Library of IDB's for different versions with named addresses

[sunnyboy]

Thanks a bunch. Will really help me out. 148 just came out :3

Ya, I would of done it this morning, but I was busy. It's currently analyzing atm in IDA still. (31mb unpacked client )


EDIT: v148 added

 

[a12182560]

I've never tried TWMS, send me a link to an unpacked client/mem dump

TWMS ver.166 unpacked

You must be registered to see links

(This link is from Diamondo25's post)

 

[sunnyboy]

TWMS ver.166 unpacked

You must be registered to see links

(This link is from Diamondo25's post)

Aww, it isn't supported. :C Diamondo25

Uh, a12182560 because it isn't english and Stredit isn't compatible, it would take some more time since I don't understand their language lol

 

[icelemon1314]

Maybe you can try to use the skills ID Sunyboy

 

[sunnyboy]

Maybe you can try to use the skills ID Sunyboy

I can find CField which leads to CLogin pretty fine, just CWvs I gotta think about. Will try when I have time!

 

[a12182560]

Aww, it isn't supported. :C Diamondo25

Uh, a12182560 because it isn't english and Stredit isn't compatible, it would take some more time since I don't understand their language lol

Thank you sunnyboy

By the way, can someone unpack TWMS latest version(ver.168)?
Because I want to research TWMS latest version packet structure, but Themida is so difficult to unpack for me.
Thank
I'm a Taiwanese, english is not good...

 

[Dynamik]

Thank you sunnyboy

By the way, can someone unpack TWMS latest version(ver.168)?
Because I want to research TWMS latest version packet structure, but Themida is so difficult to unpack for me.
Thank
I'm a Taiwanese, english is not good...

You don't need to unpack it. A memory dump works fine too.

 

[a12182560]

You don't need to unpack it. A memory dump works fine too.

Oh Thank you
I'll give it a try

 

[bobsd]

Was going pm you sunnyboy but your pm was full. I got no shame in posting this publicly.
I looked around last night and tried unpacking maple out but kept getting stuck and or crashing maple and getting a error from themida. If you could point me towards some good references, guides, etc or share your/anyone's personal tips that would be nice. :3

 

[sunnyboy]

Was going pm you sunnyboy but your pm was full. I got no shame in posting this publicly.
I looked around last night and tried unpacking maple out but kept getting stuck and or crashing maple and getting a error from themida. If you could point me towards some good references, guides, etc or share your/anyone's personal tips that would be nice. :3

I never unpacked themida, just ASProtect. I got no time to learn themida. Go to google and type "lena tuts4you" without " for one help and another to look at the user LCF-AT at tuts4you, but specifically his themida tutorial. (kiki told me this info)

 

[icelemon1314]

You don't need to unpack it. A memory dump works fine too.

How to get a mem dump?when i Loaded with OdllyDbg, and then got stuck.
How to setOdllyDBG？I used StrongOD,but it's still does not work.

 

[sunnyboy]

v80,81,82, 83, 84,85, 86, 88 and 89 are added for the reason of it being a library loool. Since v83 is a common version among users, I hope one day Kevin will release his

 

[a12182560]

You don't need to unpack it. A memory dump works fine too.

I've tried memory dump, and already research many hours, but I can not do it...
Can someone tell me how to memory dump?

 

[Hilia]

I've tried memory dump, and already research many hours, but I can not do it...
Can someone tell me how to memory dump?

Page 3

 

[a12182560]

Page 3

Thank you

 

[icelemon1314]

at the CField::OnPacket,i find big header,There are such a big header that?These headers are correct it?@sunnyboy

 switch ( a2 )
                                                                {
                                                                  case 0x3AE:
                                                                    sub_544ED0(lpMultiByteStr);
                                                                    break;
                                                                  case 0x3AF:
                                                                    sub_5450C0(lpMultiByteStr);
                                                                    break;
                                                                  case 0x3B0:
                                                                    sub_5450F0(lpMultiByteStr);
                                                                    break;
                                                                  case 0x3B1:
                                                                    sub_543020(lpMultiByteStr);
                                                                    break;
                                                                  case 0x3B2:
                                                                    sub_544C70(lpMultiByteStr);
                                                                    break;
                                                                  default:
                                                                    return;
                                                                }

 

[Fraysa]

at the CField::OnPacket,i find big header,There are such a big header that?These headers are correct it?@sunnyboy

 switch ( a2 )
                                                                {
                                                                  case 0x3AE:
                                                                    sub_544ED0(lpMultiByteStr);
                                                                    break;
                                                                  case 0x3AF:
                                                                    sub_5450C0(lpMultiByteStr);
                                                                    break;
                                                                  case 0x3B0:
                                                                    sub_5450F0(lpMultiByteStr);
                                                                    break;
                                                                  case 0x3B1:
                                                                    sub_543020(lpMultiByteStr);
                                                                    break;
                                                                  case 0x3B2:
                                                                    sub_544C70(lpMultiByteStr);
                                                                    break;
                                                                  default:
                                                                    return;
                                                                }

That's probably not CField, although I'm unsure about JMS. I'm 99% sure that's not CField (or has to do with packet handling at all).

 

[sunnyboy]

That's probably not CField, although I'm unsure about JMS. I'm 99% sure that's not CField (or has to do with packet handling at all).

it's CField. I'd double check, but he never mentions which VERSION he's using... icelemon1314

at the CField::OnPacket,i find big header,There are such a big header that?These headers are correct it?@sunnyboy

 switch ( a2 )
                                                                {
                                                                  case 0x3AE:
                                                                    sub_544ED0(lpMultiByteStr);
                                                                    break;
                                                                  case 0x3AF:
                                                                    sub_5450C0(lpMultiByteStr);
                                                                    break;
                                                                  case 0x3B0:
                                                                    sub_5450F0(lpMultiByteStr);
                                                                    break;
                                                                  case 0x3B1:
                                                                    sub_543020(lpMultiByteStr);
                                                                    break;
                                                                  case 0x3B2:
                                                                    sub_544C70(lpMultiByteStr);
                                                                    break;
                                                                  default:
                                                                    return;
                                                                }

They have larger ones.

 

[icelemon1314]

it's CField. I'd double check, but he never mentions which VERSION he's using... icelemon1314
They have larger ones.

it's the GMS 146.1.
I found CMS111 is larger than GMS 146.1. :blink:

 

[Hilia]

Just thought of it:
http://forum.ragezone.com/f690/maplestory-v118-idb-925400/