[RELEASE] Reversing latest structures for GameServer Packet ( Send / Recv )

MRx86™ · 03/14/2025, 18:58

structures for GameServer ( Send / Recv )

Battleye Heartbeat 31330 Below

Code:

[Structure Packet 57e4cbcc] Packet ID 31330 error code 264 vº¿Ãpå!n˜7nvíúNžt<*é€¥ùaå°ð2š;KÌÕ;jÕÚ¡(¼÷m0hQêN3fµã@y
S¥ëu˜ëè“’ëìÊO£Ô}¦êá£Äpæ—ƒ¢{“Eˆ+8f‡¸Û¢ÆC÷íÀMŒgD‰ŽÓx:Ûî*ëLöñü£T¢öáHOðÿ¼NF>l¤‘O^.g-å©R¢6,ÀXÓôO…´ŒÏ“¢^Xóºå™ƒÞK:ôN4CgVÀzF¤
[Structure Packet 57e4cbcc] Packet ID 31330 264 vº¿Ãpå!n˜7nvíúNžt<é€¥ùaå°ð2š;KÌÕ;jÕÚ¡(¼÷m0hQêN3fµã@y
S¥ëu˜ëè“’ëìÊO£Ô}¦êá£Äpæ—ƒ¢{“Eˆ+8f‡¸Û¢ÆC÷íÀMŒgD‰ŽÓx:ÛîëLöñü£T¢öáHOðÿ¼NF>l¤‘O^.g-å©R¢6,ÀXÓôO…´ŒÏ“¢^Xóºå™ƒÞK:ôN4CgVÀzF¤
[Structure Packet 57e4cbcc] Packet ID 31330 264 vº¿Ãpå!n˜7nvíúNžt<*é€¥ùaå°ð2š;KÌÕ;jÕÚ¡(¼÷m0hQêN3fµã@y
S¥ëu˜ëè“’ëìÊO£Ô}¦êá£Äpæ—ƒ¢{“Eˆ+8f‡¸Û¢ÆC÷íÀMŒgD‰ŽÓx:Ûî*ëLöñü£T¢öáHOðÿ¼NF>l¤‘O^.g-å©R¢6,ÀXÓôO…´ŒÏ“¢^Xóºå™ƒÞK:ôN4CgVÀzF¤
[Structure Packet 57e4cbcc] Packet ID 31330 264 vº¿Ãpå!n˜7nvíúNžt<é€¥ùaå°ð2š;KÌÕ;jÕÚ¡(¼÷m0hQêN3fµã@y
S¥ëu˜ëè“’ëìÊO£Ô}¦êá£Äpæ—ƒ¢{“Eˆ+8f‡¸Û¢ÆC÷íÀMŒgD‰ŽÓx:ÛîëLöñü£T¢öáHOðÿ¼NF>l¤‘O^.g-å©R¢6,ÀXÓôO…´ŒÏ“¢^Xóºå™ƒÞK:ôN4CgVÀzF¤
[Structure Packet 57e4cbcc] Packet ID 31330 264 vº¿Ãpå!n˜`7nvíúNžt<é€¥ùaå°ð2š;KÌÕ;jÕÚ¡(¼÷m0hQêN3fµã@y
S¥ëu˜ëè“’ëìÊO£Ô}¦êá£Äpæ—ƒ¢{“Eˆ+8f‡¸Û¢ÆC÷íÀMŒgD‰ŽÓx:ÛîëLöñü£T¢öáHOðÿ¼NF>l¤‘O^.g-å©R¢6,ÀXÓôO…´ŒÏ“¢^Xóºå™ƒÞK:ôN4CgVÀzF¤

Code:

void* DetourCreate(BYTE* src, const BYTE* dst)
{
	int len = 5;
	BYTE* jmp = (BYTE*)malloc(len + 5);
	DWORD dwBack;
	VirtualProtect(src, len, PAGE_EXECUTE_READWRITE, &dwBack);
	memcpy(jmp, src, len);
	jmp += len;
	jmp[0] = 0xE9;
	*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
	src[0] = 0xE9;
	*(DWORD*)(src + 1) = (DWORD)(dst - src) - 5;
	VirtualProtect(src, len, dwBack, &dwBack);
	return(jmp - len);
}


class cSendPacket
{
public:
	DWORD dwTimeStamp; //0x0000 
	__int16 PacketID; //0x0004 
	__int8 RetCode; //0x0006 

}; cSendPacket* pSendPacket = NULL;


class cRecvPacket
{
   public:
	DWORD dwTimeStamp; //0x0000 
	__int16 PacketID; //0x0004 
	__int8 RetCode; //0x0006 

}; cRecvPacket* pRecvPacket = NULL;




static DWORD dwRecvECX = 0;
DWORD dwRecvJmp  = 0x8608D2;
DWORD dwRecvCall = 0x86F4CC;
__declspec (naked) void HookRecv (void)
{

	__asm mov dwRecvECX,ecx


	pRecvPacket = (cRecvPacket*)dwRecvECX;
	if (pRecvPacket)
	{
		tool->add_log("[RECV] %d %d", pRecvPacket ->TimeStamp, pRecvPacket ->PacketID );
	}


	__asm call[dwRecvCall]
	__asm jmp[dwRecvJmp]

}

static DWORD dwSendECX = 0;
DWORD dwSendJmp = 0x860772;
DWORD dwSendCall = 0x86F490;
__declspec (naked) void HookSend(void)
{

	__asm mov dwSendECX, ecx


	pSendPacket = (cSendPacket*)dwSendECX;
	if (pSendPacket)
	{
		tool->add_log("[SEND] %d %d", pSendPacket->TimeStamp, pSendPacket->PacketID );
	
	}

		__asm call[dwSendCall]
		__asm jmp[dwSendJmp]
}

		DetourCreate((BYTE*)0x8608CD,(BYTE*)HookRecv);
		DetourCreate((BYTE*)0x86076D, (BYTE*)HookSend);

Short example from the past and now

Past example was ASCII
TimeStamp PacketID 1 1 1 1 1 1 -1

Right now
TimeStamp
PacketID
RetCode
Parametar ( like 1 1 1 -1 )

A Small Hint
if you got some old client from prev changment for packet system all you need to do is just to replace your ASCII Packet corresponding uint8

from now you can reverse each class structures and doing your private server with latest client ofcourse would take time.

All Packet Structures Size is 24576 so class wouldnt be bigger then this size.

I Used for some years for clb. i just abbandoned the project

Welgene · 03/22/2025, 16:46

do you have cheat for warrock?