From 2d871847bca0fe530b286246b9c041162c175781 Mon Sep 17 00:00:00 2001
From: Malfurious <m@lfurio.us>
Date: Sat, 11 Dec 2021 18:51:14 -0500
Subject: Add writeup for Metasploit Community CTF 2021 / Clickracer
Signed-off-by: Malfurious <m@lfurio.us>
---
.../Metasploit_Community_CTF_2021/clickracer.txt | 427 +++++++++++++++++++++
1 file changed, 427 insertions(+)
create mode 100644 docs/writeups/Metasploit_Community_CTF_2021/clickracer.txt
diff --git a/docs/writeups/Metasploit_Community_CTF_2021/clickracer.txt b/docs/writeups/Metasploit_Community_CTF_2021/clickracer.txt
new file mode 100644
index 0000000..ef66092
--- /dev/null
+++ b/docs/writeups/Metasploit_Community_CTF_2021/clickracer.txt
@@ -0,0 +1,427 @@
+Ports: 20000, 20001
+Flags: 2 of clubs, black joker
+Category: card (200 points - 100 per flag)
+Chall author: ???
+Writeup author: malfurious
+
+
+
+Setup
+-----
+This challenge was discovered on port 20000, which just runs a web server
+offering a download of the relevant files (executable, shared libraries, image
+assets) for a simple game. "Hope you can click fast enough."
+
+This game is a target shooter / aim trainer type game with four modes:
+easy practice, easy challenge, hard practice, and hard challenge. All modes
+require a game server to run. The server used can be overridden, but defaults
+to port 20001.
+
+Easy practice is the only mode a reasonable human can complete, and on
+completion it prints "Good job, now try the challenge." The challenge modes are
+going to need to be automated.
+
+
+
+Clickspam
+---------
+The team's first attempt at an easy solve was to setup an automation to send
+clicks all across the window (via Xorg APIs) as quickly as possible. We could
+not get the script to run fast enough, and so quickly moved on to more in-depth
+analysis of the problem.
+
+
+
+Protocol
+--------
+Analyzing network traffic with Wireshark while playing the easy game allows us
+to see the game messages going back and forth in a JSON-like format. After
+connecting, the client specifies what the desired game mode is to the server and,
+under normal circumstances, the rest of the traffic is as follows:
+
+ - Server randomly sends 'target created' messages, with X,Y screen
+ coordinates of the target, and a (pointless) target ID. (Pointless,
+ because the ID is not used anywhere else in the protocol.)
+ - Client sends 'client click' messages when the player clicks on the screen,
+ giving the X,Y position.
+ - Server responds with either a 'target missed' or a 'target hit' message in
+ response to a 'client click'.
+ - Server eventually sends a 'game ended' message with the game score and a
+ custom message.
+
+So, the critical decision-making game logic seems to take place on the server.
+However, in addition to those messages listed above, the client also sends out
+'client heart beat' messages at a regular 1-second interval for time-keeping
+purposes. This seems to affect early game loss situations where the server will
+terminate the game early if the running score is not high enough. This only
+happens after every six of these client messages.
+
+While playing the hard mode, the protocol messages are sent in a binary-encoded
+form, but there are analogues to each of the plaintext JSON messages mentioned
+above, with the same semantics.
+
+These binary messages have a fixed 16-byte preamble, followed by a 4-byte field
+encoding the type of message that it is. The team didn't characterize all the
+fields in these messages, but context clues can go a long way in helping to
+identify each message and its meaningful parts. See Appendix D for an annotated
+dump of a hard mode packet capture.
+
+
+
+Solution
+--------
+With this understanding of the protocol, I scripted two spoofed clients: one for
+the easy challenge, one for the hard challenge. Each client sends their
+corresponding 'start game' message and just handles new targets by immediately
+replying with a 'client click' in the same location. Generating my own
+heartbeat messages turned out to be unnecessary. After several target hits (a
+couple seconds of 'gameplay'), the game ends with 100% accuracy and a URL to
+retrieve the flag is sent in the 'game ended' message.
+
+Completing the easy challenge yields the 2 of clubs flag, and the hard challenge
+yields the black joker. See appendicies A and B for these client scripts.
+They are implemented using sploit, to handle the low-level comms easily.
+
+ MD5(2_of_clubs) == f8972549547c3171fd41dddece3798bb
+ MD5(joker_black) == 4195467b3a19bd9bcff419135561b01f
+
+
+
+================================================================================
+= Appendix A: easy_mode.py =
+================================================================================
+import json
+
+hello = {"StartGame": {"game_mode": "Easy"}}
+click = {"ClientClick": {"x": 0, "y": 0}}
+
+io.writeline(json.dumps(hello).encode())
+
+while True:
+ tc = json.loads(io.readline().decode())
+ try:
+ x = tc['TargetCreated']['x']
+ y = tc['TargetCreated']['y']
+
+ click['ClientClick']['x'] = x
+ click['ClientClick']['y'] = y
+ io.writeline(json.dumps(click).encode())
+ except KeyError:
+ pass
+
+
+
+================================================================================
+= Appendix B: hard_mode.py =
+================================================================================
+import struct
+
+hello = (b'\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x01'
+ b'\x00\x00\x00\x03\x00\x00\x00\x0c\x00\x02\x4e\x84\x00\x00\x00\x03'
+ b'\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x01'
+ b'\x00\x00\x00\x01')
+
+def parse_tc(data):
+ Qa, Qb, Qc, Id, tid, Qe, x, If, Ig, y = struct.unpack('!QQQIIQIIII', data)
+ assert Qa == 0x0000003800000000
+ assert Qb == 0x0000000c00020001
+ assert Qc == 0x000000090000000c
+ assert Id == 0x0000000000024f4c
+ return x, y
+
+def make_click(x, y):
+ Qa = 0x0000002c00000000
+ Qb = 0x0000000c00020001
+ Qc = 0x000000070000000c
+ Id = 0x0000000000024ee8
+ Qe = 0x0000000c00024ee9
+ data = struct.pack('!QQQIIQI', Qa, Qb, Qc, Id, x, Qe, y)
+ return data
+
+io.write(hello)
+
+while True:
+ data = io.read(64)
+ try:
+ x, y = parse_tc(data)
+ io.write(make_click(x, y))
+ except AssertionError:
+ pass
+ except struct.error:
+ pass
+
+
+
+================================================================================
+= Appendix C: easy mode pcap =
+================================================================================
+{"StartGame":{"game_mode":"Easy"}}
+{"ClientHeartBeat":{}}
+{"TargetCreated":{"target_id":0,"x":52,"y":349}}
+{"TargetCreated":{"target_id":1,"x":170,"y":29}}
+{"TargetCreated":{"target_id":2,"x":571,"y":55}}
+{"TargetCreated":{"target_id":3,"x":394,"y":551}}
+{"TargetCreated":{"target_id":4,"x":76,"y":400}}
+{"TargetCreated":{"target_id":5,"x":272,"y":377}}
+{"ClientClick":{"x":417,"y":397}}
+{"TargetMissed":{"x":417,"y":397}}
+{"TargetCreated":{"target_id":6,"x":146,"y":243}}
+{"TargetCreated":{"target_id":7,"x":12,"y":255}}
+{"ClientHeartBeat":{}}
+{"TargetCreated":{"target_id":8,"x":311,"y":216}}
+{"TargetCreated":{"target_id":9,"x":539,"y":199}}
+{"ClientClick":{"x":417,"y":397}}
+{"TargetCreated":{"target_id":10,"x":715,"y":469}}
+{"TargetMissed":{"x":417,"y":397}}
+{"TargetCreated":{"target_id":11,"x":593,"y":483}}
+{"TargetCreated":{"target_id":12,"x":466,"y":113}}
+{"TargetCreated":{"target_id":13,"x":124,"y":2}}
+{"TargetCreated":{"target_id":14,"x":389,"y":428}}
+{"TargetCreated":{"target_id":15,"x":79,"y":237}}
+{"ClientHeartBeat":{}}
+{"TargetCreated":{"target_id":16,"x":714,"y":199}}
+{"ClientClick":{"x":389,"y":242}}
+{"TargetMissed":{"x":389,"y":242}}
+{"TargetCreated":{"target_id":17,"x":424,"y":515}}
+{"TargetCreated":{"target_id":18,"x":231,"y":185}}
+{"TargetCreated":{"target_id":19,"x":186,"y":541}}
+{"TargetCreated":{"target_id":20,"x":532,"y":518}}
+{"TargetCreated":{"target_id":21,"x":673,"y":590}}
+{"TargetCreated":{"target_id":22,"x":749,"y":425}}
+{"TargetCreated":{"target_id":23,"x":264,"y":75}}
+{"ClientClick":{"x":466,"y":300}}
+{"TargetCreated":{"target_id":24,"x":441,"y":22}}
+{"TargetMissed":{"x":466,"y":300}}
+{"ClientHeartBeat":{}}
+{"TargetCreated":{"target_id":25,"x":218,"y":43}}
+{"TargetCreated":{"target_id":26,"x":426,"y":189}}
+{"TargetCreated":{"target_id":27,"x":121,"y":382}}
+{"TargetCreated":{"target_id":28,"x":337,"y":499}}
+{"TargetCreated":{"target_id":29,"x":556,"y":284}}
+{"TargetCreated":{"target_id":30,"x":729,"y":308}}
+{"TargetCreated":{"target_id":31,"x":22,"y":103}}
+{"TargetCreated":{"target_id":32,"x":295,"y":55}}
+{"ClientHeartBeat":{}}
+{"TargetCreated":{"target_id":33,"x":197,"y":185}}
+{"TargetCreated":{"target_id":34,"x":184,"y":378}}
+{"TargetCreated":{"target_id":35,"x":285,"y":270}}
+{"TargetCreated":{"target_id":36,"x":94,"y":395}}
+{"TargetCreated":{"target_id":37,"x":604,"y":582}}
+{"TargetCreated":{"target_id":38,"x":781,"y":429}}
+{"TargetCreated":{"target_id":39,"x":740,"y":255}}
+{"TargetCreated":{"target_id":40,"x":750,"y":404}}
+{"TargetCreated":{"target_id":41,"x":238,"y":165}}
+{"GameEnded":{"score":0,"message":"0% of targets hit, keep trying!","reason":"TimeOver"}}
+{"ClientHeartBeat":{}}
+
+
+
+================================================================================
+= Appendix D: hard mode pcap (annotated) =
+================================================================================
+00000000 00 00 00 20 00 00 00 00 00 00 00 0c 00 02 00 01 ... .... ........ Client sends 'start game' message
+00000010 00 00 00 03 00 00 00 0c 00 02 4e 84 00 00 00 03 ........ ..N..... for the hard challenge game mode
+00000020 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........
+00000030 00 00 00 01 ....
+ 00000000 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ Server: target created
+ 00000010 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 00 ........ ..OL.... 32-bit ID is @ offset 28 (value 0)
+ 00000020 00 00 00 0c 00 02 4f 4d 00 00 00 0b 00 00 00 0c ......OM ........ 32-bit X is @ offset 40 (value 11)
+ 00000030 00 02 4f 4e 00 00 00 44 ..ON...D 32-bit Y is @ offset 52 (value 68)
+ 00000038 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000048 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 01 ........ ..OL....
+ 00000058 00 00 00 0c 00 02 4f 4d 00 00 02 8d 00 00 00 0c ......OM ........ More target created messages
+ 00000068 00 02 4f 4e 00 00 02 06 ..ON.... |
+ 00000070 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ |
+ 00000080 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 02 ........ ..OL.... |
+ 00000090 00 00 00 0c 00 02 4f 4d 00 00 02 8a 00 00 00 0c ......OM ........ |
+ 000000A0 00 02 4f 4e 00 00 02 0b ..ON.... |
+ 000000A8 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ |
+ 000000B8 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 03 ........ ..OL.... |
+ 000000C8 00 00 00 0c 00 02 4f 4d 00 00 00 9a 00 00 00 0c ......OM ........ |
+ 000000D8 00 02 4f 4e 00 00 00 37 ..ON...7 |
+ 000000E0 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ V
+ 000000F0 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 04 ........ ..OL....
+ 00000100 00 00 00 0c 00 02 4f 4d 00 00 01 57 00 00 00 0c ......OM ...W....
+ 00000110 00 02 4f 4e 00 00 01 b8 ..ON....
+ 00000118 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000128 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 05 ........ ..OL....
+ 00000138 00 00 00 0c 00 02 4f 4d 00 00 00 36 00 00 00 0c ......OM ...6....
+ 00000148 00 02 4f 4e 00 00 01 c3 ..ON....
+ 00000150 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000160 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 06 ........ ..OL....
+ 00000170 00 00 00 0c 00 02 4f 4d 00 00 00 20 00 00 00 0c ......OM ... ....
+ 00000180 00 02 4f 4e 00 00 00 4c ..ON...L
+00000034 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ Client: client click
+00000044 00 00 00 07 00 00 00 0c 00 02 4e e8 00 00 02 0d ........ ..N..... 32-bit X is @ offset 28 (value 525)
+00000054 00 00 00 0c 00 02 4e e9 00 00 01 7e ......N. ...~ 32-bit Y is @ offset 40 (value 382)
+ 00000188 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........
+ 00000198 00 00 00 0b 00 00 00 0c 00 02 50 14 00 00 02 0d ........ ..P.....
+ 000001A8 00 00 00 0c 00 02 50 15 00 00 01 7e ......P. ...~ Two server target created messages
+ 000001B4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 000001C4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 07 ........ ..OL....
+ 000001D4 00 00 00 0c 00 02 4f 4d 00 00 03 18 00 00 00 0c ......OM ........
+ 000001E4 00 02 4f 4e 00 00 00 c9 ..ON....
+00000060 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client: client heartbeat
+00000070 00 00 00 01 ....
+ 000001EC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 000001FC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 08 ........ ..OL....
+ 0000020C 00 00 00 0c 00 02 4f 4d 00 00 00 8d 00 00 00 0c ......OM ........
+ 0000021C 00 02 4f 4e 00 00 00 9b ..ON....
+ 00000224 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000234 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 09 ........ ..OL.... Three server target created messages
+ 00000244 00 00 00 0c 00 02 4f 4d 00 00 02 2e 00 00 00 0c ......OM ........
+ 00000254 00 02 4f 4e 00 00 01 f0 ..ON....
+ 0000025C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 0000026C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0a ........ ..OL....
+ 0000027C 00 00 00 0c 00 02 4f 4d 00 00 01 fc 00 00 00 0c ......OM ........
+ 0000028C 00 02 4f 4e 00 00 01 a3 ..ON....
+00000074 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ Client click message
+00000084 00 00 00 07 00 00 00 0c 00 02 4e e8 00 00 01 24 ........ ..N....$
+00000094 00 00 00 0c 00 02 4e e9 00 00 01 18 ......N. ....
+ 00000294 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 000002A4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0b ........ ..OL....
+ 000002B4 00 00 00 0c 00 02 4f 4d 00 00 03 1a 00 00 00 0c ......OM ........
+ 000002C4 00 02 4f 4e 00 00 00 e3 ..ON....
+ 000002CC 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........
+ 000002DC 00 00 00 0b 00 00 00 0c 00 02 50 14 00 00 01 24 ........ ..P....$
+ 000002EC 00 00 00 0c 00 02 50 15 00 00 01 18 ......P. ....
+ 000002F8 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000308 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0c ........ ..OL.... Six server target created messages
+ 00000318 00 00 00 0c 00 02 4f 4d 00 00 00 e4 00 00 00 0c ......OM ........
+ 00000328 00 02 4f 4e 00 00 00 9a ..ON....
+ 00000330 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000340 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0d ........ ..OL....
+ 00000350 00 00 00 0c 00 02 4f 4d 00 00 03 16 00 00 00 0c ......OM ........
+ 00000360 00 02 4f 4e 00 00 00 e0 ..ON....
+ 00000368 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000378 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0e ........ ..OL....
+ 00000388 00 00 00 0c 00 02 4f 4d 00 00 02 d8 00 00 00 0c ......OM ........
+ 00000398 00 02 4f 4e 00 00 02 46 ..ON...F
+ 000003A0 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 000003B0 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0f ........ ..OL....
+ 000003C0 00 00 00 0c 00 02 4f 4d 00 00 02 bd 00 00 00 0c ......OM ........
+ 000003D0 00 02 4f 4e 00 00 00 c4 ..ON....
+000000A0 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client heartbeat
+000000B0 00 00 00 01 ....
+000000B4 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ Client click message
+000000C4 00 00 00 07 00 00 00 0c 00 02 4e e8 00 00 01 dd ........ ..N.....
+000000D4 00 00 00 0c 00 02 4e e9 00 00 00 96 ......N. ....
+ 000003D8 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 000003E8 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 10 ........ ..OL....
+ 000003F8 00 00 00 0c 00 02 4f 4d 00 00 00 ac 00 00 00 0c ......OM ........
+ 00000408 00 02 4f 4e 00 00 01 36 ..ON...6
+ 00000410 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........
+ 00000420 00 00 00 0b 00 00 00 0c 00 02 50 14 00 00 01 dd ........ ..P.....
+ 00000430 00 00 00 0c 00 02 50 15 00 00 00 96 ......P. ....
+ 0000043C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 0000044C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 11 ........ ..OL....
+ 0000045C 00 00 00 0c 00 02 4f 4d 00 00 00 58 00 00 00 0c ......OM ...X....
+ 0000046C 00 02 4f 4e 00 00 02 24 ..ON...$
+ 00000474 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000484 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 12 ........ ..OL....
+ 00000494 00 00 00 0c 00 02 4f 4d 00 00 03 0a 00 00 00 0c ......OM ........
+ 000004A4 00 02 4f 4e 00 00 01 f5 ..ON....
+ 000004AC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 000004BC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 13 ........ ..OL.... Ten server target created messages
+ 000004CC 00 00 00 0c 00 02 4f 4d 00 00 01 c4 00 00 00 0c ......OM ........
+ 000004DC 00 02 4f 4e 00 00 00 64 ..ON...d
+ 000004E4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 000004F4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 14 ........ ..OL....
+ 00000504 00 00 00 0c 00 02 4f 4d 00 00 00 86 00 00 00 0c ......OM ........
+ 00000514 00 02 4f 4e 00 00 01 b8 ..ON....
+ 0000051C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 0000052C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 15 ........ ..OL....
+ 0000053C 00 00 00 0c 00 02 4f 4d 00 00 00 56 00 00 00 0c ......OM ...V....
+ 0000054C 00 02 4f 4e 00 00 01 b2 ..ON....
+ 00000554 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000564 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 16 ........ ..OL....
+ 00000574 00 00 00 0c 00 02 4f 4d 00 00 01 cb 00 00 00 0c ......OM ........
+ 00000584 00 02 4f 4e 00 00 00 ee ..ON....
+ 0000058C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 0000059C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 17 ........ ..OL....
+ 000005AC 00 00 00 0c 00 02 4f 4d 00 00 01 1b 00 00 00 0c ......OM ........
+ 000005BC 00 02 4f 4e 00 00 00 05 ..ON....
+ 000005C4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 000005D4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 18 ........ ..OL....
+ 000005E4 00 00 00 0c 00 02 4f 4d 00 00 02 55 00 00 00 0c ......OM ...U....
+ 000005F4 00 02 4f 4e 00 00 00 c3 ..ON....
+000000E0 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client heartbeat
+000000F0 00 00 00 01 ....
+ 000005FC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 0000060C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 19 ........ ..OL....
+ 0000061C 00 00 00 0c 00 02 4f 4d 00 00 00 97 00 00 00 0c ......OM ........
+ 0000062C 00 02 4f 4e 00 00 00 3c ..ON...<
+ 00000634 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000644 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1a ........ ..OL....
+ 00000654 00 00 00 0c 00 02 4f 4d 00 00 02 05 00 00 00 0c ......OM ........
+ 00000664 00 02 4f 4e 00 00 01 bd ..ON....
+ 0000066C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 0000067C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1b ........ ..OL....
+ 0000068C 00 00 00 0c 00 02 4f 4d 00 00 02 06 00 00 00 0c ......OM ........
+ 0000069C 00 02 4f 4e 00 00 01 29 ..ON...)
+ 000006A4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ Eight server target created messages
+ 000006B4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1c ........ ..OL....
+ 000006C4 00 00 00 0c 00 02 4f 4d 00 00 02 1d 00 00 00 0c ......OM ........
+ 000006D4 00 02 4f 4e 00 00 00 ee ..ON....
+ 000006DC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 000006EC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1d ........ ..OL....
+ 000006FC 00 00 00 0c 00 02 4f 4d 00 00 02 dc 00 00 00 0c ......OM ........
+ 0000070C 00 02 4f 4e 00 00 00 43 ..ON...C
+ 00000714 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000724 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1e ........ ..OL....
+ 00000734 00 00 00 0c 00 02 4f 4d 00 00 02 75 00 00 00 0c ......OM ...u....
+ 00000744 00 02 4f 4e 00 00 01 f3 ..ON....
+ 0000074C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 0000075C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1f ........ ..OL....
+ 0000076C 00 00 00 0c 00 02 4f 4d 00 00 02 27 00 00 00 0c ......OM ...'....
+ 0000077C 00 02 4f 4e 00 00 00 dc ..ON....
+ 00000784 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000794 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 20 ........ ..OL...
+ 000007A4 00 00 00 0c 00 02 4f 4d 00 00 01 84 00 00 00 0c ......OM ........
+ 000007B4 00 02 4f 4e 00 00 00 ea ..ON....
+000000F4 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client heartbeat
+00000104 00 00 00 01 ....
+ 000007BC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 000007CC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 21 ........ ..OL...!
+ 000007DC 00 00 00 0c 00 02 4f 4d 00 00 01 a0 00 00 00 0c ......OM ........
+ 000007EC 00 02 4f 4e 00 00 00 5d ..ON...]
+ 000007F4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000804 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 22 ........ ..OL..."
+ 00000814 00 00 00 0c 00 02 4f 4d 00 00 03 11 00 00 00 0c ......OM ........
+ 00000824 00 02 4f 4e 00 00 01 04 ..ON....
+ 0000082C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 0000083C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 23 ........ ..OL...#
+ 0000084C 00 00 00 0c 00 02 4f 4d 00 00 01 d8 00 00 00 0c ......OM ........
+ 0000085C 00 02 4f 4e 00 00 02 2f ..ON.../
+ 00000864 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000874 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 24 ........ ..OL...$
+ 00000884 00 00 00 0c 00 02 4f 4d 00 00 00 4d 00 00 00 0c ......OM ...M.... Nine server target created messages
+ 00000894 00 02 4f 4e 00 00 01 48 ..ON...H
+ 0000089C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 000008AC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 25 ........ ..OL...%
+ 000008BC 00 00 00 0c 00 02 4f 4d 00 00 02 e2 00 00 00 0c ......OM ........
+ 000008CC 00 02 4f 4e 00 00 02 50 ..ON...P
+ 000008D4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 000008E4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 26 ........ ..OL...&
+ 000008F4 00 00 00 0c 00 02 4f 4d 00 00 01 85 00 00 00 0c ......OM ........
+ 00000904 00 02 4f 4e 00 00 01 71 ..ON...q
+ 0000090C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 0000091C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 27 ........ ..OL...'
+ 0000092C 00 00 00 0c 00 02 4f 4d 00 00 01 4f 00 00 00 0c ......OM ...O....
+ 0000093C 00 02 4f 4e 00 00 01 77 ..ON...w
+ 00000944 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 00000954 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 28 ........ ..OL...(
+ 00000964 00 00 00 0c 00 02 4f 4d 00 00 00 1a 00 00 00 0c ......OM ........
+ 00000974 00 02 4f 4e 00 00 00 1c ..ON....
+ 0000097C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........
+ 0000098C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 29 ........ ..OL...)
+ 0000099C 00 00 00 0c 00 02 4f 4d 00 00 01 41 00 00 00 0c ......OM ...A....
+ 000009AC 00 02 4f 4e 00 00 02 0f ..ON....
+00000108 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client heartbeat
+00000118 00 00 00 01 ....
+ 000009B4 00 00 00 54 00 00 00 00 00 00 00 0c 00 02 00 01 ...T.... ........ Server: game ended
+ 000009C4 00 00 00 06 00 00 00 0c 00 02 50 78 00 00 00 00 ........ ..Px.... Message: 0% of targets hit,
+ 000009D4 00 00 00 28 00 01 50 79 30 25 20 6f 66 20 74 61 ...(..Py 0% of ta keep trying!
+ 000009E4 72 67 65 74 73 20 68 69 74 2c 20 6b 65 65 70 20 rgets hi t, keep
+ 000009F4 74 72 79 69 6e 67 21 00 00 00 00 0c 00 02 50 7a trying!. ......Pz
+ 00000A04 00 00 00 02 ....
--
cgit v1.2.3