Re: Client: Using decrypted server.dat

16
Here are my findings for the 5517 client.

Code: Select all

00764CE7 = tmpnam 
00764D9A = DeleteFileA (Call)
007B714F = Push EDX
007B7150 = FOPEN 
007B7149 = Should be changed from JGE to JMP. 
After that 
007B7158 = MOV EDX [FILE THAT WILL BECOME THE SERVER.DAT] (i used:  MOV EDX, 00940450 // ini/ItemtypeSub.dat ) 
007B715E = JMP 007B714F
00765716 = JE Conquer-.007657A0 > This JE should be changed to JNZ

I've been private messaging with Adrian about removing the blacknull check from the client, since you can't find it with string reference.
Adrian found out that you can find it in the HEX window in OllyDBG, so from that point he was able to play around with the jumps around that opcode. (Thanks for the help with that).

After that i've been following the guide in the first post of this topic, from which i posted my opcodes up here.

The issue with this is that i am not able to change the row amount or names in the outerserver.xml, so for example you have server names like Lucky7, you can change it to Lucky8 or Tests1 but if you use a name which is longer or shorter it won't load the servers anymore.
Its the same with the rows in the XML file, if you remove rows, to keep only 1 server group and 1 server, the 'custom' server.dat won't load, you will see an empty server list.

If anybody else know the answer to this problem, feel free to post it :-), for now this is the start of my try.
My guess here is that the client loads the original server.dat and saves the row count and the names somewhere in the memory, to check those later.
I'm still debugging the client, but for now i've got no new info, when i have, i'll post it here.

#Update
I added the last OPCode in the code tags of this post which should be changed to make it work.
After i changed that last one, i was able to load my own serverlist.

Re: Client: Using decrypted server.dat

17
Mugaru wrote: Wed Jan 06, 2021 1:37 pm Here are my findings for the 5517 client.

Code: Select all

00764CE7 = tmpnam 
00764D9A = DeleteFileA (Call)
007B714F = Push EDX
007B7150 = FOPEN 
007B7149 = Should be changed from JGE to JMP. 
After that 
007B7158 = MOV EDX [FILE THAT WILL BECOME THE SERVER.DAT] (i used:  MOV EDX, 00940450 // ini/ItemtypeSub.dat ) 
007B715E = JMP 007B714F
00765716 = JE Conquer-.007657A0 > This JE should be changed to JNZ
#Update
I added the last OPCode in the code tags of this post which should be changed to make it work.
After i changed that last one, i was able to load my own serverlist.
I'm glad you did it!
this should work fine on 5517 client. thank you, @Mugaru.
sincerely,
adrian
software engineer
cron