8 ms·
Heroes of Might and Magic V – Hammers of Bait and Switch
- rkagerer 5y agoI skimmed through the first 3/4 of this article screaming "Process Monitor!" until the author finally cracked that tool open. It's a wonderful utility that's bailed me out of jams like this in the past. It wound up being a WOW6432Node issue. I felt the transition from 32-bit to 64-bit was handled a lot less cleanly by Windows designers than their previous transition from 16-bit to 32-bit. Hacks like Program Files (x86) were particularly offensive.
- stefanwlb 5y agoawesome write up, thank you!
- pram 5y agoThis would have been easy if Windows had something like strace.
- jimrandomh 5y agoIt does, sort of. https://docs.microsoft.com/en-us/sysinternals/downloads/procmon https://docs.microsoft.com/en-us/sysinternals/downloads/proc...
- genocidicbunny 5y agoProcMon fills that role a little bit. I also think that if the author here used that in the first place they would have arrived at the registry problems much sooner. ProcMon is often the first thing I reach for when dealing with a 'missing files' kind of problem on Windows.
- malkia 5y agoI was looking how to automate procmon on CI and found this (but info there might be bit outdated, had to reset my procmon registry to get it back to work) - https://gist.github.com/balaprasathr/ae424eec0e9e2860aa84a854244f53c3 https://gist.github.com/balaprasathr/ae424eec0e9e2860aa84a85... and whole article that goes deep into it - but can't find it now - I think I've stumbled on to it from the link above.
- Slortibort 5y ago> I also think that if the author here used that in the first place they would have arrived at the registry problems much sooner. You're absolutely correct. Doing this again, I'd probably get to start from the middle. I went the way I did because I was essentially starting it blind - technically capable but with no idea how one should do this. Discovering and reasoning my way through potential causes and tools helped it be a massive learning experience and I'm glad I did.
- malkia 5y agoAlso Rohitab Batra's API Monitor v2 - http://www.rohitab.com/ http://www.rohitab.com/ - very powerful - especially if you are hunting down who uses "getenv" (well not really getenv, but you get the picture) And there is "strace" (not the one from cygwin/mingw, which mostly traces apps written for their runtime), but from DrMemory's - https://drmemory.org/page_drstrace.html https://drmemory.org/page_drstrace.html Then you have the realtively recent Detours released, and tons of other tooling TBH, just all over.
- ziml77 5y agoAPI Monitor is an amazing tool that I've used a few times in the past when procmon wasn't enough. But I wish the author would either return to working on it or open source it. As it is, many calls it can capture are opaque because it only captures the address that a parameter is pointing to instead of following the pointer to get the actual data.
- creamytaco 5y agoThis was a 5 minute job with windbg. If I was the author I'd be too embarrassed to post this write-up.
- kbelder 5y agoTalk about embarrassing posts...
- Slortibort 5y agoHi. I'm the author. I'm not embarrassed. What I've done is written up my learning experience from near-nought in the hopes that others find it either informative or enjoyable. Why should I be embarrassed of that?
- dimgl 5y agoThis was an amazing write-up. It never ceases to amaze me how anyone can reason through decompiled code.
- robbedpeter 5y agoOne of the amazing things about doing stuff like this is the forum discussions, tutorials, irc logs, and mailing lists that detail every step and exploration and tool. Cracking a keygen, creating trainers, using hex editors, and so on down the game piracy, cheating, editing, and modding rabbit hole is incredibly rewarding and occasionally useful in the real world. It's worth doing at least once for anyone, but I think it will get harder for people as more content ends up ephemeral, unsearchable, or locked inside walled gardens.
- barbs 5y agoThat does sound fascinating! Any particular posts you would recommend?
- boppo1 5y agoI'm a layman at this but felt like I understood after reading this: https://wiki.skullsecurity.org/index.php?title=Fundamentals https://wiki.skullsecurity.org/index.php?title=Fundamentals also, that might be dated, so additionally search around for 'Ghidra'. Iirc, hackers at the NSA convinced their bosses the US would be more secure if the gen pop had access to their tools. Cool stuff.
- csydas 5y ago> It never ceases to amaze me how anyone can reason through decompiled code. How so? I'm very much so a nascent programmer, but I've learned the most by decompiling other's code and seeing what works and what doesn't. When I see good apps, I guess I make the (sometimes specious) assumption that whoever wrote it likely also knows how to write pretty well. I've also done a ton of troubleshooting at a past support position via decompiler since the Dev Team was sometimes...sparse with details :) It's one of the things I do like about programming, it's just a big logic puzzle to break down. Sometimes the logic harder to follow, but there is a way to understand it. My biggest mental growths have been just seeing how other people accomplish goals I want to accomplish, and understanding what does and doesn't work well. Especially with major developers, it's really interesting to see how/why they do the things they do as their needs are way different than in-house app needs.
- a0zU 5y agoIs this website in any way CCPA compliant? What is their shitty about cookies page?
- sharkbot 5y agoI wonder if the Windows program compatibility settings would have helped. One should be able to mark a program as needing the 32-bit runtime. Googling tells me that the Windows XP SP2 setting should force 32-bit mode.
- CornCobs 5y agoI love reading write ups like this. It's an extremely empowering feeling to realize that all these opaque software and cryptic errors are ultimately also written by fellow programmers. You CAN understand it, you CAN take matters into your own hands. I remember once, a few years back, there was this website where I was supposed to submit something, only that the submission page couldn't load. My friend thought that that was the end of it, but I decided to try to poke around. Back then I was quite unacquainted with http but I started with what I knew, downloading the page source, figuring out what was the link or call that was failing, then testing it with curl. I eventually managed to figure out that the problem was caused by a missing header in the http request so I installed some random browser extension that patched http requests and voila, it worked! Still remember the amazing feeling when the page loaded. My friend thought I was a wizard
- gleenn 5y agoI remember applying for a visa on a country's government website and their Javascript was broken. I "hacked" the HTML just to finish the application. I think it was a Firefox compatibility issue.
- aaronbrethorst 5y agoHopefully not to live in Missouri.
- renewiltord 5y agoThe problem isn’t the “hack”. They’re too dumb to notice. The problem is thinking they’re smart enough to be worth telling.
- kbelder 5y agoI think you were downvoted because somebody didn't catch your reference.
- aaronbrethorst 5y ago
- Natsu 5y agoThe solution might've been a bit shorter if he'd known to search for info about the WOW6432Node and found out about how registry redirection works, something I don't see him clearly call out in there despite wondering where that extra bit comes from: https://docs.microsoft.com/en-us/windows/win32/winprog64/registry-redirector https://docs.microsoft.com/en-us/windows/win32/winprog64/reg... Presumably this is happening due to this being an old 32-bit game running on 64-bit Windows. The WOW in there stands for "Windows on Windows."
- hacker_homie 5y agoYeah I was thinking he could have just flipped the KEY_WOW64_64KEY or the KEY_WOW64_32KEY on where ever it opened the registry in the installer Or use compatibility mode? I am still glad he got it working in the end.
- ethbr0 5y agoAre there any articles from Microsoft folks on why they made the 32/64 compatibility choices they did? I'm not going to say they're the worst, and they certainly work, but they're also pretty obtuse and "Why would you design a thing like that?" From memory of the era, the 32/64 bit client transition seemed a bit rushed when Intel had long decreed no home users would need 64-bit, and then AMD promptly started selling the Athlon 64 to anyone who would buy one. So maybe just time pressure?
- hacker_homie 5y agoMaybe this https://devblogs.microsoft.com/oldnewthing/20081222-00/?p=19763 https://devblogs.microsoft.com/oldnewthing/20081222-00/?p=19...
- Slortibort 5y agoHi there, author here. It was more than due to a 32-bit game running on 64-bit Windows and compatability mode didn't work. Ubisoft changed the reg key of the base game from it's retail key to "Uplay Install 87" and the expansion had no idea to look for that key at all. If you used the Ubisoft copy of both games, the expansion pack would never have found the base game.
- Ginden 5y agoNice job writing detailed post. Though, GOG version just worked for me. ;)
- aasasd 5y agoGotta say, I would just pirate the game and play it with a vaguely clear conscience since I've already paid for it. Probably would block it in the firewall, though. I think my approach may well be completely lawful in some jurisdictions, since it essentially amounts to ‘making the purchased software compatible with the user's device’.
- deepsun 5y agoWould blocking in firewall prevent it to install trojans? I thought once something is running it's too late.
- unnouinceput 5y agoAnd that's why you install questionable software in a virtual machine that you absolutely monitor with every available tool under the moon first. See where it goes, what it exports and brings back, check for file modifications it does with a file monitoring or file difference tool. Also repeat this test 365 times, one for each day of the year - pretty sure automation comes to mind. And only then you can say with a 50% error margin that the thing you downloaded is safe :P
- wruza 5y agoI believe that’s not against trojans, but for the legal safety (the game can’t call home and tell its/yours ids). As of trojans, just use well-established, curated torrent forums instead of faceless rarbg/kat/pb alikes.
- akavel 5y agoSo, I have a meta question: how does one go doing writeups like this? I mean, I kinda tried once post-factum, but I feel details are already starting to get blurry at that point in my memory (esp. of all the failed paths, but also byte offsets, checked fields, Google searches, etc.), as well as the order of events. OTOH, I can hardly imagine doing even such detailed screenshots on every step while actually hacking, as I assume it would slow me down like crazy and most probably break my flow. So, what's the trick??
- swarnie 5y agoFor work i use a tool called Snagit to queue up screen captures then a pen and paper to scribble notes. The two together along with my memory and the order of open tabs is enough to put together "good enough" documentation showing the discovery and fixing process.
- akavel 5y agoThanks!! I need to check the tool then!
- thrdbndndn 5y agoI wrote this style of blog all the time. When doing any kind of "discovery", I always just open notepad.exe and write some keywords, short notes, and reference URLs (most important) along the way, not specifically for blogging, but just need them for my own process. Once done, and feel like I can write a blog about it, I would redo the whole thing (and take the screenshots) for the blog article.
- akavel 5y agoThanks for the reply!! So basically working notes, makes sense, and I vaguely thought about that too; although it would appear they somehow don't seem to work that well in my case for this purpose; I need to think about it. As to the "redo" step, that is something I didn't think of, but sounds like a really good idea, thank you!
- 5y ago
- renewiltord 5y agoWhat’s the Windows equivalent of strace for open calls? I enjoyed the write up but curious about the tools. Also, funny thing but 90% of the time I am 8x as motivated to solve a problem for a loved one as I am for myself. For me, this would have been a “do something else” or “pirate it” moment.
- ripley12 5y agoAs others have noted, Process Monitor (ProcMon for short). It’s a really excellent no-nonsense GUI tool. This is a good overview of how to use it: https://www.youtube.com/watch?v=pjKNx41Ubxw https://www.youtube.com/watch?v=pjKNx41Ubxw
- southerntofu 5y agoThe post mentions using the system monitor to track some events (including registry queries). There's apparently other ways for that (but which the author failed to compile, including the official Microsoft tool), and the monitor can only see 32 XOR 64 bits events, not both.
- npteljes 5y agoI've used Process Monitor in the past to track down a mysterious "cannot open file" error. It readily listed the file opening attempt the software made, among a ton of other events.
- filoleg 5y agoAll the other things such as practicality aside, this is an amazing post all around. The content is interesting even to someone like me who doesn't really care for modding games or has no more than very bare experience with decompilers and dealing with hex editors. Writing is a great balance between too dry and too verbose or "edgy". The material is super accessible, and it progresses at a very smooth and steady pace. What started with basic debugging ended up in digging through decompiled code and mapping characters for the fixed path manually to preserve the character count in the .inx file. I swore I was going to only read the intro and read the rest in the morning, but ended up gulping up the whole thing in one go :(
- thrdbndndn 5y ago>sigh. Sure, Linux tells you to “bake it yourself” but at least the Linux hands you the tools to do it and if you follow the instructions, the tools definitely do what you expect of them. I fear Windows just isn’t quite there. Probably something most of people here can't relate to, but this is something I'm always grateful for all the "modern" language toolings, as someone that is not a dev and uses Windows. I now can just download source code of various open source projects if in Go/Node/Python, and just run/compile it. They work fine most of times. I never had the same confidence for any C++ projects, even when the author themselves also use Windows, which is unlikely. I almost never make them work/compile successfully. If the binary isn't provided I just feel doomed.
- thriftwy 5y agoI have started reading this with the assumption "incorrect or absent registry key" and it paid off. What a pain in the bosom were those registry keys. Can you imagine that for some time, The Registry was considered a Good Thing. GNOME tried to roll out its own before defecting to Mac ways.
- southerntofu 5y agoWhat's the Mac way you're talking about? How is it different from Windows registry? I'm not so familiar with Windows, but the way i understood it was that the registry was just a very limited and inefficient file storage like we have on libre systems.
- thriftwy 5y agoThe swapping of buttons and top menu I was referring to.
- southerntofu 5y agoThanks for the writeup. To be completely honest, i wish you (and other scammed players) would sue Ubisoft and claim huge sums (maybe to give away to FLOSS game devs?). These huge game corps are avidly exploiting their workers and charging tons of money for unfinished/buggy games in clear violation of all consumer/worker protection laws. I mean, if the game doesn't work for you, that's conceivable. But that they sell a game that doesn't work for many people, and the problem is widely known and the editor refuses to do anything but still takes money for it... it makes me wanna throw up :)
- Slortibort 5y agoHi, author here. On one hand I wholly agree with you. Ubisoft has absolutely no right to go around selling products that don't work - it's abysmal. In my other "how to fix it" post, my first suggestion is to just buy it from GOG, with a link. Don't give Ubisoft your money (I'm pretty sure we won't from now on). I could have also just pirated it. If I gave up, that's how we'd have done it. That said, if we'd have done that, I wouldn't have had the fun ripping this piece of software to bits. :)
- southerntofu 5y ago> Don't give Ubisoft your money (I'm pretty sure we won't from now on). My personal strategy is to only give money after i'm satisfied with a product (at least in the computer world). I never bend to paywalls and will NEVER financially support non-free software because it enables that kind of user-abuse situation to begin with. > That said, if we'd have done that, I wouldn't have had the fun ripping this piece of software to bits. :) You can still pirate the game as a quick workaround while you dismantle the original release. Anyway thanks for this read i learnt much about windows debugging (as a non-Windows user).
- ziml77 5y agoYou mentioned checking the forums, but did you ever try contacting Ubisoft through their support page? If nothing else, I'm curious about what their response would be to an issue that's preventing you from playing your purchased game that is entirely a problem with the way the installer is written.
- Hallucinaut 5y ago> It would appear that Installshield is a product used by a lot of old games to perform the installation process. How to make the Pentium generation kids feel old :-)
- fistynuts 5y agoSame thought here. "Apparently .ex_ files are actually .exes!" - no shit, Sherlock!
- sersi 5y agoHa! thought exactly the same. I haven't used Windows in 18 years but when he mentioned installshield and cab files I felt right at home. Still remember using the PowerToys to open cab files :)
- paulryanrogers 5y agoThen 7zip and realizing it can open almost anything
- pjmlp 5y agoOr how quickly knowledge gets lost.
- bloqs 5y agoThis. It's strangely upsetting. It makes me want to "raise the alarm", which I imagine is a leftover evolutionary psychological tidbit instilling the "duty to inform" others about things.
- ineedasername 5y agoYeah, I felt a little "get off my lawn!" About that one too.
- Slortibort 5y agoI played a lot of Installshield games as a kid - I definitely recognised their sail-like logo, but was too young to ever poke around in the installer back then. I started poking around in hex maybe in 2008 and then it was just installed games. I do remember trying to mod Populous the Beginning, which is quite a bit older
- IG_Semmelweiss 5y agoThis game is exhibit A of how to destroy brand equity in record time. Since 3DO folded and the property was taken over by another studio, this brand has collapsed in value.
- jquast 5y agoI would suggest to use procmon.exe, all file and registry accesses could have been monitored without any disassembly and the problem could probably have be resolved much easier.
- forbiddenlake 5y agoThis is mentioned and used in the article.
- jquast 5y agoSorry my bad it is the very last tool used, which does in fact lead to success, I guess documenting all this other stuff might help somebody somewhere, or at least persuade people to skip the superfluous efforts and just go right to procmon
- glitchc 5y agoBasically a game designed (and harcoded to some extent) for 32 bit windows doesn’t work on 64-bit Windows. This is an old problem that a lot of software faced during the switch in the 00s. Installing it in a VM on XP would have probably achieved the same result.
- Slortibort 5y agoHi, author here. Unfortunately not. Ubisoft changed the reg key of the base game from it's retail key to "Uplay Install 87" and the expansion had no idea to look for that key at all. If you used the Ubisoft copy of both games, the expansion pack would never have found the base game.
- glitchc 5y agoAh that sounds incredibly silly on their part. What’s the rationale here? Is it to force people to use their UPlay store to install games?
- Slortibort 5y agoI don't actually think it's malice. I think it's just a matter of unforeseen consequences combined with an inability to take corporate responsibility for their own products. The reg key they've changed in the base game does have some Ubisoft specific information so I expect they did that in order to allow the game to work well with their delivery service. They tested it and it worked. They presumably just didn't think to test the expansion installer or perhaps even worse, weren't permitted the funding to explore all the potential knock on effects. Since noone is fixing it, despite there being many service tickets about it, I can only think that the engineers don't know what the issue is.
- AtlasBarfed 5y agoAn amazing tale of perseverance. What has happened to all the scene crackers? It strikes me they would have this polished off in a matter of hours. Because he was basically navigating all their techniques (decompilation, bypassing checks, file formats, locating key locations, patching binaries, etc).