EFT packet sniffing

eft-packet-sniffer.md

Packet sniffing

By Senko-san, credits to CWX for finding the updated request/response code.

Requirements

• de4dot
• dnspy

Deobfuscation

1. dnspy > file > open > Assembly-CSharp.dll
2. dnspy > file > export to project > export
3. vscode > file > open folder > the exported source folder
4. vscode > search > AppDomain.CurrentDomain.GetData, the method looks like this:

internal sealed class Class2378
{
	// Token: 0x06010B9C RID: 68508 RVA: 0x0014A3A2 File Offset: 0x001485A2
	public static string smethod_0(int int_0)
	{
		return (string)((Hashtable)AppDomain.CurrentDomain.GetData(Class2378.string_0))[int_0];
	}
}

5. de4dot > clean the assembly (change 0x06010B9C to the token)

de4dot.exe --un-name "!^<>[a-z0-9]$&!^<>[a-z0-9]__.*$&![A-Z][A-Z]\$<>.*$&^[a-zA-Z_<{$][a-zA-Z_0-9<>{}$.`-]*$" "Assembly-CSharp.dll" --strtyp delegate --strtok 0x06010B9C
pause

Fix ResolutionScope error

1. copy-paste Assembly-CSharp-cleaned.dll into <gamedir>/EscapeFromTarkov_Data/Managed/
2. dnspy > file > open > Assembly-CSharp-cleaned.dll
3. dnspy > file > save module > ok

Modifications

These are done in dnspy on Assembly-CSharp-cleaned.dll

Save requests / responses

1. search for backRequest
2. modify method_5; add this to the bottom, just before return text2;

var uri = new Uri(backRequest.MainURLFull);
var path = (System.IO.Directory.GetCurrentDirectory() + "\\HTTP_DATA\\").Replace("\\\\", "\\");
var file = uri.LocalPath.Replace('/', '.').Remove(0, 1);
var time = DateTime.Now.ToString("yyyy-MM-dd_HH-mm-ss");

if (System.IO.Directory.CreateDirectory(path).Exists)
{
    if (backRequest.Params != null)
    {
        System.IO.File.WriteAllText($@"{path}req.{file}_{time}.json", backRequest.Params.ToJson());
    }

    System.IO.File.WriteAllText($@"{path}resp.{file}_{time}.json", text2);
}

BattlEye

1. search for RunValidation
2. replace RunValidation's method body with this:

this.Succeed = true;

File integrity

1. search for RunFilesChecking
2. replace RunFIlesChecking's method body with this:

return Task.CompletedTask;