I have several questions.

[TaxBeauty]

1. I tried to sniff the official Korean server using Shark Sniffer.
However, you cannot capture packets after selecting a character.
What should I modify? (I only modified sSecretKey.)

2. I unpacked the client of KMS 1.2.320 and loaded it through IDA.
I ran Diamondo's idc script, but most of the Functions Names, such as CField, did not change.

 

[seyasani15]

bumpp

 

[TaxBeauty]

bump
!

 

[Eric]

1. I guess you're not aware of crypto changes? All client packets from BEGIN_USER and onward contain Triple DES opcode encryption. On top of that, additional crypto changes were probably never updated/maintained in public MapleShark sources. However, if you did update the crypto (or found a copy with it), try updating your port range. Use Process Hacker (or Task Manager) and find out what remote port it's connecting to, then make sure MapleShark has that port within its scan range.
2. This should be obvious. Applications differ, compilers will differ, and thus the bytecode will differ. The AoBs provided in the script won't always work for every client region, let alone every version.. You'll need to update your AoBs every now and then, or find a different method of searching for the function (e.g string search, xref, etc).

 

[TaxBeauty]

1. I guess you're not aware of crypto changes? All client packets from BEGIN_USER and onward contain Triple DES opcode encryption. On top of that, additional crypto changes were probably never updated/maintained in public MapleShark sources. However, if you did update the crypto (or found a copy with it), try updating your port range. Use Process Hacker (or Task Manager) and find out what remote port it's connecting to, then make sure MapleShark has that port within its scan range.
2. This should be obvious. Applications differ, compilers will differ, and thus the bytecode will differ. The AoBs provided in the script won't always work for every client region, let alone every version.. You'll need to update your AoBs every now and then, or find a different method of searching for the function (e.g string search, xref, etc).

Thank you for your kind response.