A new game has just came out and I want to build an application that analyses game statistics in real time as games are played. The developers of the game offer a replay service allowing other gamers to view a stream of the current game, each game exists for 24 hours after the game expires.

Today I opened the game up, began watching a replay and kicked off a new Wireshark session to analyse any TCP/UDP packets as they came in, but to my disappointment (and as I expected) all packets were SSL encrypted.

I understand that I cannot decrypt these packets without the Private key, which is on the server to ensure forward secrecy and there is no way I will ever have access to that, but is there any other way I can intercept the packets before they reach my PC? I did some reading and found that ARP spoofing could be used to trick the server into thinking I am the client and then relay information between client/server but I don't think that will solve the SSL issue?

The only thing I am certain of is that the developers do not currently offer a public endpoint to expose this data, but there are 2 rival fan sites that are somehow scraping this data. Are there any techniques that I could adopt to get further with this?

  • @JasonGeffner I may be mistaken, but wasn't Echo Mirage retired? I believe that's what Xi Lu needs for his problem – Alex Jul 29 '16 at 20:37
  • 1
    Read about mitmproxy and possibly fiddler, and certificate pinning. Basically you set up a server that your pc connects to, which will impersonate the real game server, decrypt stuff, and open its own SSL connection to the real server. – Guntram Blohm Jul 29 '16 at 21:41

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.