Hexing the Damn Client!

[Monkeyface]

I'm translating the client rollovers and so far I'm doing quite well, the only things that need doing now are the chat modes and fight modes and the initial login text...

I have the exact chinese characters yet they cannot be found in the client when hexed!

Any idea why? Anyone know if they're stored somewhere else?

 

[Shard]

Hmm, this might sound stupid, but are you using AppLocale to open the Hex program to enable it to display Chinese characters? Try searching for ASCII if possible. Or use AppLocale. Report back with news Mr Monkeyface =O

 

[Monkeyface]

Hmm, this might sound stupid, but are you using AppLocale to open the Hex program to enable it to display Chinese characters? Try searching for ASCII if possible. Or use AppLocale. Report back with news Mr Monkeyface =O

I have the actual ASCII lettering, when I managed to copy and paste the characters into a txt editor, the lettering changed from Chinese to ASCII. I've searched the ASCII and actually managed to get the correct Chinese characters but they cannot be found either (when using App Locale)

 

[GIMPY]

I have also been trying to edit the client/server files

The server files are compressed/encrypted with some program not sure what tho.

Eg:
The title of the DBServer is Êý¾Ý¿â·þÎñÆ÷. But if you try and look for that in a hex editor nothing shows up.

It does show up in the config.ini file. but ive change it to something else and DBServer still shows up with Êý¾Ý¿â·þÎñÆ÷

Ive also used applocal and had no success.

Any ideas on what program is been used to encrypt/compress these files.


Thanks
GIMPY

 

[Xander]

Dont change th config titles other wise the servers wont load

 

[GIMPY]

Yep very true Xander

Ive also noticed that if you copy DBServer.exe into a directory of it own an error pops up asking for StackTrace.dll.

If you copy StackTrace.dll and DBServer into the same directory DBServer loads up but it asks for the config.ini file.

The Server files seem to be encrypted/compressed. I tried to load DBServer up with ollydbg and it complains that it may be encrypted/packed.

I let it load into memory and took a dump of it and it seems to expand DBServer upto 12.2 meg insize???

I just need to try and sort the PE header out and see if i can get it to run lol

Thanks
GIMPY

 

[GIMPY]

Ok ive been playing about with these files and it seems that the server files are protected with ASPack.

Yes it is good for compressing files so they are small enough to upload/download but also means you could add a virus/trojan and it would be hard to detect.

Ive tried loads of unpackers but had no luck unpacking these files

The client files dont seem to be packed with any thing yet it is hard to find some of the ingame text.

Any ideas

Thanks
GIMPY

 

[Xander]

I have been told that some text from the game is sent from the server so it needs unpacking

 

[Nightwolf]

Ok ive been playing about with these files and it seems that the server files are protected with ASPack.

Yes it is good for compressing files so they are small enough to upload/download but also means you could add a virus/trojan and it would be hard to detect.

Ive tried loads of unpackers but had no luck unpacking these files

The client files dont seem to be packed with any thing yet it is hard to find some of the ingame text.

Any ideas

Thanks
GIMPY

its a program called asprotect that its protected with
http://www.aspack.com/asprotect.html

and i dont think there is an unprotecter to uncompress it only thing i can think of is you got to do it manually

 

[Xander]

Tim is unpacking it // trying it for us now ill post more info... just means we will need to do it to all exes released later on aswell!

 

[GIMPY]

@NightWolf

Yeah the unpackers i found dont seem to do it. I did try to manually unpack them but no joy

Also the non sqlwoool files are packed with ASPack i managed to unpack M5Server.exe but if u check the file again it says its still packed even tho it has increased insize???. Could just be traces of ASPack left inside the exe file tho

@Xander

Nice one m8 keep us posted plz

Thanks
GIMPY

 

[Xander]

Its not packed with ASProtect... They spoofed it to make it look like it is very clever but not too as it can still be done!

 

[GIMPY]

Nice find Xander


Thanks
GIMPY