[WIP* | Work In Progress]
![]()
Xsyon : Rev Work.
The purpose of this threat is to document all aspects of Xynos, packet structures, encryptions, package structures and eventually provide tools required for anyone who wishes to modify the game client, or create there own private server.
* Please note if anyone knows if this has already been done let me know, and ill move onto another project at present I'm unable to find any current projects or private servers or documentation for this game on other forums and this one. *
Current Todo List:
- work out MD5 Salt
- proxy game client, decrypt on the flow
- document packets
- XSIP unpacker
- XSIP packer
- document .csv files within Source.xsip
- document .fxc scripts (possibly XOR encrypted and passworded)
Packet Decryption/Unpack:
The Encryption is a simple XOR, only thing that throws you are first is the unpacking, quick look in IDA Pro and you notice the usage of zlib, the first 12 bytes are the packet header.
PacketHeader Struct
XSIP Package:
Packets:
LOGIN Packet:
The salt and how its added to the password for the hash I've looked at yet. I will add more as I work out each packet, how and why etc..
The purpose of this threat is to document all aspects of Xynos, packet structures, encryptions, package structures and eventually provide tools required for anyone who wishes to modify the game client, or create there own private server.
* Please note if anyone knows if this has already been done let me know, and ill move onto another project at present I'm unable to find any current projects or private servers or documentation for this game on other forums and this one. *
Current Todo List:
- work out MD5 Salt
- proxy game client, decrypt on the flow
- document packets
- XSIP unpacker
- XSIP packer
- document .csv files within Source.xsip
- document .fxc scripts (possibly XOR encrypted and passworded)
Packet Decryption/Unpack:
Code:
'''
Python Decrypt/Unpack for Xynos
Author: KuroSaru
'''
password="Notorious Games LLC"
def dec(Data):
xpi=0
Dec=""
for i in range(0,len(Data)):
Dec = Dec+""+chr(ord(Data[i]) ^ ord(password[xpi]));
xpi=((xpi+1)%(len(password)));
return zlib.decompressobj(15+32).decompress(Dec[12:])PacketHeader Struct
Code:
//unk = unknown;
struct xynos_packet_header {
word packetID;
word unk1;
dword unpacked_size; //includes header
word packed_size; //includes header
word unk2;
}XSIP Package:
Code:
The XSIP package follows the PAK structure with a few small alterations, no compression in use.
There is no directories in use within the .xsip packages, how ever the files namesPackets:
LOGIN Packet:
Code:
struct xynos_login_packet {
char[64] *Username;
char[64] *MD5_Salted_Password_Hash;
byte unk1;
byte unk2;
byte unk3;
byte unk4;
dword unk5;
}