1

I have written a small dll that detours the function that decrypts and encrypts game packets allowing me to see the packets being sent and received.

Packets like login are easy to structure because it usually only contains username and password, character selection too is somewhat easy, some in-game packets like movement is also easy to understand because it just contains some x, y data.

But problem is there is a few other packets that are more than 1000 bytes long and there is really no way of knowing what each byte mean, like let us say the packet received as soon as you enter the world. Few parts of the packet is showing characterId, name, some stats, inventory data but there are some parts that are just 00 00 00 00 and I don't know what to make of them of even if how many bytes they are actually.

So when hooking the client with olly, I try to step through when receiving packets to find where it actually structures the bytes. But to no avail.

Question: Is there a better way to finding how many bytes are structured on the packet?

Example:

Login Packet
char 16 
char 16

Doesnt matter really what is it for, as long as I know how many bytes it should be.

Cheers,

edit

Saw this tutorial but in IDA... will try later and give feedback here.

Improve this question
1

2 Answers 2

Reset to default
3

You may try set memory breakpoint on access (read/write) on this data and see how program parse this bytes. (set breakpoint in dump window, press F9, wait when program stop, analyze program behavior -> f8 f8 f8 f8 f8 ...) . I am recommend use OllyDbg 2.01 - this is version has color highlight for breaks in dump window. sorry for my bad english

Improve this answer
1
  • Yes, I'm using 2.01 :)... Thanks I'll try this later tonight. I hope you'll elaborate on analyse program behaviour as what I expect the program will do to each byte.
    – majidarif
    Aug 7, 2014 at 8:13
2

Keep in mind that buffer after recv command might contain several packets ( or just part of one packet ). PS: most of games have similar packets structure, like: [packet id][len][crc][..data..] So, after receiving first packet, you are able to split all raw data in future to separate packets.

To my mind your 1000 bytes+ packet might be a list of mobs\items on the map, their movement etc.

Improve this answer
1
  • I've taken care of the framing. So no problems with that. Yes, it seems like this is mostly map data. So I'll need to know each bytes. I've established that the first bytes are length, id, then the content. My problem is with the content.
    – majidarif
    Aug 7, 2014 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.