Sessionkey Decryption

As you can see in the algorithm the encryption uses a simple xor operator, which is vulnerable for a know-plaintext attack.

For receiving the sessionkey, this tool uses an ingame macro, which causes the client to send several packets with an *identifiable* payload. As soon as the sniffer recognizes this payload in the stream, it extracts the 6 header bytes (2 bytes size + 4 bytes opcode) of these packets. If there are at least 7 packets in a row (7*6=42, sessionkey is 40 bytes long), it has enough data to reconstruct the sessionkey. These 42 bytes are referred as "taintedBytes" in the source code.

The sniffer knows the plaintext of the header and simply reverses the encryption algorithm, leading to an *shuffled* sessionkey.

In the last step, the client shuffles the sessionkey, until the whole session can be decrypted with it - if it reads the packets send by the macro, we finally have the sessionkey :)