Wheew, fair enough. Somehow missed that explanation.

Seems legit, Unity's been doing it for years now. Seems people don't care, either. /smh

Edit: Ayy, no wonder I didn't notice your reply. Word of advice - it really helps to summarize what's under a link for those of us skimming through ;)

First of all, like others i think its really weird that we have to think about how to stop games spying. I really hope it's a bug and not intended. Or they have to make it public everywhere like "No DRM, but ooops... we spy all your data (IP, your game-ID and so on) every time you play a game and we will give it to everyone who asks for it (read the new Terms of Service about privacy)".

Ok... quick answer: 127.0.0.1 is local, don't block it. The rest: block.

Long answer :)
This solution works without GOG-Galaxy only. When you use Galaxy you can't stop it, collecting data is the main job of Galaxy.

The firewall solution works with all GOG games i own.
Re-linking a single IP in the hosts file should work too. But this way is unsafe cause GOG could use more than one IP or the address could be changed with an update of the game etc. And you can't see when it happens.

Firewall:
127.xxx.xxx.xxx are local connections. My firewall has a switch to allow all local connections, so i just can say "block all of the game" and loopbacks are still allowed. if you can't do that, make a basic rule at the top of all other rules that allows all 127... connections, so a later "block all"-rule will only block the rest. Or do it step by step when the firewall message pops up. 127... allow / not 127... block.
Edit: Many Firewalls use lists of "Trusted companies" to allow connections. Check if GOG is in the list and remove it first.

Hosts file (not tested):
Re-linking like this should work (maybe copy/paste it, there is a space in the middle!):

0.0.0.0 46.105.121.139

Never do this with local connections (127.xxx.xxx.xxx).

The dummy thing only worked for "Witcher 3" and was a try and error experiment. I compiled an empty script and renamed the resulting exe file to galaxy.dll. Worked perfect. But we don't know the code of the galaxy.dll (or the game), so we sadly can't write an always working replacement.

I hope it helped a bit.

You're getting +rep from apehater, for chrissakes. lol

*Confused*

Are Galaxy features crashing, or Unity telemetry now.

Thanks for the information - very helpful indeed. A shame that the amended galaxy.dll is not universal though as that would be very useful.

BTW, what firewall do you use? I'm thinking of changing mine to something a little bit more flexible.

Good to see there are top people working on this :-)

Indeed :P


I kid. I love GOG. :D

I apprrrrRRRrrrove of yourrrr picturrrrre ;-)

you use windows, right?

I don't want to start a "What is the best firewall"-fight in here, lol. I use the Comodo firewall atm, its free, but for sure not the best. lets say... it works. But all firewalls should stop in- and outgoing connections and ask for permissions, the difference is the way how to create new rules etc. Check some videos to figure what you like.

GOGs galaxy.dll is sending data to a GOG-server and it's crashing when you block the local loopback connections too. (127.xxx.xxx.xxx). We install the galaxy.dll with nearly ervery GOG game, the installation of GOG Galaxy isn't needed.
I had never problems with blocking Unity.

Once again, cheers for the info. It is the creating of new rules I'd like more control over so will definitely check out some videos.

I don't have Galaxy installed at all.


I also sent in a support request with this same problem, but for your reference, here's the info:


IP address it is trying to access is: 13.33.126.6 -- which resolves to cloudfront / Amazon AWS.

Problem Event Name: APPCRASH
Application Name: BattleTech.exe
Application Version: 5.6.5.64727
Application Timestamp: 5a5de904
Fault Module Name: Galaxy64.dll
Fault Module Version: 1.114.2.0
Fault Module Timestamp: 5a5e0df0
Exception Code: 40000015
Exception Offset: 000000000035b25a
OS Version: 6.1.7601.2.1.0.256.48
Locale ID: 1033
Additional Information 1: a73f
Additional Information 2: a73f7dad24909da5dbb0a6da34d7e344
Additional Information 3: 85f0
Additional Information 4: 85f0b899a53a5e256fbf7a0551f44940

Did apehater hack your account? :P Don't turn as obnoxious as him, please. If you really don't want people to buy on GOG, go outside of the GOG forums.

GOG - cloudfront?
???

I found the two domains hosted on that IP address in my DNS history cache:
# grep '13\.33\.126\.6$' /var/lib/dynaresolve/*
/var/lib/dynaresolve/cf-hls-media.sndcdn.com:13.33.126.6
/var/lib/dynaresolve/config.uca.cloud.unity3d.com:13.33.126.6

cf-hls-media.sndcdn.com is a media server backend for Soundcloud audio media. Not sure what config.uca.cloud.unity3d.com is exactly, but it obviously seems something to do with configuration related to the Unity3D game engine.

There are probably dozens of domains on that IP aside from the two in my DNS history archives, which are hosting back end services for various websites across the web however. Doing forward lookups on those two domains gives me a list of completely different IPs which suggests they're using DNS roundrobin loadbalancing as well.

It's entirely possible that GOG Galaxy, Unity3D, or the game itself is trying to connect to some back end server for something. It could be "latest game news" or something like that, or any number of other innocuous things, or it could be some kind of telemetry gathering, or even a bug in the game.

I don't own that game personally or I would do a network analysis and tell you the exact domain it is trying to connect to. If anyone who owns the game is using a Linux based router, and running a local caching DNS server on it they could enable DNS query logging to find out. Alternatively running tcpdump and capturing DNS packets would serve the same purpose, or even using Wireshark from the Windows machine the game is running on, however that requires some familiarity with network packet analysis.

Another option that might work, is running the Windows Resource Monitor and opening the network tab up, then starting up the game and immediately ALT-TAB out of the game once you are sure it has probably attempted the network access. Look in the network connections for outbound connections from the game and whether it shows an IP or domain name. Chances are the IP address will be different than the one you got before if the domain is load balanced using roundrobin DNS, but you should be able to obtain the domain name at least, which might yield more clues.

Other than that, allowing the access through the firewall and doing a complete network packet dump of the port(s) it is connecting to might be the only way to see what data is being transferred and for what purpose, assuming it is unencrypted. If it is encrypted don't bother, there's no way easily peel back the encryption to analyze the payload.

One thing you can do however, is to add an entry to your Windows hosts.txt file and map a fake local address to the same domain, ie:

127.100.0.1 gamedomain.com

Where "gamedomain.com" is whatever the domain name is that it is connecting to as determined by the above. Note that editing the hosts.txt file may cause some antivirus software to have a heart attack.