Shaiya Chat Native RE is a static reverse-engineering corpus covering the complete chat pipeline of Shaiya Core V9: client (Documentation Index
Fetch the complete documentation index at: https://mintlify.com/ThalissonTMora/shaiya-chat-native-re/llms.txt
Use this file to discover all available pages before exploring further.
Game.exe), world server (ps_game.exe), and login server (ps_login.exe). It provides Ghidra-decompiled C source, wire packet specifications, cryptographic handshake analysis, and offline tooling — everything needed to build a wire-compatible emulator or hook the stock binaries.
Introduction
Project overview, repository layout, corpus sizes, and reimplementation confidence levels.
Binary Targets
MD5 hashes, image bases, and manifest counts for Game.exe, ps_game.exe, and ps_login.exe.
Packet Specification
Full wire layouts for all 0x11xx and 0xFxxx chat opcodes — send, recv, and envelope format.
Wire Cryptography
AES-128 CTR cipher pipeline, 0xA101/0xA102 handshake, and per-connection cipher flags.
Chat Channel Map
Every opcode mapped to its handler VA, vtable offset, and decompiled .c file.
RE Status
Static coverage snapshot, corpus sizes, and reimplementation confidence per goal.
What’s covered
This corpus documents 358 decompiled functions across three binaries, organized into logical subsystems:Client Chat
169 functions from Game.exe — UI rendering, recv handlers, send path, crypto, balloons.
World Server
143 functions from ps_game.exe — broadcast queue, pipeline, guild/party/zone fanout.
Login Server
46 functions from ps_login.exe — 0xA101 key blob construction, BigInt RSA-like pipeline.
Reimplementation confidence
| Goal | Confidence |
|---|---|
| Hook chat send/recv (plaintext) | ~95% |
| Server emulator + stock client | ~88% |
| Wire-compatible proxy | ~85% |
| Standalone cipher clone | ~82% |
| Login key blob replay | ~90% with 16 captured KeyTable slots |
All packet layouts and cryptographic formulas in this corpus are derived from static disassembly of Shaiya Core V9 binaries. Dynamic validation items are tracked in RE Gaps and Missing Artifacts.
Explore the documentation
Ghidra Setup
Prerequisites, decompile scripts, and manifest format for re-exporting .c files.
Crypto Counter
Step-by-step AES counter derivation using HMAC-SHA256 from the 0xA101 body.
Zone Messages
cn_string.DB format and the ZoneChat message table driving 0x1109/0x110A pushes.
Offline Tools
Python tools for padding scanning, counter validation, and session capture emission.