Simcity SSL Library + Intercept every Origin encrypted data

[seguromy 3]

Hello everyone,

 

I was wondering what the simcity client was saying to the simcity servers and vice-versa and I thought that I may be able to intercept the data.

 

As a lot of people have constated, man in the middle is not working as the simcity client is not using the windows certificate database to search for root certificates:

I therefore thought that I may be able to intercept the data when the client pushes it in the SSL library.

 

I saw in the Simcity/core folder the libeay.dll and ssleay.dll libraries so I decided to compile a personnaly modified version of the OpenSSL library that would allow me to record the data before the encryption (this is completely legal as OpenSSL is open source).

 

Unfortunately it seems that these libraries are not used by the simcity client as my code is never executed.

Surprisingly Origin is however using these libraries so I am able to see everything that Origin sends to EA. And it talks a lot !!! (it tells them what you play, when you play it ...)

 

I will explain how to do it if you do not want to execute unknow code (which I recommend as it is quite easy), I just have to polish a little bit the instructions so this will come in a futur post. For those that do not fear anything I can send these modified libraries.

 

 

My question is : does anyone know which library simcity is using to encrypt its data using SSL? If we find it and it is also open source we could finally see the simcity network traffic.

[seguromy 3]

Here are the instructions to modify the OpenSSL library. I repeat that this is completely legal as OpenSSL is an open source library.

 

Get the necessary software

- Download the OpenSSL sources : https://www.openssl.org/source/

- Download Microsoft Visual C++ 2012 (free on Microsoft website)

- Download PERL (I used ActiveState's PERL) : http://www.activestate.com/activeperl

- Download NASM : http://www.nasm.us/

 

Modify the source

- Extract the source in C:\OpenSSL

- Go to the SSL folder and open the file : ssl_lib.c

- Find the SSL_Read function

- Add theses lines at the beginning of the function :

  FILE *file_desc;

  file_desc = fopen("C:\\OpenSSL\\debug.dat", "a+");

  fwrite(buf, num, 1, file_desc);

  fclose(file_desc);

- Add these lines also at the beginning of the function SSL_Write

 

Compile the library

- Open the cmd

- Go to the OpenSSL directory

- Type : call "C:\Program Files\Microsoft Visual Studio 11.0\VC\vcvarsall.bat"

- Type : perl Configure VC-WIN32 enable-static-engine --prefix=c:\openssl

- Type : call ms\do_nasm

- Type : nmake -f ms\ntdll.mak

- Type : nmake -f ms\ntdll.mak install

- Type ; nmake -f ms\ntdll.mak clean

 

Replace the libraries

- Go to the Origin folder

- Save the libeay32.dll and ssleay32.dll original files

- Copy the new DLL files to this folder (they should be in c:\OpenSSL\bin)

 

Now when you launch Origin you will see a file in the c:\OpenSSL directory called debug.dat which is rapidly growing and which is containing all data transfered between Origin and EA servers.

[belarm 0]

So who's going to be the first person brave enough to post a scrubbed dump from their client?

[seguromy 3]

I won't .

 

Just a tip on what you will find :

everything between Origin and EA is HTTP so we have an interesting view of the EA API. Also it is using gzip compression over HTTP so a lot of the logs are binary waiting to be uncompressed.

[frankc123 2]

:\

[Alex Z 0]

Encryption is meant to keep your data from anyone else between you and a server. 

 

Please be wary of anyone handing out custom SSL DLLs for you to use. Once the data is decrypted that library could potentially transmit the decrypted information to them. It could also do other malicious things on your system.

 

 

[jdenm8 362]

Encryption is meant to keep your data from anyone else between you and a server.

To be honest, this type of data is so trivial, Data Security is not the reason for the encryption of this data. By this point, you've already logged in and any personally identifiable information has been communicated.

For the most part, the encryption is purely to prevent owners of SimCity using alternative server solutions.

[w0lfalot 18]

As a lot of people have constated, man in the middle is not working as the simcity client is not using the windows certificate database to search for root certificates:

I therefore thought that I may be able to intercept the data when the client pushes it in the SSL library.

 

My question is : does anyone know which library simcity is using to encrypt its data using SSL? If we find it and it is also open source we could finally see the simcity network traffic.

 

Have you got any link for an explanation or can you go into depths why HTTPS Man-in-the-middle wouldn't work ?

 

I've also tried to hook Winsock and decrypt SSL. I get alot of requests you wouldn't get with simple wininet wexproxy, but I haven't succeeded in SSL either, although it would make alot of more things easier to understand the game as well.

[gibbed 10]

Have you got any link for an explanation or can you go into depths why HTTPS Man-in-the-middle wouldn't work ?

 

I've also tried to hook Winsock and decrypt SSL. I get alot of requests you wouldn't get with simple wininet wexproxy, but I haven't succeeded in SSL either, although it would make alot of more things easier to understand the game as well.

 

Server certificate is validated by the client, it doesn't blindly accept whatever you throw at it.

[hellcatv 0]

The reddit folks are having a similar discussion here

http://www.reddit.com/r/SimCity/comments/1e72fw/

 

I'm not sure if the OP had modified the client to disregard the cert check or if he hasn't really gotten it working.

[gibbed 10]

What the OP has achieved is logging of Origin client, not SimCity.