C++ How to peek at server/client messages

[Erexo]

I'm learning about how exactly client/server works and I've figured out that server is sending a message that's starting by a "type" byte, for example if message received by client start's with 0xAC it will be a channel message etc. I understand that, but I dont understand how TFS devs figured out which byte execute particular function. They were just wandering around real tibia with packet sniffer or is there a way to get those commands from client ?

 

[Raggaer]

GitHub - comedinha/Flash-News: Check Tibia Flash Changes

Here you can see all the packets the client gets and sends

 

[Erexo]

GitHub - comedinha/Flash-News: Check Tibia Flash Changes

Here you can see all the packets the client gets and sends

Thank you, this is helpful.
But it's from latest flash client, I'm using an old 8.54 client version and there were tons of changes. Thats why I need to know how to retreive client communication system from certain client.

@Arkam I totally understand how it works, I'm just looking for a way to retreive those headers and arguments that follows the header.

I know they are stored in procolgame.cpp, but somehow the TFS devs had to retrieve those values from oryginal cipsoft client.
And that's what I'm asking for from the very beggining, how to retrieve client network commands from cipsoft client.

Anyone could help me with my question ?

 

[WibbenZ]

In the past you could use ex this; GitHub - jo3bingham/sharpmaptracker: SharpMapTracker read and parse Tibia packets to extract map information, and it saves the extracted map as a OpenTibia map (OTBM). Based on: https://code.google.com/p/sharpmaptracker/ to see what the protocol is, but with the latest version it's alot easier to just decompile the latest flash files and comparing them.
There are alot of programs and info about this if you do a serach, maybe even better programs then the map tracker, but what do you wanna do with it when it comes to an 8.54 server?

 

[Erexo]

In the past you could use ex this; GitHub - jo3bingham/sharpmaptracker: SharpMapTracker read and parse Tibia packets to extract map information, and it saves the extracted map as a OpenTibia map (OTBM). Based on: https://code.google.com/p/sharpmaptracker/ to see what the protocol is, but with the latest version it's alot easier to just decompile the latest flash files and comparing them.
There are alot of programs and info about this if you do a serach, maybe even better programs then the map tracker, but what do you wanna do with it when it comes to an 8.54 server?

Nothing much really, I just wanted to learn reverse engineering and I thought this will be a good example to start with. In 8.54 there is method to add marker on minimap, but there isn't any to remove it and I remember that there was an OT that had ability to automatically remove map marker. So I would like to dig into cipsoft 8.54 client to look if there is a network message for that (I guess there isnt if tfs devs didnt include that by themselves but as I said, I just want to learn HOW instead of do any particular job).
Thanks for the sharpmaptracker link, I'll scan it and look for any useful informations. (My next todo task that I want to do is to create .otb map from client .map files).

 

[WibbenZ]

You can start with checking the source code on TFS, this is the send function; forgottenserver/protocolgame.cpp at master · otland/forgottenserver · GitHub
There might be a way to remove all of them, best would be to do as @Raggaer said and check the source files, I highly doubt they changed the headers or anything related to it.

 

[jo3bingham]

While decompiling the flash client is nice, and convenient, CipSoft is planning on dropping support for it once Tibia 11 is ready. Not only will you no longer have access to the network protocol this way, but, like in OP's instance, you can't use this method for pre-flash-client clients anyway. And, like with the recent addition of inspection and VIP groups, the flash client didn't include the structure for those packets because they were Tibia 11-only.

The two best ways, in my opinion, to reverse-engineer the network protocol are either to open the client in a debugger (e.g., ollydbg or x64dbg) and reverse-engineer that way, or to create a proxy, catch the packets, and figure the structure out through looking at the bytes (which is what I did here: [Tibia 11][Protocol 11.10] Inspect and VIP Groups). However, when CipSoft deploys BattlEye integration, using a proxy (like the one in SharpMapTracker) should, theoretically, not be possible as it currently works. Which means that using a debugger will be what needs to be used (assuming BattlEye doesn't interfere with it).

 

[Erexo]

Thanks for your response. Like @Jo3Bingha said, there are significant changes between current and 8.54 clients so decompiled flash client is pretty much useless for me (for ex: in 8.54 there is packet for create minimap marker, but in flash client you sent there is function "editMarkWidget" which adds but also removes markers).
I know I'm asking for much, but could you post some useful tutorials about ollydbg so I could figure it out by myself. Using reverse engineering on the client am I able to find out about function structure without debugging it (send packets to from server to this client)? Also what exactly is that proxy method?

 

[pyschod]

Thanks for your response. Like @Jo3Bingha said, there are significant changes between current and 8.54 clients so decompiled flash client is pretty much useless for me (for ex: in 8.54 there is packet for create minimap marker, but in flash client you sent there is function "editMarkWidget" which adds but also removes markers).
I know I'm asking for much, but could you post some useful tutorials about ollydbg so I could figure it out by myself. Using reverse engineering on the client am I able to find out about function structure without debugging it (send packets to from server to this client)? Also what exactly is that proxy method?

Sorry for bump.
Have you managed to find out how to reverse engineer it?
I'm in the same position, I want to figure out the new bytes the client expects from server but no success.

 

[Erexo]

I've digged that topic to the source, and person who was working on this originally said that they just ran sniffer like wireshark and tested what is client sending/receiving durning certain actions. Later on cip introduced flash client so it was easy to look at the code in flash, but since flash client is gone you need to go back to the original method.

 

[pyschod]

I m gonna learn a bit of Wireshark and try to approach this way. Thanks.

 

[jo3bingham]

I m gonna learn a bit of Wireshark and try to approach this way. Thanks.

Just remember that the packets are XTEA encrypted; you would need to know the XTEA key to decrypt them.