[Tutorial] How to extract DO client.

[SekhmetPOL]

»jD« way

 Spoiler

byte[] mainswf = File.ReadAllBytes(args[0]);
uint start = (uint)(mainswf[0] ^ 0x43) - 1;
for (int i = 0; i < mainswf.Length; i++)
{
    mainswf[i] ^= (byte)++start;
}
File.WriteAllBytes(args[0], mainswf);

My way (probably worse, but if BP will change something in main.swf encoding you can use this one)

 Spoiler

Resources





What we need to know?
Example swf file.

Byte number	Field name	Type	Value[dec - hex]	Explanation
0	Signature	uint8	F - 0x46	Look at SWF File format specification
1	Signature	uint8	W - 0x57	always "W"
2	Signature	uint8	S - 0x53	always "S"
3	Version	uint8	11 - 0x17	Version
4	File length	uint32	6029338(bytes) - 0x00 0x5C 0x00 0x1A	For example if you've found 1A 00 5C 00 invert it to 005C001A and convert to decimal. It's file size in bytes(will return true value only if it's uncompressed file(first byte equals "F"), if file is compressed it contains size of uncompressed file.

How to get DarkOrbit client

1. Open HxD
2. Open FlashPlayer process(I prefer do it on Mozilla - on chrome it's difficult to find correct process)
3. Look for FWS header
4. Check size of every found file in memory(you don't needa check all files - if file is very small - ignore it, 7.8.8 file weighed 5Mb+)
5. If you found probably correct file click PPM on first byte of file, click Select block, change values to dec and in length paste converted to dec file size.
6. Copy all selection in byte(left) panel.
7. Click Ctrl + N
8. Paste copied bytes to left panel
9. Save it
10. Decompile it(cause it has FWS header, which isn't supported in many decompilers use JPEXS Flash Decompiler
11. Deobfucate client by clicking Tools > Deobfuscation > Reneme invalid identifers

Regards, Sekhmet

[Requi]

I ♥ you.

[»jD«]

Such a hard way to do it -.- Everyone knows the SWF is XORed with a starting byte of 0x71 and is then incremented each byte... lol

-jD

[SekhmetPOL]

Originally Posted by »jD«

Such a hard way to do it -.- Everyone knows the SWF is XORed with a starting byte of 0x71 and is then incremented each byte... lol

-jD

Probably you're right, but I don't understand exclusive disjunction(all the more that, what you've wrote) so I've just used way what I know.

[Requi]

Originally Posted by jD

Everyone

Who do you mean, with "everyone"?

[»jD«]

I posted that when the new encryption first came out :P

byte[] mainswf = File.ReadAllBytes(args[0]);
uint start = (uint)(mainswf[0] ^ 0x43) - 1;
for (int i = 0; i < mainswf.Length; i++)
{
    mainswf[i] ^= (byte)++start;
}
File.WriteAllBytes(args[0], mainswf);

Compile and drop SWF ontop of the exe, DONE!

-jD

[SekhmetPOL]

Originally Posted by »jD«

I posted that when the new encryption first came out :P

byte[] mainswf = File.ReadAllBytes(args[0]);
uint start = (uint)(mainswf[0] ^ 0x43) - 1;
for (int i = 0; i < mainswf.Length; i++)
{
    mainswf[i] ^= (byte)++start;
}
File.WriteAllBytes(args[0], mainswf);

Compile and drop SWF ontop of the exe, DONE!

-jD

Really easier. Thanks.
If you don't mind, I've added your way to first post.

[Requi]

Originally Posted by »jD«

I posted that when the new encryption first came out :P

byte[] mainswf = File.ReadAllBytes(args[0]);
uint start = (uint)(mainswf[0] ^ 0x43) - 1;
for (int i = 0; i < mainswf.Length; i++)
{
    mainswf[i] ^= (byte)++start;
}
File.WriteAllBytes(args[0], mainswf);

Compile and drop SWF ontop of the exe, DONE!

-jD

Really nice, that you share that with us. But it doesn't do anything with it.
I have the same file at the end.

@SekhmetPOL
My decompiler crashes, if I want to open it in the decompiler.
I can decompile it. But I can't "open" it to see the source.

[SekhmetPOL]

Originally Posted by Requi

Really nice, that you share that with us. But it doesn't do anything with it.
I have the same file at the end.

@SekhmetPOL
My decompiler crashes, if I want to open it in the decompiler.
I can decompile it. But I can't "open" it to see the source.

Use JPEXS.

[»jD«]

JPEXS is the best Finally someone else is using it :P

@Requi, whats wrong? It should work :P

-jD

[Requi]

Well. There is nothing wrong. I think.

I compiled the .exe. Dropped the main.swf on the decrypter and at the end, I still have the same main.swf

[»jD«]

Are you sure its the same SWF? :P

-jD

Are you sure its the same SWF? :P

-jD

[SekhmetPOL]

Originally Posted by Requi

Well. There is nothing wrong. I think.

I compiled the .exe. Dropped the main.swf on the decrypter and at the end, I still have the same main.swf

Weight of the file will be the same, because it's still compressed.


- decompilable 7.8.10 main.swf

[Requi]

Originally Posted by SekhmetPOL

Weight of the file will be the same, because it's still compressed.


- decompilable 7.8.10 main.swf

Sothink is ****. Because of this, I couldn't decompile it.
I use now your and jD's Decompiler.

[»jD«]

Yup, XOR doesn't change the size, it simply changes the bytes.

-jD