Jump to content

Recommended Posts

Posted (edited)

Are you able to extract opcodes directly from engine.dll?

Yes.

 

And how are you validates the packet structure? By L2J forks?

No, I don't do validation l2phx-style. I validate using l2off pts servers without extenders and then extrapolate definitions for intermediate protocols. I also have an emulator that allows me to log in using any client (and yes, it allows me to see NPCs in 336 AND 377-660 AND 69x and later at the same time); I then inject custom-built packets and see if the presentation matches my expectations.

 

For everything that is not implemented client side, l2off logic is used (e.g. if you change sub while setting up a general manufacture, your higher-levelled recipes will be marked as "unable to be created" in the packet, but the client will not display them any different than others you have the create common item level on your sub) (also, henna info lists mark hennas as applicable or not applicable to your class/level inside the packet, but client presents them all the same)

For certain features that are bugged in l2off (e.g. related to items that were not designed to be traded or GM view packets (656 and 83)), I aim for correct presentation in the associated client.

 

Does it work only for clean client with default encryption? And do u sniff it with external sniffer or you are inside process?

NP works as a transparent proxy – nothing that would be flagged as a virus by overzealous AV manufacturers. Yes, it works only with standard encryption, so if the client maintains a parallel connection to negotiate encryption with a 3rd party and then ciphers everything according to this separate LIVE key stream, it will not work.

 

Plus, when I called for suggestions before opensourcing this app, I didn't get any to add socket interception or to scan/inject process memory. Also, these features likely could only work on NA clients/servers, where pretty much every security feature is disabled (currently, even GG is not required to play on NA servers).

Korea, on the other hand, has everything forced: GG, NI, SO, now even factual ini validation. And they eventually ban if the client fails the check, which is a pain since they also require real ID.

For now, I do not have plans for aggressive interception methods. But yes, I would want them as optional features… some day.

Edited by Zeeyo
  • 7 years later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...