[Delphi - Source] decrypt Item.bmd

mauka · Dec 22, 2011

Reversed it time ago, i think GMO was S5.
If its not properly working u may need update a ITEM_BLOCK = $54 Lenght :wink:

here u can download item.bmd file ( the one i used when reversed this func ).

Finnaly atached source of a project to thread @Atachaments

PS. structure of Item record u can leach from Items.txt!

PSS. Delphi < 2009 users change TArray to Array of ...

zolamu · Dec 22, 2011

can convect into C++ ?

mauka · Dec 23, 2011

I'm not familiar with C++ syntax. I could convert C++ to Delphi only

Added:
Anyway the code itself is very simply, i see no problem to convert it to C++

To view the content, you need to sign in or register

U can by your self debug proc in current GMO client:

Code:

00521140            /$ 55             PUSH EBP
00521141            |. 8BEC           MOV EBP,ESP
00521143            |. 81EC 80020000  SUB ESP,280
00521149            |. 56             PUSH ESI
0052114A            |. 57             PUSH EDI
0052114B            |. 898D 80FDFFFF  MOV DWORD PTR SS:[EBP-280],ECX
00521151            |. 68 386ED200    PUSH main.00D26E38                       ; /Arg2 = 00D26E38 ASCII "rb"
00521156            |. 68 3C6ED200    PUSH main.00D26E3C                       ; |Arg1 = 00D26E3C ASCII "Data\Local\NPCDialogue.bmd"
0052115B            |. E8 80D74A00    CALL main.009CE8E0                       ; \main.009CE8E0
00521160            |. 83C4 08        ADD ESP,8
00521163            |. 8945 F8        MOV DWORD PTR SS:[EBP-8],EAX
00521166            |. 837D F8 00     CMP DWORD PTR SS:[EBP-8],0
0052116A            |. 75 5C          JNZ SHORT main.005211C8
0052116C            |. 68 586ED200    PUSH main.00D26E58                       ;  ASCII "Data\Local\NPCDialogue.bmd"
00521171            |. 68 746ED200    PUSH main.00D26E74                       ;  ASCII "%s file not found.
"
00521176            |. 8D85 40FEFFFF  LEA EAX,DWORD PTR SS:[EBP-1C0]
0052117C            |. 50             PUSH EAX
0052117D            |. E8 C8CD4A00    CALL main.009CDF4A
00521182            |. 83C4 0C        ADD ESP,0C
00521185            |. 8D8D 40FEFFFF  LEA ECX,DWORD PTR SS:[EBP-1C0]
0052118B            |. 51             PUSH ECX                                 ; /Arg2
0052118C            |. 68 D8A5E800    PUSH main.00E8A5D8                       ; |Arg1 = 00E8A5D8
00521191            |. E8 1A864400    CALL main.009697B0                       ; \main.009697B0
00521196            |. 83C4 08        ADD ESP,8
00521199            |. 6A 00          PUSH 0                                   ; /Style = MB_OK|MB_APPLMODAL
0052119B            |. 6A 00          PUSH 0                                   ; |Title = NULL
0052119D            |. 8D95 40FEFFFF  LEA EDX,DWORD PTR SS:[EBP-1C0]           ; |
005211A3            |. 52             PUSH EDX                                 ; |Text
005211A4            |. A1 78A5E800    MOV EAX,DWORD PTR DS:[E8A578]            ; |
005211A9            |. 50             PUSH EAX                                 ; |hOwner => NULL
005211AA            |. FF15 D406D200  CALL DWORD PTR DS:[<&USER32.MessageBoxA>>; \MessageBoxA
005211B0            |. 6A 00          PUSH 0                                   ; /lParam = 0
005211B2            |. 6A 00          PUSH 0                                   ; |wParam = 0
005211B4            |. 6A 02          PUSH 2                                   ; |Message = WM_DESTROY
005211B6            |. 8B0D 78A5E800  MOV ECX,DWORD PTR DS:[E8A578]            ; |
005211BC            |. 51             PUSH ECX                                 ; |hWnd => NULL
005211BD            |. FF15 D806D200  CALL DWORD PTR DS:[<&USER32.PostMessageA>; \PostMessageA
005211C3            |. E9 CC000000    JMP main.00521294
005211C8            |> C745 FC 580000>MOV DWORD PTR SS:[EBP-4],58
005211CF            |. C785 44FFFFFF >MOV DWORD PTR SS:[EBP-BC],0
005211D9            |> 8B55 F8        /MOV EDX,DWORD PTR SS:[EBP-8]
005211DC            |. 52             |PUSH EDX                                ; /Arg4
005211DD            |. 6A 01          |PUSH 1                                  ; |Arg3 = 00000001
005211DF            |. 6A 58          |PUSH 58                                 ; |Arg2 = 00000058
005211E1            |. 8D85 48FFFFFF  |LEA EAX,DWORD PTR SS:[EBP-B8]           ; |
005211E7            |. 50             |PUSH EAX                                ; |Arg1
005211E8            |. E8 12D64A00    |CALL main.009CE7FF                      ; \main.009CE7FF
005211ED            |. 83C4 10        |ADD ESP,10
005211F0            |. 85C0           |TEST EAX,EAX
005211F2            |. 0F84 90000000  |JE main.00521288
005211F8            |. 6A 58          |PUSH 58                                 ; /Arg2 = 00000058
005211FA            |. 8D8D 48FFFFFF  |LEA ECX,DWORD PTR SS:[EBP-B8]           ; |
00521200            |. 51             |PUSH ECX                                ; |Arg1
00521201            |. E8 9A5FEEFF    |CALL main.004071A0                      ; \Dec_Xor3_Bytes
00521206            |. 83C4 08        |ADD ESP,8
00521209            |. 6A 04          |PUSH 4
0052120B            |. 8D95 48FFFFFF  |LEA EDX,DWORD PTR SS:[EBP-B8]
00521211            |. 52             |PUSH EDX
00521212            |. 8D85 44FFFFFF  |LEA EAX,DWORD PTR SS:[EBP-BC]
00521218            |. 50             |PUSH EAX
00521219            |. E8 42C84A00    |CALL main.009CDA60
0052121E            |. 83C4 0C        |ADD ESP,0C
00521221            |. 6A 54          |PUSH 54
00521223            |. 8D8D 4CFFFFFF  |LEA ECX,DWORD PTR SS:[EBP-B4]
00521229            |. 51             |PUSH ECX
0052122A            |. 8D55 A0        |LEA EDX,DWORD PTR SS:[EBP-60]
0052122D            |. 52             |PUSH EDX
0052122E            |. E8 2DC84A00    |CALL main.009CDA60
00521233            |. 83C4 0C        |ADD ESP,0C
00521236            |. 83EC 54        |SUB ESP,54
00521239            |. B9 15000000    |MOV ECX,15
0052123E            |. 8D75 A0        |LEA ESI,DWORD PTR SS:[EBP-60]
00521241            |. 8BFC           |MOV EDI,ESP
00521243            |. F3:A5          |REP MOVS DWORD PTR ES:[EDI],DWORD PTR D>
00521245            |. 8B85 44FFFFFF  |MOV EAX,DWORD PTR SS:[EBP-BC]
0052124B            |. 50             |PUSH EAX
0052124C            |. 8D8D 90FDFFFF  |LEA ECX,DWORD PTR SS:[EBP-270]
00521252            |. 51             |PUSH ECX
00521253            |. E8 18D20000    |CALL main.0052E470
00521258            |. 83C4 5C        |ADD ESP,5C
0052125B            |. 50             |PUSH EAX                                ; /Arg1
0052125C            |. 8D8D E8FDFFFF  |LEA ECX,DWORD PTR SS:[EBP-218]          ; |
00521262            |. E8 29D20000    |CALL main.0052E490                      ; \main.0052E490
00521267            |. 8D95 E8FDFFFF  |LEA EDX,DWORD PTR SS:[EBP-218]
0052126D            |. 52             |PUSH EDX
0052126E            |. 8D85 84FDFFFF  |LEA EAX,DWORD PTR SS:[EBP-27C]
00521274            |. 50             |PUSH EAX
00521275            |. 8B8D 80FDFFFF  |MOV ECX,DWORD PTR SS:[EBP-280]
0052127B            |. 83C1 04        |ADD ECX,4
0052127E            |. E8 ED2A0000    |CALL main.00523D70
00521283            |.^E9 51FFFFFF    \JMP main.005211D9
00521288            |> 8B4D F8        MOV ECX,DWORD PTR SS:[EBP-8]
0052128B            |. 51             PUSH ECX
0052128C            |. E8 35D24A00    CALL main.009CE4C6
00521291            |. 83C4 04        ADD ESP,4
00521294            |> 5F             POP EDI
00521295            |. 5E             POP ESI
00521296            |. 8BE5           MOV ESP,EBP
00521298            |. 5D             POP EBP
00521299            \. C3             RETN

Its 100% same as Item.bmd

tt1: