Encoding method of float

Question

I'm reversing this game and got stuck. To make it simple, You have some amount of coins in the game (float or double) and you can spend it on some things. I started sniffing network traffic and noticed that with different amount of coins, only 2 bytes change.

I've bought different amount of coins and copied those two bytes:

(5)

1111 0100 0000 0011 (F4 03)

---------------------------

(6)

1101 1000 0000 0100 (D8 04)

---------------------------

(7)

1011 1100 0000 0101 (BC 05)

---------------------------

(8)

1010 0000 0000 0110 (A0 06) 

---------------------------

(9)

1000 0100 0000 0111 (84 07)

---------------------------

(10)

1110 1000 0000 0111 (E8 07)


(11)

1100 1100 0000 1000 (CC 08)

---------------------------

(12)

1011 0000 0000 1001 (B0 09)

---------------------------

(13)

1001 0100 0000 1010 (94 0a)

---------------------------

(14)

1111 1000 0000 1010 (F8 0a)

---------------------------

(15)

1101 1100 0000 1011 (DC 0B)

---------------------------
(16)

1100 0000 0000 1100 (C0 0C)

---------------------------

(17)

1010 0100 0000 1101 (A4 0D)

---------------------------

(18)

1000 1000 0000 1110 (88 0E)

---------------------------

(19)

1110 1100 0000 1110 (EC 0E)

---------------------------

(20)

1101 0000 0000 1111 (D0 0F)

First line represents the amount of coins that I have, and the second is it's corresponding bytes in hex from wireshark. I don't know which encoding method is used for this. Maybe someone has some experience and knows the algorithm behind it. Thanks.

Update

8

1010 0000 0000 0110 (A0 06) 

-----------------------------


16

1100 0000 0000 1100 (C0 0C)

--------------------------

256

1100 1000 0000 0001 (C8 01)

----------------------------

512

1001 0000 0000 0011 (90 03)

-----------------------------


2048

1100 0000 0000 1100 (C0 0C)

----------------------------

4096

1000 0000 0001 1001 (80 19)

-----------------------------

8192

1000 0000 0011 0010 (80 32)

------------------------------

Notice that 2048 and 16 have same code. I can't understand why this happened, how does it differentiate 16 and 2048?

Different amount of coins can be spend in different rooms, for example 8 and 16 are spend in one room, it has maximum limit of 30. 256 and 512 on room number two and the rest in the room number three. When I enter into a room with different amount of coins all I'm looking is the differences between bytes in the same room, different rooms have different bytes in them which as I understand describe the room itself. Is it possible that I'm missing some bytes?

But when I enter room number three with different coins 2048 4096 8192 these are the only bytes that are changing.

UPDATE 2

64   - 00110010
128  - 01100100
1024 - 1010000000000110

So we have

  8     1010000000000110
  16    1100000000001100
  32 ?
  64    00110010
 128    01100100
 256    1100100000000001
 512    1001000000000011
1024    1010000000000110
2048    1100000000001100
4096    1000000000011001
8192    1000000000110010

I can't get 32 since I could not enter none of the rooms with that value.

Answer 1

This isn't a complete answer but is a bit more than fits in a comment.

There's definitely a pattern in the powers of 2. They all have exactly 4 bits set. The high bit is always 1 and the lower 15 bits seem to be the same bit pattern (11001) but rotated to different positions. Try filling in the gaps (32, 64, 128, 1024) and show in binary without spaces to make it clearer.

   8    1010000000000110
  16    1100000000001100
  32    ?
  64    ?
 128    ?
 256    1100100000000001
 512    1001000000000011
1024    ?
2048    1100000000001100
4096    1000000000011001

The duplicates 16 & 2048 you observed suggest that you are missing a relevant byte or bytes. I'll also conjecture that 1024 is the same as 8.

---

Edit: The extra information that there is a minimum increment of 0.01 combined with what happens when doubling values strongly indicates that these are not floating point numbers but are in fact fixed point with a scaling factor of 100.

If you convert the number of coins to a decimal, multiply by 100 and convert to binary you get -

   8    8.00    800 00000000001100100000
  16   16.00   1600 00000000011001000000
  32   32.00   3200 00000000110010000000
  64   64.00   6400 00000001100100000000
 128  128.00  12800 00000011001000000000
 256  256.00  25600 00000110010000000000
  ..
4096 4096.00 409600 01100100000000000000

As I was hoping, we see the 11001 pattern again.

To me this confirms that we are on the right lines but that there must be information carried in bytes other than the two you identified since 16 bits isn't enough to cover the range and resolution of possible values.

To help find these, I'd now suggest trying the following pairs of values -

20971.51 and 20971.52
10485.75 and 10485.76
 5242.87 and  5242.88
 2621.43 and  2621.44
 1310.71 and  1310.72
  655.35 and   655.36
  327.67 and   327.68
  163.83 and   163.84

When reporting the differences it would be useful to have the neighbouring couple of bytes each side too, even if they don't change.