Under the Microscope: Three Dirty Dwarves | Hacker News Reader

Under the Microscope: Three Dirty Dwarves

32bits.substack.com

61 pointszdw10 comments

There are lots of cool things like this to discover in Sega Saturn games, in large part because people are intimidated by the notoriously difficult SH-2 assembly language.

However, the Saturn surprisingly has really good tools for reverse engineering. There is a very good save state loader for Ghidra, and the Mednafen debugger allows for on-the-fly memory editing.

With these methods I also found a cheat code for Clockwork Knight 2 that grants access to the entire first game! Somehow that was secret for decades.

I wonder how complex a cheat code system you could make - resilient to decompiling and examinations.

I’m thinking things like the code itself is interpreted as a memory address/jump and most do nothing or crash …

This video might be of interest, how to crack a C64 game. There's multiple protections and steps, it was quite interesting to see the length they've gone to slow down piracy.

https://youtu.be/yVtKKb3wkYc

Black-box obfuscation has been proven to be impossible: https://dash.harvard.edu/bitstream/handle/1/12644697/9034637... - the best possible is indistinguishability obfuscation (iO) that makes impossible to distinguish any two programs which have the same outputs for the same inputs.

Better might be to use a Key Derivation Function (e.g. bcrypt) and treat cheat codes like passwords. This wouldn't obfuscate what the set of available cheat codes do, but finding the actual code would be hard if they are sufficiently long and random.

I have done something like this for embedding Easter eggs in websites where a user can just "view source" to see the code. I want someone who looks to know there is an Easter egg, but not know what it does or how to activate it...

Code is AES-GCM encrypted, and the encrypted blob is stored on the web server. The "cheat code" to activate the Easter egg is the decryption key (the passphrase used with a key derivation function, to be precise). Entering the cheat code triggers an attempt to decrypt the blob. If the password is correct and the code decrypts successfully, the decrypted code is run with eval. If the passphrase is incorrect, nothing happens.

Thus, nobody inspecting the code can know what the cheat code is or what it does without breaking the crypto. But someone who knows it can enter it and trigger the magical cheat behavior.

Note that it's important to use authenticated encryption so that the user's browser doesn't try to execute garbled text when decryption fails.

You might well end up with cheat codes that are unintended this way! See: arbitrary execution glitches allowing skipping to loading functions to load the final area in some TAS speedruns

One time i was making an interactive video website, where user could jump between sections of the video. I added an easter egg, where the video would have an extra section, to which you could jump by clicking "next" button twice if well timed. It was done via underhanded JS: Number of sections was computed based on video duration, so uploading a video with more than expected number of sections, could cause out of bounds jump

Reminds me of abuse of the RED Book - CDs could have long tracks of silence to hide an extra track, but you could see that. The hotshit was to put it before the first track’s starting point; this could make something that could only be accessed by seeking backwards.

If it's just a simple jump people will generally find code that remains unused in the program and figure out how to trigger it.

There's a Saturn game called Thunderhawk II that has a password system. Part of it includes XORing one of the buffers with the string "NOSEY GIT", which I took to mean they were chiding me for trying to snoop on the system.

To their credit, I couldn't figure it out!

Reply on news.ycombinator.com