What's the current status of Dofus Unity Emulation/Research/RE?

[Sif#6432]

Hey, sorry if this question was asked before, is a bit hard to track all things that are in French when I don't know much French (and half the conversations are meeming xD)

Lately I've been interested in checking Dofus emulation again, but the change from Flash to Unity is a bit step and I'm not that familiar with reverse engineering. The last time I checked was when the protobuf protocol and the client wasn't obfuscated but from what I read here that has changed a lot

So… What's the status of Dofus Unity right now? So far what I know is this:

- protobufs and function signatures are rotated each updated
- There's no way to automatically "de-obfuscate that" other than manual analysis and comparing with old source code?
- I haven't found anything regarding connection, do they still have RSA handshakes or related during client connection or most of it is done by the zaapi client and client tokens?

Other than that I don't know much and would like to know what other stuff the community has found that I might have missed, cheers!

 

[sup#3894]

Hey, sorry if this question was asked before, is a bit hard to track all things that are in French when I don't know much French (and half the conversations are meeming xD)

Lately I've been interested in checking Dofus emulation again, but the change from Flash to Unity is a bit step and I'm not that familiar with reverse engineering. The last time I checked was when the protobuf protocol and the client wasn't obfuscated but from what I read here that has changed a lot

So… What's the status of Dofus Unity right now? So far what I know is this:

- protobufs and function signatures are rotated each updated
- There's no way to automatically "de-obfuscate that" other than manual analysis and comparing with old source code?
- I haven't found anything regarding connection, do they still have RSA handshakes or related during client connection or most of it is done by the zaapi client and client tokens?

Other than that I don't know much and would like to know what other stuff the community has found that I might have missed, cheers!

1) yes protobufs are rotated
2) there are ways, you gotta remap every build by analysing asm / or heuristics at runtime when receiving packets by checking values, struct etc
3) no, protocol is plain text, 0 encryption

 

[sup#3894]

4) if you focus on a specific dofus build, you can determine all packets and use the same protos forever and build your server afterward

 

[Sif#6432]

1) yes protobufs are rotated
2) there are ways, you gotta remap every build by analysing asm / or heuristics at runtime when receiving packets by checking values, struct etc
3) no, protocol is plain text, 0 encryption

Great thank you!

For 2nd, is there some open source examples of this? Ask I mentioned my RE knowledge is almost nil, I do know the whole ill2cpp tools and such but is there stuff beyond that?

I saw your work with the unity entity explorer for the elio portals, really cool!

 

[Sif#6432]

4) if you focus on a specific dofus build, you can determine all packets and use the same protos forever and build your server afterward

That's what I thought, is kind of annoying for creating servers since you can't sniff future versions but I'd guess that is the only way, thank you for the clarification!

 

[sup#3894]

Great thank you!

For 2nd, is there some open source examples of this? Ask I mentioned my RE knowledge is almost nil, I do know the whole ill2cpp tools and such but is there stuff beyond that?

I saw your work with the unity entity explorer for the elio portals, really cool!

I'm relatively new in the D3 scene so I don't really know.. But the business behind it is so big that I doubt you will find anything public

 

[Sif#6432]

I see, always has been the case since older version of Dofus, was wondering if that changed, in any case thank you! I'll just continue my IDA journey and see how far I can get, ty!

 

[sup#3894]

I see, always has been the case since older version of Dofus, was wondering if that changed, in any case thank you! I'll just continue my IDA journey and see how far I can get, ty!

take a look at frida-il2cpp-bridge

 

[sup#3894]

might help you as well

 

[sup#3894]

It may also help you [Connectez-vous pour voir ce lien]
Under development but i've added enough features to analyse dofus runtime, hf

 

[sup#3894]

 

[sup#3894]

I've added a static instance analyser and all message parsers appear to be visible from there

 

[sup#3894]

It may help you getting some addresses

 

[Sif#6432]

damn that's nice, thank you! I tried to work with it but since I'm on linux I'm still figuring out how to setup it correctly, it might take me a while but thank you for your work

 

[sup#3894]

damn that's nice, thank you! I tried to work with it but since I'm on linux I'm still figuring out how to setup it correctly, it might take me a while but thank you for your work

If you run dofus with a windows emulator, just plug the dll in the game directory

 

[sup#3894]

If not, you won't be able to use it

 

[Sif#6432]

For future context I had to set

WINEDLLOVERRIDES="winhttp=n,b"

for it to work properly, this is so helpful, thank you again for you work there @sup#3894

 

[Llith#4960]

Do you think it would be possible to map most packets by their order of arrival ? I mean, they pretty much always arrive in the same order, they can overlap or come in a different order sometimes, but on 3 - 4 catch, you should be able to deduce the correct order

 

[Sif#6432]

Do you think it would be possible to map most packets by their order of arrival ? I mean, they pretty much always arrive in the same order, they can overlap or come in a different order sometimes, but on 3 - 4 catch, you should be able to deduce the correct order

Absolutely, I would think that's the easiest way to map a given client version since the protocol changes so often

But I think you need a packet sniffer for that, I'm not sure you can use the inspector for that, you also need to try to identify the commonest "spam" messages like chat messages and map updates and such to have an easier time

I was thinking about it and the best way would be to create a mitm or visual bot that has some predetermined actions that map the most things possible. From my experience on dofus 2 emulation the hardest one to map would be combat data since it has so many messages related to it and it changes based on trigger spells, effects and such

 

[Sif#6432]

A bit of an update, I managed to do the connection work, kinda by luck since it's not complete.

I still haven't found a way to bypass the happi request the client does, but by a struck of luck the client fallback to a socket ip so I can proxy that to get data. As you can see on my console with the token and such, so I just need to create an actual server and it should be good to start emulating I'd guess