peterson:~/re/brawl-stars-offline$

Reverse Engineering - Making Brawl Stars offline

IMPORTANT NOTICE: This article is written for educational purposes only. It is unofficial and NOT intended to cause harm to Supercell or anyone in any way.

NOTE: I will not be providing the full code, but I will be providing the steps and the main idea behind it. I will also not be sharing some private tools that were used to accomplish some results, but you can dig your way without problems without them.

// some functions and variables were renamed for readability
__int64 createGameInstance()
{
    // ... ton of shit code that we don't need
    for ( i16 = 1; ; i16 = 2 )
    {
      v684 = i16;
      if ( i16 + 1 >= 3 )
        break;
      v682 = v674;
    }
    // more shit code...
    v595 = v115 + v106;
    v592 = v106;
    some_baddata_variable = 0x10000;
    return GameMain::getInstance();
}

Interceptor.replace(base.add(createGameMain),
    base.add(GameMain_getInstance));

// functions were renamed for readability.
// They might not be the same in the actual code.
__int64 __fastcall ServerConnection::update(__int64 result, long double a2)
{
    // some code...
LABEL_9:
    v7 = Messaging::hasConnectFailed(*(_QWORD *)(result + 8));
    if ( (v7 & 1) == 0 )
    {
        result = Messaging::isConnected(*(_QWORD *)(v3 + 8));
        if ( (result & 1) != 0 )
            {
                v15 = *(_QWORD *)(v3 + 8);
                *(_DWORD *)v3 = 9;
                // more code...
            }
    }
    // more code...
}

__int64 __fastcall Messaging::hasConnectFailed(__int64 a1)
{
  return *(unsigned __int8 *)(a1 + 464);
}

bool __fastcall Messaging::isConnected(__int64 a1)
{
  return *(_DWORD *)(a1 + 588) > 1u;
}

Interceptor.attach(base.add(ServerConnection_update), {
    onEnter(args) {
        args[0].add(8).readPointer().add(464).writeU8(0);
        args[0].add(8).readPointer().add(588).writeInt(2);
    },
});

const MessageManager_receiveMessage = new NativeFunction(base.add(...), "bool",
    ["pointer", "pointer"]);

const MessageManager_getInstance = function () {
    // this is the real address. I can't avoid putting it here, lol.
    return base.add(0xdeaed0).readPointer();
};

const operator_new = new NativeFunction(base.add(...), "pointer", ["int"]);
            
const createMessageByType = new NativeFunction(base.add(...), "pointer",
    ["int", "int"]);

Interceptor.replace(
    MessageManager_receiveMessage,
    new NativeCallback(
        function (messageManager, message) {
            MessageManager_receiveMessage(messageManager, message);
            return 1;
        },
        "uint8",
        ["pointer", "pointer"]
    )
);

// A simple patch for the recv function, since it does have a protection.
// you can find it by looking for "gum-js-loop"
Interceptor.replace(base.add(0x202044),
    new NativeCallback(function (a1, a2, a3) {
        return a2; // a2 is the size of the data to receive
    },
    "int",
    ["pointer", "int", "int"]
));

Interceptor.attach(base.add(MessageManager_sendMessage), {
    onEnter(args) {
        // ensure that state is always 5
        args[0].add(64).readPointer().add(588).writeInt(5);
    },
});

// and finally...
Interceptor.replace(
        base.add(Messaging_send),
        new NativeCallback(
            function (self, message) {
            // our logic here
            PiranhaMessage.destroyMessage(message);
            return 0;
        },
        "int",
        ["pointer", "pointer"]
    )
);

class PiranhaMessage {
    static getMessageType(message) {
        // simply calls PiranhaMessage::getMessageType
        // it is in the message vtable.
    }
        
    static getMessageLength(message) {
        // returns the length by calling getEncodingLength.
        // also in the vtable.
    }
        
    static getMessageBuffer(message) {
        // returns a pointer for the buffer
    }
        
    static destroyMessage(message) {
        // calls the message destructors using it's vtable
    }
}

// we also need the following function:
function sendOfflineMessage(id, payload) {

    let version = id == 20104 ? 1 : 0;

    let message = createMessageByType(0, id);
    message.add(8 /* the offset may be different in the version 
        you're using, so better checking it first. */).writeInt(version);
    message
        .add(2 * 8)
        .add(8 + 16)
        .writeInt(payload.length); // same applies to the above note.

    if (payload.length > 0) {
        let payload_ptr = operator_new(payload.length).writeByteArray(payload);
        message
            .add(2 * 8)
            .add(8 + 24)
            .writePointer(payload_ptr); // and the same... lol
    }

    let decode = new NativeFunction(
        message
            .readPointer()
            .add(3 * 8) // 3 * pointerSize, at least at the time of writing this
                // and specifically in v30.x
            .readPointer(),
        "void",
        ["pointer"]
    );
    decode(message);
    MessageManager_receiveMessage(MessageManager_getInstance(), message);
}

/*
    now there is a thing: createMessageByType expects a message factory argument
    we did set it above to 0 (NULL),
    but it won't really create the message as there is a check.
    you can just allocate the factory by yourself and pass it to the function.
    or do as I did, patch that check.
*/
Memory.patchCode(base.add(0x43be88), Process.pageSize, (code) => {
    const pcWriter = new Arm64Writer(code);
    pcWriter.putNop();
    pcWriter.putBranchAddress(base.add(0x43bed8));
    pcWriter.flush();
});

/*
    in v30.x, createMessageByType does not have a check for LoginOkMessage,
    thus it does not create it.
    I will create it using it's constructor address
    lower versions do have it in createMessageByType though.
    So if you are using a lower version, you can skip this step
*/
const LoginOkMessage_ctor = new NativeFunction(base.add(...), "pointer",
    ["pointer"]);

Interceptor.replace(
    base.add(Messaging_send),
    new NativeCallback(
        function (self, message) {
            let type = PiranhaMessage.getMessageType(message);
            /*
                since we are in offline, we do not really need to deal with encryption
                so we send LoginOkMessage and OwnHomeDataMessage without waiting for 
                LoginMessage, as it is not needed.
                (we update the state to 5 in the send function)
            */
            if (type == 10100) {
                let loginok = operator_new(0x170);
                LoginOkMessage_ctor(loginok);
                let hl = operator_new(8); // LogicLong, for player id
                hl.writeInt(0);
                hl.add(4).writeInt(1);
                loginok.add(136).writePointer(hl);
                hl = operator_new(8);
                hl.writeInt(0);
                hl.add(4).writeInt(1);
                loginok.add(144).writePointer(hl); // they are both destroyed,
                    // by LoginOkMessage::destruct
                MessageManager_receiveMessage(MessageManager_getInstance(), loginok);
                sendOwnHomeDataMessage();
            } // handle other types if you want to...
            PiranhaMessage.destroyMessage(message);
            return 0;
        },
        "int",
        ["pointer", "pointer"]
    )
);

function sendOwnHomeDataMessage() {
    // sending OwnHomeDataMessage by manually constructing it and setting fields,
    // would take a lot of time,
    // so I will just create it's payload and decode it as a server would do.
    let stream = new ByteStream();
    stream.writeVInt(0);
    stream.writeVInt(0);
    stream.writeVInt(0); // player trophies
    stream.writeVInt(0); // player highest trophies
    stream.writeVInt(0);
    // rest of the code ...
    sendOfflineMessage(24101, stream.bytes());
}

Memory.patchCode(base.add(MessageManager_sendKeepAliveMessage), Process.pageSize,
        (code) => {
    const pcWriter = new Arm64Writer(code);
    pcWriter.putRet();
    pcWriter.flush();
});