3 ms·

I was looking at how the high score submission works, and there is some quite interesting anti-cheat here. I haven't managed to defeat it, but this is what I kn

I was looking at how the high score submission works, and there is some quite interesting anti-cheat here. I haven't managed to defeat it, but this is what I know so far: A score submission looks like this, in a POST body to /new-score: {"score":58.92,"placeholder":"olivia","id":"64904","logs":[{"year":1931,"price":0.17,"target":0.25,"sale":0,"id":"v5v8"},{"year":1957,"price":0.31,"target":1,"sale":0,"id":"s8x3"},{"year":1976,"price":0.59,"target":4.23,"sale":0.01,"id":"d8v2"},{"year":1992,"price":1.13,"target":10.99,"sale":0.04,"id":"z2q0o9"},{"year":2005,"price":2.3,"target":0.39,"sale":0.05,"id":"c1s2j1"},{"year":2012,"price":3.64,"target":42.24,"sale":0.08,"id":"g1j2k5"}]} I tidied up the JavaScript that runs the site with jsbeautifier[0], but it's still pretty obfuscated and hard to read. So far I have worked out that the "id" field on each of the "logs" is just the number of milliseconds you held the button down, with random letters interspersed. So if you hold the button down for 125ms, then the id might get "a1b2c5". If you mess with the logs so that the "id" fields are incorrect, then the server responds with "invalid". If you leave the logs alone and only change the main "score" value then it still responds with "ok" or "top", but it doesn't appear to actually insert the score - I suspect this is supposed to frustrate efforts at cheating. I'm not sure whether using the word "placeholder" to refer to the player's name is an unintentional bug or not. I haven't played the game sufficiently well to see if a legitimate high-scoring submission to /new-score looks different. From what I can tell from the source, if you score well enough, it creates an input box and allows you to input your own name, and this input box has "placeholder" text set. If I just randomly change "olivia" to something else then my submission gets rejected with "invalid". I haven't yet worked out where the "olivia" string in "placeholder" comes from. It's a different name every time. I also haven't yet worked out where the main "id" number comes from (64904 in the above). If I make small changes to this number then the submission still seems to be accepted, but large changes result in "invalid". I'm guessing this number is some sort of fuzzy-ish checksum on the player's name, but I haven't worked out where it comes from. There is also a page at /tally which seems to map score values to integers (mostly 1, but some not) which I also haven't worked out the purpose of. [0] https://jsbeautifier.online/ https://jsbeautifier.online/

0x0000000 5y ago
You don't need to modify the logs, you can modify the "score" value and submit with (valid) logs from a different score, and it will go through. However, it seems the author is removing such scores from the leaderboard. Fwiw, you are correct that the digits in "id" is the duration of milliseconds. The letters in-between are random (found this in the source). If you're able to time any of the stages right, then you can find the missing variable: rate of gas dispensing (in this game, it's 6 seconds per gallon or 0.1666 gallons per second). For example, in 1931, the price is $0.17/gallon, and they want you to dispense $0.25 worth of gas. That's as little as 1.47 (0.25/0.17) gallons, or as much as ~1.52 gallons. That means you want to hold the button for between ~8825 milliseconds and ~9175 milliseconds. If you divide that ~1.5 gallons by ~9000 milliseconds, you've found the rate, 6 seconds per gallon. To generate your log entry for 1931, you'd then have something like this: {"year":1931,"price":0.17,"target":0.25,"sale":0.25,"id":"k8j9g5l8"} To generate your log id for any given year: Target / Price * 6000 = total milliseconds to hold the button. Just put a random letter in front of each digit and you're good to go.

0x0000000 5y ago

You don't need to modify the logs, you can modify the "score" value and submit with (valid) logs from a different score, and it will go through. However, it seems the author is removing such scores from the leaderboard. Fwiw, you are correct that the digits in "id" is the duration of milliseconds. The letters in-between are random (found this in the source). If you're able to time any of the stages right, then you can find the missing variable: rate of gas dispensing (in this game, it's 6 seconds per gallon or 0.1666 gallons per second). For example, in 1931, the price is $0.17/gallon, and they want you to dispense $0.25 worth of gas. That's as little as 1.47 (0.25/0.17) gallons, or as much as ~1.52 gallons. That means you want to hold the button for between ~8825 milliseconds and ~9175 milliseconds. If you divide that ~1.5 gallons by ~9000 milliseconds, you've found the rate, 6 seconds per gallon. To generate your log entry for 1931, you'd then have something like this: {"year":1931,"price":0.17,"target":0.25,"sale":0.25,"id":"k8j9g5l8"} To generate your log id for any given year: Target / Price * 6000 = total milliseconds to hold the button. Just put a random letter in front of each digit and you're good to go.