It's still in plaintext like you said, EXCEPT for the hole cards, which are now hashed with sha256 using the private session key the server gives out at the start of the connection. Was very easy to figure out what the client was doing though. As I mentioned, this was implemented with the last client update they did back when I was actively playing.
So how does the client know what its cards are if they are sha256 hashed with the session key. sha256 is a one-way hash. Does it have to brute-force them? Seems unlikely, especially for omaha where you have 4 cards, not just 2.
Uhhh... Give me a second, I'll give you an example... Maybe I mis-phrased the way I said it uses sha256?
So the new version of PokerMavens sends your hole cards in a command packet called "ECards". The flash client knows then it must decode the values it receives before displaying them. An example would be I am dealt ECards Card1=7A, Card2=71, Card3=99, Card4=1E, Salt=<16 char hex string>. Those card values are garbage, because they're hashed. For the client to really know what those garbage cards are, it needs to also know the private sessionkey, which is a 20 character hex string established at the beginning of the session.
So without revealing the entire method, the client somehow uses a combination of the sessionKey and Salt together, which it then uses portions of that combination against the garbage card values in a mathematical algorithm, which results in the proper number. Each of these steps may or may not involve an sha256 method that is called (I can't reveal everything!).
For this example (and I didn't give you the Salt or SessionKey so revealing the answer does not reveal the method): The proper numbers would be 48 (Ks) and 14 (5d). Since I was playing Hold'em at the time, Card3 and Card4 either evaluate to 0 or some value greater than 53, which would be a garbage number that the client knows to discard and treat as 0. Valid card values are 1-52, each corresponding to a different facecard.
P.S.: FreeMoney has my sourcecode.
If he gets a good, experienced programmer on board I honestly believe he could have a decent cross-platform desktop Python client that is close to PokerStars pretty damn quickly. I say this because I do not code as a profession and I learned Python about a month before I started working on the Python SwC client for the 2 weeks or so. If I was a professional coder, I imagine I would have done all this work much faster and more efficiently.
That's if the programmer doesn't want to port it to a better language, which I would highly recommend. Especially one that would port relatively easily to Android/iOS (like Java or C++).
It cannot be understated how "dumb" of a client it actually can be, since the server does so much of the heavy lifting. The server tells the client when to play a sound, when to do the deal animation, etc. The client is basically a rendered table that draws stuff on command, shows buttons on command and lets the server know when/which of the buttons are pressed and what values were typed on the screen at the time of press.
