The research in brief

I investigated two ways a multiplayer game could continue loading unapproved mods when its validation checks failed or received altered information. I reported the first issue to Studio Wildcard, then built a C# proxy to examine individual validation requests after that approach was patched.

• My role: Traffic analysis, C# tooling, HTTPS inspection, and responsible disclosure.
• Why it mattered: A content restriction could be bypassed when the game continued without a trustworthy validation result.
• Outcome: Both bypasses have since been patched. The first report led to a change requiring API connectivity; my follow-up research examined individual validation checks. This report documents the historical behavior before those fixes.

Technical report

How the research progressed: two bypasses

First bypass: blocking API access through the hosts file

My first bypass was straightforward: users could add a blocking entry for the relevant CurseForge API hostname to the Windows hosts file. During my testing, the game did not enforce a check that the API connection had completed successfully before continuing. When the connection failed, it continued without the expected validation, allowing the mod-loading restriction to be bypassed.

The hosts file changes hostname resolution; it does not filter individual URLs or HTTP requests. In practical terms, my change prevented the relevant API traffic from reaching its intended destination for clients using that hostname mapping. It did not block every CurseForge service or every possible connection method.

The underlying issue was how the game handled a failed validation connection: it allowed the workflow to continue rather than rejecting content when the API was unreachable.

I reported this hosts-file bypass to Studio Wildcard. Following my disclosure, Studio Wildcard updated the game so it no longer allowed access to online services without reaching the API. Blocking the API through the hosts file now prevented online access entirely, making hosts-file blocking useless for bypassing mod restrictions.

This patch forced me to research a new workaround. To investigate how the game processed individual mod-validation traffic when API access was required, I developed my own custom C# proxy to filter traffic and inspect individual API calls used for server mod validation. During this research, I discovered that if you individually drop the connections of the 3 specific validation checks, you can load any mod while retaining online access.

Second bypass: controlling selected requests and responses

To investigate further, I developed my own C# proxy tool using Titanium.Web.Proxy to filter and inspect the game's traffic. I examined the API calls used to validate mods for specific servers, separating those checks from the API connectivity required to access online services.

Through that analysis, I identified three validation checks. In my testing, selectively dropping the connections for those three checks individually allowed me to load any mod I chose while retaining access to online services. This became my second bypass: the game required general API connectivity, but the individual validation checks could still be interrupted without enforcing the intended mod restriction.

Inspecting mod-validation traffic

While loading into a server during my investigation, I observed the validation checks requesting information about verified mods and their attributes. These captures show the file metadata returned through that workflow, including file IDs, download URLs, availability, hashes, and module fingerprints.

Testing my URL-matching expression

While developing the interception rules, I tested a regex-based URL pattern against the metadata endpoint:

https://83374.api.curseforge.com/v1/mods/files

The screenshot below records the matching tool reporting, “The pattern matches the test URL.” This helped me check that the rule recognized the endpoint I intended to target.

The problem I investigated

A mod fingerprint is a value used to identify or compare mod content. I investigated what happened when I changed that fingerprint in an API response before the game received it.

The security question was whether the client could be persuaded to treat modified content as acceptable by changing the metadata used during validation. Information processed on a player's computer can be manipulated, so an authoritative content restriction needs validation that does not depend solely on those client-side inputs.

What I built

I used C#, Titanium.Web.Proxy, Windows proxy configuration, HTTPS interception, and JSON response manipulation to build my research tool.

1. Established a local HTTPS proxy. I created a listener on the loopback address so traffic passed through a process on my own computer.
2. Enabled HTTPS inspection. I created and trusted a local root certificate through the proxy library. This allowed inspection for clients that used the proxy and accepted certificates issued by that authority.
3. Configured Windows traffic routing. I updated the current user's Windows Internet Settings and notified Windows that the proxy settings had changed.
4. Intercepted mod-metadata traffic. I attached request and response handlers that selected the relevant API calls.
5. Changed the validation input. I substituted a specific fingerprint in qualifying JSON responses before returning the response to the client.
6. Controlled HTTP responses. I set status codes and response headers for both blocked requests and rewritten JSON.

Game client -> Local C# HTTPS proxy -> API
Game client <- Modified metadata    <- API response

How my request handler worked

I matched one exact metadata URL and answered it locally with HTTP 403 Forbidden. I set the response's Content-Type header to text/html; charset=utf-8 and supplied a short HTML body.

This let me investigate how the validation workflow behaved when that request was blocked. The effect of request blocking needs to be distinguished from the effect of fingerprint substitution when reproducing the finding.

How my response handler worked

I selected GET requests whose URLs contained the configured API domain and /v1/mods/files path text. After checking that the response contained JSON, I read its decoded body and replaced the original fingerprint with a different fingerprint.

I then returned the rewritten body with HTTP 200 OK and a Content-Type of application/json; charset=utf-8. These were response headers; my implementation did not add authorization headers or replace API credentials. The proxy library handled the underlying HTTP exchange.

The exact replacement was "fingerprint":885506360 to "fingerprint":1925868458. It used literal text matching, so whitespace and formatting could affect whether the replacement occurred. A longer number beginning with the same digits could also be changed unintentionally.

Security impact and scope

My finding concerned the integrity of the mod-loading decision. Accepting unapproved client content in a restricted multiplayer environment undermines the intended content policy. That observation does not, by itself, establish server-side installation, remote code execution, or account compromise.

Installing a trusted local certificate and intercepting traffic does not establish a vulnerability in TLS. The issue I investigated was how the application used the altered metadata when deciding whether content was acceptable.

What I would recommend fixing

My remediation focus is authoritative validation: verify approved content against authenticated metadata and bind that metadata to the actual artifact. A fingerprint supplied through the same mutable channel as the validation input is not an independent authenticity check. Blocked requests, missing metadata, and inconsistent validation results also need explicit rejection behavior.

Skills demonstrated

• C# development: asynchronous event handlers, HTTP processing, and native Windows API calls.
• Network traffic analysis: HTTPS inspection, endpoint filtering, request blocking, and response manipulation.
• Windows configuration: registry-based proxy settings and certificate trust setup.
• Application security: investigation of client-side trust assumptions and content-validation behavior.
• Communication: technical documentation and responsible disclosure.

About my C# proof of concept

The C# example shows the local proxy, request blocking, and fingerprint-response manipulation used in my research.

The code below extracts the proxy functionality from my original loader. It includes the HTTPS listener, certificate setup, Windows proxy configuration, request interception, response headers, HTTP status handling, and fingerprint replacement.

My full loader also included KeyAuth licensing, subscription checks, updates, Steam-folder discovery, and background checks. I left those supporting features out of this public PoC to keep the security mechanism easy to follow.

This version uses one listener port and restores the previous proxy settings on normal exit. My original implementation tried two ports and disabled the proxy on exit. The request and response filters retain the original substring matching and replacement behavior.

Build requirements

The PoC requires Windows, a .NET SDK, and the Titanium.Web.Proxy NuGet package. Create a console project, replace its Program.cs with the accompanying source, and add the package:

dotnet new console -n ModIntegrityResearch
cd ModIntegrityResearch
# Replace Program.cs with FingerprintPoC.cs from this report.
dotnet add package Titanium.Web.Proxy
dotnet run

Certificate trust setup may require elevation. The PoC changes Windows proxy settings and installs a trusted local root certificate, so I would run it in an authorized test environment. Escape performs normal proxy cleanup. The certificate remains installed afterward, and forced termination can prevent proxy restoration.

C# proof of concept

using System;
using System.Collections.Generic;
using System.Net;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading.Tasks;
using Microsoft.Win32;
using Titanium.Web.Proxy;
using Titanium.Web.Proxy.EventArguments;
using Titanium.Web.Proxy.Models;

// Proxy-focused extraction of my original mod-loader research code.
// Requires Windows, a .NET SDK, and Titanium.Web.Proxy.
// Changes the current user's proxy and installs a trusted local root CA.
internal static class Program
{
    private const string OldFingerprint = "885506360";
    private const string NewFingerprint = "1925868458";
    private const string ApiDomain = "api.curseforge.com";
    private const string BlockedUrl = "https://83374.api.curseforge.com/v1/mods/files";
    private const string ProxyKey = @"Software\Microsoft\Windows\CurrentVersion\Internet Settings";
    private static readonly string[] Names = { "ProxyEnable", "ProxyServer", "ProxyOverride" };
    private static readonly Dictionary<string, (object Value, RegistryValueKind Kind)> Saved = new();

    [DllImport("wininet.dll", SetLastError = true)]
    private static extern bool InternetSetOption(IntPtr handle, int option, IntPtr buffer, int length);

    private static void Main()
    {
        var proxy = new ProxyServer();
        bool settingsSaved = false;
        proxy.BeforeRequest += OnBeforeRequest;
        proxy.BeforeResponse += OnBeforeResponse;
        try
        {
            // Inspect HTTPS for clients that use the proxy and trust this CA.
            proxy.CertificateManager.CreateRootCertificate(true);
            proxy.CertificateManager.TrustRootCertificate(true);
            var endpoint = new ExplicitProxyEndPoint(IPAddress.Loopback, 6969, true);
            proxy.AddEndPoint(endpoint);
            proxy.Start();
            SaveProxySettings();
            settingsSaved = true;
            EnableWindowsSystemProxy("127.0.0.1:6969");
            Console.WriteLine("Research proxy listening on 127.0.0.1:6969.");
            Console.WriteLine("Press Escape to stop and restore the previous proxy settings.");
            while (Console.ReadKey(intercept: true).Key != ConsoleKey.Escape) { }
        }
        finally
        {
            try { if (settingsSaved) RestoreProxySettings(); }
            finally
            {
                proxy.BeforeRequest -= OnBeforeRequest;
                proxy.BeforeResponse -= OnBeforeResponse;
                proxy.Stop();
            }
            // The trusted certificate remains installed. Forced termination
            // can bypass cleanup; use an authorized test environment.
        }
    }

    private static Task OnBeforeRequest(object sender, SessionEventArgs e)
    {
        string url = e.HttpClient.Request.RequestUri.AbsoluteUri;
        if (url.Equals(BlockedUrl, StringComparison.OrdinalIgnoreCase))
        {
            e.Ok("<html><body><h1>403 Forbidden: Blocked by research proxy</h1></body></html>");
            e.HttpClient.Response.StatusCode = 403;
            e.HttpClient.Response.Headers.RemoveHeader("Content-Type");
            e.HttpClient.Response.Headers.AddHeader("Content-Type", "text/html; charset=utf-8");
            Console.WriteLine("Blocked the exact metadata endpoint with HTTP 403.");
        }
        return Task.CompletedTask;
    }

    private static async Task OnBeforeResponse(object sender, SessionEventArgs e)
    {
        string url = e.HttpClient.Request.RequestUri.AbsoluteUri;
        // Preserve the original substring-based URL filtering.
        if (!url.Contains(ApiDomain) || !url.Contains("/v1/mods/files") ||
            !e.HttpClient.Request.Method.Equals("GET", StringComparison.OrdinalIgnoreCase))
            return;
        byte[] responseBytes = await e.GetResponseBody();
        if (responseBytes == null || responseBytes.Length == 0) return;
        string contentType = e.HttpClient.Response.ContentType ?? "";
        if (!contentType.Contains("application/json")) return;
        string originalJson = Encoding.UTF8.GetString(responseBytes);
        string patchedJson = originalJson.Replace(
            $"\"fingerprint\":{OldFingerprint}",
            $"\"fingerprint\":{NewFingerprint}");

        // Original status-code and response-header handling.
        e.HttpClient.Response.StatusCode = 200;
        e.HttpClient.Response.Headers.RemoveHeader("Content-Type");
        e.HttpClient.Response.Headers.AddHeader("Content-Type", "application/json; charset=utf-8");
        e.SetResponseBody(Encoding.UTF8.GetBytes(patchedJson));
        Console.WriteLine(originalJson == patchedJson
            ? "Eligible response: no matching fingerprint found."
            : "Replaced the fingerprint in an intercepted JSON response.");
    }

    private static void SaveProxySettings()
    {
        using var key = Registry.CurrentUser.OpenSubKey(ProxyKey)
            ?? throw new InvalidOperationException("Windows Internet Settings key is unavailable.");
        foreach (string name in Names)
        {
            object value = key.GetValue(name);
            if (value != null) Saved[name] = (value, key.GetValueKind(name));
        }
    }

    private static void EnableWindowsSystemProxy(string address)
    {
        using var key = Registry.CurrentUser.OpenSubKey(ProxyKey, writable: true)
            ?? throw new InvalidOperationException("Cannot update Windows proxy settings.");
        key.SetValue("ProxyEnable", 1, RegistryValueKind.DWord);
        key.SetValue("ProxyServer", address, RegistryValueKind.String);
        key.SetValue("ProxyOverride",
            "steamcommunity.com;store.steampowered.com;*.steamcontent.com;*.valvesoftware.com;<local>",
            RegistryValueKind.String);
        RefreshProxySettings();
    }

    private static void RestoreProxySettings()
    {
        using var key = Registry.CurrentUser.OpenSubKey(ProxyKey, writable: true)
            ?? throw new InvalidOperationException("Cannot restore Windows proxy settings.");
        foreach (string name in Names)
        {
            if (Saved.TryGetValue(name, out var saved)) key.SetValue(name, saved.Value, saved.Kind);
            else key.DeleteValue(name, throwOnMissingValue: false);
        }
        RefreshProxySettings();
    }

    private static void RefreshProxySettings()
    {
        InternetSetOption(IntPtr.Zero, 39, IntPtr.Zero, 0);
        InternetSetOption(IntPtr.Zero, 37, IntPtr.Zero, 0);
    }
}