How To Hack MMORPG games "Online games" Using WPE

Here is a tutorial for WPE:

SO WHAT DOES WPE ACTUALLY DO?

when you start recording a program, you will record what it sends to the server.
so when you say "hi" on a chat
it will send a packet to the server with the message "hi" in it

there is a big chance u will find something like this
000000: 6d 73 67 00 68 69 00 00 00 00 00 00 00 00 00 00 msg.hi..........

this means,
the 6d 73 67 00 68 69 00 00 00 00 00 00 00 00 00 00 is the hex
and the msg.hi.......... is the ASCII

so this
6d 73 67 00 68 69 00 00 00 00 00 00 00 00 00 00 <in hex
means this
msg.hi..........
in ASCII

pretty simple right ^^
so that means
6d 73 67 00 68 69 00 00 00 00 00 00 00 00 00 00
msg.hi..........

see, the msg part in ascii
is 6d 73 67
and the hi part in ascii
is 68 69

so that is what the chat sends to the server
msg means its a message
hi is what the message is

wpe is used for editing this information
so when you try to filter something.
what it does is simple.

when you type 6d 73 67 in search
and 00 00 00 in modify
the packet will be modified into
....hi..........

there are also several ascii into hex translators
so if you want to change something in a packet its really easy.


So now we are done on learning what WPE ACTUALLY DOES! Its time for us to understand how to use it.

WPE Pro Tutorial

We'll be using a game called Vagabond's Quest 2. There are a few reasons why this game was picked. Firstly, it's beta. That means it's still under development and there are likely to be bugs. More than likely, the game's security is on the low-end and probably won't catch on to packet editors yet. Secondly, it's a simple, clean client. There's not a lot of data transfer at all. This makes it easy to sniff and watch packets. The game code is very simple and after you see the packets you'll know what I mean.

1] Run wpe



Start up wpe and make sure your screen looks something like mine.


2] Run your target program



In this case, run vagabond's quest 2 beta. I'll refer to this as vq2 from now on.


3] Specify your target program



In wpe, hit the <target program> button. Find vq2 from the list, select it, hit open.


4] Start logging [sniffing]



let's get to sniffin. hit the triangular button that says "start logging" when you roll your mouse over it. notice the packet meter. each time a packet is sent or received, the number will increment by 1.


5] send a message or watch closely



quickly send a message or watch what happens in the game closely. recognize when text is sent, when an action is sent, etc. everything you see is most likely delivered in the form of a packet, which you will be looking at in a second. i would recommend typing in something like "hi."



6] open wpe back up and stop logging



at this point you have all the information you need. hit the "stop logging" button.


7] look at the packets



For this example, i have several packets. the function tells you whether the packet was received [recv] or sent [send]. the packets you receive are almost irrelevant, they only show you the data the server sent you. you can't do a whole lot with this. a packet editor cannot edit packets sent to your computer, only packets you send to the server. so look at the packets with the tag "send."

my packet sent is 20 hi.. the 20 is the command to send text. hi is what you sent. the two periods in most cases signal that the packet has ended. you can figure out other packet sends and their commands by experimenting further. go back and enable logging while you click some buttons or just send more text. you're only going to figure this out by trying for yourself.

the source is where the packet comes from, it's followed by the port. my ip address is sent with packets i send, with a port that has been opened for access to this game. the destination is where i am sending my packet, or the server's ip address. it also uses a port. size indicates how big the packet is obviously, but the packet itself looks like how it appears in the source and destination. the function column has converted the packet code into text you can understand...

look again at the packet i sent. 32 30 20 68 69 0D 0A. 32 and 30 are integers [32 = 2, 30 = 0]. together they send the command 20 to the server, which could only be the command to send a message to everyone in the chatroom. any number that starts with a 3 is followed by it's integral value after it [30 = 0, 31 = 1, 32 = 2, etc]. the 20 represents a space, followed by 68 and 69. each of these represents a letter [68 = h, 69 = i .. notice the pattern]. 0D 0A will signal the end of the packet, also notice this is on every other packet too.

what would happen if you sent the following packet: 32 30 20 68 69 20 68 69 0D 0A
break it down: you got 32 30 (20). that triggers a text-to-everyone type of function on the server to process. it realizes that you want to say something, now it decides what. 68 69 will print "hi." 20 is a space, and you just repeated the code twice, so the output would be: "hi hi hi." quite annoying, i woudln't recommend sending a packet like this. but how do you send the packet?


8] go back to wpe to send your first packet



not convinced that packet editors are cool? let's send your first packet to the server, with no interaction at all with the game client. just simple packets of data. maybe this will help you understand how most online applications/games work. in wpe, click on the <send> tab [it's on the actions console]. this is where wpe pro really shines. it will do all the dirty work of copying the packet and sending it for you with all the needed data automatically collected. in older versions, this became a long process that required some patience. first of all, right click on the packet of data you want to send to the server, such as the text that said "hi." move down to select either "send." if you hit send, go back to your game and you will see that text appeared on the screen that you didn't even type. you didn't believe me did you?

what just happened? you just sent a packet of data, identical to the one you just sent previously. the only difference: the code was carried out in the game by a simple command button. by sending the packet, you sent the same message, but without pushing any buttons. it's just the same, and hard to grasp at first, but it all comes down to data. whatever you send will get processed. the game may put restrictions on you in the client [such as having to wait a second before entering another line of text]. these are where packet editors become very handy, because you're no longer going through the restrictions of the client. you have direct access to the packets and the rate at which they are sent, or what is contained in them. from here, you can use wpe to have packets sent at a constant, automated rate [i would not recommend this for making flooders, it's not really that impressive and it will probably result in your account being banned if the game uses moderators, and vq2 does].



9] adding packets to your send list


if you want to send a chain of packets at once, or you just want to be able to store them, save them, and manipulate them in an organized fashion, you should know how to send them to the packet list. right click on any packet sent [i.e. "hi"] and move down to "add to send list." this will place that particular packet into a list. double click on the packet to edit the data inside of it. be careful not to adjust the size unless you are adding on to the packet and remembering to include the 0D 0A statements at the end. you must check the box next to the packet before sending it, but once you are ready to send, just click the play button. whichever packets have a checkmark will send simultaneously.

* troubleshooting: in the event that your packets don't send, you need to do one of the following:

go to the original sent packet and right click on it. move down to "set send list with this socket id." sometimes the socket id will change, and if it doesn't match, your packets won't send.

most of the time it should be fine if you maintain a connection with the server, but if you for some reason lose the connection, or close the program, etc. then you need to adjust that socket id. if you find that doesn't work, re-log some packets that you send [repeat step 5-6] and try sending that socket id to the list.

if your sends don't work at this point you are doing something wrong [such as you forgot to choose the target program, if it happened to close]. re-select your program as the target program.



10] packet filtering


The final thing i'll show you is packet filtering. A filter will look for a packet being sent [not received] and it will change it to something else. i have not found a use for this except for maybe setting up a script or something. say you want to type "message" in the game and instead of that appearing, you want the text "hello how are you?" this is quite easy to setup. try to get around in wpe doing the following:

go to the <filters> tab. double click filter 1 to open it up and configure it.

under mode: select <advance>. because packets you modify in normal mode must be the same length as the packet sent, this can cause you lots of grief [thanks to realmhog for pointing this out to me in an earlier version of wpe]. just trust me when saying advanced mode is better, and you are less prone to find problems with this mode.

enter the same data in the search column as the packet you sent. if you add the packet to your list and open it up, you can select the packet and copy it. this becomes useful for long packets of data. in the example we used to send the text "hi" to the server, the code was: 32 30 20 68 69 0D 0A. enter that in the search column. next enter in the modify column: 32 30 20 68 69 20 68 69 0D 0A.

The above will search [or filter] any packets that match 32 30 20 68 69 0D 0A and convert it to 32 30 20 68 69 20 68 69 0D 0A. before anything else, make sure you select the checkmark next to the "filter 1." hit the enable "enable filter" button. this is important to turn your filter on and off, so don't forget to do this or your filter won't even activate. finally, type "hi" in the game now. notice something odd? you will notice that what shows up is not exactly what you typed. this is because before your packet was sent to the server, it was modified.

There are a few other options included in packet filtering, but it's pretty simple really. the biggest challenge for you is finding a use for filtering the packets. the whole point is to modify an outgoing packet. most of the other options on the filter dialog i have never used. I have used the <block> function before which will simply block the packet from ever being sent to the server. some of the packet formats may differ, such as the difference between winsock 1.1 and 2.

*note: Sometimes in VQ2 when packet filtering, you need to type something else to see the filter. For example: If you just type "hi", the server may send nothing back, but your packet was filtered. You can send a blank message the second time.

Understanding packet filters
If you really want to understand more, just take the tutorial i wrote and use it to help give you a general understanding of packets. I won't spoon feed you all the how-to's and information, go figure it out. Seriously, play with the packet editor and see what happens. You're never going to learn anything unless you go and try to actually figure it out.

Final note: Be careful when using packet editors. Some games don't allow the manipulation of packets, and if they detect it they will ban you. Remember that this tutorial was written for educational purposes only and no responsibility is taken for how you use the programs or any of the WPE tutorials.