Printable View
I tried to find out what encryption DN is using for the packets but no success.
My Result was:
-The most encrypted Packets in the Town doesn't change, even if you restart your Client
-You can send the encrypted Packets(but you can't edit them)
-Probably it is a Encryption without a SessionID
-It isn't a simple XOR Encryption
If someone has more Infos, feel free to share it here.
encipher:
Code:009096D0 - 51 - push ecx
009096D1 - 8B D0 - mov edx,eax
009096D3 - 53 - push ebx
009096D4 - 8B D8 - mov ebx,eax
009096D6 - C1 EA 03 - shr edx,03
009096D9 - A8 07 - test al,07
009096DB - 89 5C 24 04 - mov [esp+04],ebx
009096DF - 74 03 - je 009096E4
009096E1 - 83 C2 01 - add edx,01
009096E4 - 8B C8 - mov ecx,eax
009096E6 - 83 E1 01 - and ecx,01
009096E9 - 83 C1 01 - add ecx,01
009096EC - 85 D2 - test edx,edx
009096EE - 0F8E C0000000 - jng 009097B4
009096F4 - 25 FF000000 - and eax,000000FF
009096F9 - C1 E0 04 - shl eax,04
009096FC - 69 C9 B979379E - imul ecx,ecx,9E3779B9
00909702 - 55 - push ebp
00909703 - 56 - push esi
00909704 - 8B 74 24 14 - mov esi,[esp+14]
00909708 - 57 - push edi
00909709 - 8D 7C 30 04 - lea edi,[eax+esi+04]
0090970D - 8B 74 24 1C - mov esi,[esp+1C]
00909711 - 89 4C 24 18 - mov [esp+18],ecx
00909715 - 89 54 24 1C - mov [esp+1C],edx
00909719 - 8D A4 24 00000000 - lea esp,[esp+00000000]
00909720 - 33 C0 - xor eax,eax
00909722 - 83 FB 08 - cmp ebx,08
00909725 - 72 63 - jb 0090978A
00909727 - 39 44 24 18 - cmp [esp+18],eax
0090972B - 8B 0E - mov ecx,[esi]
0090972D - 8B 56 04 - mov edx,[esi+04]
00909730 - 74 4A - je 0090977C
00909732 - 8B DA - mov ebx,edx
00909734 - C1 EB 05 - shr ebx,05
00909737 - 8B EA - mov ebp,edx
00909739 - C1 E5 04 - shl ebp,04
0090973C - 33 DD - xor ebx,ebp
0090973E - 03 DA - add ebx,edx
00909740 - 8B E8 - mov ebp,eax
00909742 - 83 E5 03 - and ebp,03
00909745 - 8B 2C AF - mov ebp,[edi+ebp*4]
00909748 - 03 E8 - add ebp,eax
0090974A - 33 DD - xor ebx,ebp
0090974C - 03 CB - add ecx,ebx
0090974E - 8B D9 - mov ebx,ecx
00909750 - C1 EB 05 - shr ebx,05
00909753 - 8B E9 - mov ebp,ecx
00909755 - C1 E5 04 - shl ebp,04
00909758 - 33 DD - xor ebx,ebp
0090975A - 2D 4786C861 - sub eax,61C88647
0090975F - 8B E8 - mov ebp,eax
00909761 - C1 ED 0B - shr ebp,0B
00909764 - 83 E5 03 - and ebp,03
00909767 - 8B 2C AF - mov ebp,[edi+ebp*4]
0090976A - 03 D9 - add ebx,ecx
0090976C - 03 E8 - add ebp,eax
0090976E - 33 DD - xor ebx,ebp
00909770 - 03 D3 - add edx,ebx
00909772 - 3B 44 24 18 - cmp eax,[esp+18]
00909776 - 75 BA - jne 00909732
00909778 - 8B 5C 24 10 - mov ebx,[esp+10]
0090977C - 83 EB 08 - sub ebx,08
0090977F - 89 0E - mov [esi],ecx
00909781 - 89 56 04 - mov [esi+04],edx
00909784 - 89 5C 24 10 - mov [esp+10],ebx
00909788 - EB 19 - jmp 009097A3
0090978A - 85 DB - test ebx,ebx
0090978C - 76 15 - jna 009097A3
0090978E - 8B CF - mov ecx,edi
00909790 - 8B C6 - mov eax,esi
00909792 - 2B CE - sub ecx,esi
00909794 - 8B EB - mov ebp,ebx
00909796 - 8A 14 01 - mov dl,[ecx+eax]
00909799 - 30 10 - xor [eax],dl
0090979B - 83 C0 01 - add eax,01
0090979E - 83 ED 01 - sub ebp,01
009097A1 - 75 F3 - jne 00909796
009097A3 - 83 C6 08 - add esi,08
009097A6 - 83 6C 24 1C 01 - sub dword ptr [esp+1C],01
009097AB - 0F85 6FFFFFFF - jne 00909720
009097B1 - 5F - pop edi
009097B2 - 5E - pop esi
009097B3 - 5D - pop ebp
009097B4 - 5B - pop ebx
009097B5 - 59 - pop ecx
009097B6 - C2 0800 - ret 0008
decipher:
it's XTEA, you can find out the keys yourself.Code:009097C0 - 83 EC 08 - sub esp,08
009097C3 - 8B C8 - mov ecx,eax
009097C5 - 53 - push ebx
009097C6 - 8B D8 - mov ebx,eax
009097C8 - C1 E9 03 - shr ecx,03
009097CB - A8 07 - test al,07
009097CD - 89 5C 24 04 - mov [esp+04],ebx
009097D1 - 74 03 - je 009097D6
009097D3 - 83 C1 01 - add ecx,01
009097D6 - 8B D0 - mov edx,eax
009097D8 - 83 E2 01 - and edx,01
009097DB - 83 C2 01 - add edx,01
009097DE - 85 C9 - test ecx,ecx
009097E0 - 0F8E BC000000 - jng 009098A2
009097E6 - 55 - push ebp
009097E7 - 25 FF000000 - and eax,000000FF
009097EC - 56 - push esi
009097ED - 8B 74 24 18 - mov esi,[esp+18]
009097F1 - C1 E0 04 - shl eax,04
009097F4 - 57 - push edi
009097F5 - 8D 7C 30 04 - lea edi,[eax+esi+04]
009097F9 - 8B 74 24 20 - mov esi,[esp+20]
009097FD - 8B C2 - mov eax,edx
009097FF - 69 C0 B979379E - imul eax,eax,9E3779B9
00909805 - 89 44 24 14 - mov [esp+14],eax
00909809 - 89 4C 24 1C - mov [esp+1C],ecx
0090980D - EB 05 - jmp 00909814
0090980F - 90 - nop
00909810 - 8B 44 24 14 - mov eax,[esp+14]
00909814 - 83 FB 08 - cmp ebx,08
00909817 - 72 5F - jb 00909878
00909819 - 85 C0 - test eax,eax
0090981B - 8B 16 - mov edx,[esi]
0090981D - 8B 4E 04 - mov ecx,[esi+04]
00909820 - 74 48 - je 0090986A
00909822 - 8B DA - mov ebx,edx
00909824 - C1 EB 05 - shr ebx,05
00909827 - 8B EA - mov ebp,edx
00909829 - C1 E5 04 - shl ebp,04
0090982C - 33 DD - xor ebx,ebp
0090982E - 8B E8 - mov ebp,eax
00909830 - C1 ED 0B - shr ebp,0B
00909833 - 83 E5 03 - and ebp,03
00909836 - 8B 2C AF - mov ebp,[edi+ebp*4]
00909839 - 03 E8 - add ebp,eax
0090983B - 03 DA - add ebx,edx
0090983D - 33 DD - xor ebx,ebp
0090983F - 2B CB - sub ecx,ebx
00909841 - 8B D9 - mov ebx,ecx
00909843 - C1 EB 05 - shr ebx,05
00909846 - 8B E9 - mov ebp,ecx
00909848 - C1 E5 04 - shl ebp,04
0090984B - 33 DD - xor ebx,ebp
0090984D - 05 4786C861 - add eax,61C88647
00909852 - 8B E8 - mov ebp,eax
00909854 - 83 E5 03 - and ebp,03
00909857 - 8B 2C AF - mov ebp,[edi+ebp*4]
0090985A - 03 D9 - add ebx,ecx
0090985C - 03 E8 - add ebp,eax
0090985E - 33 DD - xor ebx,ebp
00909860 - 2B D3 - sub edx,ebx
00909862 - 85 C0 - test eax,eax
00909864 - 75 BC - jne 00909822
00909866 - 8B 5C 24 10 - mov ebx,[esp+10]
0090986A - 83 EB 08 - sub ebx,08
0090986D - 89 16 - mov [esi],edx
0090986F - 89 4E 04 - mov [esi+04],ecx
00909872 - 89 5C 24 10 - mov [esp+10],ebx
00909876 - EB 19 - jmp 00909891
00909878 - 85 DB - test ebx,ebx
0090987A - 76 15 - jna 00909891
0090987C - 8B CF - mov ecx,edi
0090987E - 8B C6 - mov eax,esi
00909880 - 2B CE - sub ecx,esi
00909882 - 8B EB - mov ebp,ebx
00909884 - 8A 14 01 - mov dl,[ecx+eax]
00909887 - 30 10 - xor [eax],dl
00909889 - 83 C0 01 - add eax,01
0090988C - 83 ED 01 - sub ebp,01
0090988F - 75 F3 - jne 00909884
00909891 - 83 C6 08 - add esi,08
00909894 - 83 6C 24 1C 01 - sub dword ptr [esp+1C],01
00909899 - 0F85 71FFFFFF - jne 00909810
0090989F - 5F - pop edi
009098A0 - 5E - pop esi
009098A1 - 5D - pop ebp
009098A2 - 5B - pop ebx
009098A3 - 83 C4 08 - add esp,08
009098A6 - C2 0800 - ret 0008
i think every packets in DN are changed when you did something up. Like for example you scanned packets then walked. So much there is need of decryption. >.<