Users browsing this thread: 1 Guest(s)
Initial Packet : Client->margin
|
07-08-2009, 09:44 PM,
(This post was last modified: 07-08-2009, 10:10 PM by Neo.)
|
|||
|
|||
Initial Packet : Client->margin
World List Packet
Code: 82 43 0B 00 00 00 00 00 00 00 00 00 00 9F 00 D7 // Packet to Margin Server 1 Code: 81 3b 01 03 00 This is the initial packet sent from client to the margin server. We didnt have it decrypted yet, but one thing comes direct into the eye, when you compare this packet with a part of the wordlist packet. After the 4th Byte (starting with 0x36), the complete packet is just a copy of a part of the world list. The only thing that is 100% clear, is the username there (put in in a hex editor to see what i mean) and the timestamp. The timestamp are the highlighted ef f6 51 4a bytes (little endian format, you have to read them backwads 4a 51 f6 ef and convert them to decimal to get the timestamp). |
|||
07-08-2009, 09:46 PM,
|
|||
|
|||
RE: Initial Packet : Client->margin
worldlist packet has 2 encrypted blobs, so if you dont post it along with this packet (of the same session), then whats the point in comparing...also, you should remove the packet length header, as it only confuses things
|
|||
07-08-2009, 09:48 PM,
|
|||
|
|||
RE: Initial Packet : Client->margin
Yes you are right, i will post the other packet too.
|
|||
07-08-2009, 09:52 PM,
|
|||
|
|||
RE: Initial Packet : Client->margin
and dont say "TURN IT BACKWARDS", just say its in little endian format (hex workshop has buttons to set little endian or big endian, and then in the pane on the right you can see the correct time or uint32 or whatever)
|
|||
07-08-2009, 10:12 PM,
|
|||
|
|||
RE: Initial Packet : Client->margin
Yes its little endian, and hex workshop can set it..but this should describe the packet also for users the dont use hexworkshop or want to raw understand how that works...so in this case this is right, i only want to say how you can alternative convert this values in a valid timestamp .
|
|||
« Next Oldest | Next Newest »
|