0

Here are the packets when sending a sit command in the game... It seems like the first 2 bytes are the checksum of the packet. They seem to change every time regardless of whatever you are doing that is sent to the server. (eg. Chat, Cast a skill, show an emoticon, sit, etc.)

It's always a 2-byte checksum. Here are the data that I captured using WireShark... I want to know how to calculate the next 2-byte header of the data and have the correct value for it.

These data are when doing all the same actions (sitting). HEX and ASCII Dump

SIT PACKET 1
0000   2c b0 5d 34 17 db 00 26 b9 80 0b 9d 08 00 45 00  ,.]4...&......E.
0010   00 2f 65 43 40 00 80 06 b8 48 c0 a8 01 02 95 38  ./eC@....H.....8
0020   86 5a c7 90 14 01 f0 48 43 8d 4e cb 2f 82 50 18  .Z.....HC.N./.P.
0030   f7 d2 14 f3 00 00 36 0d 00 00 00 00 02           ......6......

SIT PACKET 2
0000   2c b0 5d 34 17 db 00 26 b9 80 0b 9d 08 00 45 00  ,.]4...&......E.
0010   00 2f 65 68 40 00 80 06 b8 23 c0 a8 01 02 95 38  ./eh@....#.....8
0020   86 5a c7 90 14 01 f0 48 43 a1 4e cb 2f ed 50 18  .Z.....HC.N./.P.
0030   f7 67 84 79 00 00 c6 72 00 00 00 00 02           .g.y...r.....

SIT PACKET 3
0000   2c b0 5d 34 17 db 00 26 b9 80 0b 9d 08 00 45 00  ,.]4...&......E.
0010   00 2f 65 71 40 00 80 06 b8 1a c0 a8 01 02 95 38  ./eq@..........8
0020   86 5a c7 90 14 01 f0 48 43 af 4e cb 30 52 50 18  .Z.....HC.N.0RP.
0030   f7 02 67 68 00 00 e3 75 00 00 00 00 02           ..gh...u.....

SIT PACKET 4
0000   2c b0 5d 34 17 db 00 26 b9 80 0b 9d 08 00 45 00  ,.]4...&......E.
0010   00 2f 65 77 40 00 80 06 b8 14 c0 a8 01 02 95 38  ./ew@..........8
0020   86 5a c7 90 14 01 f0 48 43 bd 4e cb 30 b7 50 18  .Z.....HC.N.0.P.
0030   f6 9d 0c b8 00 00 3e 18 00 00 00 00 02           ......>......

There are only some bytes that change over these packets. I have no clue how they change. Any help would be appreciated.

Here is the summary of the packets without the long headers

2638    2017-04-09 22:00:33.012491  192.168.1.2 149.56.134.90   TCP 61  51088 → 5121 [PSH, ACK] Seq=143 Ack=14088 Win=63442 Len=7
        DATA= 36 0d 00 00 00 00 02 

2705    2017-04-09 22:00:46.761956  192.168.1.2 149.56.134.90   TCP 61  51088 → 5121 [PSH, ACK] Seq=163 Ack=14195 Win=63335 Len=7
        DATA= c6 72 00 00 00 00 02 

2721    2017-04-09 22:00:49.245309  192.168.1.2 149.56.134.90   TCP 61  51088 → 5121 [PSH, ACK] Seq=177 Ack=14296 Win=63234 Len=7
        DATA= e3 75 00 00 00 00 02 

2734    2017-04-09 22:00:51.595100  192.168.1.2 149.56.134.90   TCP 61  51088 → 5121 [PSH, ACK] Seq=191 Ack=14397 Win=63133 Len=7
        DATA= 3e 18 00 00 00 00 02 

DATA SUMMARY w/o HEADERS

DATA: [LEN=7]
36 0d 00 00 00 00 02 
c6 72 00 00 00 00 02
e3 75 00 00 00 00 02 
3e 18 00 00 00 00 02 

I have no clue how simple or how complex the function that they used. It's an old game, 2002. I hope you can help me out. Kind of interested in how they work.

Thanks!

EDIT

Found this one on the file system

MD5 : 30ab84af7ae4120cd03e002b797cadac 
SHA1: 0f5fdf0899d75f1ad6f4ae190335a311783e8f18 
CRC32(dec): 1864969028 
CRC32(hex): 6F292B44

EDIT

Binary of the 2-byte check
36 0d = 0011 0110 0000 1101
c6 72 = 1100 0110 0111 0010
e3 75 = 1110 0011 0111 0101
3e 18 = 0011 1110 0001 1000

It seems that the MSB of the 2nd byte is always 0. I tested it on other commands and it is consistently zero.

  • 2
    Did you consider reversing the binary generating the packets? Hoestly, there isn't much to go on here. Also. could you give examples including packages and their checksums? – Nordwald Apr 10 '17 at 5:24
  • I'm still trying to look for the one generating the packets... Those 2 bytes are the only data that I can reference to and they are consistent in showing up throughout every sent command in the game. – J. Salonga Apr 10 '17 at 8:19
  • I found this one on the file system: MD5 : 30ab84af7ae4120cd03e002b797cadac SHA1: 0f5fdf0899d75f1ad6f4ae190335a311783e8f18 CRC32(dec): 1864969028 CRC32(hex): 6F292B44 does this help? – J. Salonga Apr 10 '17 at 9:07
  • 2
    I'm not sure how this is supposed to help. Can you provide the binary itself? – Nordwald Apr 10 '17 at 11:55
  • I provided the binary of the checksums above... doubt it would help though. For the packets itself, it seems like i can't copy the raw binary version of the packets with its header. How can we go about this? – J. Salonga Apr 10 '17 at 14:55

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.