structural updates rc4obtainee

This commit is contained in:
sirjonasxx 2018-10-13 14:47:04 +02:00
parent feadc99024
commit b6f546ef4c
6 changed files with 66 additions and 39 deletions

View File

@ -235,6 +235,9 @@ public class HPacket implements StringifyAble {
public void setReadIndex(int number) {
readIndex = number;
}
public void resetReadIndex() {
setReadIndex(6);
}
public boolean isCorrupted() {

View File

@ -58,51 +58,60 @@ public class Rc4Obtainer {
if (DEBUG) System.out.println("[+] send encrypted");
List<byte[]> results = client.getRC4possibilities();
outerloop:
for (byte[] possible : results) {
List<byte[]> cached = client.getRC4cached();
boolean worked = onSendFirstEncryptedMessage(handler, cached);
byte[] encBuffer = new byte[handler.getEncryptedBuffer().size()];
for (int i = 0; i < encBuffer.length; i++) {
encBuffer[i] = handler.getEncryptedBuffer().get(i);
if (!worked) {
worked = onSendFirstEncryptedMessage(handler, client.getRC4possibilities());
if (!worked) {
System.err.println("COULD NOT FIND RC4 TABLE");
}
for (int i = 0; i < 256; i++) {
for (int j = 0; j < 256; j++) {
byte[] keycpy = Arrays.copyOf(possible, possible.length);
RC4 rc4Tryout = new RC4(keycpy, i, j);
if (handler.getMessageSide() == HMessage.Side.TOSERVER) rc4Tryout.undoRc4(encBuffer);
if (rc4Tryout.couldBeFresh()) {
byte[] encDataCopy = Arrays.copyOf(encBuffer, encBuffer.length);
RC4 rc4TryCopy = rc4Tryout.deepCopy();
try {
PayloadBuffer payloadBuffer = new PayloadBuffer();
byte[] decoded = rc4TryCopy.rc4(encDataCopy);
HPacket[] checker = payloadBuffer.pushAndReceive(decoded);
if (payloadBuffer.peak().length == 0) {
handler.setRc4(rc4Tryout);
break outerloop;
}
}
catch (Exception e) {
// e.printStackTrace();
}
}
}
}
}
incomingHandler.unblock();
outgoingHandler.unblock();
}).start();
}
private boolean onSendFirstEncryptedMessage(Handler handler, List<byte[]> potentialRC4tables) {
for (byte[] possible : potentialRC4tables) {
byte[] encBuffer = new byte[handler.getEncryptedBuffer().size()];
for (int i = 0; i < encBuffer.length; i++) {
encBuffer[i] = handler.getEncryptedBuffer().get(i);
}
for (int i = 0; i < 256; i++) {
for (int j = 0; j < 256; j++) {
byte[] keycpy = Arrays.copyOf(possible, possible.length);
RC4 rc4Tryout = new RC4(keycpy, i, j);
if (handler.getMessageSide() == HMessage.Side.TOSERVER) rc4Tryout.undoRc4(encBuffer);
if (rc4Tryout.couldBeFresh()) {
byte[] encDataCopy = Arrays.copyOf(encBuffer, encBuffer.length);
RC4 rc4TryCopy = rc4Tryout.deepCopy();
try {
PayloadBuffer payloadBuffer = new PayloadBuffer();
byte[] decoded = rc4TryCopy.rc4(encDataCopy);
HPacket[] checker = payloadBuffer.pushAndReceive(decoded);
if (payloadBuffer.peak().length == 0) {
handler.setRc4(rc4Tryout);
return true;
}
} catch (Exception e) {
// e.printStackTrace();
}
}
}
}
}
return false;
}
}

View File

@ -15,5 +15,8 @@ public abstract class HabboClient {
this.hConnection = connection;
}
// optional
public abstract List<byte[]> getRC4cached();
public abstract List<byte[]> getRC4possibilities();
}

View File

@ -48,6 +48,11 @@ public class LinuxHabboClient extends HabboClient {
if (DEBUG) System.out.println("* Found flashclient process: " + PID);
}
@Override
public List<byte[]> getRC4cached() {
return new ArrayList<>();
}
private void refreshMemoryMaps() {
String filename = "/proc/"+this.PID+"/maps";

View File

@ -31,6 +31,11 @@ public class WindowsHabboClient extends HabboClient {
super(connection);
}
@Override
public List<byte[]> getRC4cached() {
return new ArrayList<>();
}
@Override
public List<byte[]> getRC4possibilities() {
return null;

View File

@ -106,9 +106,11 @@ public abstract class Handler {
void notifyListeners(HMessage message) {
for (int x = 0; x < 3; x++) {
for (int i = ((List<TrafficListener>)listeners[x]).size() - 1; i >= 0; i--) {
message.getPacket().resetReadIndex();
((List<TrafficListener>)listeners[x]).get(i).onCapture(message);
}
}
message.getPacket().resetReadIndex();
}
public void sendToStream(byte[] buffer) {