How GameGuard does it's updates
The client has a CabalOnlineUK.ini, which is encrypted, and this
controls where the client will update GameGuard from. These can be decrypted
with the GameGuard file utility. These examples are from the official EU GameGuard server earlier this month.
Code:
[GAMEMON]
GAME_NAME=CabalOnlineUK
UPDATE_SERVER=gameguard.cabalonline.com
UPDATE_PATH=/gameguard/nProtect/GameGuard/RealServer/
BACKUP_SERVER=
BACKUP_PATH=
OPTION_VALUE=0
SPEEDCHECK_INTERVAL=1000
SENDERL=1
GAMECRC=1
USE_GGSCAN=1
SENDERRLOG=2
LOG_SERVER=211.233.43.45
REVISION=47
So, the client gets it's updates from GameGuard Website
and once we know that we can set up a webserver with the same directory
structure. You will need to redirect gameguard.cabalonline.com to you
own webserver using either DNS records or the hosts file.
The first thing GameGuard does is download the update.cfg file so it know what
it needs to update. This is encrypted in the same way as the ini file
from the client.
Code:
[GAME]
GAME_NAME=CabalOnlineUK
[FILE101]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=GameMon.npz
REALFILENAME=GameMon.des
DESTINATION={appgg}
VERSION=2008.12.18.1
CRC32=1147193640
OPTION=0
[FILE102]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=npgg9x.npz
REALFILENAME=npgg9x.des
DESTINATION={appgg}
VERSION=2008.8.28.1
CRC32=4142835861
OPTION=0
[FILE103]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=npggNT.npz
REALFILENAME=npggNT.des
DESTINATION={appgg}
VERSION=2008.12.3.1
CRC32=1279772719
OPTION=0
[FILE104]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=npsc.npz
REALFILENAME=npsc.des
DESTINATION={appgg}
VERSION=2008.10.17.1
CRC32=2587108299
OPTION=0
[FILE105]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=nppt9x.npz
REALFILENAME=nppt9x.vxd
DESTINATION={sys}
VERSION=
CRC32=317793346
OPTION=0
NOAUTH=1
[FILE106]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=npptNT2.npz
REALFILENAME=npptNT2.sys
DESTINATION={sys}
VERSION=2005.1.5.1
CRC32=3155204954
OPTION=0
NOAUTH=1
[FILE107]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=CabalOnlineUK.npz
REALFILENAME=CabalOnlineUK.ini
DESTINATION={appgg}
VERSION=
CRC32=1026638557
OPTION=0
[FILE108]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=Splash.npz
REALFILENAME=Splash.jpg
DESTINATION={appgg}
VERSION=
CRC32=2078401564
OPTION=0
NOAUTH=1
[FILE109]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=ggscan.npz
REALFILENAME=ggscan.des
DESTINATION={appgg}
VERSION=2007.1.4.1
CRC32=3896960380
OPTION=0
[FILE110]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=npgmup.npz
REALFILENAME=npgmup.des
DESTINATION={appgg}
VERSION=2009.1.28.1
CRC32=313176569
OPTION=0
[FILE111]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=TeCtrl.dll.npz
REALFILENAME=TeCtrl.dll
DESTINATION={commonty}
VERSION=2008.8.28.0
CRC32=2086036782
OPTION=1
NOAUTH=1
[FILE112]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=tyav32.dll.npz
REALFILENAME=tyav32.dll
DESTINATION={commonty}
VERSION=2008.11.11.0
CRC32=341796621
OPTION=1
NOAUTH=1
[FILE113]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=TYAVP_000.npz
REALFILENAME=TYAVP_000.bin
DESTINATION={commonty}
VERSION=2008.11.14.00
CRC32=2106599450
OPTION=1
NOAUTH=1
[FILE114]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=TYAVP_001.npz
REALFILENAME=TYAVP_001.bin
DESTINATION={commonty}
VERSION=
CRC32=2951889252
OPTION=1
NOAUTH=1
[FILE115]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=TYAVP_002.npz
REALFILENAME=TYAVP_002.bin
DESTINATION={commonty}
VERSION=
CRC32=1300993572
OPTION=1
NOAUTH=1
[FILE116]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=TYAVP_003.npz
REALFILENAME=TYAVP_003.bin
DESTINATION={commonty}
VERSION=
CRC32=51465540
OPTION=1
NOAUTH=1
[FILE117]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=TYAVP_004.npz
REALFILENAME=TYAVP_004.bin
DESTINATION={commonty}
VERSION=
CRC32=2929953137
OPTION=1
NOAUTH=1
[FILE118]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=TYAVP_EXP.npz
REALFILENAME=TYAVP_EXP.bin
DESTINATION={commonty}
VERSION=
CRC32=2966243243
OPTION=1
NOAUTH=1
[FILE119]
DESCRIPTION=nProtect GameGuard Engine
FILENAME=GameGuard.npz
REALFILENAME=GameGuard.des
DESTINATION={appgg}
VERSION=2009.1.28.1
CRC32=1785911752
OPTION=0
Now these 2 files are encrypted using a shared key method from what i
have read which largely means decrypting is quite easy, encrypting is
almost impossible unless we have the private key too (which we don't).
This means that for this to work we need an update.cfg and a set of
matching GameGuard files as it is checking the crc.
If i set this up, enable GameGuard on the server and try logging in with my Private Server client i get booted right away which is exactly what we want,
only protected and verified exes allowed. If i try with the EU client
(using the batch file and internal.txt obviously) i can get past Log-in
but i get booted around the char select screen.
Our servers only have GameGuard libs up to v52 and i know what GameGuard goes higher
than this. As our server version is quite old the official one has
obviously updated to a newer version of GameGuard which i am pretty sure is
the reason i get booted as the server GameGuard lib is too old for the current
GameGuard files used by official.
The real problem is how to get older Cabal GameGuard files. Getting the files
themselves is no real problem but without the matching update.cfg the
files are useless. A better method would be to find an updated lib
(libggauth2.so.xx) for the server so we can use the current GameGuard version
rather than older exploitable ones.
One other possible solution is to use older update.cfg and GameGuard files
from another game as. GameGuard is definitely going to check the game name in
the cfg and ini matches but i don't know if the client also verifies
this. I don't have any other GameGuard files from other games to test with but
maybe somebody else does.
Here are the GameGuard files, decrypted ini/cfg and a copy of GameGuard file.
Mediafire :: Download
