ROTMG packets and others info

[BernardoLima]

Just found this text and wanted to share/save it here.
It's a good article on how to start looking for packets, what encryptation they use in sent/received data, keys and etc.
[HTML]New event!Submitted by ibekrayzi on Mon, 10/01/2012 - 16:34
event called FUCK KABAM!
Reverse engineering the protocol game Realm Of The Mad God. / Build ver. 123 (?) /Server Address: ec2-176-34-240-11.eu-est-1.compute.amazonaws.com (176.34.240.11) / EuNorth /addresses of all servers (May 8, 2012, ver. Name | IP | hostname | | --------------- + ----------------- + --------- ------------------------------------------------ + | USWest | 50.18.113.133 | ec2-50-18-113-133.us-west-1.compute.amazonaws.com | | USMidWest | 107.22.218.252 | ec2-107-22-218-252.compute-1.amazonaws . COM | | EUWest | 46.137.187.86 | ec2-46-137-187-86.eu-west-1.compute.amazonaws.com | | USEast | 184.72.218.199 | ec2-184-72-218-199.compute -1.amazonaws.com | | AsiaSouthEast | 46.137.247.5 | ec2-46-137-247-5.ap-southeast-1.compute.amazonaws.com | | USSouth | 107.22.231.55 | ec2-107-22-231 -55.compute-1.amazonaws.com | | USSouthWest | 50.18.176.194 | ec2-50-18-176-194.us-west-1.compute.amazonaws.com | | EUEast | 46.51.176.123 | ec2-46 -51-176-123.eu-west-1.compute.amazonaws.com | | EUNorth | 176.34.240.11 | ec2-176-34-240-11.eu-west-1.compute.amazonaws.com | | EUSouthWest | 176.34.240.126 | ec2-176-34-240-126.eu-west-1.compute.amazonaws.com | | EUWest2 | 46.137.143.87 | ec2-46-137-143-87.eu-west-1. compute.amazonaws.com | | USEast3 | 50.19.47.160 | ec2-50-19-47-160.compute-1.amazonaws.com | | USWest2 | 184.169.130.44 | ec2-184-169-130-44.us- west-1.compute.amazonaws.com | | USMidWest2 | 174.129.56.145 | ec2-174-129-56-145.compute-1.amazonaws.com | | USEast2 | 23.21.243.164 | ec2-23-21-243- 164.compute-1.amazonaws.com | | USNorthWest | 184,169,131,108 | ec2-184-169-131-108.us-west-1.compute.amazonaws.com | | USSouth2 | 107.20.55.255 | ec2-107- 20-55-255.compute-1.amazonaws.com | | AsiaEast | 46.137.218.95 | ec2-46-137-218-95.ap-southeast-1.compute.amazonaws.com | | USSouth3 | 204,236,195,161 | ec2-204-236-195-161.compute-1.amazonaws.com | | EUSouth | 176.34.71.225 | ec2-176-34-71-225.eu-west-1.compute.amazonaws.com | | EUNorth2 | 46.137.38.91 | ec2-46-137-38-91.eu-west-1.compute.amazonaws.com requests from the server file crossdomain.xml ( https://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html ) == == package information packet format: [long] (DATA) | 01020304 | 05 | 0xDATA | Presentation : int # Length Length includes a 5 byte header (4 bytes in length and one byte for ID), hence the length of the data # == length-5 ubyte id # ID package Vector data # Data is encrypted RC4, uses two keys: # 311f80691451c71b09a13a2a6e - > Outgoing Data # 72c5583cafb6818995cbd74b80 <- Incoming stream ========= Package List ======================= == presented in the order as developers ==
Srv - server sends a packet
Cli - packet sent to the client
? - Purpose of the package is unknown
------- ------------ FormatID NAMEtype Field
type2 field2
================================================0 FAILURE # Srv, errorint errorID # ID errorString errorDescription # description of the error59 CREATE_SUCCESS # Srv, object creation was successfulint objectID # ID of the objectint charID # ID Player49 CREATE # Cli, create a game objectshort objectType # ID Object Type20 PLAYERSHOOT # Cli, shootint timestamp # being shotint bulletID # ID texture bulletShort CONTAINERTYPE #???Point startingPos # coordinates x, y the shootingfloat angle # degree angle shot in the plane xOy61 MOVE # Cli, player trafficint tickID # ID game timer tick (anti-spidhak?)
int time timestamp beginning of the movement (anti-spidhak?)
Point newPosition # x, y coordinates of the destinationShort recordsLength #???Vector Records #???39 PLAYERTEXT # Cli, send chat messageString message # UTF-8 string messages7 TEXT # Srv, chat messageString name # The name of the message sender (player or bot quest)
int objectID Object ID (?)
int numStars number of asterisks wound (made of class quests ) player, who wrote the message
ubyte bubbleTime # time, how much will keep the bubble messages over a player (in seconds?)
Name String recipient of the message recipient (for personal messages)
String text # TextString cleanText # (format?) text messages21 SHOOT ( _-u5, _-FL) # Srv, shotubyte bulletID # ID texture shotint ownerID # ID "owner" shotShort CONTAINERTYPE #???Point startingPos # initial coordinates x, y shotfloat angle # degree angle shot in the plane xOyshort damage # damage, which will cause the bullet when hit31 SHOOT # Srv, process multiple shots at onceubyte bulletID # ID texture shotint ownerID # ID "owner" shotShort CONTAINERTYPE #???Point startingPos # initial coordinates x, y shotfloat angle # degree angle shot in the plane xOyShort Damage # damage, which will cause the bullet when hit
Following is a list of shots, if there are more bytes, then:
Each subsequent byte is the number of shots
Next to it is a float angle that will be fired
If a byte is not present, the number of shots = 1, and the angle = 0
38 DAMAGE # Srv, notification of the damage caused and the effects (blindness, weakness, slow, etc.)int ID # targetID goalubyte length # list length effectsVector effects # byte array, ID effects (Blind, slow)
int damageAmount How harmed
bool kill # Killed?ubyte bulletID ID # bulletint objectID # ID of the object (?)5 UPDATE # Srv, renewal of the world (new chunks (tiles), objects (mobs players?), drops (bags))Short length_tiles # list length TilesVector <_-MV> Tiles # block list for updates (you need to deal with the structure of the object block)Short length_newObjs # list length newObjsVector <_-Oe> newObjs # List of objects to be updated (----- ~)short drops_length # list length dropsVector drops # List drops (id drops?)14?63 NOTIFICATI ON # Srv, notificationint objectIDString text # text alertint color # Text Color57 NEW_TICK # Srv,?int tickIDint tickTime # unix timestamp (?)
Short Length Length following list
Vector statuses # List status (?)65 INVSWAP # Cli, rearrangement of things in inventoryint time # timestamp permutation (to sync?)Point Position # Location (coordinates x, y) of the permutation (for drops?)Slot # slotObject1 original object slot (for slots is necessary to designate the data structure Slot)Slot slotObject2 # The target slot (- ^)58 USEITEM # Cli, use things (elixir, egg)
int timestamp time use (for timing?)
Slot slotObject # object slotPoint itemUsePos # The place where the object is used (for pots right out of the bag?)77 SHOW_EFFECT # Srv, show the effectubyte effectType # Effect Type (0-15)int ID # targetObjectID purposePoint pos1 #???Point # pos2???int Color # Color effect (?)17 HELLO # Cli, login to the server packageString buildVersion # version build # 123Int gameID # ID game (?)String guid # LoginString password # PasswordString secret # secretint KeyTime #???Short keyLength # Key length (?)Vector Key # keyint? length # length of the arrayarray String utf8bytes # utf-8 bytes
Username, password, and secret encrypted using public key PEM.RSA
Base64 encoded encrypted data
RSA public key is available and within the swf-file
----- BEGIN PUBLIC KEY ----- \ n
MIGfMA0CGSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEmgEmQcgLd0 mvWqL6AKmhzjJfZoAmZC0PUmG8K9CB1M168P00S3eU+TSL5aG8 Mg3Tipvs02gC2veC10knRi7r...
50 GOTO # Srv, pemereschenie objectint objectID # ID moving objectPoint pos # kordinaty move11 INVDROP # Cli, drop a thing of the slotSlot slotObject # Property Data from the slot75 INVRESULT # Srv, the result of action with stockint result # result code4 RECONNECT # Srv, reconnect the (other) serverString NameString hostint portgameID intint KeyTimeShort keyLengthVector Key41 PING Srv #
int serial Number ping
PONG # 27 Cliint serial # sequence number received in the processing of PING, this package should be sent immediately after the PING37 MAPINFO # Srv, the card informationint width # Map width (the Nexus 255)
int height length card (for Nexus 255)
String Name # Map Name (Nexus)uint FP #???int background # Code map background (2 - blue by default)bool allowplayertp teleportation # Allow players to each other (eg, smoking in the castle Oryx)34 LOAD # Cli, loading charint charID # ID chara3 PIC # Srv, download pictures (bitmap )int heightint widthVector byteArray # The data set picture size: (height * width) * 428 SETCONDITI ON # Cli, installation conditions (?)byte conditionEffect # ID effectfloat conditionDuration # The duration of the effect (seconds?)23 TELEPORT # Cli , a request to teleport an objectint objectID45 USEPORTAL # Cli, use the portal (or hatch in the dungeon)int objectID47 DEATH # Srv, notification of deathaccountid intint charIDString killedBy68 BUY # Cli, a request to purchase (from the store in the Nexus )int objectID10 BUYRESULT # Srv, the purchaseint result # result codeString resultString # message (error or a successful purchase)62 AOE # Srv, AoE (Area of Effect) damage as a bomb jellyfish.Point Position # Position of the centerfloat radius # Range effectushort damage # Damageushort origType # Damage type (?) probably bombs, ladders, etc. Khilki19 GROUNDDAMA GE # Cli, causing damage to land (units)int timePoint Position18 PLAYERHIT # Cli, getting into PlayerbulletID byteint objectID24 ENEMYHIT # Cli, hit the enemyint timebyte bulletIDtargetID intbool Kill26 AOEACK # Cliint timePoint Position
64 SHOOTACK Cli
int timeOTHERHIT # 6 Cliint timebulletID byteint objectIDint targetIDSQUAREHIT # 16 cliint timebyte bulletIDint targetID51 GOTOACK # Cliint time55 EDITACCOUN TList # Cliint accountListIDbool Addint objectID66 ACCOUNTLIS T # Srvint IDShort listLengthVector accountIDs74 QUESTOBJID # Srvint objectID40 CHOOSENAME # Cli, change of nameString name67 NAMERESULT # Srv, the result of changing the namebool SuccessString errorText76 CREATEGUIL D # Cli, creating a guild (clan)String Name # Name Clan69 CREATEGUIL DRESULT # Srv, the result of a guild (clan)bool SuccessString errorText8 GUILDREMOVE # Cli, removal of the guild (clan)String name22 GUILDINVIT E # Cli, invite to the guildString name # The name of the invited players53 ALLYSHOOT # Srv, shots allies (other players)ubyte bulletIDint ownerIDShort CONTAINERTYPEfloat angle48 REQUESTTRA DE # Cli, a request to trade a playerString name36 TRADEREQUE STED # Srv, alert players that want to trade with himString name9 TRADESTART # Srv, start tradingshort myItemsLength # length of the list of things that I am willing to exchangeVector myItems # List itemsString yourName # Name (whose?)Short yourItemsLength # length of the list thingsVector yourItems # list of things12 CHANGETRAD E # Cli, change trade boolean Wishlist slotsshort offerLength # length of the list marksVector offer # List marks true - a slot is selected, false - not selected44 TRADECHANG ED # Srv, the player changed his sentenceshort offerLength # length of the list marks slotsVector offer # List marks slots15 ACCEPTTRAD E # Cli, to tradeShort myOfferLengthVector myOfferShort yourOfferLengthVector yourOffer25 CANCELTRAD E # Cli, cancel trade
No data is transmitted
42 TRADEDONE # Srv, trade overint code # result codeString desription # Description1 TRADEACCEPTED # Srv, trade adoptedShort myOfferLengthVector myOfferShort yourOfferLengthVector yourOffer46 CLIENTSTAT # Srv, stats client playerString name # name of the articleint value # value30 CHECKCREDI TS # Cli, titles, like pressing a button on the main menu Credits
No data is transmitted
33 ESCAPE # Cli, teleport to Nexus
No data is transmitted
56 FILE # Srv, download the file from the server (?)Name Stringint Filesize
This is followed by an array of UTF-8 byte size filesize
35 INVITEDTOG UILD # Srv, notification that the player client was invited to the guild (clan)int objectID # ID guildint charID # ID players invited to the guild52 JOINGUILD # Cli, accept the invitation to the guildString guildName # Name Guild60 CHANGEGUIL DRANK # Cli, change the rank of the player in the guild (guild for admins)Name String # Player Nameint guildRank # New rank13 PLAYSOUND # Srv, play soundint ownerIDubyte soundID[/HTML]

More info at:
https://www.mpgh.net/forum/599-realm-...inepowers.html