Page 1 of 1

How can I get recvpackets.txt??

Posted: 03 Oct 2022, 04:30
by zhzhdk106
Hi~!
I have confirmed that the bot works normally.
but after the bot has been hunting for about a minute, the connection with the map server is cut off.
To solve this, I tried to create a new recvpackets.txt file with the ragexe.exe file referring to the manual, but it was impossible.
Can you tell me the latest way to extract recvpackets?
Maybe I need to unpack the ragexe.exe file, but I don't know how.
Is there a way to unpack or a site where unpacked ragexe files are shared?
please answer about my question.
thank you

Re: How can I get recvpackets.txt??

Posted: 29 Oct 2022, 19:53
by SkylorD
Download openkore at github, maybe it will be functional as it is marked as Botable (only using Poseidon)

It is bcz we dont have or cant publish bypasses, but evolves use of GameGuard and it is unbreakable)


Our only allowed bypass is

viewtopic.php?t=15

I used to remove it even with the 2019 protection.
It is located nearly of CreateThread.

Notes:
OllyDbg removes the pack automatically.
You could extract it only knowing the serverType date and the map_login packet ID. Below is an script of PoC containing a few list :

https://github.com/FrozenCube/My-Plugin ... nection.pl

Search this pattern at OllyDbg.

A tip would be search mov [ebp+-reg] , packetID
(here i mean any packetID you notice e.g 0xAD0)

You have at least lesser than 5 references and you can break at full packet list.

Some packet for to use as references at patternScan:

https://github.com/OpenKore/openkore/issues/1469

and

https://github.com/OpenKore/openkore/issues/497

The packet list ends at 'push 0x????'

You can extract also breaking additionals (gameGuard) at code that uses 'ecx' (an extensive loop by switch conditional, only useful to get sync_ex packets id, which ends with 2, 2, 0 size)

For to the cryptKeys references are very low, only

'and ecx, 0x7FFF'

or uses [ecx+0x4] if not found.

It does part of first element of an struct. Maybe if stack is unsigned it changes to -0x4

or use PEEK:
It does have two functions :extract keys and packets