2

I'm trying to analyze the messages that the game sends to the server through WebSockets. I have a simple WebSockets proxy that stands in the middle and prints all messages to the console.

I noticed that every 5 seconds there is a ping-pong message, that looks like this:

Server: 00 00 00 Client: 01 00 00 00

And the messages with data itself look like this:

Client:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  3E E6 DC 00 00 00 00 00 00 00 2F 08 DC 31 CB 00  >жЬ......./.Ь1Л.
00000010  06 4C 6F 77 64 65 72 00 00 00 00 00 00 00 00 03  .Lowder.........
00000020  00 90 42 47 CD 82 07 4B 14 B5 9D 4B 74 14 30 59  .ђBGН‚.K.µќKt.0Y
00000030  C8 11 EA 68 73 40 C1 7E D6 63 69 6E 6F 6E 80 EC  И.кhs@Б~ЦcinonЂм
00000040  9A                                               љ

Server:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  6F E6 DC 03 00 00 00 00 00 00 00 00 00 00 00 00  oжЬ.............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 07 49 6E 76 61 6C 69 64 00 00 00  ......Invalid...
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000050  00 00 00 00 00 00 00 FF 00 00 00 00 00 00 00 00  .......я........
00000060  00 00 00 1B 00 04 72 61 6E 6B 00 00 00 05 6D 61  ......rank....ma
00000070  72 6B 73 00 00 00 03 65 6C 6F 03 40 92 C0 00 00  rks....elo.@’А..
00000080  00 00 00 00 0B 68 69 73 63 6F 72 65 52 61 6E 6B  .....hiscoreRank
00000090  02 00 00 04 B0 00 06 62 61 6E 6E 65 64 00 00 00  ....°..banned...
000000A0  09 62 61 6E 45 78 70 69 72 65 02 00 00 00 00 00  .banExpire......
000000B0  05 6D 75 74 65 64 00 00 00 0C 62 72 6F 6E 7A 65  .muted....bronze
000000C0  54 6F 6B 65 6E 73 01 00 00 00 0C 73 69 6C 76 65  Tokens.....silve
000000D0  72 54 6F 6B 65 6E 73 01 00 00 00 0A 67 6F 6C 64  rTokens.....gold
000000E0  54 6F 6B 65 6E 73 01 00 00 00 0D 68 77 65 65 6E  Tokens.....hween
000000F0  31 37 54 6F 6B 65 6E 73 01 00 00 00 06 62 61 6E  17Tokens.....ban
00000100  6E 65 72 00 00 00 0C 6F 6E 6C 69 6E 65 53 74 61  ner....onlineSta
00000110  74 75 73 00 03 00 05 6C 65 76 65 6C 02 00 00 00  tus....level....
00000120  00 00 0A 65 78 70 65 72 69 65 6E 63 65 03 00 00  ...experience...
00000130  00 00 00 00 00 00 00 08 70 72 65 73 74 69 67 65  ........prestige
00000140  00 00 00 0A 72 65 70 75 74 61 74 69 6F 6E 02 00  ....reputation..
00000150  00 00 00 00 0D 64 61 69 6C 79 50 6F 73 69 74 69  .....dailyPositi
00000160  6F 6E 02 00 00 00 00 00 0B 65 6C 6F 50 6F 73 69  on.......eloPosi
00000170  74 69 6F 6E 02 00 00 00 00 00 12 72 65 70 75 74  tion.......reput
00000180  61 74 69 6F 6E 50 6F 73 69 74 69 6F 6E 02 00 00  ationPosition...
00000190  00 00 00 07 64 61 69 6C 79 58 50 02 00 00 00 00  ....dailyXP.....
000001A0  00 09 75 6E 73 70 65 6E 74 58 50 02 00 00 00 00  ..unspentXP.....
000001B0  00 0B 77 65 72 65 77 6F 6C 66 44 4C 43 00 00 00  ..werewolfDLC...
000001C0  0A 76 61 6D 70 69 72 65 44 4C 43 00 00 00 09 73  .vampireDLC....s
000001D0  70 69 64 65 72 44 4C 43 00 00 00 12 77 69 6E 4F  piderDLC....winO
000001E0  66 54 68 65 44 61 79 43 6C 61 69 6D 65 64 00 00  fTheDayClaimed..
000001F0  00 0A 64 6F 64 67 65 54 69 6D 65 72 03 00 00 00  ..dodgeTimer....
00000200  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01  ................
00000210  92 B0 51 DB C6 C4 42 75 BE 7F 61 5F 3F A4 A0 4B  ’°QЫЖДBuѕ.a_?¤ K
00000220  00 06 00 01 00 04 00 08 00 0C 00 14 00 32 00 00  .............2..
00000230  01 79 20 13 34 00                                .y .4.

I have initially thought that this was a protobuf or BSON, but I didn't have any luck trying to decode these messages, though I don't have any experience with protobuf.

The client is written in C++ and is using the WebSocket++ library.

How to analyze this sort of binary protocol? How can I tell how was the message encoded?

2
  • Collect a bunch of messages as hex and post them here. – pythonpython Jun 9 at 21:00
  • @pythonpython these are the only messages that I could collect. I'll try collecting more with a different approach – Lowder Jun 16 at 10:52
1

Without reverse engineering, it may be difficult to guess what are these data. However, you can harvest many packets then diff/observe them to determine the size of data filed, which data remain, which data changes...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.