[Guide] Opcodes, Packets and Reversing

[mika27]

the sniffer don't work for 64bits, and structure are not the same in 32bits and 64 bits. then use 32bits version for sniff

[Epicurus]

 

Step 5 : Once the proper occurrence found corresponding to the opcode handler , we need to identify the structure.

Step 6 : After working on the structure, we need to identify the data to be inserted at each location.

exemple :

RecvData >> player_level ;

RecvData >> player_max_level ;

ect ...

 

Hi mika27,

 

Thanks for this quick tutorial! I'm stuck on Step 5. How can we identify the proper bit order of the guid sequence? We want to end with something like this:

 

    ObjectGuid buttonStream;

 

    buttonStream[7] = recvData.ReadBit();

    buttonStream[0] = recvData.ReadBit();

    buttonStream[5] = recvData.ReadBit();

    buttonStream[2] = recvData.ReadBit();

    buttonStream[1] = recvData.ReadBit();

    buttonStream[6] = recvData.ReadBit();

    buttonStream[3] = recvData.ReadBit();

    buttonStream[4] = recvData.ReadBit();

 

The above was copied from the HandleSetActionButtonOpcode() function defined by the SkyFire devs. How did they know that the guid sequence is 7, 0, 5, 2, 1, 6, 3, 4?

 

Thank you,

Epicurus

 

-------

 Edit

-------

 

I figured it out. I was getting tripped up on the + 24 offset in the 0x1F8C Byte sequence. If I treat it like + 23, I get the correct sequence every time (it matches the sequences already discovered by SkyFire).

[jadedtdt]

I can't seem to find an IDA Pro version, i've googled the version in the guide but the hexrays website seems to only be selling pro licenses for 1189 USD? I don't want to have to pay that much money, I was wondering if you guys used leaked version or just used the free ware, thanks in advance.

[AlterEgo]

I can't seem to find an IDA Pro version, i've googled the version in the guide but the hexrays website seems to only be selling pro licenses for 1189 USD? I don't want to have to pay that much money, I was wondering if you guys used leaked version or just used the free ware, thanks in advance.

No! This is not a warez site and we do not allow links to this crap here.

[MaSoUti]

hi guys, i'm new here and i want to learn how to fix opcodes, please post a good tutorial for fixing an opcode and structure with new links for wow 5.4.8 that we can understand.

 

so that we can fix opcodes too and get this patch stable sooner.

 

if u cant post that because there is team policy or something send me a message for joining team or something...

 

i'm just graduated from university in software engineering. and i want to learn to do this ! tnx

[Zerix]

Well, what do you mean by 'fixing' opcodes? It's not really that simple. If you don't understand IDA, assembly, or the psuedocode IDA provides, then you really won't get anywhere. No guide can really teach that, you'd have to check it out on your own and play around with it. 

 

Name the CDataStore functions, JamClient, and read, write, get and put int functions. It makes the code easier to read and interpret. 

[AlterEgo]

@MaSoUti

It's more than just fixing the opcodes. We already have the opcodes. It's updating the packet structures and game mechanics.

[Scias]

For those whom still trying to figure out how to reverse opcode n stuff, your best bet is to go to 

and look through teh tutorials of basic usage of IDA and then use it with wow.exe