Extracting blowfish key from packed clients

Hello everyone, someone knows if there's a way to get the blowfish key in packed clients? There's a bunch of servers whit themida packet clients... i wanna know if it's possible, considering that the key is inside of the exes and they're packed...

You can try to create a process image to find the blowfish key, but I am not sure if it will work.
How to:
- launch sro_client
- open task manager, right click -> save process image (see picture)
- go to temp folder and open the image with any texteditor
- search for "media.pk2" (or any other name if they changed it) and check if there is a blowfish key visible
- example below

[Only registered and activated users can see links. Click Here To Register...]

Like I said it might not work... but you could try it :)

Quote:

Originally Posted by guckguck You can try to create a process image to find the blowfish key, but I am not sure if it will work. How to: - launch sro_client - open task manager, right click -> save process image (see picture) - go to temp folder and open the image with any texteditor - search for "media.pk2" (or any other name if they changed it) and check if there is a blowfish key visible - example below Code: G ðG 169841 media.pk2 [Only registered and activated users can see links. Click Here To Register...] Like I said it might not work... but you could try it :)

This works, shows the PK2 key but it's the original 169841, and i cant open the pk2 with that key, another idea? :D

Quote:

Originally Posted by iGamerFD This works, shows the PK2 key but it's the original 169841, and i cant open the pk2 with that key, another idea? :D

It shows 169841 because they most likely changed the address being pushed instead of the original bytes.

You can try [Only registered and activated users can see links. Click Here To Register...].

If the key from "blowFisher" does not work it's possible they changed the base key in their GFXFileManager.dll, but that shouldn't be a concern if the PK2 Editor uses their GFXFileManager.dll itself.

Quote:

Originally Posted by DaxterSoul It shows 169841 because they most likely changed the address being pushed instead of the original bytes. You can try [Only registered and activated users can see links. Click Here To Register...]. If the key from "blowFisher" does not work it's possible they changed the base key in their GFXFileManager.dll, but that shouldn't be a concern if the PK2 Editor uses their GFXFileManager.dll itself.

The blowfisher does not work, not even shows a key... their GFXFileManager is packed too, so i think that the extractor can't acces to that file. Also there are two libs(Silkroad_Api.dll, SroLibrary.dll) maybe one of they is related with the client ecryption. Unpack the client would be a pain in the ... There's another way? The pk2 doesn't contains any readable value about the blowsfish key so we can't find nothing there

Well another other option would be to link the files or upload your content...
It is hard to try without any specific information.

Quote:

Originally Posted by guckguck Well another other option would be to link the files or upload your content... It is hard to try without any specific information.

Full client link:

It is protected by a new software manufactured in 2017
EasySSA [Beta] v1.0.0 - Advanced Silkroad Security API - Upgrade Library

Help unlock file .pk2 !!!