Packet Sniffer and Decrypter : EverQuest 2 Premium Discussions

Home » Forums » EverQuest 2 » EverQuest 2 Premium Discussions

Page 1 of 2

[ 22 posts ]

1, 2 Next

Packet Sniffer and Decrypter : EverQuest 2 Premium Discussions

Posted: February 3rd, 2005, 7:01 am

Tault_nazeroth

Total Posts: 1390
Joined: November 17th, 2004, 5:16 pm Tault_nazeroth's Reps: 1

Credit goes to Acid.
Basicly, it dumps all incoming and outgoing EQ2 packet traffic to a log file and also decrypts them in real time.
NOTE: You HAVE to start udpdump BEFORE EQ2.

Uncompiled Version (May have an updated version: http://www.pptournament.m6.net/eq2/
Compiled Version:
V1.1 Uncompiled: See attachment

If anyone would be kind enough to compile the latest version of udpdump and either email it to me or provide a link so i can upload it to the FTP ASAP.

Last edited by Tault_nazeroth on February 10th, 2005, 1:55 pm, edited 1 time in total.

Posted: February 3rd, 2005, 8:48 am

tault_pickled
tault_pickled's Reps:

He hasnt supplied all the components to compile it.

It needs a few extra files. Which no doubt if you donate you get.

Posted: February 3rd, 2005, 8:49 am

tault_pickled
tault_pickled's Reps:

Otherwise I can compile it.

Posted: February 3rd, 2005, 10:56 am

tault_akanon
tault_akanon's Reps:

Which files are you missing? I'll see what I can do to get my hands on them.

Posted: February 3rd, 2005, 12:06 pm

Tault_nazeroth

Total Posts: 1390
Joined: November 17th, 2004, 5:16 pm Tault_nazeroth's Reps: 1

Well i have the compiled version of 1.0 but i want 1.1 as 1.0 didn't work properly for me. (and probably not for you)
I'm contacting Acid now, i'll see if i can't get it off him.

Posted: February 10th, 2005, 12:39 pm

tault_akanon
tault_akanon's Reps:

Errr - the site is down. I can compile this if somebody happens to have downloaded the latest version of the source?

Posted: February 10th, 2005, 12:47 pm

Tault_nazeroth

Total Posts: 1390
Joined: November 17th, 2004, 5:16 pm Tault_nazeroth's Reps: 1

I asked him about you guys not able able to compile it and it seems you need to get pcap.h (or something like it) from the winpcap dev pack. He couldn't add it because he wasn't sure if its legal to pass pcap.h around.

I'll see if i can grab the latest version of the source off him.

Posted: February 10th, 2005, 1:57 pm

Tault_nazeroth

Total Posts: 1390
Joined: November 17th, 2004, 5:16 pm Tault_nazeroth's Reps: 1

V1.1 uncompiled uploaded, see 1st post.

Posted: February 10th, 2005, 3:46 pm

tault_akanon
tault_akanon's Reps:

Here's the compiled version. I haven't been able to test it yet due to some Windoze issues, but it's the compiled source:

NOTE: This program requires winpcap to be installed to run properly. Find winpcap at http://winpcap.polito.it/install/default.htm

Posted: February 11th, 2005, 1:10 am

tault_sirusdv
tault_sirusdv's Reps:

all you need is winpcap and the SDK to compile yourself, I'll write up a nice C# gui for it, infact depending on what I can come up with, a plugin framework for injection.. tault membership verification required ofcorse...

Posted: February 11th, 2005, 7:12 am

tault_akanon
tault_akanon's Reps:

Does the compiled version work at all? My computer is screwed up ATM so I can't test it at all - can't even run EQ2. I'll probably have to completely reinstall windows on a formatted partition - that's hell.

Posted: February 11th, 2005, 7:18 am

tault_glenny1

Total Posts: 152
Location: USA
Joined: December 31st, 2003, 12:53 pm tault_glenny1's Reps: 0

doh

Posted: February 12th, 2005, 3:20 pm

tault_akanon
tault_akanon's Reps:

Hmmm - the program works... somewhat. I have found some sort of a bug that I'm not sure how to fix. I keep getting Access Violations *grumbles about Windoze's crappy memory management* from a line in CompressedXOR.cpp (line 111 if any coders out there can decipher why it is). I'll try to track it down and fix it.

Posted: February 12th, 2005, 5:41 pm

Tault_nazeroth

Total Posts: 1390
Joined: November 17th, 2004, 5:16 pm Tault_nazeroth's Reps: 1

I could ask Acid for ya. Though it works perfectly fine for him in windows, you sure you compiled it correctly?

Posted: February 12th, 2005, 6:06 pm

tault_akanon
tault_akanon's Reps:

*nods* I have recompiled it several times, and it always gets that same error on the same line. I had to reinstall windows recently, and had to install SP2 since they dont even offer the SP1 download on their site anymore... *grumble* I'll check it out a little more to try to figure it out.
It usually logs a good 200KB before kicking out, and sometimes it lasts even longer. One possibility might be a malformed packet causing that problem... I'm working on some updates for the program that will print out X and Y locs for VeClientCmdMsg::EqCreateGhostCmd events. I'm trying to work out a struct for the data that can be used in the future for a SEQ2 program.