Ask Your Question
0

Data in a TCP stream is unreadable. How does one figure out what the data holds? I have access to both the Server and Client versions of the software.

asked 2017-11-15 01:27:12 +0000

I am currently hosting a game server on an old online game framework called Byond. I wanted to investigate the data being sent back and forth from the client/server. I would be surprised if this data was encrypted as the code is very old and designed for old network connections like a 56k dial-up. I suspect the data is compressed for this reason. I'd like to attach a sample of my packet capture but I don't see the option. Below are two separate TCP data payloads. I am curious how professionals in the field figure out how to read data in a TCP stream when they do not know how it was compressed/encoded/encrypted.

00:0e:00:06:07:c8:1f:c7:15:fa:00:6c:00:16:6a:da:ab:a7:b4:30:83:6e:ab:3f:41:0b:ba:f2:41:27:c8:c1:c1:27:24:09

36:97:00:b7:00:01:00

Thanks,

GB

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted
1

answered 2017-11-15 08:20:11 +0000

Jasper gravatar image

Well, for proprietary protocols that you don't have a specification document for there are two options:

  1. reverse engineer the protocol by playing with the client to see what kind of data is sent as an reaction to whatever you do, e.g. "if I move in this direction, data looks like this, if I move in another direction, those bytes are different". It's basically a differential analysis
  2. reverse engineer the game binaries to find the part that generates the network data. This is extremely hard to do unless you are very skilled in reverse engineering binaries.
edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2017-11-15 01:27:12 +0000

Seen: 75 times

Last updated: Nov 15