Next speaker is David showing us an introduction to Cheat Engine.
Thanks, everyone. So as you said, I'm David. I'm here to talk about hacking video games.
I'm a security researcher at... Thanks. I work at Cinec. I hack programs there and
hardware. I love hacking programs and hardware, pwning noobs and video games, snowboarding,
hiking, that sort of thing. So a little bit of motivation. Why would you want to learn
Cheat Engine? So if you have friends who are better at video games than you are and you
want to beat them all the time, this is a way to do that. You can modify your video games
to have a little more fun with them.
And you can also just learn about programs, video games, how they're made, and learn how to
hack them. So we'll learn a little bit about how to find internal game variables in this talk,
how to scan memory, edit memory, and how that all works. And then we'll hack Minecraft at the
end. In my picture here, you'll notice something kind of funny if you've ever played Pokemon.
I have a level 70 Charmander.
So it's not photoshopped. And I'll show you guys how to do that.
Okay. But first, we're going to start a little easy.
Okay. So I don't know if you guys have ever seen this. It's kind of an old video game. This is
Super Mario 64.
Anybody play this? All right. Cool. So over here, this is cheat engine. And you'll see down here,
I've scanned memory. And do you notice anything interesting about this number? It's the number of
coins that I have.
So with cheat engine, it allows us to modify this internal variable. So I can make it, like,
9999. And then it'll update. So it's pretty sweet, right? So now let's hack Pokemon.
.
.
So we saw that memory scanning is super powerful, right? So let's take a look at, like, how it works
internally a little bit before we get into Minecraft. So why would you want to scan memory? Well,
we can find powerful variables, like health, experience, player position, and inventory items.
. So internally, it works pretty simply. So if you want to scan memory, you're going to need to
have a lot of memory. So you can see here, there are operating system functions that allow
programmers to get a representation of other processes running on the computer and then read and
write to memory. So the arguments that the operating system wants from the user are the address
that they'd like to read from, how much they'd like to read, and what they want to read into,
things like that. So now let's apply what we've learned here. So we're going to have a lot of
let's go back here to Minecraft. So if we wanted infinite items, we should be able to search the
number of items in a slot in memory, right? And then we can filter through our search results
because we're going to find a lot of other internal game variables that just happen to be the same
number, but they don't actually control the number of items that we have. So we're going to be able
able to filter through that by getting rid of and gaining items and then using that to filter
through our results. Okay. So I'll create a new world. And while we do this, I'll just go
ahead and tell Cheat Engine that we want to examine the Minecraft process.
Okay. So now we have a few items in our inventory. And I can go over here. I can search the number
of items that we have in that piece of inventory.
Okay. So we have all these results. And like I said, a lot of these, we have a lot of results.
This is like 5,200,000 results. So we need to do something about that. And I'll go ahead and
say we need to filter through these and actually find which one it represents, right? So if we go
back to the game, if I can remember the key, I should be able to get rid of one of these.
Thank you. All right. I love getting help from the crowd. All right. So I got rid of one item.
So now the number of items in that slot is one. So I'm going to go ahead and get rid of one.
So I can filter through this search result. All right. So now I've got a lot less items. You see
I got down to 53,000. And we can just, because these, the other internal variables that don't
represent the number of items in that slot will change, especially as I move around.
So now I accidentally picked one up. It went up to two. So I'll go back over here and search for
two. And I can just kind of rinse and repeat this. I'll get rid of it. Go back here and search for
one. All right. I've got a bunch of values here. So I'm going to go ahead and get rid of one.
I've really trimmed it down. We're down to 11. Go back here and search for two. You can see that
we actually, these ones don't represent the items because we went up to two and all of our values
are still one.
So this demo kind of failed. But if you come and see me after, I'll get it right in front of you.
Sorry about that, guys. The next ones will be much better, I swear. You can see that I was
actually able to do it. I took an item that I only had three of and I changed it to 31337. So the
next demo I have is going to be a little bit different. I'm going to go ahead and get rid of one.
This one is pretty cool. This was a lot less complicated than searching through memory. I was
actually able to trace the events that the game was making, like writing to and reading from files.
And I was able to find which file represented the achievements that I had. And I could change my
achievements to open like 3,000 chests when I had just started the game. Stuff like that. So that
was pretty cool. This is going to be my most exciting demo. So this is a demo I have done since
This is teleporting. So in Minecraft, I don't know if you guys have ever seen this, but
there's a debug screen. If you hit F3, it will show you all kinds of cool information like
your position on the map. You see that over here? My XYZ coordinates on the map. So I
thought that was pretty fun and I just started searching for that in memory. The problem with
that is if you notice, these are decimal values. They have a decimal point right here and a few
numbers afterwards. So if you search that in memory, you probably won't find anything and
it's because these are the rounded values of your position on the map. They're not like the
full values of your map that have a high precision. So how was I supposed to find
that? I was supposed to go to the top of the map. I was supposed to go to the bottom of the map.
I was supposed to find these high precision values before they got rounded. Well, I found my
save file. And inside my save file, if you open it up with a program that's made to parse these
files, also known as an NBT editor, then you're able to find your position on the map. See?
These ones are the unrounded versions of what's displayed on the screen. So I'll demonstrate that
really quick. I've got this really cool program I learned how to use called Unmind. And basically
it'll open up your save file. So I'm in New World, I think, right? Yeah. So that's my map. And I
can just, like, pick anywhere on my map. How about this beach? That looks nice. I'm going to
go up in the trees. So I can copy that location. I need some place to paste my location. One second.
Oh, my God. What fail?
All right. So that's where we want to teleport. That's the X, Y, Z coordinates of where we want
to teleport. All right. So... All right. So... All right. All right. All right. All right.
First we need to be able to... First we need to find our X, Y, Z coordinates in memory. So the way
we're going to do that is we're going to open up the game save file in our NBT editor. And then we're
going to copy those full precision values and search those in memory. And then that will allow us
to find the X, Y, Z coordinates. So I need to save the game first so that those values get written
to the file.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
Alright, so here's my player information. Sorry, this is pretty small. And then we're
looking for our position. So pause. There's pause. And here's our three, our X, Y, Z coordinates.
So first we want to find this X coordinate. So I'll load back up my game. New world. and I'll
find sheet engine. Soúóalr Chase doesn't have to be able to searcháó shellááááááááááááááááááááááááóááááááááááááàááááááááááááááááááááááááááááááááááááàáááááááááááááá.
Thank you.
Okay. We got results. So like I said, you want to be able to filter through these values.
A lot of values are just going to end up being the same just by chance. So what I'm doing
right now is just looking around to increase what's called entropy. So what I'm doing right
now is just looking around to increase what's called entropy. To change all these values that
don't represent my X position. So you see I got down to 25. So I'll add these to my list.
Because those are my X position. And then I'm going to change my X position. So I'm going to
go back to our NBT editor and we'll move on to the next. So we've got an X, a Y, and a Z.
I'm going to search for Z next. So we're searching for our Z position now. I'm sorry. This is a
little bit tedious. But it'll be really cool once we get to teleport. And if you guys want to see
more of these. If you guys want to see this afterwards. How did I just get rid of that? Oh, no.
If you guys want to see this afterwards. If you want to see like infinite items. I had another
demo prepared where I could actually take an item and then convert it into any other item that I
wanted. So I could take wood and make it diamonds. All right. So we're getting some entropy again.
Just like looking around without moving our position. So we're going to go back to our X position.
And we can see that we've got our X position on the map. And we're just going to filter down. We're
ABLE TO SPL multiplayer. OWT in 5,000 VALUES. We don't want to modify this many values because
that is going to slowdown our process a lot. We want to get down to like less than 100 values.
Because often in these video games there's a lot of copies of things. So it's okay if you just change
all of the copies. And in real life self phải infoboro never Flying and I really need to do this
But you want everything that actually represents the value that you're interested in.
All right, we're down to 29 values that represent our Z position in memory.
That's good.
Okay, the next one's pretty easy, our Y position.
That's just 63.
So we'll search for that.
And then we're going to filter through them as well.
It's because we're at 21,000.
We want less than that.
Y is actually really easy to change.
Yeah, we're down to 193.
This is pretty okay.
Oh, my God.
Okay.
I'll just quit then.
I'm sorry.
We're out of time.
So come see me afterwards, and I'll finish out this demo for you guys if you guys are interested.
I'd like to show some resources.
The game hacking book, I've got it with me.
I can show it to you guys if you want.
I learned a lot from it.
There's great tutorials on YouTube, forums, Wikipedias for, like, on Minecraft to find, like, all of the IDs for the different items.
And then in wrapping, I'd like to...
I'd like to say thank you to Synac for sponsoring this talk, the Dark Byte for making Cheat Engine, and to my friends for game hacking with me.
Thanks, everyone.
Thank you.