Background
I played a starcraft2 game, and used wireshark to capture a pcapng. I found there’re a lot of UDP data.
For such excellent real-time strategic game, it uses UDP as interact network traffic protocal. My location is in south hemisphere, and its UDP server IP is 37.244.40.155.
Lockstep Simulation Model
Basic Principle
Every player’s game client runs a deterministic simulation of the game world.
Instead of syncing the whole game state over the network (which is big and slow), clients just send:
“At frame N, I pressed X.”
All clients then apply those commands in lockstep, frame-by-frame.
So if the simulation is deterministic and everyone gets the same input at the same time → everyone should be in the same state.
How It Works (Step-by-Step)
Simulation runs in fixed time steps (e.g., every 16ms = 1 game frame)
At each frame, players:
Collect their inputs (e.g. “move unit to X”)
Broadcast those inputs to all other players (via UDP)
Wait until all players’ inputs for that frame are received
Apply all the inputs at the same time
- Repeat
This is why it’s called lockstep — everyone is locked into executing the same set of actions, in the same order, at the same time.
Sync Checking
To detect desyncs, SC2 and others use periodic hash checks:
Every few hundred frames, each client generates a hash of its internal game state
They exchange these hashes
If any hash differs → desync warning or game termination
You already spotted these hashes in StarCraft II’s UDP protocol like:
f32d05001be40681124916e6a09740000bd1552e
How to crack it
ChatGPT mentioned two projects, which were thought may benefit cracking of Starcraft2.
bug report
Oct 3rd, 2026
In PTR test of American Server:
Welcome to point out the mistakes and faults!