Disclosure: this is a write-up about my own side project — a combat analytics tool for AION 2. No affiliation with the game's publisher. Links at the end.
Architecture
A Windows desktop app: Rust backend + Tauri v2 webview UI. It passively captures the game's TCP traffic (npcap), reassembles streams, parses the game's undocumented binary protocol, feeds a combat model (damage, heals, buffs, deaths, boss detection), and pushes aggregates to a small JS frontend. Nothing touches the game client — no injection, no memory reading. If the packet didn't say it, we don't know it.
Pain #1: the protocol is a moving target
Nobody hands you a spec. The protocol is varint-heavy, partially compressed, and changes with game patches. You end up doing packet archaeology: capture a fight, stare at hex dumps, correlate "I pressed this skill at 19:32:04" with byte patterns, build a parser, and then — the fun part — keep it alive after every patch, usually reverse-engineering the diff within hours because your users' raids are tonight, not next week.
