Tartaros Online (INTIVsoft) — getting a Themida + GameGuard(2016) client to run offline for a private server

[extrakyo]

Hi all,

I'm trying to revive Tartaros Online (TW name "星空幻想", a Korean MMO by INTIVsoft — KR
closed 2013, TW/Playwith 2016, JP 2018). All official servers are long dead and there are
no public server files anywhere, so I want to get the stock client to RUN and connect to a
local server so I can start reversing the protocol. I've done a lot of static RE already;
the one thing blocking me is GameGuard.

== The blocker ==
- The launcher (a clean "PatchClient2") is gated on the dead patch server, so its "Start"
button never enables.
- Running the game body directly (Tartaros.bin -> _tartaros.exe, as admin) gives
GameGuard Error 153 ("GameGuard files missing or tampered"), then nProtect's error-report
dialog. It DOES reach the nProtect update server (54.116.118.11:80) but still 153s — looks
like GG's update/verify fails because this title's GG service is decommissioned.
- Disabling Windows Defender (real-time off + folder exclusion) did NOT change the GG error.

== What I've confirmed ==
- Client protection = Themida / WinLicense (strings "Themida", "WLNumDLLsProt",
"RestartApp.exe" appear once the outer stub decrypts; per-page on-demand decryption, so a
clean full unpack isn't realistic).
- GameGuard = nProtect 2016 (GameGuard.ver 2015-09; GameMon.des 2016-10, npggNT.des 2016-10,
npgmup.des 2016-08; INCA Internet signed).
- Transport layer (from the clean, unstripped Network.dll): WS2_32 IOCP, NO transport-layer
crypto. Wire framing = [uint16 LE length][uint16 reserved=0][payload], payload <= 0x400.
Opcode handlers live inside the Themida'd binary.
- Tooling: Win11, x32dbg + ScyllaHide (defeats the outer stub's basic anti-debug). The game
reaches DirectX init (dxgi/DXCore load) before GG kills it.

== My question ==
I don't need to cheat — I just need the (Themida-protected) client to run offline and connect
to my own server. What's the realistic way past GameGuard here?
- Stub/neuter GameGuard (dummy npggNT.des / GameMon.des)? My worry is the game's GG check is
virtualized by Themida, so a naive stub probably fails the challenge-response.
- Is there a known generic bypass for this 2016 nProtect build that applies?
- Or a better approach I'm missing for a dead title whose GG verification server is gone?

Purely a preservation / private-server effort on an abandoned game. Any pointers appreciated — thanks!

 

[hagios]

I'm glad to see someone else working on Tartaros in 2026. I'm also trying to get Tartaros Online running offline.


So far, I've managed to get an old Japanese client running, and I've attached a screenshot.


I was wondering which client you're working with (KR/TW/JP?) and whether it's still possible to obtain it somewhere. I've spent quite a while searching, but haven't had any luck.


Since I'm only working with an older client, I may not be able to contribute much yet, but I'd be happy to exchange information if you're interested.


Best of luck with your project.

 

[hagios]

Small progress update:


The old Japanese client is now running, and I can move around in town. I've attached a short GIF showing the current progress.


If anyone happens to have a fully patched client from before the original Tartaros Online service shut down (preferably the Japanese version, but any original regional version would also be helpful), I would greatly appreciate any help or information. I've been searching for one for quite some time without success.


Thank you.

 

[nazrin9304]

Would you two be interested in creating a Discord server for this game?

I think it would be better if you had a faster way for people to contact you.

And I would also be interested in joining the Discord server

 

[huanyizhan]

Hi all,

I'm trying to revive Tartaros Online (TW name "星空幻想", a Korean MMO by INTIVsoft — KR
closed 2013, TW/Playwith 2016, JP 2018). All official servers are long dead and there are
no public server files anywhere, so I want to get the stock client to RUN and connect to a
local server so I can start reversing the protocol. I've done a lot of static RE already;
the one thing blocking me is GameGuard.

== The blocker ==
- The launcher (a clean "PatchClient2") is gated on the dead patch server, so its "Start"
button never enables.
- Running the game body directly (Tartaros.bin -> _tartaros.exe, as admin) gives
GameGuard Error 153 ("GameGuard files missing or tampered"), then nProtect's error-report
dialog. It DOES reach the nProtect update server (54.116.118.11:80) but still 153s — looks
like GG's update/verify fails because this title's GG service is decommissioned.
- Disabling Windows Defender (real-time off + folder exclusion) did NOT change the GG error.

== What I've confirmed ==
- Client protection = Themida / WinLicense (strings "Themida", "WLNumDLLsProt",
"RestartApp.exe" appear once the outer stub decrypts; per-page on-demand decryption, so a
clean full unpack isn't realistic).
- GameGuard = nProtect 2016 (GameGuard.ver 2015-09; GameMon.des 2016-10, npggNT.des 2016-10,
npgmup.des 2016-08; INCA Internet signed).
- Transport layer (from the clean, unstripped Network.dll): WS2_32 IOCP, NO transport-layer
crypto. Wire framing = [uint16 LE length][uint16 reserved=0][payload], payload <= 0x400.
Opcode handlers live inside the Themida'd binary.
- Tooling: Win11, x32dbg + ScyllaHide (defeats the outer stub's basic anti-debug). The game
reaches DirectX init (dxgi/DXCore load) before GG kills it.

== My question ==
I don't need to cheat — I just need the (Themida-protected) client to run offline and connect
to my own server. What's the realistic way past GameGuard here?
- Stub/neuter GameGuard (dummy npggNT.des / GameMon.des)? My worry is the game's GG check is
virtualized by Themida, so a naive stub probably fails the challenge-response.
- Is there a known generic bypass for this 2016 nProtect build that applies?
- Or a better approach I'm missing for a dead title whose GG verification server is gone?

Purely a preservation / private-server effort on an abandoned game. Any pointers appreciated — thanks!

I came across your progress post on Bahamut — the one where you get login through
to character creation against your own server. That's a long way past where I am,
and it's the specific thing I want to ask you about.
I've been working on the same game. I'm on the **Taiwan retail client**, and I'm
stuck exactly where you described being stuck: **GameGuard**.
Concretely — the launcher is gated on the dead patch server, and running the game
body directly gives a GameGuard error and then nProtect's error-report dialog.
Error 380 in my case rather than 153, but the cause looks identical: the client
tries to reach `patchgameguardta.playwith.com.tw` for its update config, that
hostname no longer resolves, and the verification fails. **The client never
reaches the networking stage, so it never sends a packet** — which is why I still
don't have the application-layer opcodes.
I got the launcher half working: a local HTTP server serving `/launcher/index.html`
and a matching `Integrity.xml.gz` does unlock the Start button. So the patch stage
is solved on my side. It's the GameGuard stage I can't get through.
**So — how did you get past it?**
Three things I'd like to know, in order:
1. **Did you switch to a different client, or did you actually get past GameGuard?**
I ask because your post mentions getting the main program from someone else, so
I suspect it's the former.
2. **If it was a different client: which build (KR / TW / JP), and roughly what
channel did it come from?**
3. **If you did get past GameGuard: what was the approach?** I've tried the obvious
things and every one dead-ended —
- hosts file clean, no DNS interception of GameGuard's own lookups, no proxy
- looked for an offline mode: every `.des` module is a plain PE, `npgmup.des` is
only a local module manager (rotates `.erl` files, no network code), and the
update URL appears in **no plaintext at all** — not in the GameGuard modules,
not in either executable, and not in the launcher's memory after it decrypts
its config
- `GameGuard.ver` is a version stamp (`Fri Sep 11 10:24:03 2015`), not a
last-updated time
**Even just the general approach would help.** If there are details you'd rather
not put in a public thread, I completely understand.
---
## Something I have that might be useful to you
You mentioned earlier that Themida's per-page decryption makes a clean full unpack
unrealistic.
**I got one anyway.** No debugger, no ScyllaHide — Themida has already unpacked the
image by the time it matters; the GameGuard error dialog is modal, so the process
just sits there. I dumped it with `MiniDumpWriteDump` and rebuilt the image from
the dump.
That gives a **13,590,528-byte unpacked PE** that Ghidra decompiles into ordinary C.
Verified: **0 of 173 code-section blocks above 7.0 entropy** (the packed original
averages 7.8).
**The image and the full reproduction procedure are yours if you want them.** Your
static analysis is deeper than mine — it'd probably go further in your hands.
---
One more thing, in case it's useful for comparison. From my client I recovered the
wire format as:
```
[0..1] u16 LE length (1 .. 0x1000, zero rejected)
[2..3] u16 LE type code
[4..] payload
```
The second field isn't a constant — it's a **type code**, and both the header
length and the encryption depend on it:
| Type | Header | Payload |
|---|---|---|
| `0x2633` | 8 | XOR (`0x7c` first byte, then `key[i+3]`), then a second stage |
| `0x0BBB` | 6 | XOR (`0xb6` first byte, then `key[i+3]`), **+ checksum** |
| `0x1A68` | 4 | plaintext |
| `0x22D7` | 4 | plaintext |
(`0x0BBB`'s checksum is a 16-bit sum of the decrypted payload bytes.)
If your client is a different build, yours may differ — worth comparing either way.
---
Same goal as yours here: **get the original client talking to a self-hosted
server.** Not looking to cheat.

 

[Diegpe]

Would you two be interested in creating a Discord server for this game?

I think it would be better if you had a faster way for people to contact you.

And I would also be interested in joining the Discord server

It would be great to have a Discord server where we can still share our love for the Tartaros Online franchise.

 

[huanyizhan]

It would be great to have a Discord server where we can still share our love for the Tartaros Online franchise.

Hi, is there a discard server available now?

 

[hagios]

Small progress update:
I’ve now implemented character switching, facial expressions, animations, and changing towns.
I’m still looking for a complete Japanese client, either the original version or Rebirth.

 

[nazrin9304]

Small progress update:
I’ve now implemented character switching, facial expressions, animations, and changing towns.
I’m still looking for a complete Japanese client, either the original version or Rebirth.

I have Thai game client (already completed season1 contents). Do you want it? I am in this Discord server here discord.gg/m6Qap9zFEW

 

[hagios]

Big progress update: I’ve implemented avatars!

At the moment, I have an incomplete Japanese client and a complete Taiwan Rebirth client.
If anyone has a Japanese client, please feel free to contact me.

Thank you for offering to help.

 

[hagios]

I have also been continuing the analysis of combat-related systems, and I have now reached the point where a certain amount of restoration is possible.

The mechanisms behind skill activation and character-side processing have become fairly clear. However, as the analysis has progressed, it has also become apparent that fully restoring the original combat system using only the information remaining in the client will be difficult.

In particular, some information that appears to have originated from the server side, including data related to .mef files, is missing. Because of this, there are aspects such as enemy behavior and placement that cannot be fully reconstructed from the client alone.

As a result, while using the remaining client-side logic and data as references, I may need to supplement or reconstruct some of the missing parts myself.

There are also still some uncertainties outside of combat. For example, the exact initial positions when entering towns and the placement positions of NPCs have not yet been fully determined. These may also have depended on server-side information, and cannot currently be established with certainty from the client data I have available.

If anyone has any server-side data from the original service, related files, packet captures, development materials, or analysis documents, I would greatly appreciate your help.

In particular, I would be very interested in:

• server-side information related to combat or monster behavior
• information related to .mef files
• town entry positions and NPC placement data
• packet captures or other server-related materials from the original service

If you have anything like this, please feel free to contact me.

I am also still looking for a fully updated Japanese client, as mentioned previously. If anyone has one, or knows where one may still be available, I would greatly appreciate hearing from you.

I only included images in my previous post, so I’ll upload a GIF here as well.
The basic character actions and movement have been successfully completed.

Big progress update (added):
I have now implemented the skills available in the client I currently have. I may also implement things such as cooldowns and buffs later if I feel like working on them.
I have also successfully completed movement to any challenge or mission map.
I managed to get this far using only the packet information I currently have. At this point, the main issue is how to fill in the missing parts, since I do not have the original server-side information.
Also, even just the Japanese voice pack would be very helpful. If anyone still has it, I would greatly appreciate it if you could provide it.

 

[hagios]

Small progress update:
I have restored the NPCs in the towns.
Since their position data was not left in the client, I restored their placement by using old gameplay videos as references.
I am also currently working on the combat system, but because some server-side information is missing, I have begun reconstructing parts of it based on my memory of how the original game behaved. It may also be necessary to manually restore things such as the portals between maps in the same way.

 

[nazrin9304]

Great job

 

[hagios]

Small Progress Update:
I'm still working on the restoration, but I've confirmed that hit detection is actually working.
After further investigation, it looks like skill hit detection, movement distances, movement handling, buff handling, and similar mechanics will have to be implemented entirely by hand.
If anyone has skill compilation videos or similar footage, even just posting the URLs would be helpful.
The client also doesn't contain information about the portals used for movement in missions and challenges, so these will likely have to be restored manually as well.
Enemy HP values and similar data are also missing from the client, so it looks like I'll have no choice but to implement them using estimated values.

I'm also still looking for a full Japanese client, so if anyone is willing to help, please contact me.

 

[Diegpe]

Tales of Tartaros (Thailand/English): discord.gg/SfaxY5zqH6

 

[extrakyo]

To view the content, you need to sign in or register

It is Traditional Chinese.

 

[hagios]

Just a reminder that RaGEZONE's forum rules discourage moving discussions to external platforms such as Discord. The administrator has also explicitly stated that circumventing the forum's contact system to direct users to Discord may result in a warning.
Rather than repeatedly posting Discord invitations, please keep this thread focused on technical discussions and share relevant information here on the forum.
Additionally, I do not intend to join Discord, even if invited.
Thank you for your understanding.