Register for your free account! | Forgot your password?

Go Back   elitepvpers > Other Online Games > Browsergames > DarkOrbit
You last visited: Today at 13:46

  • Please register to post and access all features, it's quick, easy and FREE!

Advertisement



[HELP] Packet encryption

Discussion on [HELP] Packet encryption within the DarkOrbit forum part of the Browsergames category.

Reply
 
Old   #1
 
elite*gold: 278
Join Date: Dec 2010
Posts: 1,125
Received Thanks: 1,083
[HELP] Packet encryption

At the end of the topic is the download link to the full packet list

Hi!!

Well I was sniffing some packets and I realized that BP changed the encryption again (I was too close...) and now the problem is that I don't know which encryption is:

Some packets

As you can see the request and answer of policy file isn't encrypted:
Code:
1  192.168.0.154:3441  62.146.191.167:843  23  Send  

0000  3C 70 6F 6C 69 63 79 2D 66 69 6C 65 2D 72 65 71    <policy-file-req

0010  75 65 73 74 2F 3E 00                               uest/>.



2  62.146.191.167:843  192.168.0.154:3441  326  Recv  

0000  3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31    <?xml version="1

0010  2E 30 22 20 65 6E 63 6F 64 69 6E 67 3D 22 55 54    .0" encoding="UT

0020  46 2D 38 22 3F 3E 0A 3C 63 72 6F 73 73 2D 64 6F    F-8"?>.<cross-do

0030  6D 61 69 6E 2D 70 6F 6C 69 63 79 20 78 6D 6C 6E    main-policy xmln

0040  73 3A 78 73 69 3D 22 68 74 74 70 3A 2F 2F 77 77    s:xsi="http://ww

0050  77 2E 77 33 2E 6F 72 67 2F 32 30 30 31 2F 58 4D    w.w3.org/2001/XM

0060  4C 53 63 68 65 6D 61 2D 69 6E 73 74 61 6E 63 65    LSchema-instance

0070  22 20 78 73 69 3A 6E 6F 4E 61 6D 65 73 70 61 63    " xsi:noNamespac

0080  65 53 63 68 65 6D 61 4C 6F 63 61 74 69 6F 6E 3D    eSchemaLocation=

0090  22 68 74 74 70 3A 2F 2F 77 77 77 2E 61 64 6F 62    "http://www.adob

00A0  65 2E 63 6F 6D 2F 78 6D 6C 2F 73 63 68 65 6D 61    e.com/xml/schema

00B0  73 2F 50 6F 6C 69 63 79 46 69 6C 65 2E 78 73 64    s/PolicyFile.xsd

00C0  22 3E 0A 20 20 20 3C 73 69 74 65 2D 63 6F 6E 74    ">....
But the problem is that the rest of the packets are encrypted.

The last time it was a simple xor, but now it isn't
Code:
3  192.168.0.154:3445  62.146.191.167:8080  16  Send  

0000  00 0E 02 9A 00 00 00 00 00 00 00 2D 00 00 00 05    ...........-....



4  62.146.191.167:8080  192.168.0.154:3445  17  Recv  

0000  00 0F 02 9B 00 00 00 00 00 00 00 2D 00 00 00 05    ...........-....

0010  01                                                 .
If it were a xor encryption the 00 would be another number.
I also realized that BP changed the login packet:

Code:
3  192.168.0.154:3445  62.146.191.167:8080  16  Send  

0000  00 0E 02 9A 00 00 00 00 00 00 00 2D 00 00 00 05    ...........-....



4  62.146.191.167:8080  192.168.0.154:3445  17  Recv  

0000  00 0F 02 9B 00 00 00 00 00 00 00 2D 00 00 00 05    ...........-....

0010  01                                                 .

5  192.168.0.154:3445  62.146.191.167:8080  4  Send  

0000  00 02 77 F7                                        ..w.



6  62.146.191.167:8080  192.168.0.154:3445  4380  Recv  

0000  1A 2D 05 7A 1F 94 00 00 00 00 00 00 1A 21 D5 59    .-.z.........!.Y

0010  57 7F 0F CE 6B FD ED D3 EE 6A C0 51 E6 43 AE DD    W...k....j.Q.C..

0020  F8 7B 2E 33 24 77 3D F7 12 CB 57 23 5A 13 30 E9    .{.3$w=...W#Z.0.

0030  60 1D 17 FD F4 6E F0 87 F9 4C 18 A3 A2 23 B4 D3    `....n...L...#..

0040  AF FD 96 EC E7 98 F3 23 9A 5A A7 24 73 A1 FE 8C    .......#.Z.$s...

0050  E4 2A 55 29 C4 57 BB 99 DB A4 15 CD 3C F9 8F D4    .*U).W......<...

0060  76 C7 3C 97 DA 89 25 F1 F9 14 B8 4B A2 01 A9 1E    v.<...%....K....

0070  3A 76 46 1E 22 78 7F FA FC 45 1A 05 1B 8F 11 D8    :vF."x...E......

0080  BF C9 AA 94 F3 34 97 2A DD 94 F1 02 61 30 7E F0    .....4.*....a0~.

0090  50 F7 C1 0B FA EA 3A 27 99 4E 8B 27 C9 80 F9 3C    P.....:'.N.'...<

00A0  4A 7B 78 92 19 50 17 02 8B 21 49 35 7F EB F9 7A    J{x..P...!I5...z

00B0  F4 D0 ED B0 57 0A 81 96 D7 93 A8 03 8F A1 95 89    ....W...........

00C0  21 18 69 E6 41 84 52 00 8D 8A 39 56 E1 49 45 37    !.i.A.R...9V.IE7

00D0  28 7A AD AF 9A FA F3 76 A7 7D 37 2A 50 FA 62 AB    (z.....v.}7*P.b.

00E0  AE 6F CC 3B 15 C8 60 DD E8 50 DA C6 9C A2 A5 C0    .o.;..`..P......

00F0  93 7A 81 52 87 71 0A BB 94 00 50 4F A8 35 0F DC    .z.R.q....PO.5..

0100  66 21 43 46 6E 6C AA B8 87 56 D0 5E 2F D0 F3 FC    f!CFnl...V.^/...
//and more...
First it sends a packet and receive the answer from the server, and then it sends a short packet:
Code:
5  192.168.0.154:3445  62.146.191.167:8080  4  Send  

0000  00 02 77 F7                                        ..w.
With just 2 bytes of length.

One thing that hasn't change (at least at 100%) are the chat packets:
Code:
2957  178.132.246.166:9338  192.168.0.154:3483  52  Recv  

0000  61 25 31 32 38 35 40 4A 41 4C 49 53 4B 4F 40 61    a%1285@JALISKO@a

0010  20 71 75 65 20 68 6F 72 61 20 65 6E 70 69 65 7A     que hora enpiez

0020  61 20 4E 45 4D 45 53 49 53 40 D0 98 CE 9E C3 98    a NEMESIS@......

0030  CE A0 23 00                                        ..#.
So... anyone has an idea of what it can be?

Download the full list (2957 packets):

See you!!
manulaiko is offline  
Thanks
2 Users
Old 02/22/2014, 19:55   #2
 
vokovl's Avatar
 
elite*gold: 0
Join Date: Jul 2010
Posts: 523
Received Thanks: 324
login is old, and norm work
vokovl is offline  
Old 02/22/2014, 20:16   #3
 
elite*gold: 278
Join Date: Dec 2010
Posts: 1,125
Received Thanks: 1,083
Quote:
Originally Posted by vokovl View Post
login is old, and norm work
I sniffed them 1 week ago...
manulaiko is offline  
Thanks
1 User
Old 02/22/2014, 20:18   #4
 
'Heaven.'s Avatar
 
elite*gold: 1
The Black Market: 331/0/0
Join Date: Jun 2012
Posts: 5,819
Received Thanks: 3,200
Wow, good job!

You realized that the socket policy files are not encrypted!

Why you don't take a look at the SWF? EVERYTHING you need is in there....
'Heaven. is offline  
Thanks
1 User
Old 02/22/2014, 20:20   #5
 
elite*gold: 15
Join Date: Dec 2012
Posts: 1,236
Received Thanks: 1,411
Quote:
Originally Posted by Waka Toa View Post
Wow, good job!

You realized that the socket policy files are not encrypted!

Why you don't take a look at the SWF? EVERYTHING you need is in there....
Even your fails?
«Ice.Shock™ is offline  
Thanks
3 Users
Old 02/22/2014, 20:22   #6
 
elite*gold: 278
Join Date: Dec 2010
Posts: 1,125
Received Thanks: 1,083
Quote:
Originally Posted by Waka Toa View Post
Wow, good job!

You realized that the socket policy files are not encrypted!

Why you don't take a look at the SWF? EVERYTHING you need is in there....
It was really difficult, first I thought it was RC4 but then I looked again

The main swf deobfuscated isn't really easy to understand...
manulaiko is offline  
Thanks
1 User
Reply


Similar Threads Similar Threads
Packet encryption
02/20/2013 - DarkOrbit - 37 Replies
Hi guys, i know that some of you know the packet encryption mechanism used by DarkOrbit, so I was wondering if you might share it. I am trying to figure it out but with no luck whatsoever :/ ... I know that they use RC4 to encrypt their data, but i can't find the key. I have an idea, that they are sending the key over the connection, where the unique ID = 9098 , but i am not sure. the code decrypted by SWF Decompiler is so hard to understand ... Any ideas here? Thanks.
BOI Packet Encryption
09/28/2011 - Battle of the Immortals - 13 Replies
I've made some research about the packet encryption used in this game and I thought I'd share them. BOI uses a simple XOR-Algorithm. Each byte of a packet is being XORed with the value of the previous byte. The first byte of every packet indicates its length. Furthermore the first byte of the very first packet sent after the connection was established is being XORed with the value 0xCD. Example: Let's say the client sends this packet right after connecting to the server. 0x06 0xA7 0x57...
Packet encryption.
06/22/2009 - Shaiya - 2 Replies
Not sure if anyone has tried making a proxy yet, other than the one that is stickied (which is injected and I imagine directly hooks the games send function bypassing the need for encryption?). Anyway, just curious if anyone knows what sort of encryption is being used on packets? US server for the record.
Packet Encryption
02/22/2007 - General Coding - 4 Replies
so heute mal nichts zu tun also hab ich mal nach einem opfer ausschau gehalten und stieß dabei auf steam steam ist wie vermutlich jeder weiß eine online platform zum kaufen und spielen von spielen einige dinge die ich mir ueberlegt hab: steam bruter no-recoil hack fuer cs ein steam bruter gab es soweit ich weiß noch nicht und koennte sich als sehr nuetzlich erweisen natuerlich sollte er interface unabhaengig sein und rein auf packet basis arbeiten keke wireshark angeschmissen...
Packet encryption
09/19/2005 - Lineage 2 - 1 Replies
Hi,I'm trying to make a simple L2 bot, but i got stuck in begginning - in the packet encryption. I rewrote the l2j login thread sources (those about encryption) but it doesn't work. Has anyone any description of L2 packet encryption. And second question - what Init packet (server packet,nr. 0) means? I guess that it something related with encryption, but in l2j sources that packet content is hardcoded. Thanks for replies (if any ;) )



All times are GMT +1. The time now is 13:46.


Powered by vBulletin®
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.
SEO by vBSEO ©2011, Crawlability, Inc.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Support | Contact Us | FAQ | Advertising | Privacy Policy | Terms of Service | Abuse
Copyright ©2025 elitepvpers All Rights Reserved.