![247CTF](/img/default-banner.jpg)
- 21
- 377 260
247CTF
Australia
Registrace 12. 07. 2020
🏆 The 247CTF channel is dedicated to teaching Capture The Flag fundamentals. If you want to improve your technical skills and succeed in Capture The Flag competitions, make sure to subscribe!
🏁 The 247CTF is a free Capture The Flag learning environment where you can improve your technical skills by solving challenges and recovering flags. You can join now for free at 247CTF.com/.
📺 Subscribe for more Capture The Flag videos!
🏆 Solve CTF Challenges ➝ 247CTF.com/
🐦Stay up to date ➝ 247CTF
🥰 Support the 247CTF ➝ www.patreon.com/247CTF
💬 Discuss and learn ➝ discord.gg/eS74p5zWZX
📌Free flag ➝ 247CTF{9719c5ddf317154473d334f47a77ac6a}
🏁 The 247CTF is a free Capture The Flag learning environment where you can improve your technical skills by solving challenges and recovering flags. You can join now for free at 247CTF.com/.
📺 Subscribe for more Capture The Flag videos!
🏆 Solve CTF Challenges ➝ 247CTF.com/
🐦Stay up to date ➝ 247CTF
🥰 Support the 247CTF ➝ www.patreon.com/247CTF
💬 Discuss and learn ➝ discord.gg/eS74p5zWZX
📌Free flag ➝ 247CTF{9719c5ddf317154473d334f47a77ac6a}
Staged vs Stageless shellcode: fighting yourself and the debugger [Live Hacking]
Everyone makes mistakes! Live hacking session - showing what not to do when trying to debug an unknown problem. Bad assumptions + attempted shortcuts = wasted time. It happens to everyone, just try to stick with it and learn something new along the way.
Go follow OJ ➝ thecolonial
🏆 The 247CTF channel is dedicated to teaching Capture The Flag fundamentals. If you want to improve your technical skills and succeed in Capture The Flag competitions, make sure to subscribe!
🏁 The 247CTF is a free Capture The Flag learning environment where you can improve your technical skills by solving challenges and recovering flags. You can join now for free at 247CTF.com/.
📺 Subscribe for more Capture The Flag videos!
🏆 Solve CTF Challenges ➝ 247CTF.com/
🐦Stay up to date ➝ 247CTF
🥰 Support the 247CTF ➝ www.patreon.com/247CTF
💬 Discuss and learn ➝ discord.gg/eS74p5zWZX
📌Free flag ➝ 247CTF{9719c5ddf317154473d334f47a77ac6a}
📝 Icons made by Freepik & Monkik from Flaticon.com
🚨 247CTF’s channel videos are intended for educational purposes only. Methods and techniques discussed are not to be used for illegal activities against unauthorised systems.
Go follow OJ ➝ thecolonial
🏆 The 247CTF channel is dedicated to teaching Capture The Flag fundamentals. If you want to improve your technical skills and succeed in Capture The Flag competitions, make sure to subscribe!
🏁 The 247CTF is a free Capture The Flag learning environment where you can improve your technical skills by solving challenges and recovering flags. You can join now for free at 247CTF.com/.
📺 Subscribe for more Capture The Flag videos!
🏆 Solve CTF Challenges ➝ 247CTF.com/
🐦Stay up to date ➝ 247CTF
🥰 Support the 247CTF ➝ www.patreon.com/247CTF
💬 Discuss and learn ➝ discord.gg/eS74p5zWZX
📌Free flag ➝ 247CTF{9719c5ddf317154473d334f47a77ac6a}
📝 Icons made by Freepik & Monkik from Flaticon.com
🚨 247CTF’s channel videos are intended for educational purposes only. Methods and techniques discussed are not to be used for illegal activities against unauthorised systems.
zhlédnutí: 4 176
Video
Reverse engineering a game trainer hack from 1998 [Live Hacking]
zhlédnutí 7KPřed 3 lety
Live hacking session, downloading a game trainer hack from 1998 and reverse engineering how the game hack is supposed to work using Ghidra and x32 debug. 🏆 The 247CTF channel is dedicated to teaching Capture The Flag fundamentals. If you want to improve your technical skills and succeed in Capture The Flag competitions, make sure to subscribe! 🏁 The 247CTF is a free Capture The Flag learning en...
How to REVERSE ENGINEER and HACK weak encryption - "SantaGoga" challenge [Capture The Flag Writeup]
zhlédnutí 6KPřed 3 lety
The SantaGoga Hackazon CTF challenge writeup explains the difference between symmetric and asymmetric encryption, how to reverse engineer managed and unmanaged code, how to extract unmanaged code from a managed binary, how to create an RSA key using the p and q values, how to decrypt data using the openssl utility and how to use AES in python to decrypt a file! 🏆 The 247CTF channel is dedicated...
Hooking, hijacking & spying on player resource data structures [Game Hacking 101]
zhlédnutí 6KPřed 3 lety
Learn how to hook, hijack and spy on player data structures by using DLL injection, code caves and inline asm to modify how a game processes and displays player data within the game world. 🎮 Game Hacking 101 Playlist ➝ czcams.com/play/PLpnX4b2uRf5-_aLRjuIpav2Zh45C4f2QH.html 👮 Fair use of copyrighted material in the context of Age of Empires (video game); en.wikipedia.org/w/index.php?curid=11648...
Reverse engineering player structures in a game [Game Hacking 101]
zhlédnutí 23KPřed 3 lety
In order for a game to draw the world, the game process needs to know the location and status of different assets. The game process likely has some central type or class to define what something is within the game world. But how can we find it? 🎮 Game Hacking 101 Playlist ➝ czcams.com/play/PLpnX4b2uRf5-_aLRjuIpav2Zh45C4f2QH.html 👮 Fair use of copyrighted material in the context of Age of Empire...
Function hooking, detours, inline asm & code caves [Game Hacking 101]
zhlédnutí 33KPřed 3 lety
Our game hacking binary patching approach so far has been focused on making small changes to the way that the game works. But what happens if we want to do something which takes up more space than we actually have available to us? 🎮 Game Hacking 101 Playlist ➝ czcams.com/play/PLpnX4b2uRf5-_aLRjuIpav2Zh45C4f2QH.html 👮 Fair use of copyrighted material in the context of Age of Empires (video game)...
From Cheat Engine to a DLL - how to make a working game trainer in C [Game Hacking 101]
zhlédnutí 13KPřed 3 lety
Learn how to implement manual pointer hopping processes and make use of static pointers to hunt for dynamic pointers within active game memory. With these new functions in place, we can update our work in progress game trainer to implement reveal map and infinite resource hacks within the game world. 🎮 Game Hacking 101 Playlist ➝ czcams.com/play/PLpnX4b2uRf5-_aLRjuIpav2Zh45C4f2QH.html 👮 Fair us...
Memory Scanning & Resource Hacking with Cheat Engine [Game Hacking 101]
zhlédnutí 23KPřed 3 lety
Learn to influence how Age of Empires works by directly finding and modifying data in the process memory by making use of Cheat Engine. If we can find a pointer to the base address of the player object in memory, we can then dereference and follow that pointer, then once we have the dynamic location, we can follow offsets from that dynamic base address to find and modify the player's resources ...
Hacking a game with DLL injection [Game Hacking 101]
zhlédnutí 92KPřed 3 lety
Implementing a game hacking trainer for Age of Empires by using Dynamic Link Library (DLL) injection. The injected DLL enables the player to toggle the "reveal map" and "no fog" cheat codes on and off by pressing the F6 key. DLL injection is a useful technique, used by game hackers and malware authors alike. The DLL injection process enables you to force some process into running your own code....
Binary patching game cheat codes [Game Hacking 101]
zhlédnutí 17KPřed 3 lety
Reverse Engineering and binary patching the game Age of Empires, to permanently enable both the "reveal map" and "no fog" cheats - even when "no cheat" mode is enabled in the game. 🎮 Game Hacking 101 Playlist ➝ czcams.com/play/PLpnX4b2uRf5-_aLRjuIpav2Zh45C4f2QH.html 👮 Fair use of copyrighted material in the context of Age of Empires (video game); en.wikipedia.org/wiki/File:Age_of_Empires_Covera...
Reverse Engineering hidden game cheat codes [Game Hacking 101]
zhlédnutí 62KPřed 3 lety
Reverse Engineering the classic real time strategy game Age of Empires to understand how hacking functions have been implemented by game developers. Once we understand the hacks, we can binary patch the game and directly implement them too. 🎮 Game Hacking 101 Playlist ➝ czcams.com/play/PLpnX4b2uRf5-_aLRjuIpav2Zh45C4f2QH.html 👮 Fair use of copyrighted material in the context of Age of Empires (v...
Google CTF - "WRITEONLY" challenge [Capture The Flag Writeup]
zhlédnutí 2,7KPřed 3 lety
Sandbox Breakout writeup for the "WRITEONLY" challenge from the 2020 Google Capture The Flag (CTF) competition. 🏆 The 247CTF channel is dedicated to teaching Capture The Flag fundamentals. If you want to improve your technical skills and succeed in Capture The Flag competitions, make sure to subscribe! 🏁 The 247CTF is a free Capture The Flag learning environment where you can improve your techn...
How can you attack an ECB cipher? [Capture The Flag Fundamentals]
zhlédnutí 9KPřed 3 lety
In this video, we are going to discuss and demonstrate a practical attack against block ciphers operating in electronic code book, or ECB mode. ECB is the most basic and easiest to understand block cipher mode of operation. So, what exactly can go wrong when the same plaintext blocks map to the same predictable cipher text blocks? Let’s find out. 🏆 The 247CTF channel is dedicated to teaching Ca...
Symmetric Block Ciphers For Hackers [Capture The Flag Fundamentals]
zhlédnutí 2,8KPřed 3 lety
Securely designed cryptography, math and associated software implementations are hard to get right. For a beginner and as a jeopardy style, Capture The Flag category, cryptography can also be a daunting area to get started in. In this ‘Cryptography For Hackers’ video series we are going to talk about common attacks against insecure cryptographic implementations often seen in both Capture The Fl...
Google CTF - "BEGINNER" challenge [Capture The Flag Writeup]
zhlédnutí 39KPřed 3 lety
Reverse engineering writeup for the "BEGINNER" challenge from the 2020 Google Capture The Flag (CTF) competition. 🔥 Resources: BEGINNER challenge: capturetheflag.withgoogle.com/challenges/reversing-beginner CTFtime Writeups: ctftime.org/task/12813 John Hammond: czcams.com/video/RCgEIBfnTEI/video.html Gynvael: czcams.com/video/0wUDA0oh8sQ/video.html SIMD Extensions: en.wikipedia.org/wiki/Streami...
Fighting Against Time: How to identify & abuse Race Conditions [Capture The Flag Fundamentals]
zhlédnutí 7KPřed 3 lety
Fighting Against Time: How to identify & abuse Race Conditions [Capture The Flag Fundamentals]
Beyond Alert(1): Demonstrating the impact of an XSS [Capture The Flag Fundamentals]
zhlédnutí 6KPřed 3 lety
Beyond Alert(1): Demonstrating the impact of an XSS [Capture The Flag Fundamentals]
Magic Bytes & Security: When file categorisation goes wrong [Capture The Flag Fundamentals]
zhlédnutí 6KPřed 4 lety
Magic Bytes & Security: When file categorisation goes wrong [Capture The Flag Fundamentals]
Type Juggling Magic: Why PHP thinks 0 and "password" are the same [Capture The Flag Fundamentals]
zhlédnutí 6KPřed 4 lety
Type Juggling Magic: Why PHP thinks 0 and "password" are the same [Capture The Flag Fundamentals]
When Integer Overflows attack: How an Integer Overflow can can lead to Remote Code Execution
zhlédnutí 6KPřed 4 lety
When Integer Overflows attack: How an Integer Overflow can can lead to Remote Code Execution
Integer Overflows: When 15 + 1 doesn't equal 16 [Capture The Flag Fundamentals]
zhlédnutí 7KPřed 4 lety
Integer Overflows: When 15 1 doesn't equal 16 [Capture The Flag Fundamentals]
Bro, how did you manage to put the entire program on a singlr graph? It is no easy task. Please enlighten us
pretty sure i cant just watch this with zero knowledge on anything lol.
Did anyone ever notice the obfuscated cheats were from the base game? (From ancient memory it seems to align)
thanks for ur tutorial i learnt how to get the pointers and stuff but. i have pointerscan results and they all point to ammo. even when the game resets and the pointer changes the ponterscans are still valid. i created a program to read and write value to a memory address but the memory address needs to be manually corrected every time. idk how to automatically get the correct addresses and i’m stuck on it
what if i change the type from 4 bytes to float and it turns into weird numbers and letters , do i change it back?
If it's the wrong type, you might need to have a few guesses or do some reverse engineering
I saw Age of Empire and reverse engineering immediately subbed❤
As an old cracker/ trainermaker : You don’t need to understand the game. You just need to know what you want to influence. Then take memory snapshots at certain stages and compare. See the changes and then go into detail. That’s trainer making Oldskool.
u think my aoe1 game is better than my aoe2 game? all ur videos is RE on aoe1
1 > 2
try reverse aegis
Wouldn't piggybagging on one of the existing dll's be better? So for example it probably uses winmm.dll or some d3d dll. If you put that in the same directory as the executable; it'll get loaded first. You stub/forward all the functions and put your own stuff in one of the ones that gets called. That way you don't need admin elevation to inject yourself into the other process
That is another option sure, but you don't need admin rights to inject into another process you own
Hi, excellent video, however i have a question about the first software with the printf, where did you see what was needed for the "printf" function ? I'm asking that because for example, if you reverse engineer whatever software, how do we know the parameters used for that function ? nvm i'm new so i'm sorry if my question sound a little bit dumb :D
I know from playing the game and guessed the format of the format specifier
I thought windows will always give you random memory addresses, but you apply patching to the same address all the time. I don't get it.
It's a virtual address, not a physical one. So it doesn't depend where into the RAM the process is loaded, it always sees itself with the same addresses.
@@misch2 what do you mean sees itself, when he specifies the exact address. Try to define a variable and it will have different addresses on each run, even if it's virtual memory.
Depends if the binary / DLL is compiled with ASLR or not
Thankyou for this video, very interested! Can you show me step by step when get Address of resources ingame to value base address 0x001830F4 of memory_ptr resource_hack_ptr param in code, and the offsets. In video you talk and action to fast, i can't follow. I'm newbie for this technology, and i want to practice with this game, I want get some info ingame some thing like player's civil, total gold corrected, kill/losses, win/lose ... can you give some advice? thank in advance, and sorry for my poor English!
Nice tutorial !. It's possible to inject a .Net Framework DLL ?. Thx
Yes, it's a different method but you can - there are a few projects from GitHub that will show you how this works
PLS Find for me address at time 2:24
what about x64 hook tutorial?
When you find an awesome channel and they haven't uploaded in 2 years :(
F
@@247CTF 👀
i dont understand, what we are doing is reading a pointer that points to a pointer that points to a pointer and so on until the last pointer points to the actual memory adress or are we just adding the known offsets? and if thats the case, why couldnt we just store the sum of all of the offsets and add that instead of storing all of them and adding them one by one? if i press "pointer scan for this adress" and it tells me there is a base adress an then 2 offsets, offset 0 is 10 and offset 1 is 154, then what im looking for is base adress + (10 + 154) and if i go there i should find the memory location im looking for right? also when cheat engine says 10, does it mean decimal 10 or hexadecimal 10, wich would be 16?
It's pointer -> pointer -> pointer. The pointer will (likely) contain a different memory address, so you can't just add offsets to the first one and expect the same result as following the pointers.
Very interesting! Maybe you have heard that ubisoft has shut down The Crew 1, an always online racing game that has an integrated offline mode not available for normal players. Could the same or a similar method be used to make this offline mode available?
Maybe, depends what is on the server and if any data needs to be pulled down to play
Age of mythology resources doesnt work the same with resources. Can you explain why? For example, if i have 250 and change to 200, it wont show up.
They might be using a different representation for the value, or it could be being masked / obfuscated (to prevent exactly what you are trying to do).
#BoycottPatreon for providing services to rashian war criminals like WarGonzo
Is it possible to do this in an online games like ragnarok online?
It is but you may be banned ;-)
the process reminds me of MelonLoader, which is easier to load custom dll into a game
Incredible video, congrats
For anyone it might concern: if you're using WCHAR (wchar_t) type in case of unicode and you're using LoadLibraryW, then you need to use wcslen for the string length. And not only that, wcslen only returns the length in wide-char units, and since VirtualAllocEx and WriteProcessmemory expects it in byte units, you must multiply the string length by sizeof(WCHAR), which commonly is 2 bytes. TLDR; dllPathBytes = (wcslen(dllFullPath) + 1) * sizeof(WCHAR)
how can we detedt this type of vulnerabilitys on a web app using burp
I'm having issues trying to find the value for a timer. For example, I'm playing the combat mission series. I want to find the timer for how long it takes for artillery shells to fire. I can easily find the address to modify the amount of ammunition I have but I'm having issues finding the address that relates to how long it takes for the ammunition to fire. It has a 9 minute timer but I'd like to change it to 1. I've tried searching for 9 and trying to find it while it's counting down but no luck. How would you approach this scenario?
Very clear and to the point, you are a great teacher, love your style. TYVM
This is excellent and definitely more interested in a more robust DLL injection solution.
can i deal with mono.dll like you used the LoadLibraryA and run it in thread inside the target process but i will use for ex mono_get_root_domain ???
You want to do this with .NET? You can achieve a similar effect but the process is slightly different, there are some examples on GitHub you could check out. The bonus is .NET makes the reversing step easier (usually).
Great video. I have two things I don't understand: What is the purpose of poping the return address at the start? Why are the instruction overwritten by the jump being pushed onto the stack instead of where the instruction pointer will be looking at?
I wanna add new civs to settlers 4 not sure if that is possible but I dont even understand reverse engineering so that is the biggest barrier.
Is this technique also work on Ghidra, I'm newbie and I've been trying to reverse a game coded in C++ called Rise and Fall Civilisation at war
Hello sir AVIATOR GAME hacking videos please sir..
😂
What program are you using scan the memory locations?
x64dbg
How do you locate the address of the patch without knowing it in the first place? And how do you know what values to overwrite it with to achieve the function you want?
So the most secure way is to use magic bytes?
Depends what you want to do, but generally make sure you are using the correct comparison type.
Can this be done for Age of Empires II: The Conquerors?
i watch dll injection tutorial for "educational" purpose 😏
@@schittPosts101 no worry kid, i got the *C programming language👍👌* directly into my brain, with a lot of cafeine lol
@@darkfllame i code in pure binary im better then you
@@Kronos.Saturn i mine the metals and create the transistors with my bare hands, im better than you
You have an error in your code. You should get rid of the [::-1] I will explain: In the video at 10:01 the codes(in little edian hex dump) are the following: 78 68 00 00 5f 2a 00 00 but because memory is in *little endian* , the codes are really: 6878h 2a5fh ... you copied the codes into python in little endian form(meaning, already "swapped")... This code really swaps the bytes 8:50 mov ecx, dword[....] ; *loads 6878h into ecx NOT 7868* move edx,ecx ; ditto into edx sar edx,0x8 ; now edx holds 68h mov byte[eax],dl ;68h is loaded into LOW memory inc eax ; advance memory pointer move byte[eax],cl ;78h is loaded into HIGHER memory *The value loaded into ecx is 6878h NOT 7868h, and the value written into memory pointed to by eax is 7868h NOT 6878h* You copied the codes into the python array directly from hex dump in little endian format, thus the python does not need [::-1], as you already inadvertently swapped the bytes when copying.
whats the differnce how dll injector and lua injector work
Don't know much about lua injectors, I would guess it's injecting lua script instead of compiled code?
Nice video but I don't understand why the transposition table uses 4 byte values to store 2 char values with 2 null bytes, wouldn't it be easier to use cx instead of using ecx? Also why does the function use both ecx and edx to access these characters when it can be accessed by using cl and ch. Is this some form of code obfuscation or just a compiler quirk?
Helps me a lot
Great!
How can I get this game? I’d like to follow along
@@247CTF do you plan on making more game hacking videos?
thank you for your work mate, really appreciate it! also, your voice is incredibly soothing and perfect for explaining this stuff absolutely lovely <3
😂
Nice
😂