Hacking This Game To Always Win (Buckshot Roulette)

Let's hack Buckshot Roulette so we always win
Buckshot Roulette - mikeklubnika.itch.io/buckshot...
Gef - github.com/hugsy/gef
Ghidra - github.com/NationalSecurityAg...
💭 All views are my own 💭

[@nathanbaggs]

Want early access to new videos and some behind the scenes content? Consider becoming a channel member kzbin.info/door/QvW_89l7f-hCMP1pzGm4xwjoin

[@JonoTaberner]

Took me way too long to figure out why this video felt weird, and then I realised - no white shirt. 😂

[@nathanbaggs]

I just want to let people know I own more than one shirt (:

[@Haddcore]

We're getting to see an edgier side of Nathan

[@ChrisR3tro]

That stuff about bovine related data really cracked me up

[@nathanbaggs]

🐄

[@DiamondWolfX]

I wonder if the double shuffle is a bug they never caught because it doesn't have any unexpected effects

[@DoomRater]

One of the 4 live 4 blank loadouts is preshuffled before it is shown in the third round.

[@DaniTheGuy_]

0:49 Fun fact: One of the first ever Buckshot Roulette fan-made android ports had this bug of weird colors and blood splatter (even in the start menu)

[@omegahaxors3306]

You could hack the Dealer to always shoot at itsel- oh wait it already does.

[@Voxelstice]

the gef link in the description points to the game itself instead of the gef program itself also in godot the game assets (including scripts) are in the game's pck file. godot gives people the option to encrypt it, but it's a bit complicated that most people dont even bother taking the extra kilometer. even then, you can find that key in the game's binary pretty cool video anyway

[@nathanbaggs]

Thanks for pointing that out, fixed! And thanks for the godot insight

[@eVITORIOe]

That was pretty awesome ! I enjoyed seeing you using linux for a twist :)

[@nathanbaggs]

Thanks! Good to mix things up every now and then

[@wad671]

This is why I am exporting my game differently, I ship a copy of godot editor, and the project directory. Launching the game is just a command line parameter for the godot editor on each os. No obfuscation, you can easily edit the entire game, see all of the original scripts, etc. Why not ship the same tools that I use ?

[@Bobbias]

That's very nice of you. Being able to dive into the code and see exactly how someone implemented stuff can be a great learning experience.

[@GGRS]

Another great vid Nathan, thanks :)

[@f.d.9326]

Wow, this is insane level of RE knowledge. Good job and thanks for sharing

[@gathlolol4618]

It's some of the most basic knowledge???

[@ferna2294]

yeah yeah we read you, programmer, now go back to Rust.@@gathlolol4618

[@bruninhalol4363]

A newbie question, idk gdb but I imagine this with any debugger, is there some way to kinda get the class structure in memory since you found the this pointer? I mean like, compile godot and extract the debug info and bolt on over to that memory to easily see it's structure instead of dumping bytes? sorry if it's hard to understand me, it's something I thought about

[@jjh8r420]

Nah ur right. It's called ptype (print type) in gdb. And yeah, only with a debug build.

[@nathanbaggs]

You can use “add-symbol-file” in gdb to bring in other symbols, so you might be able to combine that with a debug build of godot

[@jhax]

Great stuff

[@stevensteverson]

Is it possible the two calls to shuffle combine with the copy-on-write to provide to shuffled arrays that are used for different things?

[@nathanbaggs]

It’s certainly possible, as with any RE I do I stopped looking after I got the answer I needed (:

[@zeronightx]

awesome

[@danielgysi5729]

I believe there are tools specifically to extract scripts and other assets from godot binaries. I suppose this sort of low level stuff isn't too hard for you anyway though

[@nathanbaggs]

I wanted to see how far I could get with just the binary

[@DatsRyan]

Nice

[@soviut303]

I wonder if the shuffle is called twice because it's checking if some value is the same as before and re-shuffling if that's the case. Perhaps if it could be called multiple times if a particular value keeps coming up?

[@UndeadAlex]

Please Nathan bring back the holy white shirt

[@LukeAvedon]

Sooo cool. I want to be this good.

[@HumanityAsCode]

I wonder if it wanted you to use the Vulkan renderer instead of OpenGL

[@nathanbaggs]

I didn’t really cover it but the vulkan renderer is the default one and works fine on windows and presumably ok on native Linux. WSL uses a software implementation of OpenGL and I don’t think there exists one for vulkan

[@tank45b29]

@@nathanbaggs When i run my game on windows with opengl3 the same blood screen apears, but when i don't specify any graphics API, the game runs with perfect image.

[@CiaranCoffey]

I'm completely guessing, but I feel the double shuffle is just to add more randomness including getting back to the starting state. great video, lots of good detail.

[@omegahaxors3306]

Sound about right, because i'm pretty sure a shuffle function which returns the same array would be considered broken.

[@bok..]

I wish my brain worked like yours sometimes, but I am happy with my brain as well!

[@grenadier4702]

Can one use objdump for disassembly?

[@nathanbaggs]

Yup, I’m just more used to gdb

[@Galundor01]

Are you even human? Holy shit, i wish i was at your level of reverse engineering

[@tomtravis858]

Amazing video but you could've just used GDRE to convert it to a usable Godot engine project file and directly modify the scripts.

[@mrxgn]

i like your videos a lot nathan... but in my feeling on the recent uploads , you're very talky at the camera (combined with the editing). your knowledge and expertise shine through without jump cuts, etc

[@ssznajder]

you're a boss

[@FJB-bl8xg]

try cheat engine

[@nathanbaggs]

I’ve never used cheat engine but my understanding is it’s used to find addresses of values that change. Not sure that would help here as I didn’t know the values of the shell objects till I’d pulled it all apart and by that time I already knew the addresses (:

[@jomo_sh]

@@nathanbaggs you can set breakpoints to addresses and see what accesses are being made, you can also see register values etc. It is actually a very comprehensive tool

[@ferna2294]

I used it to know what was the hidden score of the mini game in RE7 where they cut your fingers. However, it was a number, not 2 different unknown values like this game.@@nathanbaggs

[@gryzman]

please stop changing camera sides.. It confuses me. Otherwise, try writing a game in Godot. It's simple and fun. You'll learn even more ;)

[@odb7393]

Nerd 🙄

[@jomo_sh]

"Nerds" are making everything you use, everything related to engineering is "nerd" for you I guess.