1
00:00:00,000 --> 00:00:04,300
Next speaker is David showing us an introduction to Cheat Engine.

2
00:00:09,180 --> 00:00:14,860
Thanks, everyone. So as you said, I'm David. I'm here to talk about hacking video games.

3
00:00:17,740 --> 00:00:27,540
I'm a security researcher at... Thanks. I work at Cinec. I hack programs there and

4
00:00:27,540 --> 00:00:34,280
hardware. I love hacking programs and hardware, pwning noobs and video games, snowboarding,

5
00:00:34,460 --> 00:00:42,420
hiking, that sort of thing. So a little bit of motivation. Why would you want to learn

6
00:00:42,420 --> 00:00:47,680
Cheat Engine? So if you have friends who are better at video games than you are and you

7
00:00:47,680 --> 00:00:54,520
want to beat them all the time, this is a way to do that. You can modify your video games

8
00:00:54,520 --> 00:00:56,140
to have a little more fun with them.

9
00:00:57,540 --> 00:01:02,500
And you can also just learn about programs, video games, how they're made, and learn how to

10
00:01:02,500 --> 00:01:11,240
hack them. So we'll learn a little bit about how to find internal game variables in this talk,

11
00:01:11,380 --> 00:01:17,680
how to scan memory, edit memory, and how that all works. And then we'll hack Minecraft at the

12
00:01:17,680 --> 00:01:23,760
end. In my picture here, you'll notice something kind of funny if you've ever played Pokemon.

13
00:01:24,020 --> 00:01:26,180
I have a level 70 Charmander.

14
00:01:27,820 --> 00:01:32,380
So it's not photoshopped. And I'll show you guys how to do that.

15
00:01:40,480 --> 00:01:43,300
Okay. But first, we're going to start a little easy.

16
00:01:49,660 --> 00:01:53,460
Okay. So I don't know if you guys have ever seen this. It's kind of an old video game. This is

17
00:01:53,460 --> 00:01:54,340
Super Mario 64.

18
00:01:57,540 --> 00:02:15,040
Anybody play this? All right. Cool. So over here, this is cheat engine. And you'll see down here,

19
00:02:15,180 --> 00:02:25,880
I've scanned memory. And do you notice anything interesting about this number? It's the number of

20
00:02:25,880 --> 00:02:26,680
coins that I have.

21
00:02:27,480 --> 00:02:33,840
So with cheat engine, it allows us to modify this internal variable. So I can make it, like,

22
00:02:33,860 --> 00:02:42,660
9999. And then it'll update. So it's pretty sweet, right? So now let's hack Pokemon.

23
00:02:46,360 --> 00:02:46,820
.

24
00:02:56,200 --> 00:02:56,660
.

25
00:05:30,960 --> 00:05:36,640
So we saw that memory scanning is super powerful, right? So let's take a look at, like, how it works

26
00:05:36,640 --> 00:05:44,120
internally a little bit before we get into Minecraft. So why would you want to scan memory? Well,

27
00:05:44,180 --> 00:05:51,620
we can find powerful variables, like health, experience, player position, and inventory items.

28
00:05:52,100 --> 00:05:56,640
. So internally, it works pretty simply. So if you want to scan memory, you're going to need to

29
00:05:56,640 --> 00:05:58,800
have a lot of memory. So you can see here, there are operating system functions that allow

30
00:05:58,800 --> 00:06:06,200
programmers to get a representation of other processes running on the computer and then read and

31
00:06:06,200 --> 00:06:13,120
write to memory. So the arguments that the operating system wants from the user are the address

32
00:06:13,120 --> 00:06:20,540
that they'd like to read from, how much they'd like to read, and what they want to read into,

33
00:06:20,700 --> 00:06:26,620
things like that. So now let's apply what we've learned here. So we're going to have a lot of

34
00:06:26,620 --> 00:06:33,680
let's go back here to Minecraft. So if we wanted infinite items, we should be able to search the

35
00:06:33,680 --> 00:06:41,080
number of items in a slot in memory, right? And then we can filter through our search results

36
00:06:41,080 --> 00:06:46,120
because we're going to find a lot of other internal game variables that just happen to be the same

37
00:06:46,120 --> 00:06:50,100
number, but they don't actually control the number of items that we have. So we're going to be able

38
00:06:50,100 --> 00:06:55,820
able to filter through that by getting rid of and gaining items and then using that to filter

39
00:06:55,820 --> 00:07:17,240
through our results. Okay. So I'll create a new world. And while we do this, I'll just go

40
00:07:17,240 --> 00:07:21,380
ahead and tell Cheat Engine that we want to examine the Minecraft process.

41
00:08:00,360 --> 00:08:12,140
Okay. So now we have a few items in our inventory. And I can go over here. I can search the number

42
00:08:12,140 --> 00:08:14,540
of items that we have in that piece of inventory.

43
00:08:36,680 --> 00:08:41,300
Okay. So we have all these results. And like I said, a lot of these, we have a lot of results.

44
00:08:41,480 --> 00:08:47,220
This is like 5,200,000 results. So we need to do something about that. And I'll go ahead and

45
00:08:47,220 --> 00:08:54,160
say we need to filter through these and actually find which one it represents, right? So if we go

46
00:08:54,160 --> 00:08:59,440
back to the game, if I can remember the key, I should be able to get rid of one of these.

47
00:09:03,380 --> 00:09:14,300
Thank you. All right. I love getting help from the crowd. All right. So I got rid of one item.

48
00:09:14,460 --> 00:09:17,200
So now the number of items in that slot is one. So I'm going to go ahead and get rid of one.

49
00:09:17,220 --> 00:09:29,560
So I can filter through this search result. All right. So now I've got a lot less items. You see

50
00:09:29,560 --> 00:09:37,680
I got down to 53,000. And we can just, because these, the other internal variables that don't

51
00:09:37,680 --> 00:09:43,600
represent the number of items in that slot will change, especially as I move around.

52
00:09:47,440 --> 00:09:55,420
So now I accidentally picked one up. It went up to two. So I'll go back over here and search for

53
00:09:55,420 --> 00:10:10,560
two. And I can just kind of rinse and repeat this. I'll get rid of it. Go back here and search for

54
00:10:10,560 --> 00:10:17,200
one. All right. I've got a bunch of values here. So I'm going to go ahead and get rid of one.

55
00:10:17,220 --> 00:10:33,340
I've really trimmed it down. We're down to 11. Go back here and search for two. You can see that

56
00:10:33,340 --> 00:10:44,340
we actually, these ones don't represent the items because we went up to two and all of our values

57
00:10:44,340 --> 00:10:45,240
are still one.

58
00:10:46,060 --> 00:10:53,600
So this demo kind of failed. But if you come and see me after, I'll get it right in front of you.

59
00:10:56,700 --> 00:11:03,520
Sorry about that, guys. The next ones will be much better, I swear. You can see that I was

60
00:11:03,520 --> 00:11:14,400
actually able to do it. I took an item that I only had three of and I changed it to 31337. So the

61
00:11:14,400 --> 00:11:15,220
next demo I have is going to be a little bit different. I'm going to go ahead and get rid of one.

62
00:11:15,240 --> 00:11:22,440
This one is pretty cool. This was a lot less complicated than searching through memory. I was

63
00:11:22,440 --> 00:11:27,680
actually able to trace the events that the game was making, like writing to and reading from files.

64
00:11:28,040 --> 00:11:34,940
And I was able to find which file represented the achievements that I had. And I could change my

65
00:11:34,940 --> 00:11:40,960
achievements to open like 3,000 chests when I had just started the game. Stuff like that. So that

66
00:11:40,960 --> 00:11:45,220
was pretty cool. This is going to be my most exciting demo. So this is a demo I have done since

67
00:11:45,240 --> 00:11:52,440
This is teleporting. So in Minecraft, I don't know if you guys have ever seen this, but

68
00:11:52,880 --> 00:11:58,280
there's a debug screen. If you hit F3, it will show you all kinds of cool information like

69
00:11:58,280 --> 00:12:09,180
your position on the map. You see that over here? My XYZ coordinates on the map. So I

70
00:12:09,180 --> 00:12:12,820
thought that was pretty fun and I just started searching for that in memory. The problem with

71
00:12:12,820 --> 00:12:20,360
that is if you notice, these are decimal values. They have a decimal point right here and a few

72
00:12:20,360 --> 00:12:27,660
numbers afterwards. So if you search that in memory, you probably won't find anything and

73
00:12:27,660 --> 00:12:33,200
it's because these are the rounded values of your position on the map. They're not like the

74
00:12:33,200 --> 00:12:42,700
full values of your map that have a high precision. So how was I supposed to find

75
00:12:42,700 --> 00:12:42,800
that? I was supposed to go to the top of the map. I was supposed to go to the bottom of the map.

76
00:12:42,800 --> 00:12:47,600
I was supposed to find these high precision values before they got rounded. Well, I found my

77
00:12:47,600 --> 00:12:54,080
save file. And inside my save file, if you open it up with a program that's made to parse these

78
00:12:54,080 --> 00:13:01,240
files, also known as an NBT editor, then you're able to find your position on the map. See?

79
00:13:03,060 --> 00:13:12,640
These ones are the unrounded versions of what's displayed on the screen. So I'll demonstrate that

80
00:13:12,640 --> 00:13:21,340
really quick. I've got this really cool program I learned how to use called Unmind. And basically

81
00:13:21,340 --> 00:13:32,460
it'll open up your save file. So I'm in New World, I think, right? Yeah. So that's my map. And I

82
00:13:32,460 --> 00:13:42,620
can just, like, pick anywhere on my map. How about this beach? That looks nice. I'm going to

83
00:13:43,440 --> 00:14:10,840
go up in the trees. So I can copy that location. I need some place to paste my location. One second.

84
00:14:23,220 --> 00:14:25,000
Oh, my God. What fail?

85
00:14:47,340 --> 00:14:51,480
All right. So that's where we want to teleport. That's the X, Y, Z coordinates of where we want

86
00:14:51,480 --> 00:15:10,040
to teleport. All right. So... All right. So... All right. All right. All right. All right.

87
00:15:10,840 --> 00:15:15,100
First we need to be able to... First we need to find our X, Y, Z coordinates in memory. So the way

88
00:15:15,100 --> 00:15:19,660
we're going to do that is we're going to open up the game save file in our NBT editor. And then we're

89
00:15:19,660 --> 00:15:26,920
going to copy those full precision values and search those in memory. And then that will allow us

90
00:15:26,920 --> 00:15:34,860
to find the X, Y, Z coordinates. So I need to save the game first so that those values get written

91
00:15:34,860 --> 00:15:35,420
to the file.

92
00:15:45,640 --> 00:15:46,000
.

93
00:15:46,780 --> 00:15:47,140
.

94
00:15:58,180 --> 00:15:58,540
.

95
00:15:58,540 --> 00:15:58,720
.

96
00:15:58,720 --> 00:15:58,900
.

97
00:15:58,900 --> 00:15:58,980
.

98
00:15:58,980 --> 00:15:59,340
.

99
00:15:59,340 --> 00:15:59,740
.

100
00:15:59,740 --> 00:15:59,860
.

101
00:15:59,860 --> 00:15:59,940
.

102
00:15:59,940 --> 00:16:00,020
.

103
00:16:03,680 --> 00:16:04,040
.

104
00:16:04,040 --> 00:16:04,060
.

105
00:16:11,680 --> 00:16:12,220
.

106
00:16:12,220 --> 00:16:19,660
Alright, so here's my player information. Sorry, this is pretty small. And then we're

107
00:16:19,660 --> 00:16:27,440
looking for our position. So pause. There's pause. And here's our three, our X, Y, Z coordinates.

108
00:16:28,340 --> 00:16:38,540
So first we want to find this X coordinate. So I'll load back up my game. New world. and I'll

109
00:16:38,540 --> 00:16:40,820
find sheet engine. Soúóalr Chase doesn't have to be able to searcháó shellááááááááááááááááááááááááóááááááááááááàááááááááááááááááááááááááááááááááááááàáááááááááááááá.

110
00:16:50,260 --> 00:16:52,040
Thank you.

111
00:17:18,320 --> 00:17:31,820
Okay. We got results. So like I said, you want to be able to filter through these values.

112
00:17:32,160 --> 00:17:38,220
A lot of values are just going to end up being the same just by chance. So what I'm doing

113
00:17:38,220 --> 00:17:40,820
right now is just looking around to increase what's called entropy. So what I'm doing right

114
00:17:40,840 --> 00:17:44,040
now is just looking around to increase what's called entropy. To change all these values that

115
00:17:44,040 --> 00:17:51,020
don't represent my X position. So you see I got down to 25. So I'll add these to my list.

116
00:18:07,660 --> 00:18:10,820
Because those are my X position. And then I'm going to change my X position. So I'm going to

117
00:18:10,840 --> 00:18:16,880
go back to our NBT editor and we'll move on to the next. So we've got an X, a Y, and a Z.

118
00:18:17,560 --> 00:18:35,400
I'm going to search for Z next. So we're searching for our Z position now. I'm sorry. This is a

119
00:18:35,400 --> 00:18:40,720
little bit tedious. But it'll be really cool once we get to teleport. And if you guys want to see

120
00:18:40,720 --> 00:18:47,340
more of these. If you guys want to see this afterwards. How did I just get rid of that? Oh, no.

121
00:18:48,780 --> 00:18:54,540
If you guys want to see this afterwards. If you want to see like infinite items. I had another

122
00:18:54,540 --> 00:18:59,840
demo prepared where I could actually take an item and then convert it into any other item that I

123
00:18:59,840 --> 00:19:08,400
wanted. So I could take wood and make it diamonds. All right. So we're getting some entropy again.

124
00:19:08,480 --> 00:19:10,700
Just like looking around without moving our position. So we're going to go back to our X position.

125
00:19:10,720 --> 00:19:17,940
And we can see that we've got our X position on the map. And we're just going to filter down. We're

126
00:19:17,940 --> 00:19:24,020
ABLE TO SPL multiplayer. OWT in 5,000 VALUES. We don't want to modify this many values because

127
00:19:25,640 --> 00:19:30,340
that is going to slowdown our process a lot. We want to get down to like less than 100 values.

128
00:19:32,800 --> 00:19:38,940
Because often in these video games there's a lot of copies of things. So it's okay if you just change

129
00:19:39,480 --> 00:19:40,700
all of the copies. And in real life self phải infoboro never Flying and I really need to do this

130
00:19:40,720 --> 00:19:44,360
But you want everything that actually represents the value that you're interested in.

131
00:19:48,040 --> 00:19:52,940
All right, we're down to 29 values that represent our Z position in memory.

132
00:19:54,560 --> 00:19:55,240
That's good.

133
00:20:14,740 --> 00:20:17,800
Okay, the next one's pretty easy, our Y position.

134
00:20:18,600 --> 00:20:20,080
That's just 63.

135
00:20:21,360 --> 00:20:22,480
So we'll search for that.

136
00:20:33,300 --> 00:20:35,400
And then we're going to filter through them as well.

137
00:20:35,720 --> 00:20:37,380
It's because we're at 21,000.

138
00:20:37,380 --> 00:20:39,280
We want less than that.

139
00:20:41,140 --> 00:20:43,320
Y is actually really easy to change.

140
00:20:52,580 --> 00:20:53,840
Yeah, we're down to 193.

141
00:20:53,960 --> 00:20:54,640
This is pretty okay.

142
00:21:03,020 --> 00:21:03,660
Oh, my God.

143
00:21:03,740 --> 00:21:04,000
Okay.

144
00:21:05,040 --> 00:21:05,940
I'll just quit then.

145
00:21:07,580 --> 00:21:08,140
I'm sorry.

146
00:21:08,240 --> 00:21:08,880
We're out of time.

147
00:21:12,360 --> 00:21:17,080
So come see me afterwards, and I'll finish out this demo for you guys if you guys are interested.

148
00:21:18,740 --> 00:21:20,060
I'd like to show some resources.

149
00:21:20,220 --> 00:21:22,120
The game hacking book, I've got it with me.

150
00:21:22,160 --> 00:21:23,220
I can show it to you guys if you want.

151
00:21:23,340 --> 00:21:24,240
I learned a lot from it.

152
00:21:25,140 --> 00:21:36,760
There's great tutorials on YouTube, forums, Wikipedias for, like, on Minecraft to find, like, all of the IDs for the different items.

153
00:21:38,380 --> 00:21:40,380
And then in wrapping, I'd like to...

154
00:21:40,720 --> 00:21:48,680
I'd like to say thank you to Synac for sponsoring this talk, the Dark Byte for making Cheat Engine, and to my friends for game hacking with me.

155
00:21:50,140 --> 00:21:50,780
Thanks, everyone.

156
00:21:50,980 --> 00:21:51,080
Thank you.