new Groundmovement packet(10005)

Sadwos · 10/16/2015, 13:40

in conquer last patch movement packet got an update
i need help in analyzing the strange thing is the packet sometimes send with len 15 and sometimes with 14 and i can't find char uid(1591445)

15 00 15 27 08 E6 01 10 95 91 61 18 01 20 E1 92 F3 26 28 EA 07
14 00 15 27 08 68 10 95 91 61 18 01 20 E9 F6 F1 26 28 EA 07

teroareboss1 · 10/16/2015, 17:09

this is the UID

they created a buffer on bits

Sadwos · 10/16/2015, 19:13

can you explain more

Spirited · 10/16/2015, 20:52

Wait, TQ made character IDs only 24 bits in their new packets? Is that really what's going on here?

teroareboss1 · 10/16/2015, 21:18

no, tq decompose UID(32 bits) in 4 bits ( 4 * 8) , Then they apply an algorithm(on 4 bits) and that algorithm is added in buffer. the amount of bytes can be till 7 bytes.

what i just wrote is just for walk packet

Spirited · 10/16/2015, 22:15

Quote:

Originally Posted by teroareboss1

no, tq decompose UID(32 bits) in 4 bits ( 4 * 8) , Then they apply an algorithm(on 4 bits) and that algorithm is added in buffer. the amount of bytes can be till 7 bytes.

what i just wrote is just for walk packet

TQ's methods of attacking bots is quite amateur and ridiculous.

Sadwos · 10/17/2015, 04:03

so what's their algorithm?

~~Best Coder 2014~~ · 10/17/2015, 11:54

Quote:

Originally Posted by Spirited

Wait, TQ made character IDs only 24 bits in their new packets? Is that really what's going on here?

No, they just started using

for serializing MsgWalk and a few other packets.

nTL3fTy · 10/17/2015, 14:58

Quote:

Originally Posted by Best Coder 2014

No, they just started using for serializing MsgWalk and a few other packets.

The mystery is revealed.

ftp4life · 10/21/2015, 06:22

this google protocol buffer is annoying

i have never used this method before but i am kind of understanding it a bit better reading that guide you posted about buffering however, reverse engineering is not my thing xD but maybe i can give it a shot, it never hurts to try.

@Spirited , nice to see you helping more

Spirited · 10/21/2015, 08:33

Quote:

Originally Posted by ftp4life

@Spirited , nice to see you helping more

Believe it or not, but I actually have a history of general aiding dating back four years. I'm here as a developer, and will work only with other developers (of any level, mind you). What I won't do is humor the community by spoonfeeding idiots; though, that's gotten a lot better with Chris as moderator.

ftp4life · 10/21/2015, 09:41

Quote:

Originally Posted by Spirited

Believe it or not, but I actually have a history of general aiding dating back four years. I'm here as a developer, and will work only with other developers (of any level, mind you). What I won't do is humor the community by spoonfeeding idiots; though, that's gotten a lot better with Chris as moderator.

I think I have seen you here longer than that don't give yourself less credibility than you deserve. Nevertheless, many new coming members may not fully understand the level of the world of development which is why people like myself, et. al. , contribute to help people get an idea of how to achieve their goal. Some people have different learning abilities even though it may be Copy + Paste, they will still grasp the concept of what they are looking for, but yet they will still come running back to those who actually know what they are doing and they will only be chasing a ghost.

I am no reverse engineer but I am still learning this Google protocol buffer, which I finally understand thanks to your link.

still having trouble finding where he got .
15 00 15 27 08 E6 01 10 95 91 61 18 01 20 E1 92 F3 26 28 EA 07
14 00 15 27 08 68 10 95 91 61 18 01 20 E9 F6 F1 26 28 EA 07

Spirited · 10/21/2015, 10:25

Quote:

Originally Posted by ftp4life

I think I have seen you here longer than that don't give yourself less credibility than you deserve. Nevertheless, many new coming members may not fully understand the level of the world of development which is why people like myself, et. al. , contribute to help people get an idea of how to achieve their goal. Some people have different learning abilities even though it may be Copy + Paste, they will still grasp the concept of what they are looking for, but yet they will still come running back to those who actually know what they are doing and they will only be chasing a ghost.

I am no reverse engineer but I am still learning this Google protocol buffer, which I finally understand thanks to your link.

still having trouble finding where he got .
15 00 15 27 08 E6 01 10 95 91 61 18 01 20 E1 92 F3 26 28 EA 07
14 00 15 27 08 68 10 95 91 61 18 01 20 E9 F6 F1 26 28 EA 07

(a) No. That is the complete opposite of learning, as far from learning as it can possibly get, unless you threw your computer out the window right this second. Do you go into your math class and listen to lecture, then expect to do everything from that lecture? No. You go and practice like fucking crazy, because that's what you do with any logical/mathematical science. Even now, you copied this other guy's work who probably copied it from someone else, etc. Did you learn absolutely anything from this thread? No, you don't even know how to read a hex dump, which is what was required to make this. You learned nothing.

(b) That's a packet hex dump.

ftp4life · 10/21/2015, 19:45

1) actually, no I did not copy + paste, I had to adjust the entire thing just so it was converted into the source properly. There were many errors so I fixed them all.

2) yea i was using the google protocol to convert the Hex string of the first string

15 00 15 27 08 E6 01 10 95 91 61 18 01 20 E1 92 F3 26 28 EA 07

and following the guide you posted resulted me having a higher number than expected.

(01 10 95 91 61 18) <---- is this the message structure or string varint