Lockdown Checkrevisions

[Barabajagal]

ok, now you're confusing me... Are you talking about the new lockdown values and old lockdown values, or the lockdown system and the ver system?

[Hell-Lord]

I think his talking about the new lockdown values.

[Joe[x86]]

Is it just me or do not all of you understand that the MPQs are sent to the client by random, and Blizzard is able to change anything about it at any time?

[Barabajagal]

There are patterns to it, though. For instance, clients that don't use the SID_AUTH_* system have very easily visible patterns. Each server uses the same MPQ and request for about half an hour. Originally, there were about 2000 used values for SID_AUTH_* connections, but that number has risen to an unknown size. Since there are around 15^256+16^256+17^256 possible requests per MPQ per client, the list could be very large indeed. But they DO have some method to their madness. It's not random (yet).

[Smarter]

This all amazes me... the amount of time we put into figuring this all out, is just crazy. But I have a question, probably stupid, but i'm curious, you said BNLS always returns a value for what you send it (duh), but by sending it a value, and checking it's response, with enough before and after values, couldn't you caluclate the method used to generate the values? Thus finding out BNLS's method? Also, I believe we need to start a big DOC site, like BNETDocs, and call it CRevDocs And put all confirmed and unconfirmed information in a clean easy to read setup, so our minds may all converse together.

[Barabajagal]

I've tried looking for a pattern. I don't see one.

[Joe[x86]]

lol, if you want to know the method BNLS uses, just ask Skywing. He's not going to take kindly to you bruteforcing his server to find out how it works.

[Barabajagal]

I'm not bruteforcing his server. I just made a program that requests any values you give it. Ended up with a rather large list of values that don't really exist... 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01... etc...

[Ringo]

several weeks ago i found that there are only about 2000 different checksum formulas sent by the server. for some reason, they decided not to make it fully random.

about a week after i found that out, they increased it to about 50k-100k different checksum formulas sent by the server. it is still limited.

If they coulda done this in the first place, could someone whos got a good idea of the lockdown mpqs explain why they originally only stayed with 2000 checksum formulas?

and wouldn't it be more efficient if they made it took advantage of all values possible? (10^20-50s)

what do you think is limiting blizzard's checksum formulas?

Well, the lists were 1000 per client but they upped SC/BW lists to the same size as W3ROC and W3TFT (20k per client)

WAR3 -> 20000
W3XP -> 20000
D2DV -> 1000
D2XP -> 1000
STAR -> 20000
SEXP -> 20000
JSTR -> 1000
SSHR -> 1000
W2BN-> 1000
DSHR -> 1000
DRTL -> 1000

Inorder to make it random, Blizzard would have to do alot of modifications to battle.net.
At the end of the day, its inplace for checking a clients version, little if anything else
Hope that helps.

[warz]

It'd be quicker to just implement your own version of checkrevision. It'd also work 100% of the time.

[brew]

This all amazes me... the amount of time we put into figuring this all out, is just crazy. But I have a question, probably stupid, but i'm curious, you said BNLS always returns a value for what you send it (duh), but by sending it a value, and checking it's response, with enough before and after values, couldn't you caluclate the method used to generate the values? Thus finding out BNLS's method? Also, I believe we need to start a big DOC site, like BNETDocs, and call it CRevDocs And put all confirmed and unconfirmed information in a clean easy to read setup, so our minds may all converse together.

Don't people understand why you shouldn't brute force? Also, since the checksum is acually a message digest it's very doubtful you will find a pattern. See here for example, how one message can vary a great deal by even a single byte being changed.
@Ripple, Sorry for confusing you. I was talking about the new checkrevision formulas. And haha, Joe you gotta understand having the blizzard servers calculating thousands of checkrevision hashes per minute (they would have to create the checksum formula and compare the checksum on the fly) would be processor intensive. And while handling all other BNCS packets, at the same time.

[Ante]

several weeks ago i found that there are only about 2000 different checksum formulas sent by the server. for some reason, they decided not to make it fully random.

about a week after i found that out, they increased it to about 50k-100k different checksum formulas sent by the server. it is still limited.

If they coulda done this in the first place, could someone whos got a good idea of the lockdown mpqs explain why they originally only stayed with 2000 checksum formulas?

and wouldn't it be more efficient if they made it took advantage of all values possible? (10^20-50s)

what do you think is limiting blizzard's checksum formulas?

Well, the lists were 1000 per client but they upped SC/BW lists to the same size as W3ROC and W3TFT (20k per client)

WAR3 -> 20000
W3XP -> 20000
D2DV -> 1000
D2XP -> 1000
STAR -> 20000
SEXP -> 20000
JSTR -> 1000
SSHR -> 1000
W2BN-> 1000
DSHR -> 1000
DRTL -> 1000

Inorder to make it random, Blizzard would have to do alot of modifications to battle.net.
At the end of the day, its inplace for checking a clients version, little if anything else
Hope that helps.

why do y ou think bnet didn't make it totally randomly generated when they implemented the lockdown checkrevision? why do you think they limited the values to 1000 or 20000?

hdx is right. the algorithm used by checkrevision skips through the main game files as loaded into the address space, adding segments of data to the SHA1 information. this is a hefty process to do every time a user logs into battlenet. i think ive already told you this - caching this information is nothing new. battlenet has been doing this for a while. you're not onto something, you're just running in circles. but, from a client perspective, it's fine to run through the selective memory hashing routines once every connection, since it's only being performed once.

what does this have to do with caching information?

[brew]

why do y ou think bnet didn't make it totally randomly generated when they implemented the lockdown checkrevision? why do you think they limited the values to 1000 or 20000?

Because, like warz said. It's processor intensive and basically a waste of time :/ It's easier to make a hash table, which has everything in the world to do with catching information, and compare the expected checksum to the client's result.

[warz]

why do y ou think bnet didn't make it totally randomly generated when they implemented the lockdown checkrevision? why do you think they limited the values to 1000 or 20000?


what does this have to do with caching information?

come on man, put two and two together.