5 ms·
I was 14 years old when Galaxies was first announced, two years prior to its release. Like the author of this article, I too was crazy excited about this game w
by Skywing 15y ago
I was 14 years old when Galaxies was first announced, two years prior to its release. Like the author of this article, I too was crazy excited about this game when I first heard about it. My friends and I did all the same things that the author said he did, such as fantasizing about being a bounty hunter, or chillin' with Luke, etc. The idea of the game excited me more than actually wanting to play it, though. I've never been much of a gamer but games were how I learned to program. So, my approach to Galaxies took me to similar places as the author, but I got there a different way.
When Galaxies was announced, I was in my peak of reverse engineering Blizzard games. I had been reverse engineering the Battle.net client protocol since Diablo 1 and StarCraft. Battle.net had a community full of people who reverse engineered the Blizzard games and there was somewhat of a competition as to who could write the coolest bots, as we called them. Bots were apps that emulated the official clients and could completely sign into Battle.net without using the actual game. Most of mine were just console apps, because I enjoyed the reverse engineering more than the coding.
So, when Galaxies finally came out in beta, a friend of mine luckily got a copy. The computer that I used at that time, which was a shared family computer, was terrible so I didn't expect to play the game, but I did ask him for a copy of the game's directory so that I could start writing Galaxies bots. I focused all of my time on reverse engineering the Galaxies client protocol. I would stay up until the sun came up, staring at the game in a debugger. When a family member need to computer or I had to go to school, I'd hit print on IDA and print out an entire dll - tons of paper. I'd basically annotate the printed out assembly with what I thought was happening and then I'd get home and confirm or deny it with the debugger at run-time. I'd borrow my friends account so that I could see the sign in process in real-time and get packet dumps. I did this for months straight and it never got old.
The end result was a console application that could emulate the official client and sign in to Galaxies, select your character and respond to various events. My friends would level up new character's professions and I'd run them on my terrible computer while we were at school, and over night. I could run many at once with no problem.
While we did not have the in-game success with making tons of money, I did save a lot of money up front on a lot of new computers and tons of copies of Galaxies. :)
- jacques_chester 15y agoI hope all this is on your resume. You're the sort of person I like to mention when folk come up with half-assed "encryption" schemes. The kind of person who reads hex for fun.
- Skywing 15y agoHaha. Funny enough, when I was a sophomore in college, I applied to Nortel for a C++ job. During my interviews, I told them these stories. It was one of those cases where you feel like you're the object of a show-and-tell, or something. My interviewer kept walking me around to all of his friends, having me tell them these stories. Everyone seemed so interested. Needless to say, I ended up getting the job. It was a cool job. I got to help code Nortel's 4G wireless data service, doing low level network protocol stuff. That is, until they went bankrupt.
- memoryfault 15y agoWould love to hear more about the tools of the trade. What did you use back then for debugging/packet sniffing, and what would you use now?
- Skywing 15y agoI would use basically the same set of tools, today. I used IDA to annotate the dis-assembly of various files that I was interested in. I never did like IDA's run-time debugging interface. So, I used OllyDbg for most of my debugging. I liked OllyDbg because of the graphical nature of it all. But, I would also use WinDbg if I wanted to set breakpoints on unresolved symbols. I couldn't seem to get OllyDbg to do that. WinDbg is great if you're familiar with the more command-line approach. I used Ethereal, now named Wireshark, for packet capture and inspection. You just have to get familiar with the filters to harness the power of it. I'd typically start by using netstat to see what ports were being used, and then I'd filter on those ports. A lot of my first protocol reverse engineering was really just pure brute force by staring at packet dumps of multiple log in attempts with all the cases (success, fail, etc) and just basically doing a manual diff process, noting the changes. Until I got better at using IDA and WinDbg, anyways. For quick and dirty virtual mem scanning, I'd just use this tool called ArtMoney. It was an amazing tool because you could scan the memory for some data, bookmark offsets and then re-scan. Basically, you could build upon previous scans, allowing you to sieve results. Like, in StarCraft this was so easy because if you were trying to find a value that was increasing or decreasing, like supply income, you scan and scan again saying "show me only the results that went down since last scan." Then, scan again using those results but only show the ones that went up. Usually, after 3-4 sieve scans you'd be staring at your values. Then you just attach OllyDbg to the process, breakpoint on memory read or write to them, see where it breaks and step out a few function calls (because you'd usually land in some low level write function or loop event or something). Lots of tools, but the key is just to use common sense. Think about what it's logically doing. Use your knowledge of game loops and stuff to determine what you're probably looking at or looking for. Always annotate the assembly code, even if at first it seems small and stupid. Over time those small notes add up and you'll end up with fully commented code. :P A lot can be researched by poking around in the files in the install directories, too.