diff options
Diffstat (limited to '')
| -rw-r--r-- | docs/writeups/Metasploit_Community_CTF_2021/clickracer.txt | 427 |
1 files changed, 427 insertions, 0 deletions
diff --git a/docs/writeups/Metasploit_Community_CTF_2021/clickracer.txt b/docs/writeups/Metasploit_Community_CTF_2021/clickracer.txt new file mode 100644 index 0000000..ef66092 --- /dev/null +++ b/docs/writeups/Metasploit_Community_CTF_2021/clickracer.txt @@ -0,0 +1,427 @@ +Ports: 20000, 20001 +Flags: 2 of clubs, black joker +Category: card (200 points - 100 per flag) +Chall author: ??? +Writeup author: malfurious + + + +Setup +----- +This challenge was discovered on port 20000, which just runs a web server +offering a download of the relevant files (executable, shared libraries, image +assets) for a simple game. "Hope you can click fast enough." + +This game is a target shooter / aim trainer type game with four modes: +easy practice, easy challenge, hard practice, and hard challenge. All modes +require a game server to run. The server used can be overridden, but defaults +to port 20001. + +Easy practice is the only mode a reasonable human can complete, and on +completion it prints "Good job, now try the challenge." The challenge modes are +going to need to be automated. + + + +Clickspam +--------- +The team's first attempt at an easy solve was to setup an automation to send +clicks all across the window (via Xorg APIs) as quickly as possible. We could +not get the script to run fast enough, and so quickly moved on to more in-depth +analysis of the problem. + + + +Protocol +-------- +Analyzing network traffic with Wireshark while playing the easy game allows us +to see the game messages going back and forth in a JSON-like format. After +connecting, the client specifies what the desired game mode is to the server and, +under normal circumstances, the rest of the traffic is as follows: + + - Server randomly sends 'target created' messages, with X,Y screen + coordinates of the target, and a (pointless) target ID. (Pointless, + because the ID is not used anywhere else in the protocol.) + - Client sends 'client click' messages when the player clicks on the screen, + giving the X,Y position. + - Server responds with either a 'target missed' or a 'target hit' message in + response to a 'client click'. + - Server eventually sends a 'game ended' message with the game score and a + custom message. + +So, the critical decision-making game logic seems to take place on the server. +However, in addition to those messages listed above, the client also sends out +'client heart beat' messages at a regular 1-second interval for time-keeping +purposes. This seems to affect early game loss situations where the server will +terminate the game early if the running score is not high enough. This only +happens after every six of these client messages. + +While playing the hard mode, the protocol messages are sent in a binary-encoded +form, but there are analogues to each of the plaintext JSON messages mentioned +above, with the same semantics. + +These binary messages have a fixed 16-byte preamble, followed by a 4-byte field +encoding the type of message that it is. The team didn't characterize all the +fields in these messages, but context clues can go a long way in helping to +identify each message and its meaningful parts. See Appendix D for an annotated +dump of a hard mode packet capture. + + + +Solution +-------- +With this understanding of the protocol, I scripted two spoofed clients: one for +the easy challenge, one for the hard challenge. Each client sends their +corresponding 'start game' message and just handles new targets by immediately +replying with a 'client click' in the same location. Generating my own +heartbeat messages turned out to be unnecessary. After several target hits (a +couple seconds of 'gameplay'), the game ends with 100% accuracy and a URL to +retrieve the flag is sent in the 'game ended' message. + +Completing the easy challenge yields the 2 of clubs flag, and the hard challenge +yields the black joker. See appendicies A and B for these client scripts. +They are implemented using sploit, to handle the low-level comms easily. + + MD5(2_of_clubs) == f8972549547c3171fd41dddece3798bb + MD5(joker_black) == 4195467b3a19bd9bcff419135561b01f + + + +================================================================================ += Appendix A: easy_mode.py = +================================================================================ +import json + +hello = {"StartGame": {"game_mode": "Easy"}} +click = {"ClientClick": {"x": 0, "y": 0}} + +io.writeline(json.dumps(hello).encode()) + +while True: + tc = json.loads(io.readline().decode()) + try: + x = tc['TargetCreated']['x'] + y = tc['TargetCreated']['y'] + + click['ClientClick']['x'] = x + click['ClientClick']['y'] = y + io.writeline(json.dumps(click).encode()) + except KeyError: + pass + + + +================================================================================ += Appendix B: hard_mode.py = +================================================================================ +import struct + +hello = (b'\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x01' + b'\x00\x00\x00\x03\x00\x00\x00\x0c\x00\x02\x4e\x84\x00\x00\x00\x03' + b'\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x01' + b'\x00\x00\x00\x01') + +def parse_tc(data): + Qa, Qb, Qc, Id, tid, Qe, x, If, Ig, y = struct.unpack('!QQQIIQIIII', data) + assert Qa == 0x0000003800000000 + assert Qb == 0x0000000c00020001 + assert Qc == 0x000000090000000c + assert Id == 0x0000000000024f4c + return x, y + +def make_click(x, y): + Qa = 0x0000002c00000000 + Qb = 0x0000000c00020001 + Qc = 0x000000070000000c + Id = 0x0000000000024ee8 + Qe = 0x0000000c00024ee9 + data = struct.pack('!QQQIIQI', Qa, Qb, Qc, Id, x, Qe, y) + return data + +io.write(hello) + +while True: + data = io.read(64) + try: + x, y = parse_tc(data) + io.write(make_click(x, y)) + except AssertionError: + pass + except struct.error: + pass + + + +================================================================================ += Appendix C: easy mode pcap = +================================================================================ +{"StartGame":{"game_mode":"Easy"}} +{"ClientHeartBeat":{}} +{"TargetCreated":{"target_id":0,"x":52,"y":349}} +{"TargetCreated":{"target_id":1,"x":170,"y":29}} +{"TargetCreated":{"target_id":2,"x":571,"y":55}} +{"TargetCreated":{"target_id":3,"x":394,"y":551}} +{"TargetCreated":{"target_id":4,"x":76,"y":400}} +{"TargetCreated":{"target_id":5,"x":272,"y":377}} +{"ClientClick":{"x":417,"y":397}} +{"TargetMissed":{"x":417,"y":397}} +{"TargetCreated":{"target_id":6,"x":146,"y":243}} +{"TargetCreated":{"target_id":7,"x":12,"y":255}} +{"ClientHeartBeat":{}} +{"TargetCreated":{"target_id":8,"x":311,"y":216}} +{"TargetCreated":{"target_id":9,"x":539,"y":199}} +{"ClientClick":{"x":417,"y":397}} +{"TargetCreated":{"target_id":10,"x":715,"y":469}} +{"TargetMissed":{"x":417,"y":397}} +{"TargetCreated":{"target_id":11,"x":593,"y":483}} +{"TargetCreated":{"target_id":12,"x":466,"y":113}} +{"TargetCreated":{"target_id":13,"x":124,"y":2}} +{"TargetCreated":{"target_id":14,"x":389,"y":428}} +{"TargetCreated":{"target_id":15,"x":79,"y":237}} +{"ClientHeartBeat":{}} +{"TargetCreated":{"target_id":16,"x":714,"y":199}} +{"ClientClick":{"x":389,"y":242}} +{"TargetMissed":{"x":389,"y":242}} +{"TargetCreated":{"target_id":17,"x":424,"y":515}} +{"TargetCreated":{"target_id":18,"x":231,"y":185}} +{"TargetCreated":{"target_id":19,"x":186,"y":541}} +{"TargetCreated":{"target_id":20,"x":532,"y":518}} +{"TargetCreated":{"target_id":21,"x":673,"y":590}} +{"TargetCreated":{"target_id":22,"x":749,"y":425}} +{"TargetCreated":{"target_id":23,"x":264,"y":75}} +{"ClientClick":{"x":466,"y":300}} +{"TargetCreated":{"target_id":24,"x":441,"y":22}} +{"TargetMissed":{"x":466,"y":300}} +{"ClientHeartBeat":{}} +{"TargetCreated":{"target_id":25,"x":218,"y":43}} +{"TargetCreated":{"target_id":26,"x":426,"y":189}} +{"TargetCreated":{"target_id":27,"x":121,"y":382}} +{"TargetCreated":{"target_id":28,"x":337,"y":499}} +{"TargetCreated":{"target_id":29,"x":556,"y":284}} +{"TargetCreated":{"target_id":30,"x":729,"y":308}} +{"TargetCreated":{"target_id":31,"x":22,"y":103}} +{"TargetCreated":{"target_id":32,"x":295,"y":55}} +{"ClientHeartBeat":{}} +{"TargetCreated":{"target_id":33,"x":197,"y":185}} +{"TargetCreated":{"target_id":34,"x":184,"y":378}} +{"TargetCreated":{"target_id":35,"x":285,"y":270}} +{"TargetCreated":{"target_id":36,"x":94,"y":395}} +{"TargetCreated":{"target_id":37,"x":604,"y":582}} +{"TargetCreated":{"target_id":38,"x":781,"y":429}} +{"TargetCreated":{"target_id":39,"x":740,"y":255}} +{"TargetCreated":{"target_id":40,"x":750,"y":404}} +{"TargetCreated":{"target_id":41,"x":238,"y":165}} +{"GameEnded":{"score":0,"message":"0% of targets hit, keep trying!","reason":"TimeOver"}} +{"ClientHeartBeat":{}} + + + +================================================================================ += Appendix D: hard mode pcap (annotated) = +================================================================================ +00000000 00 00 00 20 00 00 00 00 00 00 00 0c 00 02 00 01 ... .... ........ Client sends 'start game' message +00000010 00 00 00 03 00 00 00 0c 00 02 4e 84 00 00 00 03 ........ ..N..... for the hard challenge game mode +00000020 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ +00000030 00 00 00 01 .... + 00000000 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ Server: target created + 00000010 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 00 ........ ..OL.... 32-bit ID is @ offset 28 (value 0) + 00000020 00 00 00 0c 00 02 4f 4d 00 00 00 0b 00 00 00 0c ......OM ........ 32-bit X is @ offset 40 (value 11) + 00000030 00 02 4f 4e 00 00 00 44 ..ON...D 32-bit Y is @ offset 52 (value 68) + 00000038 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000048 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 01 ........ ..OL.... + 00000058 00 00 00 0c 00 02 4f 4d 00 00 02 8d 00 00 00 0c ......OM ........ More target created messages + 00000068 00 02 4f 4e 00 00 02 06 ..ON.... | + 00000070 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ | + 00000080 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 02 ........ ..OL.... | + 00000090 00 00 00 0c 00 02 4f 4d 00 00 02 8a 00 00 00 0c ......OM ........ | + 000000A0 00 02 4f 4e 00 00 02 0b ..ON.... | + 000000A8 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ | + 000000B8 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 03 ........ ..OL.... | + 000000C8 00 00 00 0c 00 02 4f 4d 00 00 00 9a 00 00 00 0c ......OM ........ | + 000000D8 00 02 4f 4e 00 00 00 37 ..ON...7 | + 000000E0 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ V + 000000F0 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 04 ........ ..OL.... + 00000100 00 00 00 0c 00 02 4f 4d 00 00 01 57 00 00 00 0c ......OM ...W.... + 00000110 00 02 4f 4e 00 00 01 b8 ..ON.... + 00000118 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000128 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 05 ........ ..OL.... + 00000138 00 00 00 0c 00 02 4f 4d 00 00 00 36 00 00 00 0c ......OM ...6.... + 00000148 00 02 4f 4e 00 00 01 c3 ..ON.... + 00000150 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000160 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 06 ........ ..OL.... + 00000170 00 00 00 0c 00 02 4f 4d 00 00 00 20 00 00 00 0c ......OM ... .... + 00000180 00 02 4f 4e 00 00 00 4c ..ON...L +00000034 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ Client: client click +00000044 00 00 00 07 00 00 00 0c 00 02 4e e8 00 00 02 0d ........ ..N..... 32-bit X is @ offset 28 (value 525) +00000054 00 00 00 0c 00 02 4e e9 00 00 01 7e ......N. ...~ 32-bit Y is @ offset 40 (value 382) + 00000188 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ + 00000198 00 00 00 0b 00 00 00 0c 00 02 50 14 00 00 02 0d ........ ..P..... + 000001A8 00 00 00 0c 00 02 50 15 00 00 01 7e ......P. ...~ Two server target created messages + 000001B4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 000001C4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 07 ........ ..OL.... + 000001D4 00 00 00 0c 00 02 4f 4d 00 00 03 18 00 00 00 0c ......OM ........ + 000001E4 00 02 4f 4e 00 00 00 c9 ..ON.... +00000060 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client: client heartbeat +00000070 00 00 00 01 .... + 000001EC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 000001FC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 08 ........ ..OL.... + 0000020C 00 00 00 0c 00 02 4f 4d 00 00 00 8d 00 00 00 0c ......OM ........ + 0000021C 00 02 4f 4e 00 00 00 9b ..ON.... + 00000224 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000234 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 09 ........ ..OL.... Three server target created messages + 00000244 00 00 00 0c 00 02 4f 4d 00 00 02 2e 00 00 00 0c ......OM ........ + 00000254 00 02 4f 4e 00 00 01 f0 ..ON.... + 0000025C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 0000026C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0a ........ ..OL.... + 0000027C 00 00 00 0c 00 02 4f 4d 00 00 01 fc 00 00 00 0c ......OM ........ + 0000028C 00 02 4f 4e 00 00 01 a3 ..ON.... +00000074 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ Client click message +00000084 00 00 00 07 00 00 00 0c 00 02 4e e8 00 00 01 24 ........ ..N....$ +00000094 00 00 00 0c 00 02 4e e9 00 00 01 18 ......N. .... + 00000294 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 000002A4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0b ........ ..OL.... + 000002B4 00 00 00 0c 00 02 4f 4d 00 00 03 1a 00 00 00 0c ......OM ........ + 000002C4 00 02 4f 4e 00 00 00 e3 ..ON.... + 000002CC 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ + 000002DC 00 00 00 0b 00 00 00 0c 00 02 50 14 00 00 01 24 ........ ..P....$ + 000002EC 00 00 00 0c 00 02 50 15 00 00 01 18 ......P. .... + 000002F8 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000308 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0c ........ ..OL.... Six server target created messages + 00000318 00 00 00 0c 00 02 4f 4d 00 00 00 e4 00 00 00 0c ......OM ........ + 00000328 00 02 4f 4e 00 00 00 9a ..ON.... + 00000330 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000340 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0d ........ ..OL.... + 00000350 00 00 00 0c 00 02 4f 4d 00 00 03 16 00 00 00 0c ......OM ........ + 00000360 00 02 4f 4e 00 00 00 e0 ..ON.... + 00000368 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000378 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0e ........ ..OL.... + 00000388 00 00 00 0c 00 02 4f 4d 00 00 02 d8 00 00 00 0c ......OM ........ + 00000398 00 02 4f 4e 00 00 02 46 ..ON...F + 000003A0 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 000003B0 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0f ........ ..OL.... + 000003C0 00 00 00 0c 00 02 4f 4d 00 00 02 bd 00 00 00 0c ......OM ........ + 000003D0 00 02 4f 4e 00 00 00 c4 ..ON.... +000000A0 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client heartbeat +000000B0 00 00 00 01 .... +000000B4 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ Client click message +000000C4 00 00 00 07 00 00 00 0c 00 02 4e e8 00 00 01 dd ........ ..N..... +000000D4 00 00 00 0c 00 02 4e e9 00 00 00 96 ......N. .... + 000003D8 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 000003E8 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 10 ........ ..OL.... + 000003F8 00 00 00 0c 00 02 4f 4d 00 00 00 ac 00 00 00 0c ......OM ........ + 00000408 00 02 4f 4e 00 00 01 36 ..ON...6 + 00000410 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ + 00000420 00 00 00 0b 00 00 00 0c 00 02 50 14 00 00 01 dd ........ ..P..... + 00000430 00 00 00 0c 00 02 50 15 00 00 00 96 ......P. .... + 0000043C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 0000044C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 11 ........ ..OL.... + 0000045C 00 00 00 0c 00 02 4f 4d 00 00 00 58 00 00 00 0c ......OM ...X.... + 0000046C 00 02 4f 4e 00 00 02 24 ..ON...$ + 00000474 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000484 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 12 ........ ..OL.... + 00000494 00 00 00 0c 00 02 4f 4d 00 00 03 0a 00 00 00 0c ......OM ........ + 000004A4 00 02 4f 4e 00 00 01 f5 ..ON.... + 000004AC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 000004BC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 13 ........ ..OL.... Ten server target created messages + 000004CC 00 00 00 0c 00 02 4f 4d 00 00 01 c4 00 00 00 0c ......OM ........ + 000004DC 00 02 4f 4e 00 00 00 64 ..ON...d + 000004E4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 000004F4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 14 ........ ..OL.... + 00000504 00 00 00 0c 00 02 4f 4d 00 00 00 86 00 00 00 0c ......OM ........ + 00000514 00 02 4f 4e 00 00 01 b8 ..ON.... + 0000051C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 0000052C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 15 ........ ..OL.... + 0000053C 00 00 00 0c 00 02 4f 4d 00 00 00 56 00 00 00 0c ......OM ...V.... + 0000054C 00 02 4f 4e 00 00 01 b2 ..ON.... + 00000554 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000564 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 16 ........ ..OL.... + 00000574 00 00 00 0c 00 02 4f 4d 00 00 01 cb 00 00 00 0c ......OM ........ + 00000584 00 02 4f 4e 00 00 00 ee ..ON.... + 0000058C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 0000059C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 17 ........ ..OL.... + 000005AC 00 00 00 0c 00 02 4f 4d 00 00 01 1b 00 00 00 0c ......OM ........ + 000005BC 00 02 4f 4e 00 00 00 05 ..ON.... + 000005C4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 000005D4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 18 ........ ..OL.... + 000005E4 00 00 00 0c 00 02 4f 4d 00 00 02 55 00 00 00 0c ......OM ...U.... + 000005F4 00 02 4f 4e 00 00 00 c3 ..ON.... +000000E0 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client heartbeat +000000F0 00 00 00 01 .... + 000005FC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 0000060C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 19 ........ ..OL.... + 0000061C 00 00 00 0c 00 02 4f 4d 00 00 00 97 00 00 00 0c ......OM ........ + 0000062C 00 02 4f 4e 00 00 00 3c ..ON...< + 00000634 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000644 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1a ........ ..OL.... + 00000654 00 00 00 0c 00 02 4f 4d 00 00 02 05 00 00 00 0c ......OM ........ + 00000664 00 02 4f 4e 00 00 01 bd ..ON.... + 0000066C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 0000067C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1b ........ ..OL.... + 0000068C 00 00 00 0c 00 02 4f 4d 00 00 02 06 00 00 00 0c ......OM ........ + 0000069C 00 02 4f 4e 00 00 01 29 ..ON...) + 000006A4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ Eight server target created messages + 000006B4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1c ........ ..OL.... + 000006C4 00 00 00 0c 00 02 4f 4d 00 00 02 1d 00 00 00 0c ......OM ........ + 000006D4 00 02 4f 4e 00 00 00 ee ..ON.... + 000006DC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 000006EC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1d ........ ..OL.... + 000006FC 00 00 00 0c 00 02 4f 4d 00 00 02 dc 00 00 00 0c ......OM ........ + 0000070C 00 02 4f 4e 00 00 00 43 ..ON...C + 00000714 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000724 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1e ........ ..OL.... + 00000734 00 00 00 0c 00 02 4f 4d 00 00 02 75 00 00 00 0c ......OM ...u.... + 00000744 00 02 4f 4e 00 00 01 f3 ..ON.... + 0000074C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 0000075C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1f ........ ..OL.... + 0000076C 00 00 00 0c 00 02 4f 4d 00 00 02 27 00 00 00 0c ......OM ...'.... + 0000077C 00 02 4f 4e 00 00 00 dc ..ON.... + 00000784 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000794 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 20 ........ ..OL... + 000007A4 00 00 00 0c 00 02 4f 4d 00 00 01 84 00 00 00 0c ......OM ........ + 000007B4 00 02 4f 4e 00 00 00 ea ..ON.... +000000F4 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client heartbeat +00000104 00 00 00 01 .... + 000007BC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 000007CC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 21 ........ ..OL...! + 000007DC 00 00 00 0c 00 02 4f 4d 00 00 01 a0 00 00 00 0c ......OM ........ + 000007EC 00 02 4f 4e 00 00 00 5d ..ON...] + 000007F4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000804 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 22 ........ ..OL..." + 00000814 00 00 00 0c 00 02 4f 4d 00 00 03 11 00 00 00 0c ......OM ........ + 00000824 00 02 4f 4e 00 00 01 04 ..ON.... + 0000082C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 0000083C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 23 ........ ..OL...# + 0000084C 00 00 00 0c 00 02 4f 4d 00 00 01 d8 00 00 00 0c ......OM ........ + 0000085C 00 02 4f 4e 00 00 02 2f ..ON.../ + 00000864 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000874 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 24 ........ ..OL...$ + 00000884 00 00 00 0c 00 02 4f 4d 00 00 00 4d 00 00 00 0c ......OM ...M.... Nine server target created messages + 00000894 00 02 4f 4e 00 00 01 48 ..ON...H + 0000089C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 000008AC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 25 ........ ..OL...% + 000008BC 00 00 00 0c 00 02 4f 4d 00 00 02 e2 00 00 00 0c ......OM ........ + 000008CC 00 02 4f 4e 00 00 02 50 ..ON...P + 000008D4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 000008E4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 26 ........ ..OL...& + 000008F4 00 00 00 0c 00 02 4f 4d 00 00 01 85 00 00 00 0c ......OM ........ + 00000904 00 02 4f 4e 00 00 01 71 ..ON...q + 0000090C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 0000091C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 27 ........ ..OL...' + 0000092C 00 00 00 0c 00 02 4f 4d 00 00 01 4f 00 00 00 0c ......OM ...O.... + 0000093C 00 02 4f 4e 00 00 01 77 ..ON...w + 00000944 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 00000954 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 28 ........ ..OL...( + 00000964 00 00 00 0c 00 02 4f 4d 00 00 00 1a 00 00 00 0c ......OM ........ + 00000974 00 02 4f 4e 00 00 00 1c ..ON.... + 0000097C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ + 0000098C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 29 ........ ..OL...) + 0000099C 00 00 00 0c 00 02 4f 4d 00 00 01 41 00 00 00 0c ......OM ...A.... + 000009AC 00 02 4f 4e 00 00 02 0f ..ON.... +00000108 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client heartbeat +00000118 00 00 00 01 .... + 000009B4 00 00 00 54 00 00 00 00 00 00 00 0c 00 02 00 01 ...T.... ........ Server: game ended + 000009C4 00 00 00 06 00 00 00 0c 00 02 50 78 00 00 00 00 ........ ..Px.... Message: 0% of targets hit, + 000009D4 00 00 00 28 00 01 50 79 30 25 20 6f 66 20 74 61 ...(..Py 0% of ta keep trying! + 000009E4 72 67 65 74 73 20 68 69 74 2c 20 6b 65 65 70 20 rgets hi t, keep + 000009F4 74 72 79 69 6e 67 21 00 00 00 00 0c 00 02 50 7a trying!. ......Pz + 00000A04 00 00 00 02 .... |