SenseHeading [works with seq 4.3.2]

[Hoihoi]

enjoy :)

gonna debug it tomorrow so it compiles with M$ VC



// $Header: /usr/local/cvsroot/senseheading/senseheading.c,v 1.4 2002/11/05 23:36:03 hoihoi Exp $

#include <stdio.h>
#include <string.h>
#include <winsock2.h>
#include <tlhelp32.h>
#include <time.h>

#define CONF_FILE "C:/senseheading/senseheading.conf"
#define CONF_SIZE 16

struct CONFIG
{
unsigned long long SessionKeyLocation;
unsigned int SendInterval;
char seq_ip[16];
int seq_port;
} config;

int SendSessionKey(unsigned long long SessionKey);

void readkey (HANDLE hProcess, int useConfig)
{
while (1)
{
unsigned long addr;
unsigned long long key = 0xffffffffffffffff;

char keypressing;

if (useConfig == 0)
{
printf ("\nenter offset (ie: 0x00773b90): ");
if (scanf ("%08x", &addr) == 1)
{
printf ("offset:\t0x%08x\n", addr);
}
}
else
addr = config.SessionKeyLocation;

if (ReadProcessMemory (hProcess, (void *)addr, &key, 8, NULL) == 0)
{
printf ("ReadProcessMemory on 8 bytes at 0x%08x failed: %u\n", addr, GetLastError());
}
else
{
printf ("Session key:\t0x%016llx\n", (unsigned long long) key);

if ( useConfig == 1)
{
if (SendSessionKey(key) != SOCKET_ERROR)
printf("Sent the session key to %s:%d\n", config.seq_ip, config.seq_port);
else
printf("Failed to send the session key to %s:%d\n", config.seq_ip, config.seq_port);
}

if (config.SendInterval != 0)
sleep(config.SendInterval*1000);
else
{
printf("\nPress some key to continue");
scanf("%s", &keypressing);
}
}
}

fflush (stdin);
}

int scanproclist ( int useConfig )
{
HANDLE hProcessSnap = NULL;
PROCESSENTRY32 pe32 = {0};

// Take a snapshot of all processes in the system.
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

if (hProcessSnap == INVALID_HANDLE_VALUE)
return 0;

// Fill in the size of the structure before using it.
pe32.dwSize = sizeof(PROCESSENTRY32);

if (Process32First(hProcessSnap, &pe32))
{
HANDLE hProcess;

do
{
LPSTR pCurChar;
char pName[512];

// strip path and leave exe filename
for (pCurChar = (pe32.szExeFile + strlen (pe32.szExeFile));
*pCurChar != '\\' && pCurChar != pe32.szExeFile - 1;
--pCurChar)

strcpy(pName, pCurChar);
strlwr(pName);

if ( (strncmp (pName, "testeqgame", 10) == 0) || (strncmp (pName, "eqgame", 6) == 0) )
{
printf ("found eqgame - pid = %u\n\n", pe32.th32ProcessID);
hProcess = OpenProcess (PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);
if (hProcess == NULL)
{
DWORD dw;
dw = GetLastError();
printf ("OpenProcess failed, error: %u\n", dw);
return 0;
}
readkey (hProcess, useConfig);
}
}
while (Process32Next(hProcessSnap, &pe32));
}

CloseHandle (hProcessSnap);
return 0;
}


int ReadConfig (void)
{
int useConfig = 0;
char conf_buffer[CONF_SIZE];

GetPrivateProfileString("Client", "SessionKeyLocation", "0", conf_buffer, CONF_SIZE, CONF_FILE);
config.SessionKeyLocation = strtol(conf_buffer,NULL,16);

GetPrivateProfileString("Client", "SendInterval", "0", conf_buffer, CONF_SIZE, CONF_FILE);
config.SendInterval = atoi(conf_buffer);

GetPrivateProfileString("ShowEQ", "IP", "0", conf_buffer, CONF_SIZE, CONF_FILE);
strcpy(config.seq_ip, conf_buffer);

GetPrivateProfileString("ShowEQ", "Port", "0", conf_buffer, CONF_SIZE, CONF_FILE);
config.seq_port = atoi(conf_buffer);

if (config.SessionKeyLocation > 0)
useConfig = 1;

return useConfig;
}

int SendSessionKey(unsigned long long SessionKey)
{
int ret;
WSADATA wsd;
SOCKET ssocket;
SOCKADDR_IN seq;

if (WSAStartup(MAKEWORD(2, 2), &wsd) != 0)
{
printf("WSAStartup failed!\n");
return SOCKET_ERROR;
}

ssocket = socket(AF_INET, SOCK_DGRAM, 0);
if (ssocket == INVALID_SOCKET)
{
printf("socket() failed; %d\n", WSAGetLastError());
return SOCKET_ERROR;
}

seq.sin_family = AF_INET;
seq.sin_port = htons((short)config.seq_port);
seq.sin_addr.s_addr = inet_addr(config.seq_ip);

ret = sendto(ssocket, &SessionKey, sizeof(unsigned long long), 0, (SOCKADDR *)&seq, sizeof(seq));
if (ret == SOCKET_ERROR)
return SOCKET_ERROR;

closesocket(ssocket);
WSACleanup();

return 0;
}

int main(void)
{
printf ("scanning for eqgame.exe\n");

if (ReadConfig() == 1)
scanproclist(1);
else
scanproclist(0);

return 0;
}
:

[fryfrog]

i assume 4.3.2 is just about to come out? i did a cvs -z3 update and didn't get anything but new maps :)

[fee]

4.3.2 is not currently "working as intended." I expect a release in the next 12 hours, just need to isolate a crash bug.

fee

[pyrodex]

HoiHoi has the code above changed since your last post?

[MightyWarrior]

Hoihoi

I have MS VC 4.2 and when I compile your code i get the following:

--------------------Configuration: senseheading - Win32 Debug--------------------
Compiling...
newbie.cpp
C:\newbie.cpp(14) : error C2632: 'long' followed by 'long' is illegal
C:\newbie.cpp(20) : error C2632: 'long' followed by 'long' is illegal
C:\newbie.cpp(27) : error C2632: 'long' followed by 'long' is illegal
C:\newbie.cpp(27) : warning C4305: 'initializing' : truncation from 'const unsigned __int64' to 'unsigned long'
C:\newbie.cpp(27) : warning C4309: 'initializing' : truncation of constant value
C:\newbie.cpp(48) : error C2632: 'long' followed by 'long' is illegal
C:\newbie.cpp(59) : error C2065: 'sleep' : undeclared identifier
C:\newbie.cpp(59) : error C2064: term does not evaluate to a function
C:\newbie.cpp(96) : error C2001: newline in constant
C:\newbie.cpp(96) : error C2015: too many characters in constant
C:\newbie.cpp(97) : error C2105: '--' needs l-value
C:\newbie.cpp(97) : error C2146: syntax error : missing ';' before identifier 'pCurChar'
C:\newbie.cpp(147) : error C2632: 'long' followed by 'long' is illegal
C:\newbie.cpp(171) : error C2632: 'long' followed by 'long' is illegal
C:\newbie.cpp(171) : error C2664: 'sendto' : cannot convert parameter 2 from 'unsigned long *' to 'const char *' (new behavior; please see help)
Error executing cl.exe.
newbie.obj - 13 error(s), 2 warning(s)

If I take out the long long and replace it with just long and recompile I get the following ( also I placed another \ in the line *pCurChar != '\' && pCurChar != pe32.szExeFile - 1;):

--------------------Configuration: senseheading - Win32 Debug--------------------
Compiling...
newbie.cpp
C:\newbie.cpp(27) : warning C4305: 'initializing' : truncation from 'const unsigned __int64' to 'unsigned long'
C:\newbie.cpp(27) : warning C4309: 'initializing' : truncation of constant value
C:\newbie.cpp(59) : error C2065: 'sleep' : undeclared identifier
C:\newbie.cpp(59) : error C2064: term does not evaluate to a function
C:\newbie.cpp(171) : error C2664: 'sendto' : cannot convert parameter 2 from 'unsigned long *' to 'const char *' (new behavior; please see help)
Error executing cl.exe.
newbie.obj - 3 error(s), 2 warning(s)

Any hints (notice I compiled the program as I am newbie) Please keep the Flames low
;)

[SEQLurker]

You need to replace all the 'unsigned long long' with 'ULONGLONG'...

You need to replace the call to 'sleep' with a call to 'Sleep'...

For the error in line 171, you probably just need to explicitly cast the paramater to (char *)...

You'll probably also need to add Ws2_32.lib to the libraries being linked in to the project.

[MightyWarrior]

SEQLurker,

Thanks man ULONGLONG was the answer I also included the w3s_32.lib and the sleep thing who would have thunk a cap S would have made a difference <grin> but I still get a warning:

--------------------Configuration: senseheading - Win32 Debug--------------------
Compiling...
senseheading.c
C:\senseheading.c(171) : warning C4133: 'function' : incompatible types - from 'unsigned __int64 *' to 'const char *'
senseheading.obj - 0 error(s), 1 warning(s)


/emote looks puzzled and bewildered at comment:

For the error in line 171, you probably just need to explicitly cast the paramater to (char *)...

I know the error is tellng me that I can't combine 2 different types but how can I make the change?

[SEQLurker]

Change this:


ret = sendto(ssocket, &SessionKey, sizeof(unsigned long long), 0, (SOCKADDR *)&seq, sizeof(seq));


To this:


ret = sendto(ssocket, (char *) &SessionKey, sizeof(ULONGLONG), 0, (SOCKADDR *)&seq, sizeof(seq));

[MightyWarrior]

SEQLurker

You have the right from now until forever to /bonk me on the head anytime you want.

Compiles without error... <big Grin>

Sometimes you have to Pound learning into a warriors head after all our int isn't that great .. hehehe

[wkm]

I have this sniffer up and running, looks like it is finding eqgame and the key and sending it off to my seq box, port 666. I have updated seq to 4.3.2 and told it to watch port 666. It doesn't seem that showeq is receiving the packet sent to it due to the fact that spawns are not showing up. Should I expect to see any mesasge in the output from showeq that a key has been recieved?

[pyrodex]

Im having the same problem. Im seeing the packet from the eq machine to the seq machine but seq doesnt seem to be getting it correctly.

[Wxyz]

Thanks Gang and Hoihoi, for this update, I guess I will scrap my auto updating code now. I had to include wsock32.lib to get by the linking errors on W98 solved. Does the latest cvs solve the Keyloading Lock up issue? was causing me problems with my auto updating code in decode before. Havent had a chance to look at decode.cpp yet.. Curious..

< compiling atm > Will try it out..

Thanks Again.
Wxyz.

[fluke]

I'm using DEV-C++ and getting the following error... any help?

line 96 C:\dev-c++\senseheading.c unterminated character constant


Line 96 is this one (direct copy from up above).

*pCurChar != '\' && pCurChar != pe32.szExeFile - 1;


Thanks in Advance

[bel]

Change '\' to '\\'

[fluke]

Thanks for the eyes Bel :-) . Should have jumped right out at me, of course I also ran out of gas on way home from work today too, and that should have jumped out at me too..hehe been one of those days.

Fluke

[Wishbringer]

Hm, to avoid another warning:

in "struct CONFIG" SessionKeyLocation is ULONGLONG, in "void readkey" addr is ULONG.

Think you can change ULONGLONG into ULONG.

another thing in "int scanproclist":
hProcess = OpenProcess (PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);
isn't
hProcess = OpenProcess (PROCESS_VM_READ, FALSE, pe32.th32ProcessID);
sufficant?

Another question:
in kscan.c example there is at beginning a "BOOL enable_debug_privs()" subroutine.
Don't need it in senseheading.c?

[homer]

Not sure whats is going on here, but I have it compiled, it runs the first time, gets the key, sends it, zone decodes, but when I zone after that, it either locks showeq up or I just don't get a decoded zone again.

Anyone else having this issue?

[uncleubb]

Question:

In order to differentiate my sniffer, is it enough to change variable names, file names, etc? Is it even helpful to make changes to variable names?

-uu

[alterego]

Here is the diff:

2a3
> #include <winsock2.h>
3a5
> #include <stdlib.h>
5d6
< #include <winsock2.h>
7c8
< #include <time.h>
---
> #include <unistd.h>
27c28
< unsigned long long key = 0xffffffffffffffff;
---
> unsigned long long key = 0xffffffffffffffffULL;
96,97c97,98
< *pCurChar != '\' && pCurChar != pe32.szExeFile - 1;
< --pCurChar)
---
> *pCurChar != '\\' && pCurChar != pe32.szExeFile - 1;
> --pCurChar)
171c172
< ret = sendto(ssocket, &SessionKey, sizeof(unsigned long long), 0, (SOCKADDR *)&seq, sizeof(seq));
---
> ret = sendto(ssocket, (char *) &SessionKey, sizeof(unsigned long long), 0, (SOCKADDR *)&seq, sizeof(seq));

To summarize, move winsock2.h to the top of the includes, add unistd.h to the bottom. Add "ULL" to the end of the value being assigned to "key". Change "\" to "\\" and finally cast &SessionKey with (char *).

Finally when you compile use -lth32 -lwsock32

[tanker]

Does anyone have this working under MS VC++ 6.0?

Unfortunately my last coding exp was with a WWIV bbs about 10 years ago. :(

Getting all sorts of errors after reading through this entire post.

Thanks in advance.

[Dak-question]

Here is a modified source that I was able to compile on MSVC++ 6...


------------------------------- Snip -----------------------------------

// $Header: /usr/local/cvsroot/senseheading/senseheading.c,v 1.4 2002/11/05 23:36:03 hoihoi Exp $

#include <winsock2.h>
#include <stdio.h>
#include <string.h>
#include <tlhelp32.h>
#include <time.h>

#define CONF_FILE "C:/senseheading/senseheading.conf"
#define CONF_SIZE 16

struct CONFIG
{
ULONG SessionKeyLocation;
unsigned int SendInterval;
char seq_ip[16];
int seq_port;
} config;

int SendSessionKey(ULONGLONG SessionKey);

void readkey (HANDLE hProcess, int useConfig)
{
while (1)
{
unsigned long addr;
ULONGLONG key = 0xffffffffffffffff;

char keypressing;

if (useConfig == 0)
{
printf ("\nenter offset (ie: 0x00773b90): ");
if (scanf ("%08x", &addr) == 1)
{
printf ("offset:\t0x%08x\n", addr);
}
}
else
addr = config.SessionKeyLocation;

if (ReadProcessMemory (hProcess, (void *)addr, &key, 8, NULL) == 0)
{
printf ("ReadProcessMemory on 8 bytes at 0x%08x failed: %u\n", addr, GetLastError());
}
else
{
printf ("Session key:\t0x%016llx\n", (ULONGLONG) key);

if ( useConfig == 1)
{
if (SendSessionKey(key) != SOCKET_ERROR)
printf("Sent the session key to %s:%d\n", config.seq_ip, config.seq_port);
else
printf("Failed to send the session key to %s:%d\n", config.seq_ip, config.seq_port);
}

if (config.SendInterval != 0)
Sleep(config.SendInterval*1000);
else
{
printf("\nPress some key to continue");
scanf("%s", &keypressing);
}
}
}

fflush (stdin);
}

int scanproclist ( int useConfig )
{
HANDLE hProcessSnap = NULL;
PROCESSENTRY32 pe32 = {0};

// Take a snapshot of all processes in the system.
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

if (hProcessSnap == INVALID_HANDLE_VALUE)
return 0;

// Fill in the size of the structure before using it.
pe32.dwSize = sizeof(PROCESSENTRY32);

if (Process32First(hProcessSnap, &pe32))
{
HANDLE hProcess;

do
{
LPSTR pCurChar;
char pName[512];

// strip path and leave exe filename
for (pCurChar = (pe32.szExeFile + strlen (pe32.szExeFile));
*pCurChar != '\\' && pCurChar != pe32.szExeFile - 1;
--pCurChar)

strcpy(pName, pCurChar);
strlwr(pName);

if ( (strncmp (pName, "testeqgame", 10) == 0) || (strncmp (pName, "eqgame", 6) == 0) )
{
printf ("found eqgame - pid = %u\n\n", pe32.th32ProcessID);
hProcess = OpenProcess (PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);
if (hProcess == NULL)
{
DWORD dw;
dw = GetLastError();
printf ("OpenProcess failed, error: %u\n", dw);
return 0;
}
readkey (hProcess, useConfig);
}
}
while (Process32Next(hProcessSnap, &pe32));
}

CloseHandle (hProcessSnap);
return 0;
}


int ReadConfig (void)
{
int useConfig = 0;
char conf_buffer[CONF_SIZE];

GetPrivateProfileString("Client", "SessionKeyLocation", "0", conf_buffer, CONF_SIZE, CONF_FILE);
config.SessionKeyLocation = strtol(conf_buffer,NULL,16);

GetPrivateProfileString("Client", "SendInterval", "0", conf_buffer, CONF_SIZE, CONF_FILE);
config.SendInterval = atoi(conf_buffer);

GetPrivateProfileString("ShowEQ", "IP", "0", conf_buffer, CONF_SIZE, CONF_FILE);
strcpy(config.seq_ip, conf_buffer);

GetPrivateProfileString("ShowEQ", "Port", "0", conf_buffer, CONF_SIZE, CONF_FILE);
config.seq_port = atoi(conf_buffer);

if (config.SessionKeyLocation > 0)
useConfig = 1;

return useConfig;
}

int SendSessionKey(ULONGLONG SessionKey)
{
int ret;
WSADATA wsd;
SOCKET ssocket;
SOCKADDR_IN seq;

if (WSAStartup(MAKEWORD(2, 2), &wsd) != 0)
{
printf("WSAStartup failed!\n");
return SOCKET_ERROR;
}

ssocket = socket(AF_INET, SOCK_DGRAM, 0);
if (ssocket == INVALID_SOCKET)
{
printf("socket() failed; %d\n", WSAGetLastError());
return SOCKET_ERROR;
}

seq.sin_family = AF_INET;
seq.sin_port = htons((short)config.seq_port);
seq.sin_addr.s_addr = inet_addr(config.seq_ip);

ret = sendto(ssocket, (char *) &SessionKey, sizeof(ULONGLONG), 0, (SOCKADDR *)&seq, sizeof(seq));
if (ret == SOCKET_ERROR)
return SOCKET_ERROR;

closesocket(ssocket);
WSACleanup();

return 0;
}

int main(void)
{
printf ("scanning for eqgame.exe\n");

if (ReadConfig() == 1)
scanproclist(1);
else
scanproclist(0);

return 0;
}


------------------------------ End Snip -----------------------------------

[The Mad Poet]

I ran this program but it's screwing up the key for some reason

When the key is ffffffsomething - I get 00000something

any ideas?

[Elyon]

Did you put 600 in your .conf file,as per the example? If so, it's waiting for 600000 (6 minutes) before rescanning. Drop down the rescan time.

[jonnyboy]

ive been goin through this code since it came out trying to incorporate it into my own program and it never worked. i was cutting out snippets (sender in particular) and pasting it to my program to no avail. the program in itself works. then i realized i failed to put some of the #include statements, man did i feel real dumb.

[Quick]

Compiling under MSC++ 6 I get this error:

absorbane.cpp(193) : fatal error C1010: unexpected end of file while looking for precompiled header directive
Error executing cl.exe.


Any idea's?


Quick

Turned off precompiled headers and it works fine now.

[tanker]

MS VC++ 6.0 using Dak-question's code.
Getting the following errors.

--------------------Configuration: senseheading - Win32 Debug--------------------
Compiling...
senseheading.c
Linking...
senseheading.obj : error LNK2001: unresolved external symbol _fflush
senseheading.obj : error LNK2001: unresolved external symbol __iob
senseheading.obj : error LNK2001: unresolved external symbol _scanf
senseheading.obj : error LNK2001: unresolved external symbol _printf
senseheading.obj : error LNK2001: unresolved external symbol __chkesp
senseheading.obj : error LNK2001: unresolved external symbol _strncmp
senseheading.obj : error LNK2001: unresolved external symbol _strlwr
senseheading.obj : error LNK2001: unresolved external symbol _strcpy
senseheading.obj : error LNK2001: unresolved external symbol _strlen
senseheading.obj : error LNK2001: unresolved external symbol _atoi
senseheading.obj : error LNK2001: unresolved external symbol _strtol
senseheading.obj : error LNK2001: unresolved external symbol __imp__WSACleanup@0
senseheading.obj : error LNK2001: unresolved external symbol __imp__closesocket@4
senseheading.obj : error LNK2001: unresolved external symbol __imp__sendto@24
senseheading.obj : error LNK2001: unresolved external symbol __imp__inet_addr@4
senseheading.obj : error LNK2001: unresolved external symbol __imp__htons@4
senseheading.obj : error LNK2001: unresolved external symbol __imp__WSAGetLastError@0
senseheading.obj : error LNK2001: unresolved external symbol __imp__socket@12
senseheading.obj : error LNK2001: unresolved external symbol __imp__WSAStartup@8
LINK : error LNK2001: unresolved external symbol _mainCRTStartup
Debug/senseheading.exe : fatal error LNK1120: 20 unresolved externals
Error executing link.exe.

senseheading.exe - 21 error(s), 0 warning(s)

[MisterSpock]

Tanker,

Those are linker errors. Looks like you haven't linked the right libraries.

For certain, you will need to add wsock32.lib in your project properties LINK tab.

[tanker]

Thanks misterspock thats what I needed to do :)

This is a great little tool but is it possible to make it close after it sends the key? What i do is zone, fire off the sniffer then close it after it sends the key. that way I don't have to leave it running.

[Shadow Walker]

t0x%016I64x

Or you get 000000xxxxxxx

directed to Mad

[The Mad Poet]

yeah I got it working and compiles fine - but it's not sending the key - so I'm at a loss...

/em thinks

[Meltro]

There once was this spiffy game called Ultima Online. It was buggy as hell with worthless support and GMs, but it was fun enough to hook you. Anyways, there were utilities we used to use, to speed things up in game. One of which, UOExtreme, was looked down upon. Origin (the makers of UO) gave an ultimatum, and then started banning people for using it. Lots of people. Their most loyal and oldest customers, 7x GMs (read: lvl 65 + full AA), were being banned for using UOE.

My point is, don't think Sony/Verant will play any differently. Think your loyalty buys you leniancy? Think again.

Now, being an SEQ user myself for quite some time now (Kudos to the dev team!), this hasn't bothered me. SEQ was totally passive, transmitting nothing, thus totally invisible to verant.

This has changed. Verant is now only a minor unannounced patch away from snagging quite a few SEQ users. In a rush to put out the release, almost no thought has been given to stealth. Yes, yes, open source means I can program a system that would be totally unique to me, and thus verant would not look for it, but what about the rest? If an SEQ box is capable of detecting the encryption key packet, so is EQ. A simple check would confirm which EQ Client is currently using that key, and then the ball is in their court.

Now Verant has made it pretty clear that it does not want us to be sniffing the data stream (rolling-key encryption doesn't exactly strike me as being put in to facilitate new PoP features), so can we please try to be a bit more discret? For the user's sake?

[Wishbringer]

Wouldn't be a problem for me.
Playing EQ now since 1999 with 3 Accounts. Have 6 Chars above Lvl 60 and be abit tired.
If i would be forced to play EQ now without some beneficial tools i would quit EQ at once.
I wouldn't start a raid without knowing if NToV is up, and we won't wait till our guildtrackers goes online.
Most time is use ShowEQ only for GPS.

Another thing.
IF they ban me, i would start a lawsuit against Sony.
First, because they sniff my PC,
second, because their eula interferes with local law of my country.
(for example... eulas are only part of a contract when buyer knows about it, BEFORE he bought that product. each eula he has to agree after purchase can be ignored. ->there was a lawsuit with MS for exactly same content and MS lost it.)
If they offer their product in my country they have to do it under local law, regardless what is allowed in US.

[mvern]

EQ can't detect network activities that don't belong to it, without sniffing your network traffic. If they were to start to do that, I'd be amazed to say the least.

Anyway, opensource also means anyone is welcome to modifiy and post changes. So, how about that patch to make the keysniffing and key transfers more secure? ;)

[Meltro]

I would love too, unfortunately my C++ knowledge is limited to cins and couts, and I do not have the time to pickup a language at the moment. I do however have an idea of how things should go...

First the sniffer is started BEFORE EQ. It first broadcasts a packet that contains a new, random port to use and a decrypt key (more on this in a second). Then, open a connection with the seq box on the new port. random client/server traffic (very light) follows, with packets stuffed with gibberish. When the sniffer transmits the key, it transmits over this link. Now, the encryption key: very simple, it states the location of 9 bytes in these packets. The SEQ box parses the gibberish, and takes out those 9 bytes. The first is an ID byte, stating that this packet is an actual key packet, and the other 8 are the actual key. Since the location of these 9 bytes is totally random, and determined before the EQ executable comes up, there is no way for it to know this is anything but regular traffic.

[gnome01]

Thanks eqlurker, just noticed that..

would there be any additional work to get the seq box to receive the key other than setting the port at which to listen on in the decoder menu?

any help is appreciated, thanks in advance.

[SEQLurker]

gnome01,

I don't mean to sound mean and nasty, but the answer to your question has been answered at least 3 times in this very thread. I suggest you scroll up and read.

[gnome01]

in dak-questions source, where exactly is it sending the key from the win machine to the seq box? i'ts obviouslly sending the key somewhere i do not know =)

thx in advance

[Zor]

I was having the same trouble: key was being sent, but it was never recieved... So I did some digging. After a couple of hours playing with packet sniffers and scratching my head, my problem came down to 1 simple thing...

When you set the key port in showeq, it doesnt actually change until you zone. So if you fire up ShowEQ and set the desired port, you can fire keys at it until you turn blue, but if you dont zone ShowEQ wont see any of them. At least, thats been my experience.

[lane]

If you save settings, exit and come back in you will have the new port information from then on.

-Lane

[Resiliant]

ok... hmm read the entire thread and im a <bit> at a loss.

I included HoiHoi's code into my own version, which compiles and links, and appears to execute successfully. I set the IP address to the address of my host, and set the port to 666 as previously suggested. I set '666' as the port number in SEQ, and saved preferences, and exited and restarted SEQ.

The client side code says it successfully sent the Key to SEQ, but SEQ is not resolving. There were a couple entries earlier that seemed to indicate others have had this problem, but there were no specific suggestions as to the resolution path. If I get the Key manually it works wonderfully.... so I know the key is correct.

What am i missing? What module contains the Socket service code so i can verify reception of the key?

Res

[Mr. Suspicious]

I set the IP address to the address of my host, and set the port to 666 as previously suggested. I set '666' as the port number in SEQ, and saved preferences, and exited and restarted SEQ.

What am i missing?


Read the announcement section. What does it say about port ranges? There's your answer.

[Resiliant]

Thank you, Suspicious. I tend to only look at the most recent CVS update post in the Announcements section, and the one I needed to look at was one down!

Changed the port to 10000, as suggested... BINGO works like a champ!

Let me reiterate... The current implementation, especially with the UDP transmission is now FULLY automated, and does everything the old version did, except faster and more reliably. Just as is usually the case, conflict produces progress! I look forward with anticipation to the next salvo in this war... I just hope SoE comes to it's senses soon and realizes it is a war they absolutely can not win in any scenario.

Res

[OrangePeelBeef]

First off I'd like to say hoihoi this code is very nice =)

I made a couple modifications to the file that were very simple, yet seemed to help things out a little.

First thing I did was to get rid of the useconfig variable and make it so that the readconfig function returned the delay. I then made an exit call if the config file wasn't detected or corrupted with an appropriate printf response.

I then set it that if the delay was != 0 then sleep(15000) to allow for the load time.

Secondly I added uncle ben's debug privs. I thought about setting it up to scan for the pid, and if it didnt' find it wait 15 seconds, then scan again in an endless loop until it found it but in the end I didn't really think it was necessary.
The debug privs aren't essential, but it would be nice if you were running eqw and forgot to start the sucker up. I just did it in the first part of int main but you could add another section to the config file to check if debug=0 / 1 so people who don't want debug on can flag it off.

Third I added a line to scanproclist to let the people know there was no eq detected... make it a little more friendly.

}
readkey (hProcess, useConfig);
}

/*VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV*/
else if (!(Process32Next(hProcessSnap, &pe32)))
printf("EQ is not running or can't be detected");
/*^^^^^^^^^^^^^^^^^^^^^^^^^^^^*/

}
while (Process32Next(hProcessSnap, &pe32));
}

CloseHandle (hProcessSnap);
return 0;
}


None of these changes are really anything ground breaking but I thought I'd mention them =)

[Manaweaver]

Compiling...
Cpp1.cpp
Linking...
Cpp1.obj : error LNK2001: unresolved external symbol __imp__WSACleanup@0
Cpp1.obj : error LNK2001: unresolved external symbol __imp__closesocket@4
Cpp1.obj : error LNK2001: unresolved external symbol __imp__sendto@24
Cpp1.obj : error LNK2001: unresolved external symbol __imp__inet_addr@4
Cpp1.obj : error LNK2001: unresolved external symbol __imp__htons@4
Cpp1.obj : error LNK2001: unresolved external symbol __imp__WSAGetLastError@0
Cpp1.obj : error LNK2001: unresolved external symbol __imp__socket@12
Cpp1.obj : error LNK2001: unresolved external symbol __imp__WSAStartup@8
Debug/Cpp1.exe : fatal error LNK1120: 8 unresolved externals
Error executing link.exe.

Cpp1.exe - 9 error(s), 0 warning(s)

So far thats what I've gotten. I used the MSC++6.0 Source from above changing the *pCurChar != '\' to *pCurChar !='\\' and came out with this set of errors. It still wasn't compiling with the original '\' so I tried that fix (which seems to be either a common mistake or something that has a lot of discrepencies among version of C++.)

I realize its a linking error, but I have

#include <winsock2.h>
#include <stdio.h>
#include <string.h>
#include <tlhelp32.h>
#include <time.h>

I'm at a bit of a loss as to what to try now.

Not sure what information is relevant...so here goes what I can think of adding. Win2k Pro, its an AMD Based system(Duron Specifically), downloaded my version from Kazaa...everything seems to be in order. Could it possibly be a bad library?(Terminology may be wrong, but I think you realize what I mean...)

Also, I saw MisterSpock's post above about adding wsock32.lib into the linking tab, but that didn't work with MSCV6...or at least my version. Couldn't find the library.

[Mr. Suspicious]

I realize its a linking error, but I have

#include <winsock2.h>
#include <stdio.h>
#include <string.h>
#include <tlhelp32.h>
#include <time.h>


#includes are NOT linking. Includes are just that, included header files.



Also, I saw MisterSpock's post above about adding wsock32.lib into the linking tab, but that didn't work with MSCV6...or at least my version. Couldn't find the library.


That is linking. If it does not find the library, then install the library, use google (http://www.google.com) or read the documentation of your compiler to find out how or better yet, visit a compiler specific helpforum for help.



Cpp1.obj : error LNK2001: unresolved external symbol __imp__WSACleanup@0
Cpp1.obj : error LNK2001: unresolved external symbol __imp__closesocket@4
Cpp1.obj : error LNK2001: unresolved external symbol __imp__sendto@24
Cpp1.obj : error LNK2001: unresolved external symbol __imp__inet_addr@4
Cpp1.obj : error LNK2001: unresolved external symbol __imp__htons@4
Cpp1.obj : error LNK2001: unresolved external symbol __imp__WSAGetLastError@0
Cpp1.obj : error LNK2001: unresolved external symbol __imp__socket@12
Cpp1.obj : error LNK2001: unresolved external symbol __imp__WSAStartup@8


Also use google (http://www.google.com) to find out which library these belong to and link against that library.


Not sure what information is relevant...so here goes what I can think of adding. Win2k Pro, its an AMD Based system(Duron Specifically), downloaded my version from Kazaa...everything seems to be in order.

One thing is definatelly not in order: you are using a stolen compiler. Either pay for your compiler or use one of the widely available free compilers.

[Manaweaver]

Ah yes...thank you Mr. Suspicious. Used MinGW and everything compiled just fine using unclene's code. I have very little experience in C++ so even the terminology was wrong... I apologize for the horror of that bilge.

[eqtryin]

from another post the new offset is 0x0078AAD0, just want someone to confirm i need to put this in the hh.conf file and recompile correct?

[Samefudge]

eqtryin, the whole point of the .conf file is so that when the offset changes, you don't have to re-compile.

[OrangePeelBeef]

eqtryin.. Why don't you verify the offset yourself with the offset finder? That's what it's there for...

[eqtryin]

got the right offset in the conf file but gettin open process error failed with this now =( dont know why using windows xp pro and was working fine before

[OrangePeelBeef]

Are you starting the sniffer before the character select screen? If not that is why you are getting the op 5 error. You can include UncleBen's debug privs to get around that if you consistently forget to start it up soon enough :)



BOOL enable_debug_privs() /*This function makes it so you can run the program anytime without gettting the OpenProcess error 5 message */
{
HANDLE hToken; /* process token */
TOKEN_PRIVILEGES tp; /* token provileges */
TOKEN_PRIVILEGES oldtp; /* old token privileges */
DWORD dwSize = sizeof (TOKEN_PRIVILEGES);
LUID luid;

if (!OpenProcessToken (GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{
if (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
return TRUE;
printf ("OpenProcessToken() failed: %d\n", GetLastError());
return FALSE;
}

if (!LookupPrivilegeValue (NULL, SE_DEBUG_NAME, &luid))
{
printf ("LookupPrivilege() failed: %d\n", GetLastError());
CloseHandle (hToken);
return FALSE;
}

ZeroMemory (&tp, sizeof (tp));
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

/* Adjust Token privileges */
if (!AdjustTokenPrivileges (hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), &oldtp, &dwSize))
{
printf ("AdjustTokenPrivileges() failed: %d\n", GetLastError());
CloseHandle (hToken);
return FALSE;
}





return TRUE;
}



and change




int main(void)
{

if (enable_debug_privs() == FALSE)
printf ("Can't Enable Debug Privs");
printf ("scanning for eqgame.exe\n");

if (ReadConfig() != 1)
printf ("Problem with your config file!\n");
else
scanproclist(0);


}

[eqtryin]

nope on a 2 min sleep timer i switched over to this one for now

http://seq.sourceforge.net/showthread.php?s=&threadid=2453

and its working great, thanx for the help :)

[orenwolf]

Same problem. Pre-patch this worked fine. Post-patch (with new offset), I'm getting error 5 now as well.

Win XP sp1.

Going to try the DLL method for now, but I'd really like to figure this out.

Note, it *works* on my 98SE system.

[Talon]

--------------------Configuration: Test - Win32 Debug--------------------
Compiling...
Test1.cpp
C:\Test1.cpp(96) : error C2001: newline in constant
C:\Test1.cpp(96) : error C2015: too many characters in constant
C:\Test1.cpp(97) : error C2105: '--' needs l-value
C:\Test1.cpp(97) : error C2146: syntax error : missing ';' before identifier 'pCurChar'
Error executing cl.exe.

Test1.obj - 4 error(s), 0 warning(s)

Any idea whats wrong with my sense heading ? (MS VC++6,0 here)

Warning : Flaming is senseless, i am ice giant )

[Fletch]

Talon you need to add change this line from '\' to '\\'

*pCurChar != '\' && pCurChar != pe32.szExeFile - 1;

That should fix the error you are getting.