1

Target is protected by nProtect Gameguard. Packets are encrypted. Goal is to obtain unencrypted packet information via the client.

I obtained the free, 5.0 version, of IDA, and disassembled GVOnline.exe (the Uncharted Waters Launch exe). Interestingly enough, what is actually listed as running in Task Manager is NOT the exe, it is GVOnline.bin (another, much larger file in the same directory. Anyway, in the disassembled GVOnline.exe, I cannot find anything that looks like socket calls in the Imports table. No Send, Recv, or any of the other analogs.

I've created a Pastebin of the Imports: https://pastebin.com/UEtKSwSk

And here is a Pastebin of the Names: https://pastebin.com/GwMaCfVs

How could the application be sending and receiving packets, if not through these calls?

Do I need to disassemble GVOnline.bin instead of the exe?

Could it be that Gameguard itself is responsible for communicating with the Socket? If that's the case, then I'd suspect Gameguard would also be responsible for encrypting the packet payload, but I should be able to get the raw information from the software itself, as it must construct it somehow before passing it to whatever sends or encrypts it.

Thank you

Update:

It turns out that I was disassembling the wrong Binary. From a decision made in the initial executable, a second binary is opened and this is where the network calls are made. Disassembling this revealed the network calls and encryption routines.

Improve this question
3
  • 2
    Library functions can be imported based on ordinals also. Try to check the GetProcAddress function calls.
    – ebux
    Nov 13, 2017 at 6:26
  • 1
    Given the EXE imports LoadLibraryA, and LoadLibraryExA - both of which are responsible for loading a module at runtime, it's likely that the WinSocket library is dynamically loaded at runtime.
    – user15338
    Nov 13, 2017 at 18:08
  • For this specific question, I've found the answer. I'm keeping a thread going on elitepvpers.com titled "Emulation Project - Gameguard'd Client". The answer to the above is that a second process is run where network calls (along with a whole lot of other functions) are running. I was disassembling the wrong binary. I appreciate the answers, as I learned something about software protection and ordinal-based library functions. Thank you!
    – Lokked
    Nov 14, 2017 at 22:34

1 Answer 1

Reset to default
1

I'm not familiar with GameGuard in particular, but it's quite common for these types of protections to keep an encrypted import table, load the imports and construct the IAT themselves during runtime.

Usually, you could detour the functions by injecting and rewriting after the application has loaded, but seeing that GameGuard is a toolkit made precisely to stop these kinds of things, I suspect you have to get a lot more tricky.

Edit: You can look for old safedisc/cdilla and securom unpacking tutorials for an intro on these kinds of wrappers.

Improve this answer
2
  • 1
    While the correct answer is, "You are probably not disassembling the correct binary," I thank you for providing more insight on what is possible in the world of software protection.
    – Lokked
    Nov 14, 2017 at 22:36
  • Oh sorry, I thought you'd figured that part out since you mentioned the .bin file was shown in the tasklist :)
    – Tobias
    Nov 17, 2017 at 12:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.