TurboRivals — Bringing a Dead Multiplayer Back Online
SOLE AUTHOR · REVERSE ENGINEERING · SHIPPED INSTALLEREA switched off Need for Speed Rivals' online services on 7 October 2025, and AllDrive — the shared open world for up to six players — went with them. TurboRivals is a stand-in server that brings it back. No live traffic was left to capture and nothing was documented, so the protocol had to be recovered from the game binary itself.
It ships no game files and bypasses no copy protection — every player uses their own copy. A one-click launcher handles the hosts file, firewall rules, career-save detection and the server.
ENGINEERING NOTES
-
No traffic to sniff, so read the binary. The code section is
encrypted (entropy 1.000), but the protocol's metadata tables are not:
applying BlazeSDK's 6-bit tag encoding recovered 2,864 tag → field
pairs (1,152 unique tags) straight from
.rdata. - A TLS terminator for a 2013 client. The game offers TLS 1.1 inside an SSLv3 record; the server answers with RC4-128-SHA. RSA key exchange, the TLS 1.0/1.1 PRF and RC4 were first written in pure Python and proven against a hand-built test client before the real game ever connected.
-
Joiners vanished after the world loaded. Frida hooks on the joining
machine showed the player stuck in
ACTIVE_CONNECTING— one missing notification (4/116, sent before4/30) was the whole fix. - "When there is code to read, we do not guess." Twice a guess by analogy — once a layout borrowed from Battlefield 3 — led nowhere. From then on answers came from a memory dump of the decrypted code and Capstone.
- Beyond the handshake: matchmaking, host migration when the host leaves, career progress that survives restarts, player names and profile pictures.
