I've made some research about the packet encryption used in this game and I thought I'd share them.
BOI uses a simple XOR-Algorithm. Each byte of a packet is being XORed with the value of the previous byte. The first byte of every packet indicates its length. Furthermore the first byte of the very first packet sent after the connection was established is being XORed with the value 0xCD.
Example:
Let's say the client sends this packet right after connecting to the server.
Since this is the first packet sent by the client the first byte (0x06) gets XORed with 0xCD. The 2nd byte is XORed with the 1nd byte, the 3rd one with the 2nd one and so on.
In the end the encrypted packet looks like this:
Now image a second packet is sent:
The first byte (0x03) is now XORed with 0x41 as the prevous original packet ends with this byte. This leads to the following encrypted packet:
In C-Code the Encryption-Function would look like this:
... and the Decryption-Function:
BOI uses a simple XOR-Algorithm. Each byte of a packet is being XORed with the value of the previous byte. The first byte of every packet indicates its length. Furthermore the first byte of the very first packet sent after the connection was established is being XORed with the value 0xCD.
Example:
Let's say the client sends this packet right after connecting to the server.
Code:
0x06 0xA7 0x57 0x04 0x01 0x41
In the end the encrypted packet looks like this:
Code:
0xCB 0xA1 0xF0 0x53 0x05 0x40
Code:
0x03 0xAB 0x34
Code:
0x42 0xA8 0x9F
In C-Code the Encryption-Function would look like this:
Code:
char LastByte = 0xCD;
Encrypt(char *src, char *dst, int len)
{
for (int i = 0; i < len; i++)
{
dst[i] = src[i] ^ LastByte;
LastByte = src[i];
}
}
Code:
char LastByte = 0xCD;
Decrypt(char *src, char *dst, int len)
{
for (int i = 0; i < len; i++)
{
dst[i] = src[i] ^ LastByte;
LastByte = dst[i];
}
}
