Help Emulating GF client

[martinx1]

So i have been trying to reverse the comunications used in the GF client in order to create a laucher for metin2 without using the GF client. I didn't manage to it yet, but i think i am close.

I will give an insight to where i am now.
I am not going trought the basics of comunication between client and server since there is this fantastic repo (not made by me, )
which explains the communication between NosTale and gf client.

For Metin2 the only change that i spoted so far is on getting the game auth token, for metin2 account's for some reason when request the token via "https://spark.gameforge.com/api/v1/auth/thin/codes" it gets rejected by the spark server.

After analyzing the requests send by the gf client ( I built this tool for this purpose if you want to try it) i notice 2 things:

1 - There is a "blackbox" variable length field (5820-5845, values based on testing) in the auth request that no one seems to know what it is, this blackbox is always the same for the same GF-client session, after a relogin some parts of this field changes.

2 - There is also some packets sent before to, , that didn't analyze it completly.

The Gf-client uses qt framework which i don't have any experience while reversing (i am also just a beginer in RE), so it has been kinda hard. So i think this blackbox is the reason why the gameAuth token request fails.
I want to see if anyone can help getting this blackbox figured out in order to create a laucher without GF.
If someone what's to help reversing, just send me PM i will provide more info.

[.Verkauf´]

Hey, I spent some weeks to analyze those protection mechanisms. As you mentioned, NostaleAuth != Metin2 auth, for some reason we dont know yet. Additionally to NostaleAuth you MUST send the events requests AND blackbox string. Which makes it much harder to emulate. The "blackbox-string" is a third party fingerprint protection by Iovation (just google for that and you will find the developer portal).

Basically the blackboxstring is an encrypted string of key value pairs. It contains data to be able to fingerprint your browser and prevent emulation (e.g. : "UAGT":"Mozilla...." and much more complex values). Each interaction inside the gf client forces the blackbox string to change (since the GF client is just an embedded chrome browser(CEF Framework)). Let me give you an example: "onMouseDown" event appends "MDWN":"mouse coordinates" and the end of the string. Sent you a pm, we are working on an emulation of gf too.