Recent content on OpenPunk
If you’ve ever been involved in cheat development or reverse engineering you may have come across the problem of calculating the size of a subroutine dynamically; that is: while inside the target process’s address space, can we calculate the size of a given subroutine at address X? This is a problem that has plagued me for years and I’ve never been able to find a good solution to…
Recently I’ve been working on a passion project with a friend, a simple hash detector but written in Go. We were porting a large list of regular expressions from a python-based project since redoing work is annoying and a fool’s errand. The project we were stealing regular expressions from was this one. We ran into a strange issue where the Go regex engine would panic when we tried to…
Recently a friend of mine, dongresource, was struggling to get Star Wars Jedi Knight II: Jedi Outcast (this specific version) working over Wine/Linux. While chatting about this, we ended up collaboratively exploring all the different ways of getting the game to run that we could think of, for fun. Now I thought it’d be cool to document the resources we used and the (approximate) workflow we…
A couple weeks ago I got stuck on an idea. ‘What if FusionFall Packet Protocol, but in Go?’ I naively thought this was an easy thing. Just define the structures in Go and copy the bytes to the structure, no biggie! Oh boy was I wrong. Not only is there no way to specify the pack alignment for structure members, it was also just downright wrong to assume that Go would let you write…
I found myself up at 6am, unable to sleep, poking around google maps until I realized I lived quite close to a lake. Being 6am, I knew the sun would be rising in about an hour or so. Eager to get out of my apartment for a mini-adventure, I brewed myself some coffee and set out to Lake Ray Roberts to watch the sunrise. This was my view: The wind was fairly strong this morning, leading to some nice…
Title really says it all. I wanted something that ‘just works’ and takes minimal setup and ideally uses packages and software I already had installed. I ended up writing a tiny bash script that takes one argument, a sound file to play. The script looks like: #!/bin/bash AUDIO_SOURCE=$1 VIRTUAL_MIC=~/virtmic # sanity check the argument lol if test -z '$AUDIO_SOURCE' then echo 'Usage:…
I wanted to start this off by saying that you’re worth more than your productivity. In today’s world, it’s easy to fall into the trap of thinking that your worth is directly tied to what you produce. After all, if you don’t produce and create, what value are you bringing into this world? You’re worth more than your work. I do believe that the way our social structures…
A couple months back I was watching a vinesauce stream (very funny btw) where Joel was searching the bowels of youtube for not-so-nice software to install. After watching, I thought it’d be fun to try and find some shitware of my own to take apart. ‘The gutter’ Seeing as I used to poke fun at roblox I thought I’d start by searching “roblox hack 2022 working” and…
In my last blog post I talked about a simple Lua decompiler I made using my updated Lua 5.1 (de)serializer. I recently added support to re-serialize chunks back into Lua dumps (the equivalent of ldump.c). Using this, I wrote a tiny python script to strip debugging info from Lua 5.1 dumps automagically. It looks like: #!/usr/bin/env python3 ''' usage: lstrip [-h] -i FILE [-o FILE] Strips local and…
Over the past years I’ve grown. A little bit at a time, sometimes painstakingly, but I’ve grown nonetheless. This is my official disclaimer that I am just some nerd in your computer that writes a blog about software I think is cool. I am just a CompSci student and nothing on this site should be taken as fact. Do your own exploration! Correct me when I’m wrong! Be uncomfortable If…
Recently I struck an interest in decompilers because of a small passion project a friend of mine showed me. Gent’s project dealt with turning compiled DirectX shaders back into HLSL (High level shader language). His project (also written in python!) inspired me to write a decompiler of my own. I settled on writing a Lua 5.1 decompiler since I had already written a Lua 5.1 dump disassembler a…
Recently I faced a rather intimidating problem while working on a project. The problem was fairly simple from an objective point of view: “How do I load a DLL into a process on startup?” Now you might be wondering, “Why not just patch the IAT (import address table) on the executable and force it to load your payload DLL??” Yes! That was my exact thoughts too, however for…
In an effort to be more transparent on the very little information I collect from my readers, I’ve written this post to share the info I do use (literally the default log files from Nginx.) Recently I shared my “Cracking 22 year-old DRM” post on Reddit. I don’t use Reddit very often but every now and then I’ll lurk r/ReverseEngineering since it’s usually full of…
EDIT: Others have pointed out that the term “DRM” isn’t exactly period accurate to this software. While what the game does is arguably a less sophisticated DRM implementation, it would have been called ‘CD Check’ or something similar at the time. The difference is negligable and both approaches accomplish the same goal, prevent pirated copies for the duration of sale.…
Ansible if you hadn’t heard, is IaC’s (Infrastructure as Code) most loved obsession. Supported by RedHat, it allows deployment and management of servers in a sustainable and easy package through things called ‘Playbooks.’ These playbooks are written in YAML and specify actions to setup/maintain a server. Of course I didn’t need to use Ansible, but after writing one…
I burn through a lot of projects. Some last for several months to half a year, and others for a couple days. I can say confidently that after each project (most of them left unfinished) I’ve improved as a developer. Each project I’ve done has taught me something. Either I learned a better way of designing something, or I learned how not to do something. Yes, this can seem pretty…
Recently I’ve been working on a small passion project I’ve been wanting to do for a while. Laika is a malware written in modern C. I recently added some cool obfuscation features to the LaikaBot target. Let’s take a look at how it works. Rough Idea I’m sure you’ve seen this before, malware authors love to obfuscate strings using various techniques, among those are the…
Error handling in C has always been a pain. Most small projects have a simple return based error handling solution. For example, #include <stdlib.h> #include <stdio.h> #include <stdbool.h> bool isEven(int i) { return i % 2 == 0; } int main() { int x = 3; if (!isEven(x)) { printf('[ERROR]: %d is not even!\n', x); return EXIT_FAILURE; } return EXIT_SUCCESS; } Our ’error’ in this case is…
This journal entry is my way of being more open and honest with myself. I’ve recently been focusing more on my mental health and trying to improve myself through honest self reflection. This is me being honest. Self-love If you’re like me at all somedays you really cannot tell a difference between self-love and self-hate. An interesting thought exercise is to make a list of honest…
While I will be talking specifically about software development, the methods and self-care from my experiences should be fairly universal especially if you’re working for yourself. I’ve been programming since I was 11 years old, my first language was Lua. Since I started at a relatively young age it was never ‘work’ for me, It was more like a fun hobby with which I could…
I’ve come to the conclusion that I enjoy writing. Sad part is that I don’t always have a clean presentable project to write a roughly 1000 word essay over. Thats where this journal comes in! Think of these as ‘mini-blog’ posts, short and sweet. I’m not going to try to make these as presentable as my blog posts, aka “I’m lazy and would like to write about…
You’re going to die Okay… maybe not right now but who knows? It’s unavoidable. No matter what diet you try or whether you know Rust™ or not, eventually the curtains will close and your show will end. Preparing for one’s death might seem like a jinx, but the truth is anything could happen. It’s sure gonna suck when you die getting mugged tomorrow, so let’s make…
I’ve been spending a lot of time recently on my own scripting language called “Cosmo.” Cosmo is an easily embeddable scripting language loosely based off of Lua. It’s definitely a student project though so don’t get your hopes up. While this does smash python in benchmarks its not quite as fast as Lua, let alone Lua-JIT. Anyways, in this post I wanted to walk through…
I’ve heard stories about the haunted ‘Screaming Bridge’ since I was an elementary kid from the older kids in my neighborhood. Always some embellished story about encounters with the paranormal, which of course I innocently believed. Wanting to experience the supernatural myself, I poked around reddit and other places looking for directions on how to get there. Learning of a…
If you remember my old site before I switched to a static site, I wrote a couple of posts about FusionFall Retro. Unfortunately, that project has since been shutdown. A couple of months ago in the spirit of FFR (and because it got brought up in conversation) I started to become curious about how they actually made the server. This kick started my journey into the depths of the FusionFall client.
Hey! So I recently made an account on ctflearn.com which is this great site that teaches you how to do CTFs and gives you practice ones you can use to learn! I’ve always wanted to try out a CTF, so I quickly found a fairly simple one in the binary section and tried it out. I picked one with a lot of solves because I am a complete noob haha. Let’s take a look!
So recently I’ve been getting back into Lua, my first scripting language. I’ve already done a series about manipulating the LuaVM, (which you can read here) but this time I was interested in the LuaVM bytecode, specifically the Lua 5.1 bytecode. If you don’t know what bytecode is or even how Lua works, here’s a basic rundown: LuaC is the Lua Compiler. Its job is to turn our…
Now that we know how to find addresses of the lua C API in our client and how to capture a valid lua state, we can write our “exploit”. Let’s start with recapping what our end-goal is: We want to be able to run scripts that weren’t originally in our game. To do this, we’ve found where the Lua VM C API is, and even hooked lua_gettop to capture a valid lua state.
Last post we talked about why games use the Lua VM and how to find some key functions. The Lua VM runs everything based on a state. This state is basically the key to the kingdom, without a valid state with their custom API and environment on it, we really can’t do anything. Well that’s great and all, but how exactly are we going to get a valid Lua State??? How convenient of a question!
NOTE: 2022 Dec 1st – Roblox has changed a LOT even since I wrote this article. For example they’ve completely rewritten their lua implementation, not to mention I haven’t touched the current client in a while. Take the info in this with a grain of salt. Many games today rely on scripting languages and an internal API to interface with the game engine itself. One of the popular…