WoW Sniffer : The working

[tttommeke]

WoW Sniffer : The Working

We have like tons of sniffing tools but most of the people just download them and then when it isn't working just complaining. So here I will explain the use of it !

As you know almost everything must be send and received (except the WoW objects etc because these are already storage on your pc etc) So I used WPE Pro (look on the forum for a very nice guide) and start scanning these packets that got new information etc.

Now, how would I know that when you said something it would first go to the server and then back ? Simply, when you have a lot of lag and you type something you won't see it, because when you got some lag it can take a while before you see your character saying what you said.

The patron of messages is simply I must say, when you see the image under this text you would see a patron that their is an X then 11 spaces and then again a X and then after again ten times 00 probably the message. ( 00 or . is a empty spot )


So how should I program it ?

First of all you need to know how to read packets send and received from a specific program.
The important you will need to read is just the received packets so for not losing to much unneeded stuff your program only need to read the received packets.
Let your program look for the patron I said (But look out, the 00 etc before the first X are sometimes random with other crap with it so let him look for an X, then another X and then ten 00 and then the message.) Be sure your program also dehex the code so it would become ASCII.

Why aren't you making the program ?

Because I also have not a clue yet how to read packets. But I will try !

[Rohi]

Hihi wow sniffer Sounds cool : )

[Darkone]

I'm sorry. I don't really understand.
Are you saying, that if I would type a couple of Spaces, a X, couple of spaces
and then Hello the other faction could hear it?

~Darkone

[tttommeke]

I'm sorry. I don't really understand.
Are you saying, that if I would type a couple of Spaces, a X, couple of spaces
and then Hello the other faction could hear it?

~Darkone

No, that is how the received packet come in. All sort of packets got a patron so WoW nows that that packet is for the chat message, that packet for that,... and that X ..... X thing is the patron for WoW to let him know that that is for the chat message.

[shadowbladex]

Good job, but too confusing for me.

[Darkone]

Thank you tttommeke.

~Darkone

[kookoo]

Basically the packets C8 58 ID is the Patron or "mark" for Chat message as stated
C8 58 ID .......48 45 4C 4C 4F: HELLO.

since you can use hexadecimal to ASCII converter to see that
48 45 4C 4C 4F = HELLO

48 = H
45 = E
4C = L
4C = L
4F = O

There's Alot of Charts wich already have alot of the ASCII and Hex tables ready...so
Ascii Table - ASCII character codes and html, octal, hex and decimal chart conversion

Go figure it out


With this you can do alot of things tbh, You can make a filter for wow sniffer to read out all chat messages.

Filter C8 58 ID and you will get a chat application that can read both Alliance and Horde factions if Blizzard has done any twisty.

Cheers.

[tttommeke]

Filter C8 58 ID and you will get a chat application that can read both Alliance and Horde factions if Blizzard has done any twisty.

Cheers.

Also filter the always 10 times 00 before it etc else you will just have crappy long stuff.

[Phygar]

The plain packet has the info, but the game encrypts it.

[saionjik]

But Tomek, WPE PRO can't target WoW.exe? Where did you get your WPEPRO2 from?

[Phygar]

But Tomek, WPE PRO can't target WoW.exe? Where did you get your WPEPRO2 from?

Your first post ever since you joined March 12th and it's from this question. You just use perm edit.

[Viitapiru]

I heard something about that Warden detects modified packets. not sure though, but im not gonna try that :P

[Saint-Pasdoy]

sniffer is for client side only, isnt it ?

[tttommeke]

Yes it isn't. And how would Warden detect anything ? You didn't edit anything you were a passive program that just reads connection between WoW and internet. Some firewalls do the same.

[saionjik]

Lol yeah, march 12th. When I was here back then, I wasnt interested in this site. Most other sites died on me, and tault sucks. So I'm here now.