[Help] Packet Logging fail.

GrandSlam · 07/23/2011, 08:52

Ok so ever since Zektor had released the fixed up or w/e Enc/Dec functions for dekaron and the his packet Logger, I wanted to create my own. Find out what each packet does etc.

Basic Packet Layout goes like this. (Credits to Nebular)

Code:

0 - Packet CRC (calculated/checked by upon encryption/decryption)
4 - Number (starts from 0; synchronization,GG’s CSA are not counted)
6 - Size (header+data => 16bytes minimum )
8 - Timestamp (used to distinguish between requests/responces in some commnads)12 - Command (Describes what action to take)
16 - Data (optional; varies in size and not all areas of it are always used)

In C# I made a proxy to give me the packetID numbers which is buffer[12]-buffer[15]. I also made a logger in C++ to do the exact same thing as Zektor's DekaronSniffer.dll

Code:

WSARecv 09:12:34 PM: Server -> Client (Length: 48 bytes)

        0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
       -- -- -- -- -- -- -- --  -- -- -- -- -- -- -- --
0000   d6 70 da a1 00 e4 00 30  12 02 71 a5 05 0d 00 00   .p.....0..q.....
0010   38 d1 00 10 a5 71 02 12  ed 7d 6b 6c d5 fc 09 02   8....q...}kl....
0020   d5 01 e5 02 42 20 44 6e  20 68 75 6e 74 65 72 20

ID there would be = 050D0000 or 0D05 Which is the Movement Packet btw.

but then after a while I start getting packets, that looks like they have not been decrypted but has been? its weird... like this.

Code:

WSARecv 09:12:37 PM: Server -> Client (Length: 48 bytes)

        0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
       -- -- -- -- -- -- -- --  -- -- -- -- -- -- -- --
0000   85 99 5b 48 00 01 01 31  13 03 7a 30 04 0c 01 01   ..[H...1..z0....
0010   6e 74 01 11 30 7a 03 13  c2 7e a8 6c 45 fd 19 00   nt..0z...~.lE...
0020   82 51 0f 7e cd 49 f6 65  e6 62 d8 4e ed 86 01 5a

which is the SAME packet just TOTALY jacked up. Reason being, Packet ID numbers just don't switch up just like that.

and It happens CONSTANTLY. I'm trying to figure out what the problem is, but I am having no luck. I even resintalled my OS just to make sure it wasn't that. With Zektor's Packet logger, this packet NEVER comes up. I have no clue what could be the problem besides then Enc/Dec, But I highly doubt it. I went back through the byte table of the released packet security and it's all good. I'm either thinking it could be my hooks, or how the buffer? I have no freaking clue. Same shit happens to my Proxy in C# i get the same fail decryption.

and It's really annoying. So Kindly I am asking for SOMEONES help.

Zektor · 07/24/2011, 18:38

Use the CRYPTBody function that I provided, and wrap each packet with that.

(The packets get XOR'd after a while with a key in the packet)

GrandSlam · 07/24/2011, 19:12

Worked perfectly thanks.