I’m trying to get API responses from a backend service to make a server emulator for a game called NBA 2k17, but I can't get to them cause they are encrypted so I need to impersonate the client to get them but the server has mTLS on, do you know if this is even possible, cause it’s not stored anywhere locally. I also tried going into IDA pro to see if i can find it in there but I couldn't, it seems like the certificate isn't a pem certificate, it looks like it is in the der format so it would be pretty hard to spot inside ida.

  • 1
    Are you sure the game uses mTLS with certificate based client authentication (only if it is used you may be able to find a private key)? In general TLS with certificate based client auth is rarely used, most applications simply use TLS with certificate pinning. Thus the executable may contain the pinned certificate or more likely the certificate hash (usually the hash of the root CA certificate as those certs have the longest life-time).
    – Robert
    Commented Jul 1, 2023 at 9:55

1 Answer 1


have you tried using binwalk? it's an easy and quick tool that goes through the file and looks for headers of different file formats and can easily pick out if pem certificate is within the exe.

You could also probably wireshark the specific port the exe is using to communicate with the server and get the certificate that way?

I suggest you also look into Burp Suite as it might help you with decrypting the traffic and modifying it before sending it out to the main server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.