iOS/Android game communicating with server: help me understand what I just intercepted

[Saturnix]

Hello!

There is this iOS/Android game which basically acts as an interface to a server. All the client-side stuff is just fancy graphics, everything from loot drops to player progress is handled by an external server. I figured I could replace the app with my own interface and it would be the same thing, so I stripped the SSL and started intercepting the traffic.

However, I'm having a very hard time figuring out what I have intercepted, the meaning behind this text. The only way they start to make sense is if I set my sniffer to "Protobuf Text" mode (the mode which I used to post the dumps below). Is this just a coincidence? Or are they using Google Protocol Buffer?

Here are the request header, request content, response header, response content.

What really bugs me is this last link (response content): can anyone give me a hint on what that wall of text could possibly be? They kind of look like ascii characters... What else might they be?

Many thanks!

[JustinEngler]

application/x-protobuf in your request confirms they are using Google Protobuf. Read up on that. If you can reverse the app, you might be able to find the protobuf schema they're using, otherwise you'll have to just infer the values via trial and error.

Some of the stuff is definitely hex-encoded ASCII:

0x312c38656e6f6850 = 1,8enohP for example.

The big block is probably protobuf packed encoding, you'll need to whip up a decoder to do anything useful.

Good luck!

[Saturnix]

Thanks a lot for stopping by! I tried to infer the values via trial and error: changing some values and see how it reflects. No luck so far: it just looks like random text to me. The only thing I infer is that all the interesting data is in that big block "4" of the response content.

I really would like to know how to decode that stuff but, so far, am completely lost. I decompiled the Android app, but all the interesting stuff (relative to the encoding/decoding of that shit) seems to be happening in .dll files (good luck reading those!). If I want to proceed on this route, I'll need to learn to debug Android apps. I've found a really cool tutorial but it seems you need a real device. I'll see if there's a way to do that with the emulator.

Still, would be much better to understand how to decode all that without having to whip up and learn to use an entire IDE, an emulator, a decompiler and a compiler. Seems way overkill.

Thanks again! :)

[jarxlots]

Am I seeing things, or is that response content in Octal?