Keyring version 2.2

[baelang]

Keyring version 2.2 is now avaliable.

http://members.fortunecity.com/baelang/

major changes include:
prints version information
updated Makefile, won't overwrite existing ini files
integrated find_offset into the main program

As always a binary distribution is avaliable on the official site:
http://members.fortunecity.com/baelang/

The source only distribution is attached in .zip format.

Enjoy!

[Chuin]

Hiyas,

I downloaded your latest version into c:/keyring, used the make util fron Lcc/bin to do the make process. I edited the ini file to reflect the IP address of the SEQ machine and changed to port address to something different.

When I run keyring I get this message
'some sort of problem with the config file c:/keyring/keyring.ini'

EDIT update: I tried running Keyring -v and received the following.

Maximum verbosity.
main program starting.
keyring based on keyring version 2.2.
config file name is: C:/keyring/keyring.ini
UncleBen's function is now running.
using ini file ProgramName: eqgame
ProgramName is : eqgame
key location is: #lx
Send interval is: 0 seconds.
destination IP is: 127.0.0.1:10000
some sort of problem with the config file c:/keyring/keyring.ini


I might as well ask the last question here too....

in SEQ I see where to put in the port to listen to for the decoder, but what filename do I need?



any ideas?

[baelang]

it sounds like you have some sort of problem with your config file c:/keyring/keyring.ini

the key location should say something like 0x0078bcb8 but yours says #lx. since it is sending to 127.0.0.1, which is the default, i would say your ini file is corrupt or missing.

the config file should look like this:


[Client]
ProgramName=eqgame
SessionKeyLocation=0x0078bcb8
SendInterval=60

[ShowEQ]
IP=127.0.0.1
Port=10000


Of course you will have to change the IP address and Port number.

[Chuin]

Found it....

the Keyring.ini is located in c:/keyring/conf/keyring.ini

the program is looking in C:/keyring/keyring.ini

I copied the configured INI to c:/keyring and it's running...

Thank you,

Chuin

[uncleubb]

I just wanted to post a thank you for posting your code and making it available to all of us to compile. It works amazingly well for me. Thanks for all of the time you (and everyone else on this project) took in creating this...

-uu

[baelang]

Originally posted by Chuin
Found it....

the Keyring.ini is located in c:/keyring/conf/keyring.ini

the program is looking in C:/keyring/keyring.ini

I copied the configured INI to c:/keyring and it's running...

Thank you,

Chuin


"make install" would have copied it into the proper location. but it would just have done the same thing you did by hand, so you are set.

[Hobo]

"integrated find_offset into the main program"




Does this mean the latest version has a feature to find new offsets when needed? Sounds like it does.


Hobo

[baelang]

Originally posted by Hobo
"integrated find_offset into the main program"

Does this mean the latest version has a feature to find new offsets when needed? Sounds like it does.



As always, go here: http://members.fortunecity.com/baelang/
to see the details.

It isn't automatic, but if you call keyring with the -l option it will determine the offset and print it to the screen for you. you then copy this value into your config file and run it as normal.

[cheese_poker]

baelang ,

Just a quick question. Do you use the keysniffer with a telnet session and run it once when you need decodes? or do you let it run infinitely while playing EQ?

I ask, because the only Telnet server I could find for Win98 had a trial time (30 days) and it's about to run out. :/ I guess I am nervous about leaving it running instead of the one shot telnet session.

BTW, thanks a ton. I tried alot of the sniffers and yours is the only one I could get working. :P

[baelang]

I normally run in loop mode.

sometimes i run it from a telnet session (like if i forget to start it up before i start EQ.)

i use they cygwin sshd server, so it is technically SSH and not telnet, but it works more or less the same.

Personally, i am in the medium paranoia camp. i think that if they can detect a keysniffer running continuously, they can also detect one that runs once and exits. i don't think they plan to go to a lot of effort to activly pursue and ban people using showeq. they may try to prevent its use here and there, but won't do a lot of work to detect what is running on your own pc.

I do, however, change the executible names and config file names on my own system.

[ishap]

Is anyone else having decoding problems? I have setup Keyring and set up the ports on both ends...I can see the key being sent through a tcp dump.

Keyring outputs:

Readconfig is reading: c:/keyring/keyring.ini
using ini file ProgramName: eqgame
ProgramName is : eqgame
key location is: 0x0078bcb8
Send interval is: 60 seconds.
destination IP is: 192.168.1.20:12666
scanning for eqgame
found eqgame - pid = 1432

key: 0xffffffffbe54f4c9 lkey: 0xa44e72e321698c3e
SendSessionKey function called with key: 4201796llto destination IP: 192.168.1.20:12666
Sent the key to 192.168.1.20:12666

Then, checking the console of SEQ I get:

Decrypting and dispatching with key: 0xffffffffbe54f4c9

SEQ will properly display my level, stats, ect, but will not decode anything else.

Now, under where it says decrypting with key, it also says:
PrcoessPacket() Inflate Error: inflateREs=-3 msg=unknown compression method.
Warning: Failed to decrypt que3ued Player Profile packet: 0.
GROUPSIZE: 0
MY LEVEL: 54
GroupTot: 54
BONUS: 100
Your player's id is 4285.



Any suggestions on why it does not properly decrypt?

[baelang]

sounds like you do not have the latest version of libEQ.a. you will need to get the current one, check the md5sum, and recompile showeq (don't forget to re install showeq as well.)

[ishap]

Thank you very much! That was exactly it. Seems that when I was downloading the libEQ.a file it was not overwriting the previous one so I had to manually delete it before the new one would save. That will teach me for not checking my md5sum.

By the way excellent program!

[jgorrell]

No matter what zone I go in, I keep getting "No zone specific filter file (pathname)' and "cant find spawn point file (pathname)"

when I try to load up ShowEQ. It works with the map and everything like alot of people are getting, but it doesn't show NPC's. I can click one and it will select one of the "unknown" items.

Any ideas? Trust me, ive searched :-/

[Mr. Suspicious]

Any ideas? Trust me, ive searched :-/

No you haven't, try again using the keywords: "No zone specific filter file"

[jgorrell]

By the way - nothing shows up about the keys on the linux box, however, it says its sending the keys on this computer. Ive tried my network address and that computer's IP address.

[NHRAfan]

great work, the instructions got me up and running in no time.

[jgorrell]

Okay, after looking, I have almost exactly the same problem as the guy that needed the new libEQ.a file. The only thing is, I didn't receive this error:

PrcoessPacket() Inflate Error: inflateREs=-3 msg=unknown compression method.
Warning: Failed to decrypt que3ued Player Profile packet: 0.

And he did. I'm about to try updating that file anyways, but if you think it may be something else, please say.
Another thing i notice that is odd on my keyring is when I run it,
is this message:

scanning for eqgame
found eqgame - pid = 1432

key: 0x000000000000000 lkey: 0xFFFFFFFFFFFFFFFFFFF

or something very similar. It mixes up after the first time it runs through, but the first one always starts on 0 and F.

[ishap]

Yes, it always starts with 0x00... because the game hasn't received a key yet. Once you zone in or change zones the key changes.

Check your seq console and see if it is receiving the key. Also check the linux box with a tcpdump and see if it receiving the key.

[jgorrell]

Here's what I get in my ShowEQ box: btw, this output is using Maggotboy's this time...

Client Detected: 192.168.1.100
EQPacket::dispatchZoneData():CharProfileCode:Not Decoded
Loaded map: '/usr/local/share/showeq/Commons.map'
Loading Filter File: /usr/local/share/showeq/filters_commons.conf
TIME: 14:24 06/27/3185
EQ EPOCH OCCURRED AT 772345521 SECONDS POST UNIX EPOCH
CPlayerItems: count=150 size=54304 packetsize=362 expsize=362
Can't find spawn point file /usr/local/share/showeq/commons.sp
Loading Filter File: /usr/local/share/showeq/filters_commons.conf
Your player's id is 940
SPELL: You begin casting Improved Invisibility. Current Target is Alkure(940)
selfStartSpellCast - id=1406
selfFinishSpellCast - id=1406, by=6
L Line 11 in map '/usr/local/share/showeq/Ecommons.map' has fewer points than sp
ecified!
Loaded map: '/usr/local/share/showeq/Ecommons.map'
Can't find spawn point file /usr/local/share/showeq/ecommons.sp
Loading, Please Wait... (Zone: 'ecommons')
Loading Filter File: /usr/local/share/showeq/filters_ecommons.conf
EQPacket: SEQClosing detected, awaiting next zone session, pcap filter: EQ Clie
nt 192.168.1.100
EQPacket::dispatchZoneData():CharProfileCode:Not Decoded
L Line 11 in map '/usr/local/share/showeq/Ecommons.map' has fewer points than sp
ecified!
Loaded map: '/usr/local/share/showeq/Ecommons.map'
Loading Filter File: /usr/local/share/showeq/filters_ecommons.conf
TIME: 14:46 06/27/3185
EQ EPOCH OCCURRED AT 772345520 SECONDS POST UNIX EPOCH
CPlayerItems: count=150 size=54304 packetsize=362 expsize=362
Loading Filter File: /usr/local/share/showeq/filters_ecommons.conf
GROUPSIZE: 0
MY Level: 59
GroupTot: 59
BONUS :100
Your player's id is 1821

[ishap]

SEQ is not getting the key from your windows machine. If it was, you would be getting a line in there that says something like:

Decrypting and dispatching with key: 0xffffffffbe54f4c9

Change the keyring.ini file to use a different port than 10000 and make sure you set SEQ to also look for that port. Also, do a tcpdump from a linux console to see if it is even receiving the the key.

[Joolz]

After spending about an hour getting it working for the first time ever (so this is my first experience). Set the Key Port in SEQ when you first load it. Turn on Session Tracking and then Click on Monitor Next EQ Session. Then Zone (or join the game) and everything is well.

I've had no problems at all....

Great work!

[jgorrell]

That was my problem :) Didn't have the port specified in SEQ. Thanks fellas.

[Tardiss]

I have the Keyring sitting in my taskbar and don't see it adding any new keys when I zone. Is this normal or does it generate a new key each time I zone? From when I load eq to when I close it it has the same key listed.

Where does it send the key to on the linux box? I have it set to send to port 21000 for example but don't know where to point ShowEQ to find the key.

Cheers

[Dedpoet]

Pull down the "Decode" menu in ShowEQ, pick the "port" item and set the value to 21000. Then pick the "File" menu and choose "Save Settings." Then zone.

[Manaweaver]

Well, it appears as though something in testeqgame.exe has changed. I used the -l parameter to check the offset of testeqgame.exe and it couldn't find it. I ran it about 3 times to make sure there were no typos and that I was running it on the right program... any ideas?

[Omiime]

I've been using older version of keyring for while now. worked great thanks baelang..

just tried the new one. Very nice. I like the offset finder builtin.
manually looking for it was anonying. I'm lazy.

[baelang]

Originally posted by Manaweaver
Well, it appears as though something in testeqgame.exe has changed. I used the -l parameter to check the offset of testeqgame.exe and it couldn't find it. I ran it about 3 times to make sure there were no typos and that I was running it on the right program... any ideas?

are you sure you are giving it the full path name? (not just the word testeqgame.exe)

[permafrost]

... I can't seem to read the key from memory.

I downloaded and installed cygwin.
I downloaded and made v2.2 of the keyring code.
I did a "make install" of keyring
I edited the c:\keyring\keyring.ini to include the correct address (0x007acc38 ) as of 13 Jan 03.

I started ShowEQ and told it to monitor the same port I typed in the ini file.
I then started keyring with >keyring -v -f .\keyring.ini
I verified all of the connection info and memory address.

I then kicked off EQ.

In my keyring window I see that it finds a running instance of EQ, but it says that the key it found is 0x0000000000000000.

I check my ShowEQ screen, and sure enough, it says it has received a key of 0x0000000000000000.

Not surprisingly, it fails to decode anything.

I've been at this for two days now and I am starting to pull my hair out. I haven't seen anyone else post they couldn't get the correct key pulled out of memory. Is there something really simple that I am missing? If so, WHAT???

Please help me if you can!!!


Thanks!


permafrost

[baelang]

Originally posted by permafrost
[BIn my keyring window I see that it finds a running instance of EQ, but it says that the key it found is 0x0000000000000000.

I check my ShowEQ screen, and sure enough, it says it has received a key of 0x0000000000000000.

Not surprisingly, it fails to decode anything.
[/B]

did you try zoning? the key will change every time you zone. then you will have to wait the amount of time specified in send interval before you will get a new key to the new zone.

[permafrost]

Yup, I've tried zoning and waiting over 5 minutes for a change. Never get one though. I've tried the Bazaar with a lot of PCs and EC with a lot of NPCs. Either way, the key never changes.

I will try again and let it sit for 1/2 hour while fold some laundry.

Also, while going through your well written and well commented code, I did notice one error. In SendSessionKey, the first printf trys to print out the key, but it actually prints out the addr of the function SendSessionKey!

Thanks for the speedy reply. I'll let it sit and see what happens!


permafrost

[permafrost]

I had started from scratch after I was having these problems, and when I did, I put a typo in the mem addr in the ini file.

Thanks again for the quick response and great program!


permafrost

[baelang]

Originally posted by permafrost
Also, while going through your well written and well commented code, I did notice one error. In SendSessionKey, the first printf trys to print out the key, but it actually prints out the addr of the function SendSessionKey!

Thanks! i'll look into that and fix it in the next release.

[dirfrops]

I'm using Redhat 8.0 with all of the new errata resolved and of course with QT 3.0.5. I've cleaned SEQ off my box and threw out the old libEQ.a file, redownloaded it all, recompiled and started it up. I'm using keyring 2.2 but still no decode. I get no errors on the compile nor on the run. I have even gone so far as to just manually enter the key myself and still nothing...no errors and no decode. Only mobs that pop up are those that I /con and they are stilll unknown. Yes I downloaded the latest CVS and DID NOT repatch it. All I have right now is a GPS which of course is still better than nothing...

It's no longer a case of, "SHOW ME DA MOBS," it's now a principle of beating the cheat so I can stop beating my head against my keyboard (in fact I went ahead and bought The Virtuallly Indestructible Keybooard).

My only last resort (and I can't try it for a week cause I'm out of town) is the sequence that I get everything up and running.

Any help or suggestions would be appreciated.

Thanks,

---D

[datadog]

Hmm sounds like a tough one..

Also sounds like a libEQ.a problem from what info you gave..

You checked the MD5SUM for libEQ.a and compared to the one on the front page of this forum ?

How about some more info.

What are you seeing in the terminal window? Any errors ? Are you getting the 'Decrypting and Dispatching' message ?

[baelang]

So you manually enter the key into SEQ and it still dosen't decode? if so, that would rule out the "sniffer to SEQ" communication as the source of the problem.

[010001010111011]

guys i have downloaded the binary distribution (because i cant figure out how to compile it myself using Cygwin, i tried but i just dont understand *help with this route would be nice as well*) of keyring2.2 onto my Winme machine and followed the installation instructions... INSTALLATION: (binary distribution)

To use this program, what you need to do is:
* create a directory C:\keyring
* unzip this archiive (keyring2.bin.zip) into the directory that you created.
for some versions of unzip it may create the directory for you. in this
case, unzip into the C:\ directory and C:\keyring will be created for you.
* cd C:\keyring
* Read all the README files
* using your favorite editor, edit the keyring.ini file
you will need to change the IP address and the udp port
to which the key will be sent. remember that the default port is
10000 but that is NOT the best choice. Do NOT pick a port under 10000.
* at the dos prompt run keyring.exe
or use the run prompt: start->run->C:\keyring\keyring.exe
or browse the fulesystem and double-click keyring.exe
* start up EQ and enjoy!
* leave this program running and start up EQ. you should be good to go.
* use ctrl-c to end keyring.exe after you have closed down EQ.

.... anyway where it says "use the run prompt: start->run->C:\keyring\keyring.exe
or browse the fulesystem and double-click keyring.exe" ...i do this and all i see is a msdos window flash before my eyes and then its gone so i assume that it is working, but obviously its not since i still have no colored dots on my showeq just a gps

:confused:
anyway why does the msdos window just flash on for just a second ? i cant even read what it is saying, let alone if it is working or not........ :(
btw does Cygwin even have a make or make install command ? it says command not found when i try to use it :(

[Epsilon]

something is wrong if it closes cause its supposed to stay open and you should see everytime it sends the key to seq box, you could open up a dos prompt first (start > run > command.com) and then cd c:\keyring and run keyring.exe and see what it says

someone else prolly know exactly what the fault is..im just trying to help on the way

[traveller888]

Rather that starting it as a dos command start keyring from a dos window you will then see the error message.

I bet you messed up the ini file while editing it and thats your error.

[Epsilon]

traveller is right, think i read about ini file being messed up when using a windows editor, use the dos edit instead when editing ini file

[dirfrops]

You are all talking about opening keyring in a dos window, but ever since I started using keyring, i havent been able to run it in anything but a cygwin window. When I open a dos window and execute the file, it says, cannot find cygwin.dll. Am I suppose to copy the cygwin.dll file somewhere? I think I remember reading about this a long, LONG time ago, when baelang first wrote the program, but I can't remember (heh, short term memory lost, long term memory going)..

Thanks...

PS does it run better, different, or more correctly in a dos window as opposed to a cygwin window? or does it really matter?

Dirf

[Dark]

Copy the dll into the c:\keyring dir all will be well.

[kmaszk]

ok yea I have the same problem as this person too, I double click on keyring.exe and the dos propt just flashes and then goes away. When I open up command prompt first then cd into the directory of keyring It doesn't decode the key. I tried zoneing too, and it doesn't refresh the key or anything, it just says key: 0x000000000000000 1key: 0xffffffffffffffffffff, what is wrong! i have been messing with this for a long time now! and i have winXP, please help!

[baelang]

use the -l option to find the current offest, and put that in your .ini file.

[kmaszk]

jebus!!! that fixed the problem!!! wow! you are great!! the offset I had in there I thought was the newest, but I was being dumb, thanks B!:D

[NovaUSC]

I'll prolly get flamed for this but I'm willing to risk it. I'll go ahead and admit that I'm stupider than ya'll.(as is apparent by the misuse of the english language).

I'm at a loss as to my problem, it is simialr to what has already been posted but I've verified my md5sums for libEQ.a and they are correct. What i'm getting is gps only, no mob decryption. here is what my showeq box says as I run eq and load into the world and then zone.

Using config file '/usr/local/share/showeq/showeq.xml'
Loaded preferences file: /usr/local/share/showeq/seqdef.xml!
Loaded preferences file: /usr/local/share/showeq/showeq.xml!
Listening for first client seen.
Initializing Packet Capture Thread:
Filtering packets on device eth0, searching for EQ client...
Loading filters from '/usr/local/share/showeq/filters.conf'
No Zone Specific filter file '/usr/local/share/showeq/filters_unknown.conf'.
Loading default '/usr/local/share/showeq/filters.conf'.
GuildMgr: WARNING - could not load guildsfile, /usr/local/share/showeq/guilds2.d
at
Categories Reloaded
Error opening map file '/usr/local/share/showeq/unknown.map'!
Opcode Logging Mask: 0 0 0
set_decoder_key: User specified key port: 13325
==> EQInterface::savePrefs()
Finished saving preferences to file: /usr/local/share/showeq/showeq.xml
saveMap()
Error saving map ''!
Listening for next client seen. (you must zone for this to work!)
Filtering packets on device eth0, searching for EQ client...
set_decoder_key: User specified key port: 13325
Decrypting and dispatching with key: 0x0000000000000000
Client Detected: 192.168.1.105
EQPacket: SEQStart detected, pcap filter: EQ Client 192.168.1.105, Client port 1
691, Key port 13325
EQPacket::dispatchZoneData():CharProfileCode:Not Decoded
Loaded map: '/usr/local/share/showeq/Nektulos.map'
No Zone Specific filter file '/usr/local/share/showeq/filters_nektulos.conf'.
Loading default '/usr/local/share/showeq/filters.conf'.
TIME: 13:39 04/16/3173
EQ EPOCH OCCURRED AT 794313360 SECONDS POST UNIX EPOCH
CPlayerItems: count=45 size=21066 packetsize=468 expsize=468
Can't find spawn point file /usr/local/share/showeq/nektulos.sp
No Zone Specific filter file '/usr/local/share/showeq/filters_nektulos.conf'.
Loading default '/usr/local/share/showeq/filters.conf'.
Your player's id is 502
Loaded map: '/usr/local/share/showeq/Lavastorm.map'
Can't find spawn point file /usr/local/share/showeq/lavastorm.sp
Loading, Please Wait... (Zone: 'lavastorm')
No Zone Specific filter file '/usr/local/share/showeq/filters_lavastorm.conf'.
Loading default '/usr/local/share/showeq/filters.conf'.
EQPacket: SEQClosing detected, awaiting next zone session, pcap filter: EQ Clie
nt 192.168.1.105
EQPacket: SEQStart detected, pcap filter: EQ Client 192.168.1.105, Client port 1
699, Key port 13325
EQPacket::dispatchZoneData():CharProfileCode:Not Decoded
Loaded map: '/usr/local/share/showeq/Lavastorm.map'
No Zone Specific filter file '/usr/local/share/showeq/filters_lavastorm.conf'.
Loading default '/usr/local/share/showeq/filters.conf'.
TIME: 13:50 04/16/3173
EQ EPOCH OCCURRED AT 794313359 SECONDS POST UNIX EPOCH
CPlayerItems: count=45 size=21066 packetsize=468 expsize=468
No Zone Specific filter file '/usr/local/share/showeq/filters_lavastorm.conf'.
Loading default '/usr/local/share/showeq/filters.conf'.
Your player's id is 2797




I'm asuming that the key at the beginning is either supposed to change when I zone or is showing that the key is not getting to my eq box. I must admit I'm not certain how to verify that it is getting to the llinux box. I have keyring dending it to the ip which is static.

any help would be most appreciated, any flames will be shrugged off as I said at the beginning I was stupider than ya'll.


any ideas?

[baelang]

run your keysniffer in debug mode and post what that says.

you probably don't have the correct offset. (SessionKeyLocation)

[NovaUSC]

I assume you mean keyring -v for debug
hope this is what you wanted

Maximum verbosity
keyring based on keyring version 2.2.
config file name is: C:/keyring/keyring.ini
UncleBen's function is now running.
attempting to enable debug privledges.
Readconfig is reading: C:/keyring/keyring.ini
using ini file Programname: eqgame
ProgramName is: eqgame
key location is: 0x0078bcb8
Send interval is: 60 seconds
destination IP is: 192.168.1.70:13325
scanning for eqgame

after running everquest
it reads

found eqgame - pid = 924

SendSessionKey function called with key: 420170011to destination IP: 192.168.1.70:13325
Sent the key to 192.168.1.70:13325

[Iam_Walrus]

key location is: 0x0078bcb8 -> you haven't updated the config file to use the new offset 0x007c3448. i think the reason the main page has an old offset is because of the expected rapid changes to eqgame.exe with LoY release. i think i am now required to post something about search, so for posterity:


http://seq.sourceforge.net/images/top_search.gif
(http://seq.sourceforge.net/search.php?s=)

that being said, it's understandable that you've got the wrong one in there with the conflicting info available.

[NovaUSC]

thank you very very much, that was it!

[fm83]

:D

[Manaweaver]

For god's sake... SEQ is broken.

[NovaUSC]

manaweaver,...dude,...look at the post date, this was before it was broken

[Manaweaver]

Well... it got bumped to the top of the list... stupid post edits.