Packets 0x138B/0x1389

05/19/2015 03:16 pernotre#1

Could anyone explain the purpose of packets 0x138B and 0x1389? Is it some kind of anti-cheat?
First DWORD of 0x138B (server packet) seems to be ID of current character, but the rest of its content is a complete mystery to me :( It looks pretty much like a piece of PE file (idata section), I tried to disasm it, but with no success. And 0x1389 (client packet) is even more cryptic :(

05/20/2015 14:27 pernotre#2

I did some investigation and now I see that the initial assumption about packet 0x138B was wrong - contents of 0x138B has nothing to do with imports. It looks like it has the following format:

Spoiler

though contents of unknownData is still unknown. I'll continue investigation.

05/20/2015 19:03 Sᴡoosh#3

I noticed these a few years back and never did closer research. It's meant to be a clientless/anticheat synchro mechanism, but nothing happens if you do not send it, so I never bothered. Maybe one day gauthd will expect response, but so far, nope :).

Where's all the sudden interest in PW protocol coming from?