From 2c26434de9a7ffcfdd83114129189619b2328112 Mon Sep 17 00:00:00 2001 From: Striven <sg.striven@cutecat.club> Date: Fri, 20 Feb 2026 12:05:29 +0000 Subject: [PATCH] Moved around and added stub pages for each component of the game --- 07_anvilnext/01_overview.md | 1 04_rendezvous/04_prudp_protocol.md | 6 +- 03_ubisoft_services/01_endpoints/02_stats.md | 2 06_apex/01_overview.md | 1 03_ubisoft_services/03_structure.md | 7 +++ 03_ubisoft_services/01_endpoints/03_news.md | 2 08_scapegoat/01_overview.md | 0 08_scapegoat/README.md | 0 04_rendezvous/02_overview.md | 0 05_storm/01_overview.md | 1 README.md | 26 +++++++++---- 08_scapegoat/04_using_scapegoat.md | 0 /dev/null | 1 02_internals_of_hyperscape/01_entrypoint.md | 2 08_scapegoat/03_install_scapegoat.md | 0 02_internals_of_hyperscape/02_uplay_r1.md | 2 03_ubisoft_services/01_endpoints/01_inventory.md | 2 04_rendezvous/05_rmc_protocol.md | 22 +++++----- 08_scapegoat/02_build_scapegoat.md | 0 08_scapegoat/05_setting_up_testing_environment.md | 0 20 files changed, 47 insertions(+), 28 deletions(-) diff --git a/02_internals_of_hyperscape/01_entrypoint.md b/02_internals_of_hyperscape/01_entrypoint.md index abca818..bb9dd79 100644 --- a/02_internals_of_hyperscape/01_entrypoint.md +++ b/02_internals_of_hyperscape/01_entrypoint.md @@ -33,7 +33,7 @@ ### Launching the Game Because the game is normally distributed with [BattlEye](https://www.battleye.com/), the following game flags are required to pass into the executable: `-eac_launcher /belaunch -be` in order to disable the anti-cheat in the game. -The game also handles game license checks through [Ubisoft Connect](https://www.ubisoft.com/en-us/ubisoft-connect) (Formerly known as, and in the game files as, 'UPlay'). Check out the [uplay_r1](./02_uplay_r1.md) page for more information on how this works and how to bypass this restriction. +The game also handles game license checks through [Ubisoft Connect](https://www.ubisoft.com/en-us/ubisoft-connect) (Formerly known as, and in the game files as, 'UPlay'). Check out the [uplay_r1](02_uplay_r1.md) page for more information on how this works and how to bypass this restriction. ### Dumping Imports The game executable is obfuscated with [VMProtect](https://vmpsoft.com/) v3.20-v3.5.0, but critical game functions are not. diff --git a/02_internals_of_hyperscape/02_uplay_r1.md b/02_internals_of_hyperscape/02_uplay_r1.md index 975aa79..0fdbb36 100644 --- a/02_internals_of_hyperscape/02_uplay_r1.md +++ b/02_internals_of_hyperscape/02_uplay_r1.md @@ -7,5 +7,5 @@ > [!IMPORTANT] For `64-bit` devices, `uplay_r164_loader.dll` is loaded instead, and searches for `uplay_r164.dll`! ## Bypassing UPlay R1 -- [Spring](../05_scapegoat/04_using_scapegoat.md) - Scapegoat's own UPlay R1 launcher and plugin loader, specifically for Hyperscape. +- [Spring](../08_scapegoat/04_using_scapegoat.md) - Scapegoat's own UPlay R1 launcher and plugin loader, specifically for Hyperscape. - [LumaPlay](https://cs.rin.ru/forum/viewtopic.php?f=29&t=67197) diff --git a/03_ubisoft_services/06_inventory.md b/03_ubisoft_services/01_endpoints/01_inventory.md similarity index 99% rename from 03_ubisoft_services/06_inventory.md rename to 03_ubisoft_services/01_endpoints/01_inventory.md index 4fdced7..d202a26 100644 --- a/03_ubisoft_services/06_inventory.md +++ b/03_ubisoft_services/01_endpoints/01_inventory.md @@ -1,4 +1,4 @@ -# Ubisoft Services: Inventory +# Ubisoft Services: Endpoints: Inventory The Hyper Scape item catalog contains **1,665 items** across **40 item types**. diff --git a/03_ubisoft_services/07_stats.md b/03_ubisoft_services/01_endpoints/02_stats.md similarity index 99% rename from 03_ubisoft_services/07_stats.md rename to 03_ubisoft_services/01_endpoints/02_stats.md index 379f65a..787de52 100644 --- a/03_ubisoft_services/07_stats.md +++ b/03_ubisoft_services/01_endpoints/02_stats.md @@ -1,4 +1,4 @@ -# Ubisoft Services: Stats & Player Data +# Ubisoft Services: Endpoints: Stats & Player Data This page documents the stats-related endpoints used by Hyper Scape, including profile stats, player entities, Ubisoft Connect (Club) actions/rewards, and account status. diff --git a/03_ubisoft_services/08_news.md b/03_ubisoft_services/01_endpoints/03_news.md similarity index 99% rename from 03_ubisoft_services/08_news.md rename to 03_ubisoft_services/01_endpoints/03_news.md index 1502735..ff40a04 100644 --- a/03_ubisoft_services/08_news.md +++ b/03_ubisoft_services/01_endpoints/03_news.md @@ -1,4 +1,4 @@ -# Ubisoft Services: News +# Ubisoft Services: Endpoints: News This page documents the in-game news system used by Hyper Scape. News items appear in the main menu as a carousel banner (Billboard), thumbnail cards (MenuThumbnail), and detail views (MenuDetail). diff --git a/03_ubisoft_services/03_rest_endpoints.md b/03_ubisoft_services/03_rest_endpoints.md deleted file mode 100644 index 6236239..0000000 --- a/03_ubisoft_services/03_rest_endpoints.md +++ /dev/null @@ -1 +0,0 @@ -# Ubisoft Services: REST Endpoints \ No newline at end of file diff --git a/03_ubisoft_services/03_structure.md b/03_ubisoft_services/03_structure.md new file mode 100644 index 0000000..6aeac60 --- /dev/null +++ b/03_ubisoft_services/03_structure.md @@ -0,0 +1,7 @@ +# Ubisoft Services: Structure + +## Spaces + +## Profiles + +## Sandboxes \ No newline at end of file diff --git a/04_rendezvous/02_connections_to_rendezvous_servers.md b/04_rendezvous/02_overview.md similarity index 100% rename from 04_rendezvous/02_connections_to_rendezvous_servers.md rename to 04_rendezvous/02_overview.md diff --git a/04_rendezvous/04_prudp_protocol.md b/04_rendezvous/04_prudp_protocol.md index 7d146b4..1700c4a 100644 --- a/04_rendezvous/04_prudp_protocol.md +++ b/04_rendezvous/04_prudp_protocol.md @@ -12,13 +12,13 @@ #### Client->Server Payload | Name | Description | Type | |------|-------------|------| -| Public Key | The client's _public key_. | [`Buffer`](./03_structure.md#structure-buffer) | +| Public Key | The client's _public key_. | [`Buffer`](03_structure.md#structure-buffer) | #### Server->Client Payload | Name | Description | Type | |------|-------------|------| -| Public Key Signature | Presumably, the client's _public key_ signed by the server's _private key_. | [`Buffer`](./03_structure.md#structure-buffer) | -| Public Key | The server's _public key_. | [`Buffer`](./03_structure.md#structure-buffer) | +| Public Key Signature | Presumably, the client's _public key_ signed by the server's _private key_. | [`Buffer`](03_structure.md#structure-buffer) | +| Public Key | The server's _public key_. | [`Buffer`](03_structure.md#structure-buffer) | ### Packet: `DATA` ### Packet: `DISCONNECT` diff --git a/04_rendezvous/05_rmc_protocol.md b/04_rendezvous/05_rmc_protocol.md index 6875610..fd17ec6 100644 --- a/04_rendezvous/05_rmc_protocol.md +++ b/04_rendezvous/05_rmc_protocol.md @@ -6,7 +6,7 @@ ## Official Implementation -As seen in HyperScape, this protocol is done over [RendezVous](./03_structure.md) data packets. +As seen in HyperScape, this protocol is done over [RendezVous](03_structure.md) data packets. When a request is made, usually in a function going by `<protocol name>Protocol::Call<method name>`, a call context is created and containers in memory for data returned by the server are associated with **return value pointers**, with IDs from `[0, n)`, where n is the number of parameters. @@ -18,10 +18,10 @@ | Protocol | Description | HyperScape-specific? | |------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|----------------------| -| [`LoginProtocol`](./01_rmc_protocols/loginprotocol.md) | Used for authenticating with an RMC server using a Ubisoft token. | ✖️ | -| [`CloudServersProtocol`](./01_rmc_protocols/cloudserversprotocol.md) | Used for listing datacenters for connecting to game servers. | ✔️ | -| [`ApexAntitoxicityProtocol`](./01_rmc_protocols/apexantitoxicityprotocol.md) | Currently unknown, possibly for managing bans and mutes. | ✔️ | -| [`SessionProtocol`](./01_rmc_protocols/sessionprotocol.md) | Presumably for creating, joining and leaving game sessions, but it is unknown what that entails. | ✔️ | +| [`LoginProtocol`](01_rmc_protocols/loginprotocol.md) | Used for authenticating with an RMC server using a Ubisoft token. | ✖️ | +| [`CloudServersProtocol`](01_rmc_protocols/cloudserversprotocol.md) | Used for listing datacenters for connecting to game servers. | ✔️ | +| [`ApexAntitoxicityProtocol`](01_rmc_protocols/apexantitoxicityprotocol.md) | Currently unknown, possibly for managing bans and mutes. | ✔️ | +| [`SessionProtocol`](01_rmc_protocols/sessionprotocol.md) | Presumably for creating, joining and leaving game sessions, but it is unknown what that entails. | ✔️ | | ... | ... | ... | > [!NOTE] @@ -33,7 +33,7 @@ | Name | Description | Type | |---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------| | Packet Length | The total number of bytes in the packet, not including the length itself. | `u32` | -| Protocol Name | The protocol service on the server that is responsible for managing this request | [`String`](./03_structure.md#structure-string) | +| Protocol Name | The protocol service on the server that is responsible for managing this request | [`String`](03_structure.md#structure-string) | | Is Request? | Whether or not this packet is for a _request_. | `bool` | | ... | See [Request Packet Format](#request-packet-format) or [Response Packet Format](#response-packet-format) for parsing the packet depending on `Is Request?`. | ... | @@ -65,8 +65,8 @@ |----------------|---------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------| | ... | See [Base Packet Format](#base-packet-format) for parsing the prologue of a request packet. | ... | | Call ID | The nonce token for this call to identify the response associated with this request. | `u32` | -| Method Name | The method to call on the server. | [`String`](./03_structure.md#structure-string) | -| Class Versions | Version information about the data in the request | [`List`](./03_structure.md#structure-listt)`<`[`ClassVersion`](#structure-classversion)`>` | +| Method Name | The method to call on the server. | [`String`](03_structure.md#structure-string) | +| Class Versions | Version information about the data in the request | [`List`](03_structure.md#structure-listt)`<`[`ClassVersion`](#structure-classversion)`>` | | ... | See the respective [protocol and method specification](#known-protocols) to parse and write the rest of the packet. | | ### Structure: `ClassVersion` @@ -79,7 +79,7 @@ | Name | Description | Type | |----------------|---------------------------------------------------|------------------------------------------------| -| Structure Name | The name of the structure to assign a version to. | [`String`](./03_structure.md#structure-string) | +| Structure Name | The name of the structure to assign a version to. | [`String`](03_structure.md#structure-string) | | Version | The version of the structure. | `u16` | ## Response Packet Format @@ -109,7 +109,7 @@ |-------------|---------------------------------------------------------------------------------------------------------------------|------------------------------------------------| | ... | See [Response Packet Format](#response-packet-format) for parsing the prologue of a successful response packet. | ... | | Call ID | The nonce token for the call to associate the response to the request. | `u32` | -| Method Name | The method that was called by the client, see note below. | [`String`](./03_structure.md#structure-string) | +| Method Name | The method that was called by the client, see note below. | [`String`](03_structure.md#structure-string) | | ... | See the respective [protocol and method specification](#known-protocols) to parse and write the rest of the packet. | | > [!NOTE] @@ -123,6 +123,6 @@ | Name | Description | Type | |-----------------|--------------------------------------------------------------------------------------------------------------------|------------------------------------------------| | ... | See [Response Packet Format](#response-packet-format) for parsing the prologue of an unsuccessful response packet. | ... | -| Error Namespace | The category of error that occurred. | [`String`](./03_structure.md#structure-string) | +| Error Namespace | The category of error that occurred. | [`String`](03_structure.md#structure-string) | | Error Code | The code of the error in the specified namespace | `u16` | | Call ID | The nonce token for the call to associate the response to the request. | `u32` | \ No newline at end of file diff --git a/05_storm/01_overview.md b/05_storm/01_overview.md new file mode 100644 index 0000000..4068160 --- /dev/null +++ b/05_storm/01_overview.md @@ -0,0 +1 @@ +# Storm: Overview diff --git a/06_apex/01_overview.md b/06_apex/01_overview.md new file mode 100644 index 0000000..d78060b --- /dev/null +++ b/06_apex/01_overview.md @@ -0,0 +1 @@ +# Apex: Overview diff --git a/07_anvilnext/01_overview.md b/07_anvilnext/01_overview.md new file mode 100644 index 0000000..dfa480c --- /dev/null +++ b/07_anvilnext/01_overview.md @@ -0,0 +1 @@ +# AnvilNext: Overview diff --git a/05_scapegoat/01_overview.md b/08_scapegoat/01_overview.md similarity index 100% rename from 05_scapegoat/01_overview.md rename to 08_scapegoat/01_overview.md diff --git a/05_scapegoat/02_build_scapegoat.md b/08_scapegoat/02_build_scapegoat.md similarity index 100% rename from 05_scapegoat/02_build_scapegoat.md rename to 08_scapegoat/02_build_scapegoat.md diff --git a/05_scapegoat/03_install_scapegoat.md b/08_scapegoat/03_install_scapegoat.md similarity index 100% rename from 05_scapegoat/03_install_scapegoat.md rename to 08_scapegoat/03_install_scapegoat.md diff --git a/05_scapegoat/04_using_scapegoat.md b/08_scapegoat/04_using_scapegoat.md similarity index 100% rename from 05_scapegoat/04_using_scapegoat.md rename to 08_scapegoat/04_using_scapegoat.md diff --git a/05_scapegoat/05_setting_up_testing_environment.md b/08_scapegoat/05_setting_up_testing_environment.md similarity index 100% rename from 05_scapegoat/05_setting_up_testing_environment.md rename to 08_scapegoat/05_setting_up_testing_environment.md diff --git a/05_scapegoat/README.md b/08_scapegoat/README.md similarity index 100% rename from 05_scapegoat/README.md rename to 08_scapegoat/README.md diff --git a/README.md b/README.md index 8b15cf9..5c3c1ed 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,5 @@ +# Scapegoat Docs + The purpose of this wiki is to explain, in detail, the internal construction of the game [Hyper Scape](https://en.wikipedia.org/wiki/Hyper_Scape), developed by Ubisoft, released on 2nd July 2020, and shut down on 27th April 2022. @@ -5,12 +7,20 @@ Information is derived from reverse engineering, leaks, and information gathered by others concerning other games. -Browse individual folders to find a page to read, or check out some of these good starting -points: -- [Reverse Engineering: Getting Started on Reverse Engineering](02_reverse_engineering/02_how_to_start_reverse_engineering.md) -- [Ubisoft Services: Creating a Session](03_ubisoft_services/04_creating_a_session.md) -- [RendezVous: Structure](04_rendezvous/03_structure.md) -- [Scapegoat: Overview](05_scapegoat/01_overview.md) -- [Scapegoat: Installing and Using Scapegoat](05_scapegoat/03_install_and_use_scapegoat.md) +## Starting Pages -If you're looking to reverse-engineer the game yourself, check out the [Internals of Hyperscape](./02_internals_of_hyperscape) pages. \ No newline at end of file +If you're wanting to understand how to install and configure Scapegoat: +- [Scapegoat: Overview](08_scapegoat/01_overview.md) +- [Scapegoat: Installing and Using Scapegoat](08_scapegoat/03_install_and_use_scapegoat.md) + +If you're wanting to understand how the game works internally: +- [General Information: Game Versions](01_general_information/01_game_versions.md) +- [Internals of Hyperscape: Entrypoint](02_internals_of_hyperscape/01_entrypoint.md) + +## Outline +Hyperscape is made up of several components, each of which have been developed by different studios or licensed for different needs: +- [Ubisoft Services: Structure](03_ubisoft_services/03_structure.md) +- [RendezVous: Overview](04_rendezvous/02_overview.md) +- [Storm: Overview](05_storm/01_overview.md) +- [Apex: Overview](06_apex/01_overview.md) +- [AnvilNext: Overview](07_anvilnext/01_overview.md) \ No newline at end of file -- Gitblit v1.10.0