Documentary by Wirtual

For context, I recommend watching this video by Wirtual.

Introduction

I joined the investigation team with the goal of getting the date of official replays. Previously, it was known for such data to only exist inside replays driven with TMCP (TrackMania Competition Patch), which was believed to be missing for official replays. But i managed to do something that was never done before - get a precise timestamp of all official replays and analyze their TMCP data.

You can look at the data here: Google Sheets.

And here’s how i got it.

Getting the replays

Every top10 record can be downloaded in-game for a fee of 5 coppers (in-game currency). Of course, i don’t have enough coppers to download every replay out there. Fortunately, I figured out a way to download a lot of replays using a different method. It allows me to also download Puzzle replays, which are not possible do download in-game.

On the server only the Personal Best Record is saved, so its not possible to recover older records. But it’s reasonable - they would take too much storage space. To save storage space, the replays are also stored as ghosts - what means that they do not have a map inside. Ghosts are impossible to watch in-game, so the game has to convert them back into replays with a map.

Getting the timestamps

I also figured out that when downloading a replay, a file modification timestamp is sent as well. I verified that it is correct by checking a timestamp of recently driven records.

Interestingly, with big enough sample size, it became apparent that there are no timestamps older than 09 Jan 2012, despite they should be there. There are a lot of timestamps in range from 09 Jan 2012 to 15 Jan 2012, so I believe that in this time range server data migration could have happened. File modification date could have been overwritten during copying.

Data stored in replays

Replays store a bunch of information that can be extracted for analysis:

• CPU kind (Intel/AMD/Other)
• OS kind (It only identifies older versions of Windows)
• Exe checksum (Identifies the version of the game)
• Skin name
• Avatar name
• Horn name

Data stored in replays with Competition Patch

It was previously thought that Competition Patch data vanishes when the replay is uploaded to the server. It was thought so, because when a replay was downloaded in-game, this data was no longer there. But actually it was because of this ghost to replay conversion done by the game, which was not able to keep Competition Patch data. But this data is still stored on the server.

Competition Patch data is stored inside replays in encrypted form. I have access to Competition Patch source code and to the Validator as well - so I was able to validate downloaded replays.

If a replay is driven with Competiton Patch (a modification that is required to upload replays on Nadeo and Classic leaderboards on TMX, but not for official leaderboard) then additional information is stored in the replay - including, but not limited to:

• Date of the record (additional verification of the timestamp)
• Connected input devices

Replay analysis

Information obtained from a large amount of replays together with their timestamp can also be used to analyze player behaviour.

For example, when the values mentioned above are considered unique or rare, e.g. a custom skin/horn/avatar name, or a rare input device, then it can be used to track a player across many accounts, e.g. detecting usage of alt accounts.

More often than not, these values are pretty common, but it is possible to detect when they change. Of course these values might change naturally over time, so by itself it doesnt mean much, but when combined with additional information, it can be used to detect account sharing or account takeover.

Example

Let’s look at replays driven by 92BOB and possible alt accounts: Google Sheets. Thanks to the timestamp data it is possible to find similarities in player activity. These accounts also use the same controller from BigBen/Nacon, which i would consider rare. This data allows with high probablility connect the dots between eddy-ey and 92BOB, which wouldn’t be possible without the data I obtained.

If you appreciate my effort - consider donating :)