A not-fully-working attempt at detecting Hearthstone events by packet sniffing.

index.js

import pcap from 'pcap';
import ProtoBuf from 'protobufjs';
import ByteBuffer from 'bytebuffer';
import glob from 'glob';

const protoPath = __dirname + "/../vendor/hs-proto";

let root = {};
let decoders = {};

glob("**/*.proto", { cwd: protoPath }, function (error, files) {
  if (error === null) {
    var builder = ProtoBuf.newBuilder();
    files.forEach(function (path) {
      var b = ProtoBuf.loadProtoFile({root: protoPath, file: path}, builder);
    });
    root = builder.build();
    Object.keys(root).forEach(function(i) {
      var n = root[i];
      Object.keys(n).forEach(function(j) {
        var m = n[j];
        if(typeof m['PacketID'] !== 'undefined') {
          if(typeof m['PacketID']['ID'] === 'number') {
            decoders[m['PacketID']['ID']] = {
              'name': i + ':' + j,
              'decode': m['decode']
            }
          }
        }
      });
    });
  }
});

let tracker = new pcap.TCPTracker();
let pcap_session = pcap.createSession('en0', "tcp port 3724 or tcp port 1119");

tracker.on('session', (session) => {

  session.on('data send', (e, data) => {
    let id = ByteBuffer.fromBinary(data).readVarint32();
    let decoder = decoders[id]
    if (decoder) {
      console.log("> " + ' ' + id + ' ' + decoder.name);
      try {
        console.log(decoder.decode(data));
      } catch (e) {
        console.log(e.message);
      }
    } else {
      console.log("> " + ' ' + id);
    }
    // ProtoBuf.ByteBuffer.wrap(data).printDebug();
  });

  session.on('data recv', (e, data) => {
    let id = ByteBuffer.fromBinary(data).readVarint32();
    let decoder = decoders[id]
    if (decoder) {
      console.log("< " + ' ' + id + ' ' + decoder.name);
      try {
        console.log(decoder.decode(data));
      } catch (e) {
        console.log(e.message);
      }
    } else {
      console.log("< " + ' ' + id);
    }
  });

  session.on("end", function (e) {
    console.log("stats: ", e.session_stats());
  });
});

pcap_session.on('packet', (raw) => {
  var packet = pcap.decode.packet(raw);
  tracker.track_packet(packet);
});

Cool. Wonder how far you could take this, and use Node to do in game parsing of stuff. Sounds like a fun project!