#vhsre — Public Fediverse posts

VHS has been shut down it seems. And I'm missing critical info to make it work in custom games... I didn't capture enough data.

#VHSRE

Ok so a lot of things have happened since last time.

I was contacted by a group who had the same goal I do so we joined forces and got faster than I was doing on my own

I now have a working alternative server. It supports the bare minimum. Logging in and playing with bots but hey it is something after all. And it plats with the EOS emulator which means this will work even if EOS closes :3

From the technical point not much has been discovered although now I have clearer knowledge of what does each actor do in this game. VHSGame "main" servers handles login, savegames and queue status. It aids in custom lobbies by generating and maintaing room codes. But the lobby themselves and the players' connection are actually handled by Epic Online Services

VHSGame has auxiliary serves. One for matchmaking and another with a Websocket (purpose unknown)

But I can proudly say I have a MVP now ^^

#VHSRE

More information

As expected the Anti Cheat issue wasn't that easy. The game crashes if EAC environment is not properly set. So I have to look into Easy AntiCheat emulators but that complicates things as now I have to be careful as for not getting banned (although game is free but I don't want to make another account 🥴)


That being said I'm already working in the replacement server. I've also done more network captures. It seems like different actions (changing cosmetics, changing weapons) have their own endpoints instead of being s generic "patch saveGame" endpoint

#VHSRE

I've made further progress.

The VHS server as far as I've gathered handles a second/third login mechanism for the game. The Client uses a Epic-issued OAuth token to login into VHS Servers, which return a new OAuth token. This token will be used for all communications with VHS Server going on.

This VHS server is responsible for SaveGame management, store items, account settings, global settings, queue status, basically everything except lobby management which is done by Epic Online Services. Right now I've only captured the main savegame download. An almost 29k lines JSON which handles all the data.

My next step is going to be getting more network captures. Trying to trigger savegame modifications (like cosmetic changes) to see how the game is reporting these changes.

Once I have this sorted I think I'm in a good position to start making the alternative server. I've already generated typings for all known network operations (the server is going to be written in Typescript)

#VHSRE

Fortunately. The game doesn't use Certificate Pinning so MITMProxy did the job.

I still have to analyze the data but I can confirm it's making HTTPS and websocket Requests to vhsthegame.com

These requests seem to provide login features to the game so it's time to RE them.

But first I'll have something to eat, it's launch time

#VHSRE

So. First we have two (three?) things we need to fight.

1. #EasyAntiCheat
2. #EpicOnlineServices, as at first sight it seems it uses it for matchmaking porpuses?
¿3?. Savegame server? Savegame is cloud stored AFAIK, so maybe they're using a custom solution in this one

# 1. EAC
Easy Anti Cheat games usually have a bootstrap exe which sets EAC and launchs the payload exe which contains the game. In VHS case it seems launching the payload exe directly works. Since it doesn't seem to actually check if EAC is properly set? (weird)

2. EOS
Fortunately, someone has made an emulator for EOS so we're covered in that point. Launching with the emulator right now gives either a generic connection error or a "Cloudrun error" whethever that means, I'll leave that hanging for now.

3.
Right now I'm try going to try and do something about Nº3 and MITM myself to check what is the game doing with the savegame. The only thing I know right now is that it's talking with an AWS server

#VHSRE

I'm going to document my process, as someone who knows nothing about reverse engineer, trying to make an offline play patch for #VideoHorrorSociety

I'll tag them #VHSRE in case you wanna mute them or something IDK

I'm going to document my process, as someone who knows nothing about reverse engineer, trying to make an offline play patch for #VideoHorrorSociety

I'll tag them #VHSRE in case you wanna mute them or something IDK