Difference between revisions of "Network protocol (Worms Armageddon)"

Latest revision as of 22:05, 16 April 2022

General

• Sizes and offsets are in bytes
• All offsets are from the start of the packet's data
• Word size = 2 bytes
• DWord size = 4 bytes
• Everything is LSB on the wire (Little Endian)

Is it possible to write a bot?

It surely is. However the bot doesn't have access to very much information. It cannot tell who won or lost for example. The game relies on all of the clients performing identical simulations. So nothing other than what you get in a replay file is transmitted for each turn. This excludes any win/or loss data or anything like that. Your bot could spectate games, chat, and perform all the lobby actions and that's about it on its own. A bot could hook into the actual game, but doing so without informing other players is the difference between writing your own AI and cheating with an aimbot.

A minimal client with a readline command interface is available here https://github.com/giannitedesco/wabs under the terms of the GPLv3.

Message header

Length: 6

For in-game messages where the second byte is set to 2, the structure is slightly different.

Length:9

Packet Commands List

Chat Message

Just a String, 00 Terminated.

Type:FromNick:ToNick:Text

Differents Types

Normal Message : GLB

Private Message : PRV

System Message : SYS

Notes :

- ToNick is often set to "ALL" to be sent to everyone (doesn't work for whispers)

- When X types /me Text, it sends this : SYS:X:ALL:X Text

- For systems messages, FromNick can be null, since it's not shown

Join

Joining consists of several steps:

Step 1

• Nick at 06, null terminated, ends (last place the null could be) at 22.
• Gameid (ascii) at 23, null string for IP games.
• Version at 64, composed of 30 24 F4 (hex)

NB : these 3 parameters are sufficient to enter a game. Everything else can be 0 and it's ok. Figure out what follows.

Step 2

Acknowledgement. Empty message. Figure out error messages. (different commands?)

Step 3

• Nick at 06, null terminated.
• Flag (+1) at 72 (if 13 is France, then to put French flag, you have to put 13+1 = 0x0E)

Figure out what follows.

Step 4

Server sends:

• Player list, see below.
• Team list (when not empty), see below.
• Map data, see below. (Map is not sent when we rejoin?)
• A message with command 0x001f? What is it?

Figure out how the scheme is sent here when it's not the default Intermediate

Player list

This looks like it's sending a raw array of player structures. Each player structure is 120 bytes in size.

Names are limited to 17 characters, and are padded with 0 bytes. (If a name is exactly 17 characters, there will NOT be a null-terminator) Figure out what the rest is.

There are 6 bytes of unknown, followed by 7 player structs. The structure for each player is:

After that, there is 520 bytes unknown, a 16 byte integer with the total number of valid players and then 2 bytes unknown.

Team list

The structure here is subtly different to the WGT format. Furthermore the #Add Team message is completely different again. And reverse engineering that is complicated by the fact that the game doesn't appear to scrub the unused bytes in the structure to zero. So it leaks some random heap or stack that way.

Custom Scheme data

Default Scheme data

If you put 0 as Scheme Identifier, it will crash the game. Any other number that doesn't appear in the list will put Intermediate.

Changing Scheme data

Ready signal

Starting Game

After this, we switch to type-2 packets documented above. All players send loading status reports up to frame number 0x1b. The report for 0x1b contains some sort of magic which is presumably a sort of checksum on the game logic such as worm placement and map generation. If it's not correct then the game notifies of invalid data and won't let the game start. Best bet is to listen for one player to finish and echo his magic number back.

Here is an example of what is received when 2 other players are in the game:

Frame: player=0 frame=0x00000001 len=4
| 00000 : ....              c0 0a 00 00
Frame: player=0 frame=0x00000002 len=4
| 00000 : ....              c0 0a 04 00
Frame: player=2 frame=0x00000001 len=4
| 00000 : ....              c0 0a 00 00
Frame: player=2 frame=0x00000002 len=4
| 00000 : ....              c0 0a 04 00
Frame: player=2 frame=0x00000003 len=4
| 00000 : ....              c0 0a 08 00
Frame: player=0 frame=0x00000003 len=4
| 00000 : ....              c0 0a 08 00
Frame: player=0 frame=0x00000004 len=4
| 00000 : ....              c0 0a 0c 00

Frame: player=0 frame=0x0000001a len=4
| 00000 : ..d.              c0 0a 64 00
Frame: player=2 frame=0x0000001a len=4
| 00000 : ..d.              c0 0a 64 00
Frame: player=2 frame=0x0200001b len=7
| 00000 : @.GQ{7.           40 09 47 51 7b 37 00
Frame: player=0 frame=0x0200001b len=7
| 00000 : @.GQ{7.           40 09 47 51 7b 37 00

Map

Note : A DWord is put at the beginning of the File to tell what type of Map is sent.

1 = .BIT Monochrome map (.bit, .lev)

2 = .LEV Monochrome map (.bit, .lev)

3 = .PNG Colour map

Exemple of a multi-packeted BIT-file (135434(0x34DE)bytes file):

<01 48 1414 2B00> <A2 01 [E2 34 00 00] [00 00 00 00] [00 14 00 00]> [ 01 00 00 00 { .BIT file DATA } ]

<01 48 1414 2B00> <A2 01 [E2 34 00 00] [00 14 00 00] [00 14 00 00]> [ { .BIT file DATA } ]

<01 9C F60C 2B00> <A5 01 [E2 34 00 00] [00 28 00 00] [E2 0C 00 00]> [ { .BIT file DATA } ]