NFS Carbon over LAN possible? (Client/Server)

[Debug]

Well, if this can help, i think you should not sniff the data over the network, but the message before being ecrypted. Just put a breakpoint over 'send', and trace a bit before the call so that if will not be encryped and you can recognize the encryption because the algorithms is always the same

[schultzy]

Well, I havent had much experience in coding at all, but i really would like to play NFSC over lan, so I will try to help out, though probably not much:)

Couldnt we all just have brute force and then one of us has to get the key

also coultnt you just edit the executable file or dll files to get the key or something

Probably wasnt much but i tried

[covo2k]

Hey all. Sorry that i didn't write a post for such a long time but i had to do many other things.

So my SSL sever is ready.
I faked also the Certificate which comes from EA. It looks like this :

The root Certificate looks like this :

[edasx]

first of all, thanks for your continuos effort.

[Schultzy]

Can't We lobby pettition or something to EA for lan possible in Carbon, Cause i got it last tuesday, and dissapointed about no Lan games, i found myself here. and I have finished career mode and i would like to kick my brothers ass.

ps if you need a guinea pig for anything for this then email me at schultzy92@gmail.com and ill try it

[edasx]

[Debug]

[Guest]

Private/Public key encryption I see is the main obstacle.

Well the whole thing is based on trust. EA has one master private key in their backpocket so that their servers have it and can hence validate if the clients which connect are valid. Now to overcome this obstacle one would need to generate a new private key (a random one as brute force on the EA one is almost impossible) and change all the parts of Carbon which send out stuff verifiable with the EA key.

What I would assume EA did is assume a role of CA in the PKI mechanism. CA is a central authority whose private key is very highly protected. When a client generates a private and public key, then the CA signs this public key to say that he has validated the owner of the key pair. I guess somewhere down the throat of carbon there is a public key which has the signature of EA private key in it. That means that this has also to be regenerated and signed using the newly generated private key.

Basically one has to take all of the authentication components and recreate them and then reinsert them. Once that is done, then there is no way the software is capable of checking that it isn't connecting to the correct server as its own trust base has been compromised.

Hope it helps...[url][/url]

[edasx]

what we could do if we could not find the keys in the files of the game is editing the memory of the running process and replace the keys there... as i guess there will be uncompressed/unencrypted and easily accessible to replace by our generated fake EA public key.

What do u thing about this approach?

covo2k, can you paste in how the public key looks like?

do i understand it correctly that now we have 3 keys out of four

client public/private
server public

missing is server private...

are the client keys somewhat connected to the server keys? or all we have to do is replacing that one single server public key...

is the server public key transfered by EA server to the client or it is hardcoded in the game?

thanks for clarifing this stuff out =)

[covo2k]

Hey all.

So first i want to answer you're questions edasx.

Your idea could run. But how i said, the private key is hardcoded in the game itself. So i think even when we can dump in the memory processes and change the keys there Carbon woudln't connect because the key is hardcoded in the game.

But i can try this variant, too.

A public key looks like this :

[Guest]

I've disassembled nfsc.exe, found this code:

[Guest]

to be exact libtomcrypt version 0.97b !!!

[Guest]

What about a case of elmination with different dll files and the nfsc executable, like trying or cracking different things

Like I mentioned b4 i aint a big coder yet, Im only 14

[Guest]

what i posted before might be the public rsa key for the ad-server client.
I found another public rsa key at .rdata:009E8100
both rsakeys start with 0x98, 0x00, 0x00, 0x00, 0x01, 0x00000080 (big endian, mod len), 128 bytes mod, 0x00000003 (exp len), 0x01 0x00 0x01 (exp=65537)
(is this ASN.1 encoding ???)

[Huhn]

Hi There.
i was reading all this stuff here.
now, i hope i can explain what i am thinking, because my english is not very good, and i am from germany.

so, here we go.

it seems to me, like the only way to seperate each private key is, that some file of the game adds the whole, or a part of the cd key to a fix key, and then the whole thing gets encrypted. maybe just at the point of the installation when you putting in your cd key.
so, i think, the easiest way at this time would be to find that file what contains this client side basic key. and to do so, i think "we" 'll need to test thinks like:

cracking the cd key to values between 0000-0000-0000-0000-0000 (i think then the base key will be 0 too, if it gets multiplied) and 1000-0000-0000-0000...
like:
0000-0000-0000-0001
0000-0000-0000-0010
0000-0000-0000-0100
and this, until you get the key.

so, you will ask yourself how to put your cd key to values like that.
some days ago, i've seen a tool what can do this while being in game, but i just cant find it again !
...
OR we try to read out what files are opened at the point when you try to connect to the ea server, and then try to decrypt this file. whatever, i have no idea how to decrypt such a file.. :/

another way to find out how this works, is to know a member or an insider of any cracking-group, those guys who are also writing keygens and all this stuff. i'm sure there will be some guys who can get trough this encryption.
well..i seriously dont know a single one. crap.

an other, but very dangerous, hard and reeeaaaly bad sucking way would be, to hack the EA server, and get a copy of every f***kin file that runs on this machine. but, how to hack a server of a company that creates games, whose use savegame files with a MD5 hash?


i think this whole story is getting more and more difficult..
why oh why did EA do this to us?
sucks.