0

I decoded some of the original traffic from hex and got the below output. I'm not sure how to decode it further. Any help? Thanks.

T=2020-04-10+13:27:30.758+PST&L=i&M=[g2tray]&N=22&X=6/A3eZDCME9jCLvH9D6cciMZAFUWx2xUayI+JAbr1hzuW0BNOuxYTlatYqKViHFk0RKP1lCag7gtlyUH9l1a+fDDMkI4W/+8t0zuNFEgGcMW/qlM5iGhhJKB38/186Uy2Q+vUGBpgSSk8iyQkFhf66FIsnYI/Q32N6s=    
T=2020-04-10+13:27:30.758+PST&L=i&M=[g2tray]&N=23&X=fH6MMvw38rPIs/BF2YCulBUMBS94+qEM5lZWUQ0izn1WY+RWnBBiiuuqOHQ3omFirWOrq7Kc1ug9U/4p7tw4JsCQo+V2PChm+CdEpjMNQqehUW/yoiwBpKUfWVH3N2WATTaOsbDJcRk1sQ7qG21hXgnnAODuWe7QTwrgfg==    
T=2020-04-10+13:27:30.789+PST&L=i&M=[g2tray]&N=24&X=w+qtxL4auaCbNaOQbt7Yll0pYT7JtmlvZQYddUrMpbiJbURPSHWrUN1klgvbqan0WlpLcx3CHgd4HcHr0NuWi9X45zsc8ilChkRFfUspKLQ5SbqJfclr0Equy1J6OF+/m1w8ZcfdzUGqyVB9LjtYKQj4BQmFXHywq5gG/xA=
gowenfawr
  • 72,893
  • 17
  • 165
  • 200
Neo Son
  • 15
  • 2

1 Answers1

0

Each line consists of a timestamp (T=) and four variables (L=, M=, N=, and X=) in HTML-encoded format (var=val separated by &). Of these, only the variable X requires decoding, and it is base64 encoded. However, the decoded value is binary data, and not much useful to humans:

$ echo -n fH6MMvw38rPIs/BF2YCulBUMBS94+qEM5lZWUQ0izn1WY+RWnBBiiuuqOHQ3omFirWOrq7Kc1ug9U/4p7tw4JsCQo+V2PChm+CdEpjMNQqehUW/yoiwBpKUfWVH3N2WATTaOsbDJcRk1sQ7qG21hXgnnAODuWe7QTwrgfg== | base64 -d | hexdump -C
00000000  7c 7e 8c 32 fc 37 f2 b3  c8 b3 f0 45 d9 80 ae 94  ||~.2.7.....E....|
00000010  15 0c 05 2f 78 fa a1 0c  e6 56 56 51 0d 22 ce 7d  |.../x....VVQ.".}|
00000020  56 63 e4 56 9c 10 62 8a  eb aa 38 74 37 a2 61 62  |Vc.V..b...8t7.ab|
00000030  ad 63 ab ab b2 9c d6 e8  3d 53 fe 29 ee dc 38 26  |.c......=S.)..8&|
00000040  c0 90 a3 e5 76 3c 28 66  f8 27 44 a6 33 0d 42 a7  |....v<(f.'D.3.B.|
00000050  a1 51 6f f2 a2 2c 01 a4  a5 1f 59 51 f7 37 65 80  |.Qo..,....YQ.7e.|
00000060  4d 36 8e b1 b0 c9 71 19  35 b1 0e ea 1b 6d 61 5e  |M6....q.5....ma^|
00000070  09 e7 00 e0 ee 59 ee d0  4f 0a e0 7e              |.....Y..O..~|
0000007c
gowenfawr
  • 72,893
  • 17
  • 165
  • 200