• There is NO official Otland's Discord server and NO official Otland's server list. The Otland's Staff does not manage any Discord server or server list. Moderators or administrator of any Discord server or server lists have NO connection to the Otland's Staff. Do not get scammed!

XTEA Encryption - Solved

telaat

New Member
Joined
Jul 27, 2010
Messages
11
Solutions
1
Reaction score
1
For educational purposes I am trying to understand the encryption and decryption used for communication with Tibia 7.7 RealOts (Leaked official server). I made a lot of progress, but cannot seem to successfully decipher the actual game packets which are encrypted with XTEA.

Anyone who can help me figure this out, I will gladly pay $50 through PayPal or Bitcoin.

Progress so far:

The RSA decryption on connecting with the character list (login server) seems to be working:

008e8a71dd23de750839206c32cf5b00eafac905000d0053656c6c696e6773686974323191a301d7727d3a1735eef6f1b76e9fbb5009e2fbb3b2b36715d9911092400bdacc0a832fd51532f44f896cbcd1b1253c8d0ab500309ad85c0a83f9a46fd8b09f5daf893a5e78077ab08de8b4a40aab0044de50eb38225f6cebaa2b1a

As I understand, the XTEA key can be found directly after 00, which means it is: 8e8a71dd23de750839206c32cf5b00ea. I indeed can find my account number 379386 fac90500 and password "Sellingshit21" 0d0053656c6c696e67736869743231 directly after this.

All of the above can easily be seen using the Wireshark dissector.

After logging in with my character, the problems start, as Wireshark cannot correctly dissect the first package I send to the actual game server.

Raw encrypted data on connecting with game server:

4080e3cbe29c84af7876131967c2bdcea3e9ba2ef2a416c240015149f6931df84d6c6f51928e17722382a7b693fddd92b52b0dc41cfc337c00ab6d25ac8703eb992bd270fd2c58e6d071eea210d6e27fff451d86180570f7814fff6a28110a8b218a626fdfc91a0e8636447afb98a18efa8a984f9e47a7a0278cb92ece65e3d1

However, after decrypting:

00e9da589b8cbb9b60d74ec18fa221f3410200020300fac90500070050616c6164696e0d0053656c6c696e67736869743231d2d5e3a7049db5f7050b549ad3ba412487e813d9232862078a56e39ad0d0d4eab4e39bd76b84aa18a041a5d0b877c7625ac482872fbf659ee6e743437cda9222bac8110dff26ae4d3fa7a6364c68

This is where my confusion starts, as we cannot find our current XTEA key in here, instead a different XTEA key is shown: e9da589b8cbb9b60d74ec18fa221f341.

Part one of this job: are these XTEA keys correct, and if so which should I use for packet decryption?

Equipped with these two XTEA keys I started trying to decrypt packages sent by the client. Based on the two above login packages, I moved my character north three times. Although the Wireshark Tibia plugin should recognize such moves, I believe that either due to the decryption error of the first login package to the game server, or due to differences in protocol, Wireshark cannot correctly dissect the packages.

For your information, find three raw packages are:

a20af2faa525709a
c4d9e06a9ab38d48
4f93f90ed2f64749

As I understand the code in Otclient, Tibianic and Wireshark Tibia plugin, I expect the decrypted versions of these packages to contain one byte moving north (probably 0x65) and the rest to be padding.

However, when I use the following script (nodeJs) to decipher these packages, I cannot find a consistent first byte:

const v = Buffer.from('a20af2faa525709a').toString('hex');
const k = Buffer.from('e9da589b8cbb9b60d74ec18fa221f341').toString('hex')

let pos = 0;

while (pos < v.length / 4) {
let v0 = v[pos], v1 = v[pos + 1];
let delta = 0x61C88647;
let sum = 0xC6EF3720;

for (let i = 0; i < 32; i++) {
v1 -= ((v0 << 4 ^ v0 >> 5) + v0) ^ (sum + k[sum>>11 & 3]);
sum += delta;
v0 -= ((v1 << 4 ^ v1 >> 5) + v1) ^ (sum + k[sum & 3]);
}
v[pos] = v0;
v[pos + 1] = v1;
pos = pos + 2;
}

const result = v;


Part two of this job: help me figure out how the encryption/decryption of these packages works.

Please note that it's fine if you don't know Javascript. If you can give me pointers that help me figure out the problem, I'll also pay the full amount. Please only write solutions here, not to have conflicts with who provided the solution first!
 
Back
Top