R5Reloaded: The End of Identity Spoofing

I think many people know this game under the alias of R5Reloaded, or simply R5(R). TL;DR It is a modification that runs an old build of Apex Legends, in order to allow for community modding and creation of new functionality and gamemodes. In the year of 2023, i reverse engineered some parts of this mod because i was interested in how similar it would be to retail Apex. I also was burnt out from Apex Legends and wanted to try out something new that still somewhat resembled the game i enjoyed analyzing.

In todays post, we’ll talk about what identity spoofing really was, how it worked, and why it was eventually patched. Beware that a large part of this post has been reconstructed by me, it could very well be that my memory of some things turn out to be wrong. However, i made sure to not lean too far out of the window, in order to avoid any sweeping statements and keep the scope strictly to confirmable facts. So let’s start by taking a look at how it worked to begin with.

How it worked

In order to know how identity spoofing has worked in the past, it is important to be aware of how authentication in online video-games is designed. In case of R5Reloaded, the client was responsible for submitting two fields that would play a key role in identification. One was your display Name, the other simply your Nucleus-ID/Origin Account ID. Make sure to remember these two as they are perfect candidates for trolling and impersonation.

To be clear, the dedicated server implementation of R5Reloaded at that time, did not care at all about the validity of the client-controlled identity information. You first had the display name of the player, which was retrieved by origin and then sent to the game server in the connectionless packet challenge. Lastly, you could also control the so called Nucleus-ID as a client.

char* rs::GetWritableIngameName()
{
    return reinterpret_cast<char*>(MOD_BASE("r5apex.exe") + 0x234F35D8);
}
respawn::c_convar* rs::GetWritableNucleusIdCvar()
{
    return ix::cvar->find("platform_user_id");
}
// now you can freely write to rs::GetWritableIngameName(), and also modify the convar value of the Nucleus-ID.

Said numeric ID value was actually used during the ban process. We can easily verify this by checking r5sdk/bansystem.cpp:

bool CBanSystem::IsBanned(const char* ipAddress, const NucleusID_t nucleusId) const
{
	FOR_EACH_VEC(m_BannedList, i)
	{
		const Banned_t& banned = m_BannedList[i];
		if (banned.m_NucleusID == NULL ||
			banned.m_Address.IsEmpty())
		{
			// Cannot be NULL.
			continue;
		}
		if (banned.m_NucleusID == nucleusId ||
			banned.m_Address.IsEqual_CaseInsensitive(ipAddress))
		{
			return true;
		}
	}
	return false;
}

It was really that simple. All you’d have to do is write to both of these values, and after some updates you had to respect a certain identity format. Which is why i later resorted to impersonating other players instead of making up some IGN+Nucleus-ID combination. While doing that i also wanted to answer my question whether the person i am impersonating would get banned in case i was sanctioned by a moderator while playing on their persona.

It turned out that yes, that was indeed the case. You could get other people banned if you cheated on their account or behaved inappropriately, which can also be a ban reason on many R5Reloaded game servers. This didn’t happen just once either. I honestly find it kind of cringe to call it that, because the game server literally did not make any effort to validate what their game client had just sent them.

How it got patched

I’m not going into detail about what they have changed, or how their authentication system works in 2026. All you need to know is that the game server gets transmitted your origin authentication token, and your in-game name and persona/nucleus-ID is cross-referenced with your origin token in order to detect and reject any trivial spoofing attempts. Back when R5R team has released this update, i immediately realized that one of the funniest ways to play a game just died overnight.

It was really a shame it happened, but honestly speaking, i’ve had so much fun in R5Reloaded with this already. I’m glad that they have fixed it and moved on. The first thing i saw while inspecting the new server binaries was the following beauty.

I think later on their full implementation for this authentication stuff was put on their github, inside R5SDK iirc. I never followed through with a proper, second analysis of this new system. I personally already knew that i would stop cheating as much as i used to, if they ever were to patch this “exploit”. And yeah, throughout the last few years i have occasionally been on the game.

However it wasnt nearly as fun as it used to be. I’d rather spend my time on retail Apex, and honestly just capitulate, from here its a gg’s from me.

Their implementation of online authentication was clearly done by someone who understood the origin ecosystem and its authentication mechanics exceptionally well.