Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/363 Thanks!
All right, so my name is Matthew Halter,
CHAC, security technician
with Security Innovation, and just as
we get started here, you might notice the
mouse cursor pop up on the screen have
got this awesome little presentation
remote that likes to do that.
It's a nice old feature, but it's
probably going to get annoying and I can
stop it.
Sorry.
So anyway, I'm a security technician with
security innovation.
I've just got to give them a little bit
of a shout out because, one,
they're paying for me to be out here.
And two, they gave me a couple of weeks
of work, just kind of spent some time
working on this project.
So, yeah, I basically do the testing
application stuff.
And I am Joseph Tatiara.
I'm a security consultant with Bioactive
and Metal Gear Solid.
All right. So just as we said again
here, this isn't a development talk.
I mean, we're not going to be talking about
the programing like no client server
or anything like that.
There are other companies that you
probably go to if you want something like
that. We're also not going to be talking
about exploitation.
I mean, there are some experts that we've
come across, but that's not what our
talks about.
It just kind of a cool little project, at
least to us that we basically
just rebuilt a server from the client
will go into a little bit more on what
that is. And I mean, if you do a lot
reverse engineering, you're probably not
going to get a whole lot out of this.
We're not getting super technical.
It's it's basically
something that we realized that there was
nothing really talking about
doing, like trying to rebuild the server.
So we want to give something back to the
community with that.
So the basic project, Save MGO dot com
was back in 2006.
I use place online game middle gear
online.
And I mean, I was a teenager at
the time, just love playing this game and
it got shut down after only a year of
being online.
So I'm like, well that sucks.
Now I want to play it again.
It took quite a while, but over the last
couple of years now we start rebuilding
and basically just rebuilt the server
after it was already taken down.
So unlike a lot of private servers, I
mean, we didn't have a live server to
kind of work with.
We were just left with the
client, the client binaries
and not a whole lot else kind of go from.
So the initial problems that you're
running into when trying
to rebuild these servers is the
least for our case.
The real server was offline.
We weren't rebuilding.
Like all the Warcraft where we had an
active server we can start playing with.
We had nothing. So we had a minimum
packet capture that somebody
from the team had from years before.
And in this case, the
game had no land play.
So we were pretty much stuck.
We actually brought back two
versions of the game.
The original version was on the two
and the sequels on the three.
So for the two version,
you know, there is no official debugging
and interface it kind of difficult,
but we were able to do some memory dumps
with an emulator that made our lives a
little bit easier.
And for the three,
the game was actually removed with an
official update. So we had to
use an older version of the game and
also put custom firmware onto the console
so that we could, you know,
run unsigned code and analyze the
binaries and play with it from there.
So some of the initial high level
overview, we're going
to start by redirecting the traffic to
our controlled server so we actually see
what is happening, what's going on.
We'll go ahead and implement known
protocols, HP, stuff
like that, that we can just get up
and running with and then start to
implement unknown protocols once we
actually figure out what they are.
So traffic direction,
it's pretty simple, nothing special,
you can start by patching
the binaries. The issue is for something
like the two that's not too
realistic.
You can't really patch a binary,
press it to a disk and meld the disk out
to your friends or anything.
You'll have to find a different way.
In our case, we just did it by DNS
for the it's a little bit different since
we can just set up a
hyperlinking people and download a biner
and throw it on their console.
You could patch it, but DNS is
easy.
It's simple.
It's what we recommend.
So the first protocol that we took
out was done. It's really a non-issue.
You can run around with a simple
stuntwomen or pointed to a public server.
I believe we just pointed to a public
server and I took care of it.
It's pretty basic stuff
gets you through.
Yeah, we sort of just point the stunts
are off to a public server.
Now, obviously, once we have the server
software running our own, I mean, there's
plenty of services available for that.
And we've got the next guy.
The first challenge really that we came
up with are came up against
was the dynamic network authentication
system. This is what Sony kind of uses to
prevent cheating online and piracy.
That's where they're going to do the disk
search thing. Like, is this a real disk?
Should this used to be online?
That's, I believe, where they do the
bands like where they check with your
consoles banned from going online, things
like that are all in there.
So bypassing this
in the case of Melgar online, one,
basically we'd get to this point and it
would just say this game is no longer
online, get out.
It won't give us a chance to prove who
real disciplined, give us a chance to get
any information.
All it did was basically
block. So we had to find our way around.
We couldn't just use the piracy bypass
where you just patch the old parts of the
disk to return positive information.
You're good to go.
So the bypass for games no longer online
is kind of something new.
I worked for quite a while on this.
This was kind of the first thing where
I'm just kind of heading hitting this
wall and having a bunch of issues.
I said I really never actually
matches I want to I have a nice, pure
server where you just pop the disc and no
no action is just pop your game in
connects, you know, change the DNS and
you can play and try and do that.
I mean, we did find some useful
resources. Sony SDK is kind of public.
There's documentation for this.
But ultimately, we just weren't
successful at all with actually trying to
do this and trying
to recreate that part of the server.
I mean, eventually I plan to come back
to this, but at this point, we haven't
done it.
But I did manage to find in the code
is this new DNS connect,
just those drinka laying around code.
And if you follow it around, look at
words of reference from
unifying this function
that basically it's like, well, what
happens if you return zero zero being a
nice return code to try
to patnaik that let us kind of patch
out the actual DNA, check
it, get to the DNA would be like, here's
DNS and there goes.
It wouldn't do anything if baseballers
patch it out. But of course, the issue is
we've already mentioned is you can't
distribute this, you can't press
your own disks and just kind of pass it
out to everybody to play with.
But there are these cheap devices.
I don't know how many of you play like,
you know, in some of the old consoles,
like the game jany with the nets
or game sharks
or anything like that.
Magic.
Yeah, there are these codes.
You just kind of enter them.
And if you don't know what they are, they
look like they're just magic.
If you look at these cheats here and
they're just numbers, I mean, if you
don't know what you're looking at, it is
pretty much it's magic.
But what does that lets you overwrite
it? There's a lot of things that you can
do with it. But one of the things that
lets you overwrite the four bytes of
memory at the
most mean you can do like just one byte
if you want to. You can do a bunch of
things so we can use
those cheats. I mean, these few cheats
here, this is actually setting up a
return
or I guess it's setting one off the
registers to zero, doing
a jump back to the return address
and then just a no off at the end of it.
So baseball, these works you've got
the first character represents what type
of cheat you're trying to do.
So see as a condition, it's checking
if you know the value of memory address
A is equal to be run.
The rest of these codes and two is
telling you to overwrite the four bytes
that address A with values that B.
So I thought that was kind of cool, it's
just I mean, they were magic to me until
I started looking at this and
then going on to the three.
You're dealing with the PSN networks
no longer DNS and the PC
network is currently offline,
I think, but
it's use for account services,
profile friends, list matchmaking
on certain games, commerce,
the store, all that crap.
So looking through the binary,
there's this cute little call for
start dialog, I think.
And if you
look at it, it reads a nice struct.
So there's two different network types.
For three games,
the type zero
would be a network game, so
it would go to that side.
It would initially initiate your network
device. It would check if your Ethernet
or Wi-Fi is connected to an IP
and continue execution of the code.
But if it is a type one, which is PSN
game, it does the same as not.
But then it also checks if you have a on
account registered on the system
and if you don't, then it forces you to
create one. If you do, then it checks to
see if you're authenticated.
So lucky for us that was
the patch just changing it to a zero.
And then the issue that you run into
is all the other network profile calls
are not loaded because it
never loads up the PSN libraries.
So you just have to go through the rest
of the binary and pacis out fulfill
them in some way.
In our case, it was pretty simple.
We had one for obtaining your network
I.D.
We just bypassed it
and then the other one was checking for
your age restriction for chat and
stuff is it's a mature game.
So everyone's over 18.
Now, if you're doing something like Call
of Duty where it actually uses PSN for
matchmaking, it would be probably
significantly more involved.
But we lucked out.
So like I said,
for the PS3, you can actually patch
the binary and distribute it
there. ELF binaries, they're packed.
The only thing is that it requires custom
firmware to free to actually run the
unsigned code.
So if you're running just a
standard PS3 with official firmware,
you won't be able to run our passion play
player the game.
But if you are if you do have custom
firmware at home, you can go to save
them. Vodacom, download the patch and
start playing.
So the next protocol we take care of is
it should be pretty simple
for MejÃ­a want it.
The basic account management
registration passwords from
Jota is a little bit more.
It would check the version of your game
to see if you needed an update.
And also this reward shop.
It was this instore shop where you can
buy like hats and shirts and
other crap with points that you would get
from killing people.
So some of the simple guesswork
that we did, little guesswork
was just useful.
So when you're
toying with this stuff at home, you
can try things like we just give it
X 30, which is the ASCII zeros
response and it would continue or
normal or something or just a one and
just kind of toy with it.
The other thing is, if you have live
debugging, which if you have a three
console, you can do a lot of debugging
and makes your life a little bit easier.
You can do things like break on, send
request or receive a response,
stuff like that, and then start to step
through the functions and see where the
computers are.
So, for example, there's a picture of a
graph there and into a large switchgrass
at the bottom.
This is where we just kind of broke on to
you or I'll decode what next
and then saw the switch case.
Those are all authentication errors.
So you either authenticated or
the password is wrong.
The username didn't exist and there is a
session already active, all that crap.
So you can figure that out.
But lucky for us, since we
are controlling the new server, we
don't have to actually reverse
the entire logic.
We just need to triscuit.
So an example
of the logic, we can receive the request
and then we can just validate it on our
back end.
So when the server gets username
with password B, we can do all
the logic and we just send a generic or
a generic success code so you can kind
of use the shortcuts to get
get stuff working without killing
yourself over the binary.
Next main issue is SSL.
Unfortunately the
for the PS3 they did a serpent
incorrectly, so we just kind of
hitting a wall that somehow did it
correctly in the year 2008.
No idea how.
And
so we had to patch it out once again.
That's actually the main reason you need
custom firmware, some of
the other options. If you're doing a
different project, could you buy the
domain? Could you do
a self sensor, downgrade
it, whatever,
take over everything.
Is that legal? That's right.
So,
all right. So most of you are still here.
That's kind of the dry stuff going
through all that. No end protocols
now we're kind of going to get into is
the game protocol itself that custom
made? I think some people have quite
the Konami secure communication protocol.
I don't think there is an official name
for it, but basically
it's their game protocol.
It's what they're using. And this has no
documentation, nothing really available
except for looking at what the client
actually starts sending out.
So, of course, if you can have packet's
servers, dad can't really get packets,
but we have them.
Everything becomes much easier to look
the packets going in, see what comes
out, figuring out that transformation
is just coming down to kind of examining
and comparing everything.
So these are some of the pacts that we
would get sent out.
I don't know how many of you here kind of
read Hecks fluently and
now can just look at this like, oh yeah,
I get that.
But if you're normal, you kind of have to
go, OK, well, there are some numbers.
I mean, maybe you recognize now.
Forty one. You know, the a
you recognize a few letters in.
There are some things, but it helps
if you just look at the ASCII, so.
This really doesn't make sense either,
but there is the A I got that one right.
Well, you guys look that. But if you look
at this long enough, you start comparing
what's coming out. And these are just how
kids being sent from the client
server we're not replying to, but it's
trying to send these things out.
You start noticing some patterns in
there. You see the Z, the P
that P, and you see that guy repeating.
And then in the same column, you start to
know some patterns.
That's five seventy.
While you look the numbers we saw that
you start seeing like eighty five comes
up next and you start noticing more
and more the af the eighty five.
And if you haven't seen this before or
if you have seen this before, it's really
easy to know what's going on.
But if you have seen this before by waste
a lot of time trying to see like that,
you see the pattern, you know there's
something, but you're not quite
sure what it is.
You've got no no bytes in there if you
notice.
And you've got kind of that repeating
four byte set
of characters or four bytes,
it's X or they basically just had a hard
coded key in there, which was the five
seventy eighty five AF and
they just X or the packets with that key
over and over again,
you know, very, very secure protocol.
So you're on the X or.
You're on that excellent things start to
make sense, this is another packet
because the client one
doesn't really help too much in this
case.
We did actually get a packet capture at
one point after the project had been
running for a little while.
So I didn't have a whole lot of
functionality then.
Have a great game, didn't have join the
game, didn't have anything you'd want as
a server, but it was a packet
capture that helped us a little bit.
This is one of those packets where you
can kind of notice something letters
there. This makes more sense than the
other packets I you could see mmHg
three Snake Liquid,
MGE three league
having played the game.
I know those are the lobby names and you
can see chips in there.
Those are fairly clear.
I guess I'm getting ahead of myself here.
I'll get back to this package a little
bit later, but we're going to actually
reversing this part.
But in terms of the protocol itself,
this is what's going to come about.
These are, again, the packages being sent
by the client.
It looks really nice like this, as have
been really easy to look at and try and
see things that are popping
up. Little patterns.
You've got a counter there, you know,
two, three, four or five one.
You can kind of make a guess there.
That's probably some type of sequence
counter at this point.
It's just guesswork trying to figure out
what's going on there. But it's a
reasonable guess.
And you look at this one, you know, it
gets bigger as the
package gets larger.
Perhaps it's some type of size.
These events took a little bit longer,
but they seem to be like a command
identifier, whenever it send the
same command, they'll send out
the same first number.
Some of these other parts will change
with those first or that first.
Who will say the same?
And then you're left with a larger
payload area at
this point, don't get into that content
a bit later in your life with these
things that are kind of random.
And if, like, I have no idea what these
numbers are, what
I tend to do when I see random numbers,
my first thought every time,
our prime numbers.
This is not prime, but that's my thought
every time. And it's been right once.
So I always think of problems, but the
other thing you've got to look at is just
take them out, stop looking at it, as I
just have, and maybe this looks a bit
more familiar to most of you.
It's basically an MD five of the
header and that payload area.
So it's not it's somewhat random,
depending on how you want to count the
collisions, but you start kind
of figuring out the protocols as you
start comparing these packages, start
being and figure things out.
You see the headers always a by command
identifier, the length,
the sequence that hash followed by the
payload.
So now as we start jumping into the
actual payloads, if you've got the
package capture, I've already kind of
mentioned this, it's really easy to just
look at. You can replay the packet.
You can send them over and modify little
things. You could see what happens.
And you're just trying to determine that
transformation coming between those
packets.
So we start looking here.
I mean, these are
some of the actual packets coming
through. And you'll see, like, you know,
the commands always seem to be since
twenty one, the server reply.
This is from our packet capture of
the few packets that we had and the
server reply with 02 and 03.
It's a pattern that we start noticing in
the of stuff came up.
And then we also notice the blue numbers
there, the sequence of adding up
and each one had its own sequence.
So this is back to that same packet I
showed earlier.
Looking at a nicer format, you can see
the league are you can see the lobby
names, you could see Yipes and KDDI
see those things there if we pull out
those numbers, I mean, it's pretty easy
to guess the first bit there.
The snake.
Like what? Those are lobby names
at this point. We had never seen the gate
in the count.
But you can kind of make the guess that
those are probably just servers that they
used in the back end or communication
for authenticating and
for the log in for some of the back end
services. The IPS are pretty obvious.
Some of these other numbers, though,
you've got zero. One, two, three, four,
five. The first numbers, obvious
thing is it's probably an ID
just counting up incrementally.
These ones were a little bit different,
though. You've got zero one to two to
two to two for all the other leagues
going in there. There's actually normally
ten lobbies being sent up, most of
them out.
So you can look at that and
gain maybe some reasonable guess.
There are some educated guesses that are
zero and one refer to that game and
how we had never seen these before.
We can just replay that every time.
And then the two is probably the league
are the lobbies that are actually showing
the snake, the liquid and all
of that.
These numbers, though, haven't quite
figured out exactly why they are, but
there seems to be like some type of
globally unique identifier.
One, two for the account
lobbies are. But ABC, you're kind
of missing everything before,
eh?
My guess is that the Japanese server,
which was up before this one, would have
had the idea with those
numbers and then the Arrow and the North
American service having their own
identifiers, just the Gessen's,
those numbers actually didn't actually
have anything or didn't impact the
gameplay itself. So wasn't too
much of an issue that we don't know
exactly what's going on.
And then the other one zero zero
nine zero zero.
Gain educated guess from having played
nine, probably the amount of players in
there, so we start modifying some
things, set up my own IP and they're
giving the CD, PFG
and a CD.
One note about the CDF.
Gee,
I don't go for that because we change
all of these things, though.
We immediately saw it being replayed out,
their lobby, a lobby, be a lot.
We see exactly what we'd expect.
We did notice that it didn't care if you
had no bite in there or not.
If you see a slow way longer than the B
and C lobby names, just
some place they cared about the normal,
some places it didn't.
It's kind of an interesting thing that we
were able to exploit later on.
So that was easy.
So that was an example when we
actually had packets with the packet
capture, a little bit of
Hardaway's when we were just in the blind
and we don't have a packet capture.
So how can you determine payloads,
you know, are the and a special
type of encoding.
So, Jason, whatever.
Are they encrypted?
What's going on?
There's a link in there. If you download
the slides for Aniceto right up on crypto
stuff that's over my head, you can
download it if you want.
So what do you do?
Like, there's no known format, but we
at least know just from looking at the
earlier payloads that the first four
bytes or normally some sort of error
code and if they're all zeros and that's
a success, and then the server
command is usually plus one
of the requests.
So that's why you saw the two thousand
two than twenty three twenty four
for the responses.
So we just started experimenting.
You know, if something came through and
we had no idea what it was, give us some
zeros and see if it continues.
Right.
If the the next command
you just added one.
If it was correct, it would go go on.
If it was incorrect, you might get an
error display back to the user or
something like that.
So we were able to go ahead and start
looping identifiers to
see if they were even valid or not,
because the gate server would respond
with the command that you
gave us. So if we gave it
to two to two and
it would just not respond because it
wasn't expecting about two to three, it
would come back and say we weren't
expecting that. So, you know, that that's
at least a valid command identifier.
So it's kind of similar to the HP
crap.
Do some guesswork, blank responses
you can do.
No, nobody's expertize
fake successes and just kind of
try to continue to gain from moving on.
This is similar to before where
we didn't really kill ourselves trying to
reverse every single piece of logic.
We just wanted to get it to work to play
again.
So we already talked about that.
OK, so explain items.
Here's an example of a payload that we
didn't really have.
Um, you look at
it and you have the
initial number at the beginning of the
twenty four.
We just assume that that's a number
of items that you own.
And we knew that just from the
account that we had.
And then the first bite
you can see is starting to ascend.
And then the four bytes after that,
they seem to be slightly different.
That turned out to be color codes
for the different items.
So we just started playing with that and
sending it to the client and seeing what
changes were being made.
So, for example, for the headgear
we just sent, that we have zero for
the beginning. No, and nothing showed up.
So we have none.
But now when we add one, we got a
little cool.
So then you can just start a
new birdying through these different
values and figuring out what
pieces go to where.
So three leads to that
color, seven leads to that color,
and you can start mapping out everything.
And then for the shirks, for example,
we put zero, but some stock
item came up.
So it really helped us out as there
are different portions in the game like
this where if you give it unexpected
data, they had a stock
response that would just deal with just
so the game wouldn't crash.
And so that's what
you're seeing there, just give you some
sweater.
But then when you add one, then you
suddenly have a t shirt and start mapping
it out. So this is kind of something
funny.
Nobody knew about this.
We just found it in the files while
enumerating. This was like never released
at some sort of Japanese like Gressler
mask or something.
It's kind of cute. I don't know.
So what was interesting is as
we were going through all these,
we realized that there were actual DLC
items and DLC game modes
that didn't even come out until later
versions of the game, which was kind of
like a dick move because you knew that,
hey, they had this stuff in 1.0 and
you had to pay later to get it.
So that was kind of interesting
because you see, it's a slow and tedious
it's not too difficult just
having to map it all out.
So what about a little bit more complex
payloads?
You still don't have a packet, but simple
basic guessing might not work.
Right?
So one example is the friends
list. We know the
reason. We know it's a friends list and
other things like the gear is
we're watching the packets.
And as we go through the menu options and
have friends list, then we see the
command center.
So we started sending this simple
basic guesses back the node
by its and is whatever
and nothing's working.
We just keep getting this error.
So then we went back and started
actually looking at all the different
types of packets that we're seeing.
We're seeing a client update packets
which are saying, you know,
I'm the client and this
is whatever is going on and that's a
client request packets like I am the
client, what are my settings or what
do I have here in the service?
My response back and then list
packets which are saying,
hey, I'm going to start sending you a
bunch of data and then the next command
is sending the data and the command after
that is, OK, I'm finished.
So that's what we went with.
We went ahead and took the first command
and ran it through Sarahs
took this second command after and just
left an empty payload.
And then the third command after that
as a success.
And we have a new friends list.
So then we can start playing from there.
What happens when we start
going through that middle of this data
and filling it with stuff?
So it's filled up with a bunch of errors
and we have friends.
So now we're going to start
mapping it out. And we went ahead and
as you can see, split up the bytes.
You can see where it's going and and
what data is going where.
You can tell it's not starting.
It is. It turns out there's
a bunch of data in the background that
listed, you know,
where your friend was currently playing,
what lobby is and what room he was in
and all that.
And then the data was just
there, player name.
But that's kind of how we mapped out what
was what.
So you
see, having that output to kind of play
around with, you can experiment, you can
send different data and
it becomes easy.
You just look at what changes and
it works.
But joining a game, I mean, this is what
you want with a game server.
You want to be able to join a game, play
with other people.
And yeah, we could create a game at this
point. We could run around in the map on
our own.
But you're not playing with anybody.
You're just running around on a map
alone, forever, alone.
So anyway, for joy and game, I mean, it
was it was a complicated set of packets
that actually end up being several packs
that need to be responded to.
So there's no pack that
we can work from, no packet log.
It wasn't something that we could easily
guess. There's nothing similar.
Just have to start working
out there, so there are several menu
items here, these kind of helped us
figure out what it was trying to do at
certain points or a game.
We need first try and join.
The game would actually send the same
request as if you had selected the host
info button. So you can guess and
you try and join the game. First thing it
does is it tries to get the host info.
Makes sense. I mean, and with the host
info we're able to play around with, ah,
we can see that data so we can experiment
and we can figure this out.
That pack of itself was easy to figure
out.
Just play around with the data, see
what happens.
The next step was players that,
again, if you
inside the player list, you can make the
player?
S request. We knew what it was, we
didn't know the proper response.
And this is actually probably
the most difficult part to figure out.
And this is another place where we didn't
figure it out yet
of a request of players.
That's right. We know generally what it's
trying to send, just not the exact form
at this point.
So we started looking, though.
We are looking at doing some
static analysis.
They're just looking at the shelf.
That's why there's no debugging
functionality on the table.
But what we did have was
the emulator for the best.
You could load that off my laptop.
I can start the game.
And if you make a safe state, it'll
actually stay the emulators
version of the memory.
So somewhat accurate, at least
let us see the code after it was unpacked
in memory.
So the next thing then, if you got
the code or the disassembly, not
necessarily the code, you can
start looking for, try and find that code
path where your interesting code is.
So what you can do is you look at nearby
strings in this type
of game, you're not really having to make
nearby strings. But we did know that the
request is that forty one point three.
So that was the number we can look for.
Turns out that happened several thousand
times in the file and wasn't helpful.
But the extra code that we mentioned
earlier, that was four bytes.
That only happened a couple of times.
So we can actually follow those,
the XO and we could follow it along
until we found where those where that
other number came up in this nice little
flick switch area.
It's just branching.
If the numbers are if the comparison
comes out to zero
and you follow that along, you see a
function call.
So again, we couldn't figure out exactly
what was going on there.
But what happens again if we just return
zero so we know that's all
it's doing. It's always looking if
something's just zero or not
equal to zero point.
So you can either follow
through and figure out exactly what
little check is going wrong, which is
the ideal case.
Or and then determine what data
would make it pass.
Ultimately, we couldn't figure out what
data would actually make this pass.
We did have to patch it.
That was just returning zero.
We just want to play, just patch it out,
get going.
I spent a lot of time trying to do this,
though. I mean, I wanted to do this
server as pure as possible
is doing everything myself.
It's made me take
a whole off extra time.
So we end up patching this game just a
little code.
We can't, like add a of extra
functionality, but we can patch a few
things here and there.
So this is something that we decide to do
that for.
So now we have a request in
the game, information, we have a
requesting the players, we have a
requesting the player information
of the host, which is the fact
that we dispatch and now it send another
new packet request or another request
coming out. Forty three, twenty.
Of course, these identifiers, I mean,
forty three usually are the first two
names are usually correspond to groupings
like authentication was always twenty,
forty three generally had to do with your
game set up.
So forty three twenty.
It's something about the game but we
don't really know what
that's going to try to use some external
resources so it could jump towards
googling.
Yeah. And this being kind of a private
protocol, not a whole lot
of information, but there was a game that
came out shortly after
middle gear on line one, which is pro
evolution soccer.
And this game was like five months after
I had a or a PC version.
So someone had already kind of figured
out some of the protocol and that
a lot of it was different.
But there were some similarities.
And Melgar online, too, was still online
at this time, but I didn't like that
game, so I was even trying to build that
server.
But it had that particular package, so
just using that external resource, we are
able to figure out what
it was and what was asking for was
basically IP information,
the host external and internal
IP for connecting to it
to actually play the game.
So we actually had the client
trying to connect to the host, which is
exactly what you want.
But the host would certainly just send
40, 30, 40.
It's like you're connected.
All right, you're talking to each other.
Why do you need to ask the host or
something else?
And Melgar online, too, didn't have this
revolution. Soccer didn't have this.
I think I looked at a number of other
games actually try and figure out
something that maybe came out at the
right time, a portable
office, another Melgar game.
It did have this.
Nothing had this.
It just this unexpected packet coming in.
There's no error message because it's
the host asking for this.
Well, it's already in the game, so it's
not going to display anything.
It just want to ignore the client if it
doesn't get the right response and the
payload is just the player's ID.
So the kind of obvious guess there
is, maybe it's asking, is this player OK
to join? So send it a success.
That didn't work.
So I'm sorry to follow through,
looking at the assembly again,
this guys sitting in there, we found the
forty three four when these were all in
the same place, by the way, once we found
the one area we could see all of these
commands, we see our branches,
we see where jumps to.
And it makes a lot of calls, but was
never checking the return values of these
calls, I would read for bytes
after the initial
success code.
So you start looking.
And what we end up realizing was
basically that with just throwing those
four bites, what it's asking
for is basically an echo, send
it back the players idea that trying to
join.
And that was basically our structure.
So from that, it was the only power
to do that. So stupid.
Yeah, it's so it
took a while there.
This was my breakthrough.
I make sure I had two weeks to
work on the server
for more from my employer.
This was where I spent most of that time
figuring this out, took
pretty much week and a half of solid
time just to figure that little thing
out. So we're jumping through this really
quickly, but it took us a lot longer
than what you're seeing here.
So we were successful.
We finally had the game connect when we
figured out that response and we were
able to actually, you know, play
a bit.
So we've got is a quick video from
the server.
I don't know how many of you have
actually played the game over.
I mean, just most people don't really
know the game, so this is what it
looked like, you fight after
a frog.
So we on for that.
So, um, so what's next?
We got the actual game working and
I actually like Samjhauta too, so I got
that up and running because he didn't
want to. So what's
next from there? As you can see, there's
a map for one of the guys on the team.
There's a team, about five of us that
worked on this.
Um, he started going through
the actual game
files, which had their own sorts of
like encryptions and encodings.
And it was a completely different world
doing. Probably give your own talk on
just those files, but I thought it was
pretty neat, so I thought I'd mention it.
And right there you can actually see that
he pulled out a map and
was actually able to make modifications
and loaded up a custom map in the game.
So, you know, just
kind of acting on everything at that
point. We might even have a custom game
modes. And but it's
just kind of you just keep running with
it.
See, I've already touched on this, but
for each of the games, Melgar on line
one, they talk about 10 months of work
off and on. I mean, this wasn't like
eight hour days every day for 10 months,
but off and on work for about ten
minutes. And they'll go online to talk
about it. The same amount of time
in this little talk here, we've shown
about six different commands, whereas
in the actual servers we deal with about
80.
So there's a lot of stuff missing here.
This is just kind of an overview of some
things that we found helpful, a lot
of headaches, a lot of frustration and
no real existing reference
material for us to work from.
Nobody really talks about building
servers from something that's all right
down. I mean, you've got some talks on
building like private servers for
games are already up or you can just look
at what the server response, but
nothing really about this.
And the other thing is people are crazy
at times.
A lot of trolling at people
when we are looking for the PAC captor
had a lot of people come in saying they
had it, oh, just let me grab it.
And they disappear from our scene for the
next year and just
leave us there or in a lot of random
people that want to sue you.
For some reason, they're not even related
to a company either.
To some dude on RC who's going to sue
you?
I don't know.
Yeah, whatever.
Or we had one guy who spent
a lot of time trying to convince me that
he was talking to Konami and how they
were getting ready to prepare a legal
suit against us and
how he want me to remove his account
because of this. He didn't want to get
tied in with it. So I remove his account.
He comes back a few days later asking for
me to let him back on.
So he wasn't really talking with Konami.
And the other real issue there is
copyright DMCA running
these servers in the US.
We have to deal with DMCA.
We have to worry about that.
And there is an exception for
building things like this as long as you
don't violate the terms of service.
In our case, since the server was down,
it would when you first
connect to the server, it would request a
policy text file from
the server. It was a nexus.
So we were on the server.
We control the terms of service that
we're agreeing to.
So, of course, that was basically not
much of an issue where the issue does
come up for us was Sony,
their DNA, as mentioned
early on, that the
terms of service for that were still
potentially valid, although
the terms point to a nonexistent URL.
So I don't know where that stands.
So.
Well, actually, I was going to say this
is fairly recent, but
I got in communication with this guy,
reached out to me who was doing a similar
project for an old
MMO, Commodore 64,
bringing that back up.
And he reached out to the EFF and
they came to us
because this although we did similar work
and they're trying to actually push
through an exception for
projects similar to this, where it's
software that is no longer managed
in the original company and just is doing
nothing with it, that you can
kind of reverse and run it up there as
long as obviously you're not taking
payments or anything for it.
But I thought that was kind of cool.
So, yeah, I mean, there's a lot more to
this than just what we've shown here.
But it was it was fun,
at least looking back on it was fun,
maybe not at the time.
So it's just some credit.
Sarabi, the two of us here,
he was mostly folks on Melgar online,
too. I did the first
game gigahertz gangster
Darick.
He wore Dacron both.
He was the only guy working with me first
on the Melgar line.
One server, the fog
did another two game.
They revived that one resident evil
break.
And he helped us out actually really
early on with something groundbreaking
with that initial DNA area, some
of the first protocol stuff
he did, some of the initial groundbreaking
there.
I mentioned pro evolution software in
that server that was done by Helstone,
which I just kind of randomly contacted
him on Twitter like you did the server.
Is this true about the protocol?
Is this true? And I I don't
know what he was thinking at first, but
it took a little while before he finally
responded to me and I was able to balance
a few questions off them.
And we've got what the fuck are you
thinking? One, he's helped out with
two of the three stuff, some Melgar
online to stuff.
And our crazy
friend Jay, who was doing the math work
in the off the file stuff.
And one thing I forgot to mention is the
three work, this guy
over here, there's a lot of great artist
groups.
If you're ever analyzing three LFS
or libraries, they'll just
map out all the functions for you.
It's excellent. So you should have good
download that if you're ever going to
look into it.
And yeah, so,
um, I guess if anybody has any questions
that could obviously just e-mail us or
reach out to us on Twitter or
come up in front of everybody and ask.
OK, thank you very much for that
applause and thank you very much
to our speakers.
Any questions I see
microphone for
hello.
Hello. So you've spoken
a lot about the protocol joining the
games and, you know,
enumerating servers.
How more complicated is it once you're
actually in the game? What do the clients
send to the server?
Like how much of the actual game logic
is on the server or is that
really just passing messages between
clients?
Please, a bit quieter.
So the the server
protocol or the protocol that we reversed
was actually the controller, the gate
one that actually got to the gameplay.
That was a separate protocol.
That was all peer to peer.
So once the actual consoles communicated,
they hosted their own games.
We started looking into that a little bit
just for shits and giggles to kind of
like play around the game.
But to actually get it
all up and running, it was the main
controller just to get the consoles
communicating because everything
was hosted locally.
Oh, cool. Thank you.
OK,
can you give the Oscars
a bit more quiet, please, by
way of going out?
I see microphone one.
Hey, great work.
You did just the point.
If you run into legal troubles of
the German National Library is allowed
to crack copyright
protection on at least
on books and music.
So I
don't know if the same situation applies
in the US, but national
libraries, museums would definitely
be the place to look for because they do
have some exceptions.
Yeah, one thing with what we've got with
DNS system is you can
actually use our bypass to do any piracy.
It doesn't actually like you do that, but
it is a break of the system.
So it is maybe it's not a gray
area. I tend to think of it as one.
We've taken a few steps kind of make
it not necessarily difficult
to take a legal action against us.
But I mean, we won't take donations, so
there's no profit in coming after us.
Besides the negative publicity for taking
down the server,
obviously they still can deal with their
you know, Sony can do what they want.
Yeah, the company is well aware of the
project.
They have not publicly acknowledged
it. Well, actually, they did on Twitter
last week, but they
they won't really discuss it.
Actually, I was in Seattle this
like a year or two ago, and the
developers from the team were there for
Pasek. And I just
like kind of walked into the VIP area and
was chatting with them.
And we went out partying all night and
getting drunk and stuff.
And I kind of kept open communication
with them. And when I was working on
this, we were kind of chit chatting.
And then I sent like a question about the
protocol, as I had noticed this,
like, could you give me some info?
And it's just been like radio silence,
just like immediately stopped
communicating with me.
But but other than that, the company has
been, like, totally cool about it.
And they're the new version
of their games actually coming out soon.
They just released a trailer for it.
So we'll have to revive that one soon.
So we'll see.
OK, microphone too.
Hi, thank you.
And I have a question because
somebody already mentioned libraries,
national libraries and stuff.
And, um, I actually
wonder if there's a place maybe like
libraries for Ethernet
that captures of the games that are
basically so that somebody like
players can send in the captures
such that once a server goes down, it
will still be able to to reverse
engineer something.
Because I imagine that for for some games
that are down already and where you
didn't get to make enough captures, it
becomes very, very difficult.
And I would actually love to see the
possibility of many games that I love
coming back.
Like there's this, uh, German game I
think Battleford was, which was shut
down a year ago or something.
And I was very sad about it.
And but I imagine it's very difficult
now to to somehow bring it back.
Yeah. You know, that would actually be
really awesome if people were to do that.
I'm not aware of any sort of, like,
database of packett capturers for games,
but it would be awesome because the
moment we came out
with this and went on Reddit and kind of
did like a little write up, he did.
And that's kind of what sparked the talk,
is that little Reddit right up got so
popular.
There were like tons of people like you
like, oh, we'll revive this random guy
and revive this, revive that.
And that's like, well, there's only two
of us and I've never played that before,
so I really don't care.
But
yeah, like, it would be cool if we had a
bunch of packets like that because, for
example, we were stuck with no packets.
And the moment we figured out the
structure and the idea, we could have
knocked it out in no time if we
didn't have to sit there and figure out
80 different commands or.
So it would be really also might be
something you should start up.
Yeah, it definitely does
not exist right now.
It's something I actually thought about a
little bit, trying to start something,
but I haven't gotten around to it.
Is it legal to do packett captor's
or shouldn't? I'm not a lawyer.
So with that
I don't see why I can. Captor's shouldn't
have an issue. I mean, most places will
log their own traffic like see that.
So I can't see the characters being an
issue. The servers can be a problem, but
the characters shouldn't be problematic.
As far as I know, the app
is like, for example, for
the MGO to stuff
like somebody had a pocket capture, but
they didn't have a capture of the actual
game that is out of bag after the
authentication and all the Web stuff
before.
But it was all behind SSL.
So it's like it was pretty much
pointless. Right.
So but yeah, that would be cool.
And if people actually got captured of
the correct data, it would help out a lot
and teams could run with a.
So that's everything,
OK?
The signal and the signals that we
got for externalize signals
questions.
Yes, is the first one is
there was a presentation at the twenty
nine. So if we all thought, yes, if we
reverse engineering protocols using,
that's up.
I never tried it.
But I want to know if
you have tried it and if.
Yes, if you did find it helpful.
I've not I not understand
what you said.
Did you hear some of
it gave repeated
there we try what did
you try to call nets up?
Oh, net spark.
That's up to you,
sir. Said.
Oh, is that like a tool for reverse and
protocols?
If it was. No, no.
Did not. We just did what we showed
you. Just kind of line in pockets
up and I guess we did an
old man style.
I don't know. I also there's cool tools
out there. You should use them.
I'm not aware of any.
I should Google more often.
We learned a lot as we did that
it was a learning experience.
So I'm sure some of the things we've done
are more effectively
done by someone with more experience.
Yeah, another question, uh,
is I noticed earlier
that the game used only five to protect
pect integrity, but do you
think the truth and the five, would
it make more sense to use
a small ACLC 32 to save
some bullets in the stream?
I mean, I guess it would make more sense
if you were the person designing.
That's just what the design they want
with the first game was actually that
five of the payload plus
the header in the second game was an
empty five of the payload headier plus
in my case, like a 16 bickie.
But that's just what they ran with.
But I guess, yeah, if you
could do a simple CRC check
and it would run with it.
I don't see why not.
It would be less.
Less of a size.
Yeah.
Well, sort of, yeah,
another one would
would want to know personal,
heartfelt debulking option, perhaps
Tretick.
Could you say the last word again,
Jaedicke?
I'm not on the to
for sure. Yeah.
The for the two.
There is some homebrewed for debugging
interface, though.
Some people used for the
PS3.
I was actually able, with the custom
firmware put on the debug
firmware, which
let me hook debugger up
straight to the port and just debug it
with the leaked debugger that I didn't
use that's available
online if you Google.
And and that was so it
was pretty, pretty much easy.
But for the US to but we
didn't do anything. The hardware was for
this.
We didn't have to use geotag or tap into
the board at all or do any sort of
signals. It was a Stalter homebrew
and the disk.
So yeah, he kind of mentioned there,
there was a kernel patch
at the pastilla.
Sony uses our own debugging interface,
I think it was called Decmil or DMCA,
and it was basically our own little
communication thing going on there.
The PCs officially didn't support it, but
some kind of reverse engineered that and
added support.
If you can modify console and then
you can kind of flash stuff your own
stuff into it.
So that was actually used the little bit.
It was fairly late in the project.
We had figured most of this out.
It did help with some of the steps,
though, so it's not the
JTA, but that was something that wasn't
mentioned here.
And the last question
can be, so
can you imagine a framework
or two to help so we will
continue of political
an API to help?
I couldn't imagine it because each
game is going to be completely different,
like for for this case,
what we're dealing with as a kinami
like protocol.
So maybe we can toss
something together and it would help you
reverse Konami games that use the
same type of server.
But I would almost put it in the same
boat of like a Web application.
You know, you can write like a burp
extension to do something very specific
on something that you're using.
But unless somebody has the same
exact thing they're doing, it's not going
to be useful.
I'm assuming people will have to kind of
like roll with their own.
So, I mean, I'd plug in there.
You know, there's things like that
Wireshark plug ins like I did when I was
working on looking at that protocol.
I had a Wireshark extension
on there, but it would only be useful
for the economy, the economic protocol.
So it really depends on what
what they're trying to reverse.
I don't know, like if if all the call of
duty games use the same type
of network code, like maybe you could do
something where it helps you reverse all
those or or other other
family of games. In this case that helped
us reverse all the Konami
type games.
So.
But yeah.
OK.
All questions then then
I'd say, thank you very much
for this exciting talk from.