Private Little Idea C# Flash/Shockwave Client

[Emily]

Forget windows forms, what if the client could be embedded in c++?

 

[maritnmine]

Forget windows forms, what if the client could be embedded in c++?

You should use assembly because its faster.

 

[Emily]

You should use assembly because its faster.

I should use assembly? Me? Assembly? Must be joking. I barely have assembly experience...

 

[ovflowd]

You should use assembly because its faster.

Forget Assembly, let's do it in BrainFuck.

Nevermind, maritnmine, no jokes, what you recommend for us? I know that you have a great knowledge in this area.

 

[maritnmine]

Forget Assembly, let's do it in BrainFuck.

Nevermind, @maritnmine, no jokes, what you recommend for us? I know that you have a great knowledge in this area.

Have a look at

You must be registered to see links

.

 

[TheOleg]

So it is gonna be windows form with WebBrowser object in it?

 

[Emily]

@TheOleg No. There's no information about what's going to happen; I was working on something but if I do that maritnmine will probably throw lots of shuriken to my face. First idea was to use shockwave's DLL in a windows forms application, which actually worked, but now there's a possibility for something different.

But definitely NOT use a webbrowser control in a windows form application. There's no use for that.

 

[ovflowd]

@TheOleg No. There's no information about what's going to happen; I was working on something but if I do that @maritnmine will probably throw lots of shuriken to my face. First idea was to use shockwave's DLL in a windows forms application, which actually worked, but now there's a possibility for something different.

But definitely NOT use a webbrowser control in a windows form application. There's no use for that.

No, will not be shuriken. Probably those monsters from Mega Man that Master Marit has as profile pic.

I will do this one my vacations, 90% sure of that.

 

[Emily]

@saamus What will you do?

 

[The General]

Windows 8 (all editions) includes the .NET Framework 4.5 as an OS component, and it is installed by default.
Windows 8.1 (all editions) includes the .NET Framework 4.5.1 as an OS component, and it is installed by default.

Windows 10 (all editions) includes the .NET Framework 4.6 as an OS component, and it is installed by default.

Its 2016, jesus christ. Who uses old Windows versions

Its almost 2017 jesus christ. Who still hasn't moved to Linux?

And too bad half the market is still 50% on windows 7.

You must be registered to see links

 

[ovflowd]

Its almost 2017 jesus christ. Who still hasn't moved to Linux?

And too bad half the market is still 50% on windows 7.

You must be registered to see links

Windows 7 it's pretty much better than Windows 8/8.1/10 those are poop.

@saamus What will you do?

I will first do a big research, and check how i will implement it. First will check how will be the API. How the Client will be configured.
Last once will start researching about injecting the Flash DLL's and Shockwave too. Last thing will be design the Application itself.

Planning to make it in Java. And build in in a .jar.

Will be good a customizable SplashScreen for each hotel?

Thinking on this:

1. We have the ExternalClient.php. This file it's the core between the communication of the "server" and the "client".
In this file you configure the MySQL Data, Hotel Settings and Choose which tables and columns have user id, user name, user e-mail and user password; also which table and column contains the client token.
This file can provide some jSONs:

1. Client Button with the API URI
PATH: hhotel://myhotel.com/ExternalClient.php

This will invoke the HHOTEL Application, and tell to it to Communicate with MyHotel.com/ExternalClient.php

2. Retrieve Hotel Settings
PATH: myhotel.com/ExternalClient.php?/Hotel/Settings
Answer:

{    
    emulator : {
        address : "127.0.0.1",
        port : 30000,
        proxy : false,
        proxy-address : "127.0.0.1"
    },
    hotel : {
        name : "Habbo Hotel",
        loading : "Starting Habbo Hotel...",
        splash : "https://imgur.com/rrrrr.png",
        splash-text : "Wait!! Configuring the Loader...",
        hotel-logo : "http://habbo.com/logo.png",
        base-path : "http://habbo.com/",
        logout-uri : "http://habbo.com/logout",
        user-cipher : "md5"
    }
    client : {
        flash : true,
        base-path : "http://images.habbo.com/swf/",
        gordon : {
            base-path : "http://images.habbo.com/swf/gordon/duck-you/",
            swf-file : "Habbo.swf"
        },
        dcr : {
        	base-path : "http://images.habbo.com/dcr/",
        	furni : "hof_furni"
        },
        gamedata : {
            base-path : "http://images.habbo.com/swf/gamedata/",
            variables : "external_variables/1.xml",
            texts : "external_flash_texts/1.xml",
            override-variables : "external_override_variables/1.xml",
            override-texts : "external_override_flash_texts/1.xml",
            productdata : "productdata.xml",
            furnidata : "furnidata.xml"
        }
    }
}

Observations.:
1. User-Cipher = Cipher to be used to Encrypt User Password. Available Hashes will be : md5 (TELL ME MORE CIPHERS PLEASE!!!)
2. Logo will be displayed at Login Window

3. Landing Screen Asking to Enter Login Data
PATH: myhotel.com/ExternalClient.php?/User/Login
Payload:

{
    user-name : "Claudio",
    user-pass : "492489twjifkethw9fuihwiru3g287rtf76"
}

Answer:

{
    auth : "OK",
    user : {
        user-id : 1,
        user-name : "Claudio",
        user-email : "claudio.santoro@ieee.org"
    }
}

4. Now the Client will Request the Token,
PATH: myhotel.com/ExternalClient.php?/User/Auth
Answer:

{
    token : "89463948yhjfkhkjhiuhi37563876yhj"
}

5. Client will start to load. And you're ready.

6. Additional Requests:
6.1. Users Online
PATH : myhotel.com/ExternalClient.php?/Hotel/OnlineCount
Answer:

{
    amount : 1200
}

6.2. Is Hotel Online (Emulator ON)
(ExternalClient.php will try to do a SOCK to Port)
PATH: myhotel.com/ExternalClient.php?/Hotel/Online
Answer:

{
    online : true
}

6.X: Give more suggestions

UI COMPONENTS:

1. Logout Button
2. How Many Users Online
3. Hotel is Online or Not.
4. User Name logged in

The UI Style for Login and Splash Screen will be Holo!! (Yes HOLOCMS) (I mean old Habbo Layout Login Page from v22~

 

[ovflowd]

Does someone have HoloCMS? (With this login page):

You must be registered to see links

 

[Dora Vdb]

This one should work on the latest PHP:

You must be registered to see links

I don't know about the client meaby its somewhere inside the cms.

 

[Dora Vdb]

You can use the latest PHP. I don't know if it has the old client inside it.

You must be registered to see links

 

[Emily]

@saamus Yeah because MD5 is very good to use for password hashing. Blowfish FTW, or even SHA256. Also, why add the furni SWF path? That's defined in the variables.

 

[ovflowd]

@saamus Yeah because MD5 is very good to use for password hashing. Blowfish FTW, or even SHA256. Also, why add the furni SWF path? That's defined in the variables.

I know that md5 isn't secure. I'm not convinced in making user logging-in in the Client App.

Also each CMS has a different hashing way.. Handling all those ways will be like wtf.

I'm thinking in a way that the hhotel:// uri goes not only with the path of the communication file (ExternalClient.php) but also with a Token to identify the user. The Token can be used only one time. And i think it's better. I will rewrite it.

I know that DCR it's only on Variables. I dunno why added it.

I will update this post with a new version of the API.

Also Glaceon does you have any HoloCMS with you? All download links broken. I only want the design of it hahah,

 

[Emily]

@saamus 'all download links broken' I literally found it in 2 seconds.

You must be registered to see links

 

[ovflowd]

@saamus 'all download links broken' I literally found it in 2 seconds.

You must be registered to see links

Glaceon, i started coding this poop. See it here:

You must be registered to see links

Started by the API (PHP), so what basically i decided:

The Client.php is replaced by the HClient client.php.
When you click on your CMS "Enter on Hotel", will redirect to the client.php, yeah. That will have a HTML Template saying. Something like "This Hotel uses HClient, click on the button bellow to launch HClient, if you don't have HClient installed click here, blablah" (In HoloCMS style).

The button of Launch will have the Hotel URI and a Generated Token by HClient.

Basically this: hhotel://MYHOTEL.COM?token=GeneratedToken

This will launch the HClient Java App, and say to the App that:
1. Server It's on MYHOTEL.COM
2. The First Token is GeneratedToken

After that HClient App will try to communicate this with the Client.php on MYHOTEL.COM

You must be registered to see links

HClient PHP will answer a jSON containing a new Token and the Hotel Environment Variables. If token is invalid will show an error message in jSON output.

After that the HClient App will prepare the Assets and ask to HClient PHP:

You must be registered to see links

The HClient PHP will answer a jSON containing User Details and a New Token.

Remember.: For each request the Old token will be expired and a new token will be generated. The token will be stored in same place of the Old Client.php token column (like users.auth_ticket).

The last one answered Token can be used already to Auth in the Client.

The API will have other functionalities, like:
1. Provide How Many Users are Logged In (PHP answering a Database Query)
2. If Server it's on or Off (PHP Trying a Sock to Emulator IP)
3. And other things that can be customized.

The HClient APP will be like the Shockwave Client, with a top bar saying online user count, log out button and if server is on.
The Logout button redirects to the CMS Logout.

The system its half secure, since every time that you communicate, a new token it's generated. But if you grab the first generated token, you can use it, and "simulate" the communication.

So the onliest way to grab the First Generated Token, it's by sending the hhotel:// link to someone. And blahblah. Or if someone is listening your PC Network Interface..

Basically the token system works like in normal clients. The major different thing, it's that the auth it's being done remotely.

But since our HClient doesn't provide critical data, like password or something else. Nothing dangerous. The biggest security issue will be someone play in another user account?? But only if this user provides the link of hhote:// to someone, without using it? Since after the link being consumed the token it's regenerated?

So a way to make it safe, will be a HTTPS communication channel. So no one can use Wireshark or blahblah to see what are the Tokens that are being communicted. (HTTPS secures also Requested URI)

The biggest problem will be CORS. That means, that CORS need be enabled for everyone. So that's a risk. Obviously. (Crossdomain.xml)

Tomorrow i will create Dev Thread in RZ Habbo Development Section and will update README, create Swagger API Documentation, and code the other API paths.

I need someone to help me with the HClient Java APP. Maybe you, Glaceon?

 

[Emily]

@saamus No, I have no time for it. I barely have time for my own project. Which in fact I'm working on right now. Also, I don't think I'll be able to make the client in Java.

 

[ovflowd]

@saamus No, I have no time for it. I barely have time for my own project. Which in fact I'm working on right now. Also, I don't think I'll be able to make the client in Java.

Thanks Glaceon. But if is possible, can you give me an analysis or feedback of what you think on my actual "way" of how do this project?

If someone being interested on this, or want to give ideas, feedback or more. I will be glad to hear.