So I was coming on this forum after several month because I am trying to code a Tera launcher.. And i thought I might check existing project, what a lucky day, you are on it at the exact same moment !
Anyhow, i am not sure what you are doing exactly (I guess you coded launcher https transfers and now try to launch the standard tl.exe ?)
What I have :
I am at ease with c++ (it's my main language)
I know how to suspend themida functions from tl.exe + TERA.exe so that you can use procmon (that didn't help me tho).
I have the TeraLauncher https transfers working, thus I get my login ticket and account master name.
I have reversed the wm_copydata messages, launcher sends 3 to TL.exe.
I am in process of reversing the Launcher.exe <--> TL.exe relationship
1/Launcher starts process TL.exe with CreateProcess in a suspended state.
2/Launcher resumes the TL.exe first thread.
... Some stuff happens here, not sure what exactly
3°/Launcher sends TL.exe copydata messages as such :
1:
Hello!!size: 0x8data type: 0x0dbadb0a
2:
You must be registered to see links
0x34data type: 0x00000002
3:
{"last_connected_server_id":40xx,"chars_per_server":{},"account_bits":"0x00000000","ticket":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","result-message":"OK","result-code":200,"user_permission":0,"game_account_name":"TERA","access_level":0,"master_account_name":"xxxxxxxxx"}
size: 0x11d
data type: 0x04
My problem is that when i launch TL.exe right now, it gives me SSNL error (i am guessing it is because i need to create the adequate window on my launcher for TL.exe to communicate to, the window that probably has one of these names :
SSNHostWindow
???????d???!???????? <- this one does most of the work
I am currently reversing the callback method TL.exe passes to enumwindows, what I know so far :
The call to enumwindows (which passes the callback method) is done at RVA 0x183EA.
The routine passed does this :
For each window on the desktop, it gets the class of the window name, it gets the length of this name and it compares it with EME.LauncherWnd if it is NA's launcher.
If the class name matches, TL.exe will compare the PID of the owner of this window to the PID of its parent process. If The PIDs don't match, we get SSNL error, if they match, TL.exe saves the handle of the TERA launcher window here : DS:[A2F11C]
If all tests fail, TL.exe will throw a messagebox "Can't find SSNL".
If all tests are passed, TL.exe will send the message wm_copydata with "hello!!" to the launcher, if this function returns 0 TL.exe will say that the launcher was terminated.
If the message was correctly sent, TL.exe will wait for the launcher's copydata msgs.
Edit :
I can now trick my TL.exe into sending me messages, im tired af and will go sleep on that
