View source for Talk:BF2142 Statistics

== Note about EA and the AUTH key for stats-queries. ==


i asked John Hargelid about the AUTH section, here is what he said.

  S@tCoM zegt:
  Question : the 2142 stats queries are encrypted, is this encryption info that will be available to the public? ( http://bf2142tracker.com/ seemed to have the solution. )
  John Hargelid zegt:
  We yet have to find a solid way of allowing people to request data from GameSpy
  S@tCoM zegt:
  so does bftracker has a deal with EA ?
  John Hargelid zegt:
  no
  S@tCoM zegt:
  ok
 John Hargelid zegt:
 (at least not what I am aware of =)

So thats EA's definitive stand on the subject.
--[[User:Satcom|Satcom]] 07:02, 25 October 2006 (MDT)

== PID is included within auth ==

while playing around i found that bf2142 sent a request using only AUTH and it returned my current players details

== some basics about the auth ==

it does seem to be an base64 encode but it doesn't look like it.
minimum char for the auth is 3 and max is 27


ok. 
Based on Base64 the base64decoded value is 14 chars.
the PID is 8 chars.

  12345678901234 - fictional decoded auth
  44652121 - Gamespy PID
  ........?????? - Possible timestamp.

any suggestions?

== Version handling ==

All the discussions about the auth key etc.
If EA don't want us to access the game stat servers and done so much to avoid us being able to. They would have put in code that can/will be changed when new patches are out.
I believe there would be some information in this string that tell EA/GameSpy what version the client runs...?
Just a thought...

* they ''will'' change the auth token, that much I can confidently assure you.  Supposedly GameSpy/IGN will provide public feeds so that we don't have to keep cracking the new auth token each time the game is updated.  As I see it, they are limited as to what they can do though, either they provide a different url for each version of auth, or a new parameter name, or they change the underlying bits that make up the auth token (otherwise old clients' stats will not work).  Whatever it is (sorry Bill) machine code has to be shipped w/ the game and we can always find out whats going on to produce that (unless they move to a single sign on model <wink>)  --[[User:MadHatter|MadHatter]] 13:24, 3 November 2006 (MST)

== RE: Version ==

That very well may be the case.  There are 2 sections of the auth key that are static across all queries on accounts(for the most part).  These could be the version identifier.  But thats a pretty stupid way to attempt to block it, since we can just grab the auth key when the version changes and get the new number for the version.--[[User:Craigins|Craigins]] 21:35, 2 November 2006 (MST)

== History (Problems section from BF2142_Statistics article page) ==
Im having trouble trying to understand the 24-character '''auth''' parameter all of these functions seem to require. I know it represents your user account or player identity in some way but what confuses me is that each time Battlefield 2142 requests one of these functions a brand new auth string is generated. How is the auth string generated??? --[[User:Danielphin|Danielphin]] 01:11, 25 August 2006 (MDT)

same here, don't know how to solve the "problem" with the encypted auth-parameter :( --[[User:arnonuehm|arnonuehm]] 15:55, 10 September 2006 (CET)

Did Battlefield 2 ever have any '''auth''' parameter before or just after it was released? It could be possible this value is only required for the betas to keep the data private. To an extent. --[[User:Danielphin|Danielphin]] 07:00, 11 September 2006 (MDT)

I noticed that the old query method that worked during the beta now returns an error message "E 104 $ 4 $" --[[User:Danielphin|Danielphin]] 10:11, 21 September 2006 (MDT)

I don't have any valid pid to test it out. It's only returning: "None: No error" --[[User:DestinedTConquer|DestinedTConquer]] 17:41, 30 September 2006 (GMT+1)

It appears that they have changed the protocol yet again ready for the demo. [http://stella.prod.gamespy.com/getbackendinfo.aspx?auth=cp9z0Fs4f4JKSWmGq8UwKA__ Here is a link] that worked during the second phase of the beta and now gives an expired token message. --[[User:Danielphin|Danielphin]] 09:16, 2 October 2006 (MDT) 

A reason could be that they've simply "retired" http://stella.xxx as this was used for beta testing and nothing more. Now we're close to demo and live it could be worth trying the host "bf2142web.gamespy.com" (which does resolve correctly) to see if that returns the expected response, eg "http://bf2142web.gamespy.com/getawardsinfo.aspx" like in BF2.
--[[User:Kurt|Kurt]] 10:08, 3 October 2006 (MDT)

Hmm, that domain wasnt valid during the beta. I thought like yourself to try that domain but with no luck.

I just wanna heads up that [http://bf2142web.gamespy.com/getbackendinfo.aspx?auth=cp9z0Fs4f4JKSWmGq8UwKA__ this link] now works correctly
--[[User:Danielphin|Danielphin]] 12:39, 3 October 2006 (MDT)


Installed the released version of BF2142 yesterday and turned on a packetspy utility before starting the game.
FYI the auth= parameter still exists on every stats request against GameSpy (server is stella.prod.gamespy.com).
I think this means that it will be hard to fetch statistics from BF2142 using the old BF2-way. 

I have some thoughts on how to fix this, and it includes the use of [http://www.winpcap.org/default.htm WinPCap] on every clan members computer. 

I found an .NET API against WinPCap, and created a command-line application that I start before fireing up BF2142. This .NET application uses WinPCap and starts a trace with a filter looking for requests that BF2142 sends to http://stella.prod.gamespy.com. Every request (not that many) for the current user will then be sendt to a webservice on our clan website that handles the stat-fetch part. The requests against gamespy are at least vaild for 20 minutes or so (I have not testet the exact expiry time).

I have run a test on this today, and it actually works. Not the easiest way around though. Would be great to know how/what to encode in the auth-parameter. I think it is the PlayerID (PID) that is the base for encryption, but the auth-key changes after som time for the same request, so it has to be something more.

I Really hope that someone finds a easier way to gather the BF2142 stats. 

Good luck :o)
--[[User:Rusty(NO)|Rusty(NO)]] 07:58, 19 October 2006 (MDT)


did anyone noted the 'token' ?

/getplayerinfo.aspx?auth=NPh1eX91SAeUsDoUam7xvg__&mode=base&pToken=OxSWQ6oylBUPRhync6yubBS7ORzVvYwLMKkDUfSXqvzzHXL5oDShxEZu0EaHXH2lwK32vy3D6a1J52raU8Glvg__

I also noted that the last 2 UNDERSCORE signs, are NOT part of the auth. the appear the same with 10+ accounts.

Update : the sheme looks very like a RSA SecurID Token.
this sheme has time hashes, that are similar to what we expirience.... ofcourse, this is all speculation.
--[[User:Satcom|Satcom]] 14:34, 20 October 2006 (MDT)

the token is an encrypted stat query.  I'm sure the auth value is equates to some datetime stamp since using one generated by the game works for about 15 minutes after I capture it in ethereal saying the time has expired. 
Looking deeper into the game, it seems they're using [http://paceap.com/whatisesd.html PACE ESD] for authorization, and I can only assume that they're using this on the stats servers as well, so it may be that we can never access the servers w/ out a complete authentication transaction... --[[User:MadHatter|MH]] 21 October 2006 (CST)

GetBackendInfo seems to return the awards / unlocks criteria used for the games sats. --[[User:MadHatter|MH]] 21 October 2006 (CST)


The website [http://www.2142-stats.com/ 2142-stats.com] seems to have worked out how to query bf2142 statistics. Would anyone care to contact the webmaster and ask for a solution to our problems? --[[User:Danielphin|Danielphin]] 09:13, 22 October 2006 (MDT)

I am the owner and coder of [http://www.2142-stats.com/ 2142-stats.com] but at the moment I am not allowed to say anything about how I retrive the stats. You have to find it out! --[[User:1ApRiL|1ApRiL]] 10:55, 22 October 2006 (MDT)

: Does that mean it's doable or do you mean that EA have told you how and asked you not to say? --[[User:Streaky|Streaky]] 19:47, 22 October 2006 (MDT)

with users like 1ApRiL,Dont we like the BFcommunity?  anyways: Team ABR has issued a email regarding this mechanism to EA. i'll keep u informed.--[[User:Satcom|Satcom]] 12:49, 23 October 2006 (MDT)

BF2142 stats are now up on [http://bf2142tracker.com/ http://bf2142tracker.com]. Anyone know if they have access to a public stats feed or if they solved the auth part?
--[[User:Rusty(NO)|Rusty(NO)]] 02:07, 24 October 2006 (MDT)


bf2142tracker is owned by a guy who does tracker sites like this for AA and all the bf titles.  he's worked closely w/ ea on the stats feeds and gets it from a special stats feed that they provide for him.  --[[User:MadHatter|MH]] 14:52 24 October 2006 (CST)

I have spoken with a guy, who has done alot of work with stats for bf2 and he says that decrytping the auth key is the (no pun intended) key to the whole thing. He said it was a fairly simple encryption that anyone with a basic knowledge of key decryption could break it. Thats all i could get out of him though.--[[User:esparkman]] 04:41, 24 October 2006 (EST)


well, lets get started then shall we? 

the auth and token parameters are [http://en.wikipedia.org/wiki/Base_64 base 64] encoded.  3 characters are replaced they are:

{|cellpadding="4" border="1"
|  Base 64 char ||   EA's URL char replacement
|-
| '=' || '_'     
|-
| '/' || '[' 
|-
| '+' || ']'
|}

so that "4Eq5FDcUJyWw6NR3urE/z4hN75o04bCaHe8Cin9FiHmt1lpAbQlj+1GTUZiBdGPgL8QsqzsNRKex37JJa/dVUQ==" (a query token from get player info) gets transformed into "4Eq5FDcUJyWw6NR3urE[z4hN75o04bCaHe8Cin9FiHmt1lpAbQlj]1GTUZiBdGPgL8QsqzsNRKex37JJa[dVUQ__"

auth is always 16 bytes long (there are a few encryption algorithms that use a 16 byte key, though I dont think this is a key).  I tested this by generating a random base 64 string from a 16 byte array, and sent it into [http://stella.prod.gamespy.com/getbackendinfo.aspx?auth=TWFkSGF0dGVyMjE0Mg__ http://stella.prod.gamespy.com/getbackendinfo.aspx?auth=TWFkSGF0dGVyMjE0Mg__] and the message recieved is: "DecryptionFailure: Authentication token decryption failure" which may be a generic response, but leads me to believe that this 16 byte value is an encrypted value (I'm guessing a time stamp because it changes in a manner that seems consistent w/ this).

there are some certs in the bf2142 folder in a file named confbar.mdf which may help shed some light as to what the auth parameter is comprised of. --[[User:MadHatter|MH]] 21:43, 24 October 2006 (CST)

Ok i have been trying to work out an base64 encode using a unix time but it doesn't seem to work. I used "stellaXXXXXXXX" with x being replaced with the integer of the unix time of a forwarded 1 hour in advance and it gives me a 24 char base64 hash and i just replace the == with __ but it still doesn't work. I have tried to unencode the auth that bf2142 sends but there is no success, I believe that there is a alpha numeric replacement and then you can decode the base64. 
I believe there is a need to decompile some .dll to find a function that does the trick.
[[User:Nitr021|Nitr021]] 04:14, 25 October 2006 (MDT)

: [[User:Nitr021|Nitr021]], i'm wondering what triggered you to try '''stellaUNIXTMSTMP'''?

If the auth string was simply '''base64encode(''SOMETHING'' + UNIX_TIMESTAMP+3600)''' then ''SOMETHING'' would have to be some piece of information that uniquely identifiers the player, as each auth string is somehow unique to that player.
--[[User:Danielphin|Danielphin]] 10:32, 25 October 2006 (MDT)

that something can only be the gamespy playerid --[[User:Satcom|Satcom]] 10:34, 25 October 2006 (MDT)

hmm, inserting a gamespy playerid in various places makes the base64 hash more than the typical 24 characters. --[[User:Danielphin|Danielphin]] 10:51, 25 October 2006 (MDT)


One obvservation I made was that each request to the stats servers had a new auth value (always 20 characters) except if when I requested the leaderboard stats and checked off filters (like dog tag filter and so on), then for those requests it used the exact same auth value. the leaderboard requests were made in a vary short time of oneanother, but the others were spaced out a little.  this is why I think that that value (if not directly) has something to do w/ a time stamp.  perhaps not directly.  I ran seferal queries (Except for getplayerinfo) with auth values from the other queries (generated by the game) and it still returned valid results.  One thing we should try is to replace an auth value not sent out w/ the getplayerinfo query to see if the Token parameter is at all related to the auth parameter.--[[User:Madhatter|MH]] 13:41, 25 October 2006 (CST)

Danielphin - are you certain that the ''SOMETHING'' has to be unique to the player.  Have you tested multiple accounts from the same IP or even Machine(MAC address)?   --[[User:Craigins|Craigins]] 12:55, 25 October 2006 (MDT)

: I'm sure its unique, ive put a request URL into the google translator :P and it gives the same result. I also did a wget on my remote server. --[[User:Danielphin|Danielphin]] 02:09, 26 October 2006 (MDT)

did anyone try out different date/time formats? we should make a list of what´s tried, and with what thought behind it --[[User:Satcom|Satcom]] 13:16, 25 October 2006 (MDT)

You guys said that the unix time stamp and the PID don't fit in the 16 byte auth key.  However:<br>
// Unix timestamp: 1161812842<br>
// PID:  44652121<br>
string s = "stella" + ((char)2);<br>
s += (char)169;<br>
s += (char)86;<br>
s += (char)89;<br>
s += (char)69;<br>
s += (char)63;<br>
s += (char)219;<br>
s += (char)106;<br>
<br>
If you break the 2 numbers down into their separate bytes, then cast them to chars and encode the resulting string, you get:
c3RlbGxhAsKpVllFP8Obag==  which is 24 characters.  Don't assume that it is in the straight number->text format.  Who knows.--[[User:Craigins|Craigins]] 15:01, 25 October 2006 (MDT)


except that the auth value is pretty consistently 20 (base 64 encoded) characters (actually 16 bytes padded to 20 base 64 characters).--[[User:MadHatter|MadHatter]] 15:22, 25 October 2006 (MDT) '''EDIT: sorry, it is 24 characters... my bad'''

MadHatter- take out the word stella from the above string and you get AsKpVllFP8Obag== which is 16 characters.  Pad it to 20 somehow and see if it works.  The reason i went to 24 was because of the above post which had an example authkey of auth=NPh1eX91SAeUsDoUam7xvg__ which is 24 characters long.

If you unzip the pylib-2.3.4 file in your bf2142 dir. You got a lot of neat files. Especially in the test directory. Like testbase64.py All of them are in python but can be opened with notepad. All of them pretty much explain the code. Also the testmd5.py & stat.py & statcache.py and the TOKEN.PY is a cool read !! Hope this helps..
--[[User:LDD Bozo|LDD Bozo]] 16:18, 25 October 2006 (MDT)

how exactly does this help?  I know nothing about python, but test_base64.py is a unit test to test the base64 encoding.  test_md5.py is a unit test for md5, stat.py are file attribute tests, and statcache.py seems to be some sort mechanism for loading the stat py code.  token.py seems to be the way to tokenize things for python serialization.  these  dont provide much more insight to me atleast. --[[User:MadHatter|MadHatter]] 17:18, 25 October 2006 (MDT)


Havent found anything in pylib-2.3.4 that I can use, but it might still exist in this library. The unittests vil not give many answers.
A standard base64decode (UTF-8) of auth "NPh1eX91SAeUsDoUam7xvg__" gives us: "4uyuH\a:�jn" (after replacing __ with ==) so there exists som form of encryption that has to be solved after the base64 decode has run. The ByteArray looks like this before encoding it to the string "4uyuH\a:�jn":
{Dimensions:[16]}
    [0]: 52
    [1]: 248
    [2]: 117
    [3]: 121
    [4]: 127
    [5]: 117
    [6]: 72
    [7]: 7
    [8]: 148
    [9]: 176
    [10]: 58
    [11]: 20
    [12]: 106
    [13]: 110
    [14]: 241
    [15]: 190

Btw, EA has released their own BF2142 stats site now: [http://stage.battlefield.ea.com/battlefield/bf2142/default.aspx http://stage.battlefield.ea.com/battlefield/bf2142] 
--[[User:Rusty(NO)|Rusty(NO)]] 06:30, 26 October 2006 (MDT)

I agree with rusty about the python code.  If someone wants to dig through each file, find out where the Host object is defined at.  It is used to communicate with the stats server I believe(after reading through all the python stat code).

I also agree that there is a lot of encryption going on after the decoding.  I monitored my packets last night and came up with the following list of auths, decuded using standard base64decode (UTF-8) and came up with the following:

    AuthCode                        Ascii of the characters after decoding.
    iQEBWfVFxglMh81vF9i75g__ 	1   1   89  69  9   76  111 23  59 
    0VhKfQfV1gXjOtrPLj43eA__	88  74  125 7   5   58  46  62  55  120 
    2p5aIMGI[1Dya8H57Zh8Dw__	158 90  32  80  107 124 15 
    38dpI6LJC1vOdCpi814teQ__	105 35  11  91  116 42  98  94  45  121 
    55uq4a[IOxRVMnrV88JLDg__	234 59  20  85  50  122 75  14 
    5aDb47bhk48FLA[cv]OBjg__	207 5   44  15  63  78 
    5fDxSUnhqSdJLfmR7m5dGg__	73  73  39  73  45  110 93  26 
    62PjcWg8cEDJmYiyI2CG1w__	99  113 104 60  112 64  89  35  96 
    7pyFAHHDtbPNYZQCDaRwmw__	5   0   113 245 97  2   13  112 
    FT1WvqcI8AHItWr5NzkyUw__ 	21  61  86  8   1   53  106 55  57  50  83 
    g6q8nlLzs2vHTE3MzNYd9g__	82  107 76  77  29 
    H6S[iGJwIY]42IbnIz33Ag__	31  98  112 33  6   35  61  2 
    idss]0lsSaKBuWQydP]hgw__	44  73  108 73  100 50  116 
    MJB9[9GYU6ms2NeFbkquiw__	48  125 88  83  197 110 74 
    mRHQTvZQIMhi4U4Op24SoQ__	17  78  80  32  98  78  14  110 18 
    pMgSo2t5CxjuJjhBCrv77g__	18  107 121 11  24  38  56  65  10 
    q00qnIEsryEtLskzb5HwIg__	77  42  44  33  45  46  51  111 34 
    q00qnIEsryEtLskzb5HwIg__	77  42  44  33  45  46  51  111 34 
    ReOBI8sQaAFIf3pCIRKsvQ__	69  35  16  104 1   72  127 122 66  33  18 
    TIvOgj[eLqCJ7JECW52yLg__	76  130 63  46  2   91  46 
    VCfK25Yxd4zW8ZD593ek2Q__	84  39  214 49  119 119 
    Xejcq[TgTT]FhU]4cLD0SQ__	93  43  77  63  79  112 73 
    igg06CRnbSAoVSmQsIuMnA__ 	8   52  36  103 109 32  40  85  41 
    0YJVfMVj74oCiNAqCPgsjA__ 	66  85  124 99  2   42  8   44 
    5Expic1e1POyODluFCxfPA__ 	76  105 94  56  57  110 20  44  95  60 
    7d[AnhHiku5dAKX9Xsjw6A__ 	17  93  0   94 
    s0JSWPmFjo[Tu9d[GnKqIA__ 	66  82  88  251 127 26  114 32 
    GXszUK0tTC7[kbgCtoBjMQ__ 	25  123 51  80  45  76  46  2   99  49 
    s0JSWPmFjo[Tu9d[GnKqIA__ 	66  82  88  251 127 26  114 32 
    3KLvL5bYb6AvLA5NuBXyAw__ 	34  47  111 47  44  14  77  21  3 
    0YJVfMVj74oCiNAqCPgsjA__ 	66  85  124 99  2   42  8   44 
    DHA1JibVoqqzpOHQjBvcSQ__ 	12  112 53  38  38  98  12  27  73 
    igg06CRnbSAoVSmQsIuMnA__ 	8   52  36  103 109 32  40  85  41 
    0]Wsje7QbJSTkCtK66Etgw__ 	13  108 43  74  45 
    iQEBWfVFxglMh81vF9i75g__ 	1   1   89  69  9   76  111 23  59 


If anyone wants to give decrypting a shot, go for it. --[[User:Craigins|Craigins]] 07:44, 26 October 2006 (MDT) '''edit: yes i ran the conversions listed in the table above'''

: Did you do the underscore and square bracket conversion? maybe this is just getting to my head --[[User:Danielphin|Danielphin]] 09:02, 26 October 2006 (MDT)

Quick note:  the HOST object is NOT in python. python imports it, but the actual code is c not python. dont forget that the stats is EXACTLY the same as bf2, with little addon authcode. i have ´ranked server files´  and also there is nothing on the auth, after i checked them. --[[User:Satcom|Satcom]] 08:27, 26 October 2006 (MDT)

Bear in mind that the client does not necessarily have to decode, only encode as the results of the queries are plain text so I'd be looking for encoding functions first as they may be no decoding functions in the client. Also, Craig it'd be useful to know your PID as we need to get from PID to auth if we can find relevant py stuff.
--[[User:Kurt|Kurt]] 08:29, 26 October 2006 (MDT)
: bf2142pid=81273635 you can also search the stat sites for the player Craigins.  Also the authcodes were from around 2006-10-26 12:15am (CDT) +/- 5 minutes if you want to check for timestamps as well --[[User:Craigins|Craigins]] 09:44, 26 October 2006 (MDT)


@Danielphin - base 64 only uses abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/ characters for conversion ('=' is used for padding).  so if he decoded it, he would have had to convert the underscore and brackets.

also, I came across a possibly related connection (though I dont know how it is if it is).  this may be part of the anti-piracy protection (because of the challenge / response api of PACE), but may be used in the auth.  just before the game requests stats, it goes through a challenge / response session over tcp w/ stella.available.gamespy.com (havent figured out wich port just yet).  the challenge / response sequence has a number of hex, and base 64 (looking) pieces to it (seperated by '/' forward slashes).

@Craigins - I've been trying out different permutations of those auth strings [http://www.sanity-free.org/forum/viewtopic.php?id=15 have a running todo list on my site] and they seem to be query specific (switching the auth token from one query to another returns weird results).--[[User:MadHatter|MadHatter]] 09:24, 26 October 2006 (MDT)

@MadHatter - if you want I can give you my packet data filtered to stella during the run of the stats check.  I noticed they seemed to change on each page it sent to, the packets include the pages they were sent to as well(obviously) --[[User:Craigins|Craigins]] 09:44, 26 October 2006 (MDT)

sure, feel free to post it here or on my forum (I just put mine on my forum in case they end up exposing some data that I dont want to share w/ the world. so in the instance it does, I can delete it with out having it show up in the history).  --[[User:MadHatter|MadHatter]] 09:51, 26 October 2006 (MDT)

GUYS SCREW FINDING THE HASH CODE, just grab the stats off: [[http://stage.battlefield.ea.com/battlefield/bf2142/PlayerSummary.aspx?Lang=US&PID=81260470&SrchName=&Profiles=]] just preg_replace, easy stuff, probably friday afternoon ill make a class for that in php, ill only give it to people who really wants it.
[[User:Nitr021|Nitr021]] 14:15, 26 October 2006 (MDT)

Unfortunatly pulling the data off EA's site will leave you with partial data.  I couldn't find things such as Time as recon/assault/engie/support skin and # of times you received pins/awards and the dates.  It would be nice to have the complete dataset to work with so that the stats will be comprehensive, instead of what EA decided was important to show. --[[User:Craigins|Craigins]] 14:22, 26 October 2006 (MDT)


Tubar from [http://www.bfstats.info/ bfstats.info] just posted the disassembly of the code that generates the auth parameter.  still have a little work to do on it, but this is pretty huge: [http://www.sanity-free.org/forum/viewtopic.php?pid=157#p157 http://www.sanity-free.org/forum/viewtopic.php?pid=157#p157]. --[[User:MadHatter|MadHatter]] 14:57, 26 October 2006 (MDT)

Seems EA are being a little more protective of their stats than before. http://www.bf2142tracker.com have disabled their feed after nasty words from them. EA have promised an "official" feed at some stage but later rather than sooner.
--[[User:Kurt|Kurt]] 06:56, 27 October 2006 (MDT)

From the news post on bf2142tracker.com it seems like the way they were getting stats was to run each query in game, capture the auth code and then use a script to scrape the data from the server.  What leads me to believe this is that he was saying it only worked for 3-4 hours a day, since the auth codes expire quickly it would only work for a certain time after encoded.  If we are able to figure out the algorithm used by EA to generate the auth key, they would not be able to distinguish between a call from the server to obtain the information and a call from in game.(ie think about 1 auth key slamming the server hundreds of times in a few minutes, sticks out a lot).  If you do that sort of stuff you are suppose to do it in small bursts over the entire day, like 1 minute intervals, and NOT during prime time. The site I'm planning on will only update stats when you request it, it will then copy the stats into an internal database that way it won't hit the EA server each time someone views a page.  In fact it would benefit EA's server since people wouldn't be  hitting their servers as much, so I have no idea why they have a problem with it. --[[User:Craigins|Craigins]] 08:23, 27 October 2006 (MDT)


bf2tracker.com and bf2s.com started when bf2 came out.  they designed their stats to pull directly from the same servers that the game queries.  a short while after that (because they were putting such a strain on the stats servers) EA told them not to use the normal game stat servers.  instead what they did was to put up some server that had a replicated db of the stats, and both sites pulled their stats info from there.  there are a couple of posts by homey (the guy who runs bf2tracker / bf2142tracker) about waiting for them to put up those servers so they could pull info from it.  what I gathered from it when he started showing stats is that either they set up a server for him, or he started pulling stats from the normal game stats server.

I've never planned on setting up a stats server. I like to do my own sig and thats the only reason I'm interested in this (kind of sad eh?).  one easy way to bypass EA trying to shut stats sites down (and something I've thought of) would be to create a windows service that can run in the background that watches for the bf2142 process to exit, after a few seconds it queries for the players stats and sends that data via a webservice to a "tracker" site which takes that data and puts it into a db.  this way the webserver isnt pulling stats from ea, and there would be no central point to shut down if they dont like other sites doing game stats...  just a thought.  

in the interest of keeping this wiki up to date as we progress, Tubar showed us the section of code that does the auth token.  Its format is as follows (lets break this out into its own section after we get the hashing algorithm psudo code).

it uses a '''Little-endian''' 16 byte array (the game uses 4 DWORD / 32 bit integers).  the values of those bytes are (in hex):

{|cellpadding="4" border="1"
|  location || value stored there
|-
|  bytes 1 - 4 || unix time stamp (in seconds)
|-
| bytes 5 - 8 || magic number 00000064 
|-
| bytes 9 - 12 || player id 
|-
| bytes 13 - 16 || UNKNOWN: some sequence that we havent figured out yet  
|}

so that 
 time stamp - 1161927440 -> 45419B10
 magic # - 00000064
 pid - 81246737 -> 04D7BA11
 other # = 222 173 0 1 -> DEAD0001

turns into
 byte[0]  = 0x10
 byte[1]  = 0x9b
 byte[2]  = 0x41
 byte[3]  = 0x45
 byte[4]  = 0x64
 byte[5]  = 0x00
 byte[6]  = 0x00
 byte[7]  = 0x00
 byte[8]  = 0x11
 byte[9]  = 0xba
 byte[10] = 0xd7
 byte[11] = 0x04
 byte[12] = 0x01
 byte[13] = 0x00
 byte[14] = 0xad
 byte[15] = 0xde

then the bytes are coverted (the xor bit we used to have here is most likely an [http://en.wikipedia.org/wiki/Initialization_vector init vector] of the encryption algorithm), 

then those bytes are base 64 encoded ([] for /+ and _ for =) as the auth value.

--[[User:MadHatter|MH]] 09:57, 27 October 2006 (MDT) ('''lasted edited 16:02, 2 November 2006''')


For stats, I just want a page that my clan and I have access to.  What EA is probably upset about is they lose out on all the advertising money.  If they are the only place people can go to get stats then people will have to view their ads instead of all the other stat sites making money off of the EA content.  What EA needs to do is set up an AD server as well, so that if you want the stats you have to take their ADs, then they would get credit for it anyways.  That is the only reason I can see them not allowing external sites with stats.  At this point its almost worth figuring out the encryption just for the sake of figuring it out.  --[[User:Craigins|Craigins]] 14:03, 27 October 2006 (MDT)


In case no-one has noticed yet, EA have put a public stats site up... http://www.battlefield.ea.com/battlefield/bf2142/
I don't know yet if there's a way to feed the stats into your own web site though.--[[User:Mort|Mort]] 00:42, 12 November 2006 (MST)

Yeah, the data returned is consistant in its format - I'm writing a stats retriever and basically using the public stats site as a feed. Of course the data is not designed for parsing, just for display but you can read the html and search for specific phrases to extract the values. Untidy but it seems to work fine. I'm using it for a basic client app but if you were to pull in volume it'd be a pretty untidy way to do it.
--[[User:Kurt|Kurt]] 05:00, 20 November 2006 (MST)