~/talk

Reverse-Engineering a Proprietary Game Server with Erlang

Talkat Erlang User Conference 2012 · 2012-05-28..06-02· [security]
links:none on file
slides:none on file

Shows how Erlang is used to reverse-engineer a live MMO protocol by capturing SSL traffic with a man-in-the-middle proxy, logging packets, converting them to CSV and decoding fields with spreadsheets, and reverse-engineering client archives via debugger and ASM. Extracts and rebuilds ~10,000 game files and archives in 10,000 files in ~10 minutes, implements patch/login/game servers that accept real clients, uses Erlang hot code reload and pattern matching to keep connections alive and iterate until the reimplemented server works.

AI-written summary · about

  1. 0:00Intro
  2. 0:24Why Reverse-Engineer?
  3. 1:38Frowned Upon
  4. 2:58Anticheat Technology
  5. 4:22Windows
  6. 5:02Phantasy Star Universe (PSU)
  7. 7:10Packet Logging
  8. 7:30Undetected Logging
  9. 8:23Breaking Through PSU'S SSL
  10. 10:35Packet Analysis
  11. 11:03Spreadsheet Help
  12. 12:09Aggregate The Field Values
  13. 12:36Game Mechanics
  14. 15:04Extracting Files
  15. 15:34File Extraction
  16. 16:21Files Analysis
  17. 17:06Start With A Debugger
  18. 18:07Step By Step
  19. 18:56Concurrent Extraction
  20. 20:07Continue With An Hex Editor
  21. 21:01File Parser
  22. 22:12Prototype Server
  23. 22:29Validating Protocol Assumptions
  24. 23:05PSU's Protocols
  25. 24:20First Implementation
  26. 26:57Responses
  27. 27:22Shell Testing
  28. 28:15Warping Is Good
  29. 29:05Feedback Loop
  30. 29:43Reloading
  31. 30:04Don't Crash In The Network Layer
  32. 31:10Still Trial And Error
  33. 36:45Questions?
~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.