3 ms·

Under the Microscope: Three Dirty Dwarves

61 points by zdw 3y ago

bombcar 3y ago
I wonder how complex a cheat code system you could make - resilient to decompiling and examinations. I’m thinking things like the code itself is interpreted as a memory address/jump and most do nothing or crash …
- speps 3y ago
  This video might be of interest, how to crack a C64 game. There's multiple protections and steps, it was quite interesting to see the length they've gone to slow down piracy. https://youtu.be/yVtKKb3wkYc https://youtu.be/yVtKKb3wkYc
- A1kmm 3y ago
  Black-box obfuscation has been proven to be impossible: https://dash.harvard.edu/bitstream/handle/1/12644697/9034637.pdf https://dash.harvard.edu/bitstream/handle/1/12644697/9034637... - the best possible is indistinguishability obfuscation (iO) that makes impossible to distinguish any two programs which have the same outputs for the same inputs. Better might be to use a Key Derivation Function (e.g. bcrypt) and treat cheat codes like passwords. This wouldn't obfuscate what the set of available cheat codes do, but finding the actual code would be hard if they are sufficiently long and random.
- jstrieb 3y ago
  I have done something like this for embedding Easter eggs in websites where a user can just "view source" to see the code. I want someone who looks to know there is an Easter egg, but not know what it does or how to activate it... Code is AES-GCM encrypted, and the encrypted blob is stored on the web server. The "cheat code" to activate the Easter egg is the decryption key (the passphrase used with a key derivation function, to be precise). Entering the cheat code triggers an attempt to decrypt the blob. If the password is correct and the code decrypts successfully, the decrypted code is run with eval. If the passphrase is incorrect, nothing happens. Thus, nobody inspecting the code can know what the cheat code is or what it does without breaking the crypto. But someone who knows it can enter it and trigger the magical cheat behavior. Note that it's important to use authenticated encryption so that the user's browser doesn't try to execute garbled text when decryption fails.
- RugnirViking 3y ago
  You might well end up with cheat codes that are unintended this way! See: arbitrary execution glitches allowing skipping to loading functions to load the final area in some TAS speedruns
- Inviz 3y ago
  One time i was making an interactive video website, where user could jump between sections of the video. I added an easter egg, where the video would have an extra section, to which you could jump by clicking "next" button twice if well timed. It was done via underhanded JS: Number of sections was computed based on video duration, so uploading a video with more than expected number of sections, could cause out of bounds jump
  - bombcar 3y ago
    Reminds me of abuse of the RED Book - CDs could have long tracks of silence to hide an extra track, but you could see that. The hotshit was to put it before the first track’s starting point; this could make something that could only be accessed by seeking backwards.
- saagarjha 3y ago
  If it's just a simple jump people will generally find code that remains unused in the program and figure out how to trigger it.
- bbayles 3y ago
  There's a Saturn game called Thunderhawk II that has a password system. Part of it includes XORing one of the buffers with the string "NOSEY GIT", which I took to mean they were chiding me for trying to snoop on the system. To their credit, I couldn't figure it out!
bbayles 3y ago
There are lots of cool things like this to discover in Sega Saturn games, in large part because people are intimidated by the notoriously difficult SH-2 assembly language. However, the Saturn surprisingly has really good tools for reverse engineering. There is a very good save state loader for Ghidra, and the Mednafen debugger allows for on-the-fly memory editing. With these methods I also found a cheat code for Clockwork Knight 2 that grants access to the entire first game! Somehow that was secret for decades.

61 points by zdw 3y ago

I wonder how complex a cheat code system you could make - resilient to decompiling and examinations. I’m thinking things like the code itself is interpreted as a memory address/jump and most do nothing or crash …

speps 3y ago
This video might be of interest, how to crack a C64 game. There's multiple protections and steps, it was quite interesting to see the length they've gone to slow down piracy. https://youtu.be/yVtKKb3wkYc https://youtu.be/yVtKKb3wkYc
A1kmm 3y ago
Black-box obfuscation has been proven to be impossible: https://dash.harvard.edu/bitstream/handle/1/12644697/9034637.pdf https://dash.harvard.edu/bitstream/handle/1/12644697/9034637... - the best possible is indistinguishability obfuscation (iO) that makes impossible to distinguish any two programs which have the same outputs for the same inputs. Better might be to use a Key Derivation Function (e.g. bcrypt) and treat cheat codes like passwords. This wouldn't obfuscate what the set of available cheat codes do, but finding the actual code would be hard if they are sufficiently long and random.
jstrieb 3y ago
I have done something like this for embedding Easter eggs in websites where a user can just "view source" to see the code. I want someone who looks to know there is an Easter egg, but not know what it does or how to activate it... Code is AES-GCM encrypted, and the encrypted blob is stored on the web server. The "cheat code" to activate the Easter egg is the decryption key (the passphrase used with a key derivation function, to be precise). Entering the cheat code triggers an attempt to decrypt the blob. If the password is correct and the code decrypts successfully, the decrypted code is run with eval. If the passphrase is incorrect, nothing happens. Thus, nobody inspecting the code can know what the cheat code is or what it does without breaking the crypto. But someone who knows it can enter it and trigger the magical cheat behavior. Note that it's important to use authenticated encryption so that the user's browser doesn't try to execute garbled text when decryption fails.
RugnirViking 3y ago
You might well end up with cheat codes that are unintended this way! See: arbitrary execution glitches allowing skipping to loading functions to load the final area in some TAS speedruns
Inviz 3y ago
One time i was making an interactive video website, where user could jump between sections of the video. I added an easter egg, where the video would have an extra section, to which you could jump by clicking "next" button twice if well timed. It was done via underhanded JS: Number of sections was computed based on video duration, so uploading a video with more than expected number of sections, could cause out of bounds jump
- bombcar 3y ago
  Reminds me of abuse of the RED Book - CDs could have long tracks of silence to hide an extra track, but you could see that. The hotshit was to put it before the first track’s starting point; this could make something that could only be accessed by seeking backwards.
saagarjha 3y ago
If it's just a simple jump people will generally find code that remains unused in the program and figure out how to trigger it.
bbayles 3y ago
There's a Saturn game called Thunderhawk II that has a password system. Part of it includes XORing one of the buffers with the string "NOSEY GIT", which I took to mean they were chiding me for trying to snoop on the system. To their credit, I couldn't figure it out!

bbayles 3y ago

There are lots of cool things like this to discover in Sega Saturn games, in large part because people are intimidated by the notoriously difficult SH-2 assembly language. However, the Saturn surprisingly has really good tools for reverse engineering. There is a very good save state loader for Ghidra, and the Mednafen debugger allows for on-the-fly memory editing. With these methods I also found a cheat code for Clockwork Knight 2 that grants access to the entire first game! Somehow that was secret for decades.