1

I want to learn something about reverse engineering.

I want to rebuild the TeamSpeak connection (client connects to server).

I hooked the recv and send + encrypt/decrypt functions and logged the following:

SEND_CRYPT: clientinitiv alpha=5KPOgZDgbleuNw== omega=MEwDAgcAAgEgAiBHsn4CYlt90fs0G1sEnx0nmGPfQYMwegBrhzD3yKj3xAIhAKmF+INBCx3rP6FPHq5XfEQt2RFDHdan9EhyZwaziDrV ip=52.28.46.214
RECV_CRYPT: initivexpand alpha=5KPOgZDgbleuNw== beta=xauLd710Z+FpNA== omega=MEsDAgcAAgEgAiAeZO7JB+dpowIKbjBiTtovildErI2tDPRfMmgBBF\/h5AIgLkw8l3NXolC6nzuMltP3dbewY0hLzMnEK38uhl0N20w=
SEND_CRYPT: clientinit client_nickname=zodiac client_version=3.0.18.2\s[Build:\s1445512488] client_platform=Windows client_input_hardware=1 client_output_hardware=1 client_default_channel client_default_channel_password client_server_password client_meta_data client_version_sign=F0hY25Dtja0wcU6dzC39rNuYbhnDAbIwPHC3VO9Oicf13kUY2I2g6scPZ3p195Cw9gUYdBIRYm8ucHEhtSeWCw== client_key_offset=104 client_nickname_phonetic client_default_token client_badges=Overwolf=0 hwid=c7b85b27969edb59fc3103155deb11fb
SEND_CRYPT: ,3e8bfb43b3abf4f6331ebd6d65523eeb
RECV_CRYPT: ‘—

Teamspeak encrypts with AES the network traffic so alpha/omega are probably the keys for that.

I also sniffed the traffic:

enter image description here

I tried in Delphi to simply send this:

clientinitiv alpha=5KPOgZDgbleuNw== omega=MEwDAgcAAgEgAiBHsn4CYlt90fs0G1sEnx0nmGPfQYMwegBrhzD3yKj3xAIhAKmF+INBCx3rP6FPHq5XfEQt2RFDHdan9EhyZwaziDrV ip=52.28.46.214

as an udp packet to the server, but didn't get a response.

I hope someone can explain me how I can figure out what to send and what each packet does/contains.

Thanks!

Improve this question
2
  • If it were a sensible crypto protocol then alpha and omega wouldn't themselves be the keys, they'd be using e.g. Diffie-Hellman Key Exchange to agree a shared key without ever transmitting it, and alpha, beta and omega would be components of that. Note however that the command could be read as 'init IV', where IV usually means Initialization Vector, and that an IV or AES key here would normally be 128, 192 or 256 bits (=32,48,64 bytes) whereas e.g. alpha is 10, first omega 78, second 77.
    – Rup
    Commented Apr 19, 2016 at 8:33
  • I think you might do better to work out how it generates these values or processes the response if you can reverse-engineer that out of the client. Alternatively try and capture many traces and look for common patterns, e.g. do some bytes in either parameter crease slowly and so might be a time stamp? Here your two omega values start with the same 10 bytes: is that always true? Might that mean something? etc.
    – Rup
    Commented Apr 19, 2016 at 8:34

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.