Reversing Spellborn

Quick answer again sorry, I will try to explain as much as possible before updating the doc :

So after the prelogin, client wants a S2C_CS_LOGIN packet, if you send two dwords with 0 you will have the character creation screen.

 

About the packet tracing :

With IDA I do static analysis : Open SBPacket.dll in IDA, go in exports, ALT+T and search for PACKET_NAME (S2C_CS_LOGIN for instance). You will find all the methods related to it (CTRL+T => next find). Look for the ReadMessage method and explore it. What does it read ? It will tell you the layout of the packet (but not the meaning of each field).

For simple packet reading the ReadMessage method can be enough, but for bigger one it can be hard to understand what the data means without context.

In Sb_client.exe, SBGame.dll and SBBase.dll there is a lot of "callback" like onLogin etc attached to character classes etc. In "Imports" this time, search for your packet name, then go to the rdata section where it is imported (declared). Check for the XREF (cross references) to see where it is called in the code : voila, this is your context.

In general, d_mmos.dll include Sb_client.exe functions. So basically in Sb_client.exe you have plenty of function actually calling the callback after a message has been received. In the doc I will try to make a picture of all this stuff.

 

Then to perform dynamic analysis, I use Ollydbg. Breaking on the ReadMessage func is a good start because by looking in the call stack you can see who called this method (context!). Then I comment the assembly when I see something interesting to understand how the data is handled. If you do not find the ReadMessage function you want (because OllyDbg does not display all the exported name for one function, and as said in the doc, sometimes this is the same code for reading different packets) : use CFF Explorer. Load the SBPacket.dll, in export table find the function you want, and look at the RVA field. Then in OllyDbg, CTRL+F, check RVA radio button, select SBPacket DLL, and copy/paste the RVA found in CFF Explorer : voila!

I recommend you to use a modified version of OllyDbg, like the one available on legend of r4ndom. (but I don't know why syntax highlighting does not work for me...).

 

I recommend you to use this process for simple packets at first, because beginning directly with the character stuff can be scary! As you gain understanding about the global process, you will find more quickly what you need. It's really a "learn by doing stuff", and it's very exciting! So to begin I would recommend to not read my documentation because what is cool with TCoS is that  the learning curve for reversing it is linear-like. (it's easy at the beginning, and then character stuff is a bit harder).

I just wand to remind that I am not a professional reverser, it's my first time doing it so there is a big chance that there are other techniques more powerful than what I do!

 

Sorry for this short answer, I hope it can help. I have a lot of work these days so on my "spellborn time" I focus more on reversing than publishing doc/communicating, as the reversing is the critical part. I should have time before the end of the week to update the doc, I hope.

 

P.S: thanks for the world tricks, save me a lot of clicking time!