如何仅使用 Wireshark 对基于 UDP 的自定义游戏协议进行逆向工程？
如何仅使用 Wireshark 对基于 UDP 的自定义游戏协议进行逆向工程？我可以记录大量流量，但是然后呢？我的目标是为 Wireshark 编写一个解析器插件，最终能够解码游戏命令。这看起来可行吗？我可能面临哪些挑战？命令是否可能被加密？
How do I go about reverse engineering a UDP-based custom game protocol with nothing other than Wireshark? I can log a bunch of traffic, but then what? My goal is to write a dissector plugin for Wireshark that will eventually be able to decode the game commands. Does this seem feasible? What challenges might I face? Is it possible the commands are encrypted?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的，这是可行的。但它的实用性取决于所讨论的游戏。压缩会让你的工作变得更加困难，而加密则让它变得不可能（至少通过 Wireshark - 你仍然可以获取内存中的数据）。
也许最好的方法就是有条不紊地进行——不要记录“一堆流量”，而是在游戏中执行单个操作或命令，然后查看发送哪些数据来传达该信息。然后您可以查看数据包并尝试发现任何感兴趣的内容。通常您不会从中学到很多东西，因此请尝试另一个命令并将新消息与第一个消息进行比较。哪些部分在同一个地方？哪些部分移动了？哪些部分完全改变了？尤其要查找数据包开头附近固定位置的值，该值可能描述消息类型。一般来说，数据包的开头将是诸如标头之类的通用内容，而数据包的后续部分将是特定于消息的内容。考虑到 UDP 协议通常有自己的手动排序或可靠性方案，并且您可能会在开头附近找到序列号。
了解您的数据类型很方便。例如，整数值可能以大端或小端格式存储。许多游戏以浮点值的形式发送数据，因此请留意连续 2 或 3 个浮点数，它们可能描述位置或速度。
Yeah, it's feasible. But how practical it is will depend on the game in question. Compression will make your job harder, and encryption will make it impossible (at least through Wireshark - you can still get at the data in memory).
Probably the best way to go about this is to do it methodically - don't log 'a bunch of traffic' but instead perform a single action or command within the game and see what data is sent out to communicate that. Then you can look at the packet and try to spot anything of interest. Usually you won't learn much from that, so try another command and compare the new message with the first one. Which parts are in the same place? Which parts have moved? And which parts have changed entirely? Look especially for a value in a fixed position near the start of the packet that could be describing the message type. Generally speaking the start of the packet will be the generic stuff like the header and later parts of the packet will be the message-specifics. Consider that a UDP protocol often has its own hand-rolled ordering or reliability scheme and that you might find sequence numbers in there near the start.
Knowing your data types is handy. Integer values might be stored in big-endian or little-endian format, for example. And many games send data as floating point values, so be on the look-out for 2 or 3 floats in a row that might be describing a position or velocity.
商业游戏预计人们会尝试破解协议作为作弊手段，因此通常会使用加密，也可能会使用篡改检测。
停止此类活动是游戏制作者非常关心的问题，因为当少数玩家拥有超级工具时，它会破坏大多数玩家的体验。对于在线扑克等游戏来说，后果更为严重。
Commercial games expect that people will try to hack the protocol as a means to cheat, so will generally use encryption and probably tamper-detection as well.
Stopping this type of activity is of great concern to game makers because it ruins the experience for the majority of players when a few players have super-tools. For games like online poker the consequences are even more severe.