Help with v186+ encryption, ida code inside

[masterjerker]

i like penis

 

[Novak]

Funny, I looked into this yesterday but in the client I had all references to a5 set it to 1 so I didn't bother checking it. I'm going to take a look now but no guarantees



so like i looked at it and saw this:

So it's clearly not such a complex encryption. I renamed the vars in notepad based on kmst, the vars passed to this crypt are identical to the ones passed to the CAESCipher::Encrypt giving me this:

And translating that to java will give you this:

int nLen;
int dwKey = bUseKey ? dwKey : 0;
int nRes = dwKey;
byte[] pDest;
byte[] pSrc;

for (int i = 0; i < nLen; ++i) {
    pDest[i] = dwKey + pSrc[i];
    nRes = i + 1;
}

return nRes;

And that should do the trick

Credits to sunnyboy for checking my IDA translation since i'm a noob that likes to have his work checked by a master.

 

[masterjerker]

how to use in mapleshark??

Funny, I looked into this yesterday but in the client I had all references to a5 set it to 1 so I didn't bother checking it. I'm going to take a look now but no guarantees



so like i looked at it and saw this:

So it's clearly not such a complex encryption. I renamed the vars in notepad based on kmst, the vars passed to this crypt are identical to the ones passed to the CAESCipher::Encrypt giving me this:

And translating that to java will give you this:

int nLen;
int dwKey = bUseKey ? dwKey : 0;
int nRes = dwKey;
byte[] pDest;
byte[] pSrc;

for (int i = 0; i < nLen; ++i) {
    pDest[i] = dwKey + pSrc[i];
    nRes = i + 1;
}

return nRes;

And that should do the trick

Credits to @sunnyboy for checking my IDA translation since i'm a noob that likes to have his work checked by a master.

 

[masterjerker]

**** mom

 

[Novak]

Help ~~


How to use this for mapleshark

tried this.. no work

public void TransformAES(byte[] pBuffer)        {                   for (int i = 0; i < pBuffer.Length; i++) {                pBuffer[i] = (byte)(mIV[0] + pBuffer[i]);                       }                      }

You are using mIV[0], so the addition would never be correct. IV's in the client are integer numbers, a lot of src's incorrectly (but for convenience prolly cuz it was annoying to add) use 4 byte array's for IV's instead. If you want this crypto to work you're gonna have to cast the byte array IV into an Integer. Keep in mind that the client uses an unsigned integer btw.

On a side note, InnoHash also changed (the function that generates a new IV). But it seems to yield the exact same results for IV's as before so don't worry about it too much.

 

[masterjerker]

You are using mIV[0], so the addition would never be correct. IV's in the client are integer numbers, a lot of src's incorrectly (but for convenience prolly cuz it was annoying to add) use 4 byte array's for IV's instead. If you want this crypto to work you're gonna have to cast the byte array IV into an Integer. Keep in mind that the client uses an unsigned integer btw.



On a side note, InnoHash also changed (the function that generates a new IV). But it seems to yield the exact same results for IV's as before so don't worry about it too much.

thx. i can see inbound packet now... but why cant i see outbound??

inbound:

outbound:

is there some other encryption for outbound...?

 

[Novak]

thx. i can see inbound packet now... but why cant i see outbound??

inbound:

outbound:

is there some other encryption for outbound...?

The outbound encryption shouldn't be different. Substract the added key (make sure it stays in sync for this to work) and the data should be proper again.

 

[Novak]

yo someone hit me up and told me that I couldn't be more wrong, OutBound for most of it uses old encryption until a bit further down the game where you receive some big packet that triggers a clientside encryption change or someshit. Idk, i have to check it at some point but I don't really have the time / will to give it a proper look lol.