I am reversing an old Path of Exile client with the purpose of building an emulator. I managed to reach the character select screen in a newer, 64-bit client but I am struggling to make the same progress in an older 32-bit client. FWIW they use the same encryption setup, CryptoPP library and Salsa20 with public key encryption. I'm just trying to NOP the encrypt functions so I can ignore it.
I found function calls to Call EDX
both shortly before send
and shortly after recv
and these are the only function calls that seem likely to be crypt related. After NOPing the two functions, I did indeed confirm that the first login packet sends the username in plaintext so I think my encryption skip is good. But the client crashes upon receiving my second server packet. The unmodified client complains at this point about being unable to deserialise the packet I am sending.
I am referencing a huge (600MB) collection of decrypted packets someone very generously shared with me in order to craft my server responses.
My question is this - where should I look next? I am thinking of setting API Monitor to just watch every call made by the exe to see the last few things that happen as so far I've only been monitoring the network related calls. Or should I first confirm that the calls I'm NOPing are the only crypt related functions? I'm still new to this and unsure where my time is best spent. Thanks for any general insight you can provide!