Hacking may get a lot more dangerous...

I definitely don't believe everything this guy said. But the proof for some of it was there with what he showed me.

From the speed at which the discord mods removed this, I'd say it's probably more true than anyone would like to admit.

(Sigh)

Headline: Non-Profit Altruistic Charity Company: Pixonic; Caught in Scandal.

The "hacker" probably works at Pixonic. And they know everything he/she is doing.

Couldn't have said it better.

As soon as the update dropped, I've had obvious subtle hackers, beacon hacks, randomly dying at half health, the lot.

FYI: as a programmer who’s made a tidy profit hacking over the years on the side, I can explain some of the things he’s doing, for clarity’s sake

When he says “spy” he means: “we have a man on the inside selling information, and possibly access to or creating credentials for api calls.”

This is made clear when he says “waiting for admin access”. So it’s likely an engineer (programmer) or sys admin.

The game api access is not really a hack, so much as it’s the ability to access the same tools the game client uses. Things that you could do with local access (your account only). Probably get any offer you want, even if not visible etc. if pixonic does server side limiting then not possible. With admin api access, the doors open a lot more, basically whatever you want.

Api access plus admin credentials would basically let you do anything you want outside of the combat portion of the game.

And this could be easily accomplished simply by having their guy give them a copy of their “swagger” (a common method by which most programmers use to describe and organize documentation of their project )

Admin credentials could be created, possibly semi anonymously, and they would be hard to find unless someone checked user accounts daily on the system. Covering your tracks is very difficult however because everything is usually logged. But if they created an account, and waited 6 months (probably much less), then they could let the the old logs get cycled out safely and that aged credential would be anonymous at that point.

Regarding the movement hacks: so games generally cannot tell how you got to a location on the map, you essentially tell the server where you are and the server takes your word for it.

Since there is so much stuff flying across the screen, War Robots probably relies on a “trust based system” and uses UDP packets.

Regarding invincibility, this can be achieved by editing the projectile vector (trajectory) internally.you see the bullet hitting, and the game tracks all the locations of bots locally for you, but the receiver says it’s a miss, so no damage is reported back.

Alternatively, he could simply deny the reporting of damage to the server. It’s sort of like playing watching an audit or a vote in the USA. The election official says “it wasn’t rigged”, and you are suppose to believe them. Alternatively you can think of it like a paintball game where you get hit but decide to not stand up and report it, because you can hide the hit in some fashion

My guess is that War Robots works this way , in order to minimize the server communications

So how do they do this? It’s likely someone working at pixonic with access to their “git repository” has reported the parameters for functions to the hacking group.

On a windows system the app would use a series of DLL to offload libraries and organize the game. Other OS work in the same way. Anyone can load these libraries. But if you don’t know the parameters to a function then you have to start guessing., or be able to write in assembly (for simplicity, machines read 1 and 0, but assembly is basically human readable 1 and 0, and it translates back and forth)

To edit the program directly they can modify the binary itself (tedious, but very doable) , they can edit the memory allocated to the game when it starts, also doable, or interfere with the network traffic (probably the easiest of the 3, but least effective , because you can only modify what the game client reports back to the server (he hit me , he didn’t hit me, etc)

However if they have access to the git repository, then they. Can quickly write modules to use the same DLL etc that the game uses and make alterations. They can also compile the game or parts of it. And then quickly acquire the memory registers, test etc)

Once the parameters to access the api or internal client DLL (also basically an api) it becomes very difficult to dislodge hackers, without introducing random junk data to function calls etc,l.

So basically they do some basic gimmickry to alter memory locations etc of in game read / write memory , change protocols etc.

This lasts a few days until someone finds the new locations (security thru obscurity)


If pixonic truly wanted to fix this, they would invest serious time and effort in logs analysis introduce replay recording ala StarCraft 2, or plain old slow the game down and force everything thru the server.

That ship has sort of sailed with all the super fast 「slow」 robots out there these days tho, and the smart programmers who did the heavy lifting are likewise gone , so they are left with trash coders who punch a clock because they are underpaid