How to completely remove captcha system VSRO188

[iZexo]

I found a thread to remove it from Chernobyl but unfortunately link dead (gatewayserver modified no captcha).
Anyway, i just want to know how to modify gatewayserver and disable it.

Thanks in advance.

[DaxterSoul]

The login process in the GatewayServer is actually quite complex because it talks with both the GlobalManager and an AgentServer before handing out a successful Login acknowledge (0xA102).

I don't know how Chernobyl did it but from what I know the cleanest way is to replace the IBUV_GENERATE_REQ in the FIND_CONTENT_USER_ACK handler with code that sends a USER_VALIDATION_SUCCESS_REQ to the GlobalManager which would originally be sent only after the IBUV has been answered correctly.

The the function that calls IBUV_GENERATE_REQ is called from 0x00405CF5.

This is what the reverse engineered code from the actual place where the USER_VALIDATION_SUCCESS_REQ is sent looks like.
(at around 0x00406BB1)

      pMsgUserValidationSuccessReq = g_NetEngine->vftbl_0->CNetEngine::NewMsg(g_NetEngine, 0);
      *pMsgUserValidationSuccessReq->m_pID = 0x6112;// USER_VALIDATION_SUCCESS_REQ
      if ( pCertParam->m_szUsername.capacity < 0x10u )
        m_szUsername.c_str() = (const CHAR *)&pCertParam->m_szUsername.field1;
      else
        m_szUsername.c_str() = (const CHAR *)pCertParam->m_szUsername.field1;
      CMsg::WriteString(dwNumberOfBytesWritten, m_szUsername.c_str(), pMsgUserValidationSuccessReq);
      if ( !CServerProcessBase::SendRelayReq(
              (CServerProcessBase *)this,
              pMsgUserValidationSuccessReq,
              g_pServerBodyOfMyself->pDivision->DivisionManagerBodyID,
              0,
              0,
              pCertParam) )
      {
        pMsgLoginAck = g_NetEngine->vftbl_0->CNetEngine::NewMsg(g_NetEngine, 0);
        *pMsgLoginAck->m_pID = 0xA102u;         // LOGIN_ACK
        HIWORD(a3a) = '\x06\x02';
        CMsg::Write(1u, pMsgLoginAck, (char *)&a3a + 2);// 0x02
        CMsg::Write(1u, pMsgLoginAck, (char *)&a3a + 3);// 0x06
        g_NetEngine->vftbl_0->CNetEngine::SendMsg(g_NetEngine, pCertParam->m_SessionID, pMsgLoginAck);
        g_NetEngine->vftbl_0->CNetEngine::FreeMsg(g_NetEngine, pMsgLoginAck);
        g_NetEngine->vftbl_0->CNetEngine::DisconnectSessionById(g_NetEngine, pCertParam->m_SessionID, 1);
        sub_414410(&a1, (int)pCertParam);       // frees pCertParam
      }

It's a lot of code to write in assembly so if you want to keep your sanity write a C++ detour hook dll thingy. If you have no idea what any of this means stick to your filter sending the default captcha code. This is by no means an easy task.

[iZexo]

Originally Posted by DaxterSoul

The login process in the GatewayServer is actually quite complex because it talks with both the GlobalManager and an AgentServer before handing out a successful Login acknowledge (0xA102).

I don't know how Chernobyl did it but from what I know the cleanest way is to replace the IBUV_GENERATE_REQ in the FIND_CONTENT_USER_ACK handler with code that sends a USER_VALIDATION_SUCCESS_REQ to the GlobalManager which would originally be sent only after the IBUV has been answered correctly.

The the function that calls IBUV_GENERATE_REQ is called from 0x00405CF5.

This is what the reverse engineered code from the actual place where the USER_VALIDATION_SUCCESS_REQ is sent looks like.
(at around 0x00406BB1)

      pMsgUserValidationSuccessReq = g_NetEngine->vftbl_0->CNetEngine::NewMsg(g_NetEngine, 0);
      *pMsgUserValidationSuccessReq->m_pID = 0x6112;// USER_VALIDATION_SUCCESS_REQ
      if ( pCertParam->m_szUsername.capacity < 0x10u )
        m_szUsername.c_str() = (const CHAR *)&pCertParam->m_szUsername.field1;
      else
        m_szUsername.c_str() = (const CHAR *)pCertParam->m_szUsername.field1;
      CMsg::WriteString(dwNumberOfBytesWritten, m_szUsername.c_str(), pMsgUserValidationSuccessReq);
      if ( !CServerProcessBase::SendRelayReq(
              (CServerProcessBase *)this,
              pMsgUserValidationSuccessReq,
              g_pServerBodyOfMyself->pDivision->DivisionManagerBodyID,
              0,
              0,
              pCertParam) )
      {
        pMsgLoginAck = g_NetEngine->vftbl_0->CNetEngine::NewMsg(g_NetEngine, 0);
        *pMsgLoginAck->m_pID = 0xA102u;         // LOGIN_ACK
        HIWORD(a3a) = '\x06\x02';
        CMsg::Write(1u, pMsgLoginAck, (char *)&a3a + 2);// 0x02
        CMsg::Write(1u, pMsgLoginAck, (char *)&a3a + 3);// 0x06
        g_NetEngine->vftbl_0->CNetEngine::SendMsg(g_NetEngine, pCertParam->m_SessionID, pMsgLoginAck);
        g_NetEngine->vftbl_0->CNetEngine::FreeMsg(g_NetEngine, pMsgLoginAck);
        g_NetEngine->vftbl_0->CNetEngine::DisconnectSessionById(g_NetEngine, pCertParam->m_SessionID, 1);
        sub_414410(&a1, (int)pCertParam);       // frees pCertParam
      }

It's a lot of code to write in assembly so if you want to keep your sanity write a C++ detour hook dll thingy. If you have no idea what any of this means stick to your filter sending the default captcha code. This is by no means an easy task.

Thanks for replying I appreciate it.
I understand its hard to do (for beginners) with assembly,
So C++ packet filter is the easiest way.

[Otakanikaru]

I do It like this on

async function AutoCaptcha({ stream, config }, packet) {
    const { writer } = stream;

    const write = new writer();
    write.string(config.CAPTCHA);

    return {
        packet: {
            ...packet,
            encrypted: false,
            opcode: 0x6323,
            data: write.toData()
        },
        target: 'remote'
    };
}

export default AutoCaptcha;

then just import it in gatewayserver config context like in this file:

0x2322: 'AutoCaptcha',

[amrsmooth]

Originally Posted by iZexo

I found a thread to remove it from Chernobyl but unfortunately link dead (gatewayserver modified no captcha).
Anyway, i just want to know how to modify gatewayserver and disable it.

Thanks in advance.

I think that you can use filter to remove the captcha from login vsro proxy does support that if I'm not mistaken

[torachiyo]

No need for filter at all




// VSRO 188 / 274(208) IBUV Bypass
GatewayServer.exe

*(int*)(0x0040509C + 1) = 0x00406E30;

[YuBeDev]

Originally Posted by torachiyo

No need for filter at all




// VSRO 188 / 274(208) IBUV Bypass
GatewayServer.exe

*(int*)(0x0040509C + 1) = 0x00406E30;

Thanks, worked. Changed those bytes with IDA.