Converting Text 2

Okay, now I finally know how to convert HEX to regular Strings.
But I still have a problem, when I am logging incoming packets and convert these packets HEX to string its still unreadable tho... the packet logging program I use now have a white field where it on the left side shows me hex and on the right it shows this as string. The string to the right look unreadable..
But when I add these "rules" to the packet logging program, then the text isnt unreadable anymore, and shows up as text, or usernames which it is.
This are the following rules I added to get it to show as clear text:

capture as hex: 40 00 2E 00 FF
capture as hex: 73 46 92 A4

When I take these off, I will recieve 100s of packets constantly but all of them are unreadable. When I have these rules enabled, then I am able to see a users username in cleartext once they log in, and no extra packets either.

Anyone know how this could be implemented in my packet logger? (the packet logging program I have added these rules to is "Commview" and I want these "rules" in my own program to filter incoming packets)

I know this is very hard.. very advanced.. but someboddy have to know something!! :\

Just a tiny little thing that may lead me to the solution is
Greatly apprecciated!!!

Quote:

---

Originally Posted by UrlGuy

Okay, now I finally know how to convert HEX to regular Strings.
But I still have a problem, when I am logging incoming packets and convert these packets HEX to string its still unreadable tho... the packet logging program I use now have a white field where it on the left side shows me hex and on the right it shows this as string. The string to the right look unreadable..
But when I add these "rules" to the packet logging program, then the text isnt unreadable anymore, and shows up as text, or usernames which it is.
This are the following rules I added to get it to show as clear text:

capture as hex: 40 00 2E 00 FF
capture as hex: 73 46 92 A4

When I take these off, I will recieve 100s of packets constantly but all of them are unreadable. When I have these rules enabled, then I am able to see a users username in cleartext once they log in, and no extra packets either.

Anyone know how this could be implemented in my packet logger? (the packet logging program I have added these rules to is "Commview" and I want these "rules" in my own program to filter incoming packets)

I know this is very hard.. very advanced.. but someboddy have to know something!! :\

Just a tiny little thing that may lead me to the solution is
Greatly apprecciated!!!

---

First of all , Sorry I was off after posting that function to convert hex to string in ur last thread. I was in quite a hurry. Just made it on the fly and was off.
I think ur problem is quite small. u still don't know how to call vb functions.
u do it like this :
ReturnValue = FunctionName(InputValues)

So in this case it is :
StringOutput = HexToString( HexInput)
where HexInput is any string variable/property that contains ur Hex Code, and StringOutput is any variable/property that contains the string output

VB Code:

Function HexToString(ByVal sText As String) As String
    Dim saHex() As String, i As Long
    saHex = Split(sText)
    For i = 0 To UBound(saHex)
        HexToString = HexToString & ChrW("&H" & saHex(i))
    Next
End Function

Thanks!! =D

But still one problem,
when I convert it from the Hex it still looks like just some weird unreadable text.
I want to have like in this other packet program I used, I added some so called "text rules" which were 2 HEX strings as shown above, and then after the hex was converted I saw readable usernames in that string which got converted, pretty hard tho hehe..

Can u quote some valid Hex values and the expected string equivalents for app. I'll try converting here and see if ur's and mine match.
The control used to display them or the OS might be to blame.

I had just tried the values in ur bmp and got the equivalents correctly.

But, the thing is..


I am using this packet logging program on my server, when I look in the packet log all I see is alot of packets which data are unreadable. When I add these as rules:
capture as hex: 40 00 2E 00 FF
capture as hex: 73 46 92 A4
The incoming packets are fewer, and all the packets I see in string are fully readable, well seperated by dots.
So if I host a game on my gameserver, turn on this packetlogging program with those above hex rules, a username might appear as ..k.i.l.l.e.r... only with a few weird signs in front and back of the name. These rules somehow filter out all other packets, so when theyre enabled I only see a few ones, and those I recieve are readable.
Think its possible to do this in VB somehow?
Has been trying this for months now.. :[

Here is Commview on, - with the rules off, to capture all incoming packets. As you see its all unreadable packets:
http://www.poetzsch.org/cw/cantread.JPG

Here is Commview with rules on, here all the packets I recieve are readable, in this case the text is "easypwn", I also get less traffic with these rules on:
http://www.poetzsch.org/cw/ruleson.JPG

Here is Commview in the rules menu, where I enabled these rules:
http://www.poetzsch.org/cw/rules.JPG

These are the 2 lines of HEX I added as rules:
40 00 2E 00 FF
73 46 92 A4

My guess is that those rules tell the app to filter out non-printable (a.k.a data only) characters.
Try building a filter to only let printable chars through.

Maybe somthing like this:

VB Code:

Public Function FilterForChars(Text As String) As String
    Dim lx As Long
    Dim sChar As String
    
    For lx = 1 To Len(Text)
        sChar = Mid$(Text, lx, 1)
        If sChar Like "[a-zA-Z0-9]" Then
            FilterForChars = FilterForChars & sChar
        End If
    Next
End Function

Thanks m8, but still didnt give proper output :\
Its not supposed to filter out everything except readable data, but to filter out everything else that doesnt contain the usernames I'm looking for... or just not show the other ones.
So in other words, Only show usernames by somehow using those above 2 lines of hexcode as "rules" .. :S

In this pic:
http://www.poetzsch.org/cw/ruleson.JPG
you can see some example Hex which has been converted over to the appropriate string I want, which in the above case is "easypwn"

*Commview is a packet logging program, I added those rules as Hex, and all packets I see incoming is very few, and translated to strings they make readable usernames.

My best guess is that those vaules are locations in the packets where you expect to find the user name.

if you can post some of your received packets, some one may be able to help you convert

pete

Quote:

---

Originally Posted by westconn1

if you can post some of your received packets, some one may be able to help you convert

pete

---

Here is Commview on, - with the rules off, to capture all incoming packets. As you see its all unreadable packets:
http://www.poetzsch.org/cw/cantread.JPG

Here is Commview with rules on, here all the packets I recieve are readable, in this case the text is "easypwn", I also get less traffic with these rules on:
http://www.poetzsch.org/cw/ruleson.JPG

Here is Commview in the rules menu, where I enabled these rules:
http://www.poetzsch.org/cw/rules.JPG

These are the 2 lines of HEX I added as rules:
40 00 2E 00 FF
73 46 92 A4

can you copy out the 2 whole sets of hex numbers, paste into notepad or something, i might be able to have a look tomorrow

pete

Thanks.
Heres the lines of Hex which in this case made "easypwn";
40 00 00 00 FF 00 D0 00-07 00 65 00 61 00 73 00
79 00 70 00 77 00 6E 00-00 73 46 92 A4 00 3E 80

If you see in the bottom part of this, near the last part its the excact same hex as one of those I added as "rules" in Commview. And also, right after the name "easypwn", you see some weird signs, which is is the same as the Hex rule, only converted to string. This is really hard to make, heh .. advanced

Thanks.

apart from 1 minor difference, it would appear that the 2 hex strings you enter for rules maybe the start and finish of the location you want,

the pictures you posted before indicate that the first hex string is much longer than when the rules have been applied, so maybe it just trims away some stuff it doesn't want, the second rule is close after the name you are looking for, and only one byte is different between the first rule and the numbers before the name.

as i don't have the complete input i can't help more than that

pete

yea.. but looks really advanced, thanks for taking time to reply though :)

can you get the complete input packet from commview? so i can look at it

pete

What do you mean by input packet?
The complete packet that I recieve that together form that name? or the hex I added as a rule?

RE:
These are the 2 lines of HEX I added as rules:
40 00 2E 00 FF
73 46 92 A4

no i meant the full input packet from commview, it may be quite long, but i need to see it all

pete

Okey, thanks..

Heres the full packet from Commview for "easypwn":

Hex:
00 0C F1 F3 C7 7C 00 01-97 D2 76 00 08 00 45 00
00 43 1F 7F 00 00 6F 11-63 96 55 A4 10 2A 40 45
22 82 10 C0 05 39 00 2F-2E 1B 99 CE F1 88 21 04
40 00 00 00 FF 00 D0 00-07 00 65 00 61 00 73 00
79 00 70 00 77 00 6E 00-00 73 46 92 A4 00 3E 80
00


String:
..|..v...E.
.C...o.cU.*@E
"..9./..!.
@.......e.a.s.
y.p.w.n..sF.>
.



To have something to compare with I got from another, with a user named "speachless":

Hex:
00 0C F1 F3 C7 7C 00 01-97 D2 76 00 08 00 45 00
00 49 95 AF 00 00 75 11-9A 78 3E 83 74 32 40 45
22 82 07 D2 05 39 00 35-94 87 76 BC AF B3 E1 04
40 00 00 00 FF 01 00 00-0A 00 53 00 70 00 65 00
61 00 63 00 68 00 6C 00-65 00 73 00 73 00 00 73
46 92 A4 00 01 F4 00

String:
..|..v...E.
.I..u.x>t2@E
"..9.5v.
@........S.p.e.
a.c.h.l.e.s.s..s
F...


Hope this was what you meant.
Thanks.
Best Regards,
~UrlGuy

those look like the packets after the rules have been applied.

i need to see the original packet, before the rules have been applied

pete

they are probably much longer

Till now what I'v been able to figure out is that ur username appears just before any of the rules that match. So it would be easy to write a function that extracts only that part if I'm not wrong.

Quote:

---

ur username appears just before any of the rules that match

---

thats what it was looking like to me, but sao far i haven't seen the tring before the rules are applied

pete

hmm.. looks difficult

Quote:

---

Originally Posted by westconn1

thats what it was looking like to me, but sao far i haven't seen the tring before the rules are applied

pete

---

Here it is without rules applied, although now I recieve several per second, and lot ore traffic, all unreadable;
http://www.poetzsch.org/cw/cantread.JPG

Try playing around with Commview. It may give you a few hints...


http://www.tamos.com/products/commview/

Quote:

---

Originally Posted by dglienna

Try playing around with Commview. It may give you a few hints...


http://www.tamos.com/products/commview/

---

Yea I have done, but really can't find out how to add this feature to my own VB app :\ Im a newbie and barely know how to work with sockets :|
Still trying and experimenting =P

Quote:

---

Originally Posted by UrlGuy

Yea I have done, but really can't find out how to add this feature to my own VB app :\ Im a newbie and barely know how to work with sockets :|
Still trying and experimenting =P

---

I was curious to know whether you got those two hex codes to filter out unwanted data by a chance or it was known to you. In case it was just by a hit & trial, you might be missing many of them. I'll suggest you add rules to filter by actual UserNames instead of these. You will need to add all your users to the list.
E.g. Remove these rules and apply these instead put these and see what it results in:
07 00 65 00 61 00 73 00 79 00 70 00 77 00 6E 00 <--- for easypwn
0A 00 53 00 70 00 65 00 61 00 63 00 68 00 6C 00 65 00 73 00 73 <---- For speachless


If this works, add similar rules for all your users.

Pradeep :)

if you can post the complete packet from comview, one of us will probably be able to tell you have to get the user name.

if you can't read the packet, you will not be able to apply any rule to it.

can you
debug.print commview packet ?

pete

what do you mean? srry but I didnt quite understand last1 :\

I thought you meant this:
00 0C F1 F3 C7 7C 00 01-97 D2 76 00 08 00 45 00
00 43 1F 7F 00 00 6F 11-63 96 55 A4 10 2A 40 45
22 82 10 C0 05 39 00 2F-2E 1B 99 CE F1 88 21 04
40 00 00 00 FF 00 D0 00-07 00 65 00 61 00 73 00
79 00 70 00 77 00 6E 00-00 73 46 92 A4 00 3E 80
00

Isnt that the full packet?

As a start.. how do I capture incoming traffic on UDP port and get it in HEX anyways:?

Did u try my suggestion in #30?

Pradeep :)

Okey thanks.. actually even seemed to output the right stuff which is great progress! :D

But one problem though, I dont know the names of the users who are joining, it may be anything, whatever they choose to name themselves as, this making it even harder =\

If you do a bit of research work on the incomming data, you might be able to come up to a solution.
Here is a suggestion:
I feel what the two hex values u were using represented some user action ( like post msg, PM someone, Reequest service etc. etc). So there must also be something for "New user created". Just try to figure out that hex value. So whenever you get that hex value, you know that a new user needs to be added. Then extract the username out of that and add it to your rules list.

Pradeep :)

Ok.. But the thing is I am not quite sure where to start at all, as I am not even sure how to even capture the packets as HEX (in my own vb app) although I managed to do something similar, when working with TCP sockets, although this is UDP and after what I've understood its a lil different so I am not sure about it :\

To explain what this whole thing is,
I run a gameserver old-style game which got no anti-cheat or ban programs so I cant kick cheaters in the game. So I used Commview, so whenever a user joined the game, I got their name and their IP on Commview, so if they were abusive of some kind I would just go ahead and block their IP from within my firewall. I would like to get somehting similar with a VB app, just to log their names and IP's, as Commview takes up 99% of the cpu usage. But I dont even know where to start to even just log hex strings.. so then its even harder to convert the hex strings as I havent really managed to capture them either.. but the translation of hex strings to usernames is probably alot harder, I am just really newb to VB, sorry for that. Extremely glad for all help I may recieve, thanks for all response until now, hope anyone can help.

Once again..
Greatly apprecciated, Regards,
~UrlGuy