[Packets] Confusing packets, information needed Web

[yoni2]

Hello,

A while ago I made a post about packets, well I've been looking into it now and then and finally made something working, for a part atleast.

Now according to some tutorials I read is that the packets are read from right to left, little endian and that the first 2 bytes are the 'opcode'/'header'?, correct me if I am wrong.

I am using EMS v79(latest) to figure packets out.

I figured out that the client, after connection, would wait for the server to send 2 packets, which I captured with my own (terribly coded) C# fakeclient.

These packets were those 2.

0E 00 4F 00 01 00 31 BC 66 FE 0A 60 2A D0 06 09
60 F9 62 F9 9B 1B 31 BC 66 FE 0A 60 2A D0 06 09

I also know that "BC 66 FE 0A 60 2A D0 06" are 2 ints or 2 int16's, so I don't think 09 is the opcode?, but rather 0e with 00, but that brings me to my next problem, the second packet doesn't have a 00 as second byte.

So to make it simple, which part of this packet is the actual opcode?

Regards,

Yoni.

 

[lolwutwat]

If you've correctly decoded/decrypted it then it's 0E

 

[Diamondo25]

Hello,

A while ago I made a post about packets, well I've been looking into it now and then and finally made something working, for a part atleast.

Now according to some tutorials I read is that the packets are read from right to left, little endian and that the first 2 bytes are the 'opcode'/'header'?, correct me if I am wrong.

I am using EMS v79(latest) to figure packets out.

I figured out that the client, after connection, would wait for the server to send 2 packets, which I captured with my own (terribly coded) C# fakeclient.

These packets were those 2.

0E 00 4F 00 01 00 31 BC 66 FE 0A 60 2A D0 06 09
60 F9 62 F9 9B 1B 31 BC 66 FE 0A 60 2A D0 06 09

I also know that "BC 66 FE 0A 60 2A D0 06" are 2 ints or 2 int16's, so I don't think 09 is the opcode?, but rather 0e with 00, but that brings me to my next problem, the second packet doesn't have a 00 as second byte.

So to make it simple, which part of this packet is the actual opcode?

Regards,

Yoni.

You probably forgot to clear the buffer when you received a new packet, as this is a correct packet (the other stuff is just the left-over data from the last packet):
[60 F9 62 F9] [9B 1B]
[HEADER] [OP]

As you can see, the OPcode isn't decrypted at all. And it does not contain any data (probably PING/PONG or STARTUP packet)
The header is used for IV check (is it still correct?), Version check (contains version) and data size.

 

[yoni2]

You were right about cleaning the byte array, removed the 0s aswell

EB 8B E9 8B C9 7B(1b is now 7b?)

You are also right about the ping/pong/check packet, these are the first packets I am getting from the server.

But if this packet was a client packet that has to be send to a server, do I have to reverse it?, the packets I receive now are obviously not reversed so I guess if I work on this way without reversing it should be fine too?

here is a dump of multiple connections

Spoiler

0E 00 4F 00 01 00 31 34 0F F5 10 61 79 83 24 09
0E 00 4F 00 01 00 31 2B 4A 06 46 1B 18 01 51 09
0E 00 4F 00 01 00 31 3D 25 F1 0F BD 3D 4B 7A 09
0E 00 4F 00 01 00 31 13 2A 76 46 6A 1C 63 68 09
0E 00 4F 00 01 00 31 90 79 F3 38 8B 0A FF 47 09
0E 00 4F 00 01 00 31 FE 69 4E 5D 46 25 70 78 09
0E 00 4F 00 01 00 31 4E 25 33 75 B7 30 C6 0B 09
0E 00 4F 00 01 00 31 9F 32 E9 22 73 35 2A 1A 09
0E 00 4F 00 01 00 31 5B 74 0B 6C 28 7E D2 46 09
0E 00 4F 00 01 00 31 33 5F 26 72 3B 33 BE 58 09
0E 00 4F 00 01 00 31 46 3D 71 19 EC 74 22 73 09
0E 00 4F 00 01 00 31 5E 37 64 42 47 1C 9D 05 09
0E 00 4F 00 01 00 31 D3 4F 43 79 71 0C 47 52 09

So I asume 52 09 forms a opcode if this was a real game packet?

(perhaps if you got some spare time, you could help me over msn/skype/chat?)

 

[Diamondo25]

The first packet sent from the server is _always_ the handshake packet, and can be structured as follows:

Short - Length
Short - Version
Short - Length of upcoming ASCII string
... - Bytes of the string
Int - Send IV
Int - Receive IV
Byte - Server Locale (0x08 for GMS, 0x09 for EMS/BMS)

The following packets needs to be encoded/decoded with AES and MapleStory's own cryptography.
Here's a link to mine:

To view the content, you need to sign in or register

 

[yoni2]

Wow, mind blown, thanks alot for this, I am finally getting somewhere!

Just a small question, what are Send IV and Receive IV, I know these are random, so I guess these are connected to 1 client and will be used in other packets?

 

[Diamondo25]

Wow, mind blown, thanks alot for this, I am finally getting somewhere!

Just a small question, what are Send IV and Receive IV, I know these are random, so I guess these are connected to 1 client and will be used in other packets?

The session is set-up between the server and the client. To increase the security between these hosts, an encryption is set up. The IV's are used at both sides, at one side for encrypting and the other side for decrypting. You do not send the IV with the next packet, but instead shift the value with the version and length of the packet and put at the front of the buffer (the header) that is encrypted with the same IV the header was made. Look into my posted pastebin to see how it works exactly.