• Welcome to Valhalla Legends Archive.
 

Lost...help!

Started by After-Death, February 01, 2004, 12:46 PM

Previous topic - Next topic

After-Death

Yeah so I'm confused/lost.

I've been sniffing packets with ethereal trying to work out which packets are sent by diablo2 when you connect to battle.net

However.

None of the packets sent seem to match anything in bnetdocs, and bnetdocs doesn't seem to be very clear about what the process is.

Can someone point me in the right direction please :D

UserLoser.

#1
Format of packets:

(BYTE) 0xFF
(BYTE) Packet ID
(WORD) Packet length
(VOID) Packet data

Example packet you might see in Ethereal debug window or whatever:
   

0x0000   02 03 47 EA 57 AC 00 06-25 83 C3 ED 08 00 45 00   ..GêW¬..%ƒÃí..E.
0x0010   00 53 19 DF 00 00 75 06-D6 AA 3F F1 53 0D C0 A8   .S.ß..u.Öª?ñS.À¨
0x0020   01 75 17 E0 0F 04 A4 F7-EA 5B 0C 89 95 5D 50 18   .u.à..¤÷ê[.‰•]P.
0x0030   FF 35 B1 B5 00 00 FF 0F-2B 00 05 00 00 00 00 00   ÿ5±µ..ÿ.+.......
0x0040   00 00 4E 00 00 00 00 00-00 00 0D F0 AD BA 0D F0   ..N........ð­º.ð
0x0050   AD BA 4D 4F 55 53 45 43-4F 52 44 00 72 69 6F 74   ­ºMOUSECORD.riot
0x0060   00                                                .


Ethereal includes other data (mac address/ip/dunno?) infront of all packets

The actual Battle.net packet starts at the 55th byte, which is FF, the Battle.net Chat Server packet header. The next byte, 0F is the packet id, the next WORD (2 bytes), is 2B 00; which is the packet length which equals 43... after that is the packet data.

If you wanted to figure out and parse that (0x0F, chat event) packet, you should take a look at this document.

After-Death

#2
EDIT: I altered a couple of settings in Ethereal and it has cleared up the problem, I was looking at some extra rubbish that is sent without any data actually sent!

Thanks.


After-Death

Next question then.

I can't read C++ or code java to a great standard, so writing the hashing SHA-1 thing in java is gonna be the single biggest problem for me. Has anyone already written a class in java to handle this, and released it publically?

UserLoser.

Quote from: After-Death on February 01, 2004, 01:24 PM
Next question then.

I can't read C++ or code java to a great standard, so writing the hashing SHA-1 thing in java is gonna be the single biggest problem for me. Has anyone already written a class in java to handle this, and released it publically?

I'm sure somebody has written it in Java (maybe ask iago), but sharing it; I don't know..  As far as hashing, you could use Skywing's and Yoni's BNLS server to do it all for you!  You can find documentation on it here.

After-Death

I was hoping to do it all myself, but I guess BNLS is gonna be the easiest way. Seems simple enough.

Banana fanna fo fanna

In ethereal, "follow tcp stream" would help a lot.

iago

Quote from: UserLoser. on February 01, 2004, 01:43 PM
Quote from: After-Death on February 01, 2004, 01:24 PM
Next question then.

I can't read C++ or code java to a great standard, so writing the hashing SHA-1 thing in java is gonna be the single biggest problem for me. Has anyone already written a class in java to handle this, and released it publically?

I'm sure somebody has written it in Java (maybe ask iago), but sharing it; I don't know..  As far as hashing, you could use Skywing's and Yoni's BNLS server to do it all for you!  You can find documentation on it here.

If it's any consolation, that's at the top of my to-do stack.  But I haven't been popping much off there lately :/
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


Adron

Quote from: iago on February 03, 2004, 03:44 PM
If it's any consolation, that's at the top of my to-do stack.  But I haven't been popping much off there lately :/

If you find that you are unable to pop enough things off your to-do stack, make a more detailed to-do stack and you may be able to pop more off it. Don't get too detailed though, "Put on left shoe", "Put on right shoe" might be overdoing it.

iago

Quote from: Adron on February 04, 2004, 03:38 AM
Quote from: iago on February 03, 2004, 03:44 PM
If it's any consolation, that's at the top of my to-do stack.  But I haven't been popping much off there lately :/

If you find that you are unable to pop enough things off your to-do stack, make a more detailed to-do stack and you may be able to pop more off it. Don't get too detailed though, "Put on left shoe", "Put on right shoe" might be overdoing it.

You're forgetting to include the foot.  *reverses shoes*

I have a secondary to-do stack at work.  It lives inside a wooden duck I found in my office.  Actually, it's not so much of a stack as my personal one since it's more randomly-accessed, and I've actually crossed out 90% of the things listed (the other 10% are hard, but I might start on one of the hard ones today).

Anyway, that's not a bad idea.  I should actually write down everything I want to do in reasonable detail, and cross them off as I do them.  I might start doing that! :)
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*