Generate GF's account packet connection?

[Nortank]

Hi

I have made a simple bot that allow me some things, but I am currently not able to connect with a GF's account.
Here is a packet connection with a GF's account :

NoS0577 [cryptedDatas = ?] NONE_SESSION_ID [GFUID] [version + bit not writable here] 0 [loginhash ?]

If your login on the GFL client is helloguys, so the login in the packet will be "helloguys GF". There is also another packet which is sent when you arrive at the channel choice : "thisisgfmode".

So my question : how do we generate cryptedDatas ?

By the way, if you got a good book to get knowledges in cryptography, I would be really thankful if you post it here.
(Any explainations about how does the cryptography works in Nostale would be really appreciated too)

[Nortank]

Up,

The only thing I can add is that the loginhash is the same for every account based on the same email (if it is linked), but no way to get it, it seems like it is different from the original NoS0575 packet.

Edit : I would like to add an interesting information : the [loginhash] at the end of the packet will always be the same on your computer, maybe it is the gfuid which is hashed ? I tried, but didn't succeed.

[Bejine]

NoS0575 <?> <login> <sha512ofPassword> <GUID> <?><chr(11)><versionString> 0 <md5(md5(NostaleClientX.exe)+md5(NostaleClient.exe )+login)>
md5 and sha512 are uppercase.

if you're using GFLogin, <login> is the email ( will be changed to prohaxx4r, if it's already in use, it'll add "1" at the end, or "2" if the one is used etc.)

[Apourtartt]

Same issue there.
He is not talking about the NoS0575 packet (which is included in the Cryless' cryptography) but about the NoS0577 packet which has another architecture :

NoS0577 [cryptedDatas = ?] NONE_SESSION_ID [GFUID] [version + bit not writable here] 0 [loginhash ?]

[Bejine]

oh, sorry, didnt realize it had its own one, my bad

[Nortank]

No problem.

I would like to know if you guys had, as the last word of the packet had something begining by "73AD[...]" ?

[FI0w]

Just saying the "thisisgfmode" just replace the password. But with GF Login you dont send PW to World bc client dont even know it so you just send "thisisgfmode"

[Nortank]

Yes, I already noticed that. The only problem I am currently having is with the second and the last word :

NoS0577 [something + random crypted] NONE_SESSION_ID [GFUID] [version + bit not writable here] 0 [something not random crypted]

cryptedDatas doesn't change until you disconnect (if you only change channels/server, it won't change) but change every connections. So it has a random part, like the NoS055 packet.
But the last word never change on my computer. It will maybe change with this update, I am going to check

Edit : they rollbacked to the same version because of update's problem -_-

[Pumba98]

Originally Posted by Nortank

Yes, I already noticed that. The only problem I am currently having is with the second and the last word :

NoS0577 [something + random crypted] NONE_SESSION_ID [GFUID] [version + bit not writable here] 0 [something not random crypted]

cryptedDatas doesn't change until you disconnect (if you only change channels/server, it won't change) but change every connections. So it has a random part, like the NoS055 packet.
But the last word never change on my computer. It will maybe change with this update, I am going to check

Edit : they rollbacked to the same version because of update's problem -_-

Nothing really changed on the last parameter, it's still

Originally Posted by Bejine

<md5(md5(NostaleClientX.exe)+md5(NostaleClient.exe )+login)>

just without the login

=>
<md5(md5(NostaleClientX.exe)+md5(NostaleClient.exe ))>

[Nortank]

Thank you, I guess you didn't find the first parameter ?

[Pumba98]

Originally Posted by Nortank

Thank you, I guess you didn't find the first parameter ?

I guess it's an auth token, passed from GF-Login to the client.

[Nortank]

I got some things from my (very) humble knowledges with Cheat Engine :
the first parameter of the packet connection is in the memory like 4 of 5 times.
I found it at 0x116656F8, 0x11C8C6E0, 0x02BA06E8. Do you know if there is a way to get the function that set it ?
Also, it would may be be usefull ?

Well, got no clue how to get it.

[Nortank]

Still no idea.

Only thing I can add is that if you block GameForge's launcher to access internet after you are connected, you can start a Nostale client, but you will have the obsolete message.
So it really comes from GF's launcher, as Pumba already told.

Edit : Someone good in reversing could tell me if that could work ? (I have no clue if it is doable, atm)
- Trying to start Nostale client from GF's launcher
- Stoping after the auth token's generation
- Saving it and using it for my bot

Edit2 :


Maybe that could help
If they finish their new login version and nobody can bypass this, it will be really sad :c

[Pumba98]

Originally Posted by Nortank

- Trying to start Nostale client from GF's launcher
- Stoping after the auth token's generation
- Saving it and using it for my bot

That is what MarsBounty does in his Bot
Waiting until the NostaleClientX.exe starts, read the id from the client memory and kill the NostaleClient process.

[FI0w]

Originally Posted by Nortank

Still no idea.

Only thing I can add is that if you block GameForge's launcher to access internet after you are connected, you can start a Nostale client, but you will have the obsolete message.
So it really comes from GF's launcher, as Pumba already told.

Edit : Someone good in reversing could tell me if that could work ? (I have no clue if it is doable, atm)
- Trying to start Nostale client from GF's launcher
- Stoping after the auth token's generation
- Saving it and using it for my bot

Edit2 :


Maybe that could help
If they finish their new login version and nobody can bypass this, it will be really sad :c

It is possible to "bypass" it you just need to generate too the Login Auth key