Reverse Engineering of a packet encryption function of a game

Question

I am trying to make a game server emulator for a specific MMORPG (Perfect World). I know the basics of how the network of the game works and the structure for some packets, but they all are encrypted, except for the username in the login packet.

I am using Olly to try to find the crypt function for the packets that are send from the client to server to know how the game encrypts the data, and I need help to find the crypt function. I took some screenshots of Olly during the debugging and commented what I have analyzed in the code.

This is before I find the call to send, when I send a chat message in the game I see this:

Now, that was when I found the function which call send, and the dump for each line of this function until the send call:

I have more screenshots of the dump for the others lines but I do not have the reputation to post more than two links per time, so I will post the others later if someone wants them.

My question is, where is the crypt function? And how does it work in a language such as C++?

Answer 1

First I would run some static analysis on the application such as Findcrypt or ProtectID and PEID's Kanal plugin to scan for known static values used in various encryption algorithms. If you find something, check which function accesses them with cross referencing (X in IDA, CTRL+r in olly) and you will get to the encryption function(s) or at least very near them.

If that approach fails, you can start tracing in a dynamic debugger such as olly. You found the send function, you could start tracing back on the call stack. Select the top of the stack and click follow in disassembler, which will get you to the function that called the send function. Place a breakpoint on the top of that function. Repeat this multiple times, heading back in the call tree, and observe the variables the function is called with until you see the data to be encrypted.

In your second picture, you show the function that calls send() with the encrypted data. You should go back more levels to get near the encryption method.

Search for relevant strings in the binary (Shift+F12 in IDA), for example : "key", "crypt", "password", and cross reference to find out which function uses it.

You could also put a hardware breakpoint on the data you know will be encrypted at some point, and check where it is accessed.

Also to confirm that the application uses a static key or not, you could setup a new environment for the game with a different account on a different machine and see if the encrypted data is encrypted to the same bytes that you've found in picture 1. If it's the same, the encryption uses a static key.

Also there are a few posts about this game on ragezone and elitepvpers, if all else fails they might be able to help you :)