Learning CSS protocol, base on sourceupfilelan

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

Hello folks!

I'm trying to learn some basics with css protocol, I'm using borland c++ builder enviroment, at first I will show what I have done so far:

A function in c++ similar to rwbits.h:

Code:

int buffcpy(int num, int bytes, int where, unsigned char *buf){

if(num<=255){
memcpy(&buf[where],&num,1);
} else {
memcpy(&buf[where],&num,2);
where = where + 1; bytes = bytes - 1;
}
if(num>1){
int bits = 0;
memcpy(&buf[where+1],&bits,bytes-1);
}

return (where+bytes);
}

I did manage connect to server, and send packet like that:

Code:

unsigned char buf[4096] = "";

int b = 0;
b = buffcpy(-1,4,b,buf);
b = buffcpy(0x71,1,b,buf);

ClientSocket1->Socket->SendBuf(buf,sizeof(buf));

Server answered me with one byte, exactly 10, which is 0x0A as I remember.

I believe it was some sort of reject byte, which propably mean that I've sent incorrect packet (Because it won't answer on wrong packet).

Can you people help me with that? It would be great using my function to show me examples.

aluigi · **Posted:** 22 Sep 2009 17:58

you can't use memcpy with bits, that's the error.
AND (&) and OR (|) are your friends for doing it, otherwise why I needed to complicate my life with rw_bits.h? :)

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

so I have to work on bits? Because before, I did several bots for MMORPG game called Tibia, which is normally protocol on bytes.

aluigi · **Posted:** 22 Sep 2009 18:06

the Steam engine works only with bits, everything between 1 and 32 bits.
even the strings are handled as bits, exactly 7 + 1 bits for each char

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

Code:

unsigned char buff[4096] = "";

int b = 0;
        b = write_bits(-1,      32, buff, b);
        b = write_bits(0x71,    8,  buff, b);
        b = write_bstr(reinterpret_cast<unsigned int*>(buff), b, reinterpret_cast<unsigned int*>("00000000000000"), -1);

ClientSocket1->Socket->SendBuf(buff,sizeof(buff));

Server doesn't answer, btw. I had to use reinterpret cast because it won't compile.

Also:

Code:

int write_bstr(u8 *data, int b, u8 *str, int len) {
    int     i;

    if(len < 0) len = strlen(reinterpret_cast<char*>(str)) + 1;
    for(i = 0; i < len; i++) {
        b = write_bits(str[i], 8, reinterpret_cast<unsigned char*>(data), b); // 7 + 1 (if 1 then -= 0x80)
    }
    return(b);
}

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

Let's leave it, it's quite hard to do it on borland, gcc is simplier and works great aswell.

Referring to the source of fileuploadlan, is it possible to be able to login on steam servers? Like using my steamID key or whatever it is, and how to do that?
I want be able to connect to steam servers.

aluigi · **Posted:** 22 Sep 2009 21:41

I performed no research on that field so I don't know how to fill it with valid data.

johndavid · **Joined:** 16 Sep 2009 07:17 **Posts:** 1

i am begiiners for css can any one able to say good online tutorial for css

seo india

aluigi · **Posted:** 23 Sep 2009 10:28

tutorial of what?
this is not a gaming forum

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

aluigi wrote:

I performed no research on that field so I don't know how to fill it with valid data.

Thats bad : /

It would be very usefull, I will try to research it if I can.

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

I still can't understand why it won't accept buffer which was made from bytes instead of bits.

Code:

int b = 0;
b = buffcpy(255,4,b,buff);
b = buffcpy(0x71,1,b,buff);
b = write_bstr(buff, b*8, "00000000000000", -1);

Code:

int b = 0;
c = write_bits(-1,      32, buff2, c);
c = write_bits(0x71,    8,  buff2, c);
c = write_bstr(buff2, c, "00000000000000", -1);

Both buffers looks exactly the same as shown:

Code:

for (int i = 0 ; i < 256 ; i++) 
                std::cout << (unsigned int)buff[i] << "."; 

and

Code:

for (int i = 0 ; i < 256 ; i++) 
                std::cout << (unsigned int)buff2[i] << "."; 

Can you explain me it better?

aluigi · **Posted:** 27 Sep 2009 11:48

if you talk only about the non-in-game packets (like first and second which are composed by fields that occupy full bytes) you can even use:

Code:

int b = 0;
memcpy(buff + b, "\xff\xff\xff\xff", 4); b += 4;
buff[b] = 0x71; b++;
b += sprintf(buff + b, "%s", "00000000000000") + 1;

the first example you showed should be correct (not verified), you need only to remember to use "b / 8" as length in sendto().

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

Code:

b = 0;
b = buffcpy(255,4,b,buff);
b = buffcpy(0x71,1,b,buff);
b = write_bstr(buff, b*8, "00000000000000", -1);
      
len = send_recv(sd, buff, b / 8, buff, BUFFSZ, &peer, 1);

Doesn't really work.

(Server is not responding)

And:

Code:

b = 0;
b = write_bits(-1,      32, buff, b);
b = write_bits(0x71,    8,  buff, b);
b = write_bstr(buff, b, "00000000000000", -1);
      
len = PADDING(b) >> 3;
len = send_recv(sd, buff, len, buff, BUFFSZ, &peer, 1);

Works perfectly.

aluigi · **Posted:** 28 Sep 2009 09:34

isn't more simple for you to use a sniffer or a show_hex/show_dump function and comparing the 2 packets?

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

nevermind, trying to fix.

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

I did manage to write it on Borland C++ Builder 6, also I had to change buffcpy function to:

Code:

int buffcpy2(int num, int bytes, int where, unsigned char *buf){
char b[32] = "";

if(num<=255){
int c = 0;
for(c = 0; c < 32; c++)
b[c] = num;
}

if(num==255)
memcpy(&buf[where],&b,bytes);
else if(num>255){
int h_bytes = sizeof(num);
memcpy(&buf[where],&num,h_bytes);
where = where + h_bytes; bytes = bytes - h_bytes; 
}
else {
memcpy(&buf[where],&b,1);
int bits = 0;
memcpy(&buf[where+1],&bits,bytes-1);
}


return (where+bytes);
}

It's just temporarily.

Anyway, I've tried several times to fill data with STEAM key and cookies, but nothing good came out : /
I hope you will have some time and you will try to do smth.

aluigi · **Posted:** 30 Sep 2009 11:51

definitely not, I don't have even the game

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

So, propably if you have time, we can research it here, I will copy packets from real css with steam here.

Let's start with:

Code:

FF FF FF FF 71 30 30 30 30 30 30 30 30 30 30 30 30 30 30 00

As we already know, it is something like "login" packet, which propably request permission.
It's exactly the same as:

Code:

b = 0;
b = write_bits(-1,      32, buff, b);
b = write_bits(0x71,    8,  buff, b);
b = write_bstr(buff, b, "00000000000000", -1);

The next one, is whole data with nickname, server password, protocol, challenge and steam key and cookies, whatever last 2 means.

Code:

FF FF FF FF 6B 07 00 00 00 03 00 00 00 E8 7C 75 01 6B 6C 65 72 79 6B 00 74 75 72 6E 69 65 6A 00 78 02 00 01 00 80 56 F0 8E 1D A9 9B AE 6D 40 C2 1E 4D 87 66 E5 44 A8 6C E1 CF 7A D7 8A 33 65 CE 25 CD 2B 9F 34 41 F0 BF 03 A3 31 0E 9D EC C6 AB 8A 9F 28 56 FA 39 7D E6 86 8D B5 69 D2 A2 EE AE 41 8A A3 BF A3 BC 8C 10 D7 12 C7 41 2C 06 B2 63 C7 37 BA 3E 35 8B 7B 86 CB C9 02 C4 B2 A1 2B F6 7C 26 A8 63 38 4B 18 9A C1 60 16 AB E5 0B D7 B6 2A 73 22 82 EA 09 B4 37 30 80 4F E2 61 10 37 1A 82 03 D0 3D 7C 16 AF EA BD 5C 52 56 E0 60 01 D6 C3 D4 FD 72 C5 38 01 DF 01 E0 AA E8 E3 75 25 6E 05 D9 0F 7B FE E1 47 D8 63 84 49 7E B5 72 8B B1 D1 AF C9 FA C9 1B C3 5B B1 DB 60 57 CA EC B6 90 1D D2 21 28 04 F7 B0 48 C5 19 7D 5C 42 02 6E 47 DF E3 21 27 7C EF D1 71 0F 26 1A 6B 88 01 48 4E 92 08 62 D4 80 19 6F 09 98 32 AB 67 C6 31 37 02 A4 E5 16 2A 9D 24 1F 81 93 AD CD D2 CB F0 7F 80 C7 6B DA 4B 37 E5 42 64 8A D6 03 11 43 CF FE 2D 71 EC B1 CF CA 3E DA 45 DA A9 52 0B 06 0D 97 65 89 7C D7 7F 8B A4 63 EE 2E E7 C6 01 3D 25 8B 8D 4B 54 17 4E B4 24 31 05 70 6E 56 14 6D 75 EE 93 18 C5 8A B1 9C 69 79 2C 88 8F 5E 7D 18 75 DA 45 2D F6 49 6C F4 34 F9 A2 F4 14 17 75 ED 95 03 37 D7 D3 18 25 4F F7 60 F2 99 01 9E 9F 8F D6 F8 C6 E2 5B EC 5A 9B 72 CC 29 B4 92 F9 F7 42 5D A2 6F BC 31 AC 12 06 66 75 85 0D 92 28 46 4D 9B 2B 37 4F D4 44 95 1D 7F 0E 4C 71 70 9D 84 C0 19 E1 5F AD 21 29 1D 9A 78 DC C4 BC 83 ED 50 8D 76 97 E6 2F C0 A1 B3 98 48 C0 B9 A9 AC 92 05 32 C7 B4 54 1C B8 CB 37 61 6C AA B3 0D 6D F7 2F FD 81 A8 F7 06 F0 C4 D0 76 7D 60 EF 3A EB 3E 71 8D FF BD 21 90 A3 29 EF B6 02 84 AD 21 9D 3E 4A 7F A3 29 5A 7D 74 74 C0 FF 5E 98 35 E4 15 FB BC 4E 4C 9E F9 B6 6B 29 8E E9 AE A8 FC 40 7A 66 E9 F4 01 AF 5B 8D 70 2B 87 97 B7 E4 96 43 3D 3C 52 2C CC FA 1D 29 42 00 42 76 F1 51 37 79 EC 2C 90 B3 23 F0 76 F1 F7 D6 68 19 69 C4 AC 89 5D 5F 19 63 71 36 1E 7B 39 42 65 93 35 E7 20 87 BD 3F 7F B0 34 AE BB 2D 28 7F 3B F6 6E 34 21 0F 41 92 80 25 B7 6D 75 81 ED 1F 08 F4 FA 22 16 BC 4E BA 78 95 56 EA 9B BA EB FA 60 91 4B C1 F6 46 C1 14 00 9F EC 91 4D 19 FC 28 86 4A 95 16 02 01 00 10 01 AC 4B C3 4A 

Nickname = 6B 6C 65 72 79 6B ("kleryk")
After nickname terminated by 0x00 is Server password = 74 75 72 6E 69 65 6A ("turniej"),
after that again terminated by 0x00, 78 02 suppose to be a SteamKey (2 bytes), but what is next? Alot of data, I don't know what exactly.

It is steam account banned by VAC, if you need login and password for it, let me know, I will send you PM with that.

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

I did manage to login to steam server which I made cookies from, but I can't connect to any other with info "steam validation rejected" which means that cookies are made for each server.

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

Cookies just expired (I believe so).

aluigi · **Posted:** 30 Sep 2009 19:10

it's a bit more complex than just analyzing a packet.
it's an authentication based protocol (the cookie) and I guess there is also something else (only an hypothesis).
in any case I don't plan to return on the Valve engine for new research.
sorry

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

Yeah, I see now:

I've connected 2 times, to the same server, with about 20s delayed, both packet are different like:

38 first bytes are the same -> I believe here is something with steam ID, because it is the same on one account, but different on another.
606 bytes changed.
12 last bytes are the same -> I'm not sure what it is.

Well, so I'm at dead point, because propably I won't be able to finish this without your help.

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

Anyway, can you direct me how to find how look that authentication based protocol? I mean using whatever tools like debuggers or smth.

Atleast I will learn something.

Also I have found some functions in hl2/css header files from SDK:

Code:

// user authentication functions
   virtual void GSSetSpawnCount( uint32 ucSpawn ) = 0;
   virtual bool GSGetSteam2GetEncryptionKeyToSendToNewClient( void *pvEncryptionKey, uint32 *pcbEncryptionKey, uint32 cbMaxEncryptionKey ) = 0;

   virtual bool GSGetSteam2GetEncryptionKeyToSendToNewClient( void *pvEncryptionKey, uint32 *pcbEncryptionKey, uint32 cbMaxEncryptionKey ) = 0;
   // the IP address and port should be in host order, i.e 127.0.0.1 == 0x7f000001
   virtual bool GSSendSteam2UserConnect(  uint32 unUserID, const void *pvRawKey, uint32 unKeyLen, uint32 unIPPublic, uint16 usPort, const void *pvCookie, uint32 cubCookie ) = 0; // Both Steam2 and Steam3 authentication
   // the IP address should be in host order, i.e 127.0.0.1 == 0x7f000001
   virtual bool GSSendSteam3UserConnect( CSteamID steamID, uint32 unIPPublic, const void *pvCookie, uint32 cubCookie ) = 0; // Steam3 only user auth

or/and:

Code:

DLL_EXPORT bool Steam_GSSendSteam2UserConnect( void *phSteamHandle, uint32 unUserID, const void *pvRawKey, uint32 unKeyLen, uint32 unIPPublic, uint16 usPort, const void *pvCookie, uint32 cubCookie );
DLL_EXPORT bool Steam_GSSendSteam3UserConnect( void *phSteamHandle, uint64 ulSteamID, uint32 unIPPublic, const void *pvCookie, uint32 cubCookie );

bolek13 · **Joined:** 22 Sep 2009 17:46 **Posts:** 25

It's really sux you won't help me, because I won't be able to do this on my own.

Luigi Auriemma

Learning CSS protocol, base on sourceupfilelan