Looking Into The Runescape Packets!

[Core-Ruption]

(Program) = to scan the TCP connections from my computer to a server. The program Analyzes the connection and intercepts the packets traveling througth this connection.

Okay so I'm using a program to scan the TCP connections from my computer to a server. The program Analyzes the connection and intercepts the packets traveling througth this connection.

So I read the sticky "401 about runescape" which talks about packets and such. So after reading that I opened up the runescape world 55 and started the (program) then logged in runescape. I stopped the (program) and it had about 12 diffrent packets being sent from the Runescape server (63.31.109.3) to my IP. now there is more I'm guessing that the numbers im about to type are my clients ports and the servers ports.

Client port: 2180

Server port: 43594

I now Stream back the TCP and look at it's contents and this is one of them that seems to be to most interesting.

..
..|....t.
.......X.m.......Pr..=H..m
..u...X.7........[..................|YSp..F:.....,.bO>....j>[email protected]~..E... ......ZI.0.07..U....u..f....}..#i'.....).r.t...M..f.
....~...i....x~...R.Z......g({#+..UgG1.c...B..j..|..j.Z[...K.]..'D.U.<.:...4-c......l.......{.{..3...~8._Kd".}[email protected] have not yet set any recovery questions. It is <col=ff9040>strongly<col=ffff00> recommended that you do so. If you don't you will be <col=ff9040>unable to recover your password<col=ffff00> if you forget it, or it is stolen..`.7z...You have 0 unread messages in your message centre..4.cz...You are not a member. Choose to subscribe and you'll get loads of extra benefits and features..9..z...To change your recovery questions:<br>1) Logout and return to the frontpage of this website.<br>2) Choose 'Set new recovery questions'.....z...To start a subscription:<br>1) Logout and return to the frontpage of this website.<br>2) Choose 'Start a new subscription'...Ez.
.You last logged in <col=ff0000>2 days ago<col=000000> from: %dns...Kz...You do not have a Bank PIN. Please visit a bank if you would like one....Fo...Earn experience and help your friends by using the Assist System..c%...z....
%..o....%[email protected].$.....m.$.....n.$)....o.$b....p.$p....q.$&.&..s.$...&...Friends List - World 55...'..t.$.....u.$.....v.$6....9.....:.....5.....6.....7.....8(....;n....<.....3.....4.....w.$.....x.$.......AUTO.+.M..r.$..K..k.$G.
K...Iron axe.e..K.....Follow...
.Trade with..s
.Req Assist..J......AUTO.9........Welcome to RuneScape...........ad.r.......1..`.........k...&[email protected][email protected]........+...v.........B...........................
..*......,..0.'.....Z............@............)[email protected]....................*..Q...R.v.S...T.#.U...V...W.0.X...h.6..@...
.......................R...L.......(..................T......9..0......._........)...*...+.z.,.E.-.....o.....13.....5".A...;....1......".%..PK6<...~l.".."[email protected][email protected].%!...{.{..QG.....a..{I.....b..G8D;. ...-T.
.c.....VN.b........$...m}...8.6.5.4.3.7.(.........
)...K....
E.....................3....8.6.5.4.3.7.(.......O.D.1.F.=.................,2.....8.6.5.4.3.7.(........+.w...V....o.............:.......8.6.5.4.3.7.(...
.
.%.~
2.H.=...:.1.z.................E....8.6.5.4.3.7.(.......-%'../....a.1...........;....S..Bs....8.6.5.4.3.7.(.......+.)..7....g.5............1....?...8.6.5.4.3.7.(.....
........A....K..............8.0W.{)..8.6.5.4.3.7.(........-%)...K....o................9
.'..(X.8.6.5.4.3.7.(......h..
!.^.'....................S......8.6.5.4.3.7.(.......P.C.0.........+............<-...[..28.6.5.4.3.7.(.......*.!..1....c.3.............>..#.....8.6.5.4.3.7.(........%.#...$.l..r.....
.........QJ.>_.0..8.6.5.4.3.7.(........*.!...'...................VB'3.
...............-........*.!...&......k...........4[D.H.../8.6.5.4.3.7.(.......-%...E....g.5.............9..W,5...8.6.5.4.3.7.(.......*..
./....a..............94.o.e
..8.6.5.4.3.7.(.....................K...............3lY.o]a.8.6.5.4.3.7.(.......%.#..-...._................>.....S..8.6.5.4.3.7.(.......%.#..7....g...............;.
Y.o...8.6.5.4.3.7.(.........%#.^.W.
................b....>..
.....8.6.5.4.3.7.(.........
t
..g..k.e.5.............R.5m.V.W0............-.........%#.`.$......e.............'.;..
..8.6.5.4.3.7.(......
.*.!...$..................#.H.x....8.6.5.4.3.7.(.......-%j
..+...*..............'..Hl...4............-........X
`
^.\
..Z
m.....^
.......$.&.
....8.6.5.4.3.7.(.......+."..%......G..............\..m...8.6.5.4.3.7.(.......*.{../.......-.v...........".jg.r../8.6.5.4.3.7.(.....
...%#...)....(..............5.\......8.6.5.4.3.7.(.......*.'..(...a................P.s%....8.6.5.4.3.7.(........*.!...................t.%...$.l.@..$.q....$.w....%...z..$.m....$.o....$.k.K..$.n....$.v....$.r.M..$.s.&..$.u....%...o..$.p....$.t.'..$.x........ ............g#.......-5.....3z.................F.................
.........(..........
.........#.........T......S......,..................................z......~..........V.S................................................................K.....................................................................5........ki(.r.....
.uc..k......U.0..
...8.6.5.4.3.7.(.......-%j
.7....g.5..............;..N;$...8.6.5.4.3.7.(........%.!....... ................9C.?.....8.6.5.4.3.7.(.......#.#..7.....Y.5..............Z.......18.6.5.4.3.7.(........*.`
..X....r...............Gc.......8.6.5.4.3.7.(.......-%#..7....g..............8..a..< f `...h..=@f.`...l6.< f.`...p`_. [email protected]$./......`..X..P..([email protected]`.HX..P.J(..\[email protected]`.......GX....*.-CP~...P.GH..@..`..X.".-
C~.....-C..P..H..@..`...-CI.X.|[email protected].......]...d......).....^...z.....G.....s.................v....A....X...e([6.2|.9..........7..................|..'$.......4$jxj...... -..q.p........U.+........%y.9i....5.....1.q......E.S..r...............l)[Z,.u......(?.-.o.n......7.D<......1...#.k.....-.8_W_.
.......P[f).......5..a.....o,.Cm.k.......A...U......,.Cn..FW....-..-...G......
..ldZ......7...-........
d.;....E.....~t......\.4.P.f......)...k............+..`3g......
..
......w.G.......
...a...........S....h.W
......
...a...............e..(H.(..z
Q.....+..B..`6....!.....3........ef.Bb.......(..,...j..........
.........`X.,....l.........
.....,......`.W....
.........vc.r.v.
...
..,...........l..(P.(.~\
......
......G..................
.....`(..lX......H.
. ....sG.....
.........fe.p...K.....,g.`.Q..?..........L.3..`.t/8.6.5.4.3.7.(........*.!.\.W.....................T.. @.(..0
.....@(.....V.E...N......
.........,...`@.......
.........df.s...G.....i`..K..6........+.......8.6.5.4.3.7.(.........V
.+..._...{ .............`
..
...+...@..,..<.......X
8.a..x.g..m...K...m....|............{..;O.....+mJ1.1...8.6.5.4.3.7.(........-%`
a.W.......5.|.......s.....n.. P.(.|.5..(H.(..z
J
.
.........ld.Gc.../[email protected][email protected][email protected]...
.......
[email protected]..\.Z.m[6......
........\..-R..f.........
.....JD@..&..
.
.
<........pg.u.Z.........Z..V...........R...
0`V....-C,
.......E..)m.5.........)....Z....(P.+.~Y
...
.
.............
.........X.T
.............q
...........7.@
.........sC...
...........
/...........f
.............
.........\..V.......Z.
0........ja.Rb.B.K....x....g...............e}?.u..8.6.5.4.3.7.(.......%.!..+......1.|..............]..(H.)..*
.......]H.%.
%."....xb.J.........u...E.t..ik............80/.
y...Y....C..Y..............z..
.
.
,.
.

......j8.....~..t.b.z..
.
.
4.
..%..m.%..\$.V....`.$.$......`.${..l.
....Workshop...}.........5m.Z;....s.......r.....\F......h.........x.....F....4.........4[D.H.../8.6.5.4.3.7.(.......-%...E....g.5...............
.T
.........da.e...(..../...........s......................./..
.a`
d.......`.)+C..............
.aX.Y
.........)+....
.T\....%
.
........./.$J
.......
.lg.C..........
..........3...
.V
:
...
.....G.7.
.........;3..
.........*+)......2..
..............
C
8!.........r...
k....}.C.
.
.........,+.%.......$......
.........sg.db...V.F ....,+.'o#......u...E.t..ik.....1........8.6.5.4.3.7.(........+.!...(....................
F
...........l_
....H@....,+:..................
.
....F...X...[......w.. ...b............O.
C&..Y...y...z7....9A..$_7......0.'....G.
[........jg.b.[...D..+].qX...........P
.
.............
......
.....j....P
9&.............&.q.%..7..t.c8..Y.....(.#(T...
c.........b...........`
B
.)h........{......D.
.b...-
.
u......
.nh.k.`.........rV+.............P
.
...
.....TL.B
[email protected]
_...B..\.J.b...........k.3.........pZ
.
E........wd.y.....B@.\...[..............3E....h
.........I.
k.H!<
"
..M.D..\.
.h..H....+........;A..q...,8.6.5.4.3.7.(........%`
0........S..............j.8 /..............
.....Y.$.....i.$m.........V................u.H..
...K..0.......[.....Y._.........
...................[..].._..Y.....f......................................G........G..........................>........................................;.......]...d....
.
G........uf.d.F.
.....)9YJ....
...
.
.........._.{
..O.....E*LIYJ................./lVC;....8.6.5.4.3.7.(........%#..5...e...(........o..
..e.

......`E*LAZR.C...............
..Z^...............
$..D)..;........4.#....IF
z........wa.S...!....b.*..YJ..........u.....FM.......
..?.. ....
8
...........w.
l.G ..@..'.(".....`.a.3...
..-Y.....
......[V.J.6V..P.............w...

..?......
`.:........`..f`..J......=..
....
.....]..N.
.....Y._..!.......N....
......;.......t\................
.v)......x.
.R
..H.......J...F...,...J.......L
..,...J.......d...\...y....G..u.......w.......3...T. ...!.X.".j.#.L.$.*.%.&.&.$.'.&.(.2.).V.*...+. .,.".-....
.....]..N....
.
.........ae.h.b.......
.....I......{..
.....N.............
.
......... XM.
.!.K.).....`.+..py8..T~..)...._8..N.I...
,.
.....K... ..
..... ....
B
..$.YS.Y..E._B....n.$.i.L....,S.....,t.......*\`..T......z..
...............[
..
.........ma.d........
.....J......H............w....."..&.qQ..8.6.5.4.3.7.(.......*.w..-.n...Q.9...............VHSH...8.6.5.4.3.7.(......
.*.!.a.&.i..r..........
..........
.
............>
q..P.7..&.+
8*.;....L.....
........*\`
..*W.................U..................
B.P..@].......J..P.._..........1c.M..L..8.6.5.4.3.7.(.......*.'..1..3./.5.....5...........Y.. ....
.........ie.b..I.I.I.I.I.I.I.V.....
..q...,R..Q......
.
..............
.........W
.T.X..............
...pP_.
.
..
.......H-\+J..W.............w.......................
[email protected].
..... ....
.
.........~NT#
k.
[email protected]....).
G........\+([email protected]......
.

This seems to be quite interesting but I looked back to see were the source is and it comes back to my IP and says that: (MY IP) > (RS2 SERVER)

which means im sending that info to the server.

Take a closer look in the quote above in there it says:

"AUTO.+.M..r.$..K..k.$G.
K...Iron axe.e..K.....Follow...
.Trade with..s
.Req Assist..J......AUTO.9........Welcome to RuneScape"

notice the "iron axe" as soon as I saw this I logged back in and guess what in my hand was a iron axe which means The client sends whats is in your hand to the server? which doesnt make any bit of sense as to how the client would remember this from the last time you loged in?

any help decoding this son of a bitch and were all gonna be rich..

 

[Nullware]

For the last time Runescape is server-side not client-side. All data and information is pulled from the server. The limited amount of information that is saved into your client is matched with the server's value periodically anyway which is why using programs such as ArtMoney will make you have billions of GP but it will disappear as soon as you drop it, bank it, trade it, etc. because your client verifies the value with the server's value.

 

[Core-Ruption]

Yes, Nullware but listen I know thats how it works i'm not a super n00b and if you read the post i said that I read TerranKillers Sticky about how this all works but look below

that is the first connection made to the server and its from my IP --> RS Server

and this is the packet that holds the information i posted in the above reply

 

[Core-Ruption]

LOL!! I tracked the IP of the RS server and look were it took me!

so i'm not sure right now if this is were one of the RS Teams is stationd or what but thats a big f'n House lol!

 

[Nullware]

so i'm not sure right now if this is were one of the RS Teams is stationd or what but thats a big f'n House lol!

That doesn't mean there's an "RS Team" there it just means that's where a server is hosted.

that is the first connection made to the server and its from my IP --> RS Server

Don't you think it's exactly like I said. Your client is verifying things with the server. I'm guessing you'd already logged in and out of the account shortly before so your client had an iron axe in it's memory. When you logged in again it's sending that and other data to be checked with the server. Nothing at all you can do.

 

[Core-Ruption]

darn lol thougth i had something........


thanks tho but wat decrytion method would be used to decryte that?

 

[Nullware]

Sorry I really don't know anything about Packet Encryption/Decryption or even about Packets at all. I do understand the concept of Server-side and Client-side and that's why I was able to tell you what I did. Best of luck finding out what you want.

 

[-John-]

Watch how far you go. The best of hackers that play runescape/played have or has been Ip banned before... Good luck anyways m8. *psst* Track them to the building and take over there Master computer*/psst*

 

[Core-Ruption]

LOL! We could always just go reason with them *COUGH* *COUGH* lol thanks for the feedback and yesi have proxies in order im not that dumb lol...

 

[aronj]

I bet that's Zezima's house J/k

Someone should really stop by that house though rofl.

 

[pescados666]

That doesn't mean there's an "RS Team" there it just means that's where a server is hosted.


Don't you think it's exactly like I said. Your client is verifying things with the server. I'm guessing you'd already logged in and out of the account shortly before so your client had an iron axe in it's memory. When you logged in again it's sending that and other data to be checked with the server. Nothing at all you can do.

I think he's saying that's like a cashed version. If you were to send a false packet to the server saying that you're holding a whip rather then an axe, then it would have an axe in your hands but soon as you try and use it, it would convert back to an iron axe.

Also, I don't see how you could tell what that code means through all the periods and random numbers with out some sort of knowlage of what it means to begin with.

Perhaps your password is encypted in there also

 

[Core-Ruption]

Ya i was also thinking that If you type the username with a false password it would have to verify that password but how by sending you a password througth a packet right? So the packet would need to be decrytped but i think this is something of Jagex's own incryption? so maybe we can figure the "Algerithim" if thats how you spell it? plus I can put this into diffrent Encryptions like HEX. but that above is in ASCII or watever you call it? but i think this could be a very easy way of hacking accounts and such?

Anyone with help or opinions please reply!

 

[Core-Ruption]

Bump...

 

[Cheater_]

That would be aweseome if we could change whats in your invo and what your wielding, kinda weird how it says auto in the runescape packet.

 

[XX_PLANKER_xx]

Wow complicated.
If you make youself have 100m, when does it change? when it goes into the trade screen or when its completely traded? >

 

[suicide]

Dude nice. I will look into it I know quite a lot of people who do this kind of stuff and people who hacked runescape back in the day when it wasn't secure.

 

[Jakey]

Wow complicated.
If you make youself have 100m, when does it change? when it goes into the trade screen or when its completely traded? >

Maybe if we could cause a disconnect in that nano-second it would stay true with the server and the client? O-o

Also, didn't the party hat dupe occur by injecting packets?

 

[Java Junky]

To bad it's near impossible to replicate packet location origination. If the server detects a bad packet, it won't accept it.

 

[Core-Ruption]

Yes this is all very possible, but we have to keep working on this not just discard it..

so i thank you all for your help and support and I will keep intouch on here also tell me if you have any answers at all?

 

[Nullware]

Maybe if we could cause a disconnect in that nano-second it would stay true with the server and the client? O-o

The server modifies it's own saved data based on what you do in the client but it does not use any "saved" or "cached" data from the client.
The saved data on the server NEVER gets overwritten with data that was saved or cached in the client.

Also, didn't the party hat dupe occur by injecting packets?

Yes and no. It occured using a glitch in the way the trading system worked back then and was fixed very quickly once Jagex realized what was wrong. Basically players would use a program to send packets saying they were trading an item in a quantity of 0 (zero). This confused the server that one player was giving zero of one item so he should still have it after the trade and since the other player was receiving quantity zero of the item he should receive an item and thus both players ended up with the item.