HelpNeed help with decrypting packets

Posts 1–9 of 9 · Page 1 of 1

Need help with decrypting packets

Hello everyone, I'm starting to get into 'hacking' and I decided to make my own client without graphics (To use it as a bot), but I have a problem.

I can't get to decrypt the first packet (the hello packet) and the following ones. I used wireshark to get the data and tried to decrypt it with an online RC4 decryptor and the key I found in the client with no success.

The first bytes of the decrypted hello packet data (not counting the first 5, used for indicating length and ID) should be the build version right? Because I'm not getting that, that's why I think I'm doing something wrong.

I tried the other key but it doesn't work either.

What am I doing wrong?

lemme save you some time, check out these projects

https://github.com/thomas-crane/nrelayⓘ
https://github.com/toddw123/RotMG_Clientlessⓘ

also here's hello packet if you just wanna try and figure stuff out.

Code:

class Hello : public Packet
{
public:
	std::string buildVersion;
	int gameId;
	std::string guid;
	int random1;
	std::string password;
	int random2;
	std::string secret;
	int keyTime;
	std::vector<byte> keys;
	std::string mapJson;
	std::string entryTag;
	std::string gameNet;
	std::string gameNetUserId;
	std::string playPlatform;
	std::string platformToken;
	std::string userToken;
	// Constructor
	Hello();
	Hello(byte*, int);
	Hello(Packet&);

	// Output
	Packet *write();
	// Input
	void read();
};

Originally Posted by Darkoz360

The first bytes of the decrypted hello packet data (not counting the first 5, used for indicating length and ID) should be the build version right? Because I'm not getting that

What are you actually getting when you decrypt the first few bytes? Strings in rotmg packets have a short (Int16) before the actual string to indicate the length of the string. The build version string is 7 characters long, so the first 2 bytes of the decrypted hello packet should be 00 07. The build version itself will be the next 7 bytes, which are 58 32 31 2e 30 2e 32.

Originally Posted by willfuttbuck

lemme save you some time, check out these projects

https://github.com/thomas-crane/nrelay
https://github.com/toddw123/RotMG_Clientless

Thanks for those links, definitely going to check out them.

Originally Posted by Killer Be Killed

What are you actually getting when you decrypt the first few bytes?

I'm getting bc f7 6f ef dd da 15 b2 b0. Obviously not the build version.

I'm starting to think that the rc4 implementation of the website is not correct or something like that. So I'll code my own, based on the ones the projects willfuttbuck sent use, and see how it goes.

Originally Posted by Darkoz360

Thanks for those links, definitely going to check out them.

I'm getting bc f7 6f ef dd da 15 b2 b0. Obviously not the build version.

I'm starting to think that the rc4 implementation of the website is not correct or something like that. So I'll code my own, based on the ones the projects willfuttbuck sent use, and see how it goes.

You said you aren't counting the first 5 bytes for the build version, but are you still decrypting those 5 bytes anyway? The first 5 bytes are not encrypted so trying to decrypt them will advance the RC4 state too far and cause all subsequent decryptions to be wrong.

Originally Posted by Killer Be Killed

You mean the bytes indicating packet length and id? No, I'm not decrypting those. I know they are not encrypted.

Originally Posted by Darkoz360

No, I'm not decrypting those. I know they are not encrypted.

Originally Posted by Darkoz360

I'm starting to think that the rc4 implementation of the website is not correct or something like that..

In that case you're probably right about the website.
The RotMG_Clientless repo uses the openssl rc4 implementation, but the nrelay repo has its own implementation which is at src/crpyto/rc4.ts in case you want a reference.

Ok, the website is not the problem. I copied the exact same code of the KRelay's RC4 implementation and it gives me the same results as the website.

Are the keys really 311f80691451c71b09a13a2a6e / 72c5583cafb6818995cbd74b80? I transform them to bytes as an hex string, not an ASCII string. The same with the packet bytes: I copy the hex string from wireshark and transform them into bytes as an hex string, not an ASCII string.

Maybe the hello packet isn't really the first packet but I don't think so, wireshark tells me it's the first packet the client sends when you connect to the game.

Or maybe it has something to do with the byte order (BE/LE) but I don't know exactly how that works.

Originally Posted by Darkoz360

311f80691451c71b09a13a2a6e / 72c5583cafb6818995cbd74b80

Figured it out, I don't know why but those keys are wrong lol. I have the right keys now.

Thanks for the help though!

Posts 1–9 of 9 · Page 1 of 1

Tags for this Thread

None

HelpNeed help with decrypting packets

Post a Reply

Similar Threads

Tags for this Thread