Learning how you did it.

[mikkel-kaj]

Hey Kurt. Just opening up an issue here, can you help me a bit on how you approach this kind of project?

[Kurt212]

So, Hello!

In fact there's nothing quite complicated here. It all started when I read some information about how other people reverse EFT's protocol on https://www.unknowncheats.me/.

The main tool was Fiddler which is http/https proxy to intercept packets. I've spent a lot of time just making some actions in menu and watching different decoded requests and responses. There was only one problem - EFT server didn't set "deflate" header in responses, so you need to insert this - https://pastebin.com/XiCd9aLV in Fiddler script

Turned out EFT was using classic WEB protocol (sends JSONs in HTTP POST Requests) to transfer data. Bot needed HTTP cookie to send requests. So I could logIn from your bot and receive new cookie or logIn with launcher, sniff cookie with Fiddler and have a connection in Python and Game client.

The first thing I wrote was manual buying items on flea market. Then I added some more logic: used several threads to buy many items simultaneously, added bounds for prices.

After that I had a problem, that the rubles in my stash were not stacked optimally. I researched the stash protocol and learned how to move items, stack them and so on.

In fact, this was not a fully automated tool. I opened python shell, called different commands for bot and monitored the flea market in game.

And of course, this was all possible because BSG allowed HTTP requests to their backend server, but the game client uses HTTPS. I don't know about current situation. If BSG rejects HTTP, it will be harder to pretend that your bot is a client.

[mikkel-kaj]

It all started when I read some information about how other people reverse EFT's protocol on https://www.unknowncheats.me/

I don't mean to sound lost, but do you have some good sources in there, where they talk about it?

EFT server didn't set "deflate" header in responses, so you need to insert this - https://pastebin.com/XiCd9aLV in Fiddler script

Here from a quick google, I can see that deflate is a compression technique, so why was that important for this project, or for the response?

Finally, you're saying that we can only do this because it accepts HTTP, but I imagine that there is a python library out there that will allow us to send HTTPS requests - so what would the issue be here?

[Kurt212]

I don't mean to sound lost, but do you have some good sources in there, where they talk about it?

This sub forum - https://www.unknowncheats.me/forum/escape-from-tarkov/
For example:
https://www.unknowncheats.me/forum/escape-from-tarkov/307996-flea-tarkov-api.html

I've seen that people from unknowncheats developed a custom version of EFT backend server - https://github.com/justemutarkov/EmuTarkov-Server. And I advise you to research it to study protocol.

Also there was an old project FenceKiller https://www.unknowncheats.me/forum/escape-from-tarkov/291434-fencekiller.html. It helped me a lot, because I started when there wasn't quite much information. FenceKiller has a cool feature - it handles hardware authorisation, when EFT sends a code to your email so you can prove that this is your computer.

Here from a quick google, I can see that deflate is a compression technique, so why was that important for this project, or for the response?

That's not important for project at all :) Without that header Fiddler could not decode messages, because it did not know that messages were compressed.

Finally, you're saying that we can only do this because it accepts HTTP, but I imagine that there is a python library out there that will allow us to send HTTPS requests - so what would the issue be here?

Well, as you know, HTTPS uses encryption. I am not that much of an expert, but I believe that if BSG uses some magic with custom certificates, it would be harder to pretend that you are a client. Still that doesn't save BSG from bots, but it makes things a little bit more complicated.

[perryh]

@Kurt212 Thanks for sharing!

[devolution2409]

Hello there, sorry to bump this semi old thread. I have a couples questions, i'm trying understand the interaction between deflate, zlib and the login request.
Basically, i just want to create a bot to crawl the market and get an historisation of trades.

Thing is, i'm not even able tto send a correct post request to the login endpoint, i'm trying with axios, with the following: (don't mind the taxonomy stuff etc, it's just code adapted from fence killer source, even tho some of it might be useless)

  static SendPost(url: string, args: LoginController): void {
//creating custom axios object with transform-request function, 
//user-agent and content-type
    let customRequest = axios.create({
      baseURL: url,
      headers: {
        'Content-Type': 'application/json;charset=utf-8',
        'User-Agent': '_',
      },

      // timeout: this.client.timeout,
      // transformRequest: [(data) => {
      //   return JSON.stringify(data);
      // }],
      responseType: 'json',
      transformRequest: [function(data, headers) {
        // Do whatever you want to transform the data
        return RequestController.CompressData(JSON.stringify(data));
      }],
    });

// args.toJson() should be then passed to transformRequest
    customRequest.post(url, args.toJson())
        .then(function(response) {
          // onsole.log(`Encoded response:\n${response} \n`);
          console.log((response));
        })
        .catch(function(error) {
          console.log(error);
        });
  }

CompressData is defined as the following:

  static CompressData(input: string): string {
    // TODO: do i need base64?
    let deflated: string = zlib.deflateSync(input).toString('base64');
    // let deflated: string = zlib.deflateRawSync(input).toString();
    return deflated;
  }

Finally, loginController() is just basically a structure with a GetJson() method:

class LoginController {
  email: string;
  password: string;
  version: GameVersion;
  deviceId: string;
  dev: boolean;


  constructor() {
    this.email = 'N/A';
    this.password = 'N/A';
    this.version = new GameVersion();
    this.deviceId = 'N/A';
    this.dev = true;
  }
  /**
   * Return json 'object' corresponding to this instance
   */
  // TODO: finish this hsit
  toJson(): object {
    return ({
      email: this.email,
      password: this.password,
      deviceId: this.deviceId,
      version: this.version.toJson()
    });
  }
}

Tl;dr on my code tho, if you want to help but can't be hassle reading it ;)

• I don't know if the Content-Type is correct

• I don't know if i should set any

• nor do i know if only the body of the request should be deflated.
  I noticed you used the compress() method of zlib, but node doesnt provide this one hence why i used deflate.
  I'm also unsure about that base64 stuff, i tried with and without, and got the same error

• last but not least i have no idea how to find the deviceID

Which ever request i ran, i get a nice json with a 403 error:
{
"http code": "403",
"message": "Access forbidden by server."
}

UUh yeah sorry about the long post, but if any of you are still around and wanna help, that'd be really nice of you :)

[Kurt212]

Hello, first of all I would recomend to take a look at https://github.com/dank/tarkov

I am not sure about what is the analogue for zlib.compress in JS, so I can not help you with that

And for all other question - try to intercept the protocol yourself. From there you can see if there is a content type and get your device ID

[devolution2409]

well, if i try to use Fiddler to decode packet and requests, the launcher can't connect to anything and keeps thtrowing error :(

[Kurt212]

That means you failed to set up fiddler. Try to find a info about it on forums

[devolution2409]

ah alright, i'll check it out then :)

[leegarrett]

Is there still a way to intercept the traffic? AFAICS the eft game client uses certificate pinning, as it resets any connection attempts to the mitm proxy. Importing the CA does not make a difference.

[paullyFIRE]

@leegarrett - did you ever figure it out?

[leegarrett]

@leegarrett - did you ever figure it out?

@paullyFIRE Unfortunately I didn't. I'm guessing an old version of the client that doesn't have certificate pinning can still be used, but I don't have a copy.