Packet Sniffer

[chibis]

Hi

I searched epvp forum and google, but i didnt find a "good" packet sniffer ...
Do any1 know a good packet sniffer for kalonline? I used WPE Pro once, but didnt helped me much ;/

[bloodx]

you need to write own ^^

[chibis]

hmm ... sounds hard for a newb >.<

i mean, isnt wpe pro usefull? only thing is that its detected as an hack and i cant select engine.exe in the target process ... is there rly no other way as writing his own ??

[bloodx]

you need to write own no other way

[hello123456]

original post from r a g e z o n e by King Izu :

prog:

Net:

tut:

KaLua PacketProxy is a packet sniffer, which acts as a proxy between the client and a server. It was specifically designed as a tool for analyzing the protocol Kal Online uses for KaLua. The original program was made by Erkle, and it was updated by ingam0r to meet certain needs, and I just made a few minor adjustments today so the community could use it.


Before being able to use it, you will have to open up config.txt and add the following line:

Code:

I'm sure you can guess what that is. Now that that's set, you will need to change your xlate-e so that you can connect to PacketProxy.

By default, PacketProxy will expect the client to connect to on port 30001. You CAN change it, by passing a different port on the command line.

Code:

That would cause it to listen for the client on port 30002. Why can't you set in the config.txt like the server address and port? Well.. there never really was any need for changing the port to listen on, and based on the source's design, it wasn't easy to add it, and I rushed it sooo.

Moving on, once you've got PacketProxy started, you can connect to it with the client. Please note, if PacketProxy cannot connect to the server, it will crash. If everything is successful, you should see some packets being shown in the PacketProxy console.

Blue for extra information, green for packets that are being sent from the client, and red for packets that are being sent from the server. All packets that are sent are conveniently logged in a .log file in the same folder. The log files are named according to the 'current time' in the format: hour-day-month-year.log.

PacketProxy also has the ability to ignore packets, due to the fact that you can be 'spammed' with packets, making it harder for you to correctly analyze a specific action. To ignore a packet, open up the config.txt and add a line.

Code:

Where is either 'server' or 'client', and is the ID of the packet you want to ignore (in hexadecimal).

So, how do you do you actually analyze packets and the actions associated with them you say? Well you are going to need a decent hex editor, PacketProxy and some common sense.

If you have zero programming experience, you will need to read this and this.

In the above article, take note of the C# names. Since I will be using them to explain. ALL packets have the same basic structure:
Code:

Note: The [] signifies an array. See: Array

To actually 'figure out a packet', you will need to take note of your actions, and the packets sent as a result. As an example, let's do a rundown of how one would have figured out the structure of the login packet. (Which is as follows, but you may want to take a look at this first.)

Code:

Note: All of the strings sent by the server and client are null-terminated.

One would have figured out this structure, by first attempting to login with the sniffer on. After which, you should notice that the client sends a packet with an ID of 0x02. Now all that's needed is to figure out the structure of this packet, which is where the hex editor comes in. Upon pasting the recorded data in your hex editor, you would notice 2 blatantly obvious strings, matching the ID and password you entered. Tada, structure figured out.

And that concludes this release/guide. It's poorly written, but you should get the gist of things. Post any bugs you may have found with the PacketProxy and I may consider fixing them.

[bloodx]

he mean INT server not p-server rofl >_>

[chibis]

yup ..

but as i see theres a activ project about packetsniffing / kalemulator @ r a g e z o n e ... ill keep up to date there, close pl0x