3

I'm trying to decode chat strings in a multiplayer game's network traffic; the way it encodes them is seemingly some arbitrary encoding. I've been analyzing the UDP traffic to the server with wireshark. My goal is to find a general algorithm to go from hex back to the original message. I'm able to get the encoded hex result for any string, so here is the most telling pair I've recorded:

From the string

'aaa bbb ccc ddd eee fff ggg hhh iii jjj kkk
 lll mmm nnn ooo ppp qqq rrr sss ttt uuu vvv www xxx yyy zzz AAA BBB CCC'

(newline only for readability) The result in the sent packet is this

0020   b9 b0 3c 90 **b0 b0 30 10 31 31 31 90 b1 b1 31 10
0030   32 32 32 90 b2 b2 32 10 33 33 33 90 b3 b3 33 10
0040   34 34 34 90 b4 b4 34 10 35 35 35 90 b5 b5 35 10
0050   36 36 36 90 b6 b6 36 10 37 37 37 90 b7 b7 37 10
0060   38 38 38 90 b8 b8 38 10 39 39 39 90 b9 b9 39 10
0070   3a 3a 3a 90 ba ba 3a 10 3b 3b 3b 90 bb bb 3b 10
0080   3c 3c 3c 90 bc bc 3c 10 3d 3d 3d 90 a0 a0 20 10
0090   21 21 21 90 a1 a1 a1** 2a 66 10 04 20 02 34 5a 42

Ive marked where I think the relevant data is with asterisks. As you can see, it seems that

a = b0, b = 31
c = b1, d = 32
e = b2, f = 33
g = b3, h = 34
i = b4, j = 35
k = b5, l = 36
m = b6, n = 37
o = b7, p = 38
q = b8, r = 39
s = b9, t = 3a
u = ba, v = 3b
w = bb, x = 3c
y = bc, z = 3d

This isn't a 1:1 encoding however. Here the character for space is either 90 or 10, and it has an influence on the encoding of the previous(?) character. I'm unaware of any other characters affecting the encoding like this.

Here is the encoding for the string 'the cat is back'

hex:       3a b4 32 90 b1 30 3a 90 b4 39 10 b1 b0 b1 35 90 
desired:   t  h  e     c  a  t     i  s     b  a  c  k    
actual:    t  e  d     c  ?  t     i  r     c  a  c  j

Spaces have an influence on more than just the previous character here.

Is there a pattern here? What is going on? Any help or guesses are welcome.

7

Writing your example, aaa b in binary, and as well the encoded string, 0xb0 0xb0 0x30 0x10 0x31:

       a        a        a      ' '        b
01100001 01100001 01100001 00100000 01100010

10110000 10110000 00110000 00010000 00110001

it looks like every byte of the encoded string being the original byte shift right by one bit, with the last bit of the next byte copied to the high order bit of the current byte.

So, let's reverse this: if we take your encoded string, 3a b4 32 90 b1

00111010 10110100 00110010 10010000 10110001

shift each byte left one bit, and replace the low order bit with the high order bit from the previous byte, we get:

01110100 01101000 01100101 00100000 01100011 ...
      74       68       65       20       63 ...
       t        h        e      ' '        c ...
| improve this answer | |
  • Wow, well spotted! Is there a name for this kind of procedure, or is it just some custom encoding to deter analysis? The server sends the text to other players in yet another encoding, I may post another question if I can't figure it out myself. – Adrian Rothan Apr 8 '16 at 23:52
  • You could call it bit-shifting, but there's no common name line rot13 or caesar for it (that i know of). Yes, its purpose seems to be obfuscation, but as you've seen, it isn't very good at that. (I admit i had a certain head start, as this uses a similar technique, so i had already seen it). But, writing down your original and encoded messages in binary, and doing some simple operations on them (xor, neg, add, subtract, rotate) often gives you the correct idea when dealing with these simple types of obfuscation. – Guntram Blohm supports Monica Apr 9 '16 at 23:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.