How to Encrypt AccountEmail and AccountPassword?

[libai 2]

I have  many accounts that it took me many many time to config each one.

I write a config copy tool  to copy files from Settings directory and modify the file name to match the role name and server name.

But  the fields accountEmail and accountPassword in file  General-roleName-serverName.xml   are encrypted ,even i try to find a way to guess it's algorithm，but  it's not work on other machine , is there any guid to help me ?

on one machine it like this, but when i change to other  the result also changes.

a 603
b 604
c 605
d 606
e 607
f 608
g 609
h 610
i 611
j 612
k 613
l 614
m 615
n 616
o 617
p 618
q 619
r 620
s 621
t 622
u 623
v 624
w 625
x 626
y 627
z 628

0 554
1 555
2 556
3 557
4 558
5 559
6 560
7 561
8 562
9 563

 

[libai 2]

"g8802"  encrypted different result on different machine.
<AccountEmail>609-562-562-554-556</AccountEmail>
<AccountEmail>578-531–531-523-525</AccountEmail>

[libai 2]

 

[Matenia 630]

It's probably encrypted with a salt. I doubt Droidz will share that. 
It's probably easier to set the values to the Settings class via a plugin, then restart the bot and turn off the plugin.

 

[Droidz 2755]

Hello,

You can use the same settings file on several machines if you use a static encryption key : https://wrobot.eu/byme/doc/html/F-robotManager.robotManagerGlobalSetting.ForceStaticEncryptKey.htm (edit xml file "WRobot\Settings\RobotManagerGlobalSetting.xml")

[nax 8]

You could consider creating a system where the decryption key is generated based on the user's IP address or hardware ID. To implement this, you'll need to delve into the field of cryptography and learn how to securely handle and manage these keys,

 

i am currently researching this to give people able to protect their own fightclasses / profiles etc.

[libai 2]

  On 11/2/2023 at 11:05 AM, Droidz said:

Hello,

You can use the same settings file on several machines if you use a static encryption key : https://wrobot.eu/byme/doc/html/F-robotManager.robotManagerGlobalSetting.ForceStaticEncryptKey.htm (edit xml file "WRobot\Settings\RobotManagerGlobalSetting.xml")

Expand  

thank you Droidz，it works.

[libai 2]

  On 11/2/2023 at 10:02 AM, Matenia said:

It's probably encrypted with a salt. I doubt Droidz will share that. 
It's probably easier to set the values to the Settings class via a plugin, then restart the bot and turn off the plugin.

 

Expand  

it's a really nice point, thank you.

[libai 2]

  On 11/2/2023 at 3:30 PM, Nax said:

You could consider creating a system where the decryption key is generated based on the user's IP address or hardware ID. To implement this, you'll need to delve into the field of cryptography and learn how to securely handle and manage these keys,

 

i am currently researching this to give people able to protect their own fightclasses / profiles etc.

Expand  

 

fightclassed can be compile into dll and then use some tool to encrypt ... but how to do with files in profiles .. like quests  it seems no way to compile to dll 

[Matenia 630]

  

  On 11/3/2023 at 3:11 AM, libai said:

 

fightclassed can be compile into dll and then use some tool to encrypt ... but how to do with files in profiles .. like quests  it seems no way to compile to dll 

Expand  

If you're an authorized seller, you can encrypt it with Droidz' software and the real version will only be available from the servers.

 

  On 11/2/2023 at 3:30 PM, Nax said:

You could consider creating a system where the decryption key is generated based on the user's IP address or hardware ID. To implement this, you'll need to delve into the field of cryptography and learn how to securely handle and manage these keys,

 

i am currently researching this to give people able to protect their own fightclasses / profiles etc.

Expand  

Don't create an encryption ID based on IP, that's bound to lead to issues. If you do it based on MAC address, it's probably the smartest - it can be changed but you're not fucking users over if they swap out their hardware - most users won't change their motherboard too frequently - or their NIC for that matter.

I recommend creating keys on purchase, unique to the user (order id + email) and validating them periodically (heartbeat) - or if your server can handle it, just keep a bunch of TCP connections open for user sessions.
I shared my server that does exactly this and can be attached to Rocketr in the authorized sellers forums and it's what most people here were using. It's good enough, if your DLLs are properly obfuscated.

Can it still be cracked somewhat easily by someone with extensive reverse engineering knowledge? Of course. But so can pretty much any program you write.

Edited November 3, 2023 by Matenia

[nax 8]

  On 11/3/2023 at 7:45 AM, Matenia said:

  

If you're an authorized seller, you can encrypt it with Droidz' software and the real version will only be available from the servers.

 

Don't create an encryption ID based on IP, that's bound to lead to issues. If you do it based on MAC address, it's probably the smartest - it can be changed but you're not fucking users over if they swap out their hardware - most users won't change their motherboard too frequently - or their NIC for that matter.

I recommend creating keys on purchase, unique to the user (order id + email) and validating them periodically (heartbeat) - or if your server can handle it, just keep a bunch of TCP connections open for user sessions.
I shared my server that does exactly this and can be attached to Rocketr in the authorized sellers forums and it's what most people here were using. It's good enough, if your DLLs are properly obfuscated.

Can it still be cracked somewhat easily by someone with extensive reverse engineering knowledge? Of course. But so can pretty much any program you write.

Expand  

this is interesting, ill have to take a look at the code. i dont use Dll, my code is for my project .