187 lines
7.2 KiB
Markdown
187 lines
7.2 KiB
Markdown
# Dumping game data from Escape From Tarkov
|
|
|
|
This guide covers everything you need to know to dump all the data you need from Escape From Tarkov.
|
|
|
|
> **Note**\
|
|
> It is highly recommended that you read the guide at least once before executing what's written here.**
|
|
|
|
* For sections related to dumping server data, see:
|
|
1. [Dumper](./#development/dump_data.md#dumper)
|
|
2. [Backup](./#development/dump_data.md#backup)
|
|
3. [Dumping server data](./#development/dump_data.md#dumping-server-data)
|
|
* For sections related to dumping asset data, see:
|
|
4. [Dumping asset data](./#development/dump_data.md#dumping-asset-data)
|
|
|
|
## Theory
|
|
|
|
The game uses HTTP-secured protocol (TLS 1.2) to obtain data from the server (mostly of it not related to a raid). While the game's security is lacking, it does still block conventional tools for packet capturing.
|
|
We also cannot just simply use altered assembly either, because the launcher does an integrity check.
|
|
|
|
The game, however, does not check for integrity.
|
|
|
|
As such, we can patch the assembly to bypass the security mechanisms in place to dump our data. To be more specific, we alter the BattleEye and certificate checking always return successfully. We also add logic for saving the data received from the server. We use the "swap exploit" by quickly replacing the assembly when the game starts to load our custom assembly.
|
|
|
|
To be able to make patches, we deobfuscate the assembly. But since [de4dot](https://github.com/de4dot/de4dot) isn't capable of understanding the obfuscation algorithm fully, we use an additional specialized deobfuscator command. In addition, we save the assembly in the gamefiles before making modifications to fix a resolutionscope error.
|
|
|
|
## Legend
|
|
|
|
**path** | **what** | **example**
|
|
------------ | ----------------------------- | ----------------------
|
|
`%gamedir%` | Escape From Tarkov (Live) | `C:/games/EFT/ (Live)`
|
|
|
|
## Requirements
|
|
|
|
* Escape From Tarkov (Live)
|
|
* [dnSpy-net472](https://github.com/dnSpy/dnSpy/releases/latest)
|
|
* [de4dot](https://dev.offline-tarkov.com/innohurrytocode/de4dot/releases)
|
|
* [AssetStudio](https://github.com/Perfare/AssetStudio/releases/latest)
|
|
|
|
## Dumper
|
|
|
|
1. Copy-paste `%gamedir%/EscapeFromTarkov_Data/Managed/Assembly-CSharp.dll` to your de4dot folder.
|
|
2. Drag `Assembly-CSharp.dll` on top of `de4ot-x64.exe`.
|
|
3. Open `Assembly-CSharp-cleaned.dll` in dnSpy.
|
|
4. Find the deobfuscation method (appendix 1.1).
|
|
5. Run the deobfuscate command with the token from the deobfuscation method (appendix 1.2).
|
|
6. Cut-paste `Assembly-CSharp-cleaned-cleaned.dll` to `%gamedir%/EscapeFromTarkov_Data/Managed/`.
|
|
7. Open `Assembly-CSharp-cleaned-cleaned.dll` in dnSpy.
|
|
8. dnSpy > File > Save Module.
|
|
9. Apply request dumper patch (appendix 1.3).
|
|
10. Apply response dumper patch (appendix 1.4).
|
|
11. Apply ssl patch (appendix 1.5).
|
|
12. Apply battleye patch (appendix 1.6).
|
|
13. dnSpy > File > Save Module.
|
|
|
|
## Backup
|
|
|
|
1. Create `%gamedir%/backup/`.
|
|
2. Copy-paste `Assembly-CSharp.dll` to `%gamedir%/backup/`.
|
|
3. Rename `Assembly-CSharp.dll` in `%gamedir%/backup/` to `Assembly-CSharp.dll.bak`.
|
|
4. Cut-paste `Assembly-CSharp-cleaned-cleaned.dll` to `%gamedir%/backup/`.
|
|
5. Rename `Assembly-CSharp-cleaned-cleaned.dll` in `%gamedir%/backup/` to `Assembly-CSharp.dll`.
|
|
|
|
## Dumping server data
|
|
|
|
1. Open Battlestate Games Launcher.
|
|
2. Battlestate Games Launcher > settings > close launcher when game starts.
|
|
3. Start the game.
|
|
4. Copy-paste `%gamedir%/backup/Assembly-CSharp.dll` to `%gamedir%/EscapeFromTarkov_Data/Managed/` when the launcher closes.
|
|
5. `%gamedir%/HTTP_DATA/` appears when you reached the main menu.
|
|
6. Dump the data (appendix 2).
|
|
7. Close the game.
|
|
8. Replace `Assembly-CSharp.dll` with the original assembly.
|
|
|
|
## Dumping asset data
|
|
|
|
1. Open AssetStudio.
|
|
2. AssetStudio > File > Load File > `%gamedir%/EscapeFromTarkov_Data/sharedassets2.assets`.
|
|
3. Switch from Scene Hierarchy to Asset List.
|
|
4. AssetStudio > Filter Type > what you look for (example: `TextAsset`).
|
|
5. Select the map files you want (example: `bigmap2`, `RezervBase6`).
|
|
6. AssetStudio > Export > Selected Assets.
|
|
|
|
## Conclusion
|
|
|
|
Congratulations, you've succesfully dumped Escape From Tarkov's data.
|
|
|
|
In order to use it in Aki's database, you have 2 options:
|
|
|
|
* Manually convert the data.
|
|
* Use a tool like `aki-analyzer` to convert the data into a format the server accepts.
|
|
|
|
The data does contain sensitive information such as you account id, so be careful whom you share it with. `aki-analyzer` strips out the sensitive information when it converts the data to the right format. And no, the data dumped from the game server cannot be uploaded back to the game server.
|
|
|
|
## Appendix 1: Code
|
|
|
|
All code is based on Escape From Tarkov 0.12.9.10519.
|
|
|
|
### 1.1. Deobfuscation method in assembly
|
|
|
|
```csharp
|
|
// Token: 0x0600CDDD RID: 52701 RVA: 0x00400CD0 File Offset: 0x003FEED0
|
|
Class2045.smethod_0()
|
|
{
|
|
return (string)((Hashtable)AppDomain.CurrentDomain.GetData(Class2019.string_0))[int_0];
|
|
}
|
|
```
|
|
|
|
### 1.2. Deobfuscation command
|
|
|
|
```powershell
|
|
de4dot-x64.exe --un-name "!^<>[a-z0-9]$&!^<>[a-z0-9]__.*$&![A-Z][A-Z]\$<>.*$&^[a-zA-Z_<{$][a-zA-Z_0-9<>{}$.`-]*$" "Assembly-CSharp-cleaned.dll" --strtyp delegate --strtok 0x0600CDD7
|
|
```
|
|
|
|
### 1.3. Request dumper patch
|
|
|
|
```csharp
|
|
Class160.method_1()
|
|
{
|
|
// add this at the end
|
|
var uri = new Uri(url);
|
|
var path = (System.IO.Directory.GetCurrentDirectory() + "\\HTTP_DATA\\").Replace("\\\\", "\\");
|
|
var file = uri.LocalPath.Replace('/', '.').Remove(0, 1);
|
|
var time = DateTime.Now.ToString("yyyy-MM-dd_HH-mm-ss");
|
|
|
|
if (System.IO.Directory.CreateDirectory(path).Exists && obj != null)
|
|
{
|
|
System.IO.File.WriteAllText($@"{path}req.{file}_{time}.json", text);
|
|
}
|
|
}
|
|
```
|
|
|
|
### 1.4. Response dumper patch
|
|
|
|
```csharp
|
|
Class160.method_10()
|
|
{
|
|
// add this at the end, before "return value;"
|
|
var uri = new Uri(url);
|
|
var path = (System.IO.Directory.GetCurrentDirectory() + "\\HTTP_DATA\\").Replace("\\\\", "\\");
|
|
var file = uri.LocalPath.Replace('/', '.').Remove(0, 1);
|
|
var time = DateTime.Now.ToString("yyyy-MM-dd_HH-mm-ss");
|
|
|
|
if (System.IO.Directory.CreateDirectory(path).Exists)
|
|
{
|
|
System.IO.File.WriteAllText($@"{path}resp.{file}_{time}.json", value);
|
|
}
|
|
}
|
|
```
|
|
|
|
### 1.5. SSL cert patch
|
|
|
|
```csharp
|
|
Class511.ValidateCertificate()
|
|
{
|
|
// replace the method body content with this
|
|
return true;
|
|
}
|
|
```
|
|
|
|
### 1.6. Battleye patch
|
|
|
|
```csharp
|
|
Class797.RunValidation()
|
|
{
|
|
// replace the method body content with this
|
|
this.Succeed = true;
|
|
}
|
|
```
|
|
|
|
## Appendix 2: Obtaining specific data
|
|
|
|
This discusses how you can obtain certain data with the dumper installed.
|
|
|
|
**Type** | **How**
|
|
--------------- | -----------------------------------------------------------------------------------------------------
|
|
Startup locales | Start the game in the locale you want to dump.
|
|
Game locales | Select the locale in game settings.
|
|
Common data | Start the game.
|
|
Assort | Open the trader you want to dump from.
|
|
Bots | Do an offline raid on a map containing that bot.
|
|
Item events | Do the specifiic item event.
|
|
Images | Open the menu containing the image, it's dumped to `%TEMP%\Battlestate Games\EscapeFromTarkov\files`.
|
|
Location (loot) | Rip from game files.
|
|
Models | Rip from game files.
|
|
Textures | Rip from game files.
|
|
Audio | Rip from game files.
|