SpyUO - a C# UO packet hooker

[Smjert]

Sorry i'm a bit confused.. how i have to use Jeff's keys?

These keys are written in a different way:

45AD77EE: "5.0.7.2 T2A"       41AA8D 5 1 434910 7 6

And how i can get the timestamp?

(i followed Folko's guide, he said "Open client.exe in UltraEdit and search the PE header. It is on top of the file and starts with "PE", in 4.0.0l it's at 0x0138. Skip the next WORD and the next DWORD and you'll have the TimeStamp in Little Endian. To convert it to human readable Big Endian, reverse the bytes")

Then i found the letters PE in line 00000120h, but how can i skip WORD and DWORD??

[Jeff]

Originally Posted by Smjert

Sorry i'm a bit confused.. how i have to use Jeff's keys?

These keys are written in a different way:

45AD77EE: "5.0.7.2 T2A"       41AA8D 5 1 434910 7 6

And how i can get the timestamp?

(i followed Folko's guide, he said "Open client.exe in UltraEdit and search the PE header. It is on top of the file and starts with "PE", in 4.0.0l it's at 0x0138. Skip the next WORD and the next DWORD and you'll have the TimeStamp in Little Endian. To convert it to human readable Big Endian, reverse the bytes")

Then i found the letters PE in line 00000120h, but how can i skip WORD and DWORD??

"5.0.8.2 2D"     2F5325 7 D A2BF52 7 F

Better?

anyway, skipping a WORD by just counting 2 bytes or 16 bits,

WORD = 16bit
DWORD = 32bit

[Smjert]

Code:

"5.0.8.2 2D"     2F5325 7 D A2BF52 7 F

Better?

Ah wow.. I thought that it had to begin with a 4 or something like that XD

Edit:
I found the timestamp, added this line

45D23436: "5.0.8.2 T2A" 2F5325 7 D A2BF52 7 F

and i got: Error reading Clients.cfg--->System.FormatException: One of the identified items was in an invalid format

[Kenko]

but what is the full line please?

[Smjert]

That is the full line (the line i added).

Edit: the error or the line i added?

[jaynigs]

Try this

45D23436: "5.0.8.2 2D"       41A97D 5 7 4347D0 7 6

[Smjert]

Thnx now it works!

[jaynigs]

Thanks for confirming they work,

Perhaps you could try these for 3D also?

45D234F2: "5.0.8.2 3D"       48E1F2 6 1 4A0A23 2 6

Thanks

[Smjert]

It works

[jaynigs]

Originally Posted by Smjert

It works

Thanks smjert, i was unable to test them, now i know they both work, i can go and watch some tv now

[Amdir]

Anyone have got the new key for 5.0.9.x clients?

[MuadDib]

4609984d: "5.0.9.1 T2a" 41aaa1 5 7 41a939 7 6 ;

[Amdir]

Don't work (packed gump)

Thk anyway

[MalGanis]

Try this one:

4609984D: "5.0.9.1 2D"       41A970 5 1 434850 7 6

But rather than delaing with keys, use Spyuo 2.0 by Arul

[HellRazor]

Originally Posted by MalGanis

Try this one:

4609984D: "5.0.9.1 2D"       41A970 5 1 434850 7 6

But rather than delaing with keys, use Spyuo 2.0 by Arul

Where can I find this?

[MalGanis]

One page back (6), its 3 post from teh bottom.

[HellRazor]

Aha, thank you! I was looking for a new thread, didn't realize he had posted it in this one.

[HellRazor]

Originally Posted by arul

Try those ..

45AD77EE: "5.0.7.2 2D"        41AA8D 5 1 434910 7 6

Anyway, here's an experimental version of SpyUO that heuristically retrieves the locations of sen/rec buffers when the client starts. Sources coming soon.

Don't forget the sources Arul! They allow people to learn and to continue the good work!

[crova]

Hi all i have a problem with SpyUO 2 .. when i run the exe i have this error:

System.DllNotFoundException: Impossible to load "findaddr.dll"

Can someone help me? or maybe has someone the source code of this version?

Thnx in advance

[Kamuflaro]

Anyone sharing the keys for 6.0.1.3 or 6.0.1.7?

[arul]

findaddr.dll is compiled against vc8 runtime, so if you don't have the runtime installed it will throw that error.

As this is a problem for a lot of people, here is a tool that will tell you the recv/sendv buffer locations. It's compiled against standard msvcrt.dll so it should run on any windows machine.

Please note that the last client I tested it with was 6.0.1.6, with every new version of the client it is less probable that the keys will work or even found properly.

Usage: keysfinder.exe client_exe_location here
Example usage: keysfinder.exe c:\uo\client.exe

Sources included in the archive.

Cheers.

[crova]

Originally Posted by arul

findaddr.dll is compiled against vc8 runtime, so if you don't have the runtime installed it will throw that error.

As this is a problem for a lot of people, here is a tool that will tell you the recv/sendv buffer locations. It's compiled against standard msvcrt.dll so it should run on any windows machine.

Please note that the last client I tested it with was 6.0.1.6, with every new version of the client it is less probable that the keys will work or even found properly.

Usage: keysfinder.exe client_exe_location here
Example usage: keysfinder.exe c:\uo\client.exe

Sources included in the archive.

Cheers.

Thnx m8

[Kamuflaro]

thanks it seems to be working:
464AD29D: "6.0.1.3 2D" 41A98D 5 7 434A50 7 6
But it crashes on certain receives for me (output buffer too small):

System.ArgumentException: Der Ausgabe-Zeichenpuffer zu klein für die verschlüsselten Zeichen. Verschlüsselung von Unicode (UTF-8) in Ausweichposition System.Text.DecoderReplacementFallback.
Parametername: chars
   bei System.Text.Encoding.ThrowCharsOverflow()
   bei System.Text.Encoding.ThrowCharsOverflow(DecoderNLS decoder, Boolean nothingDecoded)
   bei System.Text.UTF8Encoding.GetChars(Byte* bytes, Int32 byteCount, Char* chars, Int32 charCount, DecoderNLS baseDecoder)
   bei System.Text.DecoderNLS.GetChars(Byte* bytes, Int32 byteCount, Char* chars, Int32 charCount, Boolean flush)
   bei System.Text.DecoderNLS.GetChars(Byte[] bytes, Int32 byteIndex, Int32 byteCount, Char[] chars, Int32 charIndex, Boolean flush)
   bei System.Text.DecoderNLS.GetChars(Byte[] bytes, Int32 byteIndex, Int32 byteCount, Char[] chars, Int32 charIndex)
   bei System.IO.BinaryReader.InternalReadOneChar()
   bei System.IO.BinaryReader.Read()
   bei System.IO.BinaryReader.PeekChar()
   bei Ultima.StringList..ctor(String language)
   bei SpyUO.Packets.LocalizedList..cctor()

[arul]

Originally Posted by Kamuflaro

thanks it seems to be working:
464AD29D: "6.0.1.3 2D" 41A98D 5 7 434A50 7 6
But it crashes on certain receives for me (output buffer too small):

System.ArgumentException: Der Ausgabe-Zeichenpuffer zu klein für die verschlüsselten Zeichen. Verschlüsselung von Unicode (UTF-8) in Ausweichposition System.Text.DecoderReplacementFallback.
Parametername: chars
   bei System.Text.Encoding.ThrowCharsOverflow()
   bei System.Text.Encoding.ThrowCharsOverflow(DecoderNLS decoder, Boolean nothingDecoded)
   bei System.Text.UTF8Encoding.GetChars(Byte* bytes, Int32 byteCount, Char* chars, Int32 charCount, DecoderNLS baseDecoder)
   bei System.Text.DecoderNLS.GetChars(Byte* bytes, Int32 byteCount, Char* chars, Int32 charCount, Boolean flush)
   bei System.Text.DecoderNLS.GetChars(Byte[] bytes, Int32 byteIndex, Int32 byteCount, Char[] chars, Int32 charIndex, Boolean flush)
   bei System.Text.DecoderNLS.GetChars(Byte[] bytes, Int32 byteIndex, Int32 byteCount, Char[] chars, Int32 charIndex)
   bei System.IO.BinaryReader.InternalReadOneChar()
   bei System.IO.BinaryReader.Read()
   bei System.IO.BinaryReader.PeekChar()
   bei Ultima.StringList..ctor(String language)
   bei SpyUO.Packets.LocalizedList..cctor()

Seems that BinaryReader.PeekChar() or text encoder respectively, is somehow bugged when using non-english version of .net framework.

I'll include the fix in my version of UO SDK later this evening.

[CEO]

Here's the info for latest client, though I think some source code modification is needed to make it work completely.

468e740b: "6.0.1.7 2D" 41A90D 5 7 434A90 7 6