1

As asking a friend and no amount of Googling yielded an answer, I figured I'd make an account and give this place a go.

I'm working on reverse engineering the server for a relatively old game with no network packets from when it was alive. The game only made partial use of SSL (don't know what for specifically), and nothing I send it seems to trigger any response. The game sends a packet via a TCP PSH after the connection is established, and Apache replies with a 400 Bad Request. If Apache doesn't send any error, the game will wait indefinitely for a response. Due to lack of environment variables in the data and a defining request (HTTP GET, SSL handshake, etc.) from the game, it's unclear as to what it's expecting. CGI scrips, digest authentication, nor anything I can think of matches the contents. Here's the packet dump. "Hub" is a special keyword that's referenced throughout the game binary relating to code files and directories:

Packet header:

00000000   90 2b 34 35 e7 c5 fc 0f e6 52 e2 e3 08 00 45 00   .+45.... .R....E.
00000010   03 1f a6 e2 40 00 40 06 0d 92 c0 a8 01 12 c0 a8   ....@.@. ........
00000020   01 02 c5 9b 27 57 de f8 91 89 55 e4 99 2b 80 18   ....'W.. ..U..+..
00000030   ff ff 62 23 00 00 01 01 08 0a 00 00 00 00 39 77   ..b#.... ......9w
00000040   24 62                                             $b

Packet contents:

00000000  24 e8 02 01 00 71 00 03  00 00 06 00 04 01 00 d6   $....q.. ........
00000010  02 30 82 02 d2 30 82 01  ba a0 03 02 01 02 02 14   .0...0.. ........
00000020  01 00 00 00 00 00 00 00  00 00 00 00 42 00 00 00   ........ ....B...
00000030  00 00 00 e4 30 0d 06 09  2a 86 48 86 f7 0d 01 01   ....0... *.H.....
00000040  05 05 00 30 81 96 31 0b  30 09 06 03 55 04 06 13   ...0..1. 0...U...
00000050  02 55 53 31 0b 30 09 06  03 55 04 08 13 02 43 41   .US1.0.. .U....CA
00000060  31 12 30 10 06 03 55 04  07 13 09 53 61 6e 20 44   1.0...U. ...San D
00000070  69 65 67 6f 31 31 30 2f  06 03 55 04 0a 13 28 53   iego110/ ..U...(S
00000080  4f 4e 59 20 43 6f 6d 70  75 74 65 72 20 45 6e 74   ONY Comp uter Ent
00000090  65 72 74 61 69 6e 6d 65  6e 74 20 41 6d 65 72 69   ertainme nt Ameri
000000A0  63 61 20 49 6e 63 2e 31  14 30 12 06 03 55 04 0b   ca Inc.1 .0...U..
000000B0  13 0b 53 43 45 52 54 20  47 72 6f 75 70 31 1d 30   ..SCERT  Group1.0
000000C0  1b 06 03 55 04 03 13 14  53 43 45 52 54 20 52 6f   ...U.... SCERT Ro
000000D0  6f 74 20 41 75 74 68 6f  72 69 74 79 30 1e 17 0d   ot Autho rity0...
000000E0  30 36 30 32 30 38 30 30  34 39 30 36 5a 17 0d 33   06020800 4906Z..3
000000F0  36 30 32 30 37 32 33 35  39 35 39 5a 30 77 31 0b   60207235 959Z0w1.
00000100  30 09 06 03 55 04 06 13  02 55 53 31 13 30 11 06   0...U... .US1.0..
00000110  03 55 04 08 13 0a 43 61  6c 69 66 6f 72 6e 69 61   .U....Ca lifornia
00000120  31 12 30 10 06 03 55 04  07 13 09 53 61 6e 20 44   1.0...U. ...San D
00000130  69 65 67 6f 31 17 30 15  06 03 55 04 0a 13 0e 4c   iego1.0. ..U....L
00000140  6f 6e 64 6f 6e 20 53 74  75 64 69 6f 73 31 0d 30   ondon St udios1.0
00000150  0b 06 03 55 04 0b 13 04  53 43 45 45 31 17 30 15   ...U.... SCEE1.0.
00000160  06 03 55 04 03 13 0e 48  75 62 20 53 43 45 45 20   ..U....H ub SCEE 
00000170  32 30 33 37 34 30 5c 30  0d 06 09 2a 86 48 86 f7   203740\0 ...*.H..
00000180  0d 01 01 01 05 00 03 4b  00 30 48 02 41 00 bb a7   .......K .0H.A...
00000190  3a c9 8c 1c b1 93 ff 51  b0 02 b3 88 6a d5 35 49   :......Q ....j.5I
000001A0  5c 58 42 f3 7f ab 32 ea  89 5b b8 c2 55 83 f4 72   \XB...2. .[..U..r
000001B0  f6 bd 1b 29 6b 7b ca 89  0a bb 42 b8 dc b0 a6 01   ...)k{.. ..B.....
000001C0  47 88 e5 47 fd 8d 31 cc  f0 8b b8 16 f5 65 02 03   G..G..1. .....e..
000001D0  00 00 11 30 0d 06 09 2a  86 48 86 f7 0d 01 01 05   ...0...* .H......
000001E0  05 00 03 82 01 01 00 08  b0 85 11 13 37 d0 97 c0   ........ ....7...
000001F0  53 bb b0 ac 48 af dd 4c  ad 24 9d bd 9c b0 8a 26   S...H..L .$.....&
00000200  45 1c 0a fd 39 0d 01 34  3b 42 34 9f 08 f6 ac 5e   E...9..4 ;B4....^
00000210  11 77 01 3a 9b e0 d5 50  28 66 4f f8 1c a1 13 08   .w.:...P (fO.....
00000220  8c fd 69 5e b8 aa b1 13  46 54 08 e3 4e 47 74 c9   ..i^.... FT..NGt.
00000230  ea 33 6c bb 12 d0 58 da  4b d6 c6 09 09 16 e6 f0   .3l...X. K.......
00000240  57 40 fb dd 69 17 83 73  a5 e6 fa 11 e6 63 9a ae   [email protected] .....c..
00000250  47 08 7b a4 23 b2 12 e5  eb 5a f6 da f5 e6 4a e8   G.{.#... .Z....J.
00000260  10 35 57 b2 ed b7 36 97  95 63 bc 78 22 87 38 1d   .5W...6. .c.x".8.
00000270  b2 70 90 31 b7 6f 11 1e  b6 72 89 91 0f 5d fe 65   .p.1.o.. .r...].e
00000280  38 ed 6c 66 f4 31 b4 5a  8a f2 71 77 7f 56 45 a4   8.lf.1.Z ..qw.VE.
00000290  70 f3 1f c5 1f 8b 78 6a  40 45 c6 39 cc 22 6e 5e   p.....xj @E.9."n^
000002A0  56 c7 63 5e 44 bb 65 e5  6d 5c 94 93 25 af 5a 47   V.c^D.e. m\..%.ZG
000002B0  24 6f 3f 0d d9 b0 a0 be  6a 1b 10 21 b7 61 d3 c3   $o?..... j..!.a..
000002C0  44 8c 8c 5a c9 61 b2 26  fc 02 ee 5e 73 12 8e ef   D..Z.a.& ...^s...
000002D0  0d 10 e9 f9 f5 37 8c 0e  6a 52 c3 4e b2 1c b1 e0   .....7.. jR.N....
000002E0  7f 21 20 ea 7b 10 97 00  00 00 00                  .! .{... ...

Scanning it as a file will detect it as a .der certificate, and while its structure in general looks like a certificate, as far as I can tell via comparison, it is not. Perhaps someone with more knowledge knows what this is (and what "rt" is, below), or knows if this is some custom data. The following strings are also referenced in the game's binary that likely has some relation, with the first coming directly after the above ASCII ZG$o?:

+-#0,;:_
_lc_mtx
<0123456789ABCDEF
0123456789abcdef

rt_ssl 3.02.200810102000
666666666666666666666666666666666666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\CLNT 
SRVR 
0123456789abcdefghijklmnopqrstuvwxyz 
0123456789abcdefABCDEF

ReleaseVersion 3.02.200810102000 
rt_cert version: 3.02.200810102000
11
  • 2
    Your ASCII dump almost certainly destroyed important information that was present in the actual binary. Replace it with a hex dump.
    – Jongware
    Commented Jun 24, 2018 at 18:11
  • Post edited. I'll find and replace the game binary strings with the hex equivalent as soon as I can. Commented Jun 24, 2018 at 19:17
  • @MercuryValentine: it would be sensible to chunk the (hex) output similar to how xxd -g 1 <file> or od -t x1 <file> give it (and how hex editors show it). Use the button with the {} after marking the relevant part to format it as code.
    – 0xC0000022L
    Commented Jun 24, 2018 at 20:24
  • 1
    @MercuryValentine am I right to assume we're talking about a CGI? Is there a chance you could provide the binary itself rather than just bits and pieces? There are places to upload stuff to aplenty.
    – 0xC0000022L
    Commented Jun 25, 2018 at 7:19
  • 1
    @ElianKamal I actually found the answer by a lucky Google search a few days ago and came to close the question, though it seems I don't have enough reputation points to do so. It's a certificate created from a middleware library called SCE-RT, which is owned by a subsidiary of Sony, RTime. Commented Jul 18, 2018 at 19:56

1 Answer 1

2

Answering my own question for anyone in the future that comes across this post searching for answers to games that use the same middleware (SCE-RT/Medius SDK), the packet above is a standard x509 certificate. You can binwalk your game's executable and extract the unformatted certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.