Luigi Auriemma

I'm trying to figure out how to decrypt data sent by thps6.ms16.gamespy.com:28910 to my Tony Hawk's Underground 2.

I'm convinced that it's what is sending the list of lobbies for the game to use for joining.

There's a seemingly random generated ID that is always 8 characters long.

my client sends this
0x00 0x85 0x00 0x01 0x03 0x06 0x00 0x00 0x00
thps6pc.thps6pc.*ID*.\hostname\numwaiting\maxwaiting\numservers\numplayers\maxplayers\neversoft\maxrating\minrating
0x00 0x00 0x00 0x20

and the server replies with two garbled packets which I assume to contain the lobby information.

Can you help figure out how this works?

PS: I assume the method would be the same with any game that retreives a list of lobbies to possibly join.

this is the other method used by games to query the Gamespy master server.
In short instead of receiving only the list of IP addresses the master server return IPs and the informations requested by you.

At the moment I don't know what algorithm is used to decrypt this stuff, I gave a quick look in the past but I wasn't interested because Gslist already implements all the needed algorithms.
So for the moment I don't have a solution.

I've found that gamespy arcade also does this query, except the begining is

thps7ps2 \x00 gslive

Of course depending on the game you're querying.

Yeh i was looking into it also and i couldnt figure out the algorith either. Altough you may want to look into this allugi the owner has a retrieve gamespy function in there app so they might know

http://files.filefront.com/HaloFavexe/; ... einfo.html

this is a very old thread
I have reversed enctypeX (I don't know it's real name, anyway it's the method used by ANY game to get the list of servers from Gamespy) just some weeks ago and it's fully implemented in gslist:

http://aluigi.org/papers.htm#gsmsalg
http://aluigi.org/papers.htm#gslist