[S.U.N Online] Encryption Algorithm

**Ashime** · 28-02-18

I am currently trying to figure out S.U.N's encryption algorithm, so I can decode the packets. I believe I have figured out some important information to help crack the algorithm, but I would like to have some help.

The information below is how the server and client interact up to the point of login:

Spoiler:

I have been studying the retail server's packets. The only thing that changes is the "hello packet" (4th step) and the login packet (7th step).
Here is the five connection trials from the retail server for the "hello packet":

Spoiler:

I noticed that the tail end of the "hello" packet changes very slightly every time you connect to the retail server. I believe it is a key of some sort, whether its an initialization vector, one key pair, and etc. Every time the key changes the login packets change dramatically, so instead, I made that "key" static on my server end to try and figure out the algorithm.

The information below is from my own server.

Interaction between my server and the client up to the point of login:

Spoiler:

I kept the "key" on the "hello" packet to $H, so this is what the login packets look like:

Spoiler:

All the older C++ S.U.N files use TEA (tiny encryption algorithm), Base64, MD5, and SHA1. I know this is not a hash algorithm because I wouldn't be able to reverse it. Then I noticed some of the other Webzen games have custom algorithms, so I am a bit confused.

Any help would be greatly appreciated.

**MentaL**

**Ashime** · 02-03-18

I decided to run some more tests in the same session (which I didn't do before) with the same server key ("$H"). There is a lot of static information between all of the tests.

This is just my guess from what I have observed so far...

It looks like the algorithm's block size is 5 bytes or 40 bits...because a password from two ~ seven characters look the same. There is a special hex value (test 1 - 0xfd) separates all repetitive code and corresponds to something. I thought it corresponds to the character count from combining the server key and the password and subtract it from 255, but the hex value is slightly off.

Spoiler:

I will have to say, I have never reversed engineered an encryption algorithm like I am trying to, so I will gladly accept any feedback or advise. Thank you!

**elmasmalo1** · 03-03-18

What I can recommend is to start organizing your stuff, and if you understand some parts of your packets identify then in some kind of grammar.

I'm working on a game and I'm logging the login server packets as well, and I'm trying to identify everything as I can... so this is what I've got so far, when the GameServer sends me the servers info. this is how I have identified them.

this way i can easily identify them when I write them to emulate the game server...

**Ashime** · 04-03-18

I know about packet identification and etc. because the older server files have that and I understand how certain parts correspond to the incoming packets. The older C++ files have category and op codes...then packet structures from and to the client. My issue is that I am working in Java and don't have access to the header information unless I download a 3rd party library. Another thing to mention is that I'm trying to figure out the encryption algorithm. Where I am at in this process is where the client sends the username and encrypted password. None of the older C++ projects have .cpp files for any of the encryption/decryption algorithms.

Truthfully, the body has the category and op code, the category is based on the first letter and the following number is the op code for the corresponding server. The authentication server is 3, where as game server is 2, and chat server is 1. I realize that the username comes after that and then its all encrypted.

**elmasmalo1** · 05-03-18

I tried helping but the client is protected with Themida, and it's also protected with XIGNCODE, I don't know how to continue any further with those two in play. My reverse engineering skills are extremely rusty on native, because I went from native to managed reversing a long time ago... and now I can barely do nothing xD

**Ashime** · 05-03-18

The client is protected with XIGNCODE and Themida? Which client are you talking about? The one Im working on is protected with GameGuard (some version of it, have to look again), then again, Im working on an Episode 1 version of the game. Anyway, thank you for your help.

**jaasonbourne** · 06-03-18

Originally Posted by 0x90

What I can recommend is to start organizing your stuff, and if you understand some parts of your packets identify then in some kind of grammar.

I'm working on a game and I'm logging the login server packets as well, and I'm trying to identify everything as I can... so this is what I've got so far, when the GameServer sends me the servers info. this is how I have identified them.

this way i can easily identify them when I write them to emulate the game server...

You coded the program of the first screenshot for the specific game you're working on or is a public one?

-- Edit

I searched and found it: 010 Editor.

**elmasmalo1** · 07-03-18

Originally Posted by Ashime

The client is protected with XIGNCODE and Themida? Which client are you talking about? The one Im working on is protected with GameGuard (some version of it, have to look again), then again, Im working on an Episode 1 version of the game. Anyway, thank you for your help.

SUN Online-Home ?

**Ashime** · 07-03-18

@0x90

Nexon.to or amzsun.com are private servers and use Episode 2 clients. I am currently working on an Episode 1 client from Zhaouc (奇迹世界（SUN）官方网站|奇迹世界1（SUN1）官方网站) the official Chinese server.

**jonnybravo** · 17-03-18

Post the .exe so we can dissemble it and look at the asm...

**Ashime** · 19-03-18

@jonnybravo

Here is the link for the Sungame.exe (Chinese version). If there is anyway I can help, please let me know. I am still working on figuring out the encryption algorithm. I am not very good at assembly, nor do I know what programs are recommended, but I will at least try to help to the best of my knowledge.

**jonnybravo** · 22-03-18

its packed with thermida v2.X gonna have to use ollydbg and run some scripts on it to unpack it so we can see inside the .exe. There are plenty of tuts on how to do this.

**Ashime** · 22-03-18

@jonnybravo

I am looking at tutorials for ollydbg with scripts. As bad as this may sound, but I didn't know you could run scripts with ollydbg. I will let you know if I find something or anything by posting it here. Thank you for all your help. I appreciate it.

**Ashime** · 26-03-18

Last night, I was going through the older C++ files and saw some code with the following information:

Encrypting block size = 8
Encrypted block size = 11
Key size = 4

If I can find the file again, I will post more of it, but I am still not sure how the encryption algorithm works to produce the outcome.

**Ashime** · 24-04-18

I have came up with some more conclusions about the encryption.

The other option I thought about was the possibilities of the "key" being an IV for a stream cipher.

[S.U.N Online] Encryption Algorithm

Thread Tools

[S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Re: [S.U.N Online] Encryption Algorithm

Advertisement