What packet encryption is the EQEMU implementing?

**AndMetal** · #1 05-07-2008, 04:38 AM

I'm not 100% sure, but I think this is what you're looking for:

common/EQPacket.cpp:

Code:

  390 void EQProtocolPacket::ChatDecode(unsigned char *buffer, int size, int DecodeKey)
  391 {
  392 	if (buffer[1]!=0x01 && buffer[0]!=0x02 && buffer[0]!=0x1d) {
  393 		int Key=DecodeKey;
  394 		unsigned char *test=(unsigned char *)malloc(size);
  395 		buffer+=2;
  396 		size-=2;
  397 
  398         	int i;
  399 		for (i = 0 ; i+4 <= size ; i+=4)
  400 		{
  401 			int pt = (*(int*)&buffer[i])^(Key);
  402 			Key = (*(int*)&buffer[i]);
  403 			*(int*)&test[i]=pt;
  404 		}
  405 		unsigned char KC=Key&0xFF;
  406 		for ( ; i < size ; i++)
  407 		{
  408 			test[i]=buffer[i]^KC;
  409 		}
  410 		memcpy(buffer,test,size);
  411 		free(test);
  412 	}
  413 }

MNWatchdog · #2 05-07-2008, 05:13 AM

People who have a need to do what your talking about already do it with Macroquest most likely.

Ive been involved in some rather personal conversation while sitting around in EQ, after all, the name of the game is EVER QUEST, which often means tons of down time and I for one dont want you being able to listen in.

Excuse me for wanting some sense of privacy when I sending PRIVATE messages.

What your wanting to do should be done using a command prefaced with a # like all specialty commands and certainly does not need for you to modify the current chat system so you can tap into it.

mcox05 · #3 05-07-2008, 05:34 AM

Quote:

Originally Posted by MNWatchdog

People who have a need to do what your talking about already do it with Macroquest most likely.

Ive been involved in some rather personal conversation while sitting around in EQ, after all, the name of the game is EVER QUEST, which often means tons of down time and I for one dont want you being able to listen in.

Excuse me for wanting some sense of privacy when I sending PRIVATE messages.

What your wanting to do should be done using a command prefaced with a # like all specialty commands and certainly does not need for you to modify the current chat system so you can tap into it.

Again, you fall to see. I don't want to modify the source and add 'specialty commands' as you phrase it.

As for macro quest, unless I am mistaken you have to still pay for that piece of software. Even if I don't have to pay, I want to make a bot program that meets MY needs, there is no rule that says I can't re-invent the wheel plus some, as you are making it seem.

You make it sound like there is a specific path towards my goal and that I'm veering off. I am implementing my application in the way I deem best. NO it wouldnt be best to implement it using specialty commands ... that would require adding bot functionality into the source ... I'm not even going to attempt to explain to you why that would be utterly complicated.

Having speciality commands would only solve the problem of execution, but not interpretation or management.

Out of curiousity, sense you have such a vast carnal knowledge of how to implement bots, once I implement A speciality command for casting a spell with a given spellid ... then what? What about self casting, target casting, group casting, or wait ... what if I wanted to actually allow for the functionality of reiterative statements such as "Heal me EVERY 5 seconds so i don't have to keep spamming the ingeniuous speciality cmd macro button"

Take some time to think it through, I am making a fully functional bot that can be controlled with a specific (my design and implementation) Command Language that is simplistic and powerful.

Adding a thousand specialty commands to the source along with bot functionality is not the correct approach in any way, the emu is a server not convoluted, add as you go, piece of software, it needs to remain as light-weight as possible. The only viable option, since the EQ Client doesn't have specific cmds that I need to facilitate this endevour, is to monitor chat packets to garner update info. and send synthetic packets to the server to issue commands that have no front-end access in the EQ Client.

I never knocked you for wanting a sense of privacy. I bashed on you because you simply made assumptions about my intentions. I frankly don't care if you think I'm out to monitor the entire world. That is your problem not mine.

Please stop posting back to me to salvage what is left of your e-penis. I'm interested in making a bot program and unless you have something worth-while to contribute then leave this thread alone. Thanks

mcox05 · #4 05-07-2008, 05:13 AM

Quote:

Originally Posted by AndMetal

I'm not 100% sure, but I think this is what you're looking for:

common/EQPacket.cpp:

Code:

  390 void EQProtocolPacket::ChatDecode(unsigned char *buffer, int size, int DecodeKey)
  391 {
  392 	if (buffer[1]!=0x01 && buffer[0]!=0x02 && buffer[0]!=0x1d) {
  393 		int Key=DecodeKey;
  394 		unsigned char *test=(unsigned char *)malloc(size);
  395 		buffer+=2;
  396 		size-=2;
  397 
  398         	int i;
  399 		for (i = 0 ; i+4 <= size ; i+=4)
  400 		{
  401 			int pt = (*(int*)&buffer[i])^(Key);
  402 			Key = (*(int*)&buffer[i]);
  403 			*(int*)&test[i]=pt;
  404 		}
  405 		unsigned char KC=Key&0xFF;
  406 		for ( ; i < size ; i++)
  407 		{
  408 			test[i]=buffer[i]^KC;
  409 		}
  410 		memcpy(buffer,test,size);
  411 		free(test);
  412 	}
  413 }

You are amazing my friend ... the ironic thing is that I just found this about 20 minutes ago. Seems that the answer to my question only leaves me with more questions since I have only programmed in Java/C#.

Question: It's using a decode key which, at a glance, isn't a predefined constant. What is the decode key they are using ... does it change constantly or do they have a constant being applied to the method call?

Anyways, thanks for the help. Great work!

**AndMetal** · #5 05-07-2008, 05:49 AM

Did a little more digging, and came up with this:

common/EQStream.cpp:

Code:

 1003 void EQStream::Process(const unsigned char *buffer, const uint32 length)
 1004 {
 1005 static unsigned char newbuffer[2048];
 1006 uint32 newlength=0;
 1007 	if (EQProtocolPacket::ValidateCRC(buffer,length,Key)) {
 1008 		if (compressed) {
 1009 			newlength=EQProtocolPacket::Decompress(buffer,length,newbuffer,2048);
 1010 		} else {
 1011 			memcpy(newbuffer,buffer,length);
 1012 			newlength=length;
 1013 			if (encoded)
 1014 				EQProtocolPacket::ChatDecode(newbuffer,newlength-2,Key);
 1015 		}
 1016 		if (buffer[1]!=0x01 && buffer[1]!=0x02 && buffer[1]!=0x1d)
 1017 			newlength-=2;
 1018 		EQProtocolPacket *p = MakeProtocolPacket(newbuffer,newlength);
 1019 		ProcessPacket(p);
 1020 		delete p;
 1021 		ProcessQueue();
 1022 	} else {
 1023 		_log(NET__DEBUG, _L "Incoming packet failed checksum" __L);
 1024 		_hex(NET__NET_CREATE_HEX, buffer, length);
 1025 	}
 1026 }

Key is defined a few times throughout EQStream.cpp, and it seems to be somewhat dependent on the type of packet. For the most part, I think it's defined as 0:

Code:

   53 	Key=0;

Here is an example of where it isn't:

Code:

  299 #ifndef COLLECTOR
  300 			Key=0x11223344;
  301 			SendSessionResponse();
  302 #endif

  310 			Key=ntohl(Response->Key);

  802 	Response->Key=htonl(Key);

I'd dig deeper, but it's late for me. Good luck with figuring out the encoding

mcox05 · #6 05-07-2008, 12:42 PM

Genius! Someone give this man a medal! Awesome I'm going to gather some packets and see if I can run them through this algorithm and I