Automating Wordfeud

3 minute read

After playing wordfeud for a while I realized that some of the opponents were active during unusual times of the day and never responded to chat messages, suggesting they were bots. To test this theory out I made a bot myself, impersonating the terminator.

Tools used

Python: Primary programming language
Android studio: Running wordfeud on my computer
Fiddler: Mapping the private wordfeud API and debugging
Frida: Disabling SSL-pinning and capturing secure network traffic from wordfeud

Method

Reverse engineering the API

After starting android studio I downloaded the wordfeud APK and signed up with a new account. I now configured frida to run on the android emulator:

I could now start Fiddler and route all data traffic through it by setting it as my proxy. By using the requests module in python I could send customized requests from there.

Note that you first have to enable "Allow remote computers to connect" in Fiddlers settings and install Fiddlers custom SSL certificate in android studio by going to computers local IP-address:8888 and downloading it from there.

Action selection algorithm

I figured a pretty good algorithm would be to always play the move that generated the most amount of points every turn. I downloaded this python library that generates a list of words and their respective points given the board (both the multipliers and the tiles) and the players rack.

Although this worked and the bot preformed quite well, the bot could sometimes get stuck with a rack of unplayable tiles. To counter this I added support for tile swapping in some cases. I also made the bot take some possible counter moves into consideration, as it would sometimes play a 20 point word that set the opponent up for a 200+ point word.

Here is an image of how it preforms after a few days of testing:

Statistics over 228 games. Although far from perfect, the bot largely outperforms the average player (which are really quite good).

Other features

As I had to choose a unique username and icon I thought that the terminator would be fitting, as he, just as my program, was a robot with robot like responses. I also created some triggers for chat messages to the opponent:

Game start --> "I'm back"
Bot plays high scoring word --> "He'll live."
Opponent plays high scoring word --> "Get out."
Bot victory --> "Hasta la vista, baby"
Opponent victory --> "I'll be back"
Random chat message --> "Talk to the hand."
Emoji only chat message --> "🤖"
Question mark in chat message --> "I am not authorized to answer your question."
Opponent congratulating bot in chat --> "I love you, too, sweetheart."

Result

I had a lot of fun during this project, and I also learned more about how private APIs can be mapped effectively. If I ever become comfortable with reinforcement learning I might come back and optimize the move selection.

The bot was banned after a few weeks, but I still believe that my suspicion that some of the opponents might have been bots was correct.