DarkBlizz

There are some programs that take a "snapshot" of the process memory. Then we can diff it before and after typing the username (since I think - not sure though - that the auth file is downloaded and "executed" just before the user types his password).

I think I'll take a look at that in the next days.

Hey guys! I'm new here... trying to help someway...

I'd like to make a simple summary of everything known here:

1) [1] has a pretty decent description of the protocol, except on the parts regarding the successfull login;
2) [2], [3] and [4] suggest that both client and server generates a common key, which is used to encrypt some data exchanged between them (it's to note, however, that some dumps on successfull logins show plain text map and settings xml being transferred);
3) [4], however, says that once it was easy to get this key on WoW (since it was used to simply XOR the contents), but now they are using it as a key for the RC4 encryption (I still didn't follow their protected links yet though);

Now some questions:

1) It was suggested by stormbreaker to read game RAM and check the key generated. I thought that too but how can we retrieve the key generated? I was thinking about getting the calls to encryption methods [5] and try to figure code in its vicinity.
2) It was strongly suggested [4] to look at mangos source code. Maybe its better than Arcemu?

Did I forget something? What do you people think we could do?
Sorry for my english...


[1] http://darkblizz.org/wiki/doku.php?id=bnet2_protcol
[2] http://trevp.net/tls_srp/draft-ietf-tls-srp-10.html#intro
[3] http://forum.gamedeception.net/threads/14426-wow-SRP6-challenge-lookup?14426-=Array
[4] http://www.mmowned.com/forums/wow-memory-editing/231740-understanding-wow-communication-protocol.html
[5] http://darkblizz.org/wiki/doku.php?id=battle.net.dll#known_crypto