Get Key

[EdoTense]

Hi guys.

I viwer in one server v83, we can imput characters
texts with accents.When I opened the localhost, I saw that they changed the encryption.I tried using the GetKey.dll of the @Diamondo25 , but it did not find the key.This is the client link
https://mega.nz/#!F7h0iATA!9B3HT099Rpb5taViAfrmZbOzdhB7zkkt3u0ky7l9xWU


. Could someone tell me another way to get the key?Thank you.

 

[Gerry]

Hey,
I see that's BMS version type of client, what type of v83 source are you running?

 

[EdoTense]

I use HeavenMS http://forum.ragezone.com/f427/v83-heavenms-1135955/

 

[br1337]

Search for this array of bytes in a clean client that you know that hasnt changed the key:

[COLOR=#6A737D]13 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 06[/COLOR]

Then compare the bytes at location of the clean client and the modified client.

If that doesnt work, xref the keys in IDA and check if they are overriding the push instruction with the offset of the AES key.

 

[EdoTense]

I will try this

The secret key for version 83 is

0x13, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, (byte) 0xB4, 0x00, 0x00, 0x00, 0x1B, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x33, 0x00, 0x00, 0x00, 0x52, 0x00, 0x00, 0x00

So I'll look for her on the right client.

Thanks i post if i get sucess.

 

[EdoTense]

thanks i solved this problem.

The key is

new byte[]{0x21, 0x00, 0x00, 0x00, 0x56, 0x00, 0x00, 0x00,(byte) 0xDE, 0x00, 0x00, 0x00, (byte) 0x76, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, (byte) 0xD6, 0x00, 0x00, 0x00,(byte) 0x8B, 0x00, 0x00, 0x00},

but necessery alter server side ^^

 

[Sen]

this is BMS from Gusmão? hahahaha

just replace the key and its work.

 

[EdoTense]

yes. this client of MrMr

You nead change in your server this line
@Override
public final String readAsciiString(int n) {
byte ret[] = new byte[n];
for (int x = 0; x < n; x++) {
ret[x] = (byte) readByte();
}
String encode = CharsetConstants.MAPLE_TYPE.getAscii();
try {
String str = new String(ret, encode);
return str;
} catch (Exception e) {
System.err.println(e);
}
return "";
}

is in GenericLittleEndianAccessor using HeavenMS for Work.