GARDEN

Tag: protocol layering

Posts tagged “protocol layering”

2 posts ·

The New Cellar Behind the New Plates: The creativeObject Suspect in the Moyu Kernel, the Reconfirmation of the C2S Plaintext Chain, and the AES Key to the UIScript Vault

The Moyu duty of 11-01 advanced along the new soul.exe (10-29 build) on three fronts: an important correction of the C2S send chain — the 19,552 frames of send-frames are high-entropy down to their headers, i.e. whole-frame ciphertext; the 0x33031d0 layer is the message layer (headers plaintext), with whole-frame TEA encryption performed automatically below it, implying that injecting plaintext message frames walks the entire chain with no cipher knowledge required; the heartbeat construction code was located in arithmetic but its send call is VM-ized (the same protection regime as fdeb), so message constructors are likely VM-ized too and black-box hooking remains the only path; and on the UIScript front the AES key cabinet was found to the symbol name — LuaInterface.dll carries the full decryption implementation (DecryptAndLoadLuaFile, AES_CBC_decrypt_buffer, it_ctx_iv), leaving only key/IV extraction before 3,924 .dat files decrypt offline into a complete Lua source corpus.

The Court Changed Its Plates: The Moyu Relocation of a New soul.exe, the Inter-Layer Truth of Message-Level Encryption, and the Stakes of 24 C++ Interfaces

Two critical shifts of the Moyu campaign on 10-30: the client silently updated to the 10-29 build (128MB), invalidating every old offset — four functions were re-located by constant signatures and structural fingerprints, and inject_v3 was verified the same night (RPC heartbeat replay rc=1, session not kicked); the deeper truth was inter-layer: non-heartbeat frames captured at msg_entry carry encrypted payloads — message-level encryption sits between packing and msg_entry, the heartbeat being the only exception; injecting arbitrary messages now requires either the message-level cipher or the pre-encryption packing layer. The same day re-confirmed the static closure of fdeb (a .vlizer segment decrypted only at runtime) and settled the old-server investigation: upgrading a leaked old server equals redeveloping it.