Montag, 7. November 2016

HowTo: Understand 0B000002 vs. 0B004002 packets

The 0B000002 and 0B004002 are both ping pong packets (i.e. they are exchanged between client and server without any user input, just to confirm the connection works). What makes them really interesting is that they are quite different, but very similar.

Let me explain: The 0B000002 has 18 bytes of body, while the 0B004002 has 22 bytes, a difference of four bytes. The body if 0B004002 is offset by these 4 bytes.

MeaningBytes 0B000002Bytes 0B004002
Sequence number of the last packet seen from "the other side"N/A0x14 - 0x17
Value specified in the 01000006 packet sent by the server0x14 - 0x170x18 - 0x1b
Unknown, but constantly increasing number0x18 - 0x1b0x1c - 0x1f
Client/Server uptime?0x1c - 0x210x20 - 0x25
Byteswapped confirmation that a packet group was received (e.g. 0x0000ebff will be sent by the client, when all packets of the group ffeb are received)0x12 - 0x250x26 - 0x29

As you can see both packets share the same payload, but the 0B004002 one also ships upfront the sequence number of the last packet received by the other side of the communication.

62 Kommentare:

  1. go go go go go ...

    https://www.lotro.com/en/game/articles/standing-stone-games-transition-faq

    AntwortenLöschen
  2. Lotro will die, I hope you sucess soon

    AntwortenLöschen
  3. bwg, are you still in progress on that?

    AntwortenLöschen
  4. How connect to test server, where are changes Ip in to client?

    AntwortenLöschen
  5. Move along, nothing to see here anymore, the object of interest is obviously dead already.

    AntwortenLöschen
  6. Did anyone ever stumble upon just the empty server? Or come even close to make it himself? Only thing id use that for is to explore outside the map a bit, to places that are now closed off for good

    AntwortenLöschen
  7. I'm able to run around in the whole world (regions 1 to 4), change weather, spawn mobs and props, play animations and sounds, change health/mana/fear bars, change skillpoints, create quests, etc etc. I'm not able to implement real gamelogic, simply because thats way too much work for a one man show.

    AntwortenLöschen
    Antworten
    1. Can i reach you on some mail please? Would like to ask you how the hell can you do that what you said up there :)

      Löschen
    2. I'm not OP, but..
      The things that were described here can be done by emulating the official game servers. As far as basic things like logging in, and walking around.. You'll have a fair deal of starting work ahead of you. With dedication and understanding for network programming, it can be done.

      I'm guessing by the OP, this is xbadcode, or someone like him. So I doubt he'll be sharing his code with you (because he shouldn't have to).

      Instead of telling you to bother him about it, I'll describe the task ahead.

      Basics:
      - Create or obtain tools to log network data
      - Create tools to parse and view the captured network data

      This section is rather simple. Lots of time could be saved by using existing software like Wireshark. I've personally taken the rout of setting up a proxy, and logging the data that way, but any implementation will work.
      The more important part of this is being able to view and analyze the data captured. It's the part that will determine what can be learned.

      Some info about capturing data for LOTRO:
      -Compression
      The game uses compression during network communications. The data you capture (save the first three packets send/revc with a given server) will be compressed. Without decompressing the data properly, it will not yield any information.

      -Encryption (signature)
      There is also a signed hash in the packet headers, so to replicate the network communication, or modify it as it's happening, you'd need to figure this out. This step however, can be skipped to start, and technically never implemented if the developer of an emulator desired.

      After you've worked out the compression (it's been done, and posted on the gitlab related to this blog), you should be able to start taking apart the network protocol.

      Ahead you'll have to figure out the basic packet structure (headers, subheaders), and core UDP communication features. This may provide a challange, especially if this is your first of either network programming projects, or reverse engineering projects.

      If after reading this, you are still interested.. Feel free to contact me (again, not the original poster), and I'd be happy to guide you in the right direction. For the sake of time and space, I won't go any further into explanation for this post.

      Contact:
      IRC: irc.efnet.net - #lotroemu (not my IRC, but we can meet there)
      Email: cydrith@gmail.com

      To the OP: If you're at all still interested in doing research for this game, do get in touch. It's always great to have capable people around, who share similar interests/goals.

      Löschen
  8. Dieser Kommentar wurde vom Autor entfernt.

    AntwortenLöschen
    Antworten
    1. It was fun to code, it was real fun to run around in the world. The last fun was to set rainy weather and have animations and sounds played, have Barliman Butterbur placed at Bilbos doorstep giving you a custom created quest to find his lost "The one and only Butterbeer" ... but that was it.

      Aside from the legal issues (LOTRO is still an active running game, compared to e.g. AC) i lost interest, as my lowlevel code is "finished" and would allow to create a playable system, but that's "just" boring scripting stuff.

      Löschen
    2. Would you consider at least to give the others, who may still work on and off on this, directions and guidelines in which way to go next, so they can maybe continue where you left.
      I am no coder, and my only desire is to visit some spots on map which are now closed off for good, and i missed the opportunity before when they were open.

      Löschen
    3. Dieser Kommentar wurde vom Autor entfernt.

      Löschen
    4. Looking at ACE i see alot of similarity to my LOTRO code, except my one is way more chaotic - erm - experimental :)

      Base networking is the same (including the checksum magic), but highlevel messaging via the fragments is way more complex in LOTRO compared to ACE. My packet debugger spits out a bunch of new and unknown message codes every time they update the client (and looking at the ones i could already identify i sometimes feel they lost track over their own structures as well).

      So, on the long term, ACE already offers base code for LOTRO too (which isn't that much of a surprise), and the command messaging stuff on top is a buttload to reverse. Seeing the actual state of ACE at that level, i would say stick to it instead of digging into the next pool of mud.

      Maybe one day i will fixate my code to an older client version to eliminate the problem of running into unknown stuff each and every time they update the client, since this is *very* annoying (up to breaking previous working structures because they changed the order for example).


      Löschen
    5. Dieser Kommentar wurde vom Autor entfernt.

      Löschen
  9. Dieser Kommentar wurde vom Autor entfernt.

    AntwortenLöschen
  10. Did anyone had a closer look at lotros weenie code engine so far?

    AntwortenLöschen
  11. Dieser Kommentar wurde vom Autor entfernt.

    AntwortenLöschen
  12. Ok, but serving character selection and gameplay isn't an issue, what i was asking for is the "weenie code" engine => that's the highlevel game design engine, responsible for scripting all the things that will enliven the world, e.g. quests.

    AntwortenLöschen
  13. Do they look like this:
    ID_CraftProfession_Master
    ID_CraftProfession_MasteryProgress
    ID_CraftProfession_ProficiencyProgress
    ID_CraftProfession_Proficient
    ID_CraftProfession_RecipeName
    ID_CraftProfession_RecipeName_NoCount
    ID_CraftProfession_TierEntry
    ID_CraftProfession_TierEntryNoMastery
    ID_CraftRecipe_CritBonus
    ?

    AntwortenLöschen
  14. Can somebody please share working code for a basic "run-around-the-world" home server with the world?

    AntwortenLöschen
  15. I haven't seen one to date. I'm still plugging away at this in the background. As eluded to though the protocol has change significantly from when the decryption program they initially had.

    That being said, I've managed to find the RSA private key in the client and I'm trying to understand the helper method and other bits and pieces in order to make the necessary modifications. I'm also trowling through the ACE code looking at how they're working through it. There are a lot of similarities in the executables when you disassemble the ACClient and LotroClient. Weenie codes are key, but I think parsing the DAT files will provide a lot of understanding of how the client generates the traffic. Most of the logic exists in these files (a lot of the weenies such as spell tables, weapons etc.. are derived from the files based on the parsed data by their server). I'm also looking at the LUA scripting interface and wonder whether the IDs that it spits out are actually the Weenie codes associated with the items. Replaying a packet capture will get you all the way into the world (I'm doing this with a Python Script and CSV files of the packet capture) but its academic if we can't decrypt them - I can see which packets trigger which but without understanding how to generate them and what values to use I'm at a bit stumped. Still learning programming probably not helping...

    Anyway, happy to throw what I've got into a new GitHub if anyones interesting in continuing to look at it.

    AntwortenLöschen
    Antworten
    1. if you're still willing to upload this to github id love to take a look.

      Löschen
  16. Happy to upload it and will do shortly. I'll post back here with the URL. For the Tammo, Bwyg and xba - did you guys come across any of the following sequences in the decrypted packet streams?
    connection_good: 11000000
    connection_uncertain: 12000000
    connection_disconnected:14000000


    These are all present (as well as heaps of others in the client_gamelogic.dat client.

    The current auto decryption tools don't work on the current structures but if you guys have any decrypted packet streams, i'd love to analyse them against what i'm finding in the DAT files.

    Cheers,
    H

    AntwortenLöschen
    Antworten
    1. At what server do you play. Would love to ask you some questions, if you are willing to share the name?

      Löschen
  17. putting my char name here would be a bad idea... but these guys appear to be looking into it... think they're able to get decrypted packets... and pull the weenie codes out.

    this is the thread: https://guidedhacking.com/threads/lotro-group-project.12696/page-4#post-83317

    AntwortenLöschen
    Antworten
    1. I was thinking about server name, where you play, not char name ofc. I would find you there no prob.

      Löschen
  18. I jump on and off a few different ones... Crickhollow lately. Based on the thread on GH I've "almost" got a working decrypted packet dumper. Works for the received packets. Plenty of info in the day files as well. There's a good tool that dumps the properties out of the client dat files (IDs, types, bit fields, enums etc...) Hoping to get round to deciphering these against the packets data. Basically I'm back to where these guys were before it all went quiet...

    AntwortenLöschen
    Antworten
    1. Can you log into the game (run around), or are you still long way from that?
      For example, this one guy can explore far away from usual borders of map
      https://old.reddit.com/user/MiniExpBounder
      If you ever finisnh, would you be able to do it aswell?

      Löschen
  19. Theoretically, yes... I've got the server movement packets being dumped and I'm pretty close to getting the client packets dumped properly. The client seems ok with unencrypted server packets, just need to understand the whole conversation between the client and server regarding movement. Once this is sorted, you can theoretically run wherever you want by having a local server send movement ack packets. It's tedious and I'm not a programmer, sort of learning as I go...

    AntwortenLöschen
  20. And yes I can get into the world using patched packets... Can't move yet (kidding the client side of the conversation). Server side sends [header] + 0x4003 then 0x030004 such when I'm watching in memory has an associated client packet (same root codes) preceding and following. Shod know more later tonight.

    AntwortenLöschen
  21. Hi, bystander here. Is there a way to get this conversation unto a Discord or so? Creating an emulator is not illegal, since this would be your IP. It would be just nice to have a real place to go l, instead of this ghost town comment section :D

    My personal motivation is, that LOTRO will shut down one day. When SWTOR was developed, SWG was shut down eventually. And even if SSG says, that they will continue, we all know that sooner or later Amazon will win.

    AntwortenLöschen
  22. Sadly I don't have any time to jump into coding myself, but I'm monitoring this conversation and releived to know there's still some progress. Keep up the good work, my haert is with you.

    AntwortenLöschen
  23. Hi END, reached out via discord as I'm keen to share I've done so far. I'll get it on gitlab shortly as well. Think I'll fork the current repo which should make it easy enough to find.
    H

    AntwortenLöschen
  24. Bystander here again. I've sent out a request, name starts with O

    AntwortenLöschen
  25. And we're in - i've put the link to the code and a compiled copy of the logger dll in the discord channel. Will put a video of it in action in there as well.

    AntwortenLöschen
  26. Hi! Could you link the discord channel?

    AntwortenLöschen
  27. Hi all,

    long time no talk ... how the progress on all this ?

    AntwortenLöschen
  28. Dieser Kommentar wurde vom Autor entfernt.

    AntwortenLöschen
  29. Good to see some people are still coming back to this blog :) for those interested, let me summarize where the lotro pserver scene is at the moment (to the best of my knowledge). There are at least two groups able to enter the world with a custom server, move around, modify basic parameters like stats or quests and spawn NPCs/monsters. Where these two groups diverge is their focus:

    One group is working with the live client, capturing packets and trying to make sense of them. They have a lot of information at their disposal and an on-demand reference frame but are somewhat lacking in active developers and most of their stuff is inherited from other devs and not written by them.
    If you're interested in reverse engineering the live game, you should look up the discord higher up on this page.

    The other group is focusing hard on getting a vanilla-SoA server up and running. Even though this is a more complex job without a reference retail server, they are arguably much further along than the first group. They have a much stronger understanding of the data that's available (lotro has A LOT of data on the client if you know how to use it), good grasp of the executable and a clear path to server implementation with only relatively few unknowns. Also more active developers but could always use more people interested in SoA - if you're one of them, drop a message to TheMadFitz above ;)

    AntwortenLöschen
  30. That's really awesome to hear ... i recently managed to (partly) get the effect generators working, so actions like spells or melee attacks play the correct ones on usage. I even managed to activate all emotes, have all cosmetic pets and the complete list of mounts (everyhing selectable and working). And nearly all quick travel points are working using mithril coins, so one can quickly change to nearly any position in the world from within the travel map.


    Depending on my time this weekend i will drop you an email to the above address, lets see if we may can arrange some chat or whatever (i dont have discord installed yet).

    Greetings,
    xbadc0de

    AntwortenLöschen
    Antworten
    1. xbad,

      Nice to hear from you. Been a long time... This is creo, from the old lotroemu IRC days. Nice to see you are still putting effort into things LOTRO related, I had figured you had moved on to other interests...

      Cheers,

      Creo

      Löschen
  31. Dieser Kommentar wurde vom Autor entfernt.

    AntwortenLöschen
  32. Hello this nerd Dread#8867 wants to talk to you guys about helping you with man power on this project. contact him on discord plz

    AntwortenLöschen
  33. Ummm, wow? How is this not more widely known about!!!?????

    AntwortenLöschen
  34. Hi everyone, long time no talk ...

    sorry for not answering here a long time, but there were a lot of private things happening.

    Just a small update, i recently checked if my code still works with the latest client, and yes, happily everything is fine and working properly.

    So hows the status of the "lotro scene" ? I havent played the game on real servers for a long time, just updated the client and made sure i am up to date with it.

    @creo: Hi buddy, nice to hear from you! LOTRO is a long time project for me, checking here and there if it still works for me, but as i said a long time ago, im at a point where it comes to "high level" development like quests, stories etc.

    There are of course a few lowlevel things i would really like to resolve, but its not on my priority list, and getting in contact with other developers on this things sadly currently is out of my scope due to private reasons :(

    But im still looking at it from time to time, so i hope the scene will continue to arise. I really hope there will be a great community for it before SSG decides to pull the plug.

    Im not dead, just sitting in the background, looking for now ... :)

    AntwortenLöschen
    Antworten
    1. Dieser Kommentar wurde vom Autor entfernt.

      Löschen
    2. Hey xbad,

      Sorry for the delayed reply. Don't check here often, but glad to see you're still around and working with things from time to time...

      We also are working on high level things (along with some low level pieces). Have made huge strides since last you and I had a chat in IRC land... If you get bored or otherwise curious, you can pop in on the IRC again. I still hang out there although no one else has been there in a long time. We have since moved out project to a discord chat, but I hang in IRC for nostalgia... ;)

      Cheers,

      Creo

      Löschen
    3. Hi, did anyone achieve a version where you can just run around and explore? My discord is cbass2311#5103. Would love to use this as a DM for my custom lotr campaigns.

      Löschen
  35. This is amazing.

    Nice to see people are still somewhat working on this, well, a pserver in general.

    Would love a SoA server just to PvP. (SoA sounds a lot easier to organize, I always forget that it was available on disk.)

    While I have a fair amount of programming knowledge I have little to none regarding networking, wish I could help you guys.

    Can anyone drop a discord link to one of the servers?

    Would love to keep up to date.

    AntwortenLöschen
  36. I am super interested in contributing to the SoA server and helping to bring that back to life. Very disappointed with what SSG has done with the game.

    How can I get in touch with you guys? Please add me on discord MasterTeal#3606.

    AntwortenLöschen
  37. here you go: https://discord.gg/MdrS7cvA4n

    AntwortenLöschen
  38. With EoA shutting down public beta, what is the next project closed to a playable prototype? Anyone in the know?

    AntwortenLöschen
    Antworten
    1. AFAIK there are no other projects with active development.

      Löschen
  39. Dieser Kommentar wurde vom Autor entfernt.

    AntwortenLöschen
  40. Dieser Kommentar wurde vom Autor entfernt.

    AntwortenLöschen