public Results BufferTCPPacket(TcpPacket pTCPPacket, DateTime pArrivalTime) { if (pTCPPacket.Fin || pTCPPacket.Rst) { _terminated = true; Text += " (Terminated)"; return _packets.Count == 0 ? Results.CloseMe : Results.Terminated; } if (pTCPPacket.Syn && !pTCPPacket.Ack) { _localPort = (ushort)pTCPPacket.SourcePort; _remotePort = (ushort)pTCPPacket.DestinationPort; _outboundSequence = (uint)(pTCPPacket.SequenceNumber + 1); Text = "Port " + _localPort + " - " + _remotePort; startTime = DateTime.Now; try { _remoteEndpoint = ((PacketDotNet.IPv4Packet)pTCPPacket.ParentPacket).SourceAddress.ToString() + ":" + pTCPPacket.SourcePort.ToString(); _localEndpoint = ((PacketDotNet.IPv4Packet)pTCPPacket.ParentPacket).DestinationAddress.ToString() + ":" + pTCPPacket.DestinationPort.ToString(); Console.WriteLine("[CONNECTION] From {0} to {1}", _remoteEndpoint, _localEndpoint); return Results.Continue; } catch { return Results.CloseMe; } } if (pTCPPacket.Syn && pTCPPacket.Ack) { _inboundSequence = (uint)(pTCPPacket.SequenceNumber + 1); return Results.Continue; } if (pTCPPacket.PayloadData.Length == 0) return Results.Continue; if (_protocol == null) { byte[] tcpData = pTCPPacket.PayloadData; if (pTCPPacket.SourcePort == _localPort) _outboundSequence += (uint)tcpData.Length; else _inboundSequence += (uint)tcpData.Length; ushort length = (ushort)(BitConverter.ToUInt16(tcpData, 0) + 2); byte[] headerData = new byte[tcpData.Length]; Buffer.BlockCopy(tcpData, 0, headerData, 0, tcpData.Length); PacketReader pr = new PacketReader(headerData); if (length != tcpData.Length || tcpData.Length < 13) { if (_socks5 > 0 && _socks5 < 7) { if (pr.ReadByte() == 5 && pr.ReadByte() == 1) { pr.ReadByte(); _proxyEndpoint = _localEndpoint; _localEndpoint = ""; switch (pr.ReadByte()) { case 1://IPv4 for (int i = 0; i < 4; i++) { _localEndpoint += pr.ReadByte(); if (i < 3) { _localEndpoint += "."; } } break; case 3://Domain //readInt - String Length //readAsciiString - Address break; case 4://IPv6 for (int i = 0; i < 16; i++) { pr.ReadByte(); } break; } byte[] ports = new byte[2]; for (int i = 1; i >= 0; i--) { ports[i] = pr.ReadByte(); } PacketReader portr = new PacketReader(ports); _proxyPort = _remotePort; _remotePort = portr.ReadUShort(); _localEndpoint += ":" + _remotePort; Text = "Port " + _localPort + " - " + _remotePort + "(Proxy" + _proxyPort + ")"; Console.WriteLine("[socks5] From {0} to {1} (Proxy {2})", _remoteEndpoint, _localEndpoint, _proxyEndpoint); } _socks5++; return Results.Continue; } else if (tcpData.Length == 3 && pr.ReadByte() == 5) { _socks5 = 1; return Results.Continue; } Console.WriteLine("Connection on port {0} did not have a MapleStory Handshake", _localEndpoint); return Results.CloseMe; } var kvp = MapleProtocol.ParseHandshake(pr.ToArray(), pArrivalTime); if (!kvp.HasValue) { return Results.CloseMe; } _protocol = kvp.Value.Key; var hs = kvp.Value.Value; mPacketList.Items.Add(hs.GetListViewItem()); _packets.Add(hs); ListView.Columns.Clear(); ListView.Columns.AddRange(_protocol.GetListViewHeaders()); MainForm.SearchForm.RefreshOpcodes(true); } if (pTCPPacket.SourcePort == _localPort) ProcessTCPPacket(pTCPPacket, ref _outboundSequence, _outboundBuffer, _protocol.OutboundStream, pArrivalTime); else ProcessTCPPacket(pTCPPacket, ref _inboundSequence, _inboundBuffer, _protocol.InboundStream, pArrivalTime); return Results.Continue; }
internal Results BufferTCPPacket(TcpPacket pTCPPacket, DateTime pArrivalTime) { if (pTCPPacket.Fin || pTCPPacket.Rst) { mTerminated = true; Text += " (Terminated)"; return mPackets.Count == 0 ? Results.CloseMe : Results.Terminated; } if (pTCPPacket.Syn && !pTCPPacket.Ack) { mLocalPort = (ushort)pTCPPacket.SourcePort; mRemotePort = (ushort)pTCPPacket.DestinationPort; mOutboundSequence = (uint)(pTCPPacket.SequenceNumber + 1); Text = "Port " + mLocalPort + " - " + mRemotePort; startTime = DateTime.Now; try { mRemoteEndpoint = ((PacketDotNet.IPv4Packet)pTCPPacket.ParentPacket).SourceAddress.ToString() + ":" + pTCPPacket.SourcePort.ToString(); mLocalEndpoint = ((PacketDotNet.IPv4Packet)pTCPPacket.ParentPacket).DestinationAddress.ToString() + ":" + pTCPPacket.DestinationPort.ToString(); Console.WriteLine("[CONNECTION] From {0} to {1}", mRemoteEndpoint, mLocalEndpoint); return Results.Continue; } catch { return Results.CloseMe; } } if (pTCPPacket.Syn && pTCPPacket.Ack) { mInboundSequence = (uint)(pTCPPacket.SequenceNumber + 1); return Results.Continue; } if (pTCPPacket.PayloadData.Length == 0) return Results.Continue; if (mBuild == 0) { byte[] tcpData = pTCPPacket.PayloadData; if (pTCPPacket.SourcePort == mLocalPort) mOutboundSequence += (uint)tcpData.Length; else mInboundSequence += (uint)tcpData.Length; ushort length = (ushort)(BitConverter.ToUInt16(tcpData, 0) + 2); byte[] headerData = new byte[tcpData.Length]; Buffer.BlockCopy(tcpData, 0, headerData, 0, tcpData.Length); bool mIsKMS = false; PacketReader pr = new PacketReader(headerData); if (length != tcpData.Length || tcpData.Length < 13) { if (socks5 > 0 && socks5 < 7) { if (pr.ReadByte() == 5 && pr.ReadByte() == 1) { pr.ReadByte(); mProxyEndpoint = mLocalEndpoint; mLocalEndpoint = ""; switch (pr.ReadByte()) { case 1://IPv4 for (int i = 0; i < 4; i++) { mLocalEndpoint += pr.ReadByte(); if (i < 3) { mLocalEndpoint += "."; } } break; case 3://Domain //readInt - String Length //readAsciiString - Address break; case 4://IPv6 for (int i = 0; i < 16; i++) { pr.ReadByte(); } break; } byte[] ports = new byte[2]; for (int i = 1; i >= 0; i--) { ports[i] = pr.ReadByte(); } PacketReader portr = new PacketReader(ports); mProxyPort = mRemotePort; mRemotePort = portr.ReadUShort(); mLocalEndpoint += ":" + mRemotePort; Text = "Port " + mLocalPort + " - " + mRemotePort + "(Proxy" + mProxyPort + ")"; Console.WriteLine("[socks5] From {0} to {1} (Proxy {2})", mRemoteEndpoint, mLocalEndpoint, mProxyEndpoint); } socks5++; return Results.Continue; } else if (tcpData.Length == 3 && pr.ReadByte() == 5) { socks5 = 1; return Results.Continue; } Console.WriteLine("Connection on port {0} did not have a MapleStory Handshake", mLocalEndpoint); return Results.CloseMe; } pr.ReadUShort(); ushort version = pr.ReadUShort(); byte subVersion = 1; string patchLocation = pr.ReadMapleString(); byte[] localIV = pr.ReadBytes(4); byte[] remoteIV = pr.ReadBytes(4); byte serverLocale = pr.ReadByte(); if (serverLocale > 0x12) { return Results.CloseMe; } if (serverLocale == 0x02 || (serverLocale == 0x01 && version > 255)) mIsKMS = true; else mIsKMS = false; if (mIsKMS) { int test = int.Parse(patchLocation); version = (ushort)(test & 0x7FFF); subVersion = (byte)((test >> 16) & 0xFF); } else if (patchLocation.All(character => { return character >= '0' && character <= '9'; })) { if (!byte.TryParse(patchLocation, out subVersion)) Console.WriteLine("Failed to parse subVersion"); } mBuild = version; mLocale = serverLocale; mPatchLocation = patchLocation; mOutboundStream = new MapleStream(true, mBuild, mLocale, localIV, subVersion); mInboundStream = new MapleStream(false, mBuild, mLocale, remoteIV, subVersion); // Generate HandShake packet Definition definition = Config.Instance.GetDefinition(mBuild, mLocale, false, 0xFFFF); if (definition == null) { definition = new Definition(); definition.Outbound = false; definition.Locale = mLocale; definition.Opcode = 0xFFFF; definition.Name = "Maple Handshake"; definition.Build = mBuild; DefinitionsContainer.Instance.SaveDefinition(definition); } { string filename = "Scripts" + Path.DirectorySeparatorChar + mLocale.ToString() + Path.DirectorySeparatorChar + mBuild.ToString() + Path.DirectorySeparatorChar + "Inbound" + Path.DirectorySeparatorChar + "0xFFFF.txt"; if (!Directory.Exists(Path.GetDirectoryName(filename))) Directory.CreateDirectory(Path.GetDirectoryName(filename)); if (!File.Exists(filename)) { string contents = ""; contents += "using (ScriptAPI) {\r\n"; contents += "\tAddShort(\"Packet Size\");\r\n"; contents += "\tAddUShort(\"MapleStory Version\");\r\n"; contents += "\tAddString(\"MapleStory Patch Location/Subversion\");\r\n"; contents += "\tAddField(\"Local Initializing Vector (IV)\", 4);\r\n"; contents += "\tAddField(\"Remote Initializing Vector (IV)\", 4);\r\n"; contents += "\tAddByte(\"MapleStory Locale\");\r\n"; if (mRemotePort == 8484 && ((mLocale == MapleLocale.GLOBAL && version >= 160) || (mLocale == MapleLocale.TAIWAN && version >= 176) || (mLocale == MapleLocale.CHINA && version >= 122))) contents += "\tAddByte(\"Unknown\");\r\n"; contents += "}"; File.WriteAllText(filename, contents); } } MaplePacket packet = new MaplePacket(pArrivalTime, false, mBuild, mLocale, 0xFFFF, definition == null ? "" : definition.Name, tcpData, (uint)0, BitConverter.ToUInt32(remoteIV, 0)); if (!mOpcodes.Exists(kv => kv.First == packet.Outbound && kv.Second == packet.Opcode)) // Should be false, but w/e { mOpcodes.Add(new Pair<bool, ushort>(packet.Outbound, packet.Opcode)); } mPacketList.Items.Add(packet); mPackets.Add(packet); MainForm.SearchForm.RefreshOpcodes(true); Console.WriteLine("[CONNECTION] MapleStory V{2}.{3} Locale {4}", mLocalEndpoint, mRemoteEndpoint, mBuild, subVersion, serverLocale); } if (pTCPPacket.SourcePort == mLocalPort) ProcessTCPPacket(pTCPPacket, ref mOutboundSequence, mOutboundBuffer, mOutboundStream, pArrivalTime); else ProcessTCPPacket(pTCPPacket, ref mInboundSequence, mInboundBuffer, mInboundStream, pArrivalTime); return Results.Continue; }
internal Results BufferTCPPacket(TcpPacket pTCPPacket, DateTime pArrivalTime) { if (pTCPPacket.Fin || pTCPPacket.Rst) { mTerminated = true; Text += " (Terminated)"; if (mPackets.Count == 0) { // f**k return Results.CloseMe; } else { return Results.Terminated; } } if (pTCPPacket.Syn && !pTCPPacket.Ack) { mLocalPort = (ushort)pTCPPacket.SourcePort; mRemotePort = (ushort)pTCPPacket.DestinationPort; mOutboundSequence = (uint)(pTCPPacket.SequenceNumber + 1); Text = "Port " + mLocalPort.ToString(); startTime = DateTime.Now; mRemoteEndpoint = ((PacketDotNet.IPv4Packet)pTCPPacket.ParentPacket).SourceAddress.ToString() + ":" + pTCPPacket.SourcePort.ToString(); mLocalEndpoint = ((PacketDotNet.IPv4Packet)pTCPPacket.ParentPacket).DestinationAddress.ToString() + ":" + pTCPPacket.DestinationPort.ToString(); Console.WriteLine("[CONNECTION] From {0} to {1}", mLocalEndpoint, mRemoteEndpoint); return Results.Continue; } if (pTCPPacket.Syn && pTCPPacket.Ack) { mInboundSequence = (uint)(pTCPPacket.SequenceNumber + 1); return Results.Continue; } if (pTCPPacket.PayloadData.Length == 0) return Results.Continue; if (mBuild == 0) { if (pTCPPacket.PayloadData.Length < 13) return Results.CloseMe; byte[] tcpData = pTCPPacket.PayloadData; //mBuild = (ushort)(tcpData[2] | (tcpData[3] << 8)); bool mIsKMS = false; PacketReader pr = new PacketReader(tcpData); pr.ReadShort(); ushort version = pr.ReadUShort(); var pos = pr.Position; { var shrt = pr.ReadShort(); if (shrt < 0 || shrt > 0x0020) { return Results.CloseMe; } } pr.Reset(pos); string patchLocation = pr.ReadMapleString(); byte[] localIV = pr.ReadBytes(4); byte[] remoteIV = pr.ReadBytes(4); byte serverLocale = pr.ReadByte(); if (pr.Remaining > 0 || serverLocale > 0x12) { return Results.CloseMe; } if (serverLocale == 0x02 || (serverLocale == 0x01 && version > 255)) mIsKMS = true; else mIsKMS = false; if (mIsKMS) { int test = int.Parse(patchLocation); ushort t1 = (ushort)(test & 0x7FFF); int t2 = (test >> 15) & 1; int t3 = (test >> 16) & 0xFF; Console.WriteLine("Logging KMS connection. Version {0} | {1} | {2}", t1, t2, t3); mBuild = t1; } else { mBuild = version; } mLocale = serverLocale; mPatchLocation = patchLocation; mOutboundStream = new MapleStream(true, mBuild, mLocale, localIV); mInboundStream = new MapleStream(false, (ushort)(0xFFFF - mBuild), mLocale, remoteIV); mInboundSequence += (uint)tcpData.Length; // Generate HandShake packet Definition definition = Config.Instance.GetDefinition(mBuild, mLocale, false, 0xFFFF); if (definition == null) { definition = new Definition(); definition.Outbound = false; definition.Locale = mLocale; definition.Opcode = 0xFFFF; definition.Name = "Maple Handshake"; definition.Build = mBuild; Config.Instance.Definitions.Add(definition); } { string filename = "Scripts" + Path.DirectorySeparatorChar + mLocale.ToString() + Path.DirectorySeparatorChar + mBuild.ToString() + Path.DirectorySeparatorChar + "Inbound" + Path.DirectorySeparatorChar + "0xFFFF.txt"; if (!Directory.Exists(Path.GetDirectoryName(filename))) Directory.CreateDirectory(Path.GetDirectoryName(filename)); if (!File.Exists(filename)) { string contents = ""; contents += "using (ScriptAPI) {\r\n"; contents += "\tAddShort(\"Packet Size\");\r\n"; contents += "\tAddUShort(\"MapleStory Version\");\r\n"; contents += "\tAddString(\"MapleStory Patch Location\");\r\n"; contents += "\tAddField(\"Local Initializing Vector (IV)\", 4);\r\n"; contents += "\tAddField(\"Remote Initializing Vector (IV)\", 4);\r\n"; contents += "\tAddByte(\"MapleStory Locale\");\r\n"; contents += "}"; File.WriteAllText(filename, contents); } } MaplePacket packet = new MaplePacket(pArrivalTime, false, mBuild, mLocale, 0xFFFF, definition == null ? "" : definition.Name, tcpData); if (!mOpcodes.Exists(kv => kv.First == packet.Outbound && kv.Second == packet.Opcode)) { // Should be false, but w/e mOpcodes.Add(new Pair<bool, ushort>(packet.Outbound, packet.Opcode)); } mPacketList.Items.Add(packet); mPackets.Add(packet); MainForm.SearchForm.RefreshOpcodes(true); Console.WriteLine("[CONNECTION] MapleStory V{2}.{3} Locale {4}", mLocalEndpoint, mRemoteEndpoint, mBuild, patchLocation, serverLocale); } if (pTCPPacket.SourcePort == mLocalPort) ProcessTCPPacket(pTCPPacket, ref mOutboundSequence, mOutboundBuffer, mOutboundStream, pArrivalTime); else ProcessTCPPacket(pTCPPacket, ref mInboundSequence, mInboundBuffer, mInboundStream, pArrivalTime); return Results.Continue; }