Runes of Magic
From Protocolinfo
Runes of Magic is a free-to-play MMORPG developed by Runewaker Entertainment and Frogster. The game is currently in open beta. The official website is at http://www.runesofmagic.com.
Contents |
[edit] Identification
[edit] Ports
- [OUT] TCP 21002: For account login.
- [OUT] TCP 16401-16402, 16502: Online game play.
[edit] l7-filter
No official pattern exists for this game. It is unknown whether its communication protocol is encrypted or not. The following is a packet capture from the game during login to server selection:
Server:
10 00 00 00 03 78 76 7a 1e 8a dd b5 95 a3 3a de .....xvz ......:. 0a 00 00 00 02 df 85 cc cc cc ........ ..
Client reply:
0e 00 00 00 02 28 82 cc cc cc 8b c9 cc cc .....(.. ......
Server:
2e 00 00 00 02 1e 7f f4 f4 f4 ef f4 f4 f4 b3 8c ........ ........ 95 88 a3 82 86 f4 92 f4 f4 f4 93 f4 f4 f4 98 f4 ........ ........ f4 f4 99 f4 f4 f4 96 f4 f4 f4 97 f4 f4 f4 2e 00 ........ ........ 00 00 02 bb 7f 3c 3c 3c 30 3c 3c 3c 71 9d 8b 88 .....<<< 0<<<q... 99 8a 6b 99 8a 86 99 8a 3c cd f6 d6 54 a9 02 c0 ..k..... <...T... 72 3f 8b 60 36 59 64 9f e1 02 0c de r?.`6Yd. .... 16 00 00 00 02 1b 97 14 14 14 0f 14 14 14 18 14 ........ ........ 14 14 87 14 14 14 1a 00 00 00 02 77 37 b2 b2 b2 ........ ...w7... af b2 b2 b2 aa b2 b2 b2 33 b2 b2 b2 65 46 cb 69 ........ 3...eF.i 16 00 00 00 02 80 c7 42 42 42 4e 42 42 42 46 42 .......B BBNBBBFB 42 42 0a 42 42 42 1a 00 00 00 02 7a 87 02 02 02 BB.BBB.. ...z.... 0e 02 02 02 0a 02 02 02 e0 02 02 02 02 02 02 02 ........ ........
Bytes 10 00 00 00 03, 0a 00 00 00 02 and 0e (client reply) were consistently present. The following filter pattern was written to match the first few consistent bytes:
^\x10\x03...........\x0a\x02.....\x0e
The pattern was able to match during the closed beta period. It is still matching okay after Runes of Magic started its open beta but could definitely use more testing from others to verify effectiveness.
