Retrieve user data as if it were the game making the request

Question

Don't think the title really summed it up but here goes.

There's a game built in Unreal Engine 4 that displays your (and other users) in-game statistics e.g a leaderboards page.

I can determine some possible IPs that the game must be talking to in order to retrieve this data but the payload is simply a hex dump and is unreadable (looks to be encoded)

Just wondering if there is a way to determine how the game is making the request, the details of that request and how it's interpreting the returned data.

(To summarise: I'm trying to get in-game statistics without any external api provided - since the developers don't have one)

Many thanks :)

Answer 1

EDIT: Just realized that I completely misunderstood your question. It seems you already have IPs. You're just trying to decode packet information, in which case I have no answer. However, I'll leave this here as it may still be useful for others.

Most games nowadays use relay servers in which all players (clients) connect to in order to disseminate such statistics like you see in the leaderboards. You used to be able to get player IPs from P2P (client hosted) games, just like in MW2 for example, as all participating clients had to connect to your computer. That is, of course, if you are picked as host.

If the game in question uses P2P, then you could throw something together in Wireshark. It will require a bit of trial-and-error, but I suggest finding the port being used by the game, then put that into a filter in Wireshark to get IP addresses of all clients.

If P2P, try this:

1. Open command prompt
2. Type ipconfig /all
3. Note your IP address
4. Type tasklist | find "game.exe"
5. Note "PID" number -- second column in output
6. netstat -ano | find " PID" -- include the space as it will filter out similar PIDs, if any
7. Note the port(s) in use -- e.g. TCP/UDP | 192.168.1.1:2529 | 123.123.123.123:1234 | ESTABLISHED | PID (2529 is being used)
8. Fire up Wireshark
9. Select your network adapter
10. In the bar at the top, type in tcp.port == *PORT* && ip.src != *YOUR IP*
11. You should begin to see different IP addresses. These are what you're looking for. You'll likely also be getting game server IP addresses as well.
12. (Optional) Let it run for a bit, then go to Statistics > Endpoints > IPv4 and check the box at the bottom "Limit to display filter"

Keep the following points in mind when performing the steps above:

• Often times, a process may have child processes
• Often times, a process may be using multiple ports

However, if the game doesn't use P2P, then I'm not entirely sure of your options.

I will edit this post if I forgot anything.