Atlantica online

[BazzCreative]

How to find Images from the data files? I want to make website for the server and I need images from the game for online shop. thx

[HighGamer.]

or as admin generate the item in game in game, press Print Screen to take screenshot then cut the images out.

as far as i know to find items in game folder they would probably have extension *.tga

[x123x123x]

..\DUI\Image\ITEMIMG0_40X40_00_000.tga - ..\DUI\Image\ITEMIMG37_40X40_00_000.tga

Icons 40x40. Converten files .tga to another format.
In the MTRUE client 3.23, these files have already been decoded.
files icons 5.7MB:
files icons 5.7Mb

[BazzCreative]

Originally Posted by x123x123x

..\DUI\Image\ITEMIMG0_40X40_00_000.tga - ..\DUI\Image\ITEMIMG37_40X40_00_000.tga

Icons 40x40. Converten files .tga to another format.
In the MTRUE client 3.23, these files have already been decoded.
files icons 5.7MB:
files icons 5.7Mb

How I can decode files for v46.08.60 of AO any program?

[x123x123x]

In recent versions of the client, TGA files are container.
It is difficult to explain. In short, they contain an extra 10 kilobytes of information. This information is a key or a data correction map.
The correction algorithm is not clear to me.

It may work as well as .vna files. Derived from the original (non-encoded) phrase or string - these strings are the encoding/decoding key.

[Triacman]

Originally Posted by BazzCreative

How I can decode files for v46.08.60 of AO any program?

I decoded all that, just download my client and use them without problems, go to , my client has all the valofe files, greetings.

[iomo13]

Hi, does anyone know how I can create a MapType?

[Triacman]

Originally Posted by iomo13

Hi, does anyone know how I can create a MapType?

you can add maps to the index as long as you do not overload the limit, but the main problem is that what you do in the Client, you must also do in the Server, and as far as I know, the Server of that version you are trying to update is packaged and protected against debug, therefore the limits cannot be modified, if someone manages to unpack the Server Atlantica.exe I promise to deliver a version with all the maps loaded and I will also make a video of how to do it step by step, just as I managed to load all Maps on my client and Server, if you don't believe me, it analyzes the files of my client and sees that it has loaded all the Maps without problems.

[HighGamer.]

Originally Posted by Triacman

you can add maps to the index as long as you do not overload the limit, but the main problem is that what you do in the Client, you must also do in the Server, and as far as I know, the Server of that version you are trying to update is packaged and protected against debug, therefore the limits cannot be modified, if someone manages to unpack the Server Atlantica.exe I promise to deliver a version with all the maps loaded and I will also make a video of how to do it step by step, just as I managed to load all Maps on my client and Server, if you don't believe me, it analyzes the files of my client and sees that it has loaded all the Maps without problems.

The new server that 123x123 released is protected by Safengine shielden v2.4.0.0 a very easy packer shouldn't be very hard to unprotect it.

this is a very popular chinese packer it's mostly only used by china.. so I wouldn't be surprised that these leaked files came

from chinse hackers.

I decided to spend 20 minutes to unpack Atlantica.exe server file


v.3.11 server has 173141 (total) /162,811 (identified) functions wow haha
v3.23.05 server has 98535 (identifed) functions. Like half less functions.. possibly better optimized code or I unpacked it incorrectly lol

You can find Imports by looking at old server v3.11.xx imports and finding the size of total imports and it should not have changed between both server

games.

Find OEP from old server v3.11.xx using CCF Explorer

AddressOfEntryPoint 0080699C
ImageBase 0000000140000000

so you combine these 2 values and get
000000014080699C

or you can just press Ctrl+E in IDA to go to OEP.

You need to run script SafeEngine_ThunksFixer.txt from OllyDbg script to fix obfuscated functions.. or else it won't be easy to find things.
It also comes with a Safengine_OEP_finder.txt to find OEP
Can't run any of these scripts because Atlantica is 64 bit.. and OllyDbg only works for 32 bit applications.

I couldn't find the OEP because of obfuscated code .. otherwise I could just search for same code from old v.3.11.xx server and find it in new server.

The old OEP I got is where packer starts. 0x1412B463E
also found 0x14000D190 this is main function server runs in.. but its triggered by 2 functions before it and I can't find xrefs to it.

you can also google "Safengine shielden x64dbg IAT" there is a tutorial but it's in chinese how to unpack it properly.

I pretty much gave up

Here is dump Atlantica.exe :
Here is a good tutorial you follow and it will work:
Manual.Unpacking.Safengine_Shielden-Licensor 2.xx.By.Sound.pdf

Here is how far I got.. this is a dump.. with IAT unpatched so it won't work until you fix IAT and also need to adjust the OEP to correct location.

[Triacman]

Originally Posted by HighGamer.

The new server that 123x123 released is protected by Safengine shielden v2.4.0.0 a very easy packer shouldn't be very hard to unprotect it.

this is a very popular chinese packer it's mostly only used by china.. so I wouldn't be surprised that these leaked files came

from chinse hackers.

I decided to spend 20 minutes to unpack Atlantica.exe server file


v.3.11 server has 173141 (total) /162,811 (identified) functions wow haha
v3.23.05 server has 98535 (identifed) functions. Like half less functions.. possibly better optimized code or I unpacked it incorrectly lol

You can find Imports by looking at old server v3.11.xx imports and finding the size of total imports and it should not have changed between both server

games.

Find OEP from old server v3.11.xx using CCF Explorer

AddressOfEntryPoint 0080699C
ImageBase 0000000140000000

so you combine these 2 values and get
000000014080699C

or you can just press Ctrl+E in IDA to go to OEP.

You need to run script SafeEngine_ThunksFixer.txt from OllyDbg script to fix obfuscated functions.. or else it won't be easy to find things.
It also comes with a Safengine_OEP_finder.txt to find OEP
Can't run any of these scripts because Atlantica is 64 bit.. and OllyDbg only works for 32 bit applications.

I couldn't find the OEP because of obfuscated code .. otherwise I could just search for same code from old v.3.11.xx server and find it in new server.

The old OEP I got is where packer starts. 0x1412B463E
also found 0x14000D190 this is main function server runs in.. but its triggered by 2 functions before it and I can't find xrefs to it.

you can also google "Safengine shielden x64dbg IAT" there is a tutorial but it's in chinese how to unpack it properly.

I pretty much gave up

Here is dump Atlantica.exe :
Here is a good tutorial you follow and it will work:
Manual.Unpacking.Safengine_Shielden-Licensor 2.xx.By.Sound.pdf

Here is how far I got.. this is a dump.. with IAT unpatched so it won't work until you fix IAT and also need to adjust the OEP to correct location.

That information will help me a lot, the reason it has more functions is because version 3.02.11 has all the indexes in the executable, in later versions all the indexes were created in plain text outside the executable, it is a lot of data saved to overload the executable, the same is in the clients of both versions, that is why updating version 3.02.11 is much more difficult and complex since the incidents change radically, with version 3.23 unpacked, it would be less traumatic when updating it through reverse engineering, thank you very much.

[Triacman]

I found the EP, the address is 1408E41A8 to add it with the LordPE you just have to subtract 1408E41A8-140000000 = 8E41A8 and configure the new EP. Unfortunately the code is totally destroyed, I could repair it but it would take a long time.

[HighGamer.]

i think the code will work even obfuscated you just need to fix IAT import tables or it won't load. you need IAT RVA, the IAT size you could steal from old v3.11.xx server.. I'll try IAT Auto Search using your OEP it might come out good without any invalid imports.

It doesn't find any Imports using 8E41A8
you can't put in 1408E41A8 as OEP its too long only accepts 32 bit integer.

in v3.11.xx server the first import is RegCloseKey from ADVAPI32.dll.

I found one function for RegCloseKey that uses this
qword_1412413A0 dq 0FFFFD466D2205DCDh

on old server it looks like this


and i found it on new Server
in this function
sub_1408E4510



but i still don't know the address to first import
seems it has more call's the the original function which is quite strange..

I tried all the calls 1 by 1 to see which one gives the best Imports
sub_141268936
sub_1411DFB3A
sub_1411CB1E9
sub_1411E6AB2
sub_1411CEF52
subtracted each with
140001000

none of them give valid imports

maybe it uses wrappers for imports so u need to check inside every function with those call's or something like that idk.. i gave up again lol

[Bidasci]

Originally Posted by HighGamer.

The new server that 123x123 released is protected by Safengine shielden v2.4.0.0 a very easy packer shouldn't be very hard to unprotect it.

this is a very popular chinese packer it's mostly only used by china.. so I wouldn't be surprised that these leaked files came

from chinse hackers.

I decided to spend 20 minutes to unpack Atlantica.exe server file


v.3.11 server has 173141 (total) /162,811 (identified) functions wow haha
v3.23.05 server has 98535 (identifed) functions. Like half less functions.. possibly better optimized code or I unpacked it incorrectly lol

You can find Imports by looking at old server v3.11.xx imports and finding the size of total imports and it should not have changed between both server

games.

Find OEP from old server v3.11.xx using CCF Explorer

AddressOfEntryPoint 0080699C
ImageBase 0000000140000000

so you combine these 2 values and get
000000014080699C

or you can just press Ctrl+E in IDA to go to OEP.

You need to run script SafeEngine_ThunksFixer.txt from OllyDbg script to fix obfuscated functions.. or else it won't be easy to find things.
It also comes with a Safengine_OEP_finder.txt to find OEP
Can't run any of these scripts because Atlantica is 64 bit.. and OllyDbg only works for 32 bit applications.

I couldn't find the OEP because of obfuscated code .. otherwise I could just search for same code from old v.3.11.xx server and find it in new server.

The old OEP I got is where packer starts. 0x1412B463E
also found 0x14000D190 this is main function server runs in.. but its triggered by 2 functions before it and I can't find xrefs to it.

you can also google "Safengine shielden x64dbg IAT" there is a tutorial but it's in chinese how to unpack it properly.

I pretty much gave up

Here is dump Atlantica.exe :
Here is a good tutorial you follow and it will work:
Manual.Unpacking.Safengine_Shielden-Licensor 2.xx.By.Sound.pdf

Here is how far I got.. this is a dump.. with IAT unpatched so it won't work until you fix IAT and also need to adjust the OEP to correct location.

can you the scripts you used to unpack safengine shielden v2.4.0.0? I can't find SafeEngine_ThunksFixer.txt + Safengine_OEP_finder.txt anywhere and when I do it is a dead download link

[ilebyc70]

Originally Posted by Bidasci

can you the scripts you used to unpack safengine shielden v2.4.0.0? I can't find SafeEngine_ThunksFixer.txt + Safengine_OEP_finder.txt anywhere and when I do it is a dead download link

https://www.elitepvpers.com/forum/atlantica-online/4980738-new-years-surprise-2-a.html here is section for unpacked well server that already Done by Triacman

[Bidasci]

Originally Posted by ilebyc70

https://www.elitepvpers.com/forum/atlantica-online/4980738-new-years-surprise-2-a.html here is section for unpacked well server that already Done by Triacman

I am only interested in the scripts.