Spell Decrypting.

[Lateralus]

I have the spell decryption in my (4267-based) source, but I'm curious as to where it is found in the client, and how to translate these sorts of encryption/decryption to a higher-level language, since I'm wanting to slightly change these methods. Cryptography is where I'm majorly lacking in expertise...

My question is a little broad; but does anyone just want to work with me in understanding these things?

[Kiyono]

Couldn't you just ask Hybrid? He overwrote the spell encryption with his own.

[Lateralus]

Originally Posted by Kiyono

Couldn't you just ask Hybrid? He overwrote the spell encryption with his own.

Haha, I asked him at about the same time you posted this. o.o

[tanelipe]

The best way to starting tracking where the encryption is would probably be the packet that gets sent when you use a spell. From there you backtrace to the point in ASM that calls the method that passes the parameters to this send function and then just try and find the function that encrypts the parameters.


(Or you could take advantage of one of the XOR values that are constant and look for that in OllyDbg)

[Lateralus]

Originally Posted by tanelipe

The best way to starting tracking where the encryption is would probably be the packet that gets sent when you use a spell. From there you backtrace to the point in ASM that calls the method that passes the parameters to this send function and then just try and find the function that encrypts the parameters.


(Or you could take advantage of one of the XOR values that are constant and look for that in OllyDbg)

I found the function by backtracking the request attack packet magic subtype, just don't understand exactly how to find which values correspond to which registers, and etc...

[Ian*]

eh removed it.

[Lateralus]

Originally Posted by Ian*

eh removed it.

Removed what?

[tanelipe]

Aren't the parameters pushed to the encryption function? You could see how those parameters are stored into the registers inside the encrypt function since they (parameters) are passed in as plain values such as 1045 etc.

[Lateralus]

Originally Posted by tanelipe

Aren't the parameters pushed to the encryption function? You could see how those parameters are stored into the registers inside the encrypt function since they (parameters) are passed in as plain values such as 1045 etc.

Thanks man, got it.

[_DreadNought_]

Originally Posted by tanelipe

The best way to starting tracking where the encryption is would probably be the packet that gets sent when you use a spell. From there you backtrace to the point in ASM that calls the method that passes the parameters to this send function and then just try and find the function that encrypts the parameters.


(Or you could take advantage of one of the XOR values that are constant and look for that in OllyDbg)

How would one find that? o.O

[Lateralus]

Originally Posted by _DreadNought_

How would one find that? o.O

Find where packet type 1022 is constructed, find the subtype 0x15 (magic subtype), and the encryption is close.