2

I'm not new to MMO Server Emulation, but I am new to working with a protected Client, and have very basic RCE skills. I would appreciate some direction, and maybe this won't be possible, given the requirements.

The target is Uncharted Waters Online, now published by Papaya Play, utilizing GameGuard (instead of X-Trap, as the previous publisher).

Two Priorities:

  1. Prevent the Client from loading or attempting to refer to GameGuard.
  2. Understand the client-server communication through Packet Analysis. Obviously, impossible with Encrypted Packets.

My Questions:

  1. How entrenched is GameGuard? Will simply bypassing the loading routines be enough?? Or must I allow it to load, but Bypass all the functions that it alters? Obviously, I would like the Client to not have to load GameGuard when accessing the Emulated Server.

  2. Encrypted Packets. A major task will be to see the unencrypted packet contents while connected to Live Servers. Does anyone have experience with this? My thoughts are to find and detour the encryption and decryption functions, to output the raw packet information somewhere else. Is this a viable approach? Is this practical, or is there an easier way for me to understand the network communication?

Thanks all. All I'm looking for is an approach. I can research on my own how to achieve that, but at this point, I don't know enough about GameGuard and Reversing Packet Encryption to know where to start.

  • Thanks to the 2 answers and some help from another, I was able to bypass GameGuard, discover the crypt routines (Blowfish) and now I have a stream of unencrypted packets to analyze. Thank you, all! I know this is old, but I just wanted to show my appreciation. – Lokked Mar 7 '19 at 17:23
3

Game hacker here.

To address your first question, forums like ElitePVPers, OwnedCore, UnknownCheats, MPGH, etc. are going to be your absolute best friend. The people you'll find in those places are steeped in exactly this type of reversing, so starting with a Google search like UnknownCheats GameGuard will yield results like this. That alone should give you a well-rounded summary of the technology and some of its current exploits (meaning you may not have to do very much heavy lifting on your own).

As for your second question, yes, that's a viable approach, but it can be extremely tough to find your way to decrypted data depending on how well-guarded they keep it (whether through odd Assembly instruction/sub-routine obfuscation, VMs, ridiculous looping, etc., etc.). Once again, those forums should really take you far. It sounds like you already have a good grasp on the language of reversing, so you positing questions around those places should be taken to by the more intelligent and experienced folks.

Finally, I highly recommend the book Attacking Network Protocols if that's one of the key areas that interests you with reversing.

Good luck!

| improve this answer | |
1

I don't think this question will get much traction here given it's a very specific, while still being quite broad. That being said some input for general game hacking:

  1. Your first step would be to figure out how the anti-cheat is being loaded: is it being streamed from a secure server, is it a DLL which is loaded at runtime, etc. Once you've found out how the anti-cheat is loaded, you can implement a workaround, i.e load order hijacking, or patching the stream routine.

  2. Your assumption is correct, hooking the networking functions is easiest way of altering/decoding packets. Look for a specific function calls (i.e createsocket, send, recv etc) and work backwards from there.

| improve this answer | |
  • Can you point me to what win32 APIs could possibly be used to either load (LoadLibrary?) or Stream (just Send/Recv?)? – Lokked Oct 25 '17 at 16:45
  • 1
    This is where the actual reversing comes in as the game could use any number of library functions to achieve these tasks. Although it is common for games to use third party networking libraries rather than roll their own (compress/encryption is complicated). Check the games import table, and function calls for clues. Two common networking libraries are Raknet, and Oodle Network, although it could be any number of other libraries - as a general rule of thumb, if you don't know what a DLL or function does, google it. – Jacob Persi Oct 25 '17 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.