Diablo 2 Resurrected packet parser

[yogort1]

I'm trying to create a simple TCP packet parser for D2R to know if I missed some item that dropped during the game. I'm capturing some data with Wireshark just to have some starting point with my work and I try to compare it to some known data packets library available in the web, but looks like those are specifically for D2 and D2 LoD. Is there any source explaining a structure of how client->server and server->client data packets are assembled in case of D2R?

[Spoooons]

I have good news and bad news for you. The good news is that the legacy packet 0x9C is still used for dropped items. They added a bit to the stats and removed the itemlevel.

The bad news for you is that you gonna face the Wall of China seeing how you asked the question. For starters the packets stream is TLS encrypted so just Wireshark won't get you anywhere.

You need to extract the master_secret , random_server and random_client keys from memory then check the cipher to decode the stream. There are 2 ways to avoid that by going fully internal and one of them needs a crc32 bypass and that became a big challenge even for experienced devs after iEve released Blizzless d2r. In the follow-up patch blizzard stepped up their game on integrity checks.


The next big issue for you is that the S->C packets come in batches of several hundred bytes, so you have to write a packet wrapper yourself some packets have static size others have a variable size. Diablo 2 packet lists might help you to some degree but without any further knowledge it will be a tedious task. You have to do that no matter what method you use. C->S packets are much simpler though.


Now for the real good news. While the statement of 0x9C is true you won't get there. There is a way how you can detect item drops without relying on packets. All you need to do is to loop through the Clientside hashtable and check the statlists. MapAssist and D2BS can help you with it. The offset you find on mapassist is outdated though.

Do following pattern scan: 48 83 EC 28 4C 63 CA 44 8B C1 8B D1 83 E2 7F you will find 2 obfuscated functions(it's a shitty jcc obfuscation) one includes the clientside hashtable the other one serverside hashtable.

I also suggest you either search memory reading on Blizzard games or familiarize yourself how to read memory properly. Blizzard implemented some tricks how they detect skids reading memory.