Thread: Red Alert 3 BETA [Download, Keys, Cracks, Information]

[ame="http://www.youtube.com/watch?v=anqfv8IH-Bc"]YouTube - Unlocked Red Alert 3 Beta Client[/ame]

Here the one Unlocked the Red Alert3 beta Client, Who can just do it ?
I was bored so I desided to search for the LAN-mode in the Red Alert 3 Beta but what I found was more than that.

I was able to unlock the complete mainmenu of the game: tutorial, network, skirmish, campaign, replay browser and credits. Some of them don't work e.g. like tutorial or campaign because the data that would be necessary is not included in the beta the others work as they intended to work.


Some facts for you to stop asking me the same questions over and over again:

- I have not modified the gameengine or any data and/or files related to it.
- I have not removed securom or any other kind of copyprotection!
- I have not hacked the installer to install eighter without a serial or with an invalid one. (I DO have a valid beta registration key!!!)
- I do not and will not post any links for illegally downloading the beta client. Every link posted in the comments will be deleted!
- It was just a proof-of-concept. I will release a detailed tutorial which containes every step I did to unlock the beta client as well as a small application capable of doing all the steps automatically. This application is for testing-purposes ONLY! You use it at your own risk.

@Wangyuan01:
Thank you, Wangyuan01! We are eagerly awaiting your tutorial and application.
I'm very interested in how you have done it!

I think I have a way around the CD check at launch but its not really workble at a large scale.

I used Wireshark to check what RA3 does when you launch the game and found that it was connecting via HTTPS to https://proxy.novafusion.ea.com/. I modified my HOSTS file to point to my local webserver and launched the game again hoping that if it got no response it'd carry on but sadly no. However I checked my logs and found this;

Code:

[08/Aug/2008:15:21:57 +0100] 127.0.0.1 TLSv1 RC4-MD5 "POST /drm/license?requestcode=QYQXS-MM7MH-L2UAX-WR8U2-EQUXH-C3GGU-H9ACT-6EBHK-9GP2&serial=ZXYGSVY5HW7CGDDH8DGW HTTP/1.1" 1132

I wrote a little script to mimic that request and got this in response;

Code:

<?xml version='1.0'?> <error code="LICENSE_NOT_FOUND"> <detail/> </error>

I'm pretty sure that if you can find out what the response normally is with a valid key then you could make a server that always gives a response saying the key is correct allowing people into the game.

@gailo:
Could you post a step by step guide what someone with a valid key would have to do. (I don't have one.)

Can you decrypt (SSL) the messages with the sniffer?

I think you would have to do something like that:

* start a local web server
* edit the file "hosts" to point proxy.novafusion.ea.com to local webserver
* start red alert 3 beta with valid key
* look into web server log to find the POST message used for validation
* undo changes in "hosts" and use script to send message manually to EA's web server
* copy and paste the web server response here in the forums

Thanks, gailo & deoton! Please correct me if I'm wrong!

You're pretty much spot on with what I did.

• Install xampp webserver
• Open C:\windows\system32\drivers\etc\HOSTS with notepad
• Add the following line "127.0.0.1 proxy.novafusion.ea.com"
• Start RA3 and wait for it to close
• Open the log file for the webserver "C:\xampp\apache\logs\ssl_request.log&quot ;
• Remove the line from HOSTS file added earlier
• Send the same response that the game sent to the server. I used the blelow Greasemonkey script for Firefox as it was quick to write but there's millions of way's to do this.

Code:

GM_xmlhttpRequest({     method: 'POST',     url: 'http://proxy.novafusion.ea.com/drm/license',     data: 'requestcode=QYQXS-MM7MH-L2UAX-WR8U2-EQUXH-C3GGU-H9ACT-6EBHK-9GP2&serial=ZXYGSVY5HW7CGDDH8DGW',     headers: {'Content-Type': 'application/x-www-form-urlencoded'},     onload: function(responseDetails) {         prompt('',escape(responseDetails.responseText));     } });

This pretty much all you'd have to do to get the required response from the server whiich then could be faked using our own server. The problem lies in this possibly not being the only CD check performed and may require more work but it's something that can only be discovered over time. The other possibility is to modify the file that's accessing the server and tell it to connect to the unencrypted http://proxy.novafusion.ea.com rather than the encrypted https://proxy.novafusion.ea.com as either will work. EDIT :: I love being right I used a HexEditor on paul.dll found in \RetailExe\1.0\ and cahnged the https:// into http:// and I was able to sniff the traffic with Wireshark.

So you think that you can get the reponce for a real CD key? And then use it on a "emulated" server?