Red Alert 3 BETA [Download, Keys and Information]

[Wangyuan01]

[video=youtube;anqfv8IH-Bc]https://www.youtube.com/watch?v=anqfv8IH-Bc"][/video]

Here the one Unlocked the Red Alert3 beta Client, Who can just do it ?
I was bored so I desided to search for the LAN-mode in the Red Alert 3 Beta but what I found was more than that.

I was able to unlock the complete mainmenu of the game: tutorial, network, skirmish, campaign, replay browser and credits. Some of them don't work e.g. like tutorial or campaign because the data that would be necessary is not included in the beta the others work as they intended to work.


Some facts for you to stop asking me the same questions over and over again:

- I have not modified the gameengine or any data and/or files related to it.
- I have not removed securom or any other kind of copyprotection!
- I have not hacked the installer to install eighter without a serial or with an invalid one. (I DO have a valid beta registration key!!!)
- I do not and will not post any links for illegally downloading the beta client. Every link posted in the comments will be deleted!
- It was just a proof-of-concept. I will release a detailed tutorial which containes every step I did to unlock the beta client as well as a small application capable of doing all the steps automatically. This application is for testing-purposes ONLY! You use it at your own risk.

 

[wg3bfu]

@Wangyuan01:
Thank you, Wangyuan01! We are eagerly awaiting your tutorial and application.
I'm very interested in how you have done it!

 

[Assassin]

Yes, very nice job there Wangyuan01!
I think the amount of levels is nearly the same as in C&C3 btw. Remember the Scrin only had like 4 levels.

 

[InsaneNutter]

Despite warnings by Nimrod I have had to remove a few posts, we are not a strict community however we do need to take action when links to torjans are posted. I have also taken the opportunity to clean this thread up so it easy for people to find the relevant information posted. We have some very good information posted here and it looks like progress is slowly been made, as previously posted by Nimrod it doesn’t help when people are constantly re posting the same post.

If your post was removed it’s nothing personal, this thread was getting a bit out of hand.

 

[gailo]

I think I have a way around the CD check at launch but its not really workble at a large scale.

I used Wireshark to check what RA3 does when you launch the game and found that it was connecting via HTTPS to https://proxy.novafusion.ea.com/. I modified my HOSTS file to point to my local webserver and launched the game again hoping that if it got no response it'd carry on but sadly no. However I checked my logs and found this;

[08/Aug/2008:15:21:57 +0100] 127.0.0.1 TLSv1 RC4-MD5 "POST /drm/license?requestcode=QYQXS-MM7MH-L2UAX-WR8U2-EQUXH-C3GGU-H9ACT-6EBHK-9GP2&serial=ZXYGSVY5HW7CGDDH8DGW HTTP/1.1" 1132

I wrote a little script to mimic that request and got this in response;

<?xml version='1.0'?> <error code="LICENSE_NOT_FOUND"> <detail/> </error>

I'm pretty sure that if you can find out what the response normally is with a valid key then you could make a server that always gives a response saying the key is correct allowing people into the game.

 

[wg3bfu]

@gailo:
Could you post a step by step guide what someone with a valid key would have to do. (I don't have one.)

 

[wg3bfu]

Can you decrypt (SSL) the messages with the sniffer?

I think you would have to do something like that:

* start a local web server
* edit the file "hosts" to point proxy.novafusion.ea.com to local webserver
* start red alert 3 beta with valid key
* look into web server log to find the POST message used for validation
* undo changes in "hosts" and use script to send message manually to EA's web server
* copy and paste the web server response here in the forums

Thanks, gailo & deoton! Please correct me if I'm wrong!

 

[gailo]

You're pretty much spot on with what I did.

• Install xampp webserver
• Open C:\windows\system32\drivers\etc\HOSTS with notepad
• Add the following line "127.0.0.1 proxy.novafusion.ea.com"
• Start RA3 and wait for it to close
• Open the log file for the webserver "C:\xampp\apache\logs\ssl_request.log"
• Remove the line from HOSTS file added earlier
• Send the same response that the game sent to the server. I used the blelow Greasemonkey script for Firefox as it was quick to write but there's millions of way's to do this.

GM_xmlhttpRequest({     method: 'POST',     url: 'http://proxy.novafusion.ea.com/drm/license',     data: 'requestcode=QYQXS-MM7MH-L2UAX-WR8U2-EQUXH-C3GGU-H9ACT-6EBHK-9GP2&serial=ZXYGSVY5HW7CGDDH8DGW',     headers: {'Content-Type': 'application/x-www-form-urlencoded'},     onload: function(responseDetails) {         prompt('',escape(responseDetails.responseText));     } });

This pretty much all you'd have to do to get the required response from the server whiich then could be faked using our own server. The problem lies in this possibly not being the only CD check performed and may require more work but it's something that can only be discovered over time. The other possibility is to modify the file that's accessing the server and tell it to connect to the unencrypted http://proxy.novafusion.ea.com rather than the encrypted https://proxy.novafusion.ea.com as either will work. EDIT :: I love being right I used a HexEditor on paul.dll found in \RetailExe\1.0\ and cahnged the https:// into http:// and I was able to sniff the traffic with Wireshark.

 

[cyrilthebest8]

So you think that you can get the reponce for a real CD key? And then use it on a "emulated" server?

 

[FandomofHell]

How would you get the response for a legitimate key? Wouldn't that require getting someone in on this who has NOT already logged in with their key?

BTW, nice job with the Wireshark sniffer.

 

[deoton]

Im not sure but it would be rational that it would check the key after every install from the server.
So if you have a legitimate key reinstall and check the response.

 

[deoton]

I love being right I used a HexEditor on paul.dll found in \RetailExe\1.0\ and cahnged the https:// into http:// and I was able to sniff the traffic with Wireshark.

I tried that but after that it couldn't connect my server that was running in port 80 or to the ea server.

 

[FandomofHell]

Im not sure but it would be rational that it would check the key after every install from the server.
So if you have a legitimate key reinstall and check the response.

But, by your logic, wouldn't that also mean that people who stole the executable file would also be able to connect as long as the serial code was correct? That wouldn't explain why people haven't been able to play the RA3 beta yet despite the innumerable keys on the front page... which is why people keep getting "invalid key" statements when they have been trying to boot up the game.

I might be talking out of my ear here, but is it possible that the game has a change in its registry coding after the demo has been verified? A change that is initiated by the contact with EA's server?

Edit: I didn't think about tracking MAC or IP addresses. It might be possible that the games are tracked through these as a way of allowing for your method to work.

 

[deoton]

people who stole the executable file

nobody stole it somebody downloaded it from fileplanet and uploaded to mininova and demonoid and such.

...would also be able to connect as long as the serial code was correct?

they did not have a legitimate key they used a keygen to generate them.

And I assume that after the game has validated the key it will add or modify some key in the registry.

 

[cyrilthebest8]

Just to say, when you have your cd key and you connect to your account with it, it'll be assigned to your account and nobody else can use it...

 

[gailo]

Also looking at paul.dll shows some of the error messages it looks for and includes for if someone with the same key is already connected or if that key has been revoked so even if a legit key was leaked they could still stop people from using it.

 

[FandomofHell]

nobody stole it somebody downloaded it from fileplanet and uploaded to mininova and demonoid and such.

Isn't that TECHNICALLY stealing, since it is only supposed to be downloaded through FilePlanet?

Anyway, I don't really care about the semantics. I want this thing cracked.

they did not have a legitimate key they used a keygen to generate them.

I thought the keys on the front page were uploaded by legitimate users? I've seen some of the keys before on other sites as being claimed by the owners.

And I assume that after the game has validated the key it will add or modify some key in the registry.

THAT's what I'm wondering. Is it just an edited registry? Or do the EA servers track the computers that have certain types of codes, through the MAC or IP (I wouldn't know which one)? I mean, the beta IS installed on the main computer, so getting the MAC should be possible for the beta launcher, shouldn't it?

Eh, I only know basic hacking. I wish I knew more. Then I could actually help... T_T

Edit:

Also looking at paul.dll shows some of the error messages it looks for and includes for if someone with the same key is already connected or if that key has been revoked so even if a legit key was leaked they could still stop people from using it.

So the EA servers DO track the keys! However, tracking the keys could still let some people in. Is it possible they are tracking IPs and/or MACs?

 

[deoton]

I mean, the beta IS installed on the main computer, so getting the MAC should be possible for the beta launcher, shouldn't it?

It doesn't work that way. After inspecting paul.dll i've come to a conclusion that every time ra3 is ran it checks is the key valid from the ea server. :-D

 

[Lavarider]

not true deoton, I have a legit key. If I log off the internet, i can still play the beta. It does not need to check the server more than once. The activation data is all in the registry.

 

[cyrilthebest8]

As I said before, your key is linked to your account, try playing with another account and It'll say that the code is already used by another account