# Understanding packet byte structures with OllyDbg

I have written a small dll that detours the function that decrypts and encrypts game packets allowing me to see the packets being sent and received.

Packets like login are easy to structure because it usually only contains username and password, character selection too is somewhat easy, some in-game packets like movement is also easy to understand because it just contains some x, y data.

But problem is there is a few other packets that are more than 1000 bytes long and there is really no way of knowing what each byte mean, like let us say the packet received as soon as you enter the world. Few parts of the packet is showing characterId, name, some stats, inventory data but there are some parts that are just 00 00 00 00 and I don't know what to make of them of even if how many bytes they are actually.

So when hooking the client with olly, I try to step through when receiving packets to find where it actually structures the bytes. But to no avail.

Question: Is there a better way to finding how many bytes are structured on the packet?

Example:

Login Packet
char 16
char 16


Doesnt matter really what is it for, as long as I know how many bytes it should be.

Cheers,

edit

Saw this tutorial but in IDA... will try later and give feedback here.

• Yes, I'm using 2.01 :)... Thanks I'll try this later tonight. I hope you'll elaborate on analyse program behaviour as what I expect the program will do to each byte. – majidarif Aug 7 '14 at 8:13