When i connect to booth ip's
IPA = "38.82.204.88";
IPB = "121.207.250.33";
An encrypted buffer of a non static length is received so i attached ollydbg to the client logedin and set a break point at the receive call and i traced it to find out whats going on... and i came up with this... or at least thats how i understand it so far,
Im using TQ's Tqanp.dll itself so i don't have to translate its code to C# or c++ and calling Tqanp.0x87381C to decrypt the buffer starting at offset 6 and it returns the exact same values that the client might return if it received the same buffer
And when it returns the buffer this is what the client does to the buffer
If no results it runs another test on the data by xoring data 16 with data 8 as int's values
But somehow EAX never equals and the break points are never hit even thought EAX is generated exactly like the client wold generate it and equals to how the client generates it using the same buffer of data...
So i need a hand making this work.. and im not asking for a full algorithm to handle those packets, i just need a hint/push in the right direction and i needed to know if im on the right track because so far it took me like 2 days to come up with what i have so far and its annoying me :P
IPA = "38.82.204.88";
IPB = "121.207.250.33";
An encrypted buffer of a non static length is received so i attached ollydbg to the client logedin and set a break point at the receive call and i traced it to find out whats going on... and i came up with this... or at least thats how i understand it so far,
Im using TQ's Tqanp.dll itself so i don't have to translate its code to C# or c++ and calling Tqanp.0x87381C to decrypt the buffer starting at offset 6 and it returns the exact same values that the client might return if it received the same buffer
PHP Code:
int Value = ToInt(Buffer, 2);
__asm
{
mov ecx,TLength//buffer length
sub ecx, 6// buffer length -= 6
push ecx
push Value//bitconvert.toint(buffer, 2)
lea edx,DWORD PTR DS:[Buffer + 6]//address of buffer[6]
push EDX
push edx
mov eAx, edx
mov ECX,0x997660
CALL DWORD PTR DS:[0x87381C]// call Tqanp.0087381C to decrypt the data
}
PHP Code:
if (Data.Length < 54)
{
//sometimes the buffer length is less then 54 so... append the missing bytes as 0's
byte[] Buffer = new byte[54];
Array.Copy(Data, Buffer, Data.Length);
Data = new byte[54];
Array.Copy(Buffer, Data, 54);
}
uint EAX = 0;
int Data2 = 0;
for (int i = 0; i < 16; i++)
{
int Value = x86Assembly.Movsx(Data[38 + i]);
Value += Data2;
int Temp1 = BitConverter.ToUInt16(Data, 6);
Temp1 *= i;
Value += Temp1;
Data2 = Value;
//CMP DWORD PTR SS:[EBP-68],10200000
if (Data2 == 0x10200000)
{
if (EAX == 0xf20a03bd || EAX == 0xf20a03be || EAX == 0xf200a3bd)
{
//im breakpointing here
break;
}
}
}
PHP Code:
EAX = BitConverter.ToUInt32(Data, 16) ^ BitConverter.ToUInt32(Data, 8);
if (EAX == 0xf20a03bd || EAX == 0xf20a03be || EAX == 0xf200a3bd)
{
//im breakpointing here
}
So i need a hand making this work.. and im not asking for a full algorithm to handle those packets, i just need a hint/push in the right direction and i needed to know if im on the right track because so far it took me like 2 days to come up with what i have so far and its annoying me :P
