Blowfish key

Hey guys.
I was wondering what's the best way to get the blowfish key?
I've tried some other stuff from ultimation but it doesnt work with protected servers, so may i ask for a trusted way?
and how to replace the new key into the exe using hex or w/e
Thanks.

Some servers just edit it using a hex editor. You can open Conquer.exe in Notepad++ and find it next to "TQServer". Other servers might use a loader to inject it with a new blowfish key. In any case, it's pretty easy to figure out the BF key by reverse engineering the loader. I know there's a few tutorials and programs out there to help you in the Programming Section. Good luck!

Fang incorect, "AFAIK" The BFKey is a fixed string and cannot be changed via hooking.

Quote:

Originally Posted by _DreadNought_ Fang incorect, "AFAIK" The BFKey is a fixed string and cannot be changed via hooking.

So it's not possible to hook the client's method that sets the key in the game cipher? It's not possible to inject a new method that sets the cipher using another key? o.O

When you think about it that way yes, but simply just changing the string at the address in memory its set to, no.

Quote:

Originally Posted by Fаng So it's not possible to hook the client's method that sets the key in the game cipher? It's not possible to inject a new method that sets the cipher using another key? o.O

Not in CO's case... well it's not exactly easy.
TQ's programmers that wrote CO's encryption implemented all by hand... so a simple detour wouldn't work (like get the lib and includes for openssl and set up a detour on BF_set_key from openssl) because you dont have the function pointer.
But, if you can get the function's pointer then you can hook the function and get the parameters easily.

On the other hand, if you're dealing with a CO.exe like classic co's, which is packed and closes the game if it finds c-e, ollydbg, programming environments (VC#, VC++), it's going to be a lot harder.
If you don't succeed with hooking/detours, you could always try a bruteforce but it might take you around a month to be able to find the right combination considering that there are 94^16 (^ = power) possible arrangements. (Starting from '0' to '~').

If you're trying bruteforce... good luck with that.

I still couldnt know how to get it after all.

Attach with a debugger; Enigma decrypts at runtime. I swear I've posted this same thing at least 5 times now.

Sorry, can you link me it?

link u what ? debugger ? if u duno how to get it then im pretty sure u dont know a thing about asm , so google asm books and read some and come back :)

Dude, I've asked clearly for help.
So, Could you just tell me a trusted way?

Google OlyDBG.

I'll do it for you I guess, [Only registered and activated users can see links. Click Here To Register...] use google to learn how to use the software and you can do everything as so.

I know the ollydbg.
I was asking for a way to get the blowfish key.
Could you show me it?
Oweee, thanks.

Up guys.

Please, don't bump a thread that you won't get a simple answer on..

you have to get throw alot first.