Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
xGladius authored Mar 1, 2021
1 parent 5b7fd41 commit 79de826
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
# wiz-packet-map
2/28/2021 Update: Kingsisle (you should hire me) decided to patch this by detecting if AuthenticatedSymmetricCipherBase functions were hooked in the function with the sig of `55 8D AC 24 ? ? ? ? 81 EC ? ? ? ? 6A FE`. As of 2/28/2021 this tool is fully funtional and working.

Wizard101 tool that dynamically dumps packet data and decrypts packets to and from the server that use aes-gcm encryption

Wizard101 has very recently (11/18/2020) started encrypting important packets using a symmetric-key cryptographic block cipher operation mode called Galois/Counter Mode (GCM) using an implementation from an open source crypto library written in C++ (https://github.com/weidai11/cryptopp/blob/master/gcm.h)

IV and nonce are both 16 bytes, this project just completely bypasses the encryption entirely.

(mainly to be used in the aid of cheating software I guess, since custom implementation using this method is possible but not recommended or viable or good!)
IV and nonce are both 16 bytes. This project hooks a function in Crypto++ called `AuthenticatedSymmetricCipherBase::ProcessData` to retrieve the inString and outString to retrieve the packet buffer before encryption (or after decryption).

It is also not a token that is generated every few minutes. It is a IV/nonce and a new iv and nonce are generated every time a zone change occurs, and is generated when the initial login packet is sent.
Shoutout to Kingsisle (who is lurking on this repo !!) again, you should hire me! I will write you better security.

0 comments on commit 79de826

Please sign in to comment.