Unreal.Tournament.2003 Multiplaying

[C0unci1]

i opened up the ut2003.ini file in the ut2k3/system folder, and all the ip's in the favorites browser are cached there. Did some copying and pasting from the stat page, and added all the servers. I was able to connect to about half of them, the other half said "Server running outdated version". Might be demo servers, but i didn't think demo servers showed up on stats pages. Barely anyone was playing. There is a "port" and a "queryPort", for servers that run on 7777, 7778 is the query port. other servers used different ports than 7777, and it seems that if you change the queryPort to one number higher than the port, it shows up on the fav page.

[C0unci1]

added all of the server ip's i could find, quite a few. If you get the port and queryPort right, they all respond. I could enter all of them, but there were about 15 people total in the 26 or so servers i tried. come on guys, GET YOUR ASSES IN THERE!
btw, it helps to enter an ip from inside the game the first time around, so you know the format and then start editing it from the ini. When ASE starts supporting ut2k3, it'd be possible to play this game... online.. with out ever having to buy it. god that makes me happy

;akjmn;ovakm pocijtgrpivmvpoiuxzuir4nga;zdfkljmnsfd;lkj vnm

[zTz]

yeah gueZz we'll have to wait for ASE, btw whats the website for ASE??

[Hellkeeper]

Unreal Tournament 2003 - Online Play


How it really works:

Both the client and server have no checking of the CD-Key besides the initial check that the DEViANCE key generator gets around.

However on connection of the client to the master server (ut2003master1.epicgames.com / ut2003master2.epicgames.com) a challenge is sent.
This challenge contains the CDKey in MD5 Hash form.
Based on that the master server can decide if you match with a valid key in their database. Since the CDKey is MD5 hashed, it means they got a complete database of all keys (or hashes on them) on the remote end. So it will be impossible to generate a valid key (chances are EXTREMELY slim that you hit a key which is published on a box).
After the key has been authenciated to the master server it will gave a gamelist.

It does seem that running a server works fine, i.e. the server report to the master server without requiring the challenge. Of course thats logical assuming they want as many servers up and running as possible (also dedicated linux / windows server).



As far as can be seen now there might be a few possible ways around this. As soon as GameSpy or All Seeing Eye starts supporting Unreal 2003 you can try to edit your ut2003.ini ( master.gamespy.com or master.udpsoft.com ). In the [ipdrv.MasterUplink] master servers are editable. Other methods are looking up the server externally outside of Unreal Tournament 2003 using Gamespy or ASE, or use webpages with unreal:// urls to servers

[FM20]

Originally posted by C0unci1
I was able to connect to about half of them, the other half said "Server running outdated version". Might be demo servers, but i didn't think demo servers showed up on stats pages.

I tried about 10 servers, they all said "Server running outdated version". Damn

edit: those were demo servers, I found a few for the final that were online. They worked, but no players online unfortunately

[Coastered]

http://www.qtracker.com/download.shtml

[Zander]

Hellkeeper,

You are 100% right. Last night I did a little research (Sniffer) and found that keys are being sent to the Master Server, but I didn't know what the format was. Noting your post above this morning I ran a MD5 hasher against my cdkey (from the keygen) and *poof*, that's the first string I see in the packet. The odd thing is, in the packet there are 2 md5 hashed strings, one is the cd-key, the other one I can't figure out yet. The first hash is always the key and is static between tries or sessions of the game, but the second hash in the packet changes everytime you query the master server, I guess it's seeded on the time somehow. Maybe a XOR with the time/date and your key? Dunno. I guess I could run an un-hasher against it, but if it's really long I don't think I will never crack it.

So yeah, they check keys in the server browser, yet you can still join games if you know the IP. I guess we wait for a 3rd party browser to work with UT2K3.

Z

[FM20]

Wouldn't it be strange if Epic just lets us keep on doing this, connecting to IP's directly with illegal keys?

Not that I mind, but it would be logical if they 'fix' this in a patch or something, wouldn't it??

Until then, frag on and wait for an ASE update

[Zander]

FM20,

I agree, while this whole server browser/key checking thing does suck, I am much more worried about Epic issueing a patch that kills playing on legit servers with the ISO at all.

Z

[QuickKill]

Originally posted by CyBorx7


and LAN does not require a master server ?

That is correct

[Hellkeeper]

Originally posted by Zander
Hellkeeper,

You are 100% right. Last night I did a little research (Sniffer) and found that keys are being sent to the Master Server, but I didn't know what the format was. Noting your post above this morning I ran a MD5 hasher against my cdkey (from the keygen) and *poof*, that's the first string I see in the packet. The odd thing is, in the packet there are 2 md5 hashed strings, one is the cd-key, the other one I can't figure out yet. The first hash is always the key and is static between tries or sessions of the game, but the second hash in the packet changes everytime you query the master server, I guess it's seeded on the time somehow. Maybe a XOR with the time/date and your key? Dunno. I guess I could run an un-hasher against it, but if it's really long I don't think I will never crack it.

So yeah, they check keys in the server browser, yet you can still join games if you know the IP. I guess we wait for a 3rd party browser to work with UT2K3.

Z

Actually the second key is pretty easy too. I mentioned there is a challenge. A challenge always exists of 2 way communication. So if you look in your sniffs you'll see there is a packet coming from the master server on connection, thats the seed packet you are referring too.

The general packet format is easy.

Each packet starts with 4 bytes which is the length of the following packet data. Packets are untagged, meaning its order is important for the packet parsers in both clients.
The client MD5 packet is also length indexed, in front of each MD5 hash, it gives a byte with the length 21 (which is the 20 byte MD5 hash + the null terminator) and the CLIENT tag has a length of 7.

It might be interesting to see what the server sends as the server does show up on the master list, I haven't checked as of yet but I got a hunch it will say SERVER. If servers do have server list query rights however you could spoof your client as server. All in all very interesting to research. (Lets see what brainmass most isonews members have )

[Drem]

Would it be possible for my and my friend out of town to set up a VPN and play just like on a LAN?

[Zander]

hmmmmm, interesting.

"
It might be interesting to see what the server sends as the server does show up on the master list, I haven't checked as of yet but I got a hunch it will say SERVER. If servers do have server list query rights however you could spoof your client as server.
"

This is an interesting idea. Tonight, when I get home, I'll sniff a server's setup procedure and announcement to the master server and depending on those results maybe I'll dust off the old packet writer. We'll see what happens.

I was also thinking of possibly crafting packets to try to authenticate to Epic with various keys. I know this would take many attempts, but the attempts to query could occur in quick succession giving you a valid key "relativly" quickly. Although even if this DID work it would be easy for Epic to trace you.

Hellkeeper, do you know of another forum where actual constructive work can be done on this? The isonews forums aren't exactly a bastion of knowledge if you know what I mean when it comes to this sorta thing.

Z

[hornet303]

Drem, that should work just fine. I do that for WC3. Assuming you have everything set up properly, it should know no difference. But also, like the guys are saying, you dont necessairly need to do that. Just have the one who has the greatest upload throughput host a game, tell you the IP and have them join the game. Its not checking IP based games. It seems that its just restricting ISO users from viewing the master list.

[hugo slokm]

why would you have to setup vpn to play with a friend,why not just start a server and give him your ip,you can still join anygame,you just cant get the master server list

[Hellkeeper]

Research shows there is a hole though.

A client authenciation goes as follows:

Packet #1
0x0000   07 00 00 00 06 32 36 35-37 34 00                  .....26574.

Packet #2
0x0000   51 00 00 00 21 37 62 33-32 66 33 62 34 65 35 66   Q...!7b32f3b4e5f
0x0010   61 63 30 35 65 61 37 63-65 31 65 38 30 37 38 64   ac05ea7ce1e8078d
0x0020   61 61 38 34 64 00 21 xx-xx xx xx xx xx xx xx xx   aa84d.!xxxxxxxxx
0x0030   xx xx xx xx xx xx xx xx-xx xx xx xx xx xx xx xx   xxxxxxxxxxxxxxxx
0x0040   xx xx xx xx xx xx xx 00-07 43 4C 49 45 4E 54 00   xxxxxxx..CLIENT.
0x0050   3B 08 00 00 04                                    ;....

After the challenge there simply is no response from the master server. Effectively blocking the client in the "Querying master server" state, which we see in the menu.

A server connection works as follows:

Packet #1
0x0000   06 00 00 00 05 35 34 36-31 00                     .....5461.

Packet #2
0x0000   55 00 00 00 21 37 62 33-32 66 33 62 34 65 35 66   U...!7b32f3b4e5f
0x0010   61 63 30 35 65 61 37 63-65 31 65 38 30 37 38 64   ac05ea7ce1e8078d
0x0020   61 61 38 34 64 00 21 xx-xx xx xx xx xx xx xx xx   aa84d.!xxxxxxxxx
0x0030   xx xx xx xx xx xx xx xx-xx xx xx xx xx xx xx xx   xxxxxxxxxxxxxxxx
0x0040   xx xx xx xx xx xx xx 00-07 53 45 52 56 45 52 00   a7c851e..SERVER.
0x0050   3B 08 00 00 FF FF FF FF-04                        ;...ÿÿÿÿ.

Packet #3
0x0000   0A 00 00 00 09 41 50 50-52 4F 56 45 44 00         .....APPROVED.

Here we see the same CD Key is used (as the first hash is the same), but this time the master server will allow it.

Apparently the master server allows servers to be listed regardless of key (as we already knew from experimentation).

So it would be theoretically possible to spoof the client as being a server. The master server might not put connections in a certain client or server pool and work fine. Its certainly worth the research. This can be achieved by writing either a gateway master server (which changes CLIENT to SERVER on the fly). Or modifiying the executable code to send SERVER. Both should be easily possible as the strings are of the same length.

On a side note:
Zander no other forums come to mind right now, I looked at other Unreal Tournament 2003 forums, but they are all about how do I cheat in multiplayer shit. So I decided not to mess with that

[Hellkeeper]

err... my bad ;p

[Zander]

Interesting point on the server/client issue.

I noticed that the frames between client and server modes are identical except for the last section...

Client trace

0x0040   xx xx xx xx xx xx xx 00-07 43 4C 49 45 4E 54 00   xxxxxxx..CLIENT.
0x0050   3B 08 00 00 04                                    ;....

Server trace

0x0040   xx xx xx xx xx xx xx 00-07 53 45 52 56 45 52 00   a7c851e..SERVER.
0x0050   3B 08 00 00 FF FF FF FF-04                        ;...ÿÿÿÿ.

The server seems to have FFFFFFFF padded at the end of the packet, I wonder what this could be. It IS in a four-octet format similair the an IP, but that's too convenient and I can't figure out how 255.255.255.255 can be relevant. I think the changing of the CLIENT string in the exe to SERVER is a good idea to try, although I think that might put the session in a mode where the master server has no intention of sending browser data to the client as a server doesn't really need that sort of thing, but you could be right.

Unfortunately my knowledge is limited to networking/routing. I'm not much of a programmer and am afraid there isn't a whole lot I could do to progress much farther, other than for knowledge. Which is fine I guess.

Know of a good packet writer that will work under NT/2K/XP? The one I have (from ntobjectives) will allow me to write IP/TCP info for the packet, but no the data payload. I'll need the data section obviously for the challenge to try some stuff out. I have a couple of packet writers for linux but I don't have a box with linux loaded right now, I guess worst-case I just load redhat up on an extra HDD and play around that way, but I'm more proficient at Sniffer Pro, Netmon and Iris then I am at linux sniffers.

I will try to play around tonight though, we'll see what happens.

Z

[Drem]

Thanks for the input guys. I didn't know ip based games work. That is good news.

[gunhero]

hello
this might be a stupid idea but what the heck

why dont anyone of you with good programming skills make your own master server program

like somekind of program that you run with unreal 2003 that sends your ip to a privat server if your host a game..
and then that server could send out the whole list like on a website or into the program to everyone that wants to play..


i hope you know what i meen =)

in my head it doesnt seem hard to make
i would if i had the c++ skills =)
ohh well
=)