Luigi Auriemma

aluigi.org (ARCHIVE-ONLY FORUM!)
It is currently 19 Jul 2012 12:21

All times are UTC [ DST ]





Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 6 posts ] 
Author Message
 Post subject: gshsniff.exe - Error
PostPosted: 03 Jan 2011 03:27 

Joined: 30 Dec 2010 10:34
Posts: 7
so i know that my atheros network adapter wont work with gshsniff.exe, but isnt there a way to edit the C code so it could work without using promiscuous mode? i know its possible, it will sniff packets if its not in promiscuous mode. i done so in wireshark and noticed that it works fine without promiscuous mode.

here is a screen of the error:


Attachments:
atheros promiscuous error.jpg
atheros promiscuous error.jpg [ 72.67 KiB | Viewed 1074 times ]
Top
 Profile  
 
 
 Post subject: Re: gshsniff.exe - Error
PostPosted: 04 Jan 2011 00:25 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
if you can compile the tool it's enough that you modify the following:
Code:
fp = pcap_open_live(d->name, 65535, 1, 1000, errbuf);
in
Code:
fp = pcap_open_live(d->name, 65535, 0, 1000, errbuf);
while if you can't recompile it open gshsniff.exe with a hex editor, go to offset 0xEEA and replace 0x01 with 0x00


Top
 Profile  
 
 Post subject: Re: gshsniff.exe - Error
PostPosted: 04 Jan 2011 03:12 

Joined: 30 Dec 2010 10:34
Posts: 7
thank you that worked. however, im trying to get the special auth part so i can use your gskeyinuse.exe program.

however, it only gives me this when i refresh swbf2 on server list:
Code:
         18:07:37   192.168.1.101:1726 -> 69.10.30.248:27900   [plain-text]


         18:07:37   69.10.30.248:27900 -> 192.168.1.101:1726   [plain-text]
?????


I then tried using the -e -v method on what you used in the video. it didnt display anything at all. i thought this must be the wrong host. so, luckily i saved a query operation relating to swbf2 and it shows this in wireshark:
Code:
192.168.1.101   192.168.1.1   DNS   Standard query A swbfront2pc.ms6.gamespy.com

The query seems to resolve to the IP address 69.10.30.247. i tried using that in gshsniff.exe, and again nothing happened.

so what am i doing wrong to get the auth lines for swbf2? wrong host?


Top
 Profile  
 
 Post subject: Re: gshsniff.exe - Error
PostPosted: 04 Jan 2011 14:46 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
uhmmm don't know, the packet is catched because the IPs are correct so maybe the content is encrypted in another way... but sounds strange.
if you can sniff and collect the original packet (those versus 69.10.30.248:27900) I can take a look at them


Top
 Profile  
 
 Post subject: Re: gshsniff.exe - Error
PostPosted: 05 Jan 2011 06:14 

Joined: 30 Dec 2010 10:34
Posts: 7
the following is a wireshark capture file containing the refresh server operation. interesting stuff in there. also, it contains me trying to join a server with a banned key:
http://96.9.161.91/bf2/pubpackets/bf2%20query%20packets.pcap

here is the .dll from proxocket that contains the start up and shut down of the BattlefrontII.exe:
http://96.9.161.91/bf2/pubpackets/BattlefrontII.exe_proxocket_03.jan.2011-19.28.06.cap


Top
 Profile  
 
 Post subject: Re: gshsniff.exe - Error
PostPosted: 05 Jan 2011 13:01 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
I have verified the sniffs and the only udp packet sent to gamespy is that one containing the name of the game so with nothing to decrypt.

maybe the cdkey authentication is done in another moment


Top
 Profile  
 
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 6 posts ] 

All times are UTC [ DST ]


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for: