Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/539 Thanks!
OK, welcome, everybody.
Um, the next talk will
be How Hecker's Grind
and MMO RPG by taking
it apart, an introduction to
reverse engineering network protocols.
So and now I would like to you
know, I would like you to give a very
warm and welcoming applause to our very
nice speaker, I think.
Oh, thank you.
I'm here to talk about how
to grind an MMO RPG if you don't know
what an RPG is.
I won't ever get into that shortly.
But just for reference, who does
not know what an RPG is?
Never heard of it.
Wow, amazing.
OK, well, then I'll get this show on the
road, I'm going spring, I'm a software
engineer and if you want to know
something else, I have a Web page fisheye
in which I encourage you to visit.
So what am I going to
talk about? I will first give a short
introduction about the game.
I decided to not to
look into Runes of Magic.
Who has heard of this game, huh?
Oh, that's a lot more people
than I expected, to be honest.
I heard it's quite popular in Germany,
but now you never know.
So I'm going to briefly touch
it and mainly to to it to tell
you why.
It's interesting to look at a game like
this. I will also tell you my motivation
and family will get right into the
technical stuff.
And I'm going to show to tell you
how I capture traffic.
And I started poking at it, looking at
it, analyzing it.
I've written tools to help me.
And I've also talking to a lawyer
because, well, it's a
it's a strange world this time.
So I wanted to be sure
I was safe.
And after that, first time for some Q&A.
So but first, I want to thank some
people, the first person is
someone who has a blog about Jeunes of
magic research.
As far as I know, he never released
something but done.
I was really like, I I'm stuck.
I not him. He had a really good,
helpful reply. So I was like, oh, thank
you to everybody expects.
It's very nice to me and
I will cover it. So don't worry.
But I'm happy it exists.
The reason I'm giving this talk is
because in previous year if I was to talk
about cyber necromancy but reverse
engineering debt protocols and I
was like, wow, that's interesting.
If people are interested in that sort of
stuff, maybe, maybe I should contribute
to this as well, because it is about
protocols. And in this case, a server is
still alive.
But on the other hand, this game
is really not trivial.
So, well, as I said,
I talk to lawyers are not a Dutch
lawyer who's a really friendly guy, and
I can highly recommend his blog.
In fact, he he will be he
won't be be writing something about
about my questions and about his view
on the matter on his blog.
So if you can read Dutch, Google his name
and you will find it.
And of course, no, nothing is complete
without either and already debug.
If you haven't heard of the tools,
I'm not sure what you're doing here
because they were really good and
you should check them out.
So but first, what is an MMO
RPG? Oh, it's an abbreviation
and you can read it, but it basically
means it's an online game and the online
game means you have a character and
it's usually something of a fantasy.
Feme an elf I visit
of Oz want.
And the idea of these
games is are subscription based or
free to play.
So in the first case you pay every
month a certain amount and in the
order and in your report, you just you
can, you can play it for free but fail
micro transactions to.
Yeah. To ensure that developers can eat.
The goal of the game is to create a
virtual character like Fits Alfredsson
or whatever, and you improve it
and you improve it by by gaining levels,
by finding items, if you will,
by completing quests, because Quest gives
you a level typically.
And then the main the
main reason to play this game is because
you want to get stronger.
You want to do more content you
want. Yeah.
You want to do stuff.
You want to show the world your virtual
person is interesting and
the game is socially involved.
A team player involved, you can't do
generally do stuff by
yourself. You need others, you need
friends.
And a level of friendship
you need is an entirely different
matter, but you can't do it alone.
And secondly, these games are designed
to suck up time.
They are designed to get you coming
back. We really want you to
to get in the world.
I want you to keep playing and
and you can do it by playing, but you can
also do it with different means, which I
will show you now.
So what does the game look like, the game
I'm covering, it looks like fierce if
you've never played it before, it's old
by now, but who knows,
it's free to play.
So you can you can just go
download it, install it.
You can do whatever you want with it.
Wow. That's what I did anyway.
It has a Taiwanese developer on a German
publisher, and you really see it back in
India in the way the game is created,
because the term grinding means you
you repeat some activity over and
over again. And that's exactly what they
do. I've heard Taiwanese developers,
Asians really, really will
love this stuff and this game
does it quite well.
So what does this game came off really,
really quick, quick now
in line, if you will.
You are fully human after all.
Do you have a lot of classes?
The interesting part about this game is
you can play a wizard warrior.
And that unique combination gives
you several skills.
And I find it interesting and
it is one of the things that drew me
to this game you can do.
Crafting an instance is like a team
level, if you will, that you can join up
together and destroy monsters and whatnot
to get the items you need to possess.
And you can do really interesting things
with the items here.
You can customize them in any way you
want. Well, there's a pet system.
You can have a pet.
You have. You have, you have and how
you can do all sort of things.
And all this stuff is encoded in a
protocol. And I was wondering how the
hell does it work?
So to give you an idea of what
what's tennesee, it's not important.
The idea is the item to the left
is what you find an item
to do it at which you can create of it.
So what this means is the left fingers.
You're lucky if you find it.
Let's put us first, but you can't use
it. It does nothing.
It's useless and item to the right.
You can enhance it and you can.
And it is useful to identify
what you would use if you play this game
like I have a year and a half ago
or something.
So what I did, I intended to do
fish. I was curious.
I mean, fish was the first time
I ever touched spoiler alert.
It's going to be the last because fish
things really took up time.
But I was wondering, how does it work?
What does make a stick?
And I was like, it's my PC.
You give me an executable Foreland
and fifteen gigs of data.
What does it do on my PC?
What does it send out?
What I wanted to know, does
it send something of my configuration.
I was like, this is interesting
to figure out.
And of course the time is now because
while the game is active now
so you can capture whatever traffic you
want, you can.
Yeah, you can basically you can just do
whatever you want. And if he decides to.
Yeah. To take the service online, it's
much, much harder.
So I was like, I'm going to do it now.
And to be honest, also I got bored
of playing the game. So I was like, what
the hell, let's just let's just take
it apart.
So the first step you need to do is you
need to capture packet's.
I don't I was like, how am I going
to do fish without the game knowing that
I'm going to do. I know he isn't.
I've got some games essentially
contain things like who gets to scan your
memory first? Can you deal Alpha?
Do whatever.
I want to figure out that you're playing
the game as intended.
And I was like, I don't know
how good those developers are.
I don't I don't know what they're
sending. So I was like, you know what?
I'm just going to take another computer
from your heart problem and I'm
just going to capture on it.
So you have tests to be done.
I'm sure everyone knows it.
And it's also a nice tool called Tsipi
Flow. And what it does is you
can just insert your doing far from TCP
IP flow and you get a text file with the
TCP data.
That's really useful because I don't like
reading TCP battles myself.
So what you do is it looks
like this. You can just tell
them to dump everything from a certain
network into a fall.
And it's really useful to filter on a
network because you don't want these new
DNS requests similar to your own
systems to be blocked.
You just want to dump everything that
goes to the network of the publisher.
And the nice part is you can
use who is to find out what the change
is. So you really know quite fast
what's interesting and what is not.
And then you courtship on
which kept your phone.
You just say, OK, let's
let's look at the file and you
have something like the stuff below.
So what it does is it has a source IP
destination and two points and it just
shows, OK, if this is the data offset
of what I found, it's really simple.
Well, if we look at the one
I'm logging into the game,
you get something like this.
And if you look at it, you're like,
that's a lot of data.
But the important thing you start
to note, I started to notice there's a
lot of zeros in their eyes.
I mean, it's odd.
And I logged in with the for
a username for each password.
And what I noticed was
that there are still zeros in Farfel.
I'm pretty sure I have crafted a really
interesting super high tech
encryption algorithm and I'm going to
find it out.
Right, because that's what we do.
And the other part of it, I noticed this,
the first four bytes of
every packet are the length of
of that piece, because if you just
look at it, default.
But a first it's 16 for 16
bytes. And by the finger on the bottom,
there are 14 any data, 14 bytes
shoulder. And it also
gives another clue because it's little.
And then you can immediately tell because
everyone recognizes little and.
Right.
So if we continue with this
and we just trip out this side because
we don't care anymore about what you see,
it this is what I get phone and log in
with for AIDS and for it
now doesn't look very interesting.
So I decided I'm going to look for
a for peace.
Now, what you see is the
underlying numbers
are the numbers have changed when,
as you can see the pickup lengths, which
I assume try to buy the first four,
but just by making educated guesses,
because that's what you do and stuff like
this. And what you see is don't change.
So I guess it's pretty likely.
OK, well, all the other packets rooms are
sort of changing in and yeah,
I'm I'm not sure, but
I can make an educated guess because
the data of the
you can see that it's four times or
five a and if you look at the previous
slides at the second packet of
the ten first, first four times
twenty one.
So that's likely the username.
Well and I tested this fairly
because I was like, OK, now I'm going to
do six, eight and indeed you
shoot six and it's actually patted
Servicios because you love me.
They want me to do this stuff.
So if you continue with this, you see
this can't be hard.
But instead of looking at the actual
encryption data mangling however you want
to call it, what I did was I was
just making a guess.
The password is always add offsets
50 and 60 and and
a password. You see, it is all
it is not broken at all
because if you just look at the
difference between each both friends,
I was like, hmm, fits only skips
one or two off or seven.
It's not random at all.
So I'm making a guess here.
I was like, I know.
And the five is sixteen points
and but if I write and the five
has hex digits I know it's 32
but. Right.
So let's try.
So I tried it and if you, if you
calculate any five hatchell for it you
will get seventy four blah blah blah.
And if you try to this to the password
the seven and a for the difference
between them is free and f7
for the difference between them it's
free.
Hmm.
That can't be a coincidence.
Right. Well if he continues his guessing
game you will do the
fourth, the four digit is a seven.
After that there's a free and individuals
you will see at the password repeats
F7 for you over there and
you will see for that then contains free
seven. So the next two
parts are indeed F
seven. So
I was like, I'm pretty sure if
I use and the five because well
the difference, we don't know how it's
encoded, but what we do know is
we understand that the difference between
the bytes, if you will,
it is the same, it's exactly the same
show, which usually means to use
super high level cryptography.
So of course, who doesn't?
And and what
I what I decided was I I was
first I was just writing down.
Right. Because you just assume
that that f7 Afri goes to fast
and the five stuff is just.
Yeah, we've just basically guessed
that we're used.
But the next part was from
how do you get from F seven to
four, three, seven.
And if you just if you just write
down bits because that's what I do when
I'm but I'm in and I don't know from
what I started noticing is that only the
top bits were different.
And then I was like, I don't
have to crypto skills to deal with this,
but I remembered for the zero
to zero lines.
And how do you do it?
So simple.
You just plus a letter, you plus a
number, you sort of get no more and you
end up with zero because and
so and it's zero.
And if you just apply his knowledge
because the first packet I got
is I assumed as a key, I didn't know
anything about it, but it changed
and I just assumed the very first part as
a key. And I plug it in as a twenty.
You see at the top, if I insert
a twenty, I take F7 seven plus twenty
or twenty, I end up exactly what I
expected.
So this package
improves. It might go a bit quicker, but
the slides are in the system so you can
look it up if you want a detail and
I want to get this boring stuff out of
the way. But the interesting part of this
is you can do this
by hand just by thinking about the data.
What do you see? You see a lot of data
that is not random at all.
So I was like, hmm, that's interesting.
So then you continue.
You have an idea how to cryptography
works. You have an idea how the rest
of the game continues.
So what you do is you start dumping
a lot of stuff and you start looking at
it. Right. And the things I saw
was if you look at the last four
numbers here, you see fit, just
continue. So you get zero one to
all the times to.
It just goes on and on, so
it's a sequence, no, because you need
to anticipate something important
and the number before it, it just goes
from zero all the way to nine Affinitas
sets again to zero one, et cetera.
And I was like, hmm, maybe that's the
key if you think because I know the key
is Denverites.
And indeed, it turned out the
number just says first, the key you need
to use is if it's if you
obtain the key yourself.
And that's basically all to it.
But there are two numbers.
I was like, what?
What do I do if I looked random to me?
Real numbers, if they
don't differ by one every packet
because it isn't random.
And what I noticed was I
didn't know anything at all.
So I fired up and I
said a few break points and after a
bit of coffee and a bit of patient
fell checksums and they have separate
header and data checksums in this game.
Hmm, that's interesting.
I finally disvalue after
a number which you will see it's
always two is just a flag.
If it's to the fact that it's encrypted,
if it's free, it's a key, simple
as that.
But then I noticed some packets I could
not understand and address, it never has
any bailout. What I show
you, what you see, so I was like, hmm,
that's boying.
If I get them, the client tries to answer
them with a way to flag
them was different.
And then I know this
is likely a keep alive.
So thinking about what I saw,
you see sequence numbers you see keep
alive Becket's If it
is likely they decide that Murie
is the protocol of the future, haven't
they decided that UDP is actually
pretty hard to use correctly
because things like reassembly
of loss data is really useful?
So my guess is they tried
to invent your own TCP IP layer
if he got the same problems as we got in
in the 1980s. So I decided just to
just to push it over TCP
MediaMath, but then again,
I will never know.
So if you were and from
now on, I'm going to ignore that Boeing
had a we had to langtang the
keys and flat, I'm also going
to ignore the complete encryption stuff
because I don't
care anymore. I figured it out.
It works.
And I'm not going to continue to back the
data itself.
Now, what I noticed, if if I wasn't
in this game, what you noticed is
when I get a lot of the packets from the
client to the server, which must mean the
client is trying to tell the server we
are moving in a direction, blah, we
are at this coordinate or something
along those lines. I don't know what it
does, but I'm guessing I'm making
educated guesses. Right.
And it's served quite well up to now.
So I'm just going to continue.
What I noticed was if you do this,
then those numbers didn't make any sense
at all. And I know the game is a little
at the end because the lengths are in the
game. So what I did was I'm
just trying I plug them in as a floating
point number and certainly they made
sense. Transfers are not
random floating point numbers because the
beauty of floating point numbers is if
you take complete, complete
nonsense and you try to make it a float,
it will become a complete nonsense float.
It will be a very huge number, a
very small number, or it just says, I
don't know, it's zero.
And, you know, maybe it's not a float.
So if you don't recognize it, it's
likely a float.
So I did a lot of Stelling
and drank a lot of coffee, of course,
and what I say is I understand the packet
had its yeah, as you see, this
isn't rocket science.
All I did was I just created mega
megabytes of logs and I tried to
to to figure out a login process and
went on from fanlight.
You see it, you understand the packet,
how to you will understand fettah
types of packets and you wouldn't
understand that some packets have some.
Yes.
You have to have a type and a subtype.
And I think it has to do with the way
packets are routed inside the game.
But don't know.
Then I got fed up because I don't
know if you ever had more than a day
about hex dumps, but
yeah, that's a good point.
So I was like, let's create a tool.
Let's create a tool to do this boring
stuff for us.
That's what I did.
I created a tool called Home Dump, and
the name is inspired by
Tsipi Dump because it can dump protocols.
Now, what I did was the first
the first input I get is a text file
from the TCP flow.
So what it does is it just takes
the head off away from it and reassembled
the stream of stuff and it does it in a
file. And the second part is an example
file which contains the definitions
of the packets. As you will know, what it
does is because we know the lengths,
because GCP has this annoying tendency
to bluffer stuff really annoying.
So and sometimes you will just
get a packet this incomplete or or
the complete TCP packets you get contains
three and a half packets and you have to
remember who I need to understand to
lot 12 bytes.
I need to it's fairly annoying.
So I want this tool to help me reference.
And what it does is it's just assembles
of packets, dusty decryption stuff
and such, and it looks any extra mouthful
and it'll continue.
So what I show, this is what
it looks like.
I will look I will first do
the packet at the at the bottom of the
screen, the look and of packets first
names are just what I came up with
because I fought for help.
And if you look at the top, right, you
can just say Paquet name is again.
It's the first field that is a
is a U 32.
The name is type and it has a fixed value
of four. And the second is some
value which I call our.
And if you look at it right at
the at the bottom right, you will see
that we get zero for
sure.
So that's four because little
endian ever will get sixty
five. So what it does is, is
dumpsites aspects is looking a failure
type is four hours 65.
So that's much more fun than having
to try to first get
rid of that annoying encryption,
obfuscating, coding, whatever you want to
call it. And the second part is suppose
sometimes I add
a field because I now know that
it's not an hour code, but
it is a Busfield or something that I can
just apply this knowledge to my XML
file. I can just say, OK,
OK, there to please process for 200
megabytes of pachyderms for me.
And I will I will immediately start to
see things because now I have
a tool which helps me for it.
And if I ever manage to figure out what a
known field of the account name and
I can just plug it in one or two and I
will see things. So that's really
useful. I really recommend to if you
do this sort of stuff, think about making
such tools. I know very well I know this
old stuff, but we will get we
will get on making custom stuff.
It's always more fun.
So as I as said, some packets
can be nested. So if you have a packet
which are called client requests and an
idea of a client request, yes.
It's always sent from the client to the
server. It always has that fixed type.
And content in this packet
is a packet which says, I want to move.
I want I want to quit the game.
I want to say something to the game, what
I want to do, whatever.
So I was like, I can
I can I yeah.
I can get things in my pots.
Right. Because everyone likes creating
portions. So if you look at the data
at the bottom right, you it's exactly
the same packets as I was illustrated
with a bit of floating point stuff
and well that doesn't make any sense.
But if you just if you just could
create a definition and you just say,
let's try float here and you will see
values that make sense, you will very
quickly get the basic idea of the
protocol. Because if you understand
the how does any idea what to make
us have, you will know overcoached
is right, but at least I hope
so. I really hope that you don't blow
trucks over and that's a shortcut.
But who knows?
But I must be some patriotism
you can exploit fent.
So when I was doing this,
too, I made a grave mistake, I voted
the C++ fatwahs done,
you really shouldn't do it.
And after this, I learned
fighting and fighting is much more fun to
do it's stuff. And and the reason
I'm stressing this point is
when I when you create tools like this,
you want to add features because
first you can deconstruct
and stuff that's really cool.
But you eventually you will
learn that, for example, an account
name is always, say, 64
bytes or so to show the moment
you start seeing one of them, you know,
FISAs like these 64 by choice
because they're always 64 bytes or has
no reason to assume you don't.
So you want to have constants.
You also want enumerations because
emotions are cool and everyone uses them.
So what you want to do is you want to
add, oh, look, in
our login code, one is
password allegan to us account
and login free IDs, whatever.
And you just want to see them.
You do not you do not want to have to
look them up at the same time.
And also you will need structure types,
at least I did.
And the reason is that
the item structure of this game is
really complex. Right.
We have seen and lots, lots of stuff on
the screen. It has to go to your client
in some way. So what I did was I wanted
to add structure to this because
all items will likely have exactly
the same format because first,
programmers are lazy and they
should be. What you want to do is you
want to figure it out one time and then
you want to use this everywhere.
So you need structure types.
You you need arrays
because everyone loves
them. You you will see
you will see the data if it belongs
together.
But the other interesting part is I want
I have transformation support in what
that does is I sometimes
you will you find a package type
or something and it's compressed because
it's a network makes sense to confess
stuff. So once you figure it out,
I will get into that shortly how you
can do this. But you want to be
able to tell your dump to
hide the data if it's coming, it's
compressed with algorithm X, Y,
Z and, you know, transform
it for me. And if you implement it
right in order, what you do not
write this to and see if it's really easy
to do because, well,
it took me a few clever hacks to
put it in.
And also, you want annotations.
And what I mean by, in fact, is if
you log in to this game, it will it'll
say, hi, you have completed
quests, one, two, three, four.
And I was like, I have no idea what.
One, two, three, four is.
So I was like, how did how can I
learn this?
I will get next to it in the next slide
that you can really clever
ways to look it up, but you want you
to know if you have first.
No, you need to look it up in a table and
I want to see the
human readable form because computers
like one, two, three, four.
And I want to know what is really in
there. And you also want dynamic
annotations and this game
works. I'm I'm I'm actually
just walking ahead now.
But as the game works by over an object
versus the surface as high as an object
over there, everything that is not static
is an object. And the ideas of the
objects are random.
You know, it's actually sequential.
So that's not really random.
But but you can't predict them.
At least I can't.
So what if what you do is it will
just say hi.
Hi. I want you to show object.
One, two, three, object type one, two,
three, four at at some position.
And I'm going to call it object two.
And what what a dynamic annotation
in the tool does it everywhere.
It's this object to it to say aha,
that's that door because it knows
it was a door so you can show
that it's a door.
I will give examples of this.
But first, how are custom
items ready. And I touched them
previously.
And one of the things you need to
realize is games are typically
and everything that we do, it's
just numbers. Right.
And there's a database and it has this
number. So I was like, it's really useful
when you start figuring out inventory
management and you just click on
items in your backpack and see what they
do. You want to see this?
I have this potion and I think
the game must have it in.
It's Datafolha.
So what's the idea of the potion?
It must have an identifier.
And it turns out that if you just Google
around a lot, the game has ways
of just linking an object to another
player so you can show someone, hi, I
have this awesome short and they will sit
and chat. And if they click, it's they
will see a FELECIA model of it.
And it turns out that so
far Sphynx typically use exactly the same
IDs, several websites,
item databases, if you will, and
they also use the same I.D.
because why not?
Why should we invent something else?
So what I what I decided to do was
first I used to make Benta.
And what it does is you feed the data for
minute and it turns out the internal
tables of the game and it has some tools
to do the
interesting stuff of it.
I also wrote my own because
why not?
And I was bored of looking at Hexton for
a while, so I wanted to do something
different. But it really helps if you
know that an item you want, you are
interested in because you pick it up or
whatever you it helps if you know it has
an idea.
So and there are also interesting part
of it is if you have hexogen support
that you can just dump all packets hack's
you can just search for it, because if
you search in data for the ID, you
will immediately identify OPAC or
packets that do stuff with items.
And it's so much easier even than
just looking them one by one.
So I was continuing
and really, really nice and I got
a package that was like no patronizes
at all, but I like to do it.
I print stuff and I just grab
a pencil and a lot of coffee and
and an evening and I start just
just drawing lines and rotating things
that I think how they work.
That's what I used to do.
And that's why I like to smell stuff so
much. But one of the things I noticed
was that the data
looks random.
It's yeah, I could have make heads or
tails of it. I had a lot of characters, a
lot of different sort of settings and
just pieces
of the name, whatever pieces of the
pieces of the inventory, item, I.D.,
whatever, but not everything like
this looks like something compressed.
And what I did was I was
like, I'm going to use my big friends
already and Yida and I'm going to learn
what the protocol does.
And I think I'm reasonably
certain they didn't invent this Fitch
protocol itself.
And it really takes a lot of time to take
a lot of assembly and try to learn.
And I'm a
compression algorithm, but it's really
fun to do.
I think I think you should do it.
But the problem is when I got this,
it's I got hold of kilobytes of data
and other fields I could identify.
I had to inventory for path.
But much of that is a lot.
It's really a lot.
My first computer didn't even have to put
them out of memory.
So I was like, hmm, I need
some way to figure out how I can
how do I continue?
I don't know enough about this data.
But first, I was actually quite fed
up with my capturing Saddam.
And the reason is photos
are good. But his game, it's a
distributed game, right?
As in from multiple servers for a lot
of back ads. And if you log
in to the game, you go get redirects to
another server and the
server can decide, no, no, you're going
to disserve and you need to look in
again and you won't have a lot of
connections and you need to look at a lot
of states. So what I decided to do
was I was like, I'm not interested
in I want I want to capture this
in a bit better fashion.
So I decided I know how the basic
protocol works. I'm going to write a
proxy.
This is what I did.
And what I did was it's a tool.
It just listens on TCP and it
connects to the real server and it
just formatted your data to the server.
What's come back for once back to the
client? And it's everything in a really
nice logging file format.
And I know they want me to do this
because you can just set in a server, any
phone you can say no, no, this is the
IP you should be contacting.
So I'm now at
log stuff first keep alive.
It does it. And if it sees a server
redirect, it's like, no, no, you want to
talk to me and three to it's
nicely to its own IP address.
And I thought, I don't know what else.
I don't care. It just looks oh, this
looks like an IP address even for
even the private IP space.
I'm just going to connect to it.
So what? And this turned out to be only
Hatemi. It's and it's undetectable
as far as I know, because I didn't want
this on my own or my gaming PC.
I just want it on some on some Linux
box in my network.
And the nice part is you can do
really cool stuff if I'm not
getting into details.
But I think
you get the idea now because you can just
rewrite packets and you can
just lie about and you can use.
I didn't see that packet.
Goodbye.
Of course I haven't tried this,
so I have
a stool. I can make nice locks,
but answering to get involved is 400
kind of batch of data and that excludes
the data for decompresses.
So the data you get a form of kilobytes
gets a whole lot, really
a lot. I was like, I'm pretty
sure most of it is not relevant, but
no idea what I could do.
So what I did was I wanted
to I need to influence data, right?
If it's not kilobyte structure, I need to
change things. And I need to I need to
learn how to how to how the game
reacts to it.
So it was like, let's write the server.
So what I did was I just
I just put something together, it's
really terrible, but it works good
enough. And I had this idea, if I
do know what, I'm going to plug a Python
script language in it because Python
is good.
But I was like, if I just
I broadcasted on some way of
bites.
Well, well, well, we are well back to the
pachyderms we wanted to avoid.
So I was like, let's not do it because
we have this nice metaphor and
if we can use it to dump, we can
only use it to create packets
and we can go further
as ohmy projects like to do.
What I did was I created a tool called
MKR Def, also superstitious, but also
a very stupid idea because
who passes Ximo?
But then again what it does is it just
takes this fall and it creates
shortcode false.
One of the packets data itself
and packet false are just, they just
create classes and you can just
put in there.
Oh I want to, I want to chanta
and create object fish data
and I want to send it now in all of its
backing and encrypting and stuff.
It's all handled by this code and it
also creates python bindings.
So I can just hook them apart and
it's because I can say hi, I want you to
create object to fish and fish arguments
and it's boathouses to all the clients it
has. That's really awesome.
And you will see it soon.
So this is looks like.
No, I have Fischbeck a display yellow
text you. I'm sure you have no idea what
it does and what it and
what you can do is you can just telnet to
the stuff on Sombath, you can just copy
paste your text in there.
And what happens is the
what happens is you will see yellow text
on the client screen, but you can also
mess with the parameters because I'm
I'm not sure what's known for that.
So I'm going to type something else and
I'm going to look at what what what does
the client show?
And this is really fun to do because
you can just change things and
you can just observe what happens and you
really learn quickly about it.
And you are not you are not
harming anyone. Right.
Because the game servers,
whatever, they are just coming along,
they don't know what to do. It's because
it's your own self.
But there a snitch, I
was like, you know what, I'm just going
to to put this phone kilobytes
of data to the to the clients and
it crashes.
Yeah, yeah.
The client is if you've played this
game, you understand
maybe it wasn't.
Yes.
It could have used a bit more more
Q&A.
Maybe, but
but so what I did was I was like,
if I just put sleeps in there.
Well I took a lot of time,
but I managed to log in and just started
to remove stuff I hoped
was not important.
And step by step, I got to somewhere
I could log into the game world and I
could do my packets and
analysis.
So I'm not going to show you a small
demo. So please play with me the
starting line that doesn't crash, because
I won't say it has happened before
because it has.
But the package I'm going to show
is if you the game version of your
exercise and if you create an object
and you are and you are like a
player character, you can customize your
character a bit and the game uses
some packets and it tells you, OK,
it has to
have looks like this and that
of the debate style
is fat and what sort of stuff.
So eventually
I knew Fishbeck it does it but I don't
know what do for the 32 two.
Do what it does.
So.
Oh, my God, it's still up.
What I'm going to do is I'm going to
start my phone.
It's just a night in the open room
because I really suck at names.
And yet how open projects are popular
items like maybe for adaptiveness
one, so I'm going to give my friend
username password.
I hope it's feasible,
but as you can see, the shuffle starts
seeing stuff.
And we are yeah, we have our own server
with have nice name Solitude, because
it's not really an online game anymore,
is it?
So now I'm going to look in with
a reverse engineer, because that's what
we do, and in the meanwhile, you will
see the look on the back.
If that's why you need logging, you want
to show you want to know that stuff is
going on. I'm not going to talk about
what the packets are actually like.
I will be presenting a short one or one
the overview of the protocol and you
can get the rest of my GitHub.
But yeah.
Did I mention the game is how it is
now? As you can see, we're an engineer at
32. She freaks because
I can send whatever I want so I can send
guild names.
Charity fund groups.
And this is how the game is supposed to
look like,
and now I'm I'm I'm going to
zoom in on my face.
And yeah, I really haven't.
So now I'm just going to tell that to
the stuff and we're going to enter Python
stuff right now.
First, I'm going to set a variable
because it was a nice.
Then I'm going to set a lot of data
and this is the data I just sniffed from
somewhere, and I'm going to and
I'm going to modify it, but first
I'm just going to send it.
So what you see here?
If nothing happens, oh,
that's boring, but that's good, because
it's exactly the same data as I sent.
I created this character.
So now I'm just going to say I'm
a nine five. I have no idea what it does,
but I'm going to send it to two five
five because two five five is a nice
fellow or oh,
and usually just testing
extreme values.
If it's ten, make it to Hudnut.
If it's too not make it true free, it's
really helps to figure out
what kind of value with this.
So now I'm going to send it to two, five,
five and I'm going to send to object
to parents, pack it again.
And as you can see, my character has lost
all his hair.
No, I can't continue with this.
I can also send a known and
unknown character and now my beard
is another color.
So I know now that the beard is somehow
linked to a lone wolf and the character
is linked to a number five.
But you can also do this.
You can also create arbitrary characters.
And I'm now going to quickly do that,
because sometimes, you know, that that
commands interactive stuff
over things.
So now I want to create a monster
and I'm going to do it.
And of course, I messed up.
You see, and we have friends
in your eyes.
But the good part is.
I figured that the object would come on
by by you
could just kill it.
And then I had this unknown nine to E
thing, and I didn't know what it was.
So I'm just going to send it and it
sparkles. Sparkling is good.
And sparkling in the game knows you can
look at it, so now if I look at it
myself, I guess I can
show Fishersville.
I if I ask you, you will see
for, I guess, an unknown one fact.
So I know. Aha.
On one f must mean you want to lose.
And now I'm supposed to center the
clients which kinds of cool items he has.
But that's about it for the demo.
Let's hope it doesn't die, so
now I'm quickly going to cover the
protocol because we're running out of
time. So how the game works
is you there are three layers of service
you have to look into over it and
it just says, hi, who are you?
A code name password.
And if it doesn't match, I go away.
If you make it through it, you get to a
portal server and a portal server, just
as first of all, the game servers you can
connect to. And if you connect to
a server, you end up with a specific
game. So you always have free
hops. And that's why I wrote the proxy
tool, because, well, it's
it's a much nicer if you if
someone so solve this problem for you.
Now, the other thing to note is, is this
game has a lot of commands and
really a lot of everything as a command.
If you join a team first
commands to sell you to tell
you hi, John went perfectly
first a command to tell you, OK, you
need to add fast to your message.
Look, that's a command to tell your oh,
your your player character.
You need to add this guild name has
a command to tell you, oh, the user
interface needs you at this guild name
Physick package that gets sent.
It says, oh, it's guilt by
the way, has fees and fees members and it
goes on and on.
And that's the nice thing about having a
server. You can just do it step by
step and see what happens when you send
it, because I don't know about you,
but if I get like forty,
forty packets, maybe 20 of
which are relevant, I don't know.
And if I can just send them myself using
the scripting stuff, it's much easier
to figure out because there are over
200 packets.
I know about one out of 50
of them. As I said, this object based
everything that's not static as an
object. So things like Dodsworth can
be removed, that object things you can
go to, objects and pieces,
bullshits, that sort of stuff, objects,
player, characters have appearances.
And that's just a physical appearance.
And you you have separate commands
over how Vecchia looks and positioning,
fighting. Everything has a command.
If you just look at the monster and
it looks back, it has a command.
If it changes Stanson, I'm a hostile,
I'm going to kick you.
It has a command.
It's if
it's going to hit you, it has a
command. If the hits match it, it has
a command.
It's really a lot.
So what I learned was this one
kilobyte character and for PÃ©cas it
influences the UI.
And that's really cool because what you
can do is you can just put
in that, OK, we have we
have a bunch of data, right.
But then it's on the market about the
data. The game relates to objects to
play. You can move has nothing to do with
it.
And the question is which the client
knows which quests are pending.
So if you look in four hundred kilobytes,
just has a lot of bad bits because
everyone of bits to what it does
is it will just tell the client, OK,
if it's Quest you can it's not
it's not done yet and this quest is done.
Donnette and the clients figure out what
it needs to show. Some really interesting
security really sucks in this game.
If you make a mistake and sent
them by too much, it crashes.
That's bad, right?
If you if you mess up this character
info packets is you get
an exception on the stack.
Now, it's really cool because
we can we can execute code for this if we
can influence the server.
And I expect a server
isn't really much better.
But I didn't try it
because well, there's
also some information regarding it that
it tells you you'll make it worse.
It tells you your operating system,
stuff like that.
I don't know. I've maybe if he wanted to
have an idea of the of
what you or what your clients are, but I
can spoof them as.
So I was like, not a lot,
because I want to release this stuff, but
I sought legal help.
And the reason I did this is because I
don't like getting sued for
some guy who was who had a talk
or some sign on his suit for two billion
dollars. I don't want to give a talk
about being sued for two million years.
So I was like, I'm going to talk to a
lawyer. Most of them say, don't go to
my stupid.
That's boring.
So I met on a lot of hits and he was
really helpful because what he told
me was after a few months,
because he's one of the few person I know
who is also an engineer, sort of engineer
and he's also a lawyer.
Crazy combination.
But hey, all the benefits.
And he says, well, first you met
a really interesting as long
as you can.
Your goal should not be cheating
if you're going to cheating you.
Yeah. You you're acting illegally.
Right, because that's that's not good.
And if you do this in private, you
don't release anything. You can do
whatever you want, but your goal can
never be cheating.
So I want to express my goal.
Never was cheating.
So as he continued, he said, OK,
well, you shouldn't do
the shelf record, the other tools are OK
for nice fair points
if interesting, but to serve
well vacancy see this competition,
you know, and I was like, why?
It doesn't crush as often but.
Just the suggestion was, don't do it,
really, do not release it.
And I was like, I'm a bit ashamed of
what the code looks like and I do not
intend to release it.
And it's not because I don't love open
source and stuff, but I don't want to get
sued. And if anyone here has contacts
with 50 drifty, developer
or publisher of his game and say, OK, you
can do it, I will.
I will. And if they ever take the
official servers offline so
you can't play the game over immediately,
dump everything I have from GitHub.
So I wanted to thank you all the stuff
I've been talking about on my account,
and there's also a lot more stuff on
there because the items stuff is in a lot
of different repository.
But who knows?
But if you have any questions, now's the
time. And I also have email and stuff,
so.
Thank you for this very insightful talk.
We now have about 10 minutes for
a question and answer.
So if you want to ask a question,
proceed to this in our microphones.
And yeah, we start right now.
Yeah, that microphone there.
Hi, thanks for the talk.
Did you ever accidentally send packets to
the server and see you react in strange
ways? Uh, yes, I did.
And that sorry.
Sorry. Uh, everybody who is now
leaving just be a little bit more quiet
so everybody can get the question and
answer. Thank you.
But yes, I did.
And one of the things I wanted to know
is if if it really matters,
if the client sends all the data,
it does and it turns out it
doesn't. The code I'm definitely not
going to release because you know what
you can do with it, right?
OK, is there a question on that
microphone or no question.
OK, then another one there.
I wanted to know how long you been
working on this, like.
Was it last week?
And a caffeine fueled nightmare.
If you've been working on this for
several months now, this
project took two years,
but it was on and off because I
well, I did suffer from from
other interests like life and
stuff.
So it's it
was really ups and downs.
But all I can
say is that overall, I think if I could
do this full time, it was about
four to six months, I guess, because
if you once you get well, you
get into it, it really goes fast.
OK, there is a question from the
Internet.
Yeah, actually, there are two questions
right now.
The first one is if there
is any kind of end to end encryption
or authentication between the client
and the server.
Yes, sure.
And plus.
Yeah, OK.
And the second question is, if you could,
in theory, spawn items
on a real server, I knew that
the question was going,
yeah, well, what I want to say
about this is the following.
I, I know about players
within the game who have managed to
duplicate items and stuff.
You can do that of.
You could I don't know if you still can
because I don't play the game anymore.
And I have this idea if I don't want to
let me play the game anymore.
But you most of it
seem to be books on the server side,
because if the class is convinced he has
some item and surprise,
surprise, you can lie about that, then
I'm pretty I'm pretty sure it's not rock
solid.
I think you can do it.
But you just most people
find it out by just clicking an item
seven million times and you can scripting
the game in Lua.
And some people just make scripts to do
something 20 times in a row and a server
just gave up and said, OK, whatever.
So.
It has happened.
I don't know if it's fixed, but it has
happened.
And there more questions.
Yes, there,
hello.
Did you try those things on other
animals or is this
a unique case to this broken piece
of software?
No, what you can do is you can do is
basically on any game you want.
You can also, for example, if you have
an observer, you could use
some like these techniques because it
basically boils down to understanding the
data. And that's why I try to
to talk more about the approach
I took than the actual game, because the
game is less interesting
than the approach. So but if you're
volunteering, I would really like to know
how the Old Republic works.
OK, any more questions?
Yeah, on that microphone.
OK, interesting talk.
Thanks.
Uh, actually, I'm a game
developer and at the moment
I'm.
Yes, I'm trying to I'm
not a massive multiplayer game, but
an online game, so you have any advice
for me to make you your
work harder?
Yeah, well, one of the things I
think you should really consider is
people can and will do this given
first officially bored of the game, I
suppose. And one of the
and I think that what you should
do is you.
Yeah, if it were up to me, I would
just release the product and say, ha ha,
have fun. But do we do
it? And eventually you will figure it
out. Eventually you can learn how it
works and you should design with that in
mind. You should design one.
If some crazy person sounds
complete 20 times,
maybe I should check for it.
You should you should never trust data
the client, since you should always you
should always consider it as well.
Fish can be influenced.
You should always you should also think
about the fact that maybe someone did
something evil and the client never got
all data you sent you on
instantly kick it off your network.
I think you should design for that.
There is another question from the
Internet.
Yes, the question is, if
you have ever had contact with the
developer I'm sorry,
could you repeat if you've had contact
with the developer of the game?
No. Know, I know you didn't I didn't ask.
I tried to contact some
guys of the virtual communities.
Right. And everything I said and
I had this idea were connected somehow
because both being in German and stuff.
But the problem was I never could
find anything. And I do not know how
to contact the publisher because
it's really a large company based in
Berlin, really happy to Congress, isn't
there? And the
and well, I don't know where
to begin. So I was hoping maybe
someone here knows how I can get
in.
I don't have any experience with this
stuff.
Any more questions?
Last chance,
OK, then, yeah, thank you again
for sharing our you're awesome work with
us. Really nice.