 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
pkedpker
Master Cheater
![]() Reputation: 1
Joined: 11 Oct 2006
Posts: 412
|
 Posted: Sun Apr 10, 2011 9:09 pm Post subject: Can someone help me understand this? |
 |
|
I'm trying to encrypt packets for a mmorpg
I'm trying to understand how it encrypts packets I decompiled the assembly using hex-rays and for this in return
| Code: |
signed int __thiscall encryptPacket(int this, int a2, signed int a3)
{
int v3; // esi@1
int v4; // eax@5
char v5; // dl@7
int v6; // ecx@7
signed int v7; // ebp@7
int v8; // edi@7
char v9; // dl@7
int v10; // eax@8
int v11; // edx@8
int v12; // eax@10
int v13; // ecx@10
signed int v14; // esi@10
int v15; // eax@11
signed int v16; // esi@13
int v17; // ecx@20
signed int result; // eax@22
int v19; // [sp+8h] [bp-14h]@7
unsigned __int8 v20; // [sp+Ch] [bp-10h]@5
int v21; // [sp+Ch] [bp-10h]@7
char v22; // [sp+10h] [bp-Ch]@7
int i; // [sp+10h] [bp-Ch]@8
int v24; // [sp+14h] [bp-8h]@1
int v25; // [sp+18h] [bp-4h]@7
int v26; // [sp+20h] [bp+4h]@8
v3 = this;
v24 = this;
if ( *(_DWORD *)this && (unsigned int)a3 >= 0xC && a3 < 16000 && a3 + *(_DWORD *)(this + 28) < *(_DWORD *)(this + 4) )
{
v4 = rand() % 256;
v20 = v4;
if ( *(_WORD *)(v3 + 64) == (unsigned __int8)v4 )
{
LOWORD(v4) = (unsigned __int8)(v4 + 1) % 256;
v20 = v4;
}
v8 = a2;
*(_WORD *)(v3 + 64) = (unsigned __int8)v4;
v9 = cryptTable[2 * v20];
*(_WORD *)a2 = a3;
*(_BYTE *)(a2 + 3) = v4;
*(_DWORD *)(a2 + 8) = dword_B52E10;
v22 = v9;
dword_B52E14 = dword_B52E10;
somethingSize((signed int *)a2);
v6 = *(_DWORD *)(v3 + 28) + *(_DWORD *)(v3 + 20);
v7 = 1;
v5 = 0;
v21 = 0;
v19 = 0;
v25 = *(_DWORD *)(v3 + 28) + *(_DWORD *)(v3 + 20);
if ( a3 >> 2 > 1 )
{
v26 = (unsigned __int8)v22;
v10 = v8 - v6;
v11 = v6 + 4;
for ( i = v8 - v6; ; v10 = i )
{
v12 = *(_DWORD *)(v10 + v11);
v21 += v12;
v14 = (unsigned __int8)cryptTable[2 * (unsigned __int8)v26];
v13 = v7 & 3;
if ( !(v7 & 3) )
break;
if ( v13 == 1 )
{
v16 = v14 >> 1;
goto LABEL_18;
}
if ( v13 == 2 )
{
*(_DWORD *)v11 = v12 + 2 * v14;
goto LABEL_20;
}
if ( v13 == 3 )
{
v16 = v14 >> 2;
LABEL_18:
v15 = v12 - v16;
LABEL_19:
*(_DWORD *)v11 = v15;
}
LABEL_20:
v17 = *(_DWORD *)v11 + v19;
++v7;
v11 += 4;
v19 = v17;
++v26;
if ( v7 >= a3 >> 2 )
{
v3 = v24;
v5 = v17;
v6 = v25;
goto LABEL_22;
}
}
v15 = v12 + 4 * v14;
goto LABEL_19;
}
LABEL_22:
*(_BYTE *)(v8 + 2) = v5 - v21;
*(_DWORD *)v6 = *(_DWORD *)v8;
*(_DWORD *)(v3 + 28) += a3;
result = 1;
}
else
{
result = 0;
}
return result;
}
signed int __cdecl somethingSize(signed int *a1)
{
signed int result; // eax@2
signed int v2; // eax@3
if ( a1 )
{
v2 = *(_WORD *)a1;
if ( (unsigned int)v2 < 0xC || v2 >= 16000 || v2 & 3 )
result = 2;
else
result = 0;
}
else
{
result = 0;
}
return result;
}
|
Here is the cryptTable. http://pastebin.com/VeTwfgPw
This is how the packet looks like decrypted and encrypted http://pastebin.com/4wZJSViS
Wondering if anyone can simplify this for me so I can understand it, I want to create a bot for this game.
Thanks I appreciate it.
_________________
|
|
| Back to top |
|
 |
Cheat Engine User
Something epic
![]() Reputation: 60
Joined: 22 Jun 2007
Posts: 2071
|
| Posted: Mon Apr 11, 2011 8:20 am Post subject: |
|
|
Anyone else took a look at this?
Is it just me or does somethingSize always return 2?
What is this name based on?
Edit: This is retarded bullshit, I mean, have you even looked at it?
|
|
| Back to top |
|
|
AhMunRa
Grandmaster Cheater Supreme
![]() Reputation: 27
Joined: 06 Aug 2010
Posts: 1117
|
| Posted: Mon Apr 11, 2011 10:27 am Post subject: |
|
|
What does that code look like without running it through hexrays.
Because the var names are not meaningful that is why you are having a hard time seeing what its doing. I know I am.
_________________
<Wiccaan> Bah that was supposed to say 'not saying its dead' lol. Fixing >.> |
|
| Back to top |
|
|
atom0s
Moderator
 Reputation: 205
Joined: 25 Jan 2006
Posts: 8585
Location: 127.0.0.1
|
| Posted: Mon Apr 11, 2011 2:44 pm Post subject: |
|
|
Not much we can do for you without knowing more info about the functions.
You are better off just hooking the functions as well rather then trying to emulate the encryption yourself.
For encryption; just hook the function and allow the function to call the original, then store the results where you need to use it at.
Psuedo example:
| Code: | function encrypt( packet )
{
// do whatever to the packet before its encrypted here..
encrypted_data = original_encrypt( packet );
// do whatever you need to the packet afterward here..
return encrypted_data;
} |
Psuedo example:
| Code: | function decrypt( packet )
{
decrypted_data = original_decrypt( packet );
// do whatever you need to the packet here etc..
return decrypted_data;
} |
_________________
- Retired. |
|
| Back to top |
|
|
pkedpker
Master Cheater
![]() Reputation: 1
Joined: 11 Oct 2006
Posts: 412
|
| Posted: Mon Apr 11, 2011 7:09 pm Post subject: |
|
|
yes, I tried hooking it and it crashes my game.. plus the game uses xTrap so... yeah memory modifications to the game what so ever restarts your computer.., so if even I hook it properly I'll only get to use it for 5-8 minutes.
I got xTrap disabled and I can run the game for 5-8 minutes without disconnection from game.
I'm trying to emulate the encryption so I can create a proxy sniffer for now.. then transform it into a little hack and bot.
If I have to hook it here is what I have to hook.
| Code: |
00421261 8B0D 5891B500 MOV ECX,DWORD PTR DS:[B59158]
00421267 6A 00 PUSH 0
00421267 6A 00 PUSH 0
00421269 56 PUSH ESI ; Size of packet
0042126A 57 PUSH EDI ; Pointer to raw packet data
0042126B E8 D0FDFEFF CALL game.00411040 ; this is encryption+send
00421270 5F POP EDI
00421271 5E POP ESI
00421272 \. C2 0800 RETN 8
|
yah wtf is DWORD PTR DS:[B59168] some random value?
this is the call which encrypts+send
it has 3 calls to encryption of packet. Probably why the encryption has some argument for depending which kind of packet format it is.
| Code: |
00411040 /$ 56 PUSH ESI
00411041 |. 8BF1 MOV ESI,ECX
00411043 |. 817E 3C 762200>CMP DWORD PTR DS:[ESI+3C],2276
0041104A |. 75 53 JNZ SHORT game.0041109F
0041104C |. A1 608D5F00 MOV EAX,DWORD PTR DS:[5F8D60]
00411051 |. 85C0 TEST EAX,EAX
00411053 |. 74 4A JE SHORT game.0041109F
00411055 |. 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10]
00411059 |. 85C0 TEST EAX,EAX
0041105B |. 74 42 JE SHORT game.0041109F
0041105D |. 8B46 1C MOV EAX,DWORD PTR DS:[ESI+1C]
00411060 |. 8B56 28 MOV EDX,DWORD PTR DS:[ESI+28]
00411063 |. 2BC2 SUB EAX,EDX
00411065 |. 3D 803A0000 CMP EAX,3A80
0041106A |. 7E 1C JLE SHORT game.00411088
0041106C |. 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]
00411070 |. 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8]
00411074 |. 51 PUSH ECX ; /Arg2
00411075 |. 52 PUSH EDX ; |Arg1
00411076 |. 8BCE MOV ECX,ESI ; |
00411078 |. E8 53FCFFFF CALL game.00410CD0 ; \Encrypt Packet
0041107D |. 8BCE MOV ECX,ESI
0041107F |. E8 3CFEFFFF CALL game.00410EC0
00411084 |. 5E POP ESI
00411085 |. C2 0C00 RETN 0C
00411088 |> 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C]
0041108C |. 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8]
00411090 |. 50 PUSH EAX ; /Arg2
00411091 |. 51 PUSH ECX ; |Arg1
00411092 |. 8BCE MOV ECX,ESI ; |
00411094 |. E8 37FCFFFF CALL game.00410CD0 ; \Encrypt Packet
00411099 |. 33C0 XOR EAX,EAX
0041109B |. 5E POP ESI
0041109C |. C2 0C00 RETN 0C
0041109F |> 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C]
004110A3 |. 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
004110A7 |. 52 PUSH EDX ; /Arg2
004110A8 |. 50 PUSH EAX ; |Arg1
004110A9 |. 8BCE MOV ECX,ESI ; |
004110AB |. E8 20FCFFFF CALL game.00410CD0 ; \Encrypt Packet
004110B0 |. 8BCE MOV ECX,ESI
004110B2 |. E8 09FEFFFF CALL game.00410EC0 ; Send packet
004110B7 |. 5E POP ESI
004110B8 \. C2 0C00 RETN 0C
|
Here is the actual encryption code
| Code: |
00410CD0 /$ 83EC 14 SUB ESP,14
00410CD3 |. 53 PUSH EBX
00410CD4 |. 56 PUSH ESI
00410CD5 |. 8BF1 MOV ESI,ECX
00410CD7 |. 897424 14 MOV DWORD PTR SS:[ESP+14],ESI
00410CDB |. 833E 00 CMP DWORD PTR DS:[ESI],0
00410CDE |. 0F86 91010000 JBE game.00410E75
00410CE4 |. 8B5C24 24 MOV EBX,DWORD PTR SS:[ESP+24]
00410CE8 |. 83FB 0C CMP EBX,0C
00410CEB |. 0F82 84010000 JB game.00410E75
00410CF1 |. 81FB 803E0000 CMP EBX,3E80
00410CF7 |. 0F8D 78010000 JGE game.00410E75
00410CFD |. 8B46 1C MOV EAX,DWORD PTR DS:[ESI+1C]
00410D00 |. 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4]
00410D03 |. 03C3 ADD EAX,EBX
00410D05 |. 3BC1 CMP EAX,ECX
00410D07 |. 0F8D 68010000 JGE game.00410E75
00410D0D |. E8 B11C1A00 CALL game.005B29C3 ; calls rand() / random byte
00410D12 |. 25 FF000080 AND EAX,800000FF
00410D17 |. 79 07 JNS SHORT game.00410D20
00410D19 |. 48 DEC EAX
00410D1A |. 0D 00FFFFFF OR EAX,FFFFFF00
00410D1F |. 40 INC EAX
00410D20 |> 66:33C9 XOR CX,CX
00410D23 |. 884424 0C MOV BYTE PTR SS:[ESP+C],AL
00410D27 |. 8AC8 MOV CL,AL
00410D29 |. 66:394E 40 CMP WORD PTR DS:[ESI+40],CX
00410D2D |. 75 19 JNZ SHORT game.00410D48
00410D2F |. FEC0 INC AL
00410D31 |. 25 FF000000 AND EAX,0FF
00410D36 |. 25 FF000080 AND EAX,800000FF
00410D3B |. 79 07 JNS SHORT game.00410D44
00410D3D |. 48 DEC EAX
00410D3E |. 0D 00FFFFFF OR EAX,FFFFFF00
00410D43 |. 40 INC EAX
00410D44 |> 884424 0C MOV BYTE PTR SS:[ESP+C],AL
00410D48 |> 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]
00410D4C |. 66:33D2 XOR DX,DX
00410D4F |. 55 PUSH EBP
00410D50 |. 57 PUSH EDI
00410D51 |. 8B7C24 28 MOV EDI,DWORD PTR SS:[ESP+28]
00410D55 |. 8AD0 MOV DL,AL
00410D57 |. 81E1 FF000000 AND ECX,0FF
00410D5D |. 66:8956 40 MOV WORD PTR DS:[ESI+40],DX ; stores random crypt counter
00410D61 |. 57 PUSH EDI
00410D62 |. 8A144D 60895F0>MOV DL,BYTE PTR DS:[ECX*2+5F8960] ; access crypt with random crypt counter
00410D69 |. 66:891F MOV WORD PTR DS:[EDI],BX
00410D6C |. 8847 03 MOV BYTE PTR DS:[EDI+3],AL
00410D6F |. A1 102EB500 MOV EAX,DWORD PTR DS:[B52E10]
00410D74 |. 8947 08 MOV DWORD PTR DS:[EDI+8],EAX
00410D77 |. 8B0D 102EB500 MOV ECX,DWORD PTR DS:[B52E10] ; DWORD_b52e10 wtf is this = 0x00012A57
00410D7D |. 885424 1C MOV BYTE PTR SS:[ESP+1C],DL
00410D81 |. 890D 142EB500 MOV DWORD PTR DS:[B52E14],ECX
00410D87 |. E8 24350100 CALL game.004242B0 ; somethingSize function
00410D8C |. 8B4E 14 MOV ECX,DWORD PTR DS:[ESI+14]
00410D8F |. 8B6E 1C MOV EBP,DWORD PTR DS:[ESI+1C]
00410D92 |. 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C]
00410D96 |. 03CD ADD ECX,EBP
00410D98 |. C1FB 02 SAR EBX,2
00410D9B |. BD 01000000 MOV EBP,1
00410DA0 |. 83C4 04 ADD ESP,4
00410DA3 |. 33D2 XOR EDX,EDX
00410DA5 |. 25 FF000000 AND EAX,0FF
00410DAA |. 3BDD CMP EBX,EBP
00410DAC |. C74424 14 0000>MOV DWORD PTR SS:[ESP+14],0
00410DB4 |. 895424 10 MOV DWORD PTR SS:[ESP+10],EDX
00410DB8 |. 894C24 20 MOV DWORD PTR SS:[ESP+20],ECX
00410DBC |. 0F8E 8B000000 JLE game.00410E4D
00410DC2 |. 894424 28 MOV DWORD PTR SS:[ESP+28],EAX
00410DC6 |. 8BC7 MOV EAX,EDI
00410DC8 |. 2BC1 SUB EAX,ECX
00410DCA |. 8D51 04 LEA EDX,DWORD PTR DS:[ECX+4]
00410DCD |. 894424 18 MOV DWORD PTR SS:[ESP+18],EAX
00410DD1 |. EB 04 JMP SHORT game.00410DD7
00410DD3 |> 8B4424 18 /MOV EAX,DWORD PTR SS:[ESP+18] ; this loop transforms packet
00410DD7 |> 8B0410 MOV EAX,DWORD PTR DS:[EAX+EDX]
00410DDA |. 8B7424 14 |MOV ESI,DWORD PTR SS:[ESP+14]
00410DDE |. 03F0 |ADD ESI,EAX
00410DE0 |. 33C9 |XOR ECX,ECX
00410DE2 |. 897424 14 |MOV DWORD PTR SS:[ESP+14],ESI
00410DE6 |. 8B7424 28 |MOV ESI,DWORD PTR SS:[ESP+28]
00410DEA |. 81E6 FF000000 |AND ESI,0FF
00410DF0 |. 8A0C75 61895F0>|MOV CL,BYTE PTR DS:[ESI*2+5F8961]
00410DF7 |. 8BF1 |MOV ESI,ECX
00410DF9 |. 8BCD |MOV ECX,EBP
00410DFB |. 83E1 03 |AND ECX,3
00410DFE |. 75 05 |JNZ SHORT game.00410E05
00410E00 |. 8D04B0 |LEA EAX,DWORD PTR DS:[EAX+ESI*4]
00410E03 |. EB 1F |JMP SHORT game.00410E24
00410E05 |> 83F9 01 |CMP ECX,1
00410E08 |. 75 04 |JNZ SHORT game.00410E0E
00410E0A |. D1FE |SAR ESI,1
00410E0C |. EB 14 |JMP SHORT game.00410E22
00410E0E |> 83F9 02 |CMP ECX,2
00410E11 |. 75 07 |JNZ SHORT game.00410E1A
00410E13 |. 8D0C70 |LEA ECX,DWORD PTR DS:[EAX+ESI*2]
00410E16 |. 890A |MOV DWORD PTR DS:[EDX],ECX
00410E18 |. EB 0C |JMP SHORT game.00410E26
00410E1A |> 83F9 03 |CMP ECX,3
00410E1D |. 75 07 |JNZ SHORT game.00410E26
00410E1F |. C1FE 02 |SAR ESI,2
00410E22 |> 2BC6 |SUB EAX,ESI
00410E24 |> 8902 |MOV DWORD PTR DS:[EDX],EAX
00410E26 |> 8B02 |MOV EAX,DWORD PTR DS:[EDX]
00410E28 |. 8B4C24 10 |MOV ECX,DWORD PTR SS:[ESP+10]
00410E2C |. 8B7424 28 |MOV ESI,DWORD PTR SS:[ESP+28]
00410E30 |. 03C8 |ADD ECX,EAX
00410E32 |. 45 |INC EBP
00410E33 |. 46 |INC ESI
00410E34 |. 83C2 04 |ADD EDX,4
00410E37 |. 3BEB |CMP EBP,EBX
00410E39 |. 894C24 10 |MOV DWORD PTR SS:[ESP+10],ECX
00410E3D |. 897424 28 |MOV DWORD PTR SS:[ESP+28],ESI
00410E41 |.^7C 90 \JL SHORT game.00410DD3
00410E43 |. 8B7424 1C MOV ESI,DWORD PTR SS:[ESP+1C]
00410E47 |. 8BD1 MOV EDX,ECX
00410E49 |. 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20]
00410E4D |> 8A5C24 14 MOV BL,BYTE PTR SS:[ESP+14]
00410E51 |. 8B4424 2C MOV EAX,DWORD PTR SS:[ESP+2C]
00410E55 |. 2AD3 SUB DL,BL
00410E57 |. 8857 02 MOV BYTE PTR DS:[EDI+2],DL
00410E5A |. 8B17 MOV EDX,DWORD PTR DS:[EDI]
00410E5C |. 8911 MOV DWORD PTR DS:[ECX],EDX
00410E5E |. 8B4E 1C MOV ECX,DWORD PTR DS:[ESI+1C]
00410E61 |. 03C8 ADD ECX,EAX
00410E63 |. 5F POP EDI
00410E64 |. 894E 1C MOV DWORD PTR DS:[ESI+1C],ECX
00410E67 |. 5D POP EBP
00410E68 |. 5E POP ESI
00410E69 |. B8 01000000 MOV EAX,1
00410E6E |. 5B POP EBX
00410E6F |. 83C4 14 ADD ESP,14
00410E72 |. C2 0800 RETN 8
00410E75 |> 5E POP ESI
00410E76 |. 33C0 XOR EAX,EAX
00410E78 |. 5B POP EBX
00410E79 |. 83C4 14 ADD ESP,14
00410E7C \. C2 0800 RETN 8
|
supporting functions calls from encryption above
here is the rand() call
| Code: |
005B29C3 E8 DB370000 CALL game.005B61A3 ;this is useless, has api calls like GetCurrentThreadId/Tls[Set/Get]Value/TlsAlloc
005B29C8 |. 8B48 14 MOV ECX,DWORD PTR DS:[EAX+14]
005B29CB |. 69C9 FD430300 IMUL ECX,ECX,343FD
005B29D1 |. 81C1 C39E2600 ADD ECX,269EC3
005B29D7 |. 8948 14 MOV DWORD PTR DS:[EAX+14],ECX
005B29DA |. 8BC1 MOV EAX,ECX
005B29DC |. C1E8 10 SHR EAX,10
005B29DF |. 25 FF7F0000 AND EAX,7FFF
005B29E4 \. C3 RETN
|
this is the SomethingSize function.. pretty short used by encryption to return 2/0 unknown use something with packet size.
| Code: |
004242B0 /$ 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]
004242B4 |. 85C9 TEST ECX,ECX
004242B6 |. 75 03 JNZ SHORT game.004242BB
004242B8 |. 33C0 XOR EAX,EAX
004242BA |. C3 RETN
004242BB |> 33C0 XOR EAX,EAX
004242BD |. 66:8B01 MOV AX,WORD PTR DS:[ECX]
004242C0 |. 83F8 0C CMP EAX,0C
004242C3 |. 72 0E JB SHORT game.004242D3
004242C5 |. 3D 803E0000 CMP EAX,3E80
004242CA |. 7D 07 JGE SHORT game.004242D3
004242CC |. A8 03 TEST AL,3
004242CE |. 75 03 JNZ SHORT game.004242D3
004242D0 |. 33C0 XOR EAX,EAX
004242D2 |. C3 RETN
004242D3 |> B8 02000000 MOV EAX,2
004242D8 \. C3 RETN
|
It shouldn't be to hard to transform it into readable code it's not that large.. I just have very little understanding of assembly.
Maybe you guys can see something... thanks
_________________
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
