6 ms·

My first real foray into Linux was inspecting network traffic with a program called ShowEQ for EverQuest. At the time, the traffic was unencrypted and had lots

My first real foray into Linux was inspecting network traffic with a program called ShowEQ for EverQuest. At the time, the traffic was unencrypted and had lots of juicy info in it. I used a hub to replicate traffic to my Linux box, and it would draw a live map of the zone and showed where the mobs, NPCS, and users were. It even showed what loot the mobs had on them so you could cherry pick certain ones. The beauty of this was that it was passive and impossible to detect. Eventually SOE wised up and started to encrypt the traffic.

Kiro 3y ago
How does encryption help? Your client obviously needs to decrypt it so can't you just piggyback on that?
- vasco 3y ago
  You need to hack the client for that vs just binding to a network port, or at least have access to a decryption key.
  - speedgoose 3y ago
    Yes. Sometimes software will encrypt HTTP calls while relying on the operating system certificate authorities, so it's easy to intercept again using tools such as mitmproxy. Sometimes you will be forced to hack the software, to allow interception or to replace a key. Unless they use a symmetric key that is easily found, but I have never seen that. And then you have the monsters such as Widevine.
- Scarjit 3y ago
  If you don't encrypt your network traffic, you can quite easily decrypt it on another PC (as you can just set promiscuous mode on your 2nd PC NIC), giving you undetectable read-only hacks like "radar", where you basically have a map of the game with the enemy positions, health, gun, ... If you encrypt it, this is no longer possible. If a cheater wants to decrypt it, he has to get access to the decryption key, which usually is send over an TLS encrypted connection (with certificate pinning in place) [Or in some cases self made encryption :/]. Therefore he has to either reverse the game to get the certificate or has to attempt to read it while the game is running. In the first case the game developers (and the Anti-Cheat providers) will try there best by obfuscating the specific regions. And the 2nd case is basically what AC is all about, and therefore difficult for modern Anti-Cheats.
  - devit 3y ago
    I think reading the encryption key from memory is usually easy and cannot really be detected in any way if done from the kernel or hypervisor by parsing page tables and accessing physical memory (except by looking for known code if the anti-cheat has as much privileges as the extractor, which the hypervisor approach avoids).
    - vsnf 3y ago
      You didn't mean it this way, but your post reads like comedy. The juxtaposition of "very easy" with everything else you wrote is a striking image.
      - gpderetta 3y ago
        In first approximation, there are only two kind of difficulty levels: the impossible things you don't know how to do, and the trivial things that you do.
      - lobf 3y ago
        It’s simple!
    - throwbadubadu 3y ago
      But the bar is much higher than just network sniffing and reversing a dumb protocol?
    - Workaccount2 3y ago
      I always wished that CPU/GPU manufacturers would make a "online gaming edition" with hardware level encryption/anti-cheat. I know many people would love to play exclusive lobbies where it is virtually guaranteed there are no cheaters.
      - devit 3y ago
        That's what game consoles usually attempt to be.
  - 3y ago
- low_tech_love 3y ago
  Decompiling (in a meaningful way) an optimized binary generated from C without debug symbols is much harder than what the author has shown in C#. It is not impossible, but probably very time consuming. Versus just reading clean packages from a network.
  - neonsunset 3y ago
    You don't need to obfuscate the code if you apply sufficient amount of acronym-driven coding practices to it!
    - another_bear 3y ago
      "It's not shit code, it's just acronym driven obfuscation!" -My coworkers, apparently.
- bcrosby95 3y ago
  It's not about finding a 100% solution. It's about deterring as many people as you can.
- dbttdft 3y ago
  It doesn't, we are just in 90's security mindset. We even have the typical idiot here chiming in, "it doesn't have to be perfect". Meanwhile in adult software engineer world, we know we can just not send the state of the entire world to every player and that would also save costs.
gnyman 3y ago
I'll admit I did something similar for a game called Dark Age of Camelot as a teenager. Very educative, learned about both network sniffing, hubs vs switches and Linux. Was it worth it to give me an advantage in the game? No, I never played the game seriously enough to be able to use it, I think I used it for a week after spending two setting it up, but it was a great learning experience.
- zdware 3y ago
  I also fell into my first programming experience with DAoC! I worked on fixing some very simple bugs/exploits on an emulated server (C#) back in 2005. There's a ton of fascinating stories coming out in the last decade around hacking/exploits/etc of games of that era; DAoC, UO, Shadowbane (this one was real bad). I'd highly suggest checking out these two episodes of this podcast - https://darknetdiaries.com/episode/7/ https://darknetdiaries.com/episode/7/
acters 3y ago
The data has to be decrypted and read, so eventually you reverse engineer the client and figure out how to decrypt on the fly, then they wise up and introduce key based signing, which you eventually try to steal from the client and breaking the encryption again, then anti cheat is implemented... thus, the cat and mouse game is born, lol
- Cpoll 3y ago
  It would also help to not send the high-value information to the client until required. Especially loot drops!
  - Workaccount2 3y ago
    But then you have to pay for more server side compute! Think of the profit margins!
    - mewpmewp2 3y ago
      Won't you have to compute it yourself in the server anyway to be sure that the client is not lying?
    - bcrosby95 3y ago
      Sending loot on NPCs to every client costs more, not less. The reason why they probably did it is because NPCs actually used the items. When the froglok King loaded his two handed sword, he was actually using it. And when he didn't load it, he wasn't.
      - deleted 3y ago
        [deleted]
- rtkwe 3y ago
  Once the siphoning happens on the same machine your client is running on it's easier to detect through anti-cheats at least. If it can run on a completely separate machine it seems like it'd be essentially impossible to detect except through changes in how a user acts like only going directly to the mobs with the juicy loot and ignoring the trash but that's really tough to detect.
michaelcampbell 3y ago
That brings back some memories. IIRC, showEQ was used to prove several theories and bugs that Verant/Sony steadfastly denied: - there were hell levels - Halflings instead of Humans got the XP bonus (and that there actually WERE race/class XP differences?) - early Shaman alchemy actually WAS broken Also wasn't it what lead to eqemulator.org?
- stocktech 3y ago
  iirc, eqemu reverse engineered the server based on the traffic. I remember being impressed.
sprite 3y ago
ShowEQ still works, there is also MySEQ which is Windows based but just reads memory instead. They are fine to use as the current owners of EQ don't really seem to care. Neither app has ever been able to show what loot a mob has except for visible pieces. Some of the data has changed over the years, for example exact mob HP used to be sent, now they just send percentages.
- Bluecobra 3y ago
  > Neither app has ever been able to show what loot a mob has except for visible pieces. ShowEQ definitely showed drops at some point. I vividly recall farming lightstones from Willowisp and using ShowEQ to ignore the ones with burned out lightstones.
  - sprite 3y ago
    Yes lightstones go in primary weapon slot so they are one of the items that are considered visible.
IG_Semmelweiss 3y ago
Curious since I don't know about this topic: Is this sort of packet sniffing (to cheat) far more difficult (impossible?) for browser-based games ? Assume of course a modern browser fairly standard use of the browser itself
- tga_d 3y ago
  I would suspect "modern" has a lot more impact than "browser" (notably, aside from more developer awareness of cheating, I would suspect TLS is far more common now, though that can of course be worked around when you control the client). Browser traffic isn't any different from any other type of traffic, the standard packet sniffing tools (tcpdump, wireshark, mitmproxy, etc.) work just fine.

Kiro 3y ago

How does encryption help? Your client obviously needs to decrypt it so can't you just piggyback on that?

vasco 3y ago
You need to hack the client for that vs just binding to a network port, or at least have access to a decryption key.
- speedgoose 3y ago
  Yes. Sometimes software will encrypt HTTP calls while relying on the operating system certificate authorities, so it's easy to intercept again using tools such as mitmproxy. Sometimes you will be forced to hack the software, to allow interception or to replace a key. Unless they use a symmetric key that is easily found, but I have never seen that. And then you have the monsters such as Widevine.
Scarjit 3y ago
If you don't encrypt your network traffic, you can quite easily decrypt it on another PC (as you can just set promiscuous mode on your 2nd PC NIC), giving you undetectable read-only hacks like "radar", where you basically have a map of the game with the enemy positions, health, gun, ... If you encrypt it, this is no longer possible. If a cheater wants to decrypt it, he has to get access to the decryption key, which usually is send over an TLS encrypted connection (with certificate pinning in place) [Or in some cases self made encryption :/]. Therefore he has to either reverse the game to get the certificate or has to attempt to read it while the game is running. In the first case the game developers (and the Anti-Cheat providers) will try there best by obfuscating the specific regions. And the 2nd case is basically what AC is all about, and therefore difficult for modern Anti-Cheats.
- devit 3y ago
  I think reading the encryption key from memory is usually easy and cannot really be detected in any way if done from the kernel or hypervisor by parsing page tables and accessing physical memory (except by looking for known code if the anti-cheat has as much privileges as the extractor, which the hypervisor approach avoids).
  - vsnf 3y ago
    You didn't mean it this way, but your post reads like comedy. The juxtaposition of "very easy" with everything else you wrote is a striking image.
    - gpderetta 3y ago
      In first approximation, there are only two kind of difficulty levels: the impossible things you don't know how to do, and the trivial things that you do.
    - lobf 3y ago
      It’s simple!
  - throwbadubadu 3y ago
    But the bar is much higher than just network sniffing and reversing a dumb protocol?
  - Workaccount2 3y ago
    I always wished that CPU/GPU manufacturers would make a "online gaming edition" with hardware level encryption/anti-cheat. I know many people would love to play exclusive lobbies where it is virtually guaranteed there are no cheaters.
    - devit 3y ago
      That's what game consoles usually attempt to be.
- 3y ago
low_tech_love 3y ago
Decompiling (in a meaningful way) an optimized binary generated from C without debug symbols is much harder than what the author has shown in C#. It is not impossible, but probably very time consuming. Versus just reading clean packages from a network.
- neonsunset 3y ago
  You don't need to obfuscate the code if you apply sufficient amount of acronym-driven coding practices to it!
  - another_bear 3y ago
    "It's not shit code, it's just acronym driven obfuscation!" -My coworkers, apparently.
bcrosby95 3y ago
It's not about finding a 100% solution. It's about deterring as many people as you can.
dbttdft 3y ago
It doesn't, we are just in 90's security mindset. We even have the typical idiot here chiming in, "it doesn't have to be perfect". Meanwhile in adult software engineer world, we know we can just not send the state of the entire world to every player and that would also save costs.

gnyman 3y ago

I'll admit I did something similar for a game called Dark Age of Camelot as a teenager. Very educative, learned about both network sniffing, hubs vs switches and Linux. Was it worth it to give me an advantage in the game? No, I never played the game seriously enough to be able to use it, I think I used it for a week after spending two setting it up, but it was a great learning experience.

zdware 3y ago
I also fell into my first programming experience with DAoC! I worked on fixing some very simple bugs/exploits on an emulated server (C#) back in 2005. There's a ton of fascinating stories coming out in the last decade around hacking/exploits/etc of games of that era; DAoC, UO, Shadowbane (this one was real bad). I'd highly suggest checking out these two episodes of this podcast - https://darknetdiaries.com/episode/7/ https://darknetdiaries.com/episode/7/

acters 3y ago

The data has to be decrypted and read, so eventually you reverse engineer the client and figure out how to decrypt on the fly, then they wise up and introduce key based signing, which you eventually try to steal from the client and breaking the encryption again, then anti cheat is implemented... thus, the cat and mouse game is born, lol

Cpoll 3y ago
It would also help to not send the high-value information to the client until required. Especially loot drops!
- Workaccount2 3y ago
  But then you have to pay for more server side compute! Think of the profit margins!
  - mewpmewp2 3y ago
    Won't you have to compute it yourself in the server anyway to be sure that the client is not lying?
  - bcrosby95 3y ago
    Sending loot on NPCs to every client costs more, not less. The reason why they probably did it is because NPCs actually used the items. When the froglok King loaded his two handed sword, he was actually using it. And when he didn't load it, he wasn't.
    - deleted 3y ago
      [deleted]
rtkwe 3y ago
Once the siphoning happens on the same machine your client is running on it's easier to detect through anti-cheats at least. If it can run on a completely separate machine it seems like it'd be essentially impossible to detect except through changes in how a user acts like only going directly to the mobs with the juicy loot and ignoring the trash but that's really tough to detect.

michaelcampbell 3y ago

That brings back some memories. IIRC, showEQ was used to prove several theories and bugs that Verant/Sony steadfastly denied: - there were hell levels - Halflings instead of Humans got the XP bonus (and that there actually WERE race/class XP differences?) - early Shaman alchemy actually WAS broken Also wasn't it what lead to eqemulator.org?

stocktech 3y ago
iirc, eqemu reverse engineered the server based on the traffic. I remember being impressed.

sprite 3y ago

ShowEQ still works, there is also MySEQ which is Windows based but just reads memory instead. They are fine to use as the current owners of EQ don't really seem to care. Neither app has ever been able to show what loot a mob has except for visible pieces. Some of the data has changed over the years, for example exact mob HP used to be sent, now they just send percentages.

Bluecobra 3y ago
> Neither app has ever been able to show what loot a mob has except for visible pieces. ShowEQ definitely showed drops at some point. I vividly recall farming lightstones from Willowisp and using ShowEQ to ignore the ones with burned out lightstones.
- sprite 3y ago
  Yes lightstones go in primary weapon slot so they are one of the items that are considered visible.

IG_Semmelweiss 3y ago

Curious since I don't know about this topic: Is this sort of packet sniffing (to cheat) far more difficult (impossible?) for browser-based games ? Assume of course a modern browser fairly standard use of the browser itself

tga_d 3y ago
I would suspect "modern" has a lot more impact than "browser" (notably, aside from more developer awareness of cheating, I would suspect TLS is far more common now, though that can of course be worked around when you control the client). Browser traffic isn't any different from any other type of traffic, the standard packet sniffing tools (tcpdump, wireshark, mitmproxy, etc.) work just fine.