1

I am starring at the following which looks like base64 but not quite:

t=base64.b64decode('gAKrEgADAAFwEgACAAFwEgACAAhmYWlybmVzcxIACQAGcmVzdWx0B0ANMzMzMzMzAAZudW1iZXIHQHdO+bLZGH8ACnNlZWRTSEEyNTYIAIBiYzBhYmQ1Y2M1MjYzNzM3MzdjNjZjNjgwZDY5ZDhlMTU0NmI5MmVjNDdkZjE3ZTdhZjJjMmNhYzU0NTIwN2MwNzQxNmM5Mjc4ZTMzNDcwNGRhM2IzOTJmMTY0NTZhZGE4MDRlOTM4OGUzZGUwMWRhZmE5MTI3OTQ5YzE1MGFkNwALcGxheWVyU2VlZHMRAAMSAAMABHNlZWQIABRUUDRNcXlWT2lKSENWdWJFZ2ZuTgAMcHJvZmlsZUltYWdlCAAJYXYtNDgucG5nAAh1c2VybmFtZQgADGFkcmlhbmFqdWN5MhIAAwAEc2VlZAgAFGtoNzVvU1M3Vll5cklIWlFZV1BrAAxwcm9maWxlSW1hZ2UIAAlhdi0yOS5wbmcACHVzZXJuYW1lCAAMMTk5N2x1Y2FzLm1hEgADAARzZWVkCAAUZmFsc0RVemUwSllBZnh6RE1pc2cADHByb2ZpbGVJbWFnZQgACWF2LTExLnBuZwAIdXNlcm5hbWUIAAtHZW5pdmFsMTk5NwAVcGFydFNlZWREZWNpbWFsTnVtYmVyBQALwKvVzFJjABFwYXJ0U2VlZEhleE51bWJlcggADWJjMGFiZDVjYzUyNjMADnJvdW5kU3RhcnREYXRlBQAAAYK0Fxp8AAdyb3VuZElkBQAAAAAAISp0AApzZXJ2ZXJTZWVkCAAoT0tZN3M5ZE5SMm1tNnNKTzJwaGVQcVVvbEtscEdHcTFXMFpVeXgycQAEY29kZQQAAADIAAFjCAAVcm91bmRGYWlybmVzc1Jlc3BvbnNlAAFhAwANAAFjAgE=')

It returns:

\x80\x02\xab\x12\x00\x03\x00\x01p\x12\x00\x02\x00\x01p\x12\x00\x02\x00\x08fairness\x12\x00\t\x00\x06result\x07@\r333333\x00\x06number\x07@wN\xf9\xb2\xd9\x18\x7f\x00\nseedSHA256\x08\x00\x80bc0abd5cc526373737c66c680d69d8e1546b92ec47df17e7af2c2cac545207c07416c9278e334704da3b392f16456ada804e9388e3de01dafa9127949c150ad7\x00\x0bplayerSeeds\x11\x00\x03\x12\x00\x03\x00\x04seed\x08\x00\x14TP4MqyVOiJHCVubEgfnN\x00\x0cprofileImage\x08\x00\tav-48.png\x00\x08username\x08\x00\x0cadrianajucy2\x12\x00\x03\x00\x04seed\x08\x00\x14kh75oSS7VYyrIHZQYWPk\x00\x0cprofileImage\x08\x00\tav-29.png\x00\x08username\x08\x00\x0c1997lucas.ma\x12\x00\x03\x00\x04seed\x08\x00\x14falsDUze0JYAfxzDMisg\x00\x0cprofileImage\x08\x00\tav-11.png\x00\x08username\x08\x00\x0bGenival1997\x00\x15partSeedDecimalNumber\x05\x00\x0b\xc0\xab\xd5\xccRc\x00\x11partSeedHexNumber\x08\x00\rbc0abd5cc5263\x00\x0eroundStartDate\x05\x00\x00\x01\x82\xb4\x17\x1a|\x00\x07roundId\x05\x00\x00\x00\x00\x00!*t\x00\nserverSeed\x08\x00(OKY7s9dNR2mm6sJO2phePqUolKlpGGq1W0ZUyx2q\x00\x04code\x04\x00\x00\x00\xc8\x00\x01c\x08\x00\x15roundFairnessResponse\x00\x01a\x03\x00\r\x00\x01c\x02\x01

Another example from the same source (websocket from https://1win.com.ci/casino/play/aviator):

t=base64.b64decode('gAB1EgADAAFwEgACAAFwEgAEAARjb2RlBAAAAMgADW1heE11bHRpcGxpZXIHP/HrhR64UewAB2VuZERhdGUFAAABgrP/Lk0AB3JvdW5kSWQFAAAAAAAhKioAAWMIAA5yb3VuZENoYXJ0SW5mbwABYQMADQABYwIB')

It returns:

'\x80\x00u\x12\x00\x03\x00\x01p\x12\x00\x02\x00\x01p\x12\x00\x04\x00\x04code\x04\x00\x00\x00\xc8\x00\rmaxMultiplier\x07?\xf1\xeb\x85\x1e\xb8Q\xec\x00\x07endDate\x05\x00\x00\x01\x82\xb3\xff.M\x00\x07roundId\x05\x00\x00\x00\x00\x00!**\x00\x01c\x08\x00\x0eroundChartInfo\x00\x01a\x03\x00\r\x00\x01c\x02\x01

We can see some words: "fairness", "result", "number", "partSeedDecimalNumber" etc but the message is incomplete.

What is the encoding used in this case?

montovaneli
  • 11
  • 1
  • 2
    Decoding base64 encoded information doesn't have to result in all ascii text. This looks like some game-specific data format. You would need to investigate the game to determine the data format, unless someone has already done so and published their findings. – Mega Tonnage Aug 19 '22 at 04:19
  • 6
    Not only that, base64 is frequently used exactly because you cant transfer binary data, but can transfer ASCII data. – Rok Tavčar Aug 19 '22 at 05:52
  • How did you determine that these messages are incomplete? – Michael Karcher Aug 19 '22 at 07:20
  • @MichaelKarcher the most important parts are missing like the round start date, round id (int), result (float) etc – montovaneli Aug 19 '22 at 14:02
  • 1
    @montovaneli You should use a real hex editor for looking at the decoded data, because I see roundStartDate and roundId as text in your posted output. – Robert Aug 19 '22 at 17:07
  • @Robert you are totally right. Using some manipulations and analyzing as big-endian I was able to got the result (float64)! Thanks! – montovaneli Aug 19 '22 at 19:47

0 Answers0