Differences for web version? #18

htrendafilov · 2021-02-25T12:18:59Z

htrendafilov
Feb 25, 2021

Hello,
... and thank You for sharing this project. I have been looking for something like that, but was lazy to look at the calls myself.

Just wanted to ask if you accidentally looked what are the differences needed to work with the web version?

The log-in handling will be somehow different but after that the API looks the same in first glance

POST /api/ HTTP/1.1
Host: heroes-wb.nextersglobal.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Request-Id: 1
X-Auth-Network-Ident: web
X-Auth-Application-Id: 3
X-Auth-Session-Id: XXXXXXXXXXXXXXX
X-Auth-User-Id: XXXXXXXX
X-Auth-Session-Key: 
X-Env-Library-Version: 1
X-Requested-With: XMLHttpRequest
X-Server-Time: 0
X-Auth-Session-Init: 1
X-Auth-Signature: 835459e146bf3ed984e647b26dbc51d3
X-Auth-Token: XXXXXXXXXXXXXXXXXXXXXXXXXXXX
Content-Type: application/json; charset=UTF-8
Content-Length: 113
Origin: https://hero-wars.com
Connection: keep-alive
Referer: https://hero-wars.com/

So it looks like if you have:

X-Auth-Session-Id: XXXXXXXXXXXXXXX
X-Auth-User-Id: XXXXXXXX
X-Auth-Signature: ????
X-Auth-Token: XXXXXXXXXXXXXXXXXXXXXXXXXXXX

You can call the API.

Have you or some friend tried this?

Thanks in advance,
Hristo

Answered by eigenein

Feb 25, 2021

Hi Hristo,

Frankly, I've never looked at the web version. The request you posted looks very much similar. It's likely that the bot would work if you adjust X-Auth-Network-Ident (constant), X-Auth-Application-Id (constant), X-Auth-Token, and X-Auth-Signature.

I've taken a quick look and found X-Auth-Token as auth_key in the server response from https://hero-wars.com/:

    <body>
        <script>
    window.NXFlashVars = { …

X-Auth-Signature is going to be the most challenging. I don't really have time to reverse it right now, but I've found a starting point. In heroes.js you can find the following:

a=xNa.bGf(a);b["X-Auth-Signature"]=a;

I'd start by reversing the xNa.bGf function to find ou…

View full answer

eigenein · 2021-02-25T12:39:27Z

eigenein
Feb 25, 2021
Maintainer

Hi Hristo,

Frankly, I've never looked at the web version. The request you posted looks very much similar. It's likely that the bot would work if you adjust X-Auth-Network-Ident (constant), X-Auth-Application-Id (constant), X-Auth-Token, and X-Auth-Signature.

I've taken a quick look and found X-Auth-Token as auth_key in the server response from https://hero-wars.com/:

    <body>
        <script>
    window.NXFlashVars = { …

X-Auth-Signature is going to be the most challenging. I don't really have time to reverse it right now, but I've found a starting point. In heroes.js you can find the following:

a=xNa.bGf(a);b["X-Auth-Signature"]=a;

I'd start by reversing the xNa.bGf function to find out which fields and in which order are used to make signature. My assumption is that the following concatenation and hashing are the same, they're probably transpiled from the same Haxe code.

3 replies

htrendafilov Feb 26, 2021
Author

Just my 2 cents, as I'm not sure when will I find some more time to try it.

from these headers + the auth_token it constructs colon separated string like that:

130:ps-EGULXBudcADMhTJFZKCVIPYmeSrWlvzRsOxjnH/+qaQpki-1614327560-213.61.69.130-3b55656dcb26a7b430f538c31801c17f:0qp4n4l0ymq62z:{"calls":[{"name":"dungeonGetInfo","args":{},"ident":"body"}]}:LIBRARY-VERSION=1

Which is fact:

X-Request-Id
token
X-Auth-Session-Id
The call json body itself
LIBRARY-VERSION=1

...and makes simple MD5 sum to this string.

The only question is if X-Request-Id matters :) Can I pass a constant or I should increase it and if I should increase it when it stats back from the beggining.

As I said ... just my 2 cents :)

eigenein Feb 26, 2021
Maintainer

For now it looks like it constructs X-Auth-Signature in exactly the same way as I do:

bestmobabot/bestmobabot/api.py

Lines 258 to 274 in 77787b9

    
           def sign_request(data: str, headers: dict) -> str: 
        
               fingerprint = ''.join( 
        
                   f'{key}={value}' 
        
                   for key, value in sorted( 
        
                       (key[6:].upper(), value) 
        
                       for key, value in headers.items() 
        
                       if key.startswith('X-Env') 
        
                   ) 
        
               ) 
        
               data = ':'.join(( 
        
                   headers['X-Request-Id'], 
        
                   headers['X-Auth-Token'], 
        
                   headers['X-Auth-Session-Id'], 
        
                   data, 
        
                   fingerprint, 
        
               )).encode('utf-8') 
        
               return hashlib.md5(data).hexdigest()

LIBRARY-VERSION=1 comes from the X-Env-Library-Version: 1 header and the rest is as you've described.

Which makes sense, because the original code for all environments is most likely written in Haxe (I reversed the flash version in the old times) and then compiled to a target platform. Try to call sign_request function manually from a Python shell and verify it returns the same hash.

As for X-Request-Id, I'm not completely sure. Just to be safe I've replicated the game client behaviour. I start it from 1 every time I initialize a new session and then increment it with every call.

For now everything looks like you can simply adjust the constants (app ID, network ident, host name, etc) and run the bot "as is" 🙂

htrendafilov Mar 1, 2021
Author

I can confirm it works out of the box, all you need to tweak is the login handling, which is in fact a json payload with user/pass posted to https://hero-wars.com/login which ... returns 204 but sets the cookie needed. So load hero-wars.com, post to login - get 204, reload hero-wars.com ... and you have window.NXFlashVars which you need for auth_token.

And because in web you can play on more than 1 server, you need also to set 'X-Auth-Player-Id', except 'X-Auth-User-Id'

What I found playing in the IPython shell (note: I never played VK/Facebook versions to know the differences from web):

Arena solver does not count pets at all, probably VK does not have pets which is much simpler, or I made something wrong.
skipTower works pretty fine, except it's not making scull coins exchange and getting the tower coins reward. Do VK have such ?
Sending gifts wants friends list ... although my guild is pretty constant it happens someone to leave/join. Wondered why did you made it to ask for teammate ids instead of calling clanGetAvailableDailyGifts ?
You mentioned that the dungeon changes, they made, irritated you. I'm interested if you have ever tried to make also rides in "Tournament of the Elements" ?

And again, thanks for sharing the code ... it was much more interesting to play with the API requests than the game itself 😃

eigenein · 2021-03-01T20:00:55Z

eigenein
Mar 1, 2021
Maintainer

Arena solver does not count pets at all, probably VK does not have pets which is much simpler, or I made something wrong.

VK does have pets, but they've been introduced around the moment I've quitted the game, so I just never implemented them. :) Technically, they have their own hero IDs and are passed into attackArena just like heroes. Though, you'd need to take care of the limitation of 1 pet per team.

skipTower works pretty fine, except it's not making scull coins exchange and getting the tower coins reward. Do VK have such ?

I don't really recognise "scull coins exchange", perhaps in Russian they're named differently. But yeah, there was no any kind of exchange in my implementation, only collecting the goods. Getting the tower coins reward worked fine. Maybe they've changed something in the API, would need to debug this.

Sending gifts wants friends list ... although my guild is pretty constant it happens someone to leave/join. Wondered why did you made it to ask for teammate ids instead of calling clanGetAvailableDailyGifts ?

IIRC, I only wanted to send gifts to particular players. My guild should've not known I'm using the bot ;)

You mentioned that the dungeon changes, they made, irritated you.

Yep, though, I've heard from others, that people were still able to run the JS code from heroes.js in node.js, to simulate entire battles and pass correct data to "finish dungeon battle". Again, I've quitted the game very soon after that, so didn't went deeper. The problem was that in this call you had to pass exact battle results, so you had to be able to simulate the entire battle precisely. So, basically run a piece of the game code. I had this implemented at some moment, but then they've obfuscated everything and I didn't want to spend dozens of hours on reverse-engineering.

I'm interested if you have ever tried to make also rides in "Tournament of the Elements" ?

Nope, haven't even tried. So no idea how difficult (or easy) it is.

3 replies

AraHaan Dec 14, 2021

I wonder if anyone figured out how to get the user's emerald/gold count yet via the API? Well to duplicate basically what the browser extension does that is.

zqguang3708 Jan 10, 2022

Yep, though, I've heard from others, that people were still able to run the JS code from heroes.js in node.js, to simulate entire battles and pass correct data to "finish dungeon battle". Again, I've quitted the game very soon after that, so didn't went deeper. The problem was that in this call you had to pass exact battle results, so you had to be able to simulate the entire battle precisely. So, basically run a piece of the game code. I had this implemented at some moment, but then they've obfuscated everything and I didn't want to spend dozens of hours on reverse-engineering.

Does this mean that we can modify the battle results?

eigenein Jan 13, 2022
Maintainer

Does this mean that we can modify the battle results?

@zqguang3708 Probably, not. When I was experimenting with that, the server rejected any other results different from «ground truth». I assume they run the same battle on the server side to validate. Another evidence for that would be rare yet happening bug in the official client when you see an «incorrect battle result» modal window at the end of the battle.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Differences for web version? #18

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 6 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

Differences for web version? #18

htrendafilov Feb 25, 2021

Replies: 2 comments · 6 replies

eigenein Feb 25, 2021 Maintainer

htrendafilov Feb 26, 2021 Author

eigenein Feb 26, 2021 Maintainer

htrendafilov Mar 1, 2021 Author

eigenein Mar 1, 2021 Maintainer

AraHaan Dec 14, 2021

zqguang3708 Jan 10, 2022

eigenein Jan 13, 2022 Maintainer

htrendafilov
Feb 25, 2021

Replies: 2 comments 6 replies

eigenein
Feb 25, 2021
Maintainer

htrendafilov Feb 26, 2021
Author

eigenein Feb 26, 2021
Maintainer

htrendafilov Mar 1, 2021
Author

eigenein
Mar 1, 2021
Maintainer

eigenein Jan 13, 2022
Maintainer