The article says that "while it might seem feasible to reimplement these functions in Python without running the client, several factors make this approach impractical" and then lists some reasons like the lookup tables changing, chunk layouts getting shuffled, etc.
Is that all it takes to thwart decrypting the packets? Even though, presumably, you have access to all those lookup tables and chunk layouts somewhere in the client? Is it just too much effort to piece together how it works? I'd be curious to hear more specifics on how exactly Riot was able to make reverse engineering this so impractical.
Great article!
This should tell you enough about the person.
Obscurity very often increases security. The question is - by how much?
It is fine to add obscurity AS ANOTHER layer.
It is the same story as the "open source software is safer"
No. If you are open source & you have significant community then it is, otherwise closed source is harder to attack.
Example:
A packet could be decrypted like this (the actual decryption takes more steps than this)
field1 = LOOKUPTABLE(XOR(ADD_CONST(... field2 = ADD_CONST(XOR(LOOKUPTABLE(... field3 = ADD_CONST(XOR(SUB_CONST(LOOKUPTABLE(... ...
We observe that each each operation is composed of ADD_CONST, XOR, SUB_CONST, LOOKUPTABLE and the lookup tables in the client which is ~256 bytes long.
We could extract these operations and generate a really long script in python.
Why didn't I approach it this way?
1) It's really fragile. League is an actively updated game and the decryption mechanism may change in the future. If the decryption adds another operation like MUL_CONST or DIV_CONST, I would need to account for that on my end. This is unlike the reverse engineering efforts for dead games/servers where the packets do not change.
2) I don't need to know how the decryption mechanism works. Building a game server would require decryption of packet necessary. I only need to observe game state.
As for understanding how it works, I have not put enough time/effort to give an answer. :)
Wouldn’t this render all previous replay files unusable? Is that likely to happen?
apologies, english is not my native ..
dug into LOL more than a decade ago with a few mates to back an api/bot/site, parsing the keyframe and chunk formats within a week of spectator launch to automate timer callouts for jungle camps through fog of war due to the observer delay being less than the respawn time and so-called « auto-shoutcasting » for matches implementation when we were maybe 11 years :)
there are a number of difficulties these days (ive not played in years but work in the industry and do not touch these due to legal risk particularly REing competitor code)
from kernel anticheat being a requirement and packman before that - this article was written during covid so predates vanguard but contains packman -
legality - RE is « forbidden » - bannable so in which you do not want to lose your account in which you have spent tens of thousands of hours or more, breaking authentication and DRM flows is [DRM, auth handshake, protecteions] illegal in USA -
entire obfuscation format and flow changes with every patch; you have to repeat the work every hotfix + patch (and it isn't just a new xor key) - the re implementations would probably need to be realised every week or two - annoying - this is likely one of most tedious bits
You are confused. Reverse engineering is perfectly legal in USA, but that of course is irrelevant when it comes to losing your account (which isn't yours to begin with).
Semi-related but the game Vindictus/Mabinogi Heroes (a Source engine MMO) changed the game archive format multiple times (and probably continues to change it every so often) because people would eventually reverse-engineer the format, dump the files, then use them in Garry's Mod or the like.
There’s an odd unspoken and somewhat understood agreement between the developer (Wargaming) and community though: the community actively reverse engineers the game to document the packets and WG kind of looks the other way (except when they recently threatened me with a perma ban :) — they even use the tooling the community creates for official tournaments.
In this article the author mentions Riot partnering with external companies to provide more rich data set and analytics. Do they use these tools/data sets for tournaments as well? Is it known at all how these partnerships are structured?
I do not know how RIOT partners with external companies, so I do not know any analysis tools or datasets besides what is publicly available :(
At least, RIOT offers special endpoints/overlays for companies ~ [1][2].
[1] https://blitz.gg/overlays/lol [2] https://www.overwolf.com/browse-by-game/league-of-legends
Developed by Sergey Titov (same engine that powers Big Rigs).
By passing this is not mentioned at all in the article. Is this because they're trivial to bypass for experienced people, or because they want to hide their method from the dev?
As it went, our data was used to prove things to the developer they would have loved to hush-hush, which led to a cat and mouse game with the data and their open and... not so open apis. In the End, we stopped playing the game and stopped our efforts at it. Fun times.
it is how i wrote a blog post on generating builds for heroes before dota plus even had the feature!
https://maknee.github.io/assets/images/posts/2024-11-02/leag...
Shortly after I released this for TSM riot came out with the api.
The repo isn't on github. I might release it later, but I would want it to be in a better shape if I were to.
@media (prefers-color-scheme: dark) {
img[src*="svg"], img[src*="png"] {
filter: invert(1) hue-rotate(180deg);
}
} document.querySelectorAll('img').forEach(img => img.style.background = 'white');
Otherwise I'm confused why you mention it.
I think it's fair enough to complain about.
So this isn’t something the user is doing to manipulate the style and layout: their browser is saying “hey, fyi, this user’s local system biases to dark mode” and the site is choosing to respond by styling in a way that breaks diagram visibility.