[solved] Need help with those Realm packets...

[z-stars]

Ok, I'm making a C++ D2 LOD bot and I'm trying to connect to a realm... I'm using BNLS.

I have sent 0x29 packet to battle.net, and received its response, and now I'm with the realm packets...

First, I'm sending SID_QUERYREALMS (0x34)

Packet ID:     0x34
Direction:    Client -> Server (Sent)
Format:
Help    

(DWORD)       Unused (0)
(DWORD)       Unused (0)
(STRING)     Unknown (empty)

Then, I am receiving it's response

Packet ID:     0x34
Direction:    Server -> Client (Received)
Format:
Help    

(DWORD)       Unknown
(DWORD)       Count

For Each Realm
(DWORD)       Unknown[7]
(STRING)     Realm title
(STRING)     Realm description

Remarks:    Realm list.

After that,  I'm supossed to send SID_LOGONREALMEX, but I'm having problems with it... I'm sending 0xffffffff as cookie and the "Realm Title" from last packet as "Realm title", but I don't know how to get a right hashed realm password... I have tried using the same function I used to hash account password (Using BNLS) but it doesn't work... (The response is less than 12 bytes). The function I mentioned above uses SID_AUTHINFO server token as server token, and GetTickCount() as ClientToken...
What can I do for it to work?
Thx in advance.

Packet ID:     0x3E
Direction:    Client -> Server (Sent)
Format:
Help    

(DWORD)       Cookie
(DWORD[5])    Hashed realm password
(STRING)     Realm title

Remarks:    Realm password is always 'password'

[shadypalm88]

First, I'm sending SID_QUERYREALMS (0x34)

Starting with Diablo II 1.10, you need to use SID_QUERYREALMS2 (0x40). 

After that,  I'm supossed to send SID_LOGONREALMEX, but I'm having problems with it... I'm sending 0xffffffff as cookie and the "Realm Title" from last packet as "Realm title", but I don't know how to get a right hashed realm password...

There is some VB code in the comments on BnetDocs' C->S SID_LOGONREALMEX page that shows this.  Basically, you just hash the realm password ("password") like you would any old logon system password, using the cookie you send with the packet as the client token.

[z-stars]

First, I'm sending SID_QUERYREALMS (0x34)

Starting with Diablo II 1.10, you need to use SID_QUERYREALMS2 (0x40). 

After that,  I'm supossed to send SID_LOGONREALMEX, but I'm having problems with it... I'm sending 0xffffffff as cookie and the "Realm Title" from last packet as "Realm title", but I don't know how to get a right hashed realm password...

There is some VB code in the comments on BnetDocs' C->S SID_LOGONREALMEX page that shows this.  Basically, you just hash the realm password ("password") like you would any old logon system password, using the cookie you send with the packet as the client token.

cool using 0xffffffff (the cookie I send) instead GetTickCount() as ClientToken worked, lots of thx