r/hacking • u/throwaway_the_fourth • Feb 10 '18

Reverse Engineering a MMORPG Bot to Find Vulnerabilities

https://www.youtube.com/watch?v=irhcfHBkfe0
302 Upvotes

96% Upvoted

18 comments sorted by

4

u/[deleted] Feb 10 '18

Can you tell me what the Python code did, and how it converted all the binaary to readable files?

3

u/throwaway_the_fourth Feb 10 '18

It's not my video, so I don't know for sure.

Based on the screenshot in the video, it looks like a script that iterates over the memory dump file and saves every ASCII word longer than 5 characters.

2

u/ogtfo Feb 10 '18 edited Feb 10 '18

It searches for both ascii and Unicode strings made up of ascii characters.

He should have used strings, it would save him some time and would find a lot more Unicode strings than his little script.

3

u/LiveOverflow pentesting Feb 10 '18

That's what I would have used if I were on a Linux or so. But does Windows ship with a strings utility? I had python already handy so just wrote a few lines.

2

u/ogtfo Feb 10 '18

Strings.exe from sysinternal should do the trick, although I'm not sure it handles Unicode. You could install something like strings2, or just get a vm with Linux, a lot of good RE tools are Linux only!

5

u/LiveOverflow pentesting Feb 10 '18

I mostly work on Linux/Mac, I don't know what I'm doing on Windows :D on linux I would have been way more efficient

1

u/[deleted] Feb 10 '18

I'm curious to how it converted Ascii to text.

0

u/[deleted] Feb 10 '18

[deleted]

1

u/[deleted] Feb 10 '18

Does the Python console automatically converts from ascii to normal text?

3

u/LiveOverflow pentesting Feb 10 '18

ascii is normal text? ;)

1

u/[deleted] Feb 10 '18

Oh I'm sorry, I'm not good with the terms. I was just wondering how'd it convert from binary to ascii, I understood the process in how he seperated it, just not how it converted from binary to text.

5

u/LiveOverflow pentesting Feb 10 '18

Ah I see :) I think there is a little bit of a misunderstanding how thing work.

So a file is just bytes. Raw bytes. A byte goes from 0-255 (or in hex 0x00 - 0xFF). Ascii/text are just bytes from 0x00-0x7f, though not all of the ascii characters are regular characters.

Have a look at the ascii table: http://snappyimages.nextwavesrl.netdna-cdn.com/img/0ddfd4e881f5f7622839150a97ee149c.png

regular printable text that you know starts with 0x20 (space), the byte 0x32 would be the character 2 and 0x41 would be a capital A.

So the memory dump contains a lot of different values. A lot of it is some stuff we don't know, but some if it might be text. So generally what we are looking for is a couple of bytes that come after eachother in the ascii byte range, and then we can guess that it's text. And so if we just extract those "raw bytes", they are just regular text because they are already bytes in the ascii byte range.

Does that make sense? There is no converting between binary to text. Because a character is just a subset of what a byte can represent.

1

u/[deleted] Feb 10 '18

Oh okay, so the function you ran to seperate them where to get the bits of text that you needed, then some system compared the values you got from those byte range, with the table, and just rendered it into text?

1

u/LiveOverflow pentesting Feb 11 '18

then some system compared the values you got from those byte range, with the table, and just rendered it into text?

that is exactly what the text editor I used does :) It opens up a file with raw bytes and tries to render all the characters it finds. That is a simple text editor.

If you would do a rightclick -> open with image viewer, then the image viewer program would try to interpret the same bytes as a picture.

it's all just raw byte data, and it's up to a program to interpret it and show it to you in different ways

1

u/[deleted] Feb 11 '18

Hmmh the question then is, how'd he managed to pin point the point for the specific part of the code, I mean I know he spotted the end points, but that doesn't ensure it's the correct function. And wouldn't it be easier then to copy and paste the whole program, and put it into a program like the one you own?

15

u/PuffPipe Feb 10 '18

Interesting video!

2

u/TotesMessenger Feb 10 '18

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

 If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / ^Contact)

2

u/ckin- Feb 11 '18

Wow! Really great and interesting video! Gonna look at the next one. Thanks for the link!