-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
xGladius
authored
Mar 1, 2021
1 parent
5b7fd41
commit 79de826
Showing
1 changed file
with
4 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,10 +1,10 @@ | ||
# wiz-packet-map | ||
2/28/2021 Update: Kingsisle (you should hire me) decided to patch this by detecting if AuthenticatedSymmetricCipherBase functions were hooked in the function with the sig of `55 8D AC 24 ? ? ? ? 81 EC ? ? ? ? 6A FE`. As of 2/28/2021 this tool is fully funtional and working. | ||
|
||
Wizard101 tool that dynamically dumps packet data and decrypts packets to and from the server that use aes-gcm encryption | ||
|
||
Wizard101 has very recently (11/18/2020) started encrypting important packets using a symmetric-key cryptographic block cipher operation mode called Galois/Counter Mode (GCM) using an implementation from an open source crypto library written in C++ (https://github.com/weidai11/cryptopp/blob/master/gcm.h) | ||
|
||
IV and nonce are both 16 bytes, this project just completely bypasses the encryption entirely. | ||
|
||
(mainly to be used in the aid of cheating software I guess, since custom implementation using this method is possible but not recommended or viable or good!) | ||
IV and nonce are both 16 bytes. This project hooks a function in Crypto++ called `AuthenticatedSymmetricCipherBase::ProcessData` to retrieve the inString and outString to retrieve the packet buffer before encryption (or after decryption). | ||
|
||
It is also not a token that is generated every few minutes. It is a IV/nonce and a new iv and nonce are generated every time a zone change occurs, and is generated when the initial login packet is sent. | ||
Shoutout to Kingsisle (who is lurking on this repo !!) again, you should hire me! I will write you better security. |