Kartograph - DEF CON

KartographElie Bursztein and Jocelyn Lagarenne

Stanford University

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Welcome to the real world

supernatural powers !

• Learn kungfu

• Infinite money

• Xray vision

• god mode

God mode illustrated (video)

Memory based attack

Memory

Memory based attack

Memory

Modification

Memory based attack

Memory

Modification

Benefits (fast and furious)

• Generic

• Fast

• Invisible

• Generic

• Fast

• Invisible

• Structure are hard to find

• No control over the flow

Drawbacks

Game memory Structures

Background

Game industry

273 Millions games sold in 2009

Game type

Action

Game type

Action First person

Game type

Action First person Sport

Game type

Role playing

Game type

Role playing Adventure

Game type

Role playing Adventure Strategy

Game type

Strategy account for 35% of the games sold in 2009

Building

Resources

Minimap

Visible

Fog of war

Supreme commander 2

How to cheat at a RTS ?

Resources

Resources units

Resources units map

What is a map hack

There is no spoon

Maphack

How to do a map hack

Reduce

Reduce Find

Reduce Find Understand

Reduce Find Understand Rewrite

Acquiring game memory

Gamememory

Acquiring game memory

Gamememory

How to reduce the search space

Gamememory

Play Discover Play more

Gamememory

Acquiring the game’s memory

Step 1Removing unrelated

memory

Step 2Discovering the map and keeping relevant memory

Step 3Removing more unrelated

memory

Step 4Finding the map in the

remaining memory

Working assumption

Maps are stored in 2-D arrays

Working assumption

Maps are stored in 2-D arrays

Step 5Isolating the potential map

In game In memory

Step 6Understanding the map’s

structure

Step 8Rewriting the memory for

fun and profit

Unexpected effects

Unit hacking

Elie Bursztein Slide deck 2010 http://ly.tl/t1

Stay tuned for our next episode

Will be available in the online version of the slides

Kartograph Demo

Ongoing work

• Active attack (Network).

• Defense (Multi-parties crypto)

Questions

• Active attack (Network).

• Defense (Multi-parties crypto)

Kartograph - DEF CON

Documents

Transcript of Kartograph - DEF CON

DEF CON 25 Hacker Conference - DefCon Media Server CON 25/DEF CON 25 presentations/DEF… · functionality = self.checklist["Functionality"] ... Manually add ancillary data (pentest/other

Security Research over Windows - DEF CON › DEF CON China beta › DEF CON... · w32k attack surface hardening 4 years ago •Fonts •TTF emulation in kernel •Loading custom fonts

Teaching Old Shellcode New Tricks - DEF CON CON 25/DEF CON 25 presentations/DE… · Teaching Old Shellcode New Tricks DEF CON 2017 @midnite_runr

The Tor Project - DEF CON CON 25/DEF CON 25 presentations/DEF CON 25... · The Tor Project Our mission is to be the global resource for technology, advocacy, research and education

DEF CON 26 Hacking Conference - infocon.org CON/DEF CON 26/DEF CON... · Bryce Kunz - Stage 2 Security, Red Teaming & Splunk Security Services. CNO.io Kevin Lustic & Bryce Kunz (@TweekFawkes)

Bypass firewalls, application white ... - media.defcon.org CON 22/DEF CON 22 presentations... · DEF CON 22, 2014. Hungary. root@ ... ... DEFCON, DEF CON, Hacker, Security Conference,

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF CON 24...RDS-1 or "Stalin's Jet Engine" Inside knowledge of the Manhattan Project combined with looting Germany's

DEF CON 26 Hacking Conference CON 26/DEF CON 26 presentations/DEF… · Malware Analysis Triage with Automated Disassembly Amanda Rousseau Rich Seymour. About Us Amanda Rousseau Rich

Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24...Katea Murray –murrayka@leidos.com 2016-08-05 Estell/Murray Eavesdropping on the Machines 28. Title: DEF CON 24

DEF CON 23 Presentation

Last mile authentication problem - DEF CON CON 26/DEF CON 26...Last mile authentication problem Exploiting the missing link in end-to-end secure communication DEF CON 26 Our team Sid

Introduction to SDR & the Wireless Village - DEF CON CON 23/DEF CON 23 presentations/DEF… · Introduction to SDR & the Wireless Village ! Who the Frig...! satanklawz!! DaKahuna!

DEF CON 25 Hacker Conference CON 25/DEF CON 25 presentations/DEF CON 25 - 0ctane...reverse engineering Intel ME Technical Overview ... Linux and all programs run on the FPGA, so we

Kiosk Security - DEF CON

Infrared - Def Con

Cracking Cryptocurrency Brainwallets - DEF CON CON 23/DEF CON 23 presentations/DEF… · Cracking Cryptocurrency Brainwallets Ryan Castellucci ... pass a file with pubkeyhashs, ...

DEF CON 24 Hacking Conference - Ruxcon · Title: DEF CON 24 Hacking Conference Author: DEF CON 24 Speaker Keywords

Crypto for Hackers - DEF CON CON 23/DEF CON 23 presentations/DEF CON 23... · Crypto for Hackers Eijah v1.00 August 7th, 2015 “Shall we play a game? ...

How to secure the keyboard chain - DEF CON CON 23/DEF CON 23 presentations/DEF… · How to secure the keyboard chain DEF CON 23 Paul Amicelli - Baptiste David - CVO Esiea-Ouest c

DEF CON 25 Hacker Conference CON 25/DEF CON 25 presentations/DEF… · $ python c2960-lanbasek9-m-12.2 ... DEF CON 25 Hacker ... Subject: DEF CON 25 Presentation Keywords: DEF CON