GARDEN
Tag: protocol analysis
2 posts ·
10-27An Underwater Hearing on the Login Handshake: The All-Ciphertext Confirmation, the Truth of the Send Path, and the MITM Session on 128 Bytes
Five late-night hearings against the Moyu protocol: a hook on ws2_32!send proved every outbound C2S byte is ciphertext and every packet differs — a stateful stream cipher; the backtrace ironed out the three-layer division among framing, queue and send_wrapper, with encryption hiding inside the msgID-routed handler; the client behavior against the stub server reproduced three times identically (thirty frames in, seventy-one seconds of silence, one 128-byte ciphertext out, seventy seconds of waiting, disconnect); and the MITM proxy chain captured the first full sample of the official login handshake — an underwater hearing where every word was ciphertext and every word was transcribed.
Read more › 10-26The Two-Day Siege of Fantasy World: Unattended Rounds Every Ten Minutes, a Zero-API Toolchain Expedition, and the Gateway Encryption Utterly Broken
The pure-technical reverse engineering of QQ Fantasy World ran two days on a ten-minute guard cadence: every heavy task on the cloud, zero tasks on the local PC, never running the official client; Ghidra 12.2 demanding a full JDK 25, the default config killed by OOM, the GitHub API never called even once (the Location-header and expanded_assets zero-API tricks); the three-stage login chain captured in full panorama, the gateway encryption utterly broken, 272 obfuscated strings decoded wholesale, the sandbox passing all nine walls — a real WeGame window rendered on the cloud, and the TCLS chain first-run reproduced.
Read more › ← Digital Garden