Reading an Undocumented Game Protocol Off the Wire: A Guided Dissection

Merune Fleur — Thu, 22 Oct 2026 02:51:18 +0000

Every multiplayer game speaks a protocol nobody documented for you. Deriving it from raw packets is one of the most useful skills in game modding, private-server development and network tooling — and there is almost no honest practice material for it. Malware and crackmes, sure. A real game protocol, laid out to be learned from? Not really.

So I built one. DRIFTLIGHT is a tiny UDP arena game written for a single purpose: to be reverse engineered. Stripped client and server binaries, a recorded session of 1,976 packets, and zero documentation. This article walks the first steps of dissecting it — the same steps Lab 1 of the pack guides you through.

The first packet

Here is a real frame from the capture, a client introducing itself:

11 7a 1f d2 01 01 01 00 0a 00 06 00 53 43 52 49 42 45 c6 68

Four bytes repeat at the start of nearly every packet in the capture: 11 7a 1f d2. That is a magic number — written little-endian, 0xD21F7A11. After it, a version byte (01) and a byte that takes only ten distinct values across the whole capture. Ten values, in a game protocol, means a message-type field: an opcode. This frame is type 1, and the ASCII hiding near the end (SCRIBE, the player's name) tells you what type 1 is for.

The length that lies (a little)

Two bytes after the opcode read 0a 00 — ten, little-endian. The payload that follows is indeed ten bytes. But count the whole UDP payload and you get 28 bytes, not 24: the length field counts the payload only, and the difference — 14 — is the frame around it: magic, version, opcode, a sequence number, the length itself, and a 2-byte trailer at the very end that changes with every packet and validates nothing yet. You derived the header size by subtraction, without a single line of documentation.

A census, not a guess

Group all 1,976 packets by their opcode byte and a picture emerges: one type is ~75% of all traffic and appears exactly 20 times per second (world snapshots), two types pair up as request/response, one carries the player names, one appears exactly once per player at the start. Frequency and timing alone reconstruct most of the architecture before you decode a single payload.

Your turn

Lab 1 is free: the full guided dissection, the binaries, the capture, and a final exercise where you write a working Wireshark dissector in Lua.

👉 https://solana63.gumroad.com/l/driftlight-lab1

The full pack (Labs 2–5) continues from there: recovering the trailer's CRC parameters black-box, breaking the chat's session-key obfuscation, Ghidra and Frida on the stripped client, and reimplementing the client in Python against the real server. It's on early-bird pre-order for $29 — and if the pack doesn't ship, every pre-order is refunded automatically.

Details: https://merunefleuruwu.github.io/driftlight/

Everything in DRIFTLIGHT is my own code, written as a legal, safe target. The techniques are the real ones; the playground is honest.

DEV Community: Merune Fleur

Reading an Undocumented Game Protocol Off the Wire: A Guided Dissection

The first packet

The length that lies (a little)

A census, not a guess

Your turn