Hack Forums
Need help reverse engineering websocket messages - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Coders Lounge (https://hackforums.net/forumdisplay.php?fid=5)
+---- Thread: Need help reverse engineering websocket messages (/showthread.php?tid=6011009)

Need help reverse engineering websocket messages - rarebone - Sep 25, 2019

Hey guys, I play a game which uses a websocket to send data between the browser and the server.

Now I want to know, which message the browser sends, if I recruit troops for example, but all I see in Chromes DevTools is this binary data:

[Image: SM5AUgY.png]
Base64: AAAAILcGjaFCX0K1T1KSgMsK+ijC0tT4WUGvAxthMLHWqAMt

I took a look at the source code and found this:

[Image: T05065D.png]

and that:

[Image: iyoK40X.png]

which may be interesting functions.
You can find the full script here: https://file.io/Imx0LB
It is not the full game, just the script that initiates the websocket.

Also good to know: It seems to be a Unity3D WebGL game.

Would be awesome if someone could help me to "decrypt" the messages. Thank you!



RE: Need help reverse engineering websocket messages - Nachfolger - Sep 25, 2019

If you're paying, go to the marketplace. Otherwise, post the script url, not just screenshots.

RE: Need help reverse engineering websocket messages - n0s1eep - Sep 25, 2019

The send and receive functions wont help you much, try and find the code that calls these functions instead and look for any code that packs/unpacks the data.

RE: Need help reverse engineering websocket messages - rarebone - Sep 25, 2019

(Sep 25, 2019 07:51 AM)n0s1eep Wrote:  The send and receive functions wont help you much, try and find the code that calls these functions instead and look for any code that packs/unpacks the data.

Sounds like a good idea.

I tried to track down what happens after I click a button using Chrome Devtools Performance tab as you can see here:

[Image: WLlYDyR.png]

but I have a hard time finding something websocket related.

Do you have an idea of what would be a good approach on that?

RE: Need help reverse engineering websocket messages - Traffic Solutions - Sep 25, 2019

You can replace the script with editing windows hosts file or any network monitor(MiTM proxy, Charles, Fiddler)
Check console and you should have objects/strings printed, you can inspect objects and find it's properties and methods.
If it's encrypted/decrypted, find the encryption function and Console.Log() the input, find the decryption function and Console.Log() at the output.

_socketSend - Anywhere in function place
Console.Log("Socket Send: " + ptr)

_socketRecv - End of function try
Console.Log("Socket Recieve: " + socket.messages)


Traffic Solutions

RE: Need help reverse engineering websocket messages - rarebone - Sep 25, 2019

(Sep 25, 2019 11:05 AM)Traffic Solutions Wrote:  You can replace the script with editing windows hosts file or any network monitor(MiTM proxy, Charles, Fiddler)
Check console and you should have objects/strings printed, you can inspect objects and find it's properties and methods.
If it's encrypted/decrypted, find the encryption function and Console.Log() the input, find the decryption function and Console.Log() at the output.

_socketSend - Anywhere in function place
Console.Log("Socket Send: " + ptr)

_socketRecv - End of function try
Console.Log("Socket Recieve: " + socket.messages)


Traffic Solutions

I see, so everytime the game sends or receives a message, the content gets logged.
How exactly can I replace the script? Because as far as I can see, the script has a different name on every page reload.

I also tried tracking the function calls and got that:

[Image: 0u71Gz8.png]

So the send function gets called by many wasm-functions, which look like that:

[Image: cVP2PWr.png]

RE: Need help reverse engineering websocket messages - Traffic Solutions - Sep 25, 2019

(Sep 25, 2019 11:26 AM)rarebone Wrote:  I see, so everytime the game sends or receives a message, the content gets logged.
How exactly can I replace the script? Because as far as I can see, the script has a different name on every page reload.

I also tried tracking the function calls and got that:

[Image: 0u71Gz8.png]

So the send function gets called by many wasm-functions, which look like that:

[Image: cVP2PWr.png]

Feature name "auto replacing"/"auto responder" or something like this, you can regex page name to replace.

RE: Need help reverse engineering websocket messages - n0s1eep - Sep 25, 2019

This is WebAssembly code, meaning that it is a lot more difficult to read than pure JavaScript. I know there are some wasm disassembler tools that can convert it back to C, google for "wasm disassembler".

I have no personal experience with this though, maybe someone else can help.

RE: Need help reverse engineering websocket messages - rarebone - Sep 26, 2019

(Sep 25, 2019 11:05 AM)Traffic Solutions Wrote:  You can replace the script with editing windows hosts file or any network monitor(MiTM proxy, Charles, Fiddler)
Check console and you should have objects/strings printed, you can inspect objects and find it's properties and methods.
If it's encrypted/decrypted, find the encryption function and Console.Log() the input, find the decryption function and Console.Log() at the output.

_socketSend - Anywhere in function place
Console.Log("Socket Send: " + ptr)

_socketRecv - End of function try
Console.Log("Socket Recieve: " + socket.messages)


Traffic Solutions

I tried editing the script in Chrome Dev Tools Sources tab but that didn't work. Also I can't replace the script with mine in the first place, because its name changes on each reload and I have no idea where this name is generated. Anyone has an idea?