public Results BufferTCPPacket(TcpPacket pTCPPacket, DateTime pArrivalTime)
{
if (pTCPPacket.Fin || pTCPPacket.Rst)
{
_terminated = true;
Text += " (Terminated)";
return _packets.Count == 0 ? Results.CloseMe : Results.Terminated;
}
if (pTCPPacket.Syn && !pTCPPacket.Ack)
{
_localPort = (ushort)pTCPPacket.SourcePort;
_remotePort = (ushort)pTCPPacket.DestinationPort;
_outboundSequence = (uint)(pTCPPacket.SequenceNumber + 1);
Text = "Port " + _localPort + " - " + _remotePort;
startTime = DateTime.Now;
try
{
_remoteEndpoint = ((PacketDotNet.IPv4Packet)pTCPPacket.ParentPacket).SourceAddress.ToString() + ":" + pTCPPacket.SourcePort.ToString();
_localEndpoint = ((PacketDotNet.IPv4Packet)pTCPPacket.ParentPacket).DestinationAddress.ToString() + ":" + pTCPPacket.DestinationPort.ToString();
Console.WriteLine("[CONNECTION] From {0} to {1}", _remoteEndpoint, _localEndpoint);
return Results.Continue;
}
catch
{
return Results.CloseMe;
}
}
if (pTCPPacket.Syn && pTCPPacket.Ack) { _inboundSequence = (uint)(pTCPPacket.SequenceNumber + 1); return Results.Continue; }
if (pTCPPacket.PayloadData.Length == 0) return Results.Continue;
if (_protocol == null)
{
byte[] tcpData = pTCPPacket.PayloadData;
if (pTCPPacket.SourcePort == _localPort) _outboundSequence += (uint)tcpData.Length;
else _inboundSequence += (uint)tcpData.Length;
ushort length = (ushort)(BitConverter.ToUInt16(tcpData, 0) + 2);
byte[] headerData = new byte[tcpData.Length];
Buffer.BlockCopy(tcpData, 0, headerData, 0, tcpData.Length);
PacketReader pr = new PacketReader(headerData);
if (length != tcpData.Length || tcpData.Length < 13)
{
if (_socks5 > 0 && _socks5 < 7)
{
if (pr.ReadByte() == 5 && pr.ReadByte() == 1)
{
pr.ReadByte();
_proxyEndpoint = _localEndpoint;
_localEndpoint = "";
switch (pr.ReadByte())
{
case 1://IPv4
for (int i = 0; i < 4; i++)
{
_localEndpoint += pr.ReadByte();
if (i < 3)
{
_localEndpoint += ".";
}
}
break;
case 3://Domain
//readInt - String Length
//readAsciiString - Address
break;
case 4://IPv6
for (int i = 0; i < 16; i++)
{
pr.ReadByte();
}
break;
}
byte[] ports = new byte[2];
for (int i = 1; i >= 0; i--)
{
ports[i] = pr.ReadByte();
}
PacketReader portr = new PacketReader(ports);
_proxyPort = _remotePort;
_remotePort = portr.ReadUShort();
_localEndpoint += ":" + _remotePort;
Text = "Port " + _localPort + " - " + _remotePort + "(Proxy" + _proxyPort + ")";
Console.WriteLine("[socks5] From {0} to {1} (Proxy {2})", _remoteEndpoint, _localEndpoint, _proxyEndpoint);
}
_socks5++;
return Results.Continue;
}
else if (tcpData.Length == 3 && pr.ReadByte() == 5)
{
_socks5 = 1;
return Results.Continue;
}
Console.WriteLine("Connection on port {0} did not have a MapleStory Handshake", _localEndpoint);
return Results.CloseMe;
}
var kvp = MapleProtocol.ParseHandshake(pr.ToArray(), pArrivalTime);
if (!kvp.HasValue)
{
return Results.CloseMe;
}
_protocol = kvp.Value.Key;
var hs = kvp.Value.Value;
mPacketList.Items.Add(hs.GetListViewItem());
_packets.Add(hs);
ListView.Columns.Clear();
ListView.Columns.AddRange(_protocol.GetListViewHeaders());
MainForm.SearchForm.RefreshOpcodes(true);
}
if (pTCPPacket.SourcePort == _localPort) ProcessTCPPacket(pTCPPacket, ref _outboundSequence, _outboundBuffer, _protocol.OutboundStream, pArrivalTime);
else ProcessTCPPacket(pTCPPacket, ref _inboundSequence, _inboundBuffer, _protocol.InboundStream, pArrivalTime);
return Results.Continue;
}
internal Results BufferTCPPacket(TcpPacket pTCPPacket, DateTime pArrivalTime)
{
if (pTCPPacket.Fin || pTCPPacket.Rst)
{
mTerminated = true;
Text += " (Terminated)";
return mPackets.Count == 0 ? Results.CloseMe : Results.Terminated;
}
if (pTCPPacket.Syn && !pTCPPacket.Ack)
{
mLocalPort = (ushort)pTCPPacket.SourcePort;
mRemotePort = (ushort)pTCPPacket.DestinationPort;
mOutboundSequence = (uint)(pTCPPacket.SequenceNumber + 1);
Text = "Port " + mLocalPort + " - " + mRemotePort;
startTime = DateTime.Now;
try
{
mRemoteEndpoint = ((PacketDotNet.IPv4Packet)pTCPPacket.ParentPacket).SourceAddress.ToString() + ":" + pTCPPacket.SourcePort.ToString();
mLocalEndpoint = ((PacketDotNet.IPv4Packet)pTCPPacket.ParentPacket).DestinationAddress.ToString() + ":" + pTCPPacket.DestinationPort.ToString();
Console.WriteLine("[CONNECTION] From {0} to {1}", mRemoteEndpoint, mLocalEndpoint);
return Results.Continue;
}
catch
{
return Results.CloseMe;
}
}
if (pTCPPacket.Syn && pTCPPacket.Ack) { mInboundSequence = (uint)(pTCPPacket.SequenceNumber + 1); return Results.Continue; }
if (pTCPPacket.PayloadData.Length == 0) return Results.Continue;
if (mBuild == 0)
{
byte[] tcpData = pTCPPacket.PayloadData;
if (pTCPPacket.SourcePort == mLocalPort) mOutboundSequence += (uint)tcpData.Length;
else mInboundSequence += (uint)tcpData.Length;
ushort length = (ushort)(BitConverter.ToUInt16(tcpData, 0) + 2);
byte[] headerData = new byte[tcpData.Length];
Buffer.BlockCopy(tcpData, 0, headerData, 0, tcpData.Length);
bool mIsKMS = false;
PacketReader pr = new PacketReader(headerData);
if (length != tcpData.Length || tcpData.Length < 13)
{
if (socks5 > 0 && socks5 < 7)
{
if (pr.ReadByte() == 5 && pr.ReadByte() == 1)
{
pr.ReadByte();
mProxyEndpoint = mLocalEndpoint;
mLocalEndpoint = "";
switch (pr.ReadByte())
{
case 1://IPv4
for (int i = 0; i < 4; i++)
{
mLocalEndpoint += pr.ReadByte();
if (i < 3)
{
mLocalEndpoint += ".";
}
}
break;
case 3://Domain
//readInt - String Length
//readAsciiString - Address
break;
case 4://IPv6
for (int i = 0; i < 16; i++)
{
pr.ReadByte();
}
break;
}
byte[] ports = new byte[2];
for (int i = 1; i >= 0; i--)
{
ports[i] = pr.ReadByte();
}
PacketReader portr = new PacketReader(ports);
mProxyPort = mRemotePort;
mRemotePort = portr.ReadUShort();
mLocalEndpoint += ":" + mRemotePort;
Text = "Port " + mLocalPort + " - " + mRemotePort + "(Proxy" + mProxyPort + ")";
Console.WriteLine("[socks5] From {0} to {1} (Proxy {2})", mRemoteEndpoint, mLocalEndpoint, mProxyEndpoint);
}
socks5++;
return Results.Continue;
}
else if (tcpData.Length == 3 && pr.ReadByte() == 5)
{
socks5 = 1;
return Results.Continue;
}
Console.WriteLine("Connection on port {0} did not have a MapleStory Handshake", mLocalEndpoint);
return Results.CloseMe;
}
pr.ReadUShort();
ushort version = pr.ReadUShort();
byte subVersion = 1;
string patchLocation = pr.ReadMapleString();
byte[] localIV = pr.ReadBytes(4);
byte[] remoteIV = pr.ReadBytes(4);
byte serverLocale = pr.ReadByte();
if (serverLocale > 0x12)
{
return Results.CloseMe;
}
if (serverLocale == 0x02 || (serverLocale == 0x01 && version > 255)) mIsKMS = true;
else mIsKMS = false;
if (mIsKMS)
{
int test = int.Parse(patchLocation);
version = (ushort)(test & 0x7FFF);
subVersion = (byte)((test >> 16) & 0xFF);
}
else if (patchLocation.All(character => { return character >= '0' && character <= '9'; }))
{
if (!byte.TryParse(patchLocation, out subVersion))
Console.WriteLine("Failed to parse subVersion");
}
mBuild = version;
mLocale = serverLocale;
mPatchLocation = patchLocation;
mOutboundStream = new MapleStream(true, mBuild, mLocale, localIV, subVersion);
mInboundStream = new MapleStream(false, mBuild, mLocale, remoteIV, subVersion);
// Generate HandShake packet
Definition definition = Config.Instance.GetDefinition(mBuild, mLocale, false, 0xFFFF);
if (definition == null)
{
definition = new Definition();
definition.Outbound = false;
definition.Locale = mLocale;
definition.Opcode = 0xFFFF;
definition.Name = "Maple Handshake";
definition.Build = mBuild;
DefinitionsContainer.Instance.SaveDefinition(definition);
}
{
string filename = "Scripts" +
Path.DirectorySeparatorChar + mLocale.ToString() +
Path.DirectorySeparatorChar + mBuild.ToString() +
Path.DirectorySeparatorChar + "Inbound" +
Path.DirectorySeparatorChar + "0xFFFF.txt";
if (!Directory.Exists(Path.GetDirectoryName(filename))) Directory.CreateDirectory(Path.GetDirectoryName(filename));
if (!File.Exists(filename))
{
string contents = "";
contents += "using (ScriptAPI) {\r\n";
contents += "\tAddShort(\"Packet Size\");\r\n";
contents += "\tAddUShort(\"MapleStory Version\");\r\n";
contents += "\tAddString(\"MapleStory Patch Location/Subversion\");\r\n";
contents += "\tAddField(\"Local Initializing Vector (IV)\", 4);\r\n";
contents += "\tAddField(\"Remote Initializing Vector (IV)\", 4);\r\n";
contents += "\tAddByte(\"MapleStory Locale\");\r\n";
if (mRemotePort == 8484 && ((mLocale == MapleLocale.GLOBAL && version >= 160) ||
(mLocale == MapleLocale.TAIWAN && version >= 176) ||
(mLocale == MapleLocale.CHINA && version >= 122)))
contents += "\tAddByte(\"Unknown\");\r\n";
contents += "}";
File.WriteAllText(filename, contents);
}
}
MaplePacket packet = new MaplePacket(pArrivalTime, false, mBuild, mLocale, 0xFFFF, definition == null ? "" : definition.Name, tcpData, (uint)0, BitConverter.ToUInt32(remoteIV, 0));
if (!mOpcodes.Exists(kv => kv.First == packet.Outbound && kv.Second == packet.Opcode)) // Should be false, but w/e
{
mOpcodes.Add(new Pair<bool, ushort>(packet.Outbound, packet.Opcode));
}
mPacketList.Items.Add(packet);
mPackets.Add(packet);
MainForm.SearchForm.RefreshOpcodes(true);
Console.WriteLine("[CONNECTION] MapleStory V{2}.{3} Locale {4}", mLocalEndpoint, mRemoteEndpoint, mBuild, subVersion, serverLocale);
}
if (pTCPPacket.SourcePort == mLocalPort) ProcessTCPPacket(pTCPPacket, ref mOutboundSequence, mOutboundBuffer, mOutboundStream, pArrivalTime);
else ProcessTCPPacket(pTCPPacket, ref mInboundSequence, mInboundBuffer, mInboundStream, pArrivalTime);
return Results.Continue;
}
internal Results BufferTCPPacket(TcpPacket pTCPPacket, DateTime pArrivalTime)
{
if (pTCPPacket.Fin || pTCPPacket.Rst)
{
mTerminated = true;
Text += " (Terminated)";
if (mPackets.Count == 0)
{
// f**k
return Results.CloseMe;
}
else
{
return Results.Terminated;
}
}
if (pTCPPacket.Syn && !pTCPPacket.Ack)
{
mLocalPort = (ushort)pTCPPacket.SourcePort;
mRemotePort = (ushort)pTCPPacket.DestinationPort;
mOutboundSequence = (uint)(pTCPPacket.SequenceNumber + 1);
Text = "Port " + mLocalPort.ToString();
startTime = DateTime.Now;
mRemoteEndpoint = ((PacketDotNet.IPv4Packet)pTCPPacket.ParentPacket).SourceAddress.ToString() + ":" + pTCPPacket.SourcePort.ToString();
mLocalEndpoint = ((PacketDotNet.IPv4Packet)pTCPPacket.ParentPacket).DestinationAddress.ToString() + ":" + pTCPPacket.DestinationPort.ToString();
Console.WriteLine("[CONNECTION] From {0} to {1}", mLocalEndpoint, mRemoteEndpoint);
return Results.Continue;
}
if (pTCPPacket.Syn && pTCPPacket.Ack) { mInboundSequence = (uint)(pTCPPacket.SequenceNumber + 1); return Results.Continue; }
if (pTCPPacket.PayloadData.Length == 0) return Results.Continue;
if (mBuild == 0)
{
if (pTCPPacket.PayloadData.Length < 13) return Results.CloseMe;
byte[] tcpData = pTCPPacket.PayloadData;
//mBuild = (ushort)(tcpData[2] | (tcpData[3] << 8));
bool mIsKMS = false;
PacketReader pr = new PacketReader(tcpData);
pr.ReadShort();
ushort version = pr.ReadUShort();
var pos = pr.Position;
{
var shrt = pr.ReadShort();
if (shrt < 0 || shrt > 0x0020)
{
return Results.CloseMe;
}
}
pr.Reset(pos);
string patchLocation = pr.ReadMapleString();
byte[] localIV = pr.ReadBytes(4);
byte[] remoteIV = pr.ReadBytes(4);
byte serverLocale = pr.ReadByte();
if (pr.Remaining > 0 || serverLocale > 0x12)
{
return Results.CloseMe;
}
if (serverLocale == 0x02 || (serverLocale == 0x01 && version > 255)) mIsKMS = true;
else mIsKMS = false;
if (mIsKMS)
{
int test = int.Parse(patchLocation);
ushort t1 = (ushort)(test & 0x7FFF);
int t2 = (test >> 15) & 1;
int t3 = (test >> 16) & 0xFF;
Console.WriteLine("Logging KMS connection. Version {0} | {1} | {2}", t1, t2, t3);
mBuild = t1;
}
else
{
mBuild = version;
}
mLocale = serverLocale;
mPatchLocation = patchLocation;
mOutboundStream = new MapleStream(true, mBuild, mLocale, localIV);
mInboundStream = new MapleStream(false, (ushort)(0xFFFF - mBuild), mLocale, remoteIV);
mInboundSequence += (uint)tcpData.Length;
// Generate HandShake packet
Definition definition = Config.Instance.GetDefinition(mBuild, mLocale, false, 0xFFFF);
if (definition == null)
{
definition = new Definition();
definition.Outbound = false;
definition.Locale = mLocale;
definition.Opcode = 0xFFFF;
definition.Name = "Maple Handshake";
definition.Build = mBuild;
Config.Instance.Definitions.Add(definition);
}
{
string filename = "Scripts" +
Path.DirectorySeparatorChar + mLocale.ToString() +
Path.DirectorySeparatorChar + mBuild.ToString() +
Path.DirectorySeparatorChar + "Inbound" +
Path.DirectorySeparatorChar + "0xFFFF.txt";
if (!Directory.Exists(Path.GetDirectoryName(filename))) Directory.CreateDirectory(Path.GetDirectoryName(filename));
if (!File.Exists(filename))
{
string contents = "";
contents += "using (ScriptAPI) {\r\n";
contents += "\tAddShort(\"Packet Size\");\r\n";
contents += "\tAddUShort(\"MapleStory Version\");\r\n";
contents += "\tAddString(\"MapleStory Patch Location\");\r\n";
contents += "\tAddField(\"Local Initializing Vector (IV)\", 4);\r\n";
contents += "\tAddField(\"Remote Initializing Vector (IV)\", 4);\r\n";
contents += "\tAddByte(\"MapleStory Locale\");\r\n";
contents += "}";
File.WriteAllText(filename, contents);
}
}
MaplePacket packet = new MaplePacket(pArrivalTime, false, mBuild, mLocale, 0xFFFF, definition == null ? "" : definition.Name, tcpData);
if (!mOpcodes.Exists(kv => kv.First == packet.Outbound && kv.Second == packet.Opcode))
{ // Should be false, but w/e
mOpcodes.Add(new Pair<bool, ushort>(packet.Outbound, packet.Opcode));
}
mPacketList.Items.Add(packet);
mPackets.Add(packet);
MainForm.SearchForm.RefreshOpcodes(true);
Console.WriteLine("[CONNECTION] MapleStory V{2}.{3} Locale {4}", mLocalEndpoint, mRemoteEndpoint, mBuild, patchLocation, serverLocale);
}
if (pTCPPacket.SourcePort == mLocalPort) ProcessTCPPacket(pTCPPacket, ref mOutboundSequence, mOutboundBuffer, mOutboundStream, pArrivalTime);
else ProcessTCPPacket(pTCPPacket, ref mInboundSequence, mInboundBuffer, mInboundStream, pArrivalTime);
return Results.Continue;
}
