- Joined
- Jul 18, 2012
- Messages
- 42
- Reaction score
- 59
Hello,
since EP8, ESTsoft changed some and added a few new packets for player auth(Login side).
They added packet "2002" with opcode 0x7D2 and "2001" with opcode 0x7D1.
First one (2002) contains player ID(which one was typed in client) and idk, i think it checks in NetCafeBilling to see if player exists in that db.
And about AuthAccount with opcode 0x67, its changed, a lot... Or maybe not.
Lets take a look at EP7 AuthAccount packet, with details (id, pw) "normal" and "pass":
0A = 10, it's id+pw length, so normalpass has 10 length.
06 = 6 , it's id length
and after 0x06 it's id+pw till the end. It's not encrypted or something.
And for this example, let's take a look at "new" AuthAccount EP8 packet, with details (id, pw) "normal" and "pass":
Can't see any id/pw or other information. And everytime this packet will be random, so it's definately encrypted somehow...
So, my question is, if it's possible to figure out which encryption method is used and decrypt this packet to get id and pw? Maybe debugging via ollydbg(heh, i don't know how to use ollydbg and i don't know asm :/) or something... Im not use this for a hack, i and some other guy(who knows, maybe he will reply on this thread
) thinking about resurrect Minerva, and here i(we) stopped, can't make a fully working login side.
Thanks for any advice.
since EP8, ESTsoft changed some and added a few new packets for player auth(Login side).
They added packet "2002" with opcode 0x7D2 and "2001" with opcode 0x7D1.
First one (2002) contains player ID(which one was typed in client) and idk, i think it checks in NetCafeBilling to see if player exists in that db.
And about AuthAccount with opcode 0x67, its changed, a lot... Or maybe not.
Lets take a look at EP7 AuthAccount packet, with details (id, pw) "normal" and "pass":
Code:
E2 B7 16 00 00 00 00 00 67 00 0A 06 6E 6F 72 6D
61 6C 70 61 73 730A = 10, it's id+pw length, so normalpass has 10 length.
06 = 6 , it's id length
and after 0x06 it's id+pw till the end. It's not encrypted or something.
And for this example, let's take a look at "new" AuthAccount EP8 packet, with details (id, pw) "normal" and "pass":
Code:
E2 B7 0C 01 00 00 00 00 67 00 00 01 54 D2 6C 1E
FB 19 1D 36 0A E3 28 80 1E D9 98 BF 6B 67 24 93
4B 9B FC F2 EE 4C 14 7A 22 50 2A BA 10 F7 51 02
C0 D7 D8 1E C7 D0 8F A6 73 D7 66 7C 2C 64 67 D1
3B FB 82 25 0A FA 99 5C AB 72 4B 88 4E 08 50 87
94 53 29 66 77 52 BA 20 D8 4D 0F 87 73 53 75 56
68 C0 F9 B8 4E 2F 21 A0 B3 DA 52 A7 E9 BA 15 16
61 85 A6 D2 CE 6D D2 3B 88 05 B7 DB 68 EF 5A 01
DD 75 6A 04 3D D5 EE BD 96 13 62 95 4A 81 E7 EE
A6 86 5E D7 78 0D 76 E2 BD 52 B7 6A B8 0B 02 EF
C4 C7 6A 18 7A 8F 30 0D 8C F2 6F 4B 77 54 C7 EB
78 CE 40 88 32 3B 02 BC A0 66 2B 8A CC 9F A7 6E
4F 67 CE B7 73 9A 56 B9 28 51 B0 19 8B AE 4B 95
85 35 9E 9B DA 9F C3 D8 D5 25 07 FA C1 31 35 A9
57 83 94 F4 1F 4D A2 AB D7 13 70 A0 DD 3A F4 E9
F1 87 4A 74 E8 47 BE 92 EC 0F F6 1A E3 C8 B4 7F
AC 72 16 54 13 FD 80 82 DF 2F 50 09Can't see any id/pw or other information. And everytime this packet will be random, so it's definately encrypted somehow...
So, my question is, if it's possible to figure out which encryption method is used and decrypt this packet to get id and pw? Maybe debugging via ollydbg(heh, i don't know how to use ollydbg and i don't know asm :/) or something... Im not use this for a hack, i and some other guy(who knows, maybe he will reply on this thread
) thinking about resurrect Minerva, and here i(we) stopped, can't make a fully working login side.Thanks for any advice.
Keep it up 
