01_general_information/01_game_versions.md
@@ -0,0 +1 @@ # General Information: Game Versions 01_general_information/README.md
New file @@ -0,0 +1,3 @@ # General Information General information about the game, essentially a wiki for the game on a surface-level. For understanding the game in closer depth, check out the [Internals of Hyperscape](../02_internals_of_hyperscape) folder. 02_internals_of_hyperscape/01_game_files.md
New file @@ -0,0 +1,35 @@ # Internals of Hyperscape: Game Files ## `Hyperscape.exe` ### Detect It Easy information | Property | Value | |------------------|--------------------------------------------------------------------------------------------------------------------------------------------------| | Operation system | `Windows(Vista)[AMD64, 64-bit, GUI]` | | Linker | `Microsoft Linker(14.16.27027)` | | Compiler | `Microsoft Visual C/C++(19.16.27043)[C++]` | | Language | `C++` | | Library | `Direct3D(9)` | | Library | `Steam` | | Library | `Vulkan` | | Tool | `Visual Studio(2017, v15.9)` | | Sign tool | `Windows Authenticode(2.0)[PKCS #7]` | | Protector | `VMProtect(3.2.0-3.5.0)` | | (Heur)Packer | `Compressed or packed data[Imports like VMProtect (v3.2.0-3.5.0) + Sections collision (".UBX") + High entropy + Section 6 (".UBX1") compressed]` | | Debug data | `PDB file link(7.0)` | | Certificate | `WinAuth(2.0)[PKCS #7]` | ### Launching the Game Because the game is normally distributed with BattlEye, the following game flags are required to pass into the executable: `-eac_launcher /belaunch -be` in order to mod the game. Currently, the only known way of launching the game and being able to attach debuggers and inject dynamic libraries is to use **LumaPlay**, which hijacks [UbiServices](../03_ubisoft_services/03_rest_endpoints.md) APIs to prevent usual restrictions like owning the game from preventing the launch. ### Dumping Imports A tool like [VMP3 Import Fix](https://github.com/KuNgia09/vmp3-import-fix) can be used to dynamically fix imports and export a much more manageable executable for reverse-engineering with a decompiler like IDA or Ghidra. ### Debug Builds No debug builds are currently known of the game itself, however debug builds and PDBs of libraries like RendezVous have been leaked and have been instrumental in further understanding the game. > [!INFO] > TODO: Explain further 02_internals_of_hyperscape/02_game_settings.md
New file @@ -0,0 +1,6 @@ # Internals of Hyperscape: Game Settings Game settings are located at `"C:\Users\<your user>\Documents\My Games\Hyperscape\<user id>\GameSettings.ini"`. > [!INFO] > TODO: Explain setting values 02_internals_of_hyperscape/03_login_screen.md
New file @@ -0,0 +1,8 @@ # Internals of Hyperscape: Login Screen When the game is first launched, the first screen after the loading and credits is a "Press any Key" screen, featuring artwork of the current season and where audio is first heard. ## Logging In When the any key is pressed, the client begins to make several requests in parallel, but there are some that have since been broken or lost relevance, and thus have acted as blockers in effectively getting past this initial screen. Firstly, the client attempts to create a session with the UbiServices API, see [Ubisoft Services: Creating a Session](../03_ubisoft_services/04_creating_a_session.md). 02_internals_of_hyperscape/README.md
New file @@ -0,0 +1,3 @@ # Internals of Hyperscape Understanding the game from the inside-out, how game features are implemented and how libraries are used. These pages also serve as something of a guide to start reverse engineering the game yourself, providing a baseline knowledge from the ground up of where things currently stand in researching the game. 02_reverse_engineering/01_structure_of_game_files.md
02_reverse_engineering/02_how_to_start_reverse_engineering.md
03_ubisoft_services/02_accessing_ubiservices.md
@@ -0,0 +1,3 @@ # Ubisoft Services: Accessing UbiServices ## Getting a Ticket 03_ubisoft_services/03_rest_endpoints.md
@@ -0,0 +1 @@ # Ubisoft Services: REST Endpoints 03_ubisoft_services/04_initial_login_flow.md
File was deleted 03_ubisoft_services/04_logging_in.md
New file @@ -0,0 +1,3 @@ # Ubisoft Services: Logging In ## Tickets 03_ubisoft_services/05_ubiservices_links_to_rendezvous.md
@@ -0,0 +1 @@ # Ubisoft Services: UbiServices Links to RendezVous 03_ubisoft_services/README.md
New file @@ -0,0 +1,3 @@ # Ubisoft Services Documenting the behaviour of the UbiServices API, explaining terms, how the game uses it and giving estimations on how it is implemented on the server. These pages should ultimately provide the information necessary to implement a custom version of the UbiServers API from scratch. 04_rendezvous/01_protocols/02_cloudserversprotocol.md
File was deleted 04_rendezvous/01_rmc_protocols/apexantitoxicityprotocol.md
New file @@ -0,0 +1,9 @@ # RendezVous: RMC Protocols: ApexAntitoxicityProtocol It is currently unknown exactly what the Apex Antitoxicity Protocol does, however it appears to manage penalties and sanctions for bad conduct. ## Method: `GetPlayerSanctions` Currently unknown. ## Method: `ReportPlayerOffense` Currently unknown. 04_rendezvous/01_rmc_protocols/cloudserversprotocol.md
New file @@ -0,0 +1,36 @@ # RendezVous: RMC Protocols: CloudServersProtocol The Cloud Servers Protocol allows the client to learn about which datacenters are available to connect to for the actual game servers. ## Method: `GetDatacenters` Fetches a list of available datacenters to the client. Currently unknown exactly what the datacenters are for and whether they contain actual URLs, or just identifiers. ### Request ##### Example The request data is empty for this method. > [!TIP] > Check out a [full request packet dump](../../00_packet_dumps/C2S-LoginProtocol__LoginWithToken_V1) for this call. ### Successful Response > [!NOTE] > TODO: Example ##### Parsing | Name | Description | Type | |-------------|------------------------------------------------|-----------------------------------------------------------------------------------------| | Datacenters | A list of datacenters available to the client. | [`List`](../03_structure.md#structure-listt)`<`[`Datacenter`](#structure-datacenter)`>` | ## Structure: `Datacenter` > [!NOTE] > TODO: Example ##### Parsing | Name | Description | Type | |----------|-------------|-------------------------------------------------| | String 1 | Unknown. | [`String`](../03_structure.md#structure-string) | | String 2 | Unknown. | [`String`](../03_structure.md#structure-string) | | String 3 | Unknown. | [`String`](../03_structure.md#structure-string) | 04_rendezvous/01_rmc_protocols/loginprotocol.md
File was renamed from 04_rendezvous/01_protocols/01_loginprotocol.md @@ -1,7 +1,9 @@ ## Overview # RendezVous: RMC Protocols: LoginProtocol The Login Protocol is common among Ubisoft games and is responsible for authenticating users by their [UbiServices ticket](../../03_ubisoft_services/02_accessing_ubiservices.md#getting-a-ticket). Additionally, it provides the server with information about the user's client and game information, and the server can re-direct the client to a more appropriate server. ## Method: `LoginWithToken` Authenticates with the server using a [UbiServices](../../03_ubisoft_services/02_accessing_ubiservices.md) ticket. See [Initial Login Flow](../../03_ubisoft_services/04_initial_login_flow.md) for information on how to obtain one. Authenticates with the server using a [UbiServices ticket](../../03_ubisoft_services/02_accessing_ubiservices.md#getting-a-ticket). See [Initial Login Flow](../../03_ubisoft_services/04_initial_login_flow.md) for information on how to obtain one. ### Request @@ -50,17 +52,18 @@ 00000270 08 00 70 72 75 64 70 3A 2F 00 ..prudp:/. ``` _[Full Request Packet](../../00_packet_dumps/C2S-LoginProtocol__LoginWithToken_V1)_ > [!TIP] > This is just the request data portion of a full packet. Check out a [full request packet dump](../../00_packet_dumps/C2S-LoginProtocol__LoginWithToken_V1) for this call. > [!NOTE] > [!IMPORTANT] > While this is a real packet sent, the ticket has been replaced with a dummy for security reasons. The normal ticket is a base64-encoded [JWT](../../03_ubisoft_services/04_initial_login_flow.md#ticket). ##### Parsing | Name | Description | Type | |---------------------|---------------------------------------------------------------------|---------------------------------------------------------------------| | Token | Ticket obtained via UbiServices, identifying the connecting client. | [`String`](../03_rendezvous_structure.md#structure-string) | | Client Version Info | Information about the client version | [`ClientVersionInfo`](#client-version-info) | | Diagnostic URL | Unknown. | [`Station URL`](../03_rendezvous_structure.md#structure-stationurl) | | Name | Description | Type | |---------------------|---------------------------------------------------------------------|----------------------------------------------------------| | Token | Ticket obtained via UbiServices, identifying the connecting client. | [`String`](../03_structure.md#structure-string) | | Client Version Info | Information about the client version | [`ClientVersionInfo`](#client-version-info) | | Diagnostic URL | Unknown. | [`Station URL`](../03_structure.md#structure-stationurl) | ### Successful Response @@ -68,11 +71,11 @@ > TODO: Example ##### Parsing | Name | Description | Type | |----------------------|--------------------------------------------------------------------|---------------------------------------------------------------------| | User PID | ID of the user profile that the connected client is identified as. | [`UUID`](../03_rendezvous_structure.md#structure-uuid) | | Protocol URL | Unknown. | [`Station URL`](../03_rendezvous_structure.md#structure-stationurl) | | Required Redirection | Unknown exactly. Presumably self-explanatory. | `bool` | | Name | Description | Type | |----------------------|--------------------------------------------------------------------|----------------------------------------------------------| | User PID | ID of the user profile that the connected client is identified as. | [`UUID`](../03_structure.md#structure-uuid) | | Protocol URL | Unknown. | [`Station URL`](../03_structure.md#structure-stationurl) | | Required Redirection | Unknown exactly. Presumably self-explanatory. | `bool` | ## Method: `Register` Currently unknown exactly what this method does, although it is called after receiving a successful response from the [LoginWithToken method](#method-loginwithtoken). @@ -96,15 +99,16 @@ 000000C0 31 35 00 15. ``` _[Full Request Packet](../../00_packet_dumps/C2S-LoginProtocol__Register_V1)_ > [!TIP] > This is just the request data portion of a full packet. Check out a [full request packet dump](../../00_packet_dumps/C2S-LoginProtocol__Register_V1) for this call. > [!NOTE] > [!IMPORTANT] > While this is a real packet sent, local IP addresses have been replaced with dummies for privacy reasons. It is currently unknown how the IP addresses are produced. ##### Parsing | Name | Description | Type | |--------------|-------------|----------------------------------------------------------------------------------------------------------------------------------| | Station URLs | Unknown. | [`List`](../03_rendezvous_structure.md#structure-listt)`<`[`Station URL`](../03_rendezvous_structure.md#structure-stationurl)`>` | | Name | Description | Type | |--------------|-------------|------------------------------------------------------------------------------------------------------------| | Station URLs | Unknown. | [`List`](../03_structure.md#structure-listt)`<`[`Station URL`](../03_structure.md#structure-stationurl)`>` | ### Response @@ -112,7 +116,7 @@ > TODO: Example ##### Parsing | Name | Description | Type | |---------------|-----------------------------------------------|---------------------------------------------------------------------| | Connection ID | Unknown exactly. Presumably self-explanatory. | `u32` | | Url Public | Unknown. | [`Station URL`](../03_rendezvous_structure.md#structure-stationurl) | | Name | Description | Type | |---------------|-----------------------------------------------|----------------------------------------------------------| | Connection ID | Unknown exactly. Presumably self-explanatory. | `u32` | | Url Public | Unknown. | [`Station URL`](../03_structure.md#structure-stationurl) | 04_rendezvous/02_connections_to_rendezvous_servers.md
@@ -0,0 +1 @@ # RendezVous: Connections to RendezVous Servers 04_rendezvous/03_structure.md
File was renamed from 04_rendezvous/03_rendezvous_structure.md @@ -1,3 +1,5 @@ # RendezVous: Structure All types are in little-endian. ## Common Structures 04_rendezvous/04_prudp_protocol.md
@@ -0,0 +1,15 @@ # RendezVous: PRUDP Protocol PRUDP probably stands for: "**P**rotected **R**eliable **U**ser **D**atagram **P**rotocol", as it is designed for adding connections, reliability, encryption and compression to UDP. To do this, it adds [connections](#connections), [ordering](#ordering), [fragmentation](#fragmentation) and [checksums](#checksums). ## Connections ## Ordering ## Fragmentation ## Checksums ## Packet Format 04_rendezvous/05_rmc_protocol.md
@@ -1,26 +1,40 @@ The RMC protocol, standing for **R**emote **M**ethod **C**all, is used to make transactional requests, such that "methods" are called by the client and responses are generated by the server. As seen in HyperScape, this protocol is done over [RendezVous](./03_rendezvous_structure.md) data packets. # RendezVous: RMC Protocol The RMC protocol, standing for **R**emote **M**ethod **C**all, is used to make transactional requests, such that "methods" are called by the client and responses are generated by the server. RMC itself is designed as a transport for several other application-defined protocols, such that services can send and handle requests through RMC. This means that there's another level deeper to go before we get to application/game data, as each protocol implements its own reading and writing of bytes, although they follow similar patterns and standardised ways. Here are the currently understood RMC protocols implemented in HyperScape. Some appear to be standard to Ubisoft games as a whole, while others appear to be designed specifically for the game. ## Official Implementation As seen in HyperScape, this protocol is done over [RendezVous](./03_structure.md) data packets. When a request is made, usually in a function going by `<protocol name>Protocol::Call<method name>`, a call context is created and containers in memory for data returned by the server are associated with **return value pointers**, with IDs from `[0, n)`, where n is the number of parameters. When a response is received, these **return value pointers** are fetched from the call context, and the packet is parsed and data is placed into these pointers. ## Known Protocols | Protocol | Description | HyperScape-specific? | |---------------------------------------------------------------------|-------------------------------------------------------------------|----------------------| | [`LoginProtocol`](./01_protocols/01_loginprotocol.md) | Used for authenticating with an RMC server using a Ubisoft token. | ✖️ | | [`CloudServersProtocol`](./01_protocols/02_cloudserversprotocol.md) | Used for listing datacenters for connecting to game servers | ✔️ | | ... | ... | ... | Here are the currently understood RMC protocols implemented in HyperScape. Some appear to be standard to Ubisoft games as a whole, while others appear to be designed specifically for the game. | Protocol | Description | HyperScape-specific? | |------------------------------------------------------------------------------|-------------------------------------------------------------------|----------------------| | [`LoginProtocol`](./01_rmc_protocols/loginprotocol.md) | Used for authenticating with an RMC server using a Ubisoft token. | ✖️ | | [`CloudServersProtocol`](./01_rmc_protocols/cloudserversprotocol.md) | Used for listing datacenters for connecting to game servers. | ✔️ | | [`ApexAntitoxicityProtocol`](./01_rmc_protocols/apexantitoxicityprotocol.md) | Currently unknown, presumably for managing bans and mutes. | ✔️ | | ... | ... | ... | > [!NOTE] > This list is far from complete. ## Base Packet Format ##### Parsing | Name | Description | Type | |---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------| | Packet Length | The total number of bytes in the packet, not including the length itself. | `u32` | | Protocol Name | The protocol service on the server that is responsible for managing this request | [`String`](./03_rendezvous_structure.md#structure-string) | | Is Request? | Whether or not this packet is for a _request_. | `bool` | | ... | See [Request Packet Format](#request-packet-format) or [Response Packet Format](#response-packet-format) for parsing the packet depending on `Is Request?`. | ... | | Name | Description | Type | |---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------| | Packet Length | The total number of bytes in the packet, not including the length itself. | `u32` | | Protocol Name | The protocol service on the server that is responsible for managing this request | [`String`](./03_structure.md#structure-string) | | Is Request? | Whether or not this packet is for a _request_. | `bool` | | ... | See [Request Packet Format](#request-packet-format) or [Response Packet Format](#response-packet-format) for parsing the packet depending on `Is Request?`. | ... | ## Request Packet Format @@ -46,13 +60,13 @@ ``` ##### Parsing | Name | Description | Type | |----------------|---------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------| | ... | See [Base Packet Format](#base-packet-format) for parsing the prologue of a request packet. | ... | | Call ID | The nonce token for this call to identify the response associated with this request. | `u32` | | Method Name | The method to call on the server. | [`String`](./03_rendezvous_structure.md#structure-string) | | Class Versions | Version information about the data in the request | [`List`](./03_rendezvous_structure.md#structure-listt)`<`[`ClassVersion`](#structure-classversion)`>` | | ... | See the respective [protocol and method specification](#known-protocols) to parse and write the rest of the packet. | | | Name | Description | Type | |----------------|---------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------| | ... | See [Base Packet Format](#base-packet-format) for parsing the prologue of a request packet. | ... | | Call ID | The nonce token for this call to identify the response associated with this request. | `u32` | | Method Name | The method to call on the server. | [`String`](./03_structure.md#structure-string) | | Class Versions | Version information about the data in the request | [`List`](./03_structure.md#structure-listt)`<`[`ClassVersion`](#structure-classversion)`>` | | ... | See the respective [protocol and method specification](#known-protocols) to parse and write the rest of the packet. | | ### Structure: `ClassVersion` Example: @@ -62,10 +76,10 @@ 00000010 6E 66 6F 00 01 00 nfo... ``` | Name | Description | Type | |----------------|---------------------------------------------------|-----------------------------------------------------------| | Structure Name | The name of the structure to assign a version to. | [`String`](./03_rendezvous_structure.md#structure-string) | | Version | The version of the structure. | `u16` | | Name | Description | Type | |----------------|---------------------------------------------------|------------------------------------------------| | Structure Name | The name of the structure to assign a version to. | [`String`](./03_structure.md#structure-string) | | Version | The version of the structure. | `u16` | ## Response Packet Format @@ -90,12 +104,12 @@ ### Successful Response Format ##### Parsing | Name | Description | Type | |-------------|---------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------| | ... | See [Response Packet Format](#response-packet-format) for parsing the prologue of a successful response packet. | ... | | Call ID | The nonce token for the call to associate the response to the request. | `u32` | | Method Name | The method that was called by the client, see note below. | [`String`](./03_rendezvous_structure.md#structure-string) | | ... | See the respective [protocol and method specification](#known-protocols) to parse and write the rest of the packet. | | | Name | Description | Type | |-------------|---------------------------------------------------------------------------------------------------------------------|------------------------------------------------| | ... | See [Response Packet Format](#response-packet-format) for parsing the prologue of a successful response packet. | ... | | Call ID | The nonce token for the call to associate the response to the request. | `u32` | | Method Name | The method that was called by the client, see note below. | [`String`](./03_structure.md#structure-string) | | ... | See the respective [protocol and method specification](#known-protocols) to parse and write the rest of the packet. | | > [!NOTE] > Typically, a `*` is appended to the Method Name in responses for currently unknown reasons. Likely to do with the fact that the response handlers update pointers to data containers created in the original request. @@ -105,9 +119,9 @@ ### Unsuccessful Response Format ##### Parsing | Name | Description | Type | |-----------------|--------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------| | ... | See [Response Packet Format](#response-packet-format) for parsing the prologue of an unsuccessful response packet. | ... | | Error Namespace | The category of error that occurred. | [`String`](./03_rendezvous_structure.md#structure-string) | | Error Code | The code of the error in the specified namespace | `u16` | | Call ID | The nonce token for the call to associate the response to the request. | `u32` | | Name | Description | Type | |-----------------|--------------------------------------------------------------------------------------------------------------------|------------------------------------------------| | ... | See [Response Packet Format](#response-packet-format) for parsing the prologue of an unsuccessful response packet. | ... | | Error Namespace | The category of error that occurred. | [`String`](./03_structure.md#structure-string) | | Error Code | The code of the error in the specified namespace | `u16` | | Call ID | The nonce token for the call to associate the response to the request. | `u32` | 04_rendezvous/README.md
New file @@ -0,0 +1,19 @@ # RendezVous RendezVous is a wide-ranging matchmaking, networking and authentication framework that serves as the basis for much of HyperScape's remote connection and gameplay system. RendezVous was developed by Quazal, seemingly around 2000, and the technology has since been licensed out to other studios.[[1]](#1) Quazal was purchased by UbiSoft in 2010.[[2]](#2) At the heart of RendezVous is an extremely customisable, extensible and dynamic system, and serves as much more of a general philosophy with a base implementation than a full library in itself. This makes it very difficult to have a single source of truth for defining RendezVous formats and flows. Therefore, these pages serve only to explain Ubisoft's use and version of RendezVous, and does not attempt to implement other games' or studios' flavours of the framework. Other wikis and pages exist to do that, such as [Pretendo](https://developer.pretendo.network/home), which implements Nintendo's licensed version and is significantly different to the one described here. Since RendezVous is so complex, it's unlikely that you would be able to use these pages to understand how to implement a RendezVous stack, however it should provide a solid enough basis for understanding the protocols used and how the game uses them. #### Footnotes ###### [1] https://web.archive.org/web/20180823162719/http:/quazal.com/rendez-vous.htm ###### [2] https://www.fasken.com/en/experience/2010/11/ubisoft-acquires-quazal-technologies 05_scapegoat/01_explaining_scapegoat.md
05_scapegoat/01_overview.md
New file @@ -0,0 +1 @@ # Scapegoat: Overview 05_scapegoat/02_build_and_use_scapegoat.md
@@ -0,0 +1 @@ # Scapegoat: Build and Use Scapegoat 05_scapegoat/03_install_and_use_scapegoat.md
@@ -0,0 +1 @@ # Scapegoat: Install and Use Scapegoat 05_scapegoat/README.md
New file @@ -0,0 +1,3 @@ # Scapegoat Information on how to install Scapegoat, its goals and how to contribute. The goal here isn't to explain how Scapegoat works internally, as that can change drastically and quickly. README.md
@@ -7,8 +7,10 @@ Browse individual folders to find a page to read, or check out some of these good starting points: - [Getting Started on Reverse Engineering](02_reverse_engineering/02_how_to_start_reverse_engineering.md) - [UbiServices Login Flow](03_ubisoft_services/04_initial_login_flow.md) - [RendezVous Structure](04_rendezvous/03_rendezvous_structure.md) - [Explaining Scapegoat](05_scapegoat/01_explaining_scapegoat.md) - [Installing and Using Scapegoat](05_scapegoat/03_install_and_use_scapegoat.md) - [Reverse Engineering: Getting Started on Reverse Engineering](02_reverse_engineering/02_how_to_start_reverse_engineering.md) - [Ubisoft Services: Creating a Session](03_ubisoft_services/04_creating_a_session.md) - [RendezVous: RendezVous Structure](04_rendezvous/03_structure.md) - [Scapegoat: Overview](05_scapegoat/01_overview.md) - [Scapegoat: Installing and Using Scapegoat](05_scapegoat/03_install_and_use_scapegoat.md) If you're looking to reverse-engineer the game yourself, check out the [Internals of Hyperscape](./02_internals_of_hyperscape) pages.
