How to decode a websocket payload message which is in binary and uses zlib encoding

1 Answer 1677 Views
Fiddler Classic
Geoge
Top achievements
Rank 1
Geoge asked on 23 Feb 2023, 02:55 PM

Hello, I am trying to decode a websocket payload message from a WS. Here is what i got:

Request:

GET https://gateway.discord.gg/?encoding=json&v=9&compress=zlib-stream HTTP/1.1
Host: gateway.discord.gg
Connection: Upgrade
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Upgrade: websocket
Origin: https://discord.com
Sec-WebSocket-Version: 13
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Sec-WebSocket-Key: NEzVIPJgSoYSmlBlsLNnmg==
Content-Encoding: gzip

The websocket Payload:

xœ4ÉM
ƒ0л|ë¤$¥íb®bDF¬ª$c¹{ݸ{ð
´ì1äëòÎ`<…“öÂÚ͋JzsÝüõ~|§‰5h&VùðÏni´{¶ÂY½ííäß S^óÖ@îâj‹¶Ö?   ÿÿ (Encoded)

 

1 Answer, 1 is accepted

Sort by
0
Nick Iliev
Telerik team
answered on 24 Feb 2023, 07:15 AM

Hello Geoge Jihnas,

 

The first thing that catches the eye is that it looks like the endpoint uses zlib compression while the header Content-Encoding has a value of gzip. While both compressions are similar, they are not identical, and it would make sense that Fiddler is failing to correctly decode the content as it tries to parse it as a gzip.

You could try to explicitly specify the Content-Encoding as zlib (by an AutoResponde rule or though FiddlerScript) and then force the decoding to use deflate, as shown in the following SO thread:

https://stackoverflow.com/questions/37830092/how-to-decode-response-with-zlib-in-fiddler 

public static ContextAction("Force Decode (zlib)")
function AddEncoding(oSessions: Fiddler.Session[]){
    for (var x:int = 0; x < oSessions.Length; x++){
        if (oSessions[x].oRequest.headers["Content-Encoding"]=="zlib"){
            oSessions[x].oRequest.headers["Content-Encoding"]="deflate";
            oSessions[x].utilDecodeRequest();
        }
        if (oSessions[x].oResponse.headers["Content-Encoding"]=="zlib"){
            oSessions[x].oResponse.headers["Content-Encoding"]="deflate";
            oSessions[x].utilDecodeResponse();
        }
    }
    UI.actUpdateInspector(true,true);
}

As a disclaimer I can not exact test the endpoint on my side and verify my thesis (as to returns 404). Aлternatively, you can also try to use the Transformer tab from Inspectors section and choose the DEFLATE option.

Regards,
Nick Iliev
Progress Telerik

Virtual Classroom, the free self-paced technical training that gets you up to speed with Telerik and Kendo UI products quickly just got a fresh new look + new and improved content including a brand new Blazor course! Check it out at https://learn.telerik.com/.

Tags
Fiddler Classic
Asked by
Geoge
Top achievements
Rank 1
Answers by
Nick Iliev
Telerik team
Share this question
or