botofu

Wed, 05 May 2021 00:00:00 +0000

I started the Botofu project during my PhD (even though it had nothing to do with it) back in 2020. My goal was to practice my C++ while building open-source tools that would be interesting for some people. At that time, I was still talking regularly with a community of people on a forum dedicated to automated tooling around a famous French game called Dofus. For most of them, the goal was to build bots that would extract interesting information from the game such as regularly getting the prices of some items in the player-driven market in order to have a database that could then be used to uncover some patterns and make virtual money in the game.

In order to build an automated tool, two main ways were explored:

Taking a man-in-the-middle (MITM) approach: the game client was launched, but the software would intercept all its communication, analyse them, and potentially forge some of them to automate some acitons.
Implement a full software that would act as the official game client, but without launching the game client itself.

Both approach require you to be able to understand how the game client communicates with the game server, so that your tool can read and understand the messages sent by the server, and potentially forge some without the game client too. It turns out that the game client needs to know that information too, so all the information that was needed was already available… except that it was hard to read! Turns out that the game client was written using the Action Script 3.0 programming language and was packaged as a SWF file. That means that, just like Java, the code was compiled into bytecode (which is an intermediate step between the code human can write and the machine code the CPU can read and understand) and executed by a virtual machine (a program running on your computer) called the ActionScript Virtual Machine 2 (AVM2).

Most people wanting to understand the protocol (how to read and forge packets of data to communicate with the server) were uncompiling the bytecode into relatively unreadable (because of obfuscation) code using a decompiler (often the JPEXS decompiler which was the most used at the time), that would then need to be parsed and understood by a human.

Example of the JPEXS decompiler user interface from their wiki.

Botofu was my attempt at circumventing uncompilation and making that step of getting the game protocol faster, less error-prone and more human friendly.

In that project I:

Developped binary readers and writers that are used in the other libraries.
Developped a partial parser for SWF files following the SWF File Format Specification Version 19.
Used the SWF file parser to extract the interesting data (the protocol) directly from the bytecode, without any decompilation, and output it in a JSON format.

As far as I can tell, the software is still used 6 years after its inception, and is still working as expected after 5 years without maintenance, which means I probably was right in my diagnostic that this was an interesting tool for people.

cpp | Adrien Suau

botofu