Mu Online Packets Parser

[vankyy26]

Hello guys !

I decided to share one of my small projects with you.

This is application written on C# that parses Mu Online packets to defined structs.

How to use it :

Add structs in Structs.cs (keep the existing syntax structure)
Click on the Load Structs button.
Add a packet hex in the field.
Click on the Parse Packet button.

The application will compile Structs.cs to Structs.dll and use those structs to parse your packets.

How to convert C++ structs to C# :

C++

struct TEST_STRUCT
{
     BYTE Size;
     char Username[10];
     byte SomeBytes[5];
};

C#
Everything must be public !

public struct TEST_STRUCT
{
     public byte Size;

     [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 10)]
     public string Username;

     [MarshalAs(UnmanagedType.ByValArray, SizeConst = 5)]
     public byte[] SomeBytes;
};

REMOVED
REMOVED

Future point of development can be to create packet sniffer from this app and auto parse the live packets with the structures

You can capture packets with WpePro or any other packet sniffer.

If someone is interested of the source code i can share it on low price =] . Just contact me on skype : vankyy26


Test Packet :

C1 08 27 FF 1F A2 2D 32 C1 04 0F 23

Runs on Windows XP Serice Pack 3 / Windows Server 2003 and above.
.NET Framework 4 Client Profile is required :

You must be registered to see links

​

 

[clerigz]

this is a nice release its so easy to find the correct packets

 

[Kiosani]

This is a good start point to develops.. to more new versions.. this is cool, thanks bro for share :

PS: Don't share your code with nothing bro, sincerely... this can be usefull on: Season 10 & 11 reverse enginering..

 

[nevS]

Too bad the marshaling of C# structs can't correctly serialize arrays
Anyways why is this code for sale and the exe encrypted? This is really no rocket science...

 

[vankyy26]

Thanks ! The .exe is obfuscated just because i don't want to share the code with everyone. Why i'm selling it ? Probably because i spent my time to create it so i deserve to get something from it. It's free for use, just the code has a price. You're not fully right about the marshaling, if you deeply look into it you'll find out that there are more options which help you to fix the little differences. And the cool part is that you can edit Structs.cs on the way u want. The application will collect all structures you placed there and will try to parse them with the packets

PS: Probably i will convert this into a sniffer in future )))

 

[nevS]

Well, I know you can set options for the marshaling... However you can't parse some constructs of mu packets. I tried to use it the other way... create byte arrays from structs with marshaling, which failed to serialize arrays of structs, for example a simple player meet packet. It serializes the first player in the array, and not more... I don't know if parsing would work correctly in this scenario, but probably it will have problems too.
Another problem with arrays is, when each element has a variable size, for example in the player meet packet, each player has a different number of visible effects (buffs etc.) appended. How would you set the options for marshaling then? You simply can't... so this approach is very limited.

About selling your code... ofc it's your decision to sell your own code and not release it for free. However, imho this doesn't make much sense for such a simple tool, and I don't think people will buy it. Why not release it on github, so more people can work on it?

 

[wolfulus]

Well, I know you can set options for the marshaling... However you can't parse some constructs of mu packets. I tried to use it the other way... create byte arrays from structs with marshaling, which failed to serialize arrays of structs, for example a simple player meet packet. It serializes the first player in the array, and not more... I don't know if parsing would work correctly in this scenario, but probably it will have problems too.
Another problem with arrays is, when each element has a variable size, for example in the player meet packet, each player has a different number of visible effects (buffs etc.) appended. How would you set the options for marshaling then? You simply can't... so this approach is very limited.

About selling your code... ofc it's your decision to sell your own code and not release it for free. However, imho this doesn't make much sense for such a simple tool, and I don't think people will buy it. Why not release it on github, so more people can work on it?

And I'll be glad to make some pull requests.

 

[hugab]

ex8.3 main.exe

You must be registered to see links

IP Serial need to change

 

[vankyy26]

Well guys. The packets are parsed on the same way the MuServer parse them. I have the algorithm and ya i agree that in some cases the parse would fail, but in most cases will work just because the app split and parse those packets on the same way the GS does it. For the cases u talk about may there problem only if those packets are not with static structure, like when the packet is manually resolved by a method in the client/server code, then the only option is to manually parse that packet. The only problem i found with the serialization of byte[] to struct is with the strings - the last character is always missing (that's because the marshaling expect the last one to be \0 ). Can be resolved but i have to change the parsing strategy.

 

[Razzor]

The packets are parsed on the same way the MuServer parse them.

Serious?! What if u have few structs with same size? I dont think that without protocol it can be correct..

source code i can share it on low price

^^ count packet bytes, foreach reflection namespace types and cast on marshal structure.. about 15 minutes work Good luck bro

PS: Don't share your code with nothing bro, sincerely... this can be usefull on: Season 10 & 11 reverse enginering..

Yea, tell me how u gonna decrypt packet captured with wpe from new crypt and packet twister stage?

 

[vankyy26]

I meant encryption/decryption/splitting. It's clear that the protocol resolve them by HeadCode and SubCode, i never said that this will give u the exact packet. Yes will give u all parsable structs with the same size. And i never said that this is complex application, ya for those who always beg for sources that's my solution. And for the last one - i don't have experience with season 8 and above, just i never had time to try and see what happens there =]

 

[Kiosani]

Serious?! What if u have few structs with same size? I dont think that without protocol it can be correct..


^^ count packet bytes, foreach reflection namespace types and cast on marshal structure.. about 15 minutes work Good luck bro


Yea, tell me how u gonna decrypt packet captured with wpe from new crypt and packet twister stage?

I have a Ducking: 1.01.12 GameServer -> Season X_PART_1 + GameServer.pdb + GameServer.map :

 

[josesp]

I have a Ducking: 1.01.12 GameServer -> Season X_PART_1 + GameServer.pdb + GameServer.map :

I have 2 Ducking cats...