Ports: 20000, 20001 Flags: 2 of clubs, black joker Category: card (200 points - 100 per flag) Chall author: ??? Writeup author: malfurious Setup ----- This challenge was discovered on port 20000, which just runs a web server offering a download of the relevant files (executable, shared libraries, image assets) for a simple game. "Hope you can click fast enough." This game is a target shooter / aim trainer type game with four modes: easy practice, easy challenge, hard practice, and hard challenge. All modes require a game server to run. The server used can be overridden, but defaults to port 20001. Easy practice is the only mode a reasonable human can complete, and on completion it prints "Good job, now try the challenge." The challenge modes are going to need to be automated. Clickspam --------- The team's first attempt at an easy solve was to setup an automation to send clicks all across the window (via Xorg APIs) as quickly as possible. We could not get the script to run fast enough, and so quickly moved on to more in-depth analysis of the problem. Protocol -------- Analyzing network traffic with Wireshark while playing the easy game allows us to see the game messages going back and forth in a JSON-like format. After connecting, the client specifies what the desired game mode is to the server and, under normal circumstances, the rest of the traffic is as follows: - Server randomly sends 'target created' messages, with X,Y screen coordinates of the target, and a (pointless) target ID. (Pointless, because the ID is not used anywhere else in the protocol.) - Client sends 'client click' messages when the player clicks on the screen, giving the X,Y position. - Server responds with either a 'target missed' or a 'target hit' message in response to a 'client click'. - Server eventually sends a 'game ended' message with the game score and a custom message. So, the critical decision-making game logic seems to take place on the server. However, in addition to those messages listed above, the client also sends out 'client heart beat' messages at a regular 1-second interval for time-keeping purposes. This seems to affect early game loss situations where the server will terminate the game early if the running score is not high enough. This only happens after every six of these client messages. While playing the hard mode, the protocol messages are sent in a binary-encoded form, but there are analogues to each of the plaintext JSON messages mentioned above, with the same semantics. These binary messages have a fixed 16-byte preamble, followed by a 4-byte field encoding the type of message that it is. The team didn't characterize all the fields in these messages, but context clues can go a long way in helping to identify each message and its meaningful parts. See Appendix D for an annotated dump of a hard mode packet capture. Solution -------- With this understanding of the protocol, I scripted two spoofed clients: one for the easy challenge, one for the hard challenge. Each client sends their corresponding 'start game' message and just handles new targets by immediately replying with a 'client click' in the same location. Generating my own heartbeat messages turned out to be unnecessary. After several target hits (a couple seconds of 'gameplay'), the game ends with 100% accuracy and a URL to retrieve the flag is sent in the 'game ended' message. Completing the easy challenge yields the 2 of clubs flag, and the hard challenge yields the black joker. See appendicies A and B for these client scripts. They are implemented using sploit, to handle the low-level comms easily. MD5(2_of_clubs) == f8972549547c3171fd41dddece3798bb MD5(joker_black) == 4195467b3a19bd9bcff419135561b01f ================================================================================ = Appendix A: easy_mode.py = ================================================================================ import json hello = {"StartGame": {"game_mode": "Easy"}} click = {"ClientClick": {"x": 0, "y": 0}} io.writeline(json.dumps(hello).encode()) while True: tc = json.loads(io.readline().decode()) try: x = tc['TargetCreated']['x'] y = tc['TargetCreated']['y'] click['ClientClick']['x'] = x click['ClientClick']['y'] = y io.writeline(json.dumps(click).encode()) except KeyError: pass ================================================================================ = Appendix B: hard_mode.py = ================================================================================ import struct hello = (b'\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x01' b'\x00\x00\x00\x03\x00\x00\x00\x0c\x00\x02\x4e\x84\x00\x00\x00\x03' b'\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x01' b'\x00\x00\x00\x01') def parse_tc(data): Qa, Qb, Qc, Id, tid, Qe, x, If, Ig, y = struct.unpack('!QQQIIQIIII', data) assert Qa == 0x0000003800000000 assert Qb == 0x0000000c00020001 assert Qc == 0x000000090000000c assert Id == 0x0000000000024f4c return x, y def make_click(x, y): Qa = 0x0000002c00000000 Qb = 0x0000000c00020001 Qc = 0x000000070000000c Id = 0x0000000000024ee8 Qe = 0x0000000c00024ee9 data = struct.pack('!QQQIIQI', Qa, Qb, Qc, Id, x, Qe, y) return data io.write(hello) while True: data = io.read(64) try: x, y = parse_tc(data) io.write(make_click(x, y)) except AssertionError: pass except struct.error: pass ================================================================================ = Appendix C: easy mode pcap = ================================================================================ {"StartGame":{"game_mode":"Easy"}} {"ClientHeartBeat":{}} {"TargetCreated":{"target_id":0,"x":52,"y":349}} {"TargetCreated":{"target_id":1,"x":170,"y":29}} {"TargetCreated":{"target_id":2,"x":571,"y":55}} {"TargetCreated":{"target_id":3,"x":394,"y":551}} {"TargetCreated":{"target_id":4,"x":76,"y":400}} {"TargetCreated":{"target_id":5,"x":272,"y":377}} {"ClientClick":{"x":417,"y":397}} {"TargetMissed":{"x":417,"y":397}} {"TargetCreated":{"target_id":6,"x":146,"y":243}} {"TargetCreated":{"target_id":7,"x":12,"y":255}} {"ClientHeartBeat":{}} {"TargetCreated":{"target_id":8,"x":311,"y":216}} {"TargetCreated":{"target_id":9,"x":539,"y":199}} {"ClientClick":{"x":417,"y":397}} {"TargetCreated":{"target_id":10,"x":715,"y":469}} {"TargetMissed":{"x":417,"y":397}} {"TargetCreated":{"target_id":11,"x":593,"y":483}} {"TargetCreated":{"target_id":12,"x":466,"y":113}} {"TargetCreated":{"target_id":13,"x":124,"y":2}} {"TargetCreated":{"target_id":14,"x":389,"y":428}} {"TargetCreated":{"target_id":15,"x":79,"y":237}} {"ClientHeartBeat":{}} {"TargetCreated":{"target_id":16,"x":714,"y":199}} {"ClientClick":{"x":389,"y":242}} {"TargetMissed":{"x":389,"y":242}} {"TargetCreated":{"target_id":17,"x":424,"y":515}} {"TargetCreated":{"target_id":18,"x":231,"y":185}} {"TargetCreated":{"target_id":19,"x":186,"y":541}} {"TargetCreated":{"target_id":20,"x":532,"y":518}} {"TargetCreated":{"target_id":21,"x":673,"y":590}} {"TargetCreated":{"target_id":22,"x":749,"y":425}} {"TargetCreated":{"target_id":23,"x":264,"y":75}} {"ClientClick":{"x":466,"y":300}} {"TargetCreated":{"target_id":24,"x":441,"y":22}} {"TargetMissed":{"x":466,"y":300}} {"ClientHeartBeat":{}} {"TargetCreated":{"target_id":25,"x":218,"y":43}} {"TargetCreated":{"target_id":26,"x":426,"y":189}} {"TargetCreated":{"target_id":27,"x":121,"y":382}} {"TargetCreated":{"target_id":28,"x":337,"y":499}} {"TargetCreated":{"target_id":29,"x":556,"y":284}} {"TargetCreated":{"target_id":30,"x":729,"y":308}} {"TargetCreated":{"target_id":31,"x":22,"y":103}} {"TargetCreated":{"target_id":32,"x":295,"y":55}} {"ClientHeartBeat":{}} {"TargetCreated":{"target_id":33,"x":197,"y":185}} {"TargetCreated":{"target_id":34,"x":184,"y":378}} {"TargetCreated":{"target_id":35,"x":285,"y":270}} {"TargetCreated":{"target_id":36,"x":94,"y":395}} {"TargetCreated":{"target_id":37,"x":604,"y":582}} {"TargetCreated":{"target_id":38,"x":781,"y":429}} {"TargetCreated":{"target_id":39,"x":740,"y":255}} {"TargetCreated":{"target_id":40,"x":750,"y":404}} {"TargetCreated":{"target_id":41,"x":238,"y":165}} {"GameEnded":{"score":0,"message":"0% of targets hit, keep trying!","reason":"TimeOver"}} {"ClientHeartBeat":{}} ================================================================================ = Appendix D: hard mode pcap (annotated) = ================================================================================ 00000000 00 00 00 20 00 00 00 00 00 00 00 0c 00 02 00 01 ... .... ........ Client sends 'start game' message 00000010 00 00 00 03 00 00 00 0c 00 02 4e 84 00 00 00 03 ........ ..N..... for the hard challenge game mode 00000020 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ 00000030 00 00 00 01 .... 00000000 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ Server: target created 00000010 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 00 ........ ..OL.... 32-bit ID is @ offset 28 (value 0) 00000020 00 00 00 0c 00 02 4f 4d 00 00 00 0b 00 00 00 0c ......OM ........ 32-bit X is @ offset 40 (value 11) 00000030 00 02 4f 4e 00 00 00 44 ..ON...D 32-bit Y is @ offset 52 (value 68) 00000038 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000048 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 01 ........ ..OL.... 00000058 00 00 00 0c 00 02 4f 4d 00 00 02 8d 00 00 00 0c ......OM ........ More target created messages 00000068 00 02 4f 4e 00 00 02 06 ..ON.... | 00000070 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ | 00000080 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 02 ........ ..OL.... | 00000090 00 00 00 0c 00 02 4f 4d 00 00 02 8a 00 00 00 0c ......OM ........ | 000000A0 00 02 4f 4e 00 00 02 0b ..ON.... | 000000A8 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ | 000000B8 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 03 ........ ..OL.... | 000000C8 00 00 00 0c 00 02 4f 4d 00 00 00 9a 00 00 00 0c ......OM ........ | 000000D8 00 02 4f 4e 00 00 00 37 ..ON...7 | 000000E0 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ V 000000F0 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 04 ........ ..OL.... 00000100 00 00 00 0c 00 02 4f 4d 00 00 01 57 00 00 00 0c ......OM ...W.... 00000110 00 02 4f 4e 00 00 01 b8 ..ON.... 00000118 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000128 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 05 ........ ..OL.... 00000138 00 00 00 0c 00 02 4f 4d 00 00 00 36 00 00 00 0c ......OM ...6.... 00000148 00 02 4f 4e 00 00 01 c3 ..ON.... 00000150 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000160 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 06 ........ ..OL.... 00000170 00 00 00 0c 00 02 4f 4d 00 00 00 20 00 00 00 0c ......OM ... .... 00000180 00 02 4f 4e 00 00 00 4c ..ON...L 00000034 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ Client: client click 00000044 00 00 00 07 00 00 00 0c 00 02 4e e8 00 00 02 0d ........ ..N..... 32-bit X is @ offset 28 (value 525) 00000054 00 00 00 0c 00 02 4e e9 00 00 01 7e ......N. ...~ 32-bit Y is @ offset 40 (value 382) 00000188 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ 00000198 00 00 00 0b 00 00 00 0c 00 02 50 14 00 00 02 0d ........ ..P..... 000001A8 00 00 00 0c 00 02 50 15 00 00 01 7e ......P. ...~ Two server target created messages 000001B4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 000001C4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 07 ........ ..OL.... 000001D4 00 00 00 0c 00 02 4f 4d 00 00 03 18 00 00 00 0c ......OM ........ 000001E4 00 02 4f 4e 00 00 00 c9 ..ON.... 00000060 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client: client heartbeat 00000070 00 00 00 01 .... 000001EC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 000001FC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 08 ........ ..OL.... 0000020C 00 00 00 0c 00 02 4f 4d 00 00 00 8d 00 00 00 0c ......OM ........ 0000021C 00 02 4f 4e 00 00 00 9b ..ON.... 00000224 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000234 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 09 ........ ..OL.... Three server target created messages 00000244 00 00 00 0c 00 02 4f 4d 00 00 02 2e 00 00 00 0c ......OM ........ 00000254 00 02 4f 4e 00 00 01 f0 ..ON.... 0000025C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 0000026C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0a ........ ..OL.... 0000027C 00 00 00 0c 00 02 4f 4d 00 00 01 fc 00 00 00 0c ......OM ........ 0000028C 00 02 4f 4e 00 00 01 a3 ..ON.... 00000074 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ Client click message 00000084 00 00 00 07 00 00 00 0c 00 02 4e e8 00 00 01 24 ........ ..N....$ 00000094 00 00 00 0c 00 02 4e e9 00 00 01 18 ......N. .... 00000294 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 000002A4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0b ........ ..OL.... 000002B4 00 00 00 0c 00 02 4f 4d 00 00 03 1a 00 00 00 0c ......OM ........ 000002C4 00 02 4f 4e 00 00 00 e3 ..ON.... 000002CC 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ 000002DC 00 00 00 0b 00 00 00 0c 00 02 50 14 00 00 01 24 ........ ..P....$ 000002EC 00 00 00 0c 00 02 50 15 00 00 01 18 ......P. .... 000002F8 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000308 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0c ........ ..OL.... Six server target created messages 00000318 00 00 00 0c 00 02 4f 4d 00 00 00 e4 00 00 00 0c ......OM ........ 00000328 00 02 4f 4e 00 00 00 9a ..ON.... 00000330 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000340 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0d ........ ..OL.... 00000350 00 00 00 0c 00 02 4f 4d 00 00 03 16 00 00 00 0c ......OM ........ 00000360 00 02 4f 4e 00 00 00 e0 ..ON.... 00000368 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000378 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0e ........ ..OL.... 00000388 00 00 00 0c 00 02 4f 4d 00 00 02 d8 00 00 00 0c ......OM ........ 00000398 00 02 4f 4e 00 00 02 46 ..ON...F 000003A0 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 000003B0 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 0f ........ ..OL.... 000003C0 00 00 00 0c 00 02 4f 4d 00 00 02 bd 00 00 00 0c ......OM ........ 000003D0 00 02 4f 4e 00 00 00 c4 ..ON.... 000000A0 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client heartbeat 000000B0 00 00 00 01 .... 000000B4 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ Client click message 000000C4 00 00 00 07 00 00 00 0c 00 02 4e e8 00 00 01 dd ........ ..N..... 000000D4 00 00 00 0c 00 02 4e e9 00 00 00 96 ......N. .... 000003D8 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 000003E8 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 10 ........ ..OL.... 000003F8 00 00 00 0c 00 02 4f 4d 00 00 00 ac 00 00 00 0c ......OM ........ 00000408 00 02 4f 4e 00 00 01 36 ..ON...6 00000410 00 00 00 2c 00 00 00 00 00 00 00 0c 00 02 00 01 ...,.... ........ 00000420 00 00 00 0b 00 00 00 0c 00 02 50 14 00 00 01 dd ........ ..P..... 00000430 00 00 00 0c 00 02 50 15 00 00 00 96 ......P. .... 0000043C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 0000044C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 11 ........ ..OL.... 0000045C 00 00 00 0c 00 02 4f 4d 00 00 00 58 00 00 00 0c ......OM ...X.... 0000046C 00 02 4f 4e 00 00 02 24 ..ON...$ 00000474 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000484 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 12 ........ ..OL.... 00000494 00 00 00 0c 00 02 4f 4d 00 00 03 0a 00 00 00 0c ......OM ........ 000004A4 00 02 4f 4e 00 00 01 f5 ..ON.... 000004AC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 000004BC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 13 ........ ..OL.... Ten server target created messages 000004CC 00 00 00 0c 00 02 4f 4d 00 00 01 c4 00 00 00 0c ......OM ........ 000004DC 00 02 4f 4e 00 00 00 64 ..ON...d 000004E4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 000004F4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 14 ........ ..OL.... 00000504 00 00 00 0c 00 02 4f 4d 00 00 00 86 00 00 00 0c ......OM ........ 00000514 00 02 4f 4e 00 00 01 b8 ..ON.... 0000051C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 0000052C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 15 ........ ..OL.... 0000053C 00 00 00 0c 00 02 4f 4d 00 00 00 56 00 00 00 0c ......OM ...V.... 0000054C 00 02 4f 4e 00 00 01 b2 ..ON.... 00000554 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000564 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 16 ........ ..OL.... 00000574 00 00 00 0c 00 02 4f 4d 00 00 01 cb 00 00 00 0c ......OM ........ 00000584 00 02 4f 4e 00 00 00 ee ..ON.... 0000058C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 0000059C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 17 ........ ..OL.... 000005AC 00 00 00 0c 00 02 4f 4d 00 00 01 1b 00 00 00 0c ......OM ........ 000005BC 00 02 4f 4e 00 00 00 05 ..ON.... 000005C4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 000005D4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 18 ........ ..OL.... 000005E4 00 00 00 0c 00 02 4f 4d 00 00 02 55 00 00 00 0c ......OM ...U.... 000005F4 00 02 4f 4e 00 00 00 c3 ..ON.... 000000E0 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client heartbeat 000000F0 00 00 00 01 .... 000005FC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 0000060C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 19 ........ ..OL.... 0000061C 00 00 00 0c 00 02 4f 4d 00 00 00 97 00 00 00 0c ......OM ........ 0000062C 00 02 4f 4e 00 00 00 3c ..ON...< 00000634 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000644 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1a ........ ..OL.... 00000654 00 00 00 0c 00 02 4f 4d 00 00 02 05 00 00 00 0c ......OM ........ 00000664 00 02 4f 4e 00 00 01 bd ..ON.... 0000066C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 0000067C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1b ........ ..OL.... 0000068C 00 00 00 0c 00 02 4f 4d 00 00 02 06 00 00 00 0c ......OM ........ 0000069C 00 02 4f 4e 00 00 01 29 ..ON...) 000006A4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ Eight server target created messages 000006B4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1c ........ ..OL.... 000006C4 00 00 00 0c 00 02 4f 4d 00 00 02 1d 00 00 00 0c ......OM ........ 000006D4 00 02 4f 4e 00 00 00 ee ..ON.... 000006DC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 000006EC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1d ........ ..OL.... 000006FC 00 00 00 0c 00 02 4f 4d 00 00 02 dc 00 00 00 0c ......OM ........ 0000070C 00 02 4f 4e 00 00 00 43 ..ON...C 00000714 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000724 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1e ........ ..OL.... 00000734 00 00 00 0c 00 02 4f 4d 00 00 02 75 00 00 00 0c ......OM ...u.... 00000744 00 02 4f 4e 00 00 01 f3 ..ON.... 0000074C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 0000075C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 1f ........ ..OL.... 0000076C 00 00 00 0c 00 02 4f 4d 00 00 02 27 00 00 00 0c ......OM ...'.... 0000077C 00 02 4f 4e 00 00 00 dc ..ON.... 00000784 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000794 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 20 ........ ..OL... 000007A4 00 00 00 0c 00 02 4f 4d 00 00 01 84 00 00 00 0c ......OM ........ 000007B4 00 02 4f 4e 00 00 00 ea ..ON.... 000000F4 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client heartbeat 00000104 00 00 00 01 .... 000007BC 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 000007CC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 21 ........ ..OL...! 000007DC 00 00 00 0c 00 02 4f 4d 00 00 01 a0 00 00 00 0c ......OM ........ 000007EC 00 02 4f 4e 00 00 00 5d ..ON...] 000007F4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000804 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 22 ........ ..OL..." 00000814 00 00 00 0c 00 02 4f 4d 00 00 03 11 00 00 00 0c ......OM ........ 00000824 00 02 4f 4e 00 00 01 04 ..ON.... 0000082C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 0000083C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 23 ........ ..OL...# 0000084C 00 00 00 0c 00 02 4f 4d 00 00 01 d8 00 00 00 0c ......OM ........ 0000085C 00 02 4f 4e 00 00 02 2f ..ON.../ 00000864 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000874 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 24 ........ ..OL...$ 00000884 00 00 00 0c 00 02 4f 4d 00 00 00 4d 00 00 00 0c ......OM ...M.... Nine server target created messages 00000894 00 02 4f 4e 00 00 01 48 ..ON...H 0000089C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 000008AC 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 25 ........ ..OL...% 000008BC 00 00 00 0c 00 02 4f 4d 00 00 02 e2 00 00 00 0c ......OM ........ 000008CC 00 02 4f 4e 00 00 02 50 ..ON...P 000008D4 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 000008E4 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 26 ........ ..OL...& 000008F4 00 00 00 0c 00 02 4f 4d 00 00 01 85 00 00 00 0c ......OM ........ 00000904 00 02 4f 4e 00 00 01 71 ..ON...q 0000090C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 0000091C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 27 ........ ..OL...' 0000092C 00 00 00 0c 00 02 4f 4d 00 00 01 4f 00 00 00 0c ......OM ...O.... 0000093C 00 02 4f 4e 00 00 01 77 ..ON...w 00000944 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 00000954 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 28 ........ ..OL...( 00000964 00 00 00 0c 00 02 4f 4d 00 00 00 1a 00 00 00 0c ......OM ........ 00000974 00 02 4f 4e 00 00 00 1c ..ON.... 0000097C 00 00 00 38 00 00 00 00 00 00 00 0c 00 02 00 01 ...8.... ........ 0000098C 00 00 00 09 00 00 00 0c 00 02 4f 4c 00 00 00 29 ........ ..OL...) 0000099C 00 00 00 0c 00 02 4f 4d 00 00 01 41 00 00 00 0c ......OM ...A.... 000009AC 00 02 4f 4e 00 00 02 0f ..ON.... 00000108 00 00 00 14 00 00 00 00 00 00 00 0c 00 02 00 01 ........ ........ Client heartbeat 00000118 00 00 00 01 .... 000009B4 00 00 00 54 00 00 00 00 00 00 00 0c 00 02 00 01 ...T.... ........ Server: game ended 000009C4 00 00 00 06 00 00 00 0c 00 02 50 78 00 00 00 00 ........ ..Px.... Message: 0% of targets hit, 000009D4 00 00 00 28 00 01 50 79 30 25 20 6f 66 20 74 61 ...(..Py 0% of ta keep trying! 000009E4 72 67 65 74 73 20 68 69 74 2c 20 6b 65 65 70 20 rgets hi t, keep 000009F4 74 72 79 69 6e 67 21 00 00 00 00 0c 00 02 50 7a trying!. ......Pz 00000A04 00 00 00 02 ....