In this talk we will delve into one of the most played games of the moment: Blizzard Interactive's Hearthstone. We will focus on analysing Hearthstone's implementation of Google Protocol Buffers and proceed to show how the game handles communication by providing some code examples and by showing how to create a Deck Tracking application.

1. Hearthstone: an analysis of game network protocols
Andrea Del Fiandra & Marco Cuciniello
MILAN 25-26 NOVEMBER 2016

3. Wow
Such surprise
Very unpredictable

4. What are google protocol buffers?
• data serialization format
• flexible and efficient
• easily portable

5. How do protocol buffers work?
message Person {
required string name = 1;
required int32 id = 2;
optional string email = 3;
enum PhoneType {
MOBILE = 0;
HOME = 1;
WORK = 2;
}
message PhoneNumber {
required string number = 1;
optional PhoneType type = 2 [default = HOME];
}
repeated PhoneNumber phone = 4;
}

7. Games using protocol buffers
github.com/Armax/Pokemon-GO-node-api
github.com/Armax/Elix

8. Back to Hearthstone

9. halp pls
Time for decompilation

12. How to extract .proto files
github.com/HearthSim/proto-extractor

13. Packets used during a Hearthstone match
{
"1": "GetGameState",
"2": "ChooseOption",
"3": "ChooseEntities",
"11": "Concede",
"13": "EntitiesChosen",
"14": "AllOptions",
"15": "UserUI",
"16": "GameSetup",
"17": "EntityChoices",
"19": "PowerHistory",
"24": "SpectatorNotify",
"115": "Ping",
"116": "Pong",
"168": "Handshake"
}

14. Packets used during a Hearthstone match
Handshake
message Handshake {
enum PacketID {
ID = 168;
}
required int32 game_handle = 1;
required string password = 2;
required int64 client_handle = 3;
optional int32 mission = 4;
required string version = 5;
required PegasusShared.Platform platform = 7;
}

15. Packets used during a Hearthstone match
GameSetup
message GameSetup {
enum PacketID {
ID = 16;
}
required int32 board = 1;
required int32 max_secrets_per_player = 2;
required int32 max_friendly_minions_per_player = 3;
optional int32 keep_alive_frequency_seconds = 4;
optional int32 disconnect_when_stuck_seconds = 5;
}

16. Packets used during a Hearthstone match
Ping & Pong
message Ping {
enum PacketID {
ID = 115;
}
}
message Pong {
enum PacketID {
ID = 116;
}
}

17. Packets used during a Hearthstone match
PowerHistory
message PowerHistory {
enum PacketID {
ID = 19;
}
repeated PowerHistoryData list = 1;
}
message PowerHistoryData {
optional PowerHistoryEntity full_entity = 1;
optional PowerHistoryEntity show_entity = 2;
optional PowerHistoryHide hide_entity = 3;
optional PowerHistoryTagChange tag_change = 4;
optional PowerHistoryCreateGame create_game = 5;
optional PowerHistoryStart power_start = 6;
optional PowerHistoryEnd power_end = 7;
optional PowerHistoryMetaData meta_data = 8;
optional PowerHistoryEntity change_entity = 9;

18. Packets used during a Hearthstone match
PowerHistoryEntity
message PowerHistoryEntity {
required int32 entity = 1;
required string name = 2;
repeated Tag tags = 3;
}

19. Packets used during a Hearthstone match
EntityChoices
message EntityChoices {
enum PacketID {
ID = 17;
}
required int32 id = 1;
required int32 choice_type = 2;
required int32 count_min = 4;
required int32 count_max = 5;
repeated int32 entities = 6 [packed = true];
optional int32 source = 7;
required int32 player_id = 8;
}

21. Implementation

22. Demo Time

23. What we learnt

24. Encryption

25. Encryption

26. Encryption

29. // Modules
var ProtoBuf = require('protobufjs');
var PegasusPacket = require('./pegasuspacket').PegasusPacket;
var net = require('net');
var client = new net.Socket();
var builder = ProtoBuf.loadProtoFile(__dirname + '/proto/game.proto');
var PegasusGame = builder.build();
var serverIp = "127.0.0.1"
var handshake = "qAAAAFkAAAAIpoKkChIGY0RnZ2xvGLmgmQIgggIqBjI4OTYwNjo6CAIQBBoOTWFjQm9va1BybzExLDUqJEJBQTVGNzV
handshake.game_handle = 1;
// Crafting ping packet
var ping = new PegasusGame.PegasusGame.Ping();
var encoded_ping = PegasusGame.PegasusGame.Ping.encode(ping);
var type = PegasusGame.PegasusGame.Ping.PacketID.ID;
var pegasus_ping = new PegasusPacket();
var encoded_pegasus_ping = pegasus_ping.Encode(encoded_ping, type);
// Craft USERUI packet
var userui = new PegasusGame.PegasusGame.UserUI();
userui.mouse_info = null;
userui.emote = 4;
userui.player_id = null;
var encoded_userui = PegasusGame.PegasusGame.UserUI.encode(userui);
var type_userui = PegasusGame.PegasusGame.UserUI.PacketID.ID;
var pegasus_userui = new PegasusPacket();
var encoded_pegasus_userui = pegasus_ping.Encode(encoded_userui, type_userui);
client.connect(3724, serverIp, function() {
client.write(Buffer.from(args.options.handshake, 'base64'));
setInterval(function() {
console.log("[+] ping sent");
client.write(encoded_pegasus_ping);
}, 5000);
setInterval(function() {
client.write(encoded_pegasus_userui);
}, 1000);

30. net.createServer(function(sock) {
console.log('[+] connection from: ' + sock.remoteAddress +':'+ sock.remotePort);
sock.on('data', function(data) {
var pegasuspacket = new PegasusPacket();
var bytes_decoded = pegasuspacket.Decode(data, 0, data.length);
if(bytes_decoded >= 4) {
var decoded = Hearthnode.Decode(pegasuspacket);
if(decoded != null && decoded != "unimplemented") {
// Handling
console.log(pegasuspacket.Type);
switch(pegasuspacket.Type) {
// Handshake
case 168:
console.log("[i] Received handshake from client");
console.log(decoded);
// Reply with GameSetup
var GameSetup = new PegasusGame.PegasusGame.GameSetup();
GameSetup.board = 6;
GameSetup.max_secrets_per_player = 5;
GameSetup.max_friendly_minions_per_player = 7;
GameSetup.keep_alive_frequency_seconds = 5;
GameSetup.disconnect_when_stuck_seconds = 25;
var encoded_GameSetup = PegasusGame.PegasusGame.GameSetup.encode(GameSetup);
var type = PegasusGame.PegasusGame.GameSetup.PacketID.ID;
var pegasus_GameSetup = new PegasusPacket();
var encoded_pegasus_GameSetup = pegasus_GameSetup.Encode(encoded_GameSetup, type);
sock.write(encoded_pegasus_GameSetup);
break;
case 115:
// Crafting ping packet
console.log("[i] Received ping from client");
console.log(decoded)
var Pong = new PegasusGame.PegasusGame.Pong();
var encoded_Pong = PegasusGame.PegasusGame.Pong.encode(Pong);
var type = PegasusGame.PegasusGame.Pong.PacketID.ID;
var pegasus_Pong = new PegasusPacket();
var encoded_pegasus_Pong = pegasus_ping.Encode(encoded_Pong, type);
sock.write(encoded_pegasus_Pong);
break;
case 15:
// Received UserUI
console.log("[i] Received UserUI");
console.log(decoded);

31. Demo Time

32. Server / Client

34. Q & A Time!

35. Thanks for your attention
Marco Cuciniello - arm4x@becreatives.com
Andrea Del Fiandra - delfioh@gmail.com