Skip to content

Commit

Permalink
Update readme and version
Browse files Browse the repository at this point in the history
  • Loading branch information
Nickid2018 committed Sep 26, 2024
1 parent 76338cc commit 8d07d1c
Show file tree
Hide file tree
Showing 3 changed files with 39 additions and 39 deletions.
16 changes: 5 additions & 11 deletions README-zh_CN.MD
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@

构建的文件可以在 Action 里面找到,稳定版可以在 Release 里面找到。

Windows 下载后把`mcdissector.dll`文件放入 Wireshark 的解析器目录(`plugins/4.2/epan`)并启动 Wireshark 即可。
Windows 下载后把`mcdissector.dll`文件放入 Wireshark 的解析器目录(`plugins/<Wireshark版本>/epan`)并启动 Wireshark 即可。

Linux 下载后把`mcdissector.so`文件放入 Wireshark 的解析器目录(`~/.local/lib/wireshark/plugins/4.2/epan`)并启动 Wireshark 即可。
Linux 下载后把`mcdissector.so`文件放入 Wireshark 的解析器目录(`~/.local/lib/wireshark/plugins/<Wireshark版本>/epan`)并启动 Wireshark 即可。

对于 Arch Linux,可以直接使用 AUR 里面的`wireshark-minecraft-dissector`包。

Expand All @@ -24,8 +24,7 @@ Linux 下载后把`mcdissector.so`文件放入 Wireshark 的解析器目录(`~

* Directory for protocol data:放置协议数据的目录,用于解析数据。
* Ignore Packets:阻止解析一些包,用于过滤不需要的信息。格式为以`<s|c>:<packet_name>`组成的以逗号分割的列表,其中`s`
代表发向服务端的包,`c`代表发向客户端的包。默认为`c:map_chunk`
即停止解析服务端发向客户端的区块数据包,这种类型的包会使解析器消耗很长时间,并且会产生过量的数据字段,所以默认禁用。
代表发向服务端的包,`c`代表发向客户端的包。默认为空。推荐设置为`c:level_chunk,c:level_chunk_with_light`
* Secret Key:用于加密连接解密数据的密钥,格式为 32 长度的 16 进制字符串。
* NBT Decoding:是否解析 NBT 数据。
* TCP Port(s):更改 MCJE 协议使用的 TCP 端口,用于识别协议。
Expand All @@ -34,12 +33,7 @@ Linux 下载后把`mcdissector.so`文件放入 Wireshark 的解析器目录(`~

所有协议数据都从外部目录读取,此目录由选项`Directory for protocol data`控制。

可以直接使用[MC_Protocol_Data](https://github.com/Nickid2018/MC_Protocol_Data)提供的协议数据,此仓库分为三个主要分支:
* `master`:包含所有协议数据。
* `only-protocol`:只包含协议格式数据,不包含任何其他文件。
* `only-essentials`:(推荐)只包含必要的协议数据(实体同步数据等),不包含任何其他文件。

直接使用这些分支的源代码压缩包或者克隆仓库到指定协议目录即可。
可以直接使用[MC_Protocol_Data](https://github.com/Nickid2018/MC_Protocol_Data)提供的协议数据,直接使用源代码压缩包或者克隆仓库到指定协议目录即可。

## 加密连接

Expand Down Expand Up @@ -102,5 +96,5 @@ Linux 下载后把`mcdissector.so`文件放入 Wireshark 的解析器目录(`~
- [x] 写的差不多了!(至少不炸了!)
- [x] linux 支持 by @xtexChooser
- [x] 支持加密。(应该没问题了!)
- [ ] 版本兼容性。
- [x] 版本兼容性。(尽量支持到最新版)
- [ ] 支持基岩版。
60 changes: 33 additions & 27 deletions README.MD
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,16 @@ English | [简体中文](./README-zh_CN.MD)

## How To Use?

Built files can be found in Actions, stable version can be found in Release.
Built files can be found in Actions, a stable version can be found in Release.

After downloading:

For Windows, put file `mcdissector.dll` into dissector directory of Wireshark (`plugins/4.2/epan`) and run Wireshark.
For Windows,
put file `mcdissector.dll` into dissector directory of Wireshark (`plugins/<Wireshark Version>/epan`) and run Wireshark.

For Linux, put file `mcdissector.so` into dissector directory of Wireshark (`~/.local/lib/wireshark/plugins/4.2/epan`) and run Wireshark.
For Linux,
put file `mcdissector.so` into dissector directory of Wireshark
(`~/.local/lib/wireshark/plugins/<Wireshark Version>/epan`) and run Wireshark.

For Arch Linux, you can use package `wireshark-minecraft-dissector` in AUR.

Expand All @@ -25,42 +28,45 @@ For Arch Linux, you can use package `wireshark-minecraft-dissector` in AUR.
`Minecraft` can be found in `Preferences/Protocols` in Wireshark, where you can adjust some options here.

* Directory for protocol data: The directory for protocol data, used to parse data.
* Ignore Packets: Prevent parsing some packets to filt unwanted information. The format is commas-separated list of `<s|c>:<packet_name>`. `s` represents packets sent to server, `c` represents packets sent to client.The default is `c:map_chunk` which stops parsing server-to-client chunk data packets, since to parse such packets will spend extra long time and produce excess data fields.
* Secret Key: To realize encrypted connection among keys for decrypting data. The format is in hexademical strings with length of 32.
* Ignore Packets: Prevent parsing some packets to filter unwanted information. The format is commas-separated list of `<s|c>:<packet_name>`. `s` represents packets sent to server, `c` represents packets sent to the client. The default is an empty string. We recommend to use `c:level_chunk,c:level_chunk_with_light` for this option.
* Secret Key: To realize encrypted connection among keys for decrypting data. The format is in hexadecimal strings with a length of 32.
* NBT Decoding: To decode NBT data.
* TCP Port(s): To change TCP ports used by MCJE protocol to identify protocol.

## Protocol Data

All protocol data is read from external directory, which is controlled by option `Directory for protocol data`.

You can directly use protocol data provided by [MC_Protocol_Data](https://github.com/Nickid2018/MC_Protocol_Data), which is divided into three main branches:
* `master`: Contains all protocol data.
* `only-protocol`: Contains only protocol schema data, without any other files.
* `only-essentials`: (Recommend) Contains only essential protocol data (entity synchronization data, etc.), without any other files.

You can directly use the source code archives of these branches or clone the repository to the specified protocol directory.
You can directly use protocol data provided by [MC_Protocol_Data](https://github.com/Nickid2018/MC_Protocol_Data).
You can use the source code archives of the repository or clone the repository to the specified protocol directory.

## Encrypted Connection

If you enter Minecraft servers in legitimated game client, encrypted connection will be built between server and client base on `AES/CFB8/NoPadding` algorithm.
This step will execute before compression during login. All data in the connection will be encrypted, including data length fields used to spilt data.
If you enter Minecraft servers in a legitimated game client,
encrypted connection will be built between server and client base on `AES/CFB8/NoPadding` algorithm.
This step will execute before compression during login.
All data in the connection will be encrypted, including data length fields used to spilt data.

To listen data in encrypted connection, we need to know what the key is with the help of `encryption-helper` in the project.
By using the feature that the generation of symmetric encrypted keys was executed by client, it forced client to use a specified key, instead create a random one.
To get data in encrypted connection,
we need to know what the key is with the help of `encryption-helper` in the project.
By using the feature that client executed the generation of symmetric encrypted keys,
it forced the client to use a specified key,
instead create a random one.

`encryption-helper` is a Java Agent injects executive code dynamically when running Minecraft. It needs JVM parameters as follow to attach to a Minecraft client:
`encryption-helper` is a Java Agent injects executive code dynamically when running Minecraft. It needs JVM parameters as follows to attach to a Minecraft client:

```shell
-javaagent:<jarfile path>=<key>
```

The key is a hexademical string only contains 0-F with length of 32. If the input format is incorrect, it will crash immediately and throw an error when starting client.
The key is a hexadecimal string only contains 0-F with length of 32.
If the input format is incorrect, it will crash immediately and throw an error when starting the client.

Theoretically, `encryption-helper` can run in all unobfuscated and obfuscated injectable clients, since the injection points it locates only contain features could not be obfuscated as follow:
Theoretically, `encryption-helper` can run in all unobfuscated and obfuscated injectable clients,
since the injection points it locates only contain features could not be obfuscated as follows:

* Method return value is `javax.crypto.SecretKey`.
* Method has no parameter.
* The Method has no parameter.
* The type of the first local variable of the method is `javax.crypto.KeyGenerator`.

Very few mods modify logics here, so it's safe for the program to modify. It should not conflict with mods.
Expand All @@ -69,9 +75,9 @@ Only a single circumstance will disable the program: Mods have modified encrypti

## Parsing Errors

Parsing error exists under 2 circumstances as follow:
Parsing error exists under 2 circumstances as follows:

* Wireshark failed to capture all data. Since Java edition uses TCP, data is spilt by length field, and once missing any segment, data will be unparsable immediately. You can confirm this circumstance if you have discovered `TCP Previous segment not captured` near the data parsing error.
* Wireshark failed to capture all data. Since the Java Edition uses TCP, data is spilt by length field, and once missing any segment, data will be unparsable immediately. You can confirm this circumstance if you have discovered `TCP Previous segment not captured` near the data parsing error.
* The program has not finished adaption or process properly for this part, or has not added corresponding strings. Such errors can be reported by open issues.

All protocol data is generated by `MC_Protocol_Data`, so if you have any questions about the data, you can open an issue in the repository.
Expand All @@ -81,22 +87,22 @@ All protocol data is generated by `MC_Protocol_Data`, so if you have any questio
Building this project requires Wireshark source code with configured dependencies.

1. Clone Wireshark repository to local and configure necessary dependencies.
2. Set environment variable `PLATFORM` as `x64`, and `WIRESHARK_LIB_DIR` as directory of dependency library of Wireshark (automatically created at running cmake).
3. Create `build` in same directory of Wireshark source codes, and run `cmake -A x64 .. -DBUILD_wireshark=OFF` in "build".
4. Still in "build", run `cmake --build . --config RelWithDebInfo --target epan`.
5. Set environment variable `WIRESHARK_DIR` (directory of Wireshark source code), `WIRESHARK_BUILD_DIR` (path of directory of "build") and `WIRESHARK_LIB_FILE_DIR` (path of directory of RelWithDebInfo generated by building the project).
2. Set environment variable `PLATFORM` as `x64`, and `WIRESHARK_LIB_DIR` as directory of dependency libraries for Wireshark (automatically created at running cmake).
3. Create `build` in same directory of Wireshark source codes, and run `cmake -A x64 .. -DBUILD_wireshark=OFF` in `build`.
4. Still in `build`, run `cmake --build . --config RelWithDebInfo --target epan`.
5. Set environment variable `WIRESHARK_DIR` (directory of Wireshark source code), `WIRESHARK_BUILD_DIR` (path of directory `build`) and `WIRESHARK_LIB_FILE_DIR` (path of directory `RelWithDebInfo` generated by building the project).
6. Run `cmake -S . -G Ninja -B build` in project root directory.
7. Run `cmake --build build --target MC_Dissector` in project root directory.
8. Built file can be discovered in "build" directory.

## How To Build Projects (Linux)

It is much easier to build on Linux, read ci.yml for details. (Too lazy to write here)
It is much easier to build on Linux, read ci.yml for details. (Too lazy to write here.)

## Current Plans

- [x] Almost complete! (Crash free, at least!)
- [x] Linux support by @xtexChooser
- [x] Support encryption. (It should be OK!)
- [ ] Version compatibility.
- [x] Version compatibility.
- [ ] Support bedrock edition.
2 changes: 1 addition & 1 deletion mc_dissector.c
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
#include "protocol_je/je_dissect.h"
#include "protocol_be/be_dissect.h"

WS_DLL_PUBLIC_DEF _U_ const gchar plugin_version[] = "0.0.0";
WS_DLL_PUBLIC_DEF _U_ const gchar plugin_version[] = "1.3.0";
WS_DLL_PUBLIC_DEF _U_ const int plugin_want_major = WIRESHARK_VERSION_MAJOR;
WS_DLL_PUBLIC_DEF _U_ const int plugin_want_minor = WIRESHARK_VERSION_MINOR;

Expand Down

0 comments on commit 8d07d1c

Please sign in to comment.