L2World - bypassing bot protection

[blejdaq]

i have already posted this in other forum but more eyes can see more

 

as devs surely know, all game packets (except the first two) are ciphered by simple XOR routine which requires a 16 byte xor key..

this xor key is provided by server and delivered to client in the initial unencrypted KeyPacket..original KeyPacket consists of ~25 bytes, 8 bytes are the xor key (they are completed to 16B on the client) and the rest is just junk

 

but the KeyPacket from L2World is 1042 bytes long and looks like this:

 

12 04  - packet size
2E      - opcode: KeyPacket
01      - protocol OK

E1 36 41 3C 8E 66
D0 7F 72 11 53 1F E4 5A 3F 00 C8 8C 40 57 3B 2E
A9 B8 A6 81 D4 8E 47 72 13 99 4C 15 7D 7F 51 6B
...
...
D8 2C DA 47 BF 25 54 2E B7 51 BE 01 00 00 00 01
00 00 00 01 00 00 00 00

 

this means the L2World's xor key is 1025 (1024?) bytes long, so we have 2 options:

- L2World's server and client cipher routines were modified to use 1024B xor key or

- our 16 (8) bytes xor key is hidden somewhere/somehow in those 1025 bytes

 

i won't give up so easy but any help on this topic is welcome