❓ How does K-relay work

Posts 1–6 of 6 · Page 1 of 1

Hey,
i'm really interested in hacking, security etc. i get the basic concept of how k-relay works but i can't seem to find my way in the code #wheretostart. is there anyone who know indept how the k-relay code works so i could for example modify it for other games/purposes.
you can send me a message via mpgh

With K-relay you are able to capture packets ( the information about game objects, player stats, enemies and everything else in the world what appears on your screen) and then edit that information before it reaches game itself.

For example, if I capture UPDATE packet, I can look at all the tiles that are about to appear on my screen and then edit them, so instead of grass - sand appears in my game. Or for example you can make your player send chat messages or use abilities without any macros - only code.

To start with K-realy, you should look at documentation.
https://github.com/TheKronks/K_Relay..._Documentation

Originally Posted by yentlXD

Hey,
i'm really interested in hacking, security etc. i get the basic concept of how k-relay works but i can't seem to find my way in the code #wheretostart. is there anyone who know indept how the k-relay code works so i could for example modify it for other games/purposes.
you can send me a message via mpgh

Like almost all games, RotMG communicated via the TCP protocol, which is a continuous stream of raw bytes sent to and from the client and game server. KRelay and other proxies work by two main components.
1. Telling the game client to connect somewhere other than official DECA game servers(localhost)
2. Reading all data sent from the client and received from the server, standing in the middle of said communication (called a man-in-the-middle proxy)

To Expand...
To make sense of this stream of bytes being transmitted to and from the client/server we must look at packet structure. Packets have to contain a few things. An Identifier so the game knows what kind of packet is being sent and then a length of said packet so we know when an entire packet has been read and we should start looking for the next one.
This is important as a I mentioned the protocol for communication is a continuous stream of data so its important to know where one bit of data of the stream starts and ends

In RotMG's packet structure, the first 4 bytes of the packet represent a 32bit unsigned integer that tells us the total size in bytes of the next packet about to be read, (4bits=1byte) Converting these 4 bytes to an integer lets us know how many more bytes we should read from the stream before we move on to the next packet.

The 5th byte in the stream represents the packet ID of the packet we are reading. We use this to select the appropriate program model to read the bytes data into (ShootPacket, Teleport, TradeRequest etc..)

For instance, the CreateSuccess Packet contains 2 data fields:

Code:

public int objectId; public int charId;

Reading such a packet would happen as follows:
1. Capture first 4 bytes and convert to int. This represents the size of our packet,
2. We will then resize our buffer that reads the game data stream to hold 13 bytes (4 for size, 1 for id, 4 for objectId, 4 for charId)
3. The byte following the first 4 will be the ID of the createsucess packet (changes from release to release).
4. Once we buffer the next 8 bytes from our stream we have successfully capture an entire packet. (total 13 bytes [5+8])
5. The final step is to decipher the captured bytes. This is done using an RC4 cipher, both the server and client cipher outbound messages with RC4s albeit with different keys. They are both contained in the production client.

Some simple code explaining the above programatically:

Code:

//ID is the 5th bytes byte packetId = this.remoteBuffer[4]; //The data we care about is everything except the first 5 bytes byte[] packetBytes = new byte[packetLength - 5]; //Move only the bytes we care about into the byte array representing the packets System.arraycopy(this.remoteBuffer, 5, packetBytes, 0, packetLength - 5); //Use an RC4 cipher to decrypt the packet this.remoteRecvRC4.cipher(packetBytes); //Handle the packet etc... Packet packet = Packet.create(packetId, packetBytes);

how did you figure out the encryption model RC4 and the keys?
in my spare time i've been looking at mitm proxy (can be found in kali), this isn't any diffrent right?

Originally Posted by yentlXD

how did you figure out the encryption model RC4 and the keys?
in my spare time i've been looking at mitm proxy (can be found in kali), this isn't any diffrent right?

This data included in client, u can find it on GameServerConnectionConcrete.as in function encryptConnection.

Originally Posted by ruusey

Like almost all games, RotMG communicated via the TCP protocol, which is a continuous stream of raw bytes sent to and from the client and game server. KRelay and other proxies work by two main components.
1. Telling the game client to connect somewhere other than official DECA game servers(localhost)
2. Reading all data sent from the client and received from the server, standing in the middle of said communication (called a man-in-the-middle proxy)

To Expand...
To make sense of this stream of bytes being transmitted to and from the client/server we must look at packet structure. Packets have to contain a few things. An Identifier so the game knows what kind of packet is being sent and then a length of said packet so we know when an entire packet has been read and we should start looking for the next one.
This is important as a I mentioned the protocol for communication is a continuous stream of data so its important to know where one bit of data of the stream starts and ends

In RotMG's packet structure, the first 4 bytes of the packet represent a 32bit unsigned integer that tells us the total size in bytes of the next packet about to be read, (4bits=1byte) Converting these 4 bytes to an integer lets us know how many more bytes we should read from the stream before we move on to the next packet.

The 5th byte in the stream represents the packet ID of the packet we are reading. We use this to select the appropriate program model to read the bytes data into (ShootPacket, Teleport, TradeRequest etc..)

For instance, the CreateSuccess Packet contains 2 data fields:

Code:

public int objectId; public int charId;

Reading such a packet would happen as follows:
1. Capture first 4 bytes and convert to int. This represents the size of our packet,
2. We will then resize our buffer that reads the game data stream to hold 13 bytes (4 for size, 1 for id, 4 for objectId, 4 for charId)
3. The byte following the first 4 will be the ID of the createsucess packet (changes from release to release).
4. Once we buffer the next 8 bytes from our stream we have successfully capture an entire packet. (total 13 bytes [5+8])
5. The final step is to decipher the captured bytes. This is done using an RC4 cipher, both the server and client cipher outbound messages with RC4s albeit with different keys. They are both contained in the production client.

Some simple code explaining the above programatically:

Code:

//ID is the 5th bytes byte packetId = this.remoteBuffer[4]; //The data we care about is everything except the first 5 bytes byte[] packetBytes = new byte[packetLength - 5]; //Move only the bytes we care about into the byte array representing the packets System.arraycopy(this.remoteBuffer, 5, packetBytes, 0, packetLength - 5); //Use an RC4 cipher to decrypt the packet this.remoteRecvRC4.cipher(packetBytes); //Handle the packet etc... Packet packet = Packet.create(packetId, packetBytes);

Thanks alot !

- - - Updated - - -

Originally Posted by Heska

Thanks to you aswell.

I hope this is enough explanation for you @yentlXD
Im going to close this for now.

Posts 1–6 of 6 · Page 1 of 1

This thread is closed for replies.

khaozizleet 7 long ago Combat Arms HelpHOWS DOES AUTO HS WORK?!?!

batboy60 11 long ago Battlefield Bad Company 2 (BFBC2) HacksHow does BC2 Banning work?MIMicktorious 10 long ago Combat Arms Hack Coding / Programming / Source CodeI know the injector, but how does the rest work?GEgenya 10 long ago

❓ How does K-relay work

Similar Threads