Hey ,
First off, massive respect for what you've put together here. Getting
any real traction on PES2021's ConnectGate — mapping out the XOR ->
Blowfish -> MD5 -> MessagePack layering, actually getting a client
into a server list — is genuinely impressive work, especially doing
it solo/small-team on a completely undocumented proprietary protocol.
This thread has honestly been the single most useful reference I've
found anywhere for this kind of project.
I'm just starting a similar effort on PES2018 (PC), and while I know
it's a different game with its own protocol quirks, it's the same
Fox Engine generation, so I'm hoping some of what you figured out
carries over at least structurally, even if the specific keys/framing
differ.
Quick summary of where I am so far: redirected the real game domains
via hosts (pes18-pc-gate.cs.konami.net, pes18-pc-stun.cs.konami.net,
ntl.service.konami.net + regional variants), set up a local capture
server, and got this far:
- STUN on UDP 3478: standard RFC 5389 Binding Request/Response (magic
cookie present). I implemented a proper Binding Response and the
client accepts it, then sends periodic Binding Requests (~every 5s)
with two vendor attributes (type 0x9090, 24 bytes; type 0x9091,
12 bytes with what looks like an incrementing counter).
- An HTTP endpoint, POST /ntl/api/GateInfo.php over plain HTTP (no
encryption), with a hex-encoded JSON body:
{"titleCode":"PES2018","locale":"EU","version":"1.05.00","extra":"",
"apiLevel":"3"}. Still haven't cracked the expected response format
— tried a few plausible JSON shapes, none stopped the client from
resetting the connection after ~3s.
- The client then connects to TCP port 10000 (the real gate) and
sends a 152-byte payload. Structurally consistent with an 8-byte
block cipher (152 = 19 blocks exactly), entropy ~6.75 bits/byte, no
repeated blocks — but that's as far as traffic analysis alone got
me. No luck with XOR key-length detection either.
That last part is basically the same wall you must have hit with
ConnectGate, so I wanted to ask, only if you have the time and don't
mind revisiting it:
1. How did you actually locate the Blowfish key inside the binary?
Searching for the standard P-array signature (the pi-digit
constants) to find the key-schedule function, or more of a dynamic
approach — breakpointing the encrypt call in a debugger, etc.?
2. Did PES2021 have an equivalent to GateInfo.php — a plaintext HTTP
pre-check before the encrypted gate connection? If so, any memory
of what a valid response looked like?
3. Any tips on how you found the XOR transport-layer key (the one
applied before Blowfish)? Static or dynamic analysis?
4. Did you see those same vendor STUN attribute types (0x9090/0x9091)
in PES2021 traffic? If that part of the code is shared across
engine versions it'd be a nice anchor point.
5. What tools ended up being most useful for you day to day — Ghidra,
IDA, x64dbg for runtime breakpoints, or a mix? Would rather not
reinvent a workflow you already found didn't work.
Totally understand if this is more than you want to dig back into —
even just a pointer to which part of your writeup/repo covers this
would already help a ton. Either way, thank you for documenting all
of this publicly. It's already saved me from a few dead ends, and
projects like this are why stuff like this doesn't just disappear
when the official servers go dark.
