Okay, I give up...

[forty-two]

::dons a flame-proof suit::

My spawns aren't decoding. I searched around a bit, but you may understand the problem is a tad common, yet my particular iteration of it doesn't seem to be posted anywhere. So if it's been posted before, error on my part, if not, I could gladly use a hand in this.

I'm using Debian 3.2, with the 2.4.19 kernel... Running SEQ 4.3.4 with the 4.3.5 patch, latest libEQ.a and using Keyring 2.2 with offset 0x007ba178.

SEQ seems to get the key, but even then doesn't want to decode. Here's the output it gives...


Using config file '/usr/local/share/showeq/showeq.xml'
Loaded preferences file: /usr/local/share/showeq/seqdef.xml!
Loaded preferences file: /usr/local/share/showeq/showeq.xml!
Xlib: extension "RENDER" missing on display "xserver:0.0".
Listening for first client seen.
Initializing Packet Capture Thread:
Filtering packets on device eth0, searching for EQ client...
Loading filters from '/usr/local/share/showeq/filters.conf'
No Zone Specific filter file '/usr/local/share/showeq/filters_unknown.conf'.
Loading default '/usr/local/share/showeq/filters.conf'.
GuildMgr: guildsfile loaded
Categories Reloaded
Error opening map file '/usr/local/share/showeq/unknown.map'!
Opcode Logging Mask: 0 0 0
Decrypting and dispatching with key: 0x007ba17800000000
Client Detected: 192.168.0.1
EQPacket: SEQStart detected, pcap filter: EQ Client 192.168.0.1, Client port 2858, Key port 10000
EQPacket::dispatchZoneData():CharProfileCode:Not Decoded
Loaded map: '/usr/local/share/showeq/Steamfont.map'
No Zone Specific filter file '/usr/local/share/showeq/filters_steamfont.conf'.
Loading default '/usr/local/share/showeq/filters.conf'.
Decrypting and dispatching with key: 0x007ba17815a5407a
Warning: Failed to decrypt queued Player Profile packet: 0.
WARNING: TimeOfDayCode (f240) (dataLen:10 != sizeof(timeOfDayStruct):8)!
TIME: 01:02 05/25/3172
EQ EPOCH OCCURRED AT 792503690 SECONDS POST UNIX EPOCH
CPlayerItems: count=7 size=3282 packetsize=468 expsize=468
WARNING: PlayerBookCode (6541) (dataLen:468 != sizeof(playerBookStruct:280 or 456
Loaded spawn points: /usr/local/share/showeq/steamfont.sp
No Zone Specific filter file '/usr/local/share/showeq/filters_steamfont.conf'.
Loading default '/usr/local/share/showeq/filters.conf'.

Italicized what seemed out of the ordinary to me... Not quite sure what's wrong here. :x

[Mr. Suspicious]

SEQ seems to get the key

No it doesn't.... look at your own listing:



Opcode Logging Mask: 0 0 0
Decrypting and dispatching with key: 0x007ba17800000000
Client Detected: 192.168.0.1
EQPacket: SEQStart detected, pcap filter: EQ Client 192.168.0.1, Client port 2858, Key port 10000
EQPacket::dispatchZoneData():CharProfileCode:Not Decoded
Loaded map: '/usr/local/share/showeq/Steamfont.map'
No Zone Specific filter file '/usr/local/share/showeq/filters_steamfont.conf'.


How high do you think the chances are that the decryption key has the EXACT value of the memorry adress that stores that key?

[casey]

and to answer the inevitable next question, that number you gave showeq as the key, is really the memory location within EverQuests virtuall address space where the 64 bit key is located.

Make your next stop the keysniffer forum to learn how to get the key out of memory and to showeq.

[forty-two]

But that's just the first key it gets as soon as I start EQ and not even logged in... I run it in loop mode, so of course that first key'll be empty. I have to check one last thing, though, then I'll get back to you...

I may not know the inner workings of SEQ, but that doesn't make me a Linux n00b either:o

[permafrost]

If you look at the key your SEQ box is receiving, it has the memory address of the key in the high bytes.

You are still not passing the correct information....
Check your code and then the Key Sniffer message board.



permafrost

[forty-two]

Still can't figure it out after reinstalling, changing port a few times (Yeah, I was using 10000 before... doesn't work with 10010 or 34567 either though). Still gets the key with offest in it. I'll try a different sniffer...

[forty-two]

I got it to work with Maggotboy's DLL... Must've been something with keyring

Good to see color on that map again :)