PES 2021 Private Server / Online Emulator/ Open Alpha Test Server /

blueclawcodewarrior said:
The only bad thing is the web site looks like a bash or bet , gambling sites.

But where we can buy the original game then?
Click to expand...

I built the website from scratch with 100% original code. There is still a lot of work to do, but I like how it is turning out.

However, I have no experience with betting or gambling websites, so I can’t really judge it from that perspective.
 
༺Ƥeຮ༻ said:
I built the website from scratch with 100% original code. There is still a lot of work to do, but I like how it is turning out.

However, I have no experience with betting or gambling websites, so I can’t really judge it from that perspective.
Click to expand...
In case its useful i notice some urls were wordpress https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn it has a lot of security concerns try to keep it on latest versions or maybe even switch to something more secure

EDIT: some more info

 
Hey ,

First off, massive respect for what you've put together here. Getting
any real traction on PES2021's ConnectGate — mapping out the XOR ->
Blowfish -> MD5 -> MessagePack layering, actually getting a client
into a server list — is genuinely impressive work, especially doing
it solo/small-team on a completely undocumented proprietary protocol.
This thread has honestly been the single most useful reference I've
found anywhere for this kind of project.

I'm just starting a similar effort on PES2018 (PC), and while I know
it's a different game with its own protocol quirks, it's the same
Fox Engine generation, so I'm hoping some of what you figured out
carries over at least structurally, even if the specific keys/framing
differ.

Quick summary of where I am so far: redirected the real game domains
via hosts (pes18-pc-gate.cs.konami.net, pes18-pc-stun.cs.konami.net,
ntl.service.konami.net + regional variants), set up a local capture
server, and got this far:

- STUN on UDP 3478: standard RFC 5389 Binding Request/Response (magic
cookie present). I implemented a proper Binding Response and the
client accepts it, then sends periodic Binding Requests (~every 5s)
with two vendor attributes (type 0x9090, 24 bytes; type 0x9091,
12 bytes with what looks like an incrementing counter).
- An HTTP endpoint, POST /ntl/api/GateInfo.php over plain HTTP (no
encryption), with a hex-encoded JSON body:
{"titleCode":"PES2018","locale":"EU","version":"1.05.00","extra":"",
"apiLevel":"3"}. Still haven't cracked the expected response format
— tried a few plausible JSON shapes, none stopped the client from
resetting the connection after ~3s.
- The client then connects to TCP port 10000 (the real gate) and
sends a 152-byte payload. Structurally consistent with an 8-byte
block cipher (152 = 19 blocks exactly), entropy ~6.75 bits/byte, no
repeated blocks — but that's as far as traffic analysis alone got
me. No luck with XOR key-length detection either.

That last part is basically the same wall you must have hit with
ConnectGate, so I wanted to ask, only if you have the time and don't
mind revisiting it:

1. How did you actually locate the Blowfish key inside the binary?
Searching for the standard P-array signature (the pi-digit
constants) to find the key-schedule function, or more of a dynamic
approach — breakpointing the encrypt call in a debugger, etc.?
2. Did PES2021 have an equivalent to GateInfo.php — a plaintext HTTP
pre-check before the encrypted gate connection? If so, any memory
of what a valid response looked like?
3. Any tips on how you found the XOR transport-layer key (the one
applied before Blowfish)? Static or dynamic analysis?
4. Did you see those same vendor STUN attribute types (0x9090/0x9091)
in PES2021 traffic? If that part of the code is shared across
engine versions it'd be a nice anchor point.
5. What tools ended up being most useful for you day to day — Ghidra,
IDA, x64dbg for runtime breakpoints, or a mix? Would rather not
reinvent a workflow you already found didn't work.

Totally understand if this is more than you want to dig back into —
even just a pointer to which part of your writeup/repo covers this
would already help a ton. Either way, thank you for documenting all
of this publicly. It's already saved me from a few dead ends, and
projects like this are why stuff like this doesn't just disappear
when the official servers go dark.
 
_erick_14_11_ said:
Hey ,

First off, massive respect for what you've put together here. Getting
any real traction on PES2021's ConnectGate — mapping out the XOR ->
Blowfish -> MD5 -> MessagePack layering, actually getting a client
into a server list — is genuinely impressive work, especially doing
it solo/small-team on a completely undocumented proprietary protocol.
This thread has honestly been the single most useful reference I've
found anywhere for this kind of project.

I'm just starting a similar effort on PES2018 (PC), and while I know
it's a different game with its own protocol quirks, it's the same
Fox Engine generation, so I'm hoping some of what you figured out
carries over at least structurally, even if the specific keys/framing
differ.

Quick summary of where I am so far: redirected the real game domains
via hosts (pes18-pc-gate.cs.konami.net, pes18-pc-stun.cs.konami.net,
ntl.service.konami.net + regional variants), set up a local capture
server, and got this far:

- STUN on UDP 3478: standard RFC 5389 Binding Request/Response (magic
cookie present). I implemented a proper Binding Response and the
client accepts it, then sends periodic Binding Requests (~every 5s)
with two vendor attributes (type 0x9090, 24 bytes; type 0x9091,
12 bytes with what looks like an incrementing counter).
- An HTTP endpoint, POST /ntl/api/GateInfo.php over plain HTTP (no
encryption), with a hex-encoded JSON body:
{"titleCode":"PES2018","locale":"EU","version":"1.05.00","extra":"",
"apiLevel":"3"}. Still haven't cracked the expected response format
— tried a few plausible JSON shapes, none stopped the client from
resetting the connection after ~3s.
- The client then connects to TCP port 10000 (the real gate) and
sends a 152-byte payload. Structurally consistent with an 8-byte
block cipher (152 = 19 blocks exactly), entropy ~6.75 bits/byte, no
repeated blocks — but that's as far as traffic analysis alone got
me. No luck with XOR key-length detection either.

That last part is basically the same wall you must have hit with
ConnectGate, so I wanted to ask, only if you have the time and don't
mind revisiting it:

1. How did you actually locate the Blowfish key inside the binary?
Searching for the standard P-array signature (the pi-digit
constants) to find the key-schedule function, or more of a dynamic
approach — breakpointing the encrypt call in a debugger, etc.?
2. Did PES2021 have an equivalent to GateInfo.php — a plaintext HTTP
pre-check before the encrypted gate connection? If so, any memory
of what a valid response looked like?
3. Any tips on how you found the XOR transport-layer key (the one
applied before Blowfish)? Static or dynamic analysis?
4. Did you see those same vendor STUN attribute types (0x9090/0x9091)
in PES2021 traffic? If that part of the code is shared across
engine versions it'd be a nice anchor point.
5. What tools ended up being most useful for you day to day — Ghidra,
IDA, x64dbg for runtime breakpoints, or a mix? Would rather not
reinvent a workflow you already found didn't work.

Totally understand if this is more than you want to dig back into —
even just a pointer to which part of your writeup/repo covers this
would already help a ton. Either way, thank you for documenting all
of this publicly. It's already saved me from a few dead ends, and
projects like this are why stuff like this doesn't just disappear
when the official servers go dark.
Click to expand...
Hey, thank you, I really appreciate the message. What you have found on PES 2018 looks promising, especially the STUN behavior, which appears closely related to what we observed in PES 2021.

PES 2018 was actually going to be my next target after I finish the 11v11 Team Play mode for PES 2021, so I would be genuinely happy to see you make progress with it. From what you have already found, it is clear that you know what you are doing and have a solid reverse-engineering approach.

In my case, I'm not, I'm an average Joe who is still learning a lot of this as I go. I am the "only person writing " the code and doing the main reverse-engineering work on the project. I do have some great people helping me with testing, reporting problems, and supporting our growing Discord community, but the actual development is currently a one-person effort.

So I am definitely interested in following your progress. There may also be useful discoveries we can share with each other, especially if parts of the Konami NTL implementation are common between PES 2018 and PES 2021.

A few points that may help without assuming the two games use identical keys or framing:

  1. Do not assume the complete 152-byte TCP message is encrypted payload. In PES 2021, the network frame includes an outer header and integrity data before the block-cipher payload. A total size divisible by eight can therefore be misleading.
  2. We identified the encryption path mainly by tracing the actual receive/transmit codec in the executable and then validating candidate interpretations against captured packets. The useful proof was not merely finding Blowfish-looking constants, but obtaining a fully coherent decoded structure with valid lengths, integrity checking and a recognisable MessagePack command.
  3. For the transport obfuscation layer, static tracing of the frame parser was more reliable than statistical XOR-key detection. A useful dynamic approach is to break after recv() and follow the first transformation that turns the buffer into plausible header and length values.
  4. Yes, PES 2021 sends STUN vendor attributes 0x9090 and 0x9091 with the same lengths you described, and the final part of 0x9091 increments between requests roughly five seconds apart. That is probably the strongest indication that parts of the Konami NTL implementation are shared between the games.
  5. We did not observe a PES 2021 equivalent of GateInfo.php in our captured ConnectGate bootstrap. That does not prove it does not exist in another build or region, only that it was not part of the path we reconstructed. For PES 2018, I would trace the HTTP response consumer instead of continuing to guess response JSON shapes. Check whether the body is decoded from hex before JSON parsing and whether exact headers, content length or connection-close behavior are required.
  6. The most useful workflow for us was a mix of Ghidra for static analysis, runtime instrumentation/debugging for proving which paths actually execute, and Wireshark plus custom packet tooling for validating the full decode pipeline. The key lesson was to require several independent checks before accepting a protocol interpretation.
I would treat the matching STUN attributes as a good structural anchor, but I would not assume that the PES 2021 keys, exact frame fields or command schemas are reused unchanged in PES 2018.
 
@_erick_14_11_
I do agree on that with @༺Ƥeຮ༻ , its important to not pay much attention to how the game uses the stun to me, stun is basically a packet that sends the public ip and the private ip of both users to later on make the p2p connection during match or even during the lobby, and probably there's already a lib integrated in the game to resolve that, is just a regular networking protocol.
If its even more useful and you are using AI for this i highly recommend using cheat engine mcp and ghidra mcp, with that you're giving AI super powers to test everything thats its been found
 
Thanks a lot for taking the time to write all that out — this is
genuinely more useful than I expected to get from a.

The STUN attribute match (0x9090/0x9091, same lengths, same ~5s
counter behavior) is a good confirmation that at least part of the
Konami NTL stack is shared code between the two games, so that's
staying our anchor point going forward.

The two corrections are the most valuable part, honestly:

- Good catch on the 152-byte assumption. I was treating the whole
thing as block-cipher payload just because the length divided
evenly by 8, but if PES2021 has header/integrity bytes before the
actual ciphertext, I need to stop trusting that math until I know
where the real boundary is.
- And the point about static frame-parser tracing being more
reliable than statistical XOR-key detection lines up exactly with
what I ran into — tried Hamming-distance key-length detection on
the payload and got nothing conclusive. Makes sense now that it
probably wasn't a clean fit for the method in the first place.
Moving to breakpointing right after recv() and following the first
transformation, like you suggested.

Also appreciate the suggestion on GateInfo.php — tracing the response
consumer instead of continuing to guess JSON shapes is obviously the
better use of time. Will report back if that gets me anywhere useful
for you too, since I have no idea if PES2018 even has a real
equivalent on your side once you get to it.

Good luck with 11v11 Team Play — and since PES2018 is apparently next
on your list anyway, happy to keep sharing whatever I find in case it
saves you some time when you get there. I'll post an update here once
I've got something concrete instead of more open questions.
 
You must log in or register to reply here.
Back
Top Bottom