7

I am trying to make a game server emulator for a specific MMORPG (Perfect World). I know the basics of how the network of the game works and the structure for some packets, but they all are encrypted, except for the username in the login packet.

I am using Olly to try to find the crypt function for the packets that are send from the client to server to know how the game encrypts the data, and I need help to find the crypt function. I took some screenshots of Olly during the debugging and commented what I have analyzed in the code.

This is before I find the call to send, when I send a chat message in the game I see this:

b

Now, that was when I found the function which call send, and the dump for each line of this function until the send call:

c

I have more screenshots of the dump for the others lines but I do not have the reputation to post more than two links per time, so I will post the others later if someone wants them.

My question is, where is the crypt function? And how does it work in a language such as C++?

Improve this question
0

1 Answer 1

Reset to default
10

First I would run some static analysis on the application such as Findcrypt or ProtectID and PEID's Kanal plugin to scan for known static values used in various encryption algorithms. If you find something, check which function accesses them with cross referencing (X in IDA, CTRL+r in olly) and you will get to the encryption function(s) or at least very near them.

If that approach fails, you can start tracing in a dynamic debugger such as olly. You found the send function, you could start tracing back on the call stack. Select the top of the stack and click follow in disassembler, which will get you to the function that called the send function. Place a breakpoint on the top of that function. Repeat this multiple times, heading back in the call tree, and observe the variables the function is called with until you see the data to be encrypted.

In your second picture, you show the function that calls send() with the encrypted data. You should go back more levels to get near the encryption method.

Search for relevant strings in the binary (Shift+F12 in IDA), for example : "key", "crypt", "password", and cross reference to find out which function uses it.

You could also put a hardware breakpoint on the data you know will be encrypted at some point, and check where it is accessed.

Also to confirm that the application uses a static key or not, you could setup a new environment for the game with a different account on a different machine and see if the encrypted data is encrypted to the same bytes that you've found in picture 1. If it's the same, the encryption uses a static key.

Also there are a few posts about this game on ragezone and elitepvpers, if all else fails they might be able to help you :)

Improve this answer
2
  • thanks for helping but the findcript found nothing. I've selected the top of the function which call send and placed a breakpoint on the top but not work again. The only way that i've found something it's when i set a memory/harware breakpoint on the data that will be encrypted, i'm going to a piece of code where looks like that are a looping function that subtract the chat message like "hello", "ello", "llo" and so on, but i can't find any logic on the code of that function
    – Renan Moura
    May 16, 2015 at 11:43
  • 1
    Did you try all the detection tools or only findcrypt? It's absolutely possible that they don't detect anything, but there's still something. What do you mean by "but not work again" ? When you see the looping, it's probably copying that data to another buffer, you should observe where it is being copied to and place a HW breakpoint on that too. It will probably be used for encryption a little bit later. Please edit your question with your progress with as much details as you can.
    – Dominik Antal
    May 18, 2015 at 13:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.