[RELEASE] code105 ol,server and client,but no sql

[aqualung]

here is another client v=1013,maybe help you @aqualung @hodias

You must be registered to see links

With this client, I get this message:

@xlw00tlx can you translate..



Anyone have newer client... maybe ver 1015 - 1020

AquaLung

.

 

[lastfun]

hi, guys)
a little bit about the *.zpk format (as i could understand it)...
open any hex editor (for example Media.zpk) and look:

You must be registered to see links

*.zpk consists of a header and a heap zlib archives (0x78, 0x9C - one of the 3 standard headers zlib)
unpack last archives (offset 0x06360de3) and see:

You must be registered to see links

we see a list of files)
unpack second from the end archives (offset 0x063576da) and see:

You must be registered to see links

we see a set of 30-byte blocks
try to unpack №6 (it should be a picture file (Arrowhead_03.dds))
take out the archive file from the media and unzlib him, and see:

You must be registered to see links

...we see an encrypted DDS file ))
is immediately clear that this is a simple XOR, key = 0x98
unXOR it, ..... result:

You must be registered to see links

I do not parse fully all of the fields, this is what i was able to understand in a short time (i have little free time)
I hope someone will write unpacking datapack this game earlier than me...
good luck, guys)

 

[aqualung]

hi, guys)
a little bit about the *.zpk format (as i could understand it)...
open any hex editor (for example Media.zpk) and look:

You must be registered to see links

*.zpk consists of a header and a heap zlib archives (0x78, 0x9C - one of the 3 standard headers zlib)
unpack last archives (offset 0x06360de3) and see:

You must be registered to see links

we see a list of files)
unpack second from the end archives (offset 0x063576da) and see:

You must be registered to see links

we see a set of 30-byte blocks
try to unpack №6 (it should be a picture file (Arrowhead_03.dds))
take out the archive file from the media and unzlib him, and see:

You must be registered to see links

...we see an encrypted DDS file ))
is immediately clear that this is a simple XOR, key = 0x98
unXOR it, ..... result:

You must be registered to see links

I do not parse fully all of the fields, this is what i was able to understand in a short time (i have little free time)
I hope someone will write unpacking datapack this game earlier than me...
good luck, guys)

lastfun
Very nice, thanks!

AquaLung

.

 

[xlw00tlx]

@aqualung i use

You must be registered to see links

u put a image slect the text then ocr it and sometimes it shows the text from the image
提示 -->prompt
充码磺误 Full code key errors

 

[apple3236]

With this client, I get this message:

@xlw00tlx can you translate..
View attachment 158690


Anyone have newer client... maybe ver 1015 - 1020

AquaLung

.

It is "password error".

 

[exe19890522]

@lastfun thanks for your help,but maybe your pic are broken,why i see just some X X X pictures.
aqualung that pic means: tip assword is wrong ,sure. i also don't know why you enter a wrong pwd,test--test ,maybe you enter a wrong letter.
the 10013maybe is the newest version for i can dl form web.it is hard to search.

 

[aqualung]

@ALL
Thanks!

I looked into it further and v1013 may work. I now receive the 'StateNotice=' message from ServerInfo.ini in the client window. When authenticating, the login server is querying the DB for the account. The issue seems to be with salt_s and verifier_v (which is a type of Secure_Remote_Password_Protocol) Anyone have experience with this? If we can figure this out, should get a successful login.

You must be registered to see links

@exe19890522
The .sql you included in original download to INSERT an account: Is it real and what password does it represent, any idea?

INSERT INTO ark_account (accountName, salt_s, verifier_v, name, idCard, joinDate,birthday,address,qq,mail,phone,education,sex,IsPlatformAccount)VALUES ('bunny0', 'A29E2E9438DA7EA22AA1AEF1D882CF0D5D8E33638346EF98060C83427CA13B4F', '2C9519CEACE3C2D71C8FDA6E068E764F71B8283FDAB329D22551F75EA2331ACC', '测试', '440901197709194316', now(),'1977-09-19', '
', '
', 'xyfbao@163.com', '
', 5, 1, 0);

AquaLung


.

 

[SanGawku]

Probably have to find the method it calls to check. Its probably md5 hash and salt is probably the hashed password hashed again.

 

[aqualung]

Yes, I will have to look into this deeper when I find time. Working for a living is a killer, no time!

AquaLung

.

 

[exe19890522]

@ALL
Thanks!

I looked into it further and v1013 may work. I now receive the 'StateNotice=' message from ServerInfo.ini in the client window. When authenticating, the login server is querying the DB for the account. The issue seems to be with salt_s and verifier_v (which is a type of Secure_Remote_Password_Protocol) Anyone have experience with this? If we can figure this out, should get a successful login.

You must be registered to see links

@exe19890522
The .sql you included in original download to INSERT an account: Is it real and what password does it represent, any idea?

INSERT INTO ark_account (accountName, salt_s, verifier_v, name, idCard, joinDate,birthday,address,qq,mail,phone,education,sex,IsPlatformAccount)VALUES ('bunny0', 'A29E2E9438DA7EA22AA1AEF1D882CF0D5D8E33638346EF98060C83427CA13B4F', '2C9519CEACE3C2D71C8FDA6E068E764F71B8283FDAB329D22551F75EA2331ACC', '测试', '440901197709194316', now(),'1977-09-19', '
', '
', 'xyfbao@163.com', '
', 5, 1, 0);

AquaLung


.

i am not sure ,i found it in the file:2014-06-23_logSQL.sql in the [Log_PayUserManagerServer] folder,
i think it is may a origin thing.
but i am not good at crack md5-hash ,from the sql's name:salt_s, verifier_v,i know it is a +salt hash.
it is hard to crack for me.
sorry.

 

[SanGawku]

The salt is probably something simple it usually is. Is there a procedure somewhere in the sql. Or just look at the login function and use a simple password and debug with ollydbg

 

[aqualung]

ok, so still trying to get my head around SRP process because the password is never transmitted between the server and client, they just prove to each other that they know the password. Here is a good detail of how SRP works, in a python script:

# An example SRP authentication
# WARNING: Do not use for real cryptographic purposes beyond testing.
# based on http://srp.stanford.edu/design.html
import hashlib
import random

def global_print(*names):
    x = lambda s: ["{}", "0x{:x}"] [hasattr(s, 'real')].format(s)
    print("".join("{} = {}\n".format(name, x(globals()[name])) for name in names))

# note: str converts as is, str( [1,2,3,4] ) will convert to "[1,2,3,4]"
def H(*args):  # a one-way hash function
    a = ':'.join(str(a) for a in args)
    return int(hashlib.sha256(a.encode('utf-8')).hexdigest(), 16)

def cryptrand(n=1024):
    return random.SystemRandom().getrandbits(n) % N

# A large safe prime (N = 2q+1, where q is prime)
# All arithmetic is done modulo N
# (generated using "openssl dhparam -text 1024")
N = '''00:c0:37:c3:75:88:b4:32:98:87:e6:1c:2d:a3:32:
       4b:1b:a4:b8:1a:63:f9:74:8f:ed:2d:8a:41:0c:2f:
       c2:1b:12:32:f0:d3:bf:a0:24:27:6c:fd:88:44:81:
       97:aa:e4:86:a6:3b:fc:a7:b8:bf:77:54:df:b3:27:
       c7:20:1f:6f:d1:7f:d7:fd:74:15:8b:d3:1c:e7:72:
       c9:f5:f8:ab:58:45:48:a9:9a:75:9b:5a:2c:05:32:
       16:2b:7b:62:18:e8:f1:42:bc:e2:c3:0d:77:84:68:
       9a:48:3e:09:5e:70:16:18:43:79:13:a8:c3:9c:3d:
       d0:d4:ca:3c:50:0b:88:5f:e3'''
N = int(''.join(N.split()).replace(':', ''), 16)
g = 2        # A generator modulo N

k = H(N, g)  # Multiplier parameter (k=3 in legacy SRP-6)

print("#. H, N, g, and k are known beforehand to both client and server:")
global_print("H", "N", "g", "k")

print("0. server stores (I, s, v) in its password database")

# the server must first generate the password verifier
I = "person"         # Username
p = "password1234"   # Password
s = cryptrand(64)    # Salt for the user
x = H(s, I, p)       # Private key
v = pow(g, x, N)     # Password verifier
global_print("I", "p", "s", "x", "v")

print("1. client sends username I and public ephemeral value A to the server")
a = cryptrand()
A = pow(g, a, N)
global_print("I", "A")  # client->server (I, A)

print("2. server sends user's salt s and public ephemeral value B to client")
b = cryptrand()
B = (k * v + pow(g, b, N)) % N
global_print("s", "B")  # server->client (s, B)

print("3. client and server calculate the random scrambling parameter")
u = H(A, B)  # Random scrambling parameter
global_print("u")

print("4. client computes session key")
x = H(s, I, p)
S_c = pow(B - k * pow(g, x, N), a + u * x, N)
K_c = H(S_c)
global_print("S_c", "K_c")

print("5. server computes session key")
S_s = pow(A * pow(v, u, N), b, N)
K_s = H(S_s)
global_print("S_s", "K_s")

print("6. client sends proof of session key to server")
M_c = H(H(N) ^ H(g), H(I), s, A, B, K_c)
global_print("M_c")
# client->server (M_c) ; server verifies M_c

print("7. server sends proof of session key to client")
M_s = H(A, M_c, K_s)
global_print("M_s")
# server->client (M_s) ;  client verifies M_s

Now, I have not figured it out yet, but I did figure out the password for the included account insert sql which is:

ACCOUNT: bunny0
PASSWORD: 000000

And I'm in:



Just hanging after Char selection, probably DB issue's. Need to look into this further..

UPDATE: Actually it hung because DatabaseServer.exe crashed, lol!

AquaLung

.

 

[SanGawku]

Oh sweet. Now we have to make a mysql proc for making new users with password.

 

[SanGawku]

If you log the mysql server you can probably see its missing a stored pro

 

[aqualung]

Yes, turning MySQL logging on now, we'll see what happens...

UPDATE:

Fixed a few DB issue's but gives this message when creating char:
translate...

 

[hodias]

@aqualung send me your database backup? is still using the same password error using 000000

 

[aqualung]

Here is current DB which lets you login:

You must be registered to see links

ACCOUNT: bunny0
PASSWORD: 000000

NOTE: Don't forget to issue command 'changeserverstate' in console of login server to take it out of Maintenence mode.

AquaLung

.

 

[xlw00tlx]

@aqualung
"name contains illegal character" try to make a char using chinese name and letters

 

[lastfun]

Here is current DB which lets you login:

You must be registered to see links

ACCOUNT: bunny0
PASSWORD: 000000

NOTE: Don't forget to issue command 'changeserverstate' in console of login server to take it out of Maintenence mode.

AquaLung

.

hm...

You must be registered to see links

What's this?

 

[aqualung]

Code105.sql creates tables only, not the database. In Navicat, create db, double click to select, then right click it and select execute script from there.