8 ms·

Tony Hawk's Pro Strcpy

731 points by ndiddy 2y ago

jonhohle 2y ago
This is awesome! I've been doing some PSX decompiling and there are lots of similar things there as well. Interestingly, something like `memmove` is linked in using an SDK library[0], but `strcpy` is a function provided by the BIOS. Later version of the SDK could patch that out for a library version, but as late as 1997 it hadn't been. 0 - https://github.com/Xeeynamo/sotn-decomp/blob/master/src/main/psxsdk/libc/memmove.c https://github.com/Xeeynamo/sotn-decomp/blob/master/src/main...
- anthk 2y ago
  I'd love a reimplemeantion in C+SDL2 (and OpenGL 2.1) of the former console games. Now there are the N64 games being ported to PC with decompilers, I can only hope. Inb4 "there are native PC versions of these, you know"... most recompiled N64 games with the FX's being 'deshaderized' to pure textures (or simpler FX's) can be run in toasters such as cheap netbooks from 2009 and nearly anywhere. They even ported Super Mario 64 to the 3DFX API. I know, the most complex games accesing the N64 framebuffer with complex FX will require OpenGL 3.3 to mimic that microcode; but, as I said before, when the engines run uber-fast on anything post Pentium III, is not something difficult to 'mimic' these in software while the rest it's running GL 2.1 accelerated.
  - bitwize 2y ago
    > They even ported Super Mario 64 to the 3DFX API. That's... not surprising. UltraHLE ran SM64 like a dream, and the HLE bit referred to the fact that the emulator translated 3D calls to the Glide API rather than attempting to emulate the 3D hardware directly.
    - anthk 2y ago
      Yeah, I knew about that, so this it's just transcribing instead of translating. But I'd guess SGI machines (IRIX) being OpenGL bound (they invented it) the N64 would map the microcode to GL funcs much better.
      - bitwize 2y ago
        Glide was modelled after OpenGL, so I'm guessing the mapping was not that much of a stretch anyway.
        rvnx 2y ago
        and then you had to use an extra DLL that was essentially translating 3dfx calls to DirectX
        anthk 2y ago
        That was later. NGlide for sure.
  - astrange 2y ago
    The N64 used a different texture interpolation method than anything else ever has (IIRC three-point instead of four-point) so if you do the equivalent of HLE like that, it'll look bad and blurry. Of course, official rereleases of N64 games haven't emulated it properly either.
    - anthk 2y ago
      Not an issue at 640x480 and higher resolutions. Once your run the games at 1024x768 and up that doesn't matter at all: sm64ex, perfectdark, zeldaoot for PC...
      - astrange 2y ago
        Doesn't it? I didn't go try it, but seems to me a different texture interpolation would be more obvious at higher resolutions. If you use one of those hires texture packs then it'd be fine.
perihelions 2y ago
- "If I was lucky it would be strcpy (opposed to something like strncpy)" it really ought to have been strncpy, I'm sure Tony Hawk who's lauded for his advocacy of safety gear would prefer to be associated with safer string copying
- kragen 2y ago
  strncpy is definitely not safer; it produces unterminated strings when it hits n basically you should almost never use strncpy; it's specifically for fixed-size fields like this: struct dirent { unsigned short inode; char name[14]; }; and in those cases more often than not the pad byte should be a space rather than a nul strncpy should never have been added to the standard library
  - sidewndr46 2y ago
    What is the preferred solution here? I usually just use "memset" to zeroize the whole destination string, then tell "strncpy" that my destination is 1 byte shorter than what it really is. The real issue I've ran into is that "strncpy" assumes the source is null-terminated.
    - connicpu 2y ago
      C11 adds `strcpy_s` which takes (dest, destsz, src) and returns an errno_t which will report an error if the src string is longer than destsz, as silent truncation is often not a desirable behavior. It also assigns dest[0]='\0' on error so you don't get an unterminated garbage string.
      - david2ndaccount 2y ago
        Only msvc provides strcpy_s and they don’t conform to the standard. Other libcs don’t provide it. Ignore everything from Annex K and write your own wrappers around memcpy. You should always know the size of your buffers.
        2y ago
nj5rq 2y ago
Very good article.
makin 2y ago
A bit of a shame about the exploit applying to THUG PRO. The mod is played to this day, since the more competitive side of the Tony Hawk franchise has been dead for almost twenty years (with the exception of the THPS1+2 remake, which was but a blip in the scene). The mod itself is over 10 years old now, and I think the original developers are gone, explaining why no one was interested in fixing it when Ryan reported it. But this means that now the mod is unusable, no one is going to want to risk a full privilege exploit taking over their PC. Hopefully this article reaches someone who's a bit more interested in patching the mod.
- rlabrecque 2y ago
  I wish I had the time, because it would be fun. Back when I DID have time, I actually got that thug1 source code almost playable on Windows. That source code was only for the console versions, and the code assumed if it was compiling for windows (and not Xbox windows..) it was only for tools, so a lot of pieces worked completely differently.
auto 2y ago
I've read so many flavors of this sort of exploit analysis over the years, and if I get to read 100 more I'll be all the happier for it. Great article!
Retr0id 2y ago
> The more interesting thing about the habibi key is that the public key modulus only has a 4 byte difference compared to the Microsoft RSA public key. For reference the MS key is a 2048 bit RSA key. I’ve asked a few people how this might be possible and the answer I got is “if you change the exponent to something small like 3 you easily factor out a similar key”. This should require that the exponent of the public key is also patched to “3”. However, none of the shell code payloads that use the habibi key ever change the exponent used by the RSA signature verification routine. Presumably it’s still performing the validation using the exponent 65537 so I’m not entirely sure how this works. Perhaps someone more knowledgeable could shed some light on it. A random 2048-bit integer has a moderate chance of being trivially factorizeable (I don't know the precise odds but we can infer that it's roughly on the order of 2^-32 (for some definition of trivial) without doing any real math). Presumably, they wrote code that did something like this: while true: randomly tweak/increment 4 bytes of the public modulus spend 1 millisecond trying to factor it did it work? if yes, we're done here. else, try again. The resulting public modulus likely has lots of smaller factors (it should be possible to verify this, if anyone knows where I can find the "habibi public key"?). Although an RSA modulus normally has exactly 2 prime factors, the math still works out if you have more (as long as e is coprime).
- fxtentacle 2y ago
  Let me try to explain that. You start with a random 2048-bit integer. You then change the lower bytes to make it divisible by 3. This is easy because you're only working on the public key. Now that the public key is divisible by 3, you use Fermat's little theorem which tells you that the private key must be divisible by 3 and have a sum of digits that is divisible by 3. This lets you skip most possible private keys, thereby reducing the compute needed to factorize it by a few orders of magnitude. And maybe you get lucky and they use that RSA implementation which uses exactly 2 prime factors, because then you already know that one of them is 3 and you just divide the public key by 3 to get the other prime factor. EDIT: Wikipedia says "The structure of the RSA public key requires that N be a large semiprime (i.e., a product of two large prime numbers), that 2 < e < N, that e be coprime to φ(N), and that 0 ≤ C < N." and later "the same algorithm allows anyone who factors N to obtain the private key." which in the contest of the Xbox hack means that if you force N to be divisible by the prime 3, then the other prime which is used for generating the private key has to be N/3 => You have successfully factored it. EDIT2: Here's code for signing with the Habibi key: https://github.com/XboxDev/xbedump/blob/b8cd5cd0f8b1cbc4e64f41daf925a873d34dacf1/xboxlib.c#L408 https://github.com/XboxDev/xbedump/blob/b8cd5cd0f8b1cbc4e64f... As you can see, it'll replace the last 4 bytes with 0x89, 0x9c, 0x90, 0x6b and then start by dividing it by 3 and using that to generate a suitable private key.
brcmthrowaway 2y ago
This gives me an opportunity to clarify a myth from my childhood. Was Tony Hawk the first ever to hit a 720?
- zimpenfish 2y ago
  https://en.wikipedia.org/wiki/Aerial_(skateboarding) https://en.wikipedia.org/wiki/Aerial_(skateboarding) says "The 720, two full mid-air rotations, is one of the rarest tricks in skateboarding. It was first done by Tony Hawk in 1985, and it wasn't something he planned to do." (Which is presumably "the first recorded" but I'm guessing if someone had done it, they'd have been shouting about it and -probably- the only kind of person who could pull it off would be a pro skater anyway?)
  - detoured299 2y ago
    At that time only a few pro vert skaters would have had the ability to throw 720s, yeah. Nowadays a good number of ams can too. The rarity of seeing a 720 or above has as much to do with the fact that most skaters don’t skate vert - instead skating street or smaller transition - as the trick’s difficulty. Outsiders tend to imagine large spins are the holy grail of skate moves but almost all skaters aren’t interested in them for aesthetic reasons among others.
  - voytec 2y ago
    He worked much longer for the 900 but more importantly - he repeated the 900 at the age of 48[0]! [0] https://youtu.be/TnvPt_a7iOQ?t=93 https://youtu.be/TnvPt_a7iOQ?t=93
    - imiric 2y ago
      Even more impressive: a 9-year-old did three consecutive 900s in front of Tony Hawk[1]. Arguably, this feat is easier for a small child, but still... insane talent at a young age. [1]: https://old.reddit.com/1dh6p2h https://old.reddit.com/1dh6p2h
ComputerGuru 2y ago
FYI, what looks like a section header icon followed by the text "So what's the habibi key?" is actually a clickable expanding segment (html details). You should click it if you're interested! A question I have is where/when/how the corresponding private habibi key was released/leaked, if the story about it being used exclusively by the linux console group to prevent pirated content from being used is true. OP clearly was able to patch the four byte difference between the MS key and the habibi key to then run "unsigned" (but, actually, signed with the habibi private key) executables, so they clearly got their hands on it.
- bri3d 2y ago
  The Habibi key is generated by patching the Microsoft key to be divisible by 3, making it quite easy to factor indeed. The private key can be trivially recovered from the public key, and there was nothing really to release or leak. It was basically a little crypto CTF buried in the original 007: Agent Under Fire savegame hack, which was basically a CTF in and of itself (it was reasonably heavily obfuscated, I think both as a middle finger to pirates and as a challenge to other reverse engineers).
  - ComputerGuru 2y ago
    Thanks, that makes perfect sense.
jdlyga 2y ago
Imagine a VSCode plugin that made up trick names and gave you a combo points score at the bottom for your continuous keystrokes. Tony Hawk's Pro-grammer
- i_read_news 2y ago
  I think this would be more fun for VIM keybindings, where there is a higher skill level (to get cooler combos of course).
- high_priest 2y ago
  This describes https://codestats.net https://codestats.net very well
Rebelgecko 2y ago
Thanks for sharing, the other articles on this blog are equally fascinating
- Arrath 2y ago
  "Running Halo 2 in true HD" was a really, really good read.
Jerrrrrrry 2y ago
It may not be possible for me to articulate how fucking insane of an accomplishment this is. Xbox 360...._softmod_.... via the park name on a Tony Hawk game. 24 segment ROP chain :') His rightful lamentation for the hypervisor, concise functional write up, and immediate thoughts of an x360 botnet make this the greatest xbox 360 nostalgia gut-punch of all time. kudos++
Reason077 2y ago
In Tony Hawk’s defence, he’s a pro skater, not a security analyst. Limited time behind the keyboard in the late 90s/early 2000s grinding on his soon-to-be iconic game series would have been spent making sure 900 McTwists felt really natural, not auditing code for buffer overruns!
JoshTriplett 2y ago
This seems like a great example of having the wrong security mindset in console development. "We're the only thing that can write this saved data, so we only have to parse what we wrote" is a very common console mindset, and fundamentally wrong when people can prepare artificially constructed saved data. (Completely separate from that, consoles shouldn't be treating users as the adversary, but given that they do, games are failing to have a security mindset consistent with that stance.)
- cortesoft 2y ago
  > consoles shouldn't be treating users as the adversary I would 100% agree with this when talking about a normal computer, but I kind of feel differently about consoles. How do you prevent cheating in online games if you don't restrict what users can do?
  - JoshTriplett 2y ago
    1) Play with people you know, or 2) Group players by apparent capability and observed behavior, such that cheaters end up only playing with other cheaters.
    - searealist 2y ago
      1. makes matchmaking impossible, which is how 99% of people want to play. 2. is a research project that will probably never pan out.
      - JoshTriplett 2y ago
        Multiple games have done 2 in production with great success.
        searealist 2y ago
        No they haven't. Maybe they have caught cheaters with _intrusive_ software. But that's not "observed behavior and apparent capability".
stard 2y ago
[flagged]
culopatin 2y ago
I was hoping that the exploit would only execute if he stuck the landing across the gap
mclau156 2y ago
at that point I would rather re-make the game in Godot
megaloblasto 2y ago
I have a dumb question. Once you soft mod a game console, what type of stuff can you do?
- forgotmyacc 2y ago
  Back in the day we mostly did it to cheat in Halo 2 online multiplayer. I remember being 13 and would stick a butter knife into my Xbox DVD drive so the "old maps" (on the disc) would fail to load, forcing the game to load a "new map" on the hard drive which I patched via soft modding the console allowing FTP to edit the maps on the hard drive.

731 points by ndiddy 2y ago

This is awesome! I've been doing some PSX decompiling and there are lots of similar things there as well. Interestingly, something like `memmove` is linked in using an SDK library[0], but `strcpy` is a function provided by the BIOS. Later version of the SDK could patch that out for a library version, but as late as 1997 it hadn't been. 0 - https://github.com/Xeeynamo/sotn-decomp/blob/master/src/main/psxsdk/libc/memmove.c https://github.com/Xeeynamo/sotn-decomp/blob/master/src/main...

anthk 2y ago
I'd love a reimplemeantion in C+SDL2 (and OpenGL 2.1) of the former console games. Now there are the N64 games being ported to PC with decompilers, I can only hope. Inb4 "there are native PC versions of these, you know"... most recompiled N64 games with the FX's being 'deshaderized' to pure textures (or simpler FX's) can be run in toasters such as cheap netbooks from 2009 and nearly anywhere. They even ported Super Mario 64 to the 3DFX API. I know, the most complex games accesing the N64 framebuffer with complex FX will require OpenGL 3.3 to mimic that microcode; but, as I said before, when the engines run uber-fast on anything post Pentium III, is not something difficult to 'mimic' these in software while the rest it's running GL 2.1 accelerated.
- bitwize 2y ago
  > They even ported Super Mario 64 to the 3DFX API. That's... not surprising. UltraHLE ran SM64 like a dream, and the HLE bit referred to the fact that the emulator translated 3D calls to the Glide API rather than attempting to emulate the 3D hardware directly.
  - anthk 2y ago
    Yeah, I knew about that, so this it's just transcribing instead of translating. But I'd guess SGI machines (IRIX) being OpenGL bound (they invented it) the N64 would map the microcode to GL funcs much better.
    - bitwize 2y ago
      Glide was modelled after OpenGL, so I'm guessing the mapping was not that much of a stretch anyway.
      - rvnx 2y ago
        and then you had to use an extra DLL that was essentially translating 3dfx calls to DirectX
        anthk 2y ago
        That was later. NGlide for sure.
- astrange 2y ago
  The N64 used a different texture interpolation method than anything else ever has (IIRC three-point instead of four-point) so if you do the equivalent of HLE like that, it'll look bad and blurry. Of course, official rereleases of N64 games haven't emulated it properly either.
  - anthk 2y ago
    Not an issue at 640x480 and higher resolutions. Once your run the games at 1024x768 and up that doesn't matter at all: sm64ex, perfectdark, zeldaoot for PC...
    - astrange 2y ago
      Doesn't it? I didn't go try it, but seems to me a different texture interpolation would be more obvious at higher resolutions. If you use one of those hires texture packs then it'd be fine.

perihelions 2y ago

- "If I was lucky it would be strcpy (opposed to something like strncpy)" it really ought to have been strncpy, I'm sure Tony Hawk who's lauded for his advocacy of safety gear would prefer to be associated with safer string copying

kragen 2y ago
strncpy is definitely not safer; it produces unterminated strings when it hits n basically you should almost never use strncpy; it's specifically for fixed-size fields like this: struct dirent { unsigned short inode; char name[14]; }; and in those cases more often than not the pad byte should be a space rather than a nul strncpy should never have been added to the standard library
- sidewndr46 2y ago
  What is the preferred solution here? I usually just use "memset" to zeroize the whole destination string, then tell "strncpy" that my destination is 1 byte shorter than what it really is. The real issue I've ran into is that "strncpy" assumes the source is null-terminated.
  - connicpu 2y ago
    C11 adds `strcpy_s` which takes (dest, destsz, src) and returns an errno_t which will report an error if the src string is longer than destsz, as silent truncation is often not a desirable behavior. It also assigns dest[0]='\0' on error so you don't get an unterminated garbage string.
    - david2ndaccount 2y ago
      Only msvc provides strcpy_s and they don’t conform to the standard. Other libcs don’t provide it. Ignore everything from Annex K and write your own wrappers around memcpy. You should always know the size of your buffers.
      - 2y ago

nj5rq 2y ago

Very good article.

makin 2y ago

A bit of a shame about the exploit applying to THUG PRO. The mod is played to this day, since the more competitive side of the Tony Hawk franchise has been dead for almost twenty years (with the exception of the THPS1+2 remake, which was but a blip in the scene). The mod itself is over 10 years old now, and I think the original developers are gone, explaining why no one was interested in fixing it when Ryan reported it. But this means that now the mod is unusable, no one is going to want to risk a full privilege exploit taking over their PC. Hopefully this article reaches someone who's a bit more interested in patching the mod.

rlabrecque 2y ago
I wish I had the time, because it would be fun. Back when I DID have time, I actually got that thug1 source code almost playable on Windows. That source code was only for the console versions, and the code assumed if it was compiling for windows (and not Xbox windows..) it was only for tools, so a lot of pieces worked completely differently.

auto 2y ago

I've read so many flavors of this sort of exploit analysis over the years, and if I get to read 100 more I'll be all the happier for it. Great article!

Retr0id 2y ago

> The more interesting thing about the habibi key is that the public key modulus only has a 4 byte difference compared to the Microsoft RSA public key. For reference the MS key is a 2048 bit RSA key. I’ve asked a few people how this might be possible and the answer I got is “if you change the exponent to something small like 3 you easily factor out a similar key”. This should require that the exponent of the public key is also patched to “3”. However, none of the shell code payloads that use the habibi key ever change the exponent used by the RSA signature verification routine. Presumably it’s still performing the validation using the exponent 65537 so I’m not entirely sure how this works. Perhaps someone more knowledgeable could shed some light on it. A random 2048-bit integer has a moderate chance of being trivially factorizeable (I don't know the precise odds but we can infer that it's roughly on the order of 2^-32 (for some definition of trivial) without doing any real math). Presumably, they wrote code that did something like this: while true: randomly tweak/increment 4 bytes of the public modulus spend 1 millisecond trying to factor it did it work? if yes, we're done here. else, try again. The resulting public modulus likely has lots of smaller factors (it should be possible to verify this, if anyone knows where I can find the "habibi public key"?). Although an RSA modulus normally has exactly 2 prime factors, the math still works out if you have more (as long as e is coprime).

fxtentacle 2y ago
Let me try to explain that. You start with a random 2048-bit integer. You then change the lower bytes to make it divisible by 3. This is easy because you're only working on the public key. Now that the public key is divisible by 3, you use Fermat's little theorem which tells you that the private key must be divisible by 3 and have a sum of digits that is divisible by 3. This lets you skip most possible private keys, thereby reducing the compute needed to factorize it by a few orders of magnitude. And maybe you get lucky and they use that RSA implementation which uses exactly 2 prime factors, because then you already know that one of them is 3 and you just divide the public key by 3 to get the other prime factor. EDIT: Wikipedia says "The structure of the RSA public key requires that N be a large semiprime (i.e., a product of two large prime numbers), that 2 < e < N, that e be coprime to φ(N), and that 0 ≤ C < N." and later "the same algorithm allows anyone who factors N to obtain the private key." which in the contest of the Xbox hack means that if you force N to be divisible by the prime 3, then the other prime which is used for generating the private key has to be N/3 => You have successfully factored it. EDIT2: Here's code for signing with the Habibi key: https://github.com/XboxDev/xbedump/blob/b8cd5cd0f8b1cbc4e64f41daf925a873d34dacf1/xboxlib.c#L408 https://github.com/XboxDev/xbedump/blob/b8cd5cd0f8b1cbc4e64f... As you can see, it'll replace the last 4 bytes with 0x89, 0x9c, 0x90, 0x6b and then start by dividing it by 3 and using that to generate a suitable private key.

brcmthrowaway 2y ago

This gives me an opportunity to clarify a myth from my childhood. Was Tony Hawk the first ever to hit a 720?

zimpenfish 2y ago
https://en.wikipedia.org/wiki/Aerial_(skateboarding) https://en.wikipedia.org/wiki/Aerial_(skateboarding) says "The 720, two full mid-air rotations, is one of the rarest tricks in skateboarding. It was first done by Tony Hawk in 1985, and it wasn't something he planned to do." (Which is presumably "the first recorded" but I'm guessing if someone had done it, they'd have been shouting about it and -probably- the only kind of person who could pull it off would be a pro skater anyway?)
- detoured299 2y ago
  At that time only a few pro vert skaters would have had the ability to throw 720s, yeah. Nowadays a good number of ams can too. The rarity of seeing a 720 or above has as much to do with the fact that most skaters don’t skate vert - instead skating street or smaller transition - as the trick’s difficulty. Outsiders tend to imagine large spins are the holy grail of skate moves but almost all skaters aren’t interested in them for aesthetic reasons among others.
- voytec 2y ago
  He worked much longer for the 900 but more importantly - he repeated the 900 at the age of 48[0]! [0] https://youtu.be/TnvPt_a7iOQ?t=93 https://youtu.be/TnvPt_a7iOQ?t=93
  - imiric 2y ago
    Even more impressive: a 9-year-old did three consecutive 900s in front of Tony Hawk[1]. Arguably, this feat is easier for a small child, but still... insane talent at a young age. [1]: https://old.reddit.com/1dh6p2h https://old.reddit.com/1dh6p2h

ComputerGuru 2y ago

FYI, what looks like a section header icon followed by the text "So what's the habibi key?" is actually a clickable expanding segment (html details). You should click it if you're interested! A question I have is where/when/how the corresponding private habibi key was released/leaked, if the story about it being used exclusively by the linux console group to prevent pirated content from being used is true. OP clearly was able to patch the four byte difference between the MS key and the habibi key to then run "unsigned" (but, actually, signed with the habibi private key) executables, so they clearly got their hands on it.

bri3d 2y ago
The Habibi key is generated by patching the Microsoft key to be divisible by 3, making it quite easy to factor indeed. The private key can be trivially recovered from the public key, and there was nothing really to release or leak. It was basically a little crypto CTF buried in the original 007: Agent Under Fire savegame hack, which was basically a CTF in and of itself (it was reasonably heavily obfuscated, I think both as a middle finger to pirates and as a challenge to other reverse engineers).
- ComputerGuru 2y ago
  Thanks, that makes perfect sense.

jdlyga 2y ago

Imagine a VSCode plugin that made up trick names and gave you a combo points score at the bottom for your continuous keystrokes. Tony Hawk's Pro-grammer

i_read_news 2y ago
I think this would be more fun for VIM keybindings, where there is a higher skill level (to get cooler combos of course).
high_priest 2y ago
This describes https://codestats.net https://codestats.net very well

Rebelgecko 2y ago

Thanks for sharing, the other articles on this blog are equally fascinating

Arrath 2y ago
"Running Halo 2 in true HD" was a really, really good read.

Jerrrrrrry 2y ago

It may not be possible for me to articulate how fucking insane of an accomplishment this is. Xbox 360...._softmod_.... via the park name on a Tony Hawk game. 24 segment ROP chain :') His rightful lamentation for the hypervisor, concise functional write up, and immediate thoughts of an x360 botnet make this the greatest xbox 360 nostalgia gut-punch of all time. kudos++

Reason077 2y ago

In Tony Hawk’s defence, he’s a pro skater, not a security analyst. Limited time behind the keyboard in the late 90s/early 2000s grinding on his soon-to-be iconic game series would have been spent making sure 900 McTwists felt really natural, not auditing code for buffer overruns!

JoshTriplett 2y ago

This seems like a great example of having the wrong security mindset in console development. "We're the only thing that can write this saved data, so we only have to parse what we wrote" is a very common console mindset, and fundamentally wrong when people can prepare artificially constructed saved data. (Completely separate from that, consoles shouldn't be treating users as the adversary, but given that they do, games are failing to have a security mindset consistent with that stance.)

cortesoft 2y ago
> consoles shouldn't be treating users as the adversary I would 100% agree with this when talking about a normal computer, but I kind of feel differently about consoles. How do you prevent cheating in online games if you don't restrict what users can do?
- JoshTriplett 2y ago
  1) Play with people you know, or 2) Group players by apparent capability and observed behavior, such that cheaters end up only playing with other cheaters.
  - searealist 2y ago
    1. makes matchmaking impossible, which is how 99% of people want to play. 2. is a research project that will probably never pan out.
    - JoshTriplett 2y ago
      Multiple games have done 2 in production with great success.
      - searealist 2y ago
        No they haven't. Maybe they have caught cheaters with _intrusive_ software. But that's not "observed behavior and apparent capability".

stard 2y ago

[flagged]

culopatin 2y ago

I was hoping that the exploit would only execute if he stuck the landing across the gap

mclau156 2y ago

at that point I would rather re-make the game in Godot

megaloblasto 2y ago

I have a dumb question. Once you soft mod a game console, what type of stuff can you do?

forgotmyacc 2y ago
Back in the day we mostly did it to cheat in Halo 2 online multiplayer. I remember being 13 and would stick a butter knife into my Xbox DVD drive so the "old maps" (on the disc) would fail to load, forcing the game to load a "new map" on the hard drive which I patched via soft modding the console allowing FTP to edit the maps on the hard drive.