Packet Sniffer and Decrypter : EverQuest 2 Premium Discussions

Credit goes to Acid.
Basicly, it dumps all incoming and outgoing EQ2 packet traffic to a log file and also decrypts them in real time.
NOTE: You HAVE to start udpdump BEFORE EQ2.

Uncompiled Version (May have an updated version: http://www.pptournament.m6.net/eq2/
Compiled Version:
V1.1 Uncompiled: See attachment

If anyone would be kind enough to compile the latest version of udpdump and either email it to me or provide a link so i can upload it to the FTP ASAP.

He hasnt supplied all the components to compile it.

It needs a few extra files. Which no doubt if you donate you get.

Otherwise I can compile it.

Which files are you missing? I'll see what I can do to get my hands on them.

Well i have the compiled version of 1.0 but i want 1.1 as 1.0 didn't work properly for me. (and probably not for you)
I'm contacting Acid now, i'll see if i can't get it off him.

Errr - the site is down. I can compile this if somebody happens to have downloaded the latest version of the source?

I asked him about you guys not able able to compile it and it seems you need to get pcap.h (or something like it) from the winpcap dev pack. He couldn't add it because he wasn't sure if its legal to pass pcap.h around.

I'll see if i can grab the latest version of the source off him.

V1.1 uncompiled uploaded, see 1st post.

Here's the compiled version. I haven't been able to test it yet due to some Windoze issues, but it's the compiled source:

NOTE: This program requires winpcap to be installed to run properly. Find winpcap at http://winpcap.polito.it/install/default.htm

all you need is winpcap and the SDK to compile yourself, I'll write up a nice C# gui for it, infact depending on what I can come up with, a plugin framework for injection.. tault membership verification required ofcorse...

Does the compiled version work at all? My computer is screwed up ATM so I can't test it at all - can't even run EQ2. I'll probably have to completely reinstall windows on a formatted partition - that's hell.

doh

Hmmm - the program works... somewhat. I have found some sort of a bug that I'm not sure how to fix. I keep getting Access Violations *grumbles about Windoze's crappy memory management* from a line in CompressedXOR.cpp (line 111 if any coders out there can decipher why it is). I'll try to track it down and fix it.

I could ask Acid for ya. Though it works perfectly fine for him in windows, you sure you compiled it correctly?

*nods* I have recompiled it several times, and it always gets that same error on the same line. I had to reinstall windows recently, and had to install SP2 since they dont even offer the SP1 download on their site anymore... *grumble* I'll check it out a little more to try to figure it out.
It usually logs a good 200KB before kicking out, and sometimes it lasts even longer. One possibility might be a malformed packet causing that problem... I'm working on some updates for the program that will print out X and Y locs for VeClientCmdMsg::EqCreateGhostCmd events. I'm trying to work out a struct for the data that can be used in the future for a SEQ2 program.