KEMBAR78
ZaCon 4 (2012) - Game Hacking | PDF
Uploaded byHypnZA
871 views

ZaCon 4 (2012) - Game Hacking

Game Hacking discusses various techniques for hacking console, DOS, and Windows games. These include using devices like Game Genie to modify NES games, memory scanning DOS games to change values like health and ammo, hex editing save files, using debuggers like OllyDbg to modify StarCraft map code, and exploiting flaws in game logic or servers. Memory hacking is described as a common technique to achieve hacks like teleporting or speed increases in games like World of Warcraft.

Download to read offline
GAME HACKING by Ross Simpson
About Me: I’m a Ruby on Rails developer at Platform45 - we make web and iOS applications and games: http://www.platform45.com Have been hacking games, off and on, since 2005. Twitter: @hypn Email: ross@hypn.za.net Website: http://www.hypn.za.net
Not Covered: • Latest games - I want to avoid lawsuits and “history repeats itself” (methods shown work for the latest games, eg: DotA 2) • FPS (aim) Bots - typically require DirectX/OpenGL programming knowledge (and I have none) • Android games - I’m an iPhone user, sorry!
DISCLAIMER: The “Terms of Service” / “Terms and Conditions” of most games prevent you from decompiling or modifying game files, or intercepting and manipulating data traffic. Hack creators have been sued for making hacks (under “copyright infringement”). You might get banned from your favourite game.
ZaCon 4 - Game Hacking 1. Console Games 1.1. Game Genie and others
Game Genie Inserted in to the NES before game cartridges.
Game Genie Inserted in to the NES before game cartridges. User is prompted to enter codes, which ultimately overwrote game logic:
Game Genie Inserted in to the NES before game cartridges. User is prompted to enter codes, which ultimately overwrote game logic: infinite lives
Game Genie Inserted in to the NES before game cartridges. User is prompted to enter codes, which ultimately overwrote game logic: infinite lives super powers
Game Genie Inserted in to the NES before game cartridges. User is prompted to enter codes, which ultimately overwrote game logic: infinite lives super powers kill Toad! (change the game)
Game Genie is available for mutliple consoles. Many similar devices and systems have been created, such as the GameShark.
ZaCon 4 - Game Hacking 1. Console Games 2. DOS Games 2.1. Memory Scanning
Game Wizard 32 is a DOS memory scanner
Game Wizard 32 is a DOS memory scanner Search for a value (eg: health, ammo, money) in game
Game Wizard 32 is a DOS memory scanner Search for a value (eg: health, ammo, money) in game Keep searching for the value, as is it changes
Game Wizard 32 is a DOS memory scanner Search for a value (eg: health, ammo, money) in game Keep searching for the value, as is it changes Find the correct memory address (trial and error)
Game Wizard 32 is a DOS memory scanner Search for a value (eg: health, ammo, money) in game Keep searching for the value, as is it changes Find the correct memory address (trial and error) Enter a new value, and “freeze” it if desired
Game Wizard 32 is a DOS memory scanner Search for a value (eg: health, ammo, money) in game Keep searching for the value, as is it changes Find the correct memory address (trial and error) Enter a new value, and “freeze” it if desired God mode!
ZaCon 4 - Game Hacking 1. Console Games 2. DOS Games 2.1. Memory Scanning 2.2. Hex Editing save games
Take note of the value (eg: health, ammo, money) in game to be changed, and create a save game
Take note of the value (eg: health, ammo, money) in game to be changed, and create a save game Open the save game and find the hex value of the amount (bytes might be switched) 1000 = 03E8 in hex
Take note of the value (eg: health, ammo, money) in game to be changed, and create a save game Open the save game and find the hex value of the amount (bytes might be switched) 1000 = 03E8 in hex Overwrite with the new value (trial and error) 31337 = 7A69 in hex
Take note of the value (eg: health, ammo, money) in game to be changed, and create a save game Open the save game and find the hex value of the amount (bytes might be switched) 1000 = 03E8 in hex Overwrite with the new value (trial and error) 31337 = 7A69 in hex Profit!
ZaCon 4 - Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 3.1. Diablo 1 & Memory Scanning
MHS (“Memory Hacking Software”) is a great Windows memory scanner
MHS (“Memory Hacking Software”) is a great Windows memory scanner Some game mechanics are available to the game client even if not shown
MHS (“Memory Hacking Software”) is a great Windows memory scanner Some game mechanics are available to the game client even if not shown Eg:Wirt’s “Cape of Health” in Diablo 1
MHS (“Memory Hacking Software”) is a great Windows memory scanner Some game mechanics are available to the game client even if not shown Eg:Wirt’s “Cape of Health” in Diablo 1 Doing a “string” search for it in MHS...
MHS (“Memory Hacking Software”) is a great Windows memory scanner Some game mechanics are available to the game client even if not shown Eg:Wirt’s “Cape of Health” in Diablo 1 Doing a “string” search for it in MHS... finds the address, which can be read in the future.
Diablo 1 had no multiplayer “state” checking Game clients dictated the stats of their character to each other (peer to peer, via Battle.Net) Character stats could be changed Items could be exported, imported and modified Custom items could be created (eg:“Zacon Item of L33tn3ss”)
ZaCon 4 - Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 3.1. Diablo 1 & Memory Scanning 3.2. StarCraft 1 map hack with OllyDbg (debugger)
Making of a StarCraft map hack: 1. explore a new area, and search for “unknown” data
Making of a StarCraft map hack: 1. explore a new area, and search for “unknown” data 2. leave the area, and search again
Making of a StarCraft map hack: 1. explore a new area, and search for “unknown” data 2. leave the area, and search again 3. repeat until “suspicious” results are found (lots of addresses changing between two values, in order) 4. copy one of these addresses
Making of a StarCraft map hack: 5. attach OllyDbg to the game, and put a breakpoint on the memory address
Making of a StarCraft map hack: 5. attach OllyDbg to the game, and put a breakpoint on the memory address 6. wait for the game to pause (map being redrawn)
Making of a StarCraft map hack: 5. attach OllyDbg to the game, and put a breakpoint on the memory address 6. wait for the game to pause (map being redrawn) 7. modify the code to always set the “shown” value (jump to code cave if necessary)
Making of a StarCraft map hack: 5. attach OllyDbg to the game, and put a breakpoint on the memory address 6. wait for the game to pause (map being redrawn) 7. modify the code to always set the “shown” value (jump to code cave if necessary) Map hack! (in multiplayer)
Unlike Diablo 1, StarCraft has “state” checking, so values couldn’t just be modified... ... (flawed) game logic has to be exploited “The Zerg Mineral Hack works by sending a command that tells a larva to morph into an invalid unit, which is worth 564 minerals.Then, the morphing auto-cancels (it's a feature of the hack, not the exploit) and the player receives 514 extra minerals.” - Zynastor
Unlike Diablo 1, StarCraft has “state” checking, so values couldn’t just be modified... ... (flawed) game logic has to be exploited “The Zerg Mineral Hack works by sending a command that tells a larva to morph into an invalid unit, which is worth 564 minerals.Then, the morphing auto-cancels (it's a feature of the hack, not the exploit) and the player receives 514 extra minerals.” - Zynastor
Unlike Diablo 1, StarCraft has “state” checking, so values couldn’t just be modified... ... (flawed) game logic has to be exploited “The Zerg Mineral Hack works by sending a command that tells a larva to morph into an invalid unit, which is worth 564 minerals.Then, the morphing auto-cancels (it's a feature of the hack, not the exploit) and the player receives 514 extra minerals.” - Zynastor
Unlike Diablo 1, StarCraft has “state” checking, so values couldn’t just be modified... ... (flawed) game logic has to be exploited 1600 minerals, seconds in to the game, and counting! “The Zerg Mineral Hack works by sending a command that tells a larva to morph into an invalid unit, which is worth 564 minerals.Then, the morphing auto-cancels (it's a feature of the hack, not the exploit) and the player receives 514 extra minerals.” - Zynastor
ZaCon 4 - Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 3.3. World of Warcraft & more memory hacks
“Memory Hacking” is often thought to be simple, limiting, and “lame” Many hacks can be achieved by changing, or freezing, memory values: Teleporting, flying, no- clipping, speed hacks, etc
“Memory Hacking” is often thought to be simple, limiting, and “lame” Many hacks can be achieved by changing, or freezing, memory values: Teleporting, flying, no- clipping, speed hacks, etc Spammers make use of them
“Memory Hacking” is often thought to be simple, limiting, and “lame” Many hacks can be achieved by changing, or freezing, memory values: Teleporting, flying, no- clipping, speed hacks, etc Spammers make use of them Sometimes “restricted” Spell IDs are found, and used, by non-GameMasters, resulting in mass (in-game) death
ZaCon 4 - Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 3.3. World of Warcraft & more memory hacks 3.4. Kartograph
“Kartograph”, shown at Defcon 18, takes an interesting approach to game hacks: Game memory is monitored
“Kartograph”, shown at Defcon 18, takes an interesting approach to game hacks: Game memory is monitored, and shown as a “heat map”, making identifying data, and making (especially map) hacks, much quicker and easier I can’t do them enough justice in these slides, visit http://elie.im/talks/kartograph to learn more about it!
ZaCon 4 - Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 3.5. Ultima Online “POL” server exploitation with W32Dasm
“POL”, an Ultima Online server emulator, stores it’s data in key-value based text files. An advisory was mailed out, suggesting that if someone where to insert a “newline” character additional properties could be inserted. Luckily this was deemed impossible ;) So I set out to do it...
Game clients often restrict input, but we can put in “markers” (the third “A” in this case)
Game clients often restrict input, but we can put in “markers” (the third “A” in this case), and then search for it’s hex value in memory...
Game clients often restrict input, but we can put in “markers” (the third “A” in this case), and then search for it’s hex value in memory... (changing it,
Game clients often restrict input, but we can put in “markers” (the third “A” in this case), and then search for it’s hex value in memory... (changing it, and searching for it’s new value, until we find it)
Game clients often restrict input, but we can put in “markers” (the third “A” in this case), and then search for it’s hex value in memory... (changing it, and searching for it’s new value, until we find it) ... and then replacing it with something like, like a newline
Game clients often restrict input, but we can put in “markers” (the third “A” in this case), and then search for it’s hex value in memory... (changing it, and searching for it’s new value, until we find it) ... and then replacing it with something like, like a newline
Game clients often restrict input, but we can put in “markers” (the third “A” in this case), and then search for it’s hex value in memory... (changing it, and searching for it’s new value, until we find it) ... and then replacing it with something like, like a newline (or something else more malicious?) Game clients don’t always like us doing that... BUT...
W32Dasm (aka WinDasm) is a decompiler which can find text strings in an application
W32Dasm (aka WinDasm) is a decompiler which can find text strings in an application, and show us the code around them In this case there’s a “Conditional” jump from 0041EC75
W32Dasm (aka WinDasm) is a decompiler which can find text strings in an application, and show us the code around them In this case there’s a “Conditional” jump from 0041EC75 Which performs some kind of checking, and then jumps to the code with the string in, if the condition is met. We can make note of the offset (0001EC75)...
... and open the file, going to that location, in a hexeditor Where we see the same hex codes
... and open the file, going to that location, in a hexeditor Where we see the same hex codes Changing them to “90”s...
... and open the file, going to that location, in a hexeditor Where we see the same hex codes Changing them to “90”s... “nop”s them out “nop”s basically mean “do nothing” (“No Operation”) - in this case, never error on invalid characters
The “CmdLevel test” payload after our marker would give your character GameMaster powers. This has been fixed in more recent POL versions - for character names, but theoretically every text input (such as naming pets) may still be vulnerable
ZaCon 4 - Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 4. iPhone / iPad Games 4.1. Non-Jailbroken hacks - modifying “plist” and other config files
iPhone games can be hacked, to some degree, without jailbreaking
iPhone games can be hacked, to some degree, without jailbreaking Using a program like “iExplorer” game files can be accessed
iPhone games can be hacked, to some degree, without jailbreaking Using a program like “iExplorer” game files can be accessed, and changed (eg: changing a high-score, and setting scores as not have been sent yet)
iPhone games can be hacked, to some degree, without jailbreaking Using a program like “iExplorer” game files can be accessed, and changed (eg: changing a high-score, and setting scores as not have been sent yet) The next time the game is run, the scores are updated!
Some games “lock” content until certain levels or scores are reached (or payments have been made)
Some games “lock” content until certain levels or scores are reached (or payments have been made) Often these “locks” are controlled in config files (look out for “ini”,“plist” and “sqlite” files!)
Some games “lock” content until certain levels or scores are reached (or payments have been made) Often these “locks” are controlled in config files (look out for “ini”,“plist” and “sqlite” files!) Changing “0” values to “1”s often does the trick
Some games “lock” content until certain levels or scores are reached (or payments have been made) Often these “locks” are controlled in config files (look out for “ini”,“plist” and “sqlite” files!) Changing “0” values to “1”s often does the trick Unlocked!
Tools like Burp Suite, and mitmproxy, can be used to intercept game traffic
Tools like Burp Suite, and mitmproxy, can be used to intercept game traffic And re-write values, such as XP, gold, scores, or “premium” (paid-for) credits mitmproxy lets you write scripts to do this automatically
ZaCon 4 - Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 4. iPhone / iPad Games 4.2. Jailbroken hacks - decompiling with IDA Pro
iOS games are encrypted when downloaded from the App Store Calculating offsets, using “gdb” to dump memory, and trial and error byte switching can decrypt apps... OR... A jailbroken app called “clutch” can be used to decrypt them quickly and easily
Decrypted iOS apps can be opened in “IDA Pro” - be sure to set the “Processor type” to “ARM” though!
Decrypted iOS apps can be opened in “IDA Pro” - be sure to set the “Processor type” to “ARM” though! Analysis will run, displaying function names on the left, allowing you to view their actions Un-wanted commands can be found, their offsets noted (0011A508)
Decrypted iOS apps can be opened in “IDA Pro” - be sure to set the “Processor type” to “ARM” though! Analysis will run, displaying function names on the left, allowing you to view their actions Un-wanted commands can be found, their offsets noted (0011A508), the application file opened in a hex editor
Decrypted iOS apps can be opened in “IDA Pro” - be sure to set the “Processor type” to “ARM” though! Analysis will run, displaying function names on the left, allowing you to view their actions Un-wanted commands can be found, their offsets noted (0011A508), the application file opened in a hex editor, and them edited out (00’s work as NOPs in ARM)
NOTE: after modifying an iOS application (and re- uploading it to your device), you will need to “sign” it with “ldone” (from Cydia) Your device will probably need to be restarted before the app will run
NOTE: after modifying an iOS application (and re- uploading it to your device), you will need to “sign” it with “ldone” (from Cydia) Your device will probably need to be restarted before the app will run The game WordsWithFriends has a “isValidMove” method...
NOTE: after modifying an iOS application (and re- uploading it to your device), you will need to “sign” it with “ldone” (from Cydia) Your device will probably need to be restarted before the app will run The game WordsWithFriends has a “isValidMove” method... ... which could be set to always return true - the server, and other clients, don’t seem to care!
Recommended Reading: 1. “Exploiting Online Games: Cheating Massively Distributed Systems” - Greg Hoglund & Gary McGraw 2. “Hacking and Securing iOS Applications” - Jonathan Zdziarski 3. Forums: http://www.blizzhackers.cc & http://www.mpgh.net/forum/
Real world concerns? 1. Bypass string terminators in saved games to buffer overflow and root devices? (eg: PSP - http://pspslimhacks.com/psp-6-20-save- data-exploit-released-hello-world-6-20/) 2. Send malicious (code execution?) instructions to multiplayer clients (eg: Starcraft forced map download hack) 3. Send XSS or SQL injection to “high score” severs not checking or filtering input
Thanks! Questions?

More Related Content

DOCX
Mulu Caves
bystevenfelixcho
 
PPT
Computer Chess 2004
bySushi Projet 2010
 
PDF
Item generation using rule based randomization algorithms in RPG games
byRejosh Samuel
 
PDF
RuneStone_Keeper_2015_2_5
byTing Sun
 
PPTX
Developers vs Cybercriminals: Protecting your MMO from online crime
byEn Masse Entertainment
 
DOCX
Task 2 research
byamybrockbank
 
DOCX
Endless vision gdd_revised_1214
byLisa Lee
 
DOCX
Seagate game-drive-for-xbox
byssuser1eca7d
 
Mulu Caves
bystevenfelixcho
 
Computer Chess 2004
bySushi Projet 2010
 
Item generation using rule based randomization algorithms in RPG games
byRejosh Samuel
 
RuneStone_Keeper_2015_2_5
byTing Sun
 
Developers vs Cybercriminals: Protecting your MMO from online crime
byEn Masse Entertainment
 
Task 2 research
byamybrockbank
 
Endless vision gdd_revised_1214
byLisa Lee
 
Seagate game-drive-for-xbox
byssuser1eca7d
 

What's hot

DOCX
11thDimensionStudios_GDD_Final_0915
byBlake Taylor
 
PDF
Manual
byhrm500
 
DOC
I Love SpongeBob XBox Vs PS4 Gammers
byBusiness and financial Information Resources, Inc.
 
PPSX
Akshay-UNIT 20-LO-1,2,3&4-FINAL
byAkshay
 
DOCX
Work flow
byDeightonater
 
PPTX
Mongo or Die: How MongoDB Powers Doodle or Die
byAaron Silverman
 
PDF
Lordmancer II ICO deck
byIlya Mikov
 
PDF
Ethereum dapps list you need to know in 2018
byAli Raza
 
PPTX
MongoDC 2012: How MongoDB Powers Doodle or Die
byMongoDB
 
DOCX
Assignment 1
byLuke Summers
 
PDF
IkaLog: Data Collector for Splatoon and Machine Learning
byTakeshi HASEGAWA
 
PDF
Disk partition alignment
byPaolo Pedaletti
 
PPTX
2spookyAction adventure
byBenWhite101
 
DOCX
Task 2 research
byamybrockbank
 
DOCX
Task 2 research
byamybrockbank
 
PDF
Xcite.com Gamer’s Guide
byGianluca Girard
 
PDF
Space Brawl Game Design Document
byryanhorbal
 
DOCX
Awea
byMoazam Ali
 
TXT
Super heroes training_simulator
byjoustin12
 
PPT
Reviewing A Game - The Orange Box
byAmar Nath
 
11thDimensionStudios_GDD_Final_0915
byBlake Taylor
 
Manual
byhrm500
 
I Love SpongeBob XBox Vs PS4 Gammers
byBusiness and financial Information Resources, Inc.
 
Akshay-UNIT 20-LO-1,2,3&4-FINAL
byAkshay
 
Work flow
byDeightonater
 
Mongo or Die: How MongoDB Powers Doodle or Die
byAaron Silverman
 
Lordmancer II ICO deck
byIlya Mikov
 
Ethereum dapps list you need to know in 2018
byAli Raza
 
MongoDC 2012: How MongoDB Powers Doodle or Die
byMongoDB
 
Assignment 1
byLuke Summers
 
IkaLog: Data Collector for Splatoon and Machine Learning
byTakeshi HASEGAWA
 
Disk partition alignment
byPaolo Pedaletti
 
2spookyAction adventure
byBenWhite101
 
Task 2 research
byamybrockbank
 
Task 2 research
byamybrockbank
 
Xcite.com Gamer’s Guide
byGianluca Girard
 
Space Brawl Game Design Document
byryanhorbal
 
Awea
byMoazam Ali
 
Super heroes training_simulator
byjoustin12
 
Reviewing A Game - The Orange Box
byAmar Nath
 

Similar to ZaCon 4 (2012) - Game Hacking

PDF
Beat Your Mom At Solitaire—Reverse Engineering of Computer Games
byChristoph Matthies
 
PDF
Боремся с читингом в онлайн-играх
byPositive Hack Days
 
PPT
Hacking
bygotchagirl
 
PDF
Introduction to Game Programming
byRichard Jones
 
PPTX
playing the forensics game
byPeter Clemenko III
 
PDF
[HUN] Hackersuli - Console and arcade game hacking – history, present, future
byhackersuli
 
PPT
Hackathon 2013 - The Art Of Cheating In Games
bySouhail Hammou
 
PDF
FreeMobileHacks
byTianahuggins
 
PPTX
Project KidHack - Teaching Kids Security through Gaming at BSidesTampa on Feb...
bygrecsl
 
PDF
En game hacking
byRahmad Kurniawan
 
PPTX
Swords and sandals 2 flash game hacks
byJudithFeist965
 
PDF
Top 10 Hacking Games for Aspiring Ethical Hackers [2025].pdf
bymanisha06650
 
PPTX
Rmd mithdd 20130305
bySheepy D.
 
PDF
Ce hv6 module 51 hacking and cheating online games
byVi Tính Hoàng Nam
 
PPTX
HKUST Security Lab Opening Ceremony
byKelvin Chan
 
PDF
Preserving arcade games - 31c3
byAnge Albertini
 
PDF
Cheating in Computer Games
byIftach Ian Amit
 
PPT
Semlsprograms+Corecollections92007
byBeth Gallaway
 
PPTX
Video Game Security
byCigital
 
PPTX
Project Kid Hack - Teaching Kids Security through Gaming at BSidesDE on Novem...
bygrecsl
 
Beat Your Mom At Solitaire—Reverse Engineering of Computer Games
byChristoph Matthies
 
Боремся с читингом в онлайн-играх
byPositive Hack Days
 
Hacking
bygotchagirl
 
Introduction to Game Programming
byRichard Jones
 
playing the forensics game
byPeter Clemenko III
 
[HUN] Hackersuli - Console and arcade game hacking – history, present, future
byhackersuli
 
Hackathon 2013 - The Art Of Cheating In Games
bySouhail Hammou
 
FreeMobileHacks
byTianahuggins
 
Project KidHack - Teaching Kids Security through Gaming at BSidesTampa on Feb...
bygrecsl
 
En game hacking
byRahmad Kurniawan
 
Swords and sandals 2 flash game hacks
byJudithFeist965
 
Top 10 Hacking Games for Aspiring Ethical Hackers [2025].pdf
bymanisha06650
 
Rmd mithdd 20130305
bySheepy D.
 
Ce hv6 module 51 hacking and cheating online games
byVi Tính Hoàng Nam
 
HKUST Security Lab Opening Ceremony
byKelvin Chan
 
Preserving arcade games - 31c3
byAnge Albertini
 
Cheating in Computer Games
byIftach Ian Amit
 
Semlsprograms+Corecollections92007
byBeth Gallaway
 
Video Game Security
byCigital
 
Project Kid Hack - Teaching Kids Security through Gaming at BSidesDE on Novem...
bygrecsl
 

Recently uploaded

PPTX
Session 5 - Specialized AI Associate Series: Build a Document Understanding ...
byDianaGray10
 
PDF
The invisible key: Securing the new attack vector of OAuth tokens
byGianluca Varisco
 
PPTX
"Daily workflows with Cursor IDE", Maksym Anisimov
byFwdays
 
PPTX
"Towards React Server Components in Clojure", Roman Liutikov
byFwdays
 
PDF
From Bots to Brains: Getting Started with Agentic Automation in UiPath
byUiPathCommunity
 
PDF
How to Measure Microsoft 365 Copilot Success and Manage AI Risk: Advanced Str...
byNikki Chapple
 
PDF
Beyond Generative AI: Creating Demand for Compute in the 2030s
byReidar Wasenius
 
PDF
Ethical Initiatives in AI and accountability.pdf
byShiwani Gupta
 
PDF
From Data Chaos to Copilot Confidence: A Step-by-Step Microsoft 365 Copilot R...
byNikki Chapple
 
PDF
The Journey Is The Reward - Apple Maps Travel Companion
byJohn Andrews
 
PDF
UiPath DevConnect 2025: Introduction to Agentic Automation
byDianaGray10
 
PDF
AGV PROTOCOL BRAND KIT COMPLETE VIEW.pdf
byfagbolade
 
PDF
A 4-Terminal Approach to Validating Charge Conservation in MOSFET Compact Models
byEalwan Lee
 
PDF
Cassandra vs. ScyllaDB: Evolutionary Differences
byScyllaDB
 
PDF
Ask Me Anything About AI Assist: Practical Answers for Real Workflows
bySafe Software
 
PPTX
BioVault.net ADW 2025 CODATA: SyftBox: a General Purpose Solution for Data Vi...
byMadhava Jay
 
PPTX
Top Trends in Kubernetes Security: TalosCon 2025
byCheryl Hung
 
PDF
2025 October Patch Tuesday
byIvanti
 
PDF
Session 2 - Agentic Orchestration with UiPath Maestro
byDianaGray10
 
PDF
UnityNet Digital Sovereignty Checklist 2025-10-13
byLHelferty
 
Session 5 - Specialized AI Associate Series: Build a Document Understanding ...
byDianaGray10
 
The invisible key: Securing the new attack vector of OAuth tokens
byGianluca Varisco
 
"Daily workflows with Cursor IDE", Maksym Anisimov
byFwdays
 
"Towards React Server Components in Clojure", Roman Liutikov
byFwdays
 
From Bots to Brains: Getting Started with Agentic Automation in UiPath
byUiPathCommunity
 
How to Measure Microsoft 365 Copilot Success and Manage AI Risk: Advanced Str...
byNikki Chapple
 
Beyond Generative AI: Creating Demand for Compute in the 2030s
byReidar Wasenius
 
Ethical Initiatives in AI and accountability.pdf
byShiwani Gupta
 
From Data Chaos to Copilot Confidence: A Step-by-Step Microsoft 365 Copilot R...
byNikki Chapple
 
The Journey Is The Reward - Apple Maps Travel Companion
byJohn Andrews
 
UiPath DevConnect 2025: Introduction to Agentic Automation
byDianaGray10
 
AGV PROTOCOL BRAND KIT COMPLETE VIEW.pdf
byfagbolade
 
A 4-Terminal Approach to Validating Charge Conservation in MOSFET Compact Models
byEalwan Lee
 
Cassandra vs. ScyllaDB: Evolutionary Differences
byScyllaDB
 
Ask Me Anything About AI Assist: Practical Answers for Real Workflows
bySafe Software
 
BioVault.net ADW 2025 CODATA: SyftBox: a General Purpose Solution for Data Vi...
byMadhava Jay
 
Top Trends in Kubernetes Security: TalosCon 2025
byCheryl Hung
 
2025 October Patch Tuesday
byIvanti
 
Session 2 - Agentic Orchestration with UiPath Maestro
byDianaGray10
 
UnityNet Digital Sovereignty Checklist 2025-10-13
byLHelferty
 

ZaCon 4 (2012) - Game Hacking

  • 1.
  • 2.
    About Me: I’m aRuby on Rails developer at Platform45 - we make web and iOS applications and games: http://www.platform45.com Have been hacking games, off and on, since 2005. Twitter: @hypn Email: ross@hypn.za.net Website: http://www.hypn.za.net
  • 3.
    Not Covered: • Latestgames - I want to avoid lawsuits and “history repeats itself” (methods shown work for the latest games, eg: DotA 2) • FPS (aim) Bots - typically require DirectX/OpenGL programming knowledge (and I have none) • Android games - I’m an iPhone user, sorry!
  • 4.
    DISCLAIMER: The “Terms ofService” / “Terms and Conditions” of most games prevent you from decompiling or modifying game files, or intercepting and manipulating data traffic. Hack creators have been sued for making hacks (under “copyright infringement”). You might get banned from your favourite game.
  • 5.
    ZaCon 4 -Game Hacking 1. Console Games 1.1. Game Genie and others
  • 6.
    Game Genie Inserted into the NES before game cartridges.
  • 7.
    Game Genie Inserted into the NES before game cartridges. User is prompted to enter codes, which ultimately overwrote game logic:
  • 8.
    Game Genie Inserted into the NES before game cartridges. User is prompted to enter codes, which ultimately overwrote game logic: infinite lives
  • 9.
    Game Genie Inserted into the NES before game cartridges. User is prompted to enter codes, which ultimately overwrote game logic: infinite lives super powers
  • 10.
    Game Genie Inserted into the NES before game cartridges. User is prompted to enter codes, which ultimately overwrote game logic: infinite lives super powers kill Toad! (change the game)
  • 11.
    Game Genie isavailable for mutliple consoles. Many similar devices and systems have been created, such as the GameShark.
  • 12.
    ZaCon 4 -Game Hacking 1. Console Games 2. DOS Games 2.1. Memory Scanning
  • 13.
    Game Wizard 32is a DOS memory scanner
  • 14.
    Game Wizard 32is a DOS memory scanner Search for a value (eg: health, ammo, money) in game
  • 15.
    Game Wizard 32is a DOS memory scanner Search for a value (eg: health, ammo, money) in game Keep searching for the value, as is it changes
  • 16.
    Game Wizard 32is a DOS memory scanner Search for a value (eg: health, ammo, money) in game Keep searching for the value, as is it changes Find the correct memory address (trial and error)
  • 17.
    Game Wizard 32is a DOS memory scanner Search for a value (eg: health, ammo, money) in game Keep searching for the value, as is it changes Find the correct memory address (trial and error) Enter a new value, and “freeze” it if desired
  • 18.
    Game Wizard 32is a DOS memory scanner Search for a value (eg: health, ammo, money) in game Keep searching for the value, as is it changes Find the correct memory address (trial and error) Enter a new value, and “freeze” it if desired God mode!
  • 19.
    ZaCon 4 -Game Hacking 1. Console Games 2. DOS Games 2.1. Memory Scanning 2.2. Hex Editing save games
  • 20.
    Take note ofthe value (eg: health, ammo, money) in game to be changed, and create a save game
  • 21.
    Take note ofthe value (eg: health, ammo, money) in game to be changed, and create a save game Open the save game and find the hex value of the amount (bytes might be switched) 1000 = 03E8 in hex
  • 22.
    Take note ofthe value (eg: health, ammo, money) in game to be changed, and create a save game Open the save game and find the hex value of the amount (bytes might be switched) 1000 = 03E8 in hex Overwrite with the new value (trial and error) 31337 = 7A69 in hex
  • 23.
    Take note ofthe value (eg: health, ammo, money) in game to be changed, and create a save game Open the save game and find the hex value of the amount (bytes might be switched) 1000 = 03E8 in hex Overwrite with the new value (trial and error) 31337 = 7A69 in hex Profit!
  • 24.
    ZaCon 4 -Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 3.1. Diablo 1 & Memory Scanning
  • 25.
    MHS (“Memory Hacking Software”)is a great Windows memory scanner
  • 26.
    MHS (“Memory Hacking Software”)is a great Windows memory scanner Some game mechanics are available to the game client even if not shown
  • 27.
    MHS (“Memory Hacking Software”)is a great Windows memory scanner Some game mechanics are available to the game client even if not shown Eg:Wirt’s “Cape of Health” in Diablo 1
  • 28.
    MHS (“Memory Hacking Software”)is a great Windows memory scanner Some game mechanics are available to the game client even if not shown Eg:Wirt’s “Cape of Health” in Diablo 1 Doing a “string” search for it in MHS...
  • 29.
    MHS (“Memory Hacking Software”)is a great Windows memory scanner Some game mechanics are available to the game client even if not shown Eg:Wirt’s “Cape of Health” in Diablo 1 Doing a “string” search for it in MHS... finds the address, which can be read in the future.
  • 30.
    Diablo 1 hadno multiplayer “state” checking Game clients dictated the stats of their character to each other (peer to peer, via Battle.Net) Character stats could be changed Items could be exported, imported and modified Custom items could be created (eg:“Zacon Item of L33tn3ss”)
  • 31.
    ZaCon 4 -Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 3.1. Diablo 1 & Memory Scanning 3.2. StarCraft 1 map hack with OllyDbg (debugger)
  • 32.
    Making of aStarCraft map hack: 1. explore a new area, and search for “unknown” data
  • 33.
    Making of aStarCraft map hack: 1. explore a new area, and search for “unknown” data 2. leave the area, and search again
  • 34.
    Making of aStarCraft map hack: 1. explore a new area, and search for “unknown” data 2. leave the area, and search again 3. repeat until “suspicious” results are found (lots of addresses changing between two values, in order) 4. copy one of these addresses
  • 35.
    Making of aStarCraft map hack: 5. attach OllyDbg to the game, and put a breakpoint on the memory address
  • 36.
    Making of aStarCraft map hack: 5. attach OllyDbg to the game, and put a breakpoint on the memory address 6. wait for the game to pause (map being redrawn)
  • 37.
    Making of aStarCraft map hack: 5. attach OllyDbg to the game, and put a breakpoint on the memory address 6. wait for the game to pause (map being redrawn) 7. modify the code to always set the “shown” value (jump to code cave if necessary)
  • 38.
    Making of aStarCraft map hack: 5. attach OllyDbg to the game, and put a breakpoint on the memory address 6. wait for the game to pause (map being redrawn) 7. modify the code to always set the “shown” value (jump to code cave if necessary) Map hack! (in multiplayer)
  • 39.
    Unlike Diablo 1,StarCraft has “state” checking, so values couldn’t just be modified... ... (flawed) game logic has to be exploited “The Zerg Mineral Hack works by sending a command that tells a larva to morph into an invalid unit, which is worth 564 minerals.Then, the morphing auto-cancels (it's a feature of the hack, not the exploit) and the player receives 514 extra minerals.” - Zynastor
  • 40.
    Unlike Diablo 1,StarCraft has “state” checking, so values couldn’t just be modified... ... (flawed) game logic has to be exploited “The Zerg Mineral Hack works by sending a command that tells a larva to morph into an invalid unit, which is worth 564 minerals.Then, the morphing auto-cancels (it's a feature of the hack, not the exploit) and the player receives 514 extra minerals.” - Zynastor
  • 41.
    Unlike Diablo 1,StarCraft has “state” checking, so values couldn’t just be modified... ... (flawed) game logic has to be exploited “The Zerg Mineral Hack works by sending a command that tells a larva to morph into an invalid unit, which is worth 564 minerals.Then, the morphing auto-cancels (it's a feature of the hack, not the exploit) and the player receives 514 extra minerals.” - Zynastor
  • 42.
    Unlike Diablo 1,StarCraft has “state” checking, so values couldn’t just be modified... ... (flawed) game logic has to be exploited 1600 minerals, seconds in to the game, and counting! “The Zerg Mineral Hack works by sending a command that tells a larva to morph into an invalid unit, which is worth 564 minerals.Then, the morphing auto-cancels (it's a feature of the hack, not the exploit) and the player receives 514 extra minerals.” - Zynastor
  • 43.
    ZaCon 4 -Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 3.3. World of Warcraft & more memory hacks
  • 44.
    “Memory Hacking” isoften thought to be simple, limiting, and “lame” Many hacks can be achieved by changing, or freezing, memory values: Teleporting, flying, no- clipping, speed hacks, etc
  • 45.
    “Memory Hacking” isoften thought to be simple, limiting, and “lame” Many hacks can be achieved by changing, or freezing, memory values: Teleporting, flying, no- clipping, speed hacks, etc Spammers make use of them
  • 46.
    “Memory Hacking” isoften thought to be simple, limiting, and “lame” Many hacks can be achieved by changing, or freezing, memory values: Teleporting, flying, no- clipping, speed hacks, etc Spammers make use of them Sometimes “restricted” Spell IDs are found, and used, by non-GameMasters, resulting in mass (in-game) death
  • 47.
    ZaCon 4 -Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 3.3. World of Warcraft & more memory hacks 3.4. Kartograph
  • 48.
    “Kartograph”, shown at Defcon18, takes an interesting approach to game hacks: Game memory is monitored
  • 49.
    “Kartograph”, shown at Defcon18, takes an interesting approach to game hacks: Game memory is monitored, and shown as a “heat map”, making identifying data, and making (especially map) hacks, much quicker and easier I can’t do them enough justice in these slides, visit http://elie.im/talks/kartograph to learn more about it!
  • 50.
    ZaCon 4 -Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 3.5. Ultima Online “POL” server exploitation with W32Dasm
  • 51.
    “POL”, an UltimaOnline server emulator, stores it’s data in key-value based text files. An advisory was mailed out, suggesting that if someone where to insert a “newline” character additional properties could be inserted. Luckily this was deemed impossible ;) So I set out to do it...
  • 52.
    Game clients oftenrestrict input, but we can put in “markers” (the third “A” in this case)
  • 53.
    Game clients oftenrestrict input, but we can put in “markers” (the third “A” in this case), and then search for it’s hex value in memory...
  • 54.
    Game clients oftenrestrict input, but we can put in “markers” (the third “A” in this case), and then search for it’s hex value in memory... (changing it,
  • 55.
    Game clients oftenrestrict input, but we can put in “markers” (the third “A” in this case), and then search for it’s hex value in memory... (changing it, and searching for it’s new value, until we find it)
  • 56.
    Game clients oftenrestrict input, but we can put in “markers” (the third “A” in this case), and then search for it’s hex value in memory... (changing it, and searching for it’s new value, until we find it) ... and then replacing it with something like, like a newline
  • 57.
    Game clients oftenrestrict input, but we can put in “markers” (the third “A” in this case), and then search for it’s hex value in memory... (changing it, and searching for it’s new value, until we find it) ... and then replacing it with something like, like a newline
  • 58.
    Game clients oftenrestrict input, but we can put in “markers” (the third “A” in this case), and then search for it’s hex value in memory... (changing it, and searching for it’s new value, until we find it) ... and then replacing it with something like, like a newline (or something else more malicious?) Game clients don’t always like us doing that... BUT...
  • 59.
    W32Dasm (aka WinDasm)is a decompiler which can find text strings in an application
  • 60.
    W32Dasm (aka WinDasm)is a decompiler which can find text strings in an application, and show us the code around them In this case there’s a “Conditional” jump from 0041EC75
  • 61.
    W32Dasm (aka WinDasm)is a decompiler which can find text strings in an application, and show us the code around them In this case there’s a “Conditional” jump from 0041EC75 Which performs some kind of checking, and then jumps to the code with the string in, if the condition is met. We can make note of the offset (0001EC75)...
  • 62.
    ... and openthe file, going to that location, in a hexeditor Where we see the same hex codes
  • 63.
    ... and openthe file, going to that location, in a hexeditor Where we see the same hex codes Changing them to “90”s...
  • 64.
    ... and openthe file, going to that location, in a hexeditor Where we see the same hex codes Changing them to “90”s... “nop”s them out “nop”s basically mean “do nothing” (“No Operation”) - in this case, never error on invalid characters
  • 65.
    The “CmdLevel test”payload after our marker would give your character GameMaster powers. This has been fixed in more recent POL versions - for character names, but theoretically every text input (such as naming pets) may still be vulnerable
  • 66.
    ZaCon 4 -Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 4. iPhone / iPad Games 4.1. Non-Jailbroken hacks - modifying “plist” and other config files
  • 67.
    iPhone games canbe hacked, to some degree, without jailbreaking
  • 68.
    iPhone games canbe hacked, to some degree, without jailbreaking Using a program like “iExplorer” game files can be accessed
  • 69.
    iPhone games canbe hacked, to some degree, without jailbreaking Using a program like “iExplorer” game files can be accessed, and changed (eg: changing a high-score, and setting scores as not have been sent yet)
  • 70.
    iPhone games canbe hacked, to some degree, without jailbreaking Using a program like “iExplorer” game files can be accessed, and changed (eg: changing a high-score, and setting scores as not have been sent yet) The next time the game is run, the scores are updated!
  • 71.
    Some games “lock”content until certain levels or scores are reached (or payments have been made)
  • 72.
    Some games “lock”content until certain levels or scores are reached (or payments have been made) Often these “locks” are controlled in config files (look out for “ini”,“plist” and “sqlite” files!)
  • 73.
    Some games “lock”content until certain levels or scores are reached (or payments have been made) Often these “locks” are controlled in config files (look out for “ini”,“plist” and “sqlite” files!) Changing “0” values to “1”s often does the trick
  • 74.
    Some games “lock”content until certain levels or scores are reached (or payments have been made) Often these “locks” are controlled in config files (look out for “ini”,“plist” and “sqlite” files!) Changing “0” values to “1”s often does the trick Unlocked!
  • 75.
    Tools like BurpSuite, and mitmproxy, can be used to intercept game traffic
  • 76.
    Tools like BurpSuite, and mitmproxy, can be used to intercept game traffic And re-write values, such as XP, gold, scores, or “premium” (paid-for) credits mitmproxy lets you write scripts to do this automatically
  • 77.
    ZaCon 4 -Game Hacking 1. Console Games 2. DOS Games 3. Windows Games 4. iPhone / iPad Games 4.2. Jailbroken hacks - decompiling with IDA Pro
  • 78.
    iOS games areencrypted when downloaded from the App Store Calculating offsets, using “gdb” to dump memory, and trial and error byte switching can decrypt apps... OR... A jailbroken app called “clutch” can be used to decrypt them quickly and easily
  • 79.
    Decrypted iOS appscan be opened in “IDA Pro” - be sure to set the “Processor type” to “ARM” though!
  • 80.
    Decrypted iOS appscan be opened in “IDA Pro” - be sure to set the “Processor type” to “ARM” though! Analysis will run, displaying function names on the left, allowing you to view their actions Un-wanted commands can be found, their offsets noted (0011A508)
  • 81.
    Decrypted iOS appscan be opened in “IDA Pro” - be sure to set the “Processor type” to “ARM” though! Analysis will run, displaying function names on the left, allowing you to view their actions Un-wanted commands can be found, their offsets noted (0011A508), the application file opened in a hex editor
  • 82.
    Decrypted iOS appscan be opened in “IDA Pro” - be sure to set the “Processor type” to “ARM” though! Analysis will run, displaying function names on the left, allowing you to view their actions Un-wanted commands can be found, their offsets noted (0011A508), the application file opened in a hex editor, and them edited out (00’s work as NOPs in ARM)
  • 83.
    NOTE: after modifyingan iOS application (and re- uploading it to your device), you will need to “sign” it with “ldone” (from Cydia) Your device will probably need to be restarted before the app will run
  • 84.
    NOTE: after modifyingan iOS application (and re- uploading it to your device), you will need to “sign” it with “ldone” (from Cydia) Your device will probably need to be restarted before the app will run The game WordsWithFriends has a “isValidMove” method...
  • 85.
    NOTE: after modifyingan iOS application (and re- uploading it to your device), you will need to “sign” it with “ldone” (from Cydia) Your device will probably need to be restarted before the app will run The game WordsWithFriends has a “isValidMove” method... ... which could be set to always return true - the server, and other clients, don’t seem to care!
  • 86.
    Recommended Reading: 1. “ExploitingOnline Games: Cheating Massively Distributed Systems” - Greg Hoglund & Gary McGraw 2. “Hacking and Securing iOS Applications” - Jonathan Zdziarski 3. Forums: http://www.blizzhackers.cc & http://www.mpgh.net/forum/
  • 87.
    Real world concerns? 1.Bypass string terminators in saved games to buffer overflow and root devices? (eg: PSP - http://pspslimhacks.com/psp-6-20-save- data-exploit-released-hello-world-6-20/) 2. Send malicious (code execution?) instructions to multiplayer clients (eg: Starcraft forced map download hack) 3. Send XSS or SQL injection to “high score” severs not checking or filtering input
  • 88.