter if you modify clientside (and as soon as a packet is sent, it is clientside , because in both cases real data is on server and packet just informs client what to display), the real value wont be altered...

oh I see, then what could possibly be accomplished by successfully modifying sent/received packet ?

12/01/2011 23:19 plasen#56

The offset I go wrong with this code.

ws2_32.dll file where is it???

12/02/2011 00:29 dumbfck#57

Are you sure it didn't work? I've yet to come accross a version where that offset finder hasn't worked. Running on Win7? If so, you'd need to run SciTE as administrator. And you actually need to run it within SciTE (press F5) rather than compile it and run the exe - That way you get a console output.

Edit: Actually, shouldn't need to run as administrator because it doesn't do anything 'naughty' :P

Otherwise, you'd need to run PW through a debugger such as OllyDbg, then open the modules list (Alt+E), choose WS2_32, then search for names within the module for 'send'. Set a breakpoint there, then when it hits, backtrace out (about 3-4 iterations of ctrl+F9, then F8) until you find some code that looks like (you'll need to scroll to the top of the function each time):

Code:

CPU Disasm
Address   Hex dump                         Command                                  Comments
006734C0  /$  6A FF                        PUSH -1                                  ; elementclient.006734C0(guessed Arg1,Arg2)
006734C2  |.  68 185D9F00                  PUSH elementclient.009F5D18              ; Entry point
006734C7  |.  64:A1 00000000               MOV EAX,DWORD PTR FS:[0]
006734CD  |.  50                           PUSH EAX
006734CE  |.  64:8925 00000000             MOV DWORD PTR FS:[0],ESP                 ; Installs SE handler 9F5D18
006734D5  |.  83EC 18                      SUB ESP,18
006734D8  |.  53                           PUSH EBX
006734D9  |.  56                           PUSH ESI
006734DA  |.  57                           PUSH EDI
006734DB  |.  8BF9                         MOV EDI,ECX
006734DD  |.  6A 07                        PUSH 7                                   ; /Arg1 = 7
006734DF  |.  E8 7C9C0F00                  CALL elementclient.0076D160              ; \elementclient.0076D160
006734E4  |.  33DB                         XOR EBX,EBX
006734E6  |.  33C0                         XOR EAX,EAX
006734E8  |.  83C4 04                      ADD ESP,4
006734EB  |.  894424 18                    MOV DWORD PTR SS:[LOCAL.5],EAX
006734EF  |.  895C24 1C                    MOV DWORD PTR SS:[LOCAL.4],EBX
006734F3  |.  895C24 20                    MOV DWORD PTR SS:[LOCAL.3],EBX
006734F7  |.  C74424 14 4CAEA100           MOV DWORD PTR SS:[LOCAL.6],OFFSET elemen ; ASCII "`TC"
006734FF  |.  C74424 0C 8026A300           MOV DWORD PTR SS:[LOCAL.8],OFFSET elemen ; ASCII "P6g"
00673507  |.  C74424 10 22000000           MOV DWORD PTR SS:[LOCAL.7],22

Edit: One thing to note, the send function is used for other stuff besides sendPacket() too, so when you enable the breakpoint, quickly hit your meditate hotkey or something so that it gets called from sendPacket. This'll at least improve your chances ^^

12/02/2011 16:33 asgborges#58

Quote:

Originally Posted by plasen

Hello I wonder if anyone can tell me how to get the basis of sendpacket

at the moment for PWI:
BaseAddress = 00B28AC4

SendPacketAddr = 006734C0; (actual address in PWI last version)

the plugin Sniffer for Cheat Engine will use:
[BaseAddress] = 00B29168 <- value pointed by the base address

Quote:

Originally Posted by Smurfin

what packet is safe to modify for testing ? a success refine packet to replace a bad one would be nice :D

Swoosh is correct about the client-side acting being just for mere visual information...at least it should be 100% that way...
BUT i remmember the earlys days of PW with plenty of damage to be done that way.. for example dup coin hack, and gshop dup items as showed by a russian guy back in that time (late 2008)...
The fact that the game "now days" is better protected than before with the most of the things being handled in server-side will not mean that is perfectly protected or hack-proof... but is indeed a challenge finding new things that actly will work...
as that said, you probably can try modify the receiving packets.. depending of what you trying to do you may have lucky... just dont be too hopeful :p

12/04/2011 01:23 Smurfin#59

lol thanks for idea and explanation, PW is really a tough nut to crack. :(

12/04/2011 04:20 altic#60

Quote:

Originally Posted by Smurfin

lol thanks for idea and explanation, PW is really a tough nut to crack. :(

sure it did, i have attacked PW Indo by bruteforce, modifying client and packet data, etc. and it didn't work at all.
fuuuuhhhhhh,,,,,,, i'm nearly gave up about this :handsdown:

Page 4 of 5

« First