Kartograph - DEF CON

73
Kartograph Elie Bursztein and Jocelyn Lagarenne Stanford University 1

Transcript of Kartograph - DEF CON

Page 1: Kartograph - DEF CON

KartographElie Bursztein and Jocelyn Lagarenne

Stanford University

1

Page 2: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Welcome to the real world

Page 3: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

supernatural powers !

• Learn kungfu

• Infinite money

• Xray vision

• god mode

Page 4: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

God mode illustrated (video)

http://ly.tl/t1
http://ly.tl/t1
Page 5: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Memory based attack

Memory

http://ly.tl/t1
http://ly.tl/t1
Page 6: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Memory based attack

Memory

Modification

http://ly.tl/t1
http://ly.tl/t1
Page 7: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Memory based attack

Memory

Modification

http://ly.tl/t1
http://ly.tl/t1
Page 8: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Benefits (fast and furious)

• Generic

• Fast

• Invisible

• Generic

• Fast

• Invisible

http://ly.tl/t1
http://ly.tl/t1
Page 9: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

• Structure are hard to find

• No control over the flow

Drawbacks

Game memory Structures

http://ly.tl/t1
http://ly.tl/t1
Page 10: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Background

http://ly.tl/t1
http://ly.tl/t1
Page 11: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Game industry

273 Millions games sold in 2009

Page 12: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Game type

Action

http://ly.tl/t1
http://ly.tl/t1
Page 13: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Game type

Action First person

http://ly.tl/t1
http://ly.tl/t1
Page 14: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Game type

Action First person Sport

http://ly.tl/t1
http://ly.tl/t1
Page 15: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Game type

Action First person Sport

Role playing

http://ly.tl/t1
http://ly.tl/t1
Page 16: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Game type

Action First person Sport

Role playing Adventure

http://ly.tl/t1
http://ly.tl/t1
Page 17: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Game type

Action First person Sport

Role playing Adventure Strategy

http://ly.tl/t1
http://ly.tl/t1
Page 18: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Game type

http://ly.tl/t1
http://ly.tl/t1
Page 19: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Page 20: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Strategy account for 35% of the games sold in 2009

Page 21: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Page 22: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Units

Page 23: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Building

Page 24: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Resources

Page 25: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Minimap

Page 26: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Visible

Page 27: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Fog of war

Page 28: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Supreme commander 2

http://ly.tl/t1
http://ly.tl/t1
Page 29: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to cheat at a RTS ?

http://ly.tl/t1
http://ly.tl/t1
Page 30: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to cheat at a RTS ?

Resources

http://ly.tl/t1
http://ly.tl/t1
Page 31: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to cheat at a RTS ?

Resources units

http://ly.tl/t1
http://ly.tl/t1
Page 32: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to cheat at a RTS ?

Resources units map

http://ly.tl/t1
http://ly.tl/t1
Page 33: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

What is a map hack

http://ly.tl/t1
http://ly.tl/t1
Page 34: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

What is a map hack

http://ly.tl/t1
http://ly.tl/t1
Page 35: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

There is no spoon

Page 36: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Maphack

http://ly.tl/t1
http://ly.tl/t1
Page 37: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to do a map hack

http://ly.tl/t1
http://ly.tl/t1
Page 38: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to do a map hack

http://ly.tl/t1
http://ly.tl/t1
Page 39: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to do a map hack

Reduce

http://ly.tl/t1
http://ly.tl/t1
Page 40: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to do a map hack

Reduce Find

http://ly.tl/t1
http://ly.tl/t1
Page 41: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to do a map hack

Reduce Find Understand

http://ly.tl/t1
http://ly.tl/t1
Page 42: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to do a map hack

Reduce Find Understand Rewrite

http://ly.tl/t1
http://ly.tl/t1
Page 43: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Acquiring game memory

Gamememory

http://ly.tl/t1
http://ly.tl/t1
Page 44: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Acquiring game memory

Gamememory

http://ly.tl/t1
http://ly.tl/t1
Page 45: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to reduce the search space

Gamememory

Play Discover Play more

http://ly.tl/t1
http://ly.tl/t1
Page 46: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to reduce the search space

Gamememory

Play Discover Play more

http://ly.tl/t1
http://ly.tl/t1
Page 47: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to reduce the search space

Gamememory

Play Discover Play more

http://ly.tl/t1
http://ly.tl/t1
Page 48: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to reduce the search space

Gamememory

Play Discover Play more

http://ly.tl/t1
http://ly.tl/t1
Page 49: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

How to reduce the search space

Gamememory

Play Discover Play more

http://ly.tl/t1
http://ly.tl/t1
Page 50: Kartograph - DEF CON

Acquiring the game’s memory

Page 51: Kartograph - DEF CON
Page 52: Kartograph - DEF CON

Step 1Removing unrelated

memory

Page 53: Kartograph - DEF CON
Page 54: Kartograph - DEF CON

Step 2Discovering the map and keeping relevant memory

Page 55: Kartograph - DEF CON
Page 56: Kartograph - DEF CON

Step 3Removing more unrelated

memory

Page 57: Kartograph - DEF CON
Page 58: Kartograph - DEF CON

Step 4Finding the map in the

remaining memory

Page 59: Kartograph - DEF CON

Working assumption

Maps are stored in 2-D arrays

Page 60: Kartograph - DEF CON

Working assumption

Maps are stored in 2-D arrays

Page 61: Kartograph - DEF CON
Page 62: Kartograph - DEF CON

Step 5Isolating the potential map

Page 63: Kartograph - DEF CON

In game In memory

Page 64: Kartograph - DEF CON

Step 6Understanding the map’s

structure

Page 65: Kartograph - DEF CON
Page 66: Kartograph - DEF CON

Step 8Rewriting the memory for

fun and profit

Page 67: Kartograph - DEF CON
Page 68: Kartograph - DEF CON

Unexpected effects

Page 69: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Unit hacking

http://ly.tl/t1
http://ly.tl/t1
Page 70: Kartograph - DEF CON

Elie Bursztein Slide deck 2010 http://ly.tl/t1

Stay tuned for our next episode

Will be available in the online version of the slides

http://ly.tl/t1
http://ly.tl/t1
Page 71: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Kartograph Demo

http://ly.tl/t1
http://ly.tl/t1
Page 72: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Ongoing work

• Active attack (Network).

• Defense (Multi-parties crypto)

http://ly.tl/t1
http://ly.tl/t1
Page 73: Kartograph - DEF CON

Jocelyn Lagarenne & Elie Bursztein Kartograph (cd version) http://ly.tl/t10

Questions

• Active attack (Network).

• Defense (Multi-parties crypto)

http://ly.tl/t1
http://ly.tl/t1

Secure Tokin’ & Doobiekeys - DEF CON CON 25/DEF CON 25... · 2020. 5. 16. · Insecure Boot Spliff Trusted Platform Module Doobiekey Altered State. Title: Untitled Author: DEF CON

Secure Tokin’ & Doobiekeys - DEF CON CON 25/DEF CON 25... · 2020. 5. 16. · Insecure Boot Spliff Trusted Platform Module Doobiekey Altered State. Title: Untitled Author: DEF CON

DEF CON 23 Presentation

DEF CON 23 Presentation

SCADA - DEF CON

SCADA - DEF CON

DEF CON 25 Hacker Conference - DefCon Media Server CON 25/DEF CON 25 presentations/DEF… · functionality = self.checklist["Functionality"] ... Manually add ancillary data (pentest/other

DEF CON 25 Hacker Conference - DefCon Media Server CON 25/DEF CON 25 presentations/DEF… · functionality = self.checklist["Functionality"] ... Manually add ancillary data (pentest/other

DEF CON 24 Hacking Conference - Ruxcon · Title: DEF CON 24 Hacking Conference Author: DEF CON 24 Speaker Keywords

DEF CON 24 Hacking Conference - Ruxcon · Title: DEF CON 24 Hacking Conference Author: DEF CON 24 Speaker Keywords

Eric Sesterhenn 2018 CON 26/DEF CON 26 presentations/DEFCON-26... · DEF CON 26 Hacking Conference Author DEF CON Speaker Subject DEF CON 26 Presentation

Eric Sesterhenn 2018 CON 26/DEF CON 26 presentations/DEFCON-26... · DEF CON 26 Hacking Conference Author DEF CON Speaker Subject DEF CON 26 Presentation

DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DEF… · Don’t"believe"anything"I"Say • Also,"hold"those"around"you"accountable

DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DEF… · Don’t"believe"anything"I"Say • Also,"hold"those"around"you"accountable

Cracking Cryptocurrency Brainwallets - DEF CON CON 23/DEF CON 23 presentations/DEF… · Cracking Cryptocurrency Brainwallets Ryan Castellucci ... pass a file with pubkeyhashs, ...

Cracking Cryptocurrency Brainwallets - DEF CON CON 23/DEF CON 23 presentations/DEF… · Cracking Cryptocurrency Brainwallets Ryan Castellucci ... pass a file with pubkeyhashs, ...

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF CON 24...RDS-1 or "Stalin's Jet Engine" Inside knowledge of the Manhattan Project combined with looting Germany's

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF CON 24...RDS-1 or "Stalin's Jet Engine" Inside knowledge of the Manhattan Project combined with looting Germany's

DEF CON 26 Hacking Conference CON 26/DEF CON 26 presentations/DEF… · Malware Analysis Triage with Automated Disassembly Amanda Rousseau Rich Seymour. About Us Amanda Rousseau Rich

DEF CON 26 Hacking Conference CON 26/DEF CON 26 presentations/DEF… · Malware Analysis Triage with Automated Disassembly Amanda Rousseau Rich Seymour. About Us Amanda Rousseau Rich

DEF CON 26 HACKING CONFERENCE CON 26/DEF CON 26 receipt.pdf · Title: DEF CON 26 HACKING CONFERENCE Author: DEF CON 26 Subject: DEF CON 26 RECEIPT Keywords: DEF CON Conference, DEF

DEF CON 26 HACKING CONFERENCE CON 26/DEF CON 26 receipt.pdf · Title: DEF CON 26 HACKING CONFERENCE Author: DEF CON 26 Subject: DEF CON 26 RECEIPT Keywords: DEF CON Conference, DEF

Introduction to x86 disassembly - DEF CON CON 24/DEF CON 24 workshops/DEF CON 24... · x86 •Today, “x86” generally refers to all architectures based off of the original 8086

Introduction to x86 disassembly - DEF CON CON 24/DEF CON 24 workshops/DEF CON 24... · x86 •Today, “x86” generally refers to all architectures based off of the original 8086

Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24 presentations/DEF… · Network Protocol Reverse Engineering ... Linux, Mac •Scapy –Python based, extensible •Fuzzing

Network Protocol Reverse Engineering - DEF CON CON 24/DEF CON 24 presentations/DEF… · Network Protocol Reverse Engineering ... Linux, Mac •Scapy –Python based, extensible •Fuzzing

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF… · •Dummy frame injection •Delaying acknowledgments ECU CAN High CAN Low ... #wireshark -X lua_script:ethcan.lua

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF… · •Dummy frame injection •Delaying acknowledgments ECU CAN High CAN Low ... #wireshark -X lua_script:ethcan.lua

Crypto for Hackers - DEF CON CON 23/DEF CON 23 presentations/DEF CON 23... · Crypto for Hackers Eijah v1.00 August 7th, 2015 “Shall we play a game? ...

Crypto for Hackers - DEF CON CON 23/DEF CON 23 presentations/DEF CON 23... · Crypto for Hackers Eijah v1.00 August 7th, 2015 “Shall we play a game? ...

Hacking travel routers like it’s 1999 - DEF CON Media Server CON 25/DEF CON 25 presentations/DEF… · Hacking travel routers like it’s 1999 Mikhail Sosonkin. Mikhail Sosonkin

Hacking travel routers like it’s 1999 - DEF CON Media Server CON 25/DEF CON 25 presentations/DEF… · Hacking travel routers like it’s 1999 Mikhail Sosonkin. Mikhail Sosonkin

Download - Def Con

Download - Def Con

Teaching Old Shellcode New Tricks - DEF CON CON 25/DEF CON 25 presentations/DE… · Teaching Old Shellcode New Tricks DEF CON 2017 @midnite_runr

Teaching Old Shellcode New Tricks - DEF CON CON 25/DEF CON 25 presentations/DE… · Teaching Old Shellcode New Tricks DEF CON 2017 @midnite_runr

Infrared - Def Con

Infrared - Def Con

WPA TOO ! - DEF CON

WPA TOO ! - DEF CON