0
$\begingroup$

This question was originally asked on Reverse Engineering SE, but I felt that the main part of my question doesn't relate to RE directly, and it's more about a fundamental understanding of cryptography, hence why the original question has been removed and re-asked here.

I'm trying to analyze the UDP packets of a P2P game. I set up Wireshark and captured the traffic I'm interested in and saved it, and now the next step is to take a look at the game code since the UDP payload is not in plain text (Or at least, that's what it is from my perspective).

However, while I was checking the captured traffic, something caught my interest. Sequences of repeated bytes can be observed in most of the packets' payload, and they are pretty apparent with larger payloads.

Here are three examples of the captured UDP packets' payload (only the payload):

00000000  1B DA 10 39 3A 3B 88 FF 7B 6F BA 90 15 9B 9B 9B  .Ú.9:;ˆÿ{oº..›››
00000010  9B 9A 9A 1E 1E 1B 1B 9B DF DF BA BA D7 D7 BE BE  ›šš....›ßߺº××¾¾
00000020  BE BE BE BE BE BE BE BE BE BE BE BE BE BE BE BE  ¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾
00000030  BE BE BE BE BE BE BE BE BE BE BE BE CE CE CE CE  ¾¾¾¾¾¾¾¾¾¾¾¾ÎÎÎÎ
00000040  CE CE CE CE CE CE CE CE CE CE CE CE CE CE CE CE  ÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎ
00000050  CE CE CE CE CE CE CE CE CE CE CE CE CE CE CE CE  ÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎ
00000060  CE CE CE CE CE CE CE CE CE CE CE CE CE CE CE CE  ÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎ
00000070  CE CE CE CE CE CE CE CE CE CE CE CE CE CE CE CE  ÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎ
00000080  CE CE CE CE CE CE CE CE CE CE CE CE CE CE CE CE  ÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎ
00000090  CE CE CE CE CE CE CE CE                          ÎÎÎÎÎÎÎÎ
00000000  A9 BD 6F A0 A3 A2 88 04 E3 62 D1 A6 22 36 36 36  ©½o £¢ˆ.ãbѦ"666
00000010  36 37 37 B3 B3 B6 B6 36 65 55 0D 3D 43 73 24 14  677³³¶¶6eU.=Cs$.
00000020  99 A9 EF DF DF DF DF DF DF EA E3 92 DC DC DC DC  ™©ïßßßßßßêã’ÜÜÜÜ
00000030  3C 08 01 70 3E 3E 3E 3E 1E 25 E1 28 3B 3B 3B 3B  <..p>>>>.%á(;;;;
00000040  B1 D6 4C 73 73 73 73 73 73 73 73 73 73 73 73 73  ±ÖLsssssssssssss
00000050  73 73 73 73 E4 DB D2 92 92 92 92 92 92 92 92 92  ssssäÛÒ’’’’’’’’’
00000060  92 92 92 92 92 92 92 92 3A 3A BA 05 05 05 85 3A  ’’’’’’’’::º...…:
00000070  3A 3A 3A 3A 3A 3A 3A 3A E0 2D E1 5C 5C 5C 5C 5C  ::::::::à-á\\\\\
00000080  1B 4D 2B 15 A2 A3 A5 1B E9 C4 B3 8C 8C 8C 8C 8C  .M+.¢£¥.éijŒŒŒŒŒ
00000090  D5 00 E9 5C 65 CB B6 89                          Õ.é\e˶‰
00000000  44 DF 30 48 4C 4E FD 8A 0E 1A CF E5 60 EE EE E7  Dß0HLNýŠ..Ïå`îîç
00000010  F9 F9 F9 F7 4E 4E 51 51 51                       ùùù÷NNQQQ

Now the question is: Is it safe to rule out compression and encryption given those sequences of repeated bytes?

It's possible that some sort of a cipher is used here (like a XOR cipher) but I can't see an actual encryption or compression is taking place.

Is my initial assumption right? If not, how can I better judge such contents in the future (contents with sequences of repeated bytes)?

$\endgroup$
1
  • 1
    $\begingroup$ AEAD schemes may result in the output including "associated data" which would not be encrypted, and a nonce which may not look random (because it only has to be used no more than once, and does not need to be random). $\endgroup$
    – knaccc
    Sep 2, 2022 at 3:46

1 Answer 1

2
$\begingroup$

Is it safe to rule out compression and encryption given those sequences of repeated bytes?

It is safe to rule out that the highly repetitive part of the packet carries a compressed or encrypted payload: this kind of data has probability to contain a repetition of length at least $n$ bytes that decreases roughly as $p=2^{8-8n}\,(\ell-n+1)$ where $\ell$ is the total length. For the first frame $n=92$, $l=152$, thus $p<2^{-722}$ and we are way into the realm of certainty.

However it can't be ruled out that part of these sequences is compressed or encrypted. What we see could be the result of lazy programming, where it's sent a buffer of fixed size with the start carrying the payload and the end left undetermined by the programmer, perhaps with whatever was in the stack as a result of manipulating highly repetitive data, like a bitmap.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.