Extracting blowfish key from packed clients

[iGamerFD]

Hello everyone, someone knows if there's a way to get the blowfish key in packed clients? There's a bunch of servers whit themida packet clients... i wanna know if it's possible, considering that the key is inside of the exes and they're packed...

[guckguck]

You can try to create a process image to find the blowfish key, but I am not sure if it will work.
How to:
- launch sro_client
- open task manager, right click -> save process image (see picture)
- go to temp folder and open the image with any texteditor
- search for "media.pk2" (or any other name if they changed it) and check if there is a blowfish key visible
- example below

G ðG 169841  media.pk2

Like I said it might not work... but you could try it

[iGamerFD]

Originally Posted by guckguck

You can try to create a process image to find the blowfish key, but I am not sure if it will work.
How to:
- launch sro_client
- open task manager, right click -> save process image (see picture)
- go to temp folder and open the image with any texteditor
- search for "media.pk2" (or any other name if they changed it) and check if there is a blowfish key visible
- example below

G ðG 169841  media.pk2

Like I said it might not work... but you could try it

This works, shows the PK2 key but it's the original 169841, and i cant open the pk2 with that key, another idea?

[DaxterSoul]

Originally Posted by iGamerFD

This works, shows the PK2 key but it's the original 169841, and i cant open the pk2 with that key, another idea?

It shows 169841 because they most likely changed the address being pushed instead of the original bytes.

You can try .

If the key from "blowFisher" does not work it's possible they changed the base key in their GFXFileManager.dll, but that shouldn't be a concern if the PK2 Editor uses their GFXFileManager.dll itself.

[iGamerFD]

Originally Posted by DaxterSoul

It shows 169841 because they most likely changed the address being pushed instead of the original bytes.

You can try .

If the key from "blowFisher" does not work it's possible they changed the base key in their GFXFileManager.dll, but that shouldn't be a concern if the PK2 Editor uses their GFXFileManager.dll itself.

The blowfisher does not work, not even shows a key... their GFXFileManager is packed too, so i think that the extractor can't acces to that file. Also there are two libs(Silkroad_Api.dll, SroLibrary.dll) maybe one of they is related with the client ecryption. Unpack the client would be a pain in the ... There's another way? The pk2 doesn't contains any readable value about the blowsfish key so we can't find nothing there

[guckguck]

Well another other option would be to link the files or upload your content...
It is hard to try without any specific information.

[iGamerFD]

Originally Posted by guckguck

Well another other option would be to link the files or upload your content...
It is hard to try without any specific information.

Full client link:

 Spoiler

https://mega.nz/#!NgBhHYQa!Z7kDXYiYzg_8UZ6jMQ7Cq3Vvasc3yYrMNSlIlTi bgQ4

[hieulovehoa]

It is protected by a new software manufactured in 2017
EasySSA [Beta] v1.0.0 - Advanced Silkroad Security API - Upgrade Library

Help unlock file .pk2 !!!