How to get packet structure using ollydbg

[awchjimmy]

How to get packet structure using ollydbg

Introduction
Let's say, you want to create a specific (old) version of a server emulator. All you have is the client files. You have done some packet sniffing tasks with success before. However, there is no public available server for you to sniff this time.

Not big deal, you have read one or two tutorials about how to get packet structure using IDA. You applied what you've learned to update some CLogin packets. It works.

The complexity of packet structure and control flow quickly increase as you proceed further. You go back to the old padding zero method. Add and remove zero here and there, and soon realize this process will take you forever...

Who is this for?
1. Anyone who wants to upgrade / downgrade their server emulator.
2. Anyone who is interested in general reverse engineering.

What solutions do we have already?
1. Packet sniffing if there are public servers available. MapleShark or MapleSnowSniffer.
2. Getting packet structures/opcodes using IDA by Hendi48
3. How to get packet structures using Cheat Engine by Hendi48
4. Getting packet structures and opcodes with IDA after GMS new update by oxysoft

How can we do it in ollydbg?
The concept is easy. You set breakpoints to these addresses.

COutPacket::Encode1
COutPacket::Encode2
COutPacket::Encode4
COutPacket::EncodeBuffer
COutPacket::EncodeStr

Whenever the breakpoints hit, write logs, and continue to run the program.

This way, you get only what has been executed. Plus, in the right order.
As opposed to the whole control flow in IDA.

Screenshot: CLogin::SendLoginPacket in ollydbg

What can be improved?
1. You can write everything into an odbgscript, make it somehow like a packet sniffer.
2. You can log the register values, so you get not only the structure but also the data.

Conclusion
1. I am not saying that this method is better than IDA. You will need ollydbg to know what's currently going on, and IDA to view the whole picture. In my opinion, you will need both most of the time.
2. I am not saying that this method is easy either. Reverse engineering is not easy task in general. This is just another way to achieve things. You will still need to do the hard work.
3. That's all for now. Happy hacking.

 

[Riremito]

you are right, but packet editor (with format logging) is more useful
it easily detects packet format is correct or not

if you already know packet encode/decode addresses, you can make PE
you should make own PE, logging packet format and return address is enough
but you have to make Packet Logger as external exe, not a DLL, when client gets crash, packet won't be logged if PE is running as DLL
it makes harder to check where causes crash

 

[awchjimmy]

Riremito Great idea! Never thought about building a custom packet editor!
And thanks for the external exe tip. I’ll definitely give it a try.

 

[Xanix]

you are right, but packet editor (with format logging) is more useful
it easily detects packet format is correct or not

if you already know packet encode/decode addresses, you can make PE
you should make own PE, logging packet format and return address is enough
but you have to make Packet Logger as external exe, not a DLL, when client gets crash, packet won't be logged if PE is running as DLL
it makes harder to check where causes crash

View attachment 242891

But isn't this the same as just logging the packets on the terminal of your server? You can log both in and out packets.
...Well, except for the editing part, since you cannot do that on runtime, and i guess there's no use for doing that server-side

 

[awchjimmy]

But isn't this the same as just logging the packets on the terminal of your server? You can log both in and out packets.
...Well, except for the editing part, since you cannot do that on runtime, and i guess there's no use for doing that server-side

I hadn't tried any packet editor before at that time.

The two methods I know are the static analysis one, IDA, which is a bit hard for me to interpret.
And the dynamic one, MapleSnowSniffer, which is more intuitive. It has array of bytes but no packet structure.

After some trial and error, I came up with this ollydbg idea.
It does have packet structure now, but no array of bytes this time.

What Riremito suggests is, I can combine the two to make a packet editor/viewer.
Again, I never thought about this before at that time.

Since my goal is to create a server emulator, there is no need for me to edit packet on runtime.
Xanix Not sure if this clarifies a bit.