Emulation Project - GameGuard Protected Client

Question

I'm not new to MMO Server Emulation, but I am new to working with a protected Client, and have very basic RCE skills. I would appreciate some direction, and maybe this won't be possible, given the requirements.

The target is Uncharted Waters Online, now published by Papaya Play, utilizing GameGuard (instead of X-Trap, as the previous publisher).

Two Priorities:

1. Prevent the Client from loading or attempting to refer to GameGuard.
2. Understand the client-server communication through Packet Analysis. Obviously, impossible with Encrypted Packets.

My Questions:

1. How entrenched is GameGuard? Will simply bypassing the loading routines be enough?? Or must I allow it to load, but Bypass all the functions that it alters? Obviously, I would like the Client to not have to load GameGuard when accessing the Emulated Server.

2. Encrypted Packets. A major task will be to see the unencrypted packet contents while connected to Live Servers. Does anyone have experience with this? My thoughts are to find and detour the encryption and decryption functions, to output the raw packet information somewhere else. Is this a viable approach? Is this practical, or is there an easier way for me to understand the network communication?

Thanks all. All I'm looking for is an approach. I can research on my own how to achieve that, but at this point, I don't know enough about GameGuard and Reversing Packet Encryption to know where to start.

Answer 1

Game hacker here.

To address your first question, forums like ElitePVPers, OwnedCore, UnknownCheats, MPGH, etc. are going to be your absolute best friend. The people you'll find in those places are steeped in exactly this type of reversing, so starting with a Google search like UnknownCheats GameGuard will yield results like this. That alone should give you a well-rounded summary of the technology and some of its current exploits (meaning you may not have to do very much heavy lifting on your own).

As for your second question, yes, that's a viable approach, but it can be extremely tough to find your way to decrypted data depending on how well-guarded they keep it (whether through odd Assembly instruction/sub-routine obfuscation, VMs, ridiculous looping, etc., etc.). Once again, those forums should really take you far. It sounds like you already have a good grasp on the language of reversing, so you positing questions around those places should be taken to by the more intelligent and experienced folks.

Finally, I highly recommend the book Attacking Network Protocols if that's one of the key areas that interests you with reversing.

Good luck!

Answer 2

I don't think this question will get much traction here given it's a very specific, while still being quite broad. That being said some input for general game hacking:

1. Your first step would be to figure out how the anti-cheat is being loaded: is it being streamed from a secure server, is it a DLL which is loaded at runtime, etc. Once you've found out how the anti-cheat is loaded, you can implement a workaround, i.e load order hijacking, or patching the stream routine.

2. Your assumption is correct, hooking the networking functions is easiest way of altering/decoding packets. Look for a specific function calls (i.e createsocket, send, recv etc) and work backwards from there.