{"id":456,"date":"2011-02-05T17:15:31","date_gmt":"2011-02-06T01:15:31","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=456"},"modified":"2011-02-05T17:15:31","modified_gmt":"2011-02-06T01:15:31","slug":"fun-with-game-memory","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2011\/02\/05\/fun-with-game-memory\/","title":{"rendered":"fun with game memory"},"content":{"rendered":"

So, I was testing a (closed source) single-player offline game recently and thought this exercise might be fun to document. I didn’t want to spend any time actually earning in-game money since I’d played it before and I wanted to just skip ahead to other aspects of the game. I was curious how straight-forward adjusting my cash might be. So, noting the in-game “bank account number” of 219393<\/strong> and account balance of 3000<\/strong>, I dived right in.<\/p>\n

First up, what’s the memory layout of the heap look like? I looked at the brk and the mmap regions without a mapped library or file, marked with “w” in the permissions column, from \/proc\/PID\/maps<\/code>:<\/p>\n

0827e000-08282000 rw-p 00000000 00:00 0
\n0a22e000<\/strong>–0b08a000<\/strong> rw-p 00000000 00:00 0 [heap]
\nefa59000-efd00000 rw-p 00000000 00:00 0
\nefd00000-efd21000 rw-p 00000000 00:00 0\n<\/p><\/blockquote>\n

Knowing these, I could use gdb’s “find” command, after attaching to the process:<\/p>\n

\n$ gdb \/some\/cool\/game
\n…
\n(gdb) attach PID
\n…
\n(gdb) find \/w 0x0827e000, 0x08282000, 219393<\/strong>
\n(gdb) find \/w 0x0a22e000<\/strong>, 0x0b08a000<\/strong>, 219393<\/strong>
\n0xaf03d08
\n0xaf06ca8<\/strong>\n<\/p><\/blockquote>\n

No hits in the first region, but I see two hits for the account number value in the second region. Let’s start there and see what’s near them…<\/p>\n

\n(gdb) x\/8x 0xaf03d08
\n0xaf03d08:\t0x00035901\t0x00000000\t0x00000000\t0x0af06ce0
\n0xaf03d18:\t0x0af06be0\t0x00000059\t0x0af03d98\t0x0af041e8
\n(gdb) x\/8x 0xaf06ca8<\/strong>
\n0xaf06ca8:\t0x00035901\t0x00000bb8<\/strong>\t0x00000bb8<\/strong>\t0x0820b148
\n0xaf06cb8:\t0x00000001\t0x00000000\t0x00000000\t0x00000000\n<\/p><\/blockquote>\n

In that second hit, I see the value 0xBB8<\/strong>, which is 3000<\/strong>, and matches our account balance. Let’s see what happens if we just change both of those to add a bit a few orders of magnitude above the current value…<\/p>\n

\n(gdb) set var *0xaf06cac = 0x00100bb8
\n(gdb) set var *0xaf06cb0 = 0x00100bb8
\n(gdb) x\/32x 0xaf06cac
\n0xaf06cac:\t0x00100bb8\t0x00100bb8\t0x0820b148\t0x00000001
\n(gdb) continue\n<\/p><\/blockquote>\n

And presto, clicking on the bank account details in-game shows a huge account balance of 1051576 now. No need to reverse-engineer any saved games, whew.<\/p>\n

© 2011, Kees Cook<\/a>. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License<\/a>.
\"CC<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"

So, I was testing a (closed source) single-player offline game recently and thought this exercise might be fun to document. I didn’t want to spend any time actually earning in-game money since I’d played it before and I wanted to just skip ahead to other aspects of the game. I was curious how straight-forward adjusting […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,18,1,10,14],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/456"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=456"}],"version-history":[{"count":8,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/456\/revisions"}],"predecessor-version":[{"id":464,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/456\/revisions\/464"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=456"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=456"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=456"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}