02_internals_of_hyperscape/01_entrypoint.md
@@ -33,7 +33,7 @@ ### Launching the Game Because the game is normally distributed with [BattlEye](https://www.battleye.com/), the following game flags are required to pass into the executable: `-eac_launcher /belaunch -be` in order to disable the anti-cheat in the game. The game also handles game license checks through [Ubisoft Connect](https://www.ubisoft.com/en-us/ubisoft-connect) (Formerly known as, and in the game files as, 'UPlay'). Check out the [uplay_r1](./02_uplay_r1.md) page for more information on how this works and how to bypass this restriction. The game also handles game license checks through [Ubisoft Connect](https://www.ubisoft.com/en-us/ubisoft-connect) (Formerly known as, and in the game files as, 'UPlay'). Check out the [uplay_r1](02_uplay_r1.md) page for more information on how this works and how to bypass this restriction. ### Dumping Imports The game executable is obfuscated with [VMProtect](https://vmpsoft.com/) v3.20-v3.5.0, but critical game functions are not. 02_internals_of_hyperscape/02_uplay_r1.md
@@ -7,5 +7,5 @@ > [!IMPORTANT] For `64-bit` devices, `uplay_r164_loader.dll` is loaded instead, and searches for `uplay_r164.dll`! ## Bypassing UPlay R1 - [Spring](../05_scapegoat/04_using_scapegoat.md) - Scapegoat's own UPlay R1 launcher and plugin loader, specifically for Hyperscape. - [Spring](../08_scapegoat/04_using_scapegoat.md) - Scapegoat's own UPlay R1 launcher and plugin loader, specifically for Hyperscape. - [LumaPlay](https://cs.rin.ru/forum/viewtopic.php?f=29&t=67197) 03_ubisoft_services/01_endpoints/01_inventory.md
File was renamed from 03_ubisoft_services/06_inventory.md @@ -1,4 +1,4 @@ # Ubisoft Services: Inventory # Ubisoft Services: Endpoints: Inventory The Hyper Scape item catalog contains **1,665 items** across **40 item types**.
File was renamed from 03_ubisoft_services/07_stats.md @@ -1,4 +1,4 @@ # Ubisoft Services: Stats & Player Data # Ubisoft Services: Endpoints: Stats & Player Data This page documents the stats-related endpoints used by Hyper Scape, including profile stats, player entities, Ubisoft Connect (Club) actions/rewards, and account status.
File was renamed from 03_ubisoft_services/08_news.md @@ -1,4 +1,4 @@ # Ubisoft Services: News # Ubisoft Services: Endpoints: News This page documents the in-game news system used by Hyper Scape. News items appear in the main menu as a carousel banner (Billboard), thumbnail cards (MenuThumbnail), and detail views (MenuDetail).
File was deleted 03_ubisoft_services/03_structure.md
New file @@ -0,0 +1,7 @@ # Ubisoft Services: Structure ## Spaces ## Profiles ## Sandboxes 04_rendezvous/02_overview.md
04_rendezvous/04_prudp_protocol.md
@@ -12,13 +12,13 @@ #### Client->Server Payload | Name | Description | Type | |------|-------------|------| | Public Key | The client's _public key_. | [`Buffer`](./03_structure.md#structure-buffer) | | Public Key | The client's _public key_. | [`Buffer`](03_structure.md#structure-buffer) | #### Server->Client Payload | Name | Description | Type | |------|-------------|------| | Public Key Signature | Presumably, the client's _public key_ signed by the server's _private key_. | [`Buffer`](./03_structure.md#structure-buffer) | | Public Key | The server's _public key_. | [`Buffer`](./03_structure.md#structure-buffer) | | Public Key Signature | Presumably, the client's _public key_ signed by the server's _private key_. | [`Buffer`](03_structure.md#structure-buffer) | | Public Key | The server's _public key_. | [`Buffer`](03_structure.md#structure-buffer) | ### Packet: `DATA` ### Packet: `DISCONNECT` 04_rendezvous/05_rmc_protocol.md
@@ -6,7 +6,7 @@ ## Official Implementation As seen in HyperScape, this protocol is done over [RendezVous](./03_structure.md) data packets. As seen in HyperScape, this protocol is done over [RendezVous](03_structure.md) data packets. When a request is made, usually in a function going by `<protocol name>Protocol::Call<method name>`, a call context is created and containers in memory for data returned by the server are associated with **return value pointers**, with IDs from `[0, n)`, where n is the number of parameters. @@ -18,10 +18,10 @@ | Protocol | Description | HyperScape-specific? | |------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|----------------------| | [`LoginProtocol`](./01_rmc_protocols/loginprotocol.md) | Used for authenticating with an RMC server using a Ubisoft token. | ✖️ | | [`CloudServersProtocol`](./01_rmc_protocols/cloudserversprotocol.md) | Used for listing datacenters for connecting to game servers. | ✔️ | | [`ApexAntitoxicityProtocol`](./01_rmc_protocols/apexantitoxicityprotocol.md) | Currently unknown, possibly for managing bans and mutes. | ✔️ | | [`SessionProtocol`](./01_rmc_protocols/sessionprotocol.md) | Presumably for creating, joining and leaving game sessions, but it is unknown what that entails. | ✔️ | | [`LoginProtocol`](01_rmc_protocols/loginprotocol.md) | Used for authenticating with an RMC server using a Ubisoft token. | ✖️ | | [`CloudServersProtocol`](01_rmc_protocols/cloudserversprotocol.md) | Used for listing datacenters for connecting to game servers. | ✔️ | | [`ApexAntitoxicityProtocol`](01_rmc_protocols/apexantitoxicityprotocol.md) | Currently unknown, possibly for managing bans and mutes. | ✔️ | | [`SessionProtocol`](01_rmc_protocols/sessionprotocol.md) | Presumably for creating, joining and leaving game sessions, but it is unknown what that entails. | ✔️ | | ... | ... | ... | > [!NOTE] @@ -33,7 +33,7 @@ | Name | Description | Type | |---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------| | Packet Length | The total number of bytes in the packet, not including the length itself. | `u32` | | Protocol Name | The protocol service on the server that is responsible for managing this request | [`String`](./03_structure.md#structure-string) | | Protocol Name | The protocol service on the server that is responsible for managing this request | [`String`](03_structure.md#structure-string) | | Is Request? | Whether or not this packet is for a _request_. | `bool` | | ... | See [Request Packet Format](#request-packet-format) or [Response Packet Format](#response-packet-format) for parsing the packet depending on `Is Request?`. | ... | @@ -65,8 +65,8 @@ |----------------|---------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------| | ... | See [Base Packet Format](#base-packet-format) for parsing the prologue of a request packet. | ... | | Call ID | The nonce token for this call to identify the response associated with this request. | `u32` | | Method Name | The method to call on the server. | [`String`](./03_structure.md#structure-string) | | Class Versions | Version information about the data in the request | [`List`](./03_structure.md#structure-listt)`<`[`ClassVersion`](#structure-classversion)`>` | | Method Name | The method to call on the server. | [`String`](03_structure.md#structure-string) | | Class Versions | Version information about the data in the request | [`List`](03_structure.md#structure-listt)`<`[`ClassVersion`](#structure-classversion)`>` | | ... | See the respective [protocol and method specification](#known-protocols) to parse and write the rest of the packet. | | ### Structure: `ClassVersion` @@ -79,7 +79,7 @@ | Name | Description | Type | |----------------|---------------------------------------------------|------------------------------------------------| | Structure Name | The name of the structure to assign a version to. | [`String`](./03_structure.md#structure-string) | | Structure Name | The name of the structure to assign a version to. | [`String`](03_structure.md#structure-string) | | Version | The version of the structure. | `u16` | ## Response Packet Format @@ -109,7 +109,7 @@ |-------------|---------------------------------------------------------------------------------------------------------------------|------------------------------------------------| | ... | See [Response Packet Format](#response-packet-format) for parsing the prologue of a successful response packet. | ... | | Call ID | The nonce token for the call to associate the response to the request. | `u32` | | Method Name | The method that was called by the client, see note below. | [`String`](./03_structure.md#structure-string) | | Method Name | The method that was called by the client, see note below. | [`String`](03_structure.md#structure-string) | | ... | See the respective [protocol and method specification](#known-protocols) to parse and write the rest of the packet. | | > [!NOTE] @@ -123,6 +123,6 @@ | Name | Description | Type | |-----------------|--------------------------------------------------------------------------------------------------------------------|------------------------------------------------| | ... | See [Response Packet Format](#response-packet-format) for parsing the prologue of an unsuccessful response packet. | ... | | Error Namespace | The category of error that occurred. | [`String`](./03_structure.md#structure-string) | | Error Namespace | The category of error that occurred. | [`String`](03_structure.md#structure-string) | | Error Code | The code of the error in the specified namespace | `u16` | | Call ID | The nonce token for the call to associate the response to the request. | `u32` | 05_storm/01_overview.md
New file @@ -0,0 +1 @@ # Storm: Overview 06_apex/01_overview.md
New file @@ -0,0 +1 @@ # Apex: Overview 07_anvilnext/01_overview.md
New file @@ -0,0 +1 @@ # AnvilNext: Overview 08_scapegoat/01_overview.md
08_scapegoat/02_build_scapegoat.md
08_scapegoat/03_install_scapegoat.md
08_scapegoat/04_using_scapegoat.md
08_scapegoat/05_setting_up_testing_environment.md
08_scapegoat/README.md
README.md
@@ -1,3 +1,5 @@ # Scapegoat Docs The purpose of this wiki is to explain, in detail, the internal construction of the game [Hyper Scape](https://en.wikipedia.org/wiki/Hyper_Scape), developed by Ubisoft, released on 2nd July 2020, and shut down on 27th April 2022. @@ -5,12 +7,20 @@ Information is derived from reverse engineering, leaks, and information gathered by others concerning other games. Browse individual folders to find a page to read, or check out some of these good starting points: - [Reverse Engineering: Getting Started on Reverse Engineering](02_reverse_engineering/02_how_to_start_reverse_engineering.md) - [Ubisoft Services: Creating a Session](03_ubisoft_services/04_creating_a_session.md) - [RendezVous: Structure](04_rendezvous/03_structure.md) - [Scapegoat: Overview](05_scapegoat/01_overview.md) - [Scapegoat: Installing and Using Scapegoat](05_scapegoat/03_install_and_use_scapegoat.md) ## Starting Pages If you're looking to reverse-engineer the game yourself, check out the [Internals of Hyperscape](./02_internals_of_hyperscape) pages. If you're wanting to understand how to install and configure Scapegoat: - [Scapegoat: Overview](08_scapegoat/01_overview.md) - [Scapegoat: Installing and Using Scapegoat](08_scapegoat/03_install_and_use_scapegoat.md) If you're wanting to understand how the game works internally: - [General Information: Game Versions](01_general_information/01_game_versions.md) - [Internals of Hyperscape: Entrypoint](02_internals_of_hyperscape/01_entrypoint.md) ## Outline Hyperscape is made up of several components, each of which have been developed by different studios or licensed for different needs: - [Ubisoft Services: Structure](03_ubisoft_services/03_structure.md) - [RendezVous: Overview](04_rendezvous/02_overview.md) - [Storm: Overview](05_storm/01_overview.md) - [Apex: Overview](06_apex/01_overview.md) - [AnvilNext: Overview](07_anvilnext/01_overview.md)
