You examine the packets received by the client in response to a discrete action by the client. Recorded enough of these, and you can emulate the server!