Diablo 3 Retail - Installer Cracking

[malloc84]

I managed to install 2%. But nothing really installed since those 2% only contained logs, mpq.part (0 bytes) and tfil and mfil files. But from those files I found out some interesting things. I also caught couple of authorization keys and a complete list of the files that will be installed.

I have serious issues with debugging (old windows installation or something) so I am having a hard time finding where to nop the warning windows since they come from blizz servers, not locally. Other than that, it is progressing. Just need to get to auth window.

If forced, Diablo III installs in predefined dir based on installer language. Also, it creates setup logs where it elevates administration privilieges to install.

I'll have more info soon.

[Miksu]

Cool find, keep us updated =)!

[chuanhsing]

could you share how to crack it?

[Valtharak]

isn't the files encrypted ? seem like it's the same way star craft 2 was released. you would need to crack the 32bit key used to decrypte the game.

[chuanhsing]

Diablo III Setup, external_resources.rcc and SetupWin.mpq are not encrypted.

and these files contains install pics and texts.

only .MPQE are salsa20 encrypted files.

[Anuroth]

isn't the files encrypted ? seem like it's the same way star craft 2 was released. you would need to crack the 32bit key used to decrypte the game.

Just browsed through the String list in IDA. There were at least strings of wow and sc2 besides the d3 ones in the Setup.exe.

[malloc84]

Yeah, MPQE is salsa20 protected which is practically unbreakable. Brute force maybe but in few years on 1 computer.

I already have some ideas about bypassing the key check itself but first some things need to be in order. It probably won't work but nothing better to do till release.

And since I managed to gather some interesting files and info tricking the bnet maybe there is hope. I bypassed the first encryption and time-check in 2 hours but as said, I am having trouble with debugging. Need to reinstall windows or better yet, install winxp.

[xynoman]

you mean that?

https://i.imgur.com/h2uU6.png

i just used fiddler to edit edgesuit blob request response

[malloc84]

Yeah that.

That is for the salsa20 key.

I tried the hard way to get that screen and to remove any possible obstacle even if right key is entered.

And, didn't use fiddler much in general so my knowledge of the app is limited.

[R3d-Dr4gon]

SC2 authentication codes will not work

i tried that yesterday :_/

for example: http://dist.blizzard.com/mediakey/sc...ncode-enGB.txt

[malloc84]

I have some codes to try but can't since I get a damn warning window from bnet when trying to input the key. And can't remove that warning since I don't know what to nop. Broken debugging. Always crashing the installer.

Gonna continue today in VM with XP installed.

[xynoman]

Fiddler is easy, i havent used it before(downloaded it just to mess with diablo installer)
I will make short tutorial in few minutes

[wowhelp]

Took me 3 days to crack this and make a bypass installer. The game is just near fully installed now.
Here's a watermarked image so those crazy europeans and japs/koreans/asians don't try and steal my shit and be posting it all over the net like it's theirs.

A few things you'll notice when looking at the image... one of the major things is the prompt screen after clicking install followed with the authentication code screen which btw has a custom url for the key I use remotely. I blocked out my url for security and legal reasons. Anyway.. I'll post more images of the following:

1) Complete directory/archive of expanded MPQs.
2) Complete mined data from the deciphered retail MPQs in .txt format (assuming people request it)
3) More images of other random shit? (Also to be requested if people doubt anything)

[xynoman]

1. Start installer and wait untill you see Install button
https://i.imgur.com/DNw3O.png

2.Go to fiddler Rules-> Automatic breakpoints->After response
xrxtl.png (imgur)

3.Then press install and something like that(from ak.world...) should show up in fiddler. Select it and choose text view on the right and scroll down. Then you should see authentication key and 2 urls.
If you redirect it to your own file agent crashes, so change it to random not working site.
OvHCn.png (imgur)
IRsNj.png (imgur)

4.Press Run to Completion
If you dont do it fast enough launcher sends another request

EDIT: This watermarks are easy to remove

[ktion23]

Brute force maybe but in few years on 1 computer.

^ we have plenty computers

so, question, can an individual encripted file be retrived? (encripted, not decripted, ofc)
do the mfil, tfil files provide hashes of files content/size?