TL.exe hacking one more try...

[jenose]

interesting.

 

[P5yl0]

wow.. very nice
i understan...d cause of this i send 2 times serverlist then it was enough time to reply...

but i was stuck at the last process... it wasnt starting the game...
hmm..
and yes it would be nice if you could upload it ...

 

[ulysse3131]

Sure, tomorrow I'll clean up the code a bit and upload the solution.
On a side note, if you get a endpopup message the whole starting TERA algorythm from TL.exe stops, even if it asks for gamestr on second sls sent.

 

[Aquanox]

Okay. I am finished, My launcher now works and TERA.exe starts and logs in correctly, i can then play the game on official servers.

Congratz

I am surprised, I don't understand why TERA-launcher.exe sends "http://sls.service.enmasse.com:8080/servers/list.en" to TL.exe
TL.exe does not open internet connection it doesn't need this url.

TERA-Launcher is a Publisher-specific Launcher (BHS give them very small API to operate) It keep user web session id and provide data for real launcher
TL.exe as a "real" launcher "asks" publisher launcher for server list address and user account info from publisher.

The protocol for launchers looks like:

KTERA TL.exe <~8 commands> TERA.exe
NA/EU TeraLauncher <~3 commands> TL.exe <~8 commands> TERA.exe

gameEvent(xxx) are just various notifications ( game start/end/crash ) forwarded and can be ignored

The only requirenments to emulate launcher (and work with TERA.exe directly) are valid WindowClass/WindowTitle and launch TERA.exe as subprocess.
From protocol: implement handshake between CustomTL and TERA, token request and server list request. (they use profobuf inside)
I could also make custom PublisherLauncher but working directly with TERA.exe much better.

To fully analyze "what is happening" in between them I used easyhook and patched SendMessageA/PostMessageA + added WndProc proxy (via GWL_WNDPROC) to all processes from injected to them dll.
Also DebugView output of launcher is very useful

 

[ulysse3131]

github :

You must be registered to see links

you need a valid ticket if you intend for TERA.exe to fully login.

To fully analyze "what is happening" in between them I used easyhook and patched SendMessageA/PostMessageA + added WndProc proxy (via GWL_WNDPROC) to all processes from injected to them dll.
Also DebugView output of launcher is very useful

Cool tools

 

[P5yl0]

whoa...
wtf...

i dont know what the problem was.. with my C# Version
but it dont wanted to work after the slsurl^^

i go it now to work...
but im stuck now at endpop(274) too..
as far as i know 274 is Ini Error...???

could it be that the gamestring is wrong in some way...?


PS:
Okay poop...
I got it...
Dont know where the mistake now was ^^ but from one second to the next it works...
Game is Starting...
yeahhh....^^

 

[ulysse3131]

Nice

 

[P5yl0]

*lol*
after we got the WM poop done to start the EU/NA ^^
i started before to try running the RUS Client with the EU/NA TL.exe file.. but run into some endpopup(6) and other endpopups^^
i thinks its some gamestring problem only...
so i thaught ok lets capture the RU launcher file with spy++ ^^
but i forgot i worked before on the RUS launcher files and edited the launcher.ini to localhost...
so i thaught okay.. lets delete the file, maybe the launcher will create a new one...
and what happened..
*lol*

[/IMG]