PW Packet Sniffer

*bump* :)

1st: Thumbs up! This really looks like a usefull piece of software (srry if my english is a little sluggish right now, am still half drunk xD)

2nd: WOOT You're on the same Server I play on xD (And even Screenshoted one of my rare Worldchats xD)

Does it still work?

i guess asgborges isnt around anymore but thanks for this tool :)
i tried it abit today and was still working for me. I got those test results:

c2s-221716 "2500" "07000000" "0C000000" "56240000(_id)" "00000000" -> accept quest
c2s-220302 "2E00" -> start meditate
c2s-220302 "0800" -> unselect

sadly after i rebooted my pc the tool wasnt working anymore...so far i have not figured out why.

Do we know how well the packet sniffer plugin to cheat engine 5.5 still works with current (2015) versions of PWI? I'm trying to use it to just view the data sent from server-to-client... not modify it or inject my own packets in any way. I also don't care about the data sent from client-to-server.

So I'm firing up PW, then cheat engine, then the plugin, then logging into PW, staying in game for 3-5 seconds, closing down the PW client, and examining the created log file with all the packets recorded.

I'm having a reasonably low success rate on this. In that sometimes (typically in less crowded areas) I find exactly what I'm looking for. Other times it simply isn't there, even though I know the server must have sent it. Initially I was thinking its because I didn't have enough experience in scanning through the data to know what to look for. But now I've got more confidence in how to find the data I'm looking for so I'm thinking that isn't the problem anymore - after reading a lot of posts about packet sniffers no longer working on newer versions, I'm thinking its because under certain conditions the decryption/decompression done by the packet sniffer isn't working quite right, and corrupting the data.

Firstly can anyone confirm that? Or are others getting 100% accurate results from the packet sniffer?

Otherwise does anyone have actual source code for this - even if it doesn't work 100%, if its pretty close maybe I can figure out what's wrong. Or even just a textual explanation of how to read the packet data, i.e. how do the client and server negotiate the RC4 decryption key? What compression is used? I'm assuming the stream is compressed then encrypted, so we must decrypt then decompress (rather than the other way around)?

Many thanks!

Compression is modified MPPC in Server -> Client direction. Doesn't matter though for your scenario - all the public sniffers don't even go that far.

There are several different types of PW packets - the sniffers only hook functions that handle S00 packets.

You'll need to write your own sniffers, like many of us did.

Quote:

Originally Posted by Sᴡoosh the sniffers only hook functions that handle S00 packets.

Hook functions as in, add breakpoints in to trap when the send/receivePacket functions get called? Yeah I wasn't thinking of doing it that way. I was more thinking of modifying my hosts file to redirect the address of the real PW server to 127.0.0.1, then have my pgm sitting listening on port 29000, intercepting and bouncing all traffic to the real PW server.

That much is easy. That was as far as I got when I then realised the data was encrypted, and other than knowing this is done with RC4 and the account login and some other random info is used to negotiate the decryption keys, I don't have any more detailed info on this. I figured since that packet sniffer is 95% working, somebody must have that info, but maybe it doesn't work like that and it hooks the functions in the PW EXE instead...

It depends on what you're using. Some hook, others do it the proxy way, as you described.

For infos about PW protocol - if you dig, a bit can be found in the open.

Maybe once I quit this game, i'll release my unfinished clientless bot and tools. Lots of infos in there.

I actually got this to work... am able to decode all the client-to-server and server-to-client packets with my proxy sitting in between the two, and since I'm not modifying the data in any way going either direction, it should be undetectable. So now I'm figuring out what I can do with it :)

So thanks for the pointers :)

hey, sorry for necroing this.

the tool seems to work fine till this day, but im trying to do some scripts off of it. how is the hash, cmkey and rc4 keys calculated? hash seems to be a combination of username + initial key, but I cant seem to figure it out nor to find the answer in here

any help would be greatly appreciated

cheers