This project is a proof of concept on decrypting and inspecting Roblox's customized RakNet protocol packets for educational purposes.
Warning
Users must provide their own session keys to use this tool. I will not provide instructions or methods on how to obtain these session keys, as doing so violates the Roblox Terms of Service.
The tool recognizes the following top-level packet IDs.
| ID | Name | Description |
|---|---|---|
0x00 |
ID_CONNECTED_PING |
RakNet connected ping packet carrying a ping timestamp. |
0x03 |
ID_CONNECTED_PONG |
RakNet connected pong reply carrying ping and pong timestamps. |
0x09 |
ID_CONNECTION_REQUEST |
RakNet connection handshake request packet. |
0x10 |
ID_CONNECTION_ACCEPTED |
RakNet handshake acceptance packet sent after connection setup succeeds. |
0x13 |
ID_NEW_INCOMING_CONNECTION |
RakNet notification that a new incoming connection has been established. |
0x15 |
ID_DISCONNECT |
Disconnect/connection teardown packet. |
0x1B |
ID_TIMESTAMP |
Timestamp wrapper packet that prepends one or two timestamps and may wrap another packet. |
0x51 |
ID_MTU_PING_1 |
MTU probe ping packet used during path/MTU discovery. |
0x52 |
ID_MTU_PING_2 |
Second MTU probe ping variant used during connection setup. |
0x53 |
ID_MTU_PING_3 |
Third MTU probe ping variant used during connection setup. |
0x54 |
ID_MTU_PONG_1 |
MTU probe pong reply carrying timing data. |
0x55 |
ID_MTU_PONG_2 |
Second MTU probe pong variant carrying timing data. |
0x56 |
ID_MTU_PONG_3 |
Third MTU probe pong variant carrying timing data. |
0x81 |
ID_SET_GLOBALS |
Replication/session setup packet containing global flags, peer ID, script keys, and service references. |
0x82 |
ID_TEACH_DESCRIPTOR_DICTIONARIES |
Descriptor/dictionary teaching packet referenced by name but not currently decoded in detail. |
0x83 |
ID_DATA |
Main Roblox replication container that carries one or more subpackets such as property, event, and instance updates. |
0x84 |
ID_MARKER |
Marker/control packet referenced by name but not currently decoded as a top-level packet. |
0x85 |
ID_PHYSICS |
Physics replication packet carrying transforms, velocities, motors, and optional child-body data. |
0x86 |
ID_TOUCHES |
Touch/contact replication packet describing begin/end touch relationships between instances. |
0x87 |
ID_CHAT_ALL |
Global chat packet referenced by name only. |
0x88 |
ID_CHAT_TEAM |
Team chat packet referenced by name only. |
0x89 |
ID_REPORT_ABUSE |
Abuse report packet referenced by name only. |
0x8A |
ID_SUBMIT_TICKET |
Support/ticket submission packet referenced by name only. |
0x8B |
ID_CHAT_GAME |
Game/system chat packet referenced by name only. |
0x8C |
ID_CHAT_PLAYER |
Direct player chat packet referenced by name only. |
0x8D |
ID_CLUSTER |
Cluster/control packet referenced by name only. |
0x8E |
ID_PROTOCOL_MISMATCH |
Protocol version mismatch/error packet. |
0x8F |
ID_PREFERRED_SPAWN_NAME |
Preferred spawn selection packet referenced by name only. |
0x90 |
ID_PROTOCOL_SYNC |
Protocol synchronization packet referenced by name only. |
0x91 |
ID_SCHEMA_SYNC |
Schema synchronization packet referenced by name only. |
0x92 |
ID_PLACEID_VERIFICATION |
Packet carrying the Roblox place ID used to verify the connected experience. |
0x93 |
ID_DICTIONARY_FORMAT |
Dictionary-format negotiation packet referenced by name only. |
0x94 |
ID_HASH_MISMATCH |
Hash mismatch/error packet referenced by name only. |
0x95 |
ID_SECURITYKEY_MISMATCH |
Security key mismatch/error packet referenced by name only. |
0x96 |
ID_REQUEST_STATS |
Statistics request packet referenced by name only. |
0x97 |
ID_NEW_SCHEMA |
Compressed schema-definition packet describing enums, classes, properties, events, and string dictionaries. |
0x98 |
ID_KICK_MESSAGE |
Kick/disconnect reason packet containing a UTF-8 message string. |
0x9B |
ID_LUAU_CHALLENGE |
Luau challenge/response packet used during security or script validation. |
0xA2 |
ID_DATA_PING |
Segmented data ping packet used to measure latency for data transport. |
0xA3 |
ID_DATA_PING_BACK |
Reply packet for ID_DATA_PING. |
0xA4 |
ID_UNRELIABLE_DATA_PING |
Unreliable-channel variant of the data ping packet. |
0xA7 |
ID_EARLY_DATA_PING |
Early-session data ping packet sent before normal steady-state replication. |
ID_DATA (0x83) is a container packet. It can hold the following Roblox replication subpacket types:
| Sub ID | Name | Description |
|---|---|---|
0x01 |
DELETE_INST |
Deletes or dereferences an existing replicated instance. |
0x02 |
NEW_INST |
Creates a new replicated instance, including schema/class information, selected properties, and parent linkage. |
0x03 |
PROP |
Updates a single property on an existing instance, optionally with a version field. |
0x04 |
MARKER |
Carries a marker ID used for sequencing or control flow. |
0x05 |
PING |
Roblox data-channel ping packet carrying timing and send-stat fields. |
0x06 |
PING_BACK |
Reply packet for PING, echoing timing and send-stat fields. |
0x07 |
EVENT |
Fires a replicated event on an instance and carries typed event arguments. |
0x08 |
REQ_CHAR |
Character-request packet referenced by name only. |
0x09 |
ROCKY |
Packet type referenced by name only; exact purpose is not yet decoded. |
0x0A |
CFRAME_ACK |
Acknowledges transform/CFrame-related replication data. |
0x0B |
JOIN_DATA |
Compressed initial replication snapshot used to send many instances and their properties during join. |
0x0C |
CLIENT_QUOTA |
Streaming/client-budget packet containing quota delta and max region radius. |
0x0D |
STREAM_DATA |
Streamed replication payload referenced by name only. |
0x0E |
REGION_REMOVAL |
Signals streamed region removal/unload. |
0x0F |
INST_REMOVAL |
Removes streamed instances from the client's replicated state. |
0x10 |
TAG |
Tag/metadata replication packet referenced by name only. |
0x11 |
STATS |
Statistics/telemetry packet referenced by name only. |
0x12 |
HASH |
Hash/security packet containing a nonce, hash values, and optional security tokens. |
0x13 |
ATOMIC |
Grouped atomic replication update referenced by name only. |
0x14 |
STREAM_DATA_INFO |
Metadata packet for streamed replication data. |
0x16 |
SCHEMA_DATA |
Compressed follow-up schema/game-state data sent after ID_NEW_SCHEMA. |
Credit to Arisstath/raknet-dissector for some of the packet decoding implementations that I've ported to Python.