structural updates rc4obtainee

This commit is contained in:
sirjonasxx 2018-10-13 14:47:04 +02:00
parent feadc99024
commit b6f546ef4c
6 changed files with 66 additions and 39 deletions

View File

@ -235,6 +235,9 @@ public class HPacket implements StringifyAble {
public void setReadIndex(int number) { public void setReadIndex(int number) {
readIndex = number; readIndex = number;
} }
public void resetReadIndex() {
setReadIndex(6);
}
public boolean isCorrupted() { public boolean isCorrupted() {

View File

@ -58,51 +58,60 @@ public class Rc4Obtainer {
if (DEBUG) System.out.println("[+] send encrypted"); if (DEBUG) System.out.println("[+] send encrypted");
List<byte[]> results = client.getRC4possibilities(); List<byte[]> cached = client.getRC4cached();
outerloop: boolean worked = onSendFirstEncryptedMessage(handler, cached);
for (byte[] possible : results) {
byte[] encBuffer = new byte[handler.getEncryptedBuffer().size()]; if (!worked) {
for (int i = 0; i < encBuffer.length; i++) { worked = onSendFirstEncryptedMessage(handler, client.getRC4possibilities());
encBuffer[i] = handler.getEncryptedBuffer().get(i); if (!worked) {
System.err.println("COULD NOT FIND RC4 TABLE");
} }
for (int i = 0; i < 256; i++) {
for (int j = 0; j < 256; j++) {
byte[] keycpy = Arrays.copyOf(possible, possible.length);
RC4 rc4Tryout = new RC4(keycpy, i, j);
if (handler.getMessageSide() == HMessage.Side.TOSERVER) rc4Tryout.undoRc4(encBuffer);
if (rc4Tryout.couldBeFresh()) {
byte[] encDataCopy = Arrays.copyOf(encBuffer, encBuffer.length);
RC4 rc4TryCopy = rc4Tryout.deepCopy();
try {
PayloadBuffer payloadBuffer = new PayloadBuffer();
byte[] decoded = rc4TryCopy.rc4(encDataCopy);
HPacket[] checker = payloadBuffer.pushAndReceive(decoded);
if (payloadBuffer.peak().length == 0) {
handler.setRc4(rc4Tryout);
break outerloop;
}
}
catch (Exception e) {
// e.printStackTrace();
}
}
}
}
} }
incomingHandler.unblock(); incomingHandler.unblock();
outgoingHandler.unblock(); outgoingHandler.unblock();
}).start(); }).start();
} }
private boolean onSendFirstEncryptedMessage(Handler handler, List<byte[]> potentialRC4tables) {
for (byte[] possible : potentialRC4tables) {
byte[] encBuffer = new byte[handler.getEncryptedBuffer().size()];
for (int i = 0; i < encBuffer.length; i++) {
encBuffer[i] = handler.getEncryptedBuffer().get(i);
}
for (int i = 0; i < 256; i++) {
for (int j = 0; j < 256; j++) {
byte[] keycpy = Arrays.copyOf(possible, possible.length);
RC4 rc4Tryout = new RC4(keycpy, i, j);
if (handler.getMessageSide() == HMessage.Side.TOSERVER) rc4Tryout.undoRc4(encBuffer);
if (rc4Tryout.couldBeFresh()) {
byte[] encDataCopy = Arrays.copyOf(encBuffer, encBuffer.length);
RC4 rc4TryCopy = rc4Tryout.deepCopy();
try {
PayloadBuffer payloadBuffer = new PayloadBuffer();
byte[] decoded = rc4TryCopy.rc4(encDataCopy);
HPacket[] checker = payloadBuffer.pushAndReceive(decoded);
if (payloadBuffer.peak().length == 0) {
handler.setRc4(rc4Tryout);
return true;
}
} catch (Exception e) {
// e.printStackTrace();
}
}
}
}
}
return false;
}
} }

View File

@ -15,5 +15,8 @@ public abstract class HabboClient {
this.hConnection = connection; this.hConnection = connection;
} }
// optional
public abstract List<byte[]> getRC4cached();
public abstract List<byte[]> getRC4possibilities(); public abstract List<byte[]> getRC4possibilities();
} }

View File

@ -48,6 +48,11 @@ public class LinuxHabboClient extends HabboClient {
if (DEBUG) System.out.println("* Found flashclient process: " + PID); if (DEBUG) System.out.println("* Found flashclient process: " + PID);
} }
@Override
public List<byte[]> getRC4cached() {
return new ArrayList<>();
}
private void refreshMemoryMaps() { private void refreshMemoryMaps() {
String filename = "/proc/"+this.PID+"/maps"; String filename = "/proc/"+this.PID+"/maps";

View File

@ -31,6 +31,11 @@ public class WindowsHabboClient extends HabboClient {
super(connection); super(connection);
} }
@Override
public List<byte[]> getRC4cached() {
return new ArrayList<>();
}
@Override @Override
public List<byte[]> getRC4possibilities() { public List<byte[]> getRC4possibilities() {
return null; return null;

View File

@ -106,9 +106,11 @@ public abstract class Handler {
void notifyListeners(HMessage message) { void notifyListeners(HMessage message) {
for (int x = 0; x < 3; x++) { for (int x = 0; x < 3; x++) {
for (int i = ((List<TrafficListener>)listeners[x]).size() - 1; i >= 0; i--) { for (int i = ((List<TrafficListener>)listeners[x]).size() - 1; i >= 0; i--) {
message.getPacket().resetReadIndex();
((List<TrafficListener>)listeners[x]).get(i).onCapture(message); ((List<TrafficListener>)listeners[x]).get(i).onCapture(message);
} }
} }
message.getPacket().resetReadIndex();
} }
public void sendToStream(byte[] buffer) { public void sendToStream(byte[] buffer) {