KOP2 SQL-Injections/Holes

kLabMouse · August 22, 2016

3 hours ago, Totoka said:

Got error 400

same as this github link?

Same.

But detours is mostly for C.

There is a few other similar that can handle __thiscall (class member call).

and the ASM version I shown, is very similar to what I used for years now.

Prototype · October 22, 2016

On 21/8/2016 at 10:45 AM, Totoka said:

GameServer.exe extension

CCharacter.h

looks like a mess, I shall clean it, once i finish the extension. @PCanLearnSkill pointer to function CanLearnSkill.

CCharacter pseudo class


// CCharacter.h
#define CALL_MEMBER(pObject,pMember) (pObject->*(pMember))

#define PCanLearnSkill 0x0053FE10

#define TEXTMAX  0x20
#define SKILLMAX 0x259

class CCharacter {
private:
	void*			pUnknow01;
	char			sID[TEXTMAX];
	char			bUnknow01[0x38];
	unsigned int	pointX1;
	unsigned int	pointY1;
	unsigned int	pointX2;
	unsigned int	pointY2;
	char			bUnknow02[0x10];
	// absolute offset 0x7C
	unsigned int	direction;
	char			bUnknow03[0x18];
	char			mapName[TEXTMAX];
	// absolute offset 0xB8
	char			cityName[TEXTMAX];
	char			bUnknow04[0x10C];
	char			name[TEXTMAX];
	char			bUnknow05[0x3140];
	// absolute offset 0x3350
	struct Skills {
		char  learned;    // flag 0/1, is set when a character has this skill ?
		char  level;      // skill level
		short id;         // skill id
		void *pUnknown1;  // dunno
		void *pUnknown2;  // ...
	} skills[SKILLMAX];
  
	// here is also more bytes, but dont care for now

private:
	// used to find a character skill by id
	Skills* skillByID(unsigned short id);

public:
	bool CanLearnSkill(struct CSkillRecord *pSkill, char nextLv);
};


// CCharacter.cpp
#include <stdio.h>    // printf
#include "TableData.h"
#include "Character.h"

CCharacter::Skills*
CCharacter::skillByID(unsigned short id)
{
	unsigned short it=0;
	for(;it<SKILLMAX;++it) {
		if( skills[it].id == id )
			return &skills[it];
	} return NULL;
}

bool
CCharacter::CanLearnSkill(CSkillRecord *pSkill, char nextLv)
{
	bool res = false;
	{
		Skills* skill = skillByID( pSkill->sID );
		typedef bool(CCharacter::*call_t)(CSkillRecord*,char);
		void *pCall = reinterpret_cast<void*>(PCanLearnSkill);
		call_t call=reinterpret_cast<call_t&>(pCall);
		// calls the original function member
		res = CALL_MEMBER(this,call)(pSkill,nextLv);
		// do extra checks for those very special skills
		if( res ) { // PCanLearnSkill returns true
			// ...
			printf("%d valid!\n", pSkill->sID);
		} else { // PCanLearnSkill returns false
			// ...
			printf("%d invalid!\n", pSkill->sID);
		}
	} return res;
}


//TableData.h
// taked from kop2 source

#pragma once
#define	defSKILL_NAME_LEN			17
#define defSKILL_ICON_NAME_LEN		17
#define defSKILL_JOB_SELECT_NUM		9
#define defSKILL_ITEM_NEED_NUM		8
#define defSKILL_PRE_SKILL_NUM		3
#define defEFFECT_SELF_ATTR_NUM		2
#define defEFFECT_TAR_ATTR_NUM		2
#define defEXPEND_ITEM_NUM			2
#define defSKILL_OPERATE_NUM		3
#define defSKILL_POSE_NUM			10
#define defSKILL_RANGE_SET_SCRIPT	33
#define defSKILL_EFFECT_SCRIPT_LEN	33
#define defSKILL_ACTION_EFFECT		3
#define defSKILL_ITEM_EFFECT		2
#define defSELF_EFFECT_NUM			2

typedef struct CRawDataInfo {
    int				bExist;
	int				nIndex;
	char			szDataName[72];
	unsigned long	dwLastUseTick;
	int				bEnable;
	void*			pData;
	unsigned long	dwPackOffset;
	unsigned long	dwDataSize;
	int				nID;
    unsigned long	dwLoadCnt;

} CRawDataInfo;

typedef struct CSkillRecord: public CRawDataInfo {

	short	sID;
	char	szName[defSKILL_NAME_LEN];
	char    chFightType;
	char	chJobSelect[defSKILL_JOB_SELECT_NUM][2];

	short	sItemNeed[3][defSKILL_ITEM_NEED_NUM][2];
	short	sConchNeed[defSKILL_ITEM_NEED_NUM][3];
	char	chPhase;
	char	chType;
	short	sLevelDemand;
	short	sPremissSkill[defSKILL_PRE_SKILL_NUM][2];
	char	chPointExpend;
	char	chSrcType;
	char	chTarType;
	short	sApplyDistance;
	char	chApplyTarget;
	char	chApplyType;
	char	chHelpful;
	short	sAngle;
	short	sRadii;
	char	chRange;
	char	szPrepare[defSKILL_RANGE_SET_SCRIPT];
	char	szUseSP[defSKILL_EFFECT_SCRIPT_LEN];
	char	szUseEndure[defSKILL_EFFECT_SCRIPT_LEN];
	char	szUseEnergy[defSKILL_EFFECT_SCRIPT_LEN];
	char	szSetRange[defSKILL_EFFECT_SCRIPT_LEN];
	char	szRangeState[defSKILL_EFFECT_SCRIPT_LEN];
	char	szUse[defSKILL_EFFECT_SCRIPT_LEN];
	char	szEffect[defSKILL_EFFECT_SCRIPT_LEN];
	char	szActive[defSKILL_EFFECT_SCRIPT_LEN];
	char	szInactive[defSKILL_EFFECT_SCRIPT_LEN];
	int		nStateID;
	short	sSelfAttr[defEFFECT_SELF_ATTR_NUM];
	short	sSelfEffect[defSELF_EFFECT_NUM];
	short	sItemExpend[defEXPEND_ITEM_NUM][2];
	short	sBeingTime;
	short	sTargetAttr[defEFFECT_TAR_ATTR_NUM];
	short	sSplashPara;
	short	sTargetEffect;
	short	sSplashEffect;
	short	sVariation;
	short	sSummon;
	short	sPreTime;
	char	szFireSpeed[defSKILL_EFFECT_SCRIPT_LEN];
	char	chOperate[defSKILL_OPERATE_NUM];

public:
	short	sActionHarm;
	char	chActionPlayType;
	short	sActionPose[defSKILL_POSE_NUM];
	short	sActionKeyFrme;
	short	sWhop;
	short	sActionDummyLink[defSKILL_ACTION_EFFECT];
	short	sActionEffect[defSKILL_ACTION_EFFECT];
	short	sActionEffectType[defSKILL_ACTION_EFFECT];
	short	sItemDummyLink;
	short	sItemEffect1[defSKILL_ITEM_EFFECT];
	short	sItemEffect2[defSKILL_ITEM_EFFECT];
	short	sSkyEffectActionKeyFrame;
	short   sSkyEffectActionDummyLink;
	short   sSkyEffectItemDummyLink;
	short   sSkyEffect;
	short	sSkySpd;
	short	sWhoped;
	short   sTargetDummyLink;
	short	sTargetEffectID;
	char	chTargetEffectTime;
    short   sAgroundEffectID;
	short	sWaterEffectID;
	char	szICON[defSKILL_ICON_NAME_LEN];
	char	chPlayTime;
	char	szDescribeHint[128];
	char	szEffectHint[128];
	char	szExpendHint[128];
} CSkillRecord;

finally hooks/replace CCharacter::CanLearnSkill at gameserver.exe with this one =P

Hi, this is the function to fix the hack of mob skills on characters, right?

If so, could you explain me how to do it and how to fix it? Kinda please and thanks beforehands.

Totoka · October 22, 2016

7 minutes ago, Prototype said:

Hi, this is the function to fix the hack of mob skills on characters, right?

If so, could you explain me how to do it and how to fix it? Kinda please and thanks beforehands.

* That code is just a handler, it required validations, should be compiled as a Dll, and finally injected into the GameServer.exe;

* Also it has some offsets that must match the same GameServer in order to work properly; Feel free to try it out `the code is commented`.

I also need to re-check the code, and probably with some time I will finish it, as an extension

Prototype · October 24, 2016

On 22/10/2016 at 5:32 AM, Totoka said:

* That code is just a handler, it required validations, should be compiled as a Dll, and finally injected into the GameServer.exe;

* Also it has some offsets that must match the same GameServer in order to work properly; Feel free to try it out `the code is commented`.

I also need to re-check the code, and probably with some time I will finish it, as an extension

Alryt, so much thx!

Going a bit off topic, do you have any decompiler for characterinfo.bin?

Totoka · October 24, 2016

9 hours ago, Prototype said:

Alryt, so much thx!

Going a bit off topic, do you have any decompiler for characterinfo.bin?

No, I do not use decompilers. You could try here:

Totoka · October 24, 2016

~ Status: Skill upgrade extension ~

* config file *

Spoiler

debug = 1;

patch =
{
   list =
   (
       {
           address = 0x00561C66;
           data = "8D05{{C::Character->LearnSkill}}FFD0EBAE";
       }
   );
};

skill =
{
   list =
   (
       {
           id = 62;
           name = "Sword Mastery";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 63;
           name = "Will of Steel";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 64;
           name = "Strengthen";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 65;
           name = "Deftness";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 66;
           name = "Concentration";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 67;
           name = "Greatsword Mastery";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 68;
           name = "Blood Bull";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 70;
           name = "Blood Frenzy";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 74;
           name = "Range Mastery";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 75;
           name = "Windwalk";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 78;
           name = "Firegun Mastery";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 79;
           name = "Vigor";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 80;
           name = "Divine Grace";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 81;
           name = "Phantom Slash";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 82;
           name = "Mighty Strike";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 83;
           name = "Beast Strike";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 84;
           name = "Berserk";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 86;
           name = "Shadow Slash";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 87;
           name = "Poison Dart";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 90;
           name = "Dual Shot";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 93;
           name = "Frozen Arrow";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 94;
           name = "Cripple";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 95;
           name = "Enfeeble";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 96;
           name = "Headshot";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 97;
           name = "Heal";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 98;
           name = "Recover";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 99;
           name = "Soul collide";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 100;
           name = "Spiritual Fire";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 101;
           name = "Tempest Boost";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 102;
           name = "Tornado Swirl";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 103;
           name = "Angelic Shield";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 104;
           name = "Seal of Elder";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 105;
           name = "Shadow Insignia";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 106;
           name = "Energy Shield";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 107;
           name = "Wolf Howl";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 109;
           name = "Dual Sword Mastery";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 112;
           name = "Meteor Shower";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 113;
           name = "MaGMa Bullet";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 116;
           name = "True Sight";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 119;
           name = "Cursed Fire";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 121;
           name = "Abyss Mire";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 122;
           name = "Healing Spring";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 123;
           name = "Stealth";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 124;
           name = "Revival";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 127;
           name = "Tiger Roar";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 200;
           name = "Woodcutting";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 201;
           name = "Mining";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 210;
           name = "Diligence";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 211;
           name = "Current";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 212;
           name = "Conch Armor";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 213;
           name = "Tornado";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 214;
           name = "Lightning Strike";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 215;
           name = "Algae Entangleme";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 216;
           name = "Shell pounds";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 217;
           name = "Tail Wind";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 218;
           name = "Whirlpool";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 219;
           name = "Fog";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 220;
           name = "Lightning Curtai";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 222;
           name = "Break Armor";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 223;
           name = "Rousing";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 224;
           name = "Dart";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 225;
           name = "Harden";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 231;
           name = "Fishing";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 232;
           name = "Salvage";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 241;
           name = "Set Stall";
           level = { by = 1; min = 1; max = 3; }
       },
       {
           id = 254;
           name = "Repair";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 255;
           name = "Crystalline Blessed";
           level = { by = 1; min = 1; max = 10; }
       },
       {
           id = 256;
           name = "Intense Magic";
           level = { by = 1; min = 1; max = 10; }
       }
   );
};

~ pics ~

Most validation `logic is already done, still remaining a lot of testing

V3ct0r · May 7, 2019

Sign In

KOP2 SQL-Injections/Holes

Recommended Posts

kLabMouse 7

Share this post

Link to post

Share on other sites

Prototype 0

Share this post

Link to post

Share on other sites

Totoka 152

Share this post

Link to post

Share on other sites

Prototype 0

Share this post

Link to post

Share on other sites

Totoka 152

Share this post

Link to post

Share on other sites

Totoka 152

Share this post

Link to post

Share on other sites

V3ct0r 2,117

Share this post

Link to post

Share on other sites

Join the conversation