[Release] Cabal Packet Monitor

[HellSpider]

Hi.

I've coded a tool to intercept and log the packets sent between the Cabal game client and server. This tool is targeted to Cabal EU and similar version clients, but will work on the older private servers too, excluding reliable packet analysis data.

This is not a cheating application, this application merely allows to collect info that can be used to create cheats, emulators, bots and more.

This tool hooks Winsock2 functions to intercept the packet traffic and is different from the packet sniffer created by Yamachi, which works as an external proxy application.

There are 2 different applications in this project, a logger and a viewer. The logger logs the traffic and writes it into a .cpm data file, which the viewer can read. This way you can easily open and analyze different saved sessions.

This application is written in MASM.

This application supports custom packet parser plugins, more of them further down.

If you have analyzed packets and their contents, post the research, makes my job much faster!

This application is able to work while nProtect GameGuard is running, so no worries about that.

Some antivirus software might flag the files in the package as malware, but they are completely clean.
If you do not trust these files, don't tell me about it, just don't use them!


~Screenshots~

-Loader-



-Viewer-




~Packet parser plugin~

If you are interested in coding your own packet data parser, it's fully possible.

 Plugin coding information!

The data parser is a DLL file named "parse.dll" with 2 exports.

GetPacketType and ParsePacketData

Both exports will be called for each packet that is handled by the viewer.

CALLBACK GetPacketType( argOpcode )
CALLBACK ParsePacketData( argData, argSize, argOpcode, argWriteBuffer, argID )

argOpcode = Packet opcode
argData = Address of packet data
argSize = Size of packet data (only data, excluding header)
argWriteBuffer = Address of buffer that should receive an ANSI text string
argID = Packet origin: ID_SERVER (0x1) or ID_CLIENT (0x2)

The exported functions must be in __stdcall calling convention, meaning that the function must pop its own arguments from the stack before return.

Notes!

1) GetPacketType must return a pointer to an ANSI text string!
2) ParsePacketData must write in the write buffer, if the parser doesn't have any data to write, it must at least write a terminating NULL character in the buffer! The return value does not matter.
3) Because of a bug in HexEdit.dll (which I am not the author of), it should be mapped at address 0x10000000, which means other modules should be mapped at other addresses. As HexEdit.dll is loaded after the parser I recommend using ImageBase 0x20000000+ for the parser.

~Credits~

- Helped a lot with understanding the Cabal packet system.

~Update History~

~2012-06-18~

+ Initial release

~2012-06-19~

+ Fixed a bug in ParsePacketData plugin export handler

~2012-08-23~

+ Bugfixes in many modules

~2012-08-27~

+ Hidden from nProtect GameGuard again

~2013-09-01~

+ Viewer: Re-coded partially, new GUI
+ Parser: Re-coded, supports only a few packets at the moment


DOWNLOAD -> PRESS THANKS!
DO NOT SUPPORT LEECHING!

_

[genesisVI]

yes after months of search iv found it ty...

[crckd]

great tool!

on parsing packets, there are private servers with custom packet header (0x7AB38CF1).
can we change this value when parsing received packets?

[Legacy2]

somehow it doesnt work on Mystery Cabal (ep7)

cabal doesnt start and when i use a bypassed client then i get no packets :/

can you change the name of the programm so idont need to use a bypass for mystery?

[bartbilf]

I bet someone with the right knowledge actualy can do something with this tool, I know I can't.

PS little type-o in the first sentence ''intecept'' = ''intercept'' ;D

[rhizzu]

noob question.
what is the uses/purpose of CabalPacketMonitor?
can it block the packet that can send on the server.? "make me invisible to their server, and free to use all kinds of hack?" cannot saved on their hack log?

[noolander]

manipulate data read packet from server and client..trace and decrypt..bla bla

[1337stylor]

fulululu rageboiiis123

[iqjeff]

I wish i didn't cut my programming classes. Very useful tool especially with hacks that you get an instant dc.

[.Law.]

What you noobs need to realize:

• You can't edit packets with this.
• You can't stop DC from happening in any way.
• This will not stop the hacklogs
• This is created for documentation, not for noobs like you.

[alecz24]

Punk you should add that they can make use of it to code a bot to your list

[spiderx0413]

Originally Posted by HellSpider

Hi.

I've coded a tool to intecept and log the packets sent between the Cabal gameclient and server. This tool is targeted to Cabal EU and similar version clients, but will work on the older private servers too.

FOR THE IDIOTS:

THIS IS NOT AN ANTICHEAT BYPASS!! THIS IS NOT A CHEAT EITHER!!

This tool hooks Winsock2 functions to intercept the packet traffic and is different from the packet sniffer created by Yamachi, which works as an external application.

There are 2 different applications in this project, a logger and a viewer. The logger logs the traffic and writes it into a .cpm data file, which the viewer can read. This way you can easily open and analyze different saved sessions.

This application is written in MASM.

This application supports custom packet parser plugins, more of them further down.

This application is able to work while GameGuard is running, so no worries about that.

Some antivirus software might flag the files in the package as malware, but they are completely clean.
If you do not trust these files, don't tell me about it, just don't use them!


~Screenshots~

-Loader-



-Viewer-



-Detailed packet view-



~Packet parser plugin~

If you are interested in coding your own packet data parser, it's fully possible.

= UNDER CONSTRUCTION =


~Credits~

- Helped a lot with understanding of Cabal packet system


~Donations~

This tool is freeware and I don't have any intentions of making it commercial, but I'd be very grateful for any donations you can offer, as programming usually takes a lot of free time.

The viewer has a built in button to access PayPal donation page.


~Update History~

~18/06/2012~

+ Initial release (ver. 1.0.0.0)

tnx a lot dude i've been looking for it for so long!!!!!

[.Law.]

Originally Posted by alecz24

Punk you should add that they can make use of it to code a bot to your list

These guys ? HAHA

[strontklit]

Thanks, great release!

Bet it'll be usefull in the future

[genesisVI]

Originally Posted by strontklit

Thanks, great release!

Bet it'll be usefull in the future

very usefull