Original subtitles

hello and welcome back to CS 420 a

course on game hacking this section is

going to be on the basics of the

operating system and a memory scanning

which is arguably the most important

skill in game hacking we're not going to

go deep into operating systems since

that can be an entire course on its own

we're just gonna learn the parts that

are relevant to game hacking and then

we'll move on

memory scanning is a technique used to

find things like health and gold in a

video game we'll go over how that works

and I'll demonstrate a few live examples

at the end let's briefly dive into what

we need to know about operating systems

the operating system does quite a few

things but these two are the most

important first it manages the hardware

in your computer and this part really

isn't that important to game hackers so

we won't touch on this very much the

second thing it does is that it manages

the programs running on your computer

when you double-click an exe file when

you open an application it's the

operating system that is responsible for

making sure that program runs and let's

look at how that works so here we have

the executable file for squally on the

left and that's a file that exists on

your hard drive and when you

double-click that exe file the operating

system basically takes that file and

copies it into RAM a couple other things

happen behind the scenes but again it's

one of those things where you don't need

to know all the details now if you want

to know just for the sake of knowing you

can read up on loaders and executable

file formats and I'll put links to the

relevant Wikipedia articles in the

description it's worth mentioning that

when we hack the game we hack the copy

in RAM not on disk this means none of

the changes we make are permanent if we

break something or crash the game it

doesn't matter we could just run the

game again this is the main difference

between software cracking and game

hacking when cracking software you

generally hack the version on disk

rather than the version in RAM this is

because in software cracking the goal is

to make a paid program free by removing

serial key checks and that sort of thing

and game hacking you would still want to

be able to play the game normally when

you want to for this reason we only hack

the version in RAM

so let's cover some of the tools that

game hackers use cheat engine is the

most well known tool it's been around

since about 2003 it's well tested and it

gets the job done the other tool listed

here is squalor this is the tool that

I've been working on it's faster than

cheat engine but it's newer and has some

issues if you're watching this via and

20:19 probably just stick with cheat

engine however if you're watching this

video in that future checkout squalor

I'll put links to both in the

description one thing to note is that

when you're installing cheat engine they

have optional promoted software that

they bundle with the Installer you have

to make sure to decline those during the

installation process so no just spam the

next button just be careful about that

so next let's talk a bit about how these

tools work all right

so because the operating system has so

much power over running programs we can

abuse the operating system to help us

cheat in games you can say hey operating

system you see that game running over

there go ahead and change health to 100

for me and as long as you tell it

exactly where to look it'll follow your

orders

every operating system has a bunch of

things you can ask it to do these

functionalities are known as an API or a

library I used to find these terms

confusing but they really just mean code

that somebody else wrote that I can use

the operating system is code it's

written in C and C++ we're able to use

some of that code when we develop our

hacking tools on windows this is known

as the windows api and on mac and linux

they have their own API

some of these are really powerful some

of these functions that they let us use

are very powerful and allow us to cheat

in games one example is this right

process memory function here on the

screen it's used to edit things running

in RAM which is exactly what we need to

cheat in our games you could just fire

up a C++ or C sharp program and use this

code to edit the program this is how

both cheat engine and squalor work I'm

going to leave it at that for now later

I'll have a lecture on how you would

actually implement a memory editor using

the windows API and I'll go into much

more detail there

if you recall from before I mentioned

that hacking can be broken up into three

steps find the thing exploit the thing

and observe the results for this hacking

method and memory scanning is the act of

finding the number you want to change

it's like hitting ctrl F in your browser

to search for something in our case we

want to use it to find health mana Gold

skill points the XYZ coordinates of the

player anything numeric once you find

the number you want to change you can

edit it with memory editing and then you

just see if it worked

and you're done before I get into this

we need to update our understanding of

what a computer program actually is so

last lecture I said we could think of a

program as a bunch of zeros and ones and

I also mentioned that this was a very

bad understanding I promised that we

would keep building on this so let's

build on it so if this was the memory of

a game loaded into Ram then somewhere in

the sea of zeros and ones would be the

players health now let's say we somehow

figured out that this particular

sequence of zeros and ones somehow

represents the player's health one might

think that in order to increase the

player's health we could just delete the

old bits and put in a bunch of ones now

this is wrong this is not how it works

look how laggy this is I'd released the

one key a long time ago and it's still

trying to catch up the problem is that

when you insert a new digit it has to

shift over potentially billions of other

digits and this is super slow let's

explore how we actually accomplish our

goal

to make things less confusing computer

scientists a long time ago agreed to

group bits into eight this grouping of

eight bits is known as a byte this is a

lot cleaner to look at and a lot cleaner

to work with this restriction is baked

and almost everything in your computer

files have to be a multiple of eight bit

it's impossible to have a file that only

takes up seven bits it would have to be

rounded up to eight if I have a text

file that had just has one letter in it

its size on the disk is one byte so now

let's say we found the players health

let's say it's this byte here if we

wanted to change it we would simply

overwrite the existing value

now I know we haven't learned a binary

yet next lecture we'll dive into how

binary actually works but for now just

bear with me it's important to note that

because we can't insert new data that

means whoever programmed the game had to

decide the limit in advance it turns out

the maximum for one byte of data is 255

if you took this and converted it to

decimal it would be 255 and that works

pretty well for health because a lot of

games will have like a hundred max

health so you never have to go worry

about going over the memory limit

however if you have gold in a video game

this one byte is not enough so you would

actually have to use multiple bytes a

lot of games will use for when you have

4 bytes the limits about 2 billion so

programmers will take this group it into

4 and say this is actually one number

sometimes they'll use groupings of one

two four or even eight I'm highlighting

the right amount here yeah so this is

our new updated mental model of what a

computer program is it's still not

perfect but this is far less insulting

than our original model we know that a

computer program is made up of a bunch

of bytes which are groups of eight bits

and to represent larger numbers a

programmer can group bytes together to

give themselves more digits to work with

these can be groups of one two four and

eight which will learn the reasons for

it in a later lecture and I glossed over

this but you may have been able to

figure out that binary numbers can be

converted to decimal numbers we can

convert the highlighted group of four

bytes in the bottom left into the number

623 luckily for us most tools will

handle this sort of thing for us so

we've never have to really look at

binary

now on to memory scanning I mentioned

earlier that memory scanning is like

hitting ctrl F in your browser except

instead of a searching for text on a

page we're searching for numbers and

memory so if a player has 100 health

we'll assume that we're searching for a

number that can be up to four bytes long

because like I said that's what most

programmers choose and there is a

problem with this though and allow me to

demonstrate what the issue is it's not

as easy as just hitting ctrl F so let's

say that it did work exactly like ctrl F

does in your browser and we want to

search for 100 because that's how much

health we have well we quickly run into

the problem of there's just too many

matches it turns out that most games

take up anywhere from 1 gigabyte to 8

gigabytes of memory for larger games and

this can be about 4 billion numbers

which means we'll get a lot of matches

so we need to figure out how to narrow

down our search and there's a cool magic

trick that makes that possible but

before we can learn about that we need

to know what an address is first let's

go back to our mental model of what a

computer program is there are these

groups of 8 bits these bytes that start

at the top left and go from left to

right until they reach the end well we

can call that first group of bits that

first byte address 0 because it exists

at the first location it's kind of weird

but programmers tend to start list with

0 instead of 1 so the first one is 0

then it goes to 1 and 2 now if we keep

going this first group of 4 bytes

starts at address 116 now even though it

occupies 4 addresses we refer to it by

the first address in the sequence now

just to you know give an analogy right

just because you have a mansion just

because you have a lot of property you

still only have one street address and

the same is kind of true here now it's

important to note this example here in

the center sia address 169 is where we

have the value 100 and this can get very

confusing for people right you don't

want to confuse addresses and values the

value is whatever the bits inside

represent and the address is just the

location

all right I want to reiterate this so

here the value is just a hundred if we

look at this box but it exists at a bat

position 169 value 100 position 169

banja the value can change but the

address can never change this will

always be a hundred sixty-nine but 100

can change if the bits change right if I

kept flipping the first bit this value

would change to a hundred once all gone

flip between these two a hundred it

changes a hundred and one right but the

address will always be one sixty nine

so now that we know a little bit about

addresses we can actually learn how to

solve that problem from earlier that

problem of we have too many matches so

the best way for me to do this is just

to jump into some live examples and

we'll solve this together

so here we have an early build of

squally open on the left and we have

cheatengine open on the right the first

thing we're gonna want to do is tell

cheat engine which game we're trying to

hack and we do that with this little

glowing select a process button the

computer icon here we pick squally and

now cheat engine knows what we're trying

to do

now our goal is to hack our health you

see here we have eleven health and we

want to change that to heal ourselves up

so what we do in cheatengine is we can

search for eleven now there's a lot of

overwhelming looking settings here but

we can ignore most of them just know

that we're using four bytes I mentioned

earlier that that's how most programmers

store integers and we hit the first scan

button now we got a lot of matches right

we have about 16,000 matches which is a

considerable amount so there's no way

we're just gonna be able to flip through

these and you know eyeball which one of

these is health we can ignore this

column for now so just know there's

address which we covered earlier and

value address here is being represented

as a hex number but it's still the same

exact concept

so how do we narrow this list down well

since we already know everything that's

11 we can actually just go ahead and

take some damage in the game so I'm

gonna get hit again and now we want to

know which things used to be 11 but our

eight now and that's how scanning works

so I go ahead and type 8 and it'll

search this list right so now we're

searching Arden

we're searching on our search

essentially right just narrowing the

search down so if I hit this there's

only one result we found it that was

super easy it only took two scans

sometimes it can take a lot more but for

us we got pretty lucky now I just

double-click this value change it to 16

and then the game I have 16 health that

easy

now let's jump into another example

using squalor my software so here

there's a drop down just go ahead and

hit this and pick squally from the list

similar to cheat engine and up in this

top bar all the settings are good too

it's already set to a four byte integer

and we can go ahead and just type in 380

because now we're gonna try and change

your gold in our minigame hexxus so I go

ahead and start this scan I get a fair

number of matches there's not a lot only

132 matches this time you know what I

can go ahead and do is buy something in

the game so I'll go ahead and buy this

card and now it's 275 so I just go in

and now I try and narrow the search by

searching for 275 there's only one match

so I go ahead and double click this and

now we change it to something else so I

can change it to 200,000 now you may

have noticed that in the game it hasn't

updated well it turns out that it

doesn't update immediately every single

time sometimes you have to do something

to refresh the screen so if I go ahead

and buy to the card now it recognized

okay I increased my gold now it updates

and that's all there is to it

so in our examples we learned how to

find health and we learned how to find

money this is enough to get you started

but there's still a lot more we need to

cover for example what if you wanted to

find the x and y-coordinates of the

player to write a teleportation hack how

would you do it we have no idea what the

players x-coordinate is it could be a

hundred a thousand a million no idea

also the Chiefs we learned how to create

aren't reusable if we restart the game

the addresses we found for gold and

health are no longer valid and will

learn the reasons for that later but

what we learned today is enough to be

dangerous right I encourage you to go

start hacking some single player games

whatever you own and get familiar with

the process

okay thanks for watching and if you have

any questions or feedback leave a

comment below thank you