How to decode a websocket payload message which is in binary and uses zlib encoding

[Geoge]

Hello, I am trying to decode a websocket payload message from a WS. Here is what i got:

Request:

GET https://gateway.discord.gg/?encoding=json&v=9&compress=zlib-stream HTTP/1.1
Host: gateway.discord.gg
Connection: Upgrade
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Upgrade: websocket
Origin: https://discord.com
Sec-WebSocket-Version: 13
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Sec-WebSocket-Key: NEzVIPJgSoYSmlBlsLNnmg==
Content-Encoding: gzip

The websocket Payload:

xœ4ÉM
ƒ0л|ë¤$¥íb®bDF¬ª$c¹{ݸ{ð
´ì1äëòÎ`<…“öÂÚ͋JzsÝüõ~|§‰
5h&VùðÏni´{¶ÂY½ííäß S^óÖ@îâj‹¶Ö?   ÿÿ (Encoded)

 

[Nick Iliev]

Hello Geoge Jihnas,

 

The first thing that catches the eye is that it looks like the endpoint uses zlib compression while the header Content-Encoding has a value of gzip. While both compressions are similar, they are not identical, and it would make sense that Fiddler is failing to correctly decode the content as it tries to parse it as a gzip.

You could try to explicitly specify the Content-Encoding as zlib (by an AutoResponde rule or though FiddlerScript) and then force the decoding to use deflate, as shown in the following SO thread:

https://stackoverflow.com/questions/37830092/how-to-decode-response-with-zlib-in-fiddler 

public static ContextAction("Force Decode (zlib)")
function AddEncoding(oSessions: Fiddler.Session[]){
    for (var x:int = 0; x < oSessions.Length; x++){
        if (oSessions[x].oRequest.headers["Content-Encoding"]=="zlib"){
            oSessions[x].oRequest.headers["Content-Encoding"]="deflate";
            oSessions[x].utilDecodeRequest();
        }
        if (oSessions[x].oResponse.headers["Content-Encoding"]=="zlib"){
            oSessions[x].oResponse.headers["Content-Encoding"]="deflate";
            oSessions[x].utilDecodeResponse();
        }
    }
    UI.actUpdateInspector(true,true);
}

As a disclaimer I can not exact test the endpoint on my side and verify my thesis (as to returns 404). Aлternatively, you can also try to use the Transformer tab from Inspectors section and choose the DEFLATE option.

Regards,
Nick Iliev
Progress Telerik