More information

This commit is contained in:
Bottersnike 2021-12-21 01:19:43 +00:00
parent 2c19752f70
commit 4827a1eb07
7 changed files with 1441 additions and 6 deletions

BIN
images/200_only.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 3.7 KiB

BIN
images/lz77.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 16 KiB

View File

@ -16,6 +16,7 @@
<td><a href=".">Contents</a></td> <td><a href=".">Contents</a></td>
<td><a href="./transport.html">Transport layer</a></td> <td><a href="./transport.html">Transport layer</a></td>
<td><a href="./packet.html">Packet format</a></td> <td><a href="./packet.html">Packet format</a></td>
<td><a href="./protocol.html">Application Protocol</a></td>
</tr> </tr>
</table> </table>
@ -36,7 +37,7 @@
<p>If you're here because you work on one of those aforementioned closed source projects, hello! Feel free to share <p>If you're here because you work on one of those aforementioned closed source projects, hello! Feel free to share
knowledge with the rest of the world, or point out corrections. Or don't; you do you.</p> knowledge with the rest of the world, or point out corrections. Or don't; you do you.</p>
<h1>Contents</h1> <h2>Contents</h2>
<ol> <ol>
<li><a href="./transport.html">Transport layer</a></li> <li><a href="./transport.html">Transport layer</a></li>
<ol> <ol>
@ -52,7 +53,29 @@
</ol> </ol>
</ol> </ol>
<p><small>This site intentionally looks not-great. I don't feel like changing that, and honestly quite like the aesthetic.</small></p> <h2>Getting started</h2>
<p>My aim with these pages is to cover as much as possible, so you don't need to try and figure them out yourself.
That said, being able to follow along yourself will almost certainly help get more out of this. For following
along with source code, you're really going to want to grab yourself a dumped copy of a game (it's going to be a
lot easier, and cheeper, than dumping one yourself). I trust you can figure out where to find that.</p>
<p>For network related things, your options are a little broader. The ideal would be physical ownership of a
cabinet, and a subscription to genuine e-amusement. Odds are you don't have both of those :P. A connection to an
alternative network works just as well. In the more likely case that you don't have a physical cabinet, it's
time to crack out that dumped copy of a game and just run it on your own PC (or a VM, if you're not on Windows)
(odds are whatever you downloaded came with the program you'll need to start it pre-packaged. If not, it rhymes
with rice.).</p>
<p>You will also need a local e-amusement-emulating server. By the time I'm done with these pages, there will
hopefully be everything you need to be able to write your own. Unfortunately I'm not finished writing them;
depending on where you acquired your game, it may have shipped with one of said servers. If it didn't, Asphyxia
CORE will do the trick (yes, it's closed source).</p>
<p>If this all sounds like way too much work, and/or you're just here because of curiosity, I plan to prepare some
pcaps of network traffic to play around with without needing a running copy of a game or a network tap on a cab.
</p>
<a href="./transport.html">Next page</a>
<p><small>This site intentionally looks not-great. I don't feel like changing that, and honestly quite like the
aesthetic.</small></p>
</body> </body>
</html> </html>

View File

@ -17,6 +17,7 @@
<td><a href=".">Contents</a></td> <td><a href=".">Contents</a></td>
<td><a href="./transport.html">Transport layer</a></td> <td><a href="./transport.html">Transport layer</a></td>
<td><a href="./packet.html">Packet format</a></td> <td><a href="./packet.html">Packet format</a></td>
<td><a href="./protocol.html">Application Protocol</a></td>
</tr> </tr>
</table> </table>
@ -888,6 +889,8 @@
self.request_allocation(4)</code></pre></p> self.request_allocation(4)</code></pre></p>
</details> </details>
<a href="./transport.html">Prev page</a> | <a href="./protocol.html">Next page</a>
</body> </body>
</html> </html>

1392
protocol.html Normal file

File diff suppressed because it is too large Load Diff

View File

@ -1,9 +1,10 @@
body { body {
/* font-family: sans-serif; */ /* font-family: sans-serif; */
line-height: 1.25; line-height: 1.25;
max-width: 720px; max-width: 1000px;
margin: 16px auto; margin: 16px auto;
color: #222; color: #222;
padding: 0 16px;
} }
table { table {
@ -37,7 +38,6 @@ p {
} }
code { code {
display: inline-block;
letter-spacing: .02em; letter-spacing: .02em;
padding: 2px 4px; padding: 2px 4px;
font-size: 90%; font-size: 90%;
@ -46,7 +46,11 @@ code {
border-radius: 4px; border-radius: 4px;
word-break: break-word; word-break: break-word;
} }
code > a {
color: inherit;
}
pre > code { pre > code {
display: block;
word-break: normal; word-break: normal;
border-radius: 4px; border-radius: 4px;
background: #f8f8f8; background: #f8f8f8;
@ -55,10 +59,12 @@ pre > code {
color: #333; color: #333;
padding: 9.5px; padding: 9.5px;
line-height: 1.4; line-height: 1.4;
width: min-content;
}
pre {
max-width: 100%; max-width: 100%;
overflow-x: auto; overflow-x: auto;
display: block; display: block;
width: min-content;
} }
summary { summary {

View File

@ -14,6 +14,7 @@
<td><a href=".">Contents</a></td> <td><a href=".">Contents</a></td>
<td><a href="./transport.html">Transport layer</a></td> <td><a href="./transport.html">Transport layer</a></td>
<td><a href="./packet.html">Packet format</a></td> <td><a href="./packet.html">Packet format</a></td>
<td><a href="./protocol.html">Application Protocol</a></td>
</tr> </tr>
</table> </table>
@ -25,13 +26,21 @@
<li><code>none</code></li> <li><code>none</code></li>
<li><code>lz77</code></li> <li><code>lz77</code></li>
</ul> </ul>
<details>
<summary>Source code details</summary>
<figure>
<img src="./images/lz77.png">
<figcaption><code>libavs-win32-ea3.dll:0x1000fa29</code></figcaption>
</figure>
</details>
<p>Encryption is performed <b>after</b> compression, and uses RC4. RC4 is symmetric, so decryption is performed the same as encryption. That is, <code>packet = encrypt(compress(data))</code> and <code>data = decompress(decrypt(data))</code>.</p> <p>Encryption is performed <b>after</b> compression, and uses RC4. RC4 is symmetric, so decryption is performed the same as encryption. That is, <code>packet = encrypt(compress(data))</code> and <code>data = decompress(decrypt(data))</code>.</p>
<h2 id="keys">Encryption keys</h2> <h2 id="keys">Encryption keys</h2>
<p>Encryption is not performed using a single static key. Instead, each request and response has its own key that is generated.</p> <p>Encryption is not performed using a single static key. Instead, each request and response has its own key that is generated.</p>
<p>These keys are generated baesd on the <code>X-Eamuse-Info</code> header.</p> <p>These keys are generated baesd on the <code>X-Eamuse-Info</code> header.</p>
<p>This header loosely follows the format <code>1-[0-9a-f]{8}-[0-9a-f]{4}</code>. This corresponds to <code>[version]-[serial]-[salt]</code>. <b>TODO: Confirm this</b></p> <p>This header loosely follows the format <code>1-[0-9a-f]{8}-[0-9a-f]{4}</code>. This corresponds to <code>[version]-[serial]-[salt]</code>. <b>TODO: Confirm this</b></p>
<p>Our per-packet key is then generated using <code>md5(serial | salt | KEY)</code>. Identifying <code>KEY</code> is left as an exercise for the reader, however should not be especially challenging.</p> <p>Our per-packet key is then generated using <code>md5(serial | salt | KEY)</code>. Identifying <code>KEY</code> is left as an exercise for the reader, however should not be especially challenging. <span style="color: #fff">Check the page source if you're stuck.</span></p>
<!-- It's 69d74627d985ee2187161570d08d93b12455035b6df0d8205df5, if you were wondering. libavs-win32-ea3.dll:0x10054160 -->
<h2 id="lz77">LZ77</h2> <h2 id="lz77">LZ77</h2>
<p>Packets are compressed using lzss. The compressed data structure is a repeating cycle of an 8 bit flags byte, followed by 8 values. Each value is either a single literal byte, if the corresponding bit in the preceeding flag is high, or is a two byte lookup into the window.</p> <p>Packets are compressed using lzss. The compressed data structure is a repeating cycle of an 8 bit flags byte, followed by 8 values. Each value is either a single literal byte, if the corresponding bit in the preceeding flag is high, or is a two byte lookup into the window.</p>
@ -39,5 +48,7 @@
<p>The exact algorithm used for compression is not especially important, as long as it follows this format. One can feasibly perform no compression at all, and instead insert <code>0xFF</code> every 8 bytes (starting at index 0), to indicate that all values are literals. While obviously poor for compression, this is an easy way to test without first implementing a compressor.</p> <p>The exact algorithm used for compression is not especially important, as long as it follows this format. One can feasibly perform no compression at all, and instead insert <code>0xFF</code> every 8 bytes (starting at index 0), to indicate that all values are literals. While obviously poor for compression, this is an easy way to test without first implementing a compressor.</p>
<a href="./index.html">Prev page</a> | <a href="./packet.html">Next page</a>
</body> </body>
</html> </html>