Hacking Games with MelonLoader

Key Takeaways

this is a continuation of the last two videos where we have been doing some game hacking following along with the unity based game that was developed for the game hacking village now new part of Defcon in the most recent Defcon 32 conference in the last couple of videos we were working through levels 1 through three using cheat engine levels 4 through six with DN spy and we'll do a little bit more of that now as we tackle levels 7 through N9 so let's get back to level seven and as we're spawned to the map here this does tell us hey there's no more cheating from now on cheat again and you are out of here and it looks like oh I bet you can't shoot all these Targets in 10 seconds so once we step on this hey bit of grass here looks like we have some turrets to click on and shoot but if we don't complete that within 10 seconds then we will be shot by the turret over on the far side of the map here that kills us and we die if we were to open up some of our tools like Cheat Engine and DN spy we can open these applications try to get back to it we can restart the level see what the game is up to but but if I restart the level you will see a big cheater detected and a small trivial anti-che functionality in place some of you may have noticed if we were to actually open up the assembly that we were working with previously part of the game hacking data we can move into the managed folder and that assembly C that we were looking at opening up this dll and looking at this managed assembly inside one of the classes here we did see this anti-che bis of code and this is interesting it actually will try to determine or detect if you have a debugger attached looking for cheat engine even looking for a hash of the code here and you can see down below there's another function to check hey are there any cheat processes running based off of some given process names and down below you might be able to see there is a big long list of known cheat tools things that might have in the name cheat like cheat engine art money game Guardian DN spy dot Peak Etc so since we have control over the executable we could just simply remove this using some of the methods and functionality that we had previously to go ahead and just remove or stub out any bits of code or functions here like we could there's nothing to stop us going down and modifying so that this known sheet tools is completely empty you could modify any of the methods above but honestly since we know that this is a mono game or unity game based off of mono here a fun fact is that Unity will end up trying to run some of the regular built-in and like default functions for some of those classes that it uses like start and update any class using these mono Behavior scripts will end up calling these functions but if it doesn't exist well then it would not be able to know what code to run we could basically remove these functions start and update and then the anti-che in quotes is kind of rendered useless unless any other game object were to instantiate it on its own and we are operating under the assumption that this anti-che class just relies solely on itself there's no other functionality from other objects or other classes but at least from what we can see in the code that's a fine deduction to make here so let's rightclick and then simply edit that class once this decompiles and is up and atam well I know and I we did have some chatter on the previous video and like well honestly you could and you should probably just end up manipulating the iil or intermediary language bite code and I'll show that in just a second but kind of getting back to basics keeping what we know thus far we could just simply remove these two functions start and update once we get back to the rest of level 7 we could go ahead and chat a little bit more about the ilil code and the bite code behind it but for now let's compile save and we could see this in action we could as usual kind of follow through that process to save the module I like to call this with SL modified I know there's some chatter hey it'd be worth doing some Version Control in a GitHub repository or just having your own net loader sort of stub that might end up loading some other stuff for your own cheats in the future but for now we're keeping it with the basics this is all for the beginners at the start here cuz I'm a beginner too and you know what all right let's close out cheat engine we won't need that but if we get back to the Explorer folder we could get back to the folder for our game hacking GG move into the data directory and then just sort of hot swap our original C dll that the game loads and put in place the modified one given a copy of it since we have backed up an original that's probably fine but I think it's still good to do now we can restart the game one more time and with that we can load back into level seven cool now we can still work with the N spy do whatever we need to and try to solve this task where we're basically playing whack-a-mole right we kind of have to shoot any of these targets all within 10 seconds but that's presumably given all of them impossible for what we're asked of we're going to end up being being killed by the turret one way or another so if we look back in the end spy we can take a look to see okay what are these classes that might be pertinent to us and what we're up to you might be able to see down in the very end here there is a class called wacka and this aptly fits the situation that we're in for this level so we could dig into it and see what it's up to couple methods and functions here begin wacka spawn moles spawn mole and then on trigger enter as it actually collides with okay whether or not we are going to start the process as we walk onto that little platform that started the game and the timer for us here's end game on enable on disable this is a bit of a long one but this check win is kind of interesting because that basically defines the win functionality or the win condition right to say okay we completed the task we've successfully shot all the wack-a-mole turret things whatever we're beating up so here's the condition here you might be able to see this if statement if the spawn count and if the kill count and this spawn count is not equal to zero if the spawn count is equal to the kill count so as many as the game has spawned you have killed then it'll end up playing the sound and giving you feedback that you've completed that task and then spawning the flag in this case the mole flag otherwise it'll end up killing the player and then returning false you did not win in this check win condition so we could of course just modify the code here given this example but I did want to mention look you can do a little bit more if you want to get under the hood and work with that intermediary language I think for this case for this small simple game just for our learning it's not super duper necessary but I do want to let you know that that's totally possible rather than edit method or edit class as we've seen before you can edit I instructions and this will bring up a whole new menu for you where you get to see some of that intermediary language in the code behind it that will almost look like assembly instructions but really just the equivalent in whatever C or bite code compiled language here the lines here 9 through 16 the ones highlighted are what make up the condition that we're seeing in that if state you saw the variables referenced like the spawn count the kill count and these are all loaded with that LD load field FLD I'm thinking and you can put this side by side the original code if you want to see how that might map to hey what you're actually seeing in the C that's decompiled DN spy and IL spy and do Peak will do its best to decompile but it might not always work and especially if you're in any sort of application that will do some deobfuscation or try to mangle or mask and hide bits of the code it's worthwhile to dig into to the IL operators and this ilil code here and you can toggle these if you'd like clicking into one of those operators you can take a look at what the other options are for yourselves things like load constant integer 4 being a0o 1 2 3 Etc or anything else that it might do to load arguments or other pieces of logic really recommend you take a look at it online it's probably worth having a reference in some notes as to what all of these might do but truthfully in this case we don't really need to deal with them because we just kind of want to get rid of this condition we just want to win one way or another so basically if true just don't even have the if condition let us run the code as we have won so with that all this selected as it was I'm just going to hit delete and now it's gone basically what we've been doing in the C decompilation but I did want to squeeze in some of that IL code so folks are aware of it now you can see our code has changed to not even deal with the return false condition underneath the if statement since it would return true at the end of this we're just going to say you know what no matter what happened you win with that we basically Force the wind condition and we don't even need to shoot the moles or get shot by the turet at the end of the 10 seconds so we'll save our module same process as always just hot swap that in so we can work with it let's get into level seven here and now as we walk onto the platform start the little activity to spawn all these whack-a-mole things to shoot at doesn't matter if we actually shoot at them or not after 10 seconds when it runs that check wi condition as we saw in the code we could do whatever the heck we want but you'll see the flag has spawn just over there so we'll go grab that and complete level seven I can press I on my keyboard to open my inventory you can see the flag here nice shooting Tex fastest gun in the west and now let's go back over and fall down the rabbit hole here to get onto level eight looking good now on level eight we have an interesting setup here it says hey you apparently are the luckiest person in the world if you're so lucky it should be easy to win the lottery good luck and we're given what looks like a chest here in the middle of the map and a floating kind of display to press the E key on our keyboard so we could press e and then it spawned that thing over there and hey hanging out with our unicorn raft we could try to go collect it oh if we aren't bumped by it now in our inventory we have a fish okay easy enough let's get back to the chest we can go ahead and press e on our keyboard one more time now we have an apple good good another fish another fish we can keep spawning these as much as we would like but it looks like it just randomly gives us stuff okay a balloon another Apple a heart oh that's awesome so presumably the chest would give us the flag at some point but it doesn't and we aren't getting the right lottery numbers so to speak we don't have the chance it's not in the cards for us to actually get the flag from this but presumably it could so we could take a look at the code and try to make some sense of it but I think for our learning now we could probably level up we could try some new things get a new addition to our bag of tricks here and remember this is all an online resource if you were to go visit gam hacking. in your web browser this is the event page for the Defcon 32 competition you could download the game you could download all the info but the unity CTF guide did include some other details and even some other tools that we might be able to work with in this case melon loader and it's finally time for us to play with melon loader if you were to take a look at the hints for the levels here and again all available online on that resource gam hacking. take a look at some of the levels you could catch up to everything that we were at if you wanted to see some other ideas or some other tricks for those levels level six just previously is where it was mentioning you know what maybe you could use melon loader and even use the unity Explorer mod to be able to inspect some of the objects and see everything that's loaded into the game this is exactly what we could do for level seven but we will definitely do for level eight so you could get this resource at melon wiki. XYZ and that'll bring us to melon loader the world's first Universal mod loader for Unity games this supports il2 CPP in mono games obviously we are just working with mono thus far would really love to dig into il2cpp I know a lot of folks in the comments were thinking about that one uh I would like to Pivot to some Unreal Engine and uh real games once we're done with this series but for now hey we're having fun with unity and melon loader so look you got a couple options here you can do the automated installation or the manual installation although it does note it's highly recommended to use the automated installation when you can so if we scroll back up to the automated installation all we really need to do is download the installer go ahead and run it press select to open the game itself and then it'll automatically detect whether it's a 32-bit or 64bit game and what you might end up using for the version of unity you could specify that just as well but the automated installer makes this nice and easy for us so let's get that downloaded we can open that up and go ahead and get it started here and with that it will honestly super easy just let us select our game so we'll navigate to our game hacking GG and the game hacking GG executable once I open that it'll say look this is a 32-bit version that has autod detected that and the version of unity that it's kind of cruising through with that we can go ahead and click install and then it'll download whatever it needs to get it all set up stag in the folders and then the install is successful you might be able to see now if we go back to our game hacking GG there is a lot more in this directory here noting the melon loader other mods you might be able to use other user data user Libs Etc I would recommend you keep taking a look at the wiki though they do have a little bit more insight on maybe if you're were to play with this uh with Linux maybe for L native games or any other info some contact details and even launch arguments looks like command line arguments that allow you to do different things as it started up uh worthwhile to know but honestly that kind of tells us okay this is going to end up doing some console work right like if I were to get back to the folder and run our game at this point now it opens up melon loader which is kind of cool you can see some of the inside and look how if we were to end up running this thing with the command line now you could provide those arguments but let's exit out for now because on its own melon loader isn't all that helpful we really need the mods or really adding the capability to use melon loader but that will have created the user Libs folder if you didn't have that created prior and that will be helpful as we get our Unity Explorer up in action now if we go back to Unity Explorer go take a look at that on the GitHub repository we do have the releases that we might be able to download but there are a lot of them and that might be a little bit confusing so if I may I'd suggest look just go take a look at the readme get a little bit more insight and info on this thing it is an in-game UI or user interface for for exploring debugging and modifying IL to CPP and mono Unity games so this is awesome this is going to come in super duper handy and if we were to end up using it with melon loader like we're planning on doing all we need to do is unzip one of the release files into a folder probably the one labeled melon loader and copy the DLS into the mods folder of your melon loader mods folder copy all the DLS inside the user Libs folder into your melon loader user Libs folder nice and easy so let's go back over to the releases download the rendition that we need and then follow those instructions I want melon loader for mono download that let's go ahead and extract this and now we can put these side by side so the mods folder over for our Unity Explorer should be able to just drag that in for melon loader we'll do the very same for our user Libs just drag and drop and now this is pretty cool if we were to go open our game once again you can see all the melon loer things firing up as well as I don't know if you caught it the unity Explorer being loaded alongside the game so now when we get into action here you've got all these new menus that pop up and this is actually something you can toggle with F7 F7 on your keyboard that will display or hide and show okay the OB Explorer clipboard that you might be able to copy and paste pieces of data and info class data Etc in and out even a debug log here and of course you can drag and move and manipulate these windows however you would like but with all that said let's go ahead and dig into what would be level 8 now and let's see what it loads once we get into the scene or the map I can walk around as normal and hey kind of work with our chest as we might play the lottery see what this will spawn for us but just a fish isn't really all that helpful we can see everything that's displayed here though in the object Explorer so let's get a little bit curious and kind of treat this as more Discovery based right what else do we have present here you see chest yeah okay so we can open that up click into it and now look at the inspector that opens this is kind of awesome cuz you can totally change and manipulate what ever you want here like the position of an object its rotation its scale XYZ I want to actually do that can I make this like uh 12 for one of the axes and like double it in size what does it look like now so look at just how you can tweak and tune and play with literally anything all the data and information about the game as it's running you can see the children for an object even some of the components that it's made up of so the components have some interesting stuff here right you probably see this Lottery check and that sounds about right that sounds like something oh we might want to drill down into to if we're trying to get the chest to return a flag so I'll click into that it'll take a second to load but look at all this stuff here again please treat this as Discovery treat this as something that you just want to explore see what's available I really recommend you just kind of play with the interface see what you can toggle see what you can tweak and have a little bit of fun here note you do kind of have tabs for what you're looking at up top so if there weren't anything all that interesting in our chest uh Lottery check component there we could get out of that there's even a button activated Zone which is probably like oh as we get closer and closer to the chest being able to actually press e and like the proximity to be able to determine okay would we go follow through that functions the loot though that's dropped by the chest is probably what's interesting to us so let's dig into that as that's opened in the inspector take a look at all the properties information things that are included and as we keep scrolling down we can see anything that might be more related to loot like loot game object to loot ooh maybe it's chosen one out of a given oh table here loot table like all the possible options like loot T.O looks like it has a little bit more detail there so let me click into inspect and this is pretty sweet now we have a what is this mm more Mountains more mountains by the way if you wanted to Google one of the engines I think like some a quick and easy kit that was used to help develop the game given the models and properties and display and format and all just something to sort of streamline development but let's look at the loot t I can click into that one here and expected and maybe that'll say okay these are all the objects that could be spawned like look at this we have a maximum weight so far sort of variable weights computed objects to loot and this is something that actually is a collections so it's a big long list or an array of things that could be spawned right let's collapse that or expand that excuse me and now look at these choices here 0 to six so we're Z based but if I were to inspect any of these loot game objects let's take a look and see what we have here letting this load but oh take a look game object loot in this case it's the apple and it has like a chance percentage as to how likely that object is to be spawned even has a weight which is interesting but let's go back we can use the tab to the top here to go back to we were looking at let's go see some of the others we know the Apple spawned do we have the fish here yeah Okay cool so that index one again being zero base the fish is what another option might be given another 33% chance let's keep exploring kind of see what else we got in there we know some balloons had spawned we saw the heart how about this one oh this is our Lottery flag nice that's what we're looking for but the chance percentage is practically zero in this case 0.00 33 hm could we just like copy that object representation with the copy buttons over by the side here yep okay we can we can see that in our clipboard and maybe we could toggle or tweak some of the chance percentages just as well say it's % chance to work with maybe the game weight we could amp up like we saw for the others they were like 10,000 or whatever but honestly a little silly hack might just be kind of going back to the other objects and then just pasting in rather than it being an apple or a fish that would spawn let's tell it to drop the flag kind of Dumbo kind of cheesy but that would work right we can go back to Apple and we could do this if you wanted to for all the others but as long as you feel like you know what there's going to be a decent chance and percentage likely that the flag will spawn so with that all done let me hit F7 to get back to the game and I'll hit e to open the chest and will we get a flag or anything spawned e yep okay there's the flag we did it super easy oh it looks like I have to jump to go reach it but now you might have saw it just over on the right hand side take a look at our inventory with the I key wow wow lucky pull oh they don't know our cheats they don't know our hacks using uh Unity Explorer and melon loader to get into some cool action here so let's go down now to level 9 and please please please seriously go take a look at all the sweet stuff you can do F7 to toggle back and forth to use and Tinker with this object Explorer and unity Explorer this I think is a real game changer to be able to manipulate stuff in real time like in action while you're playing the game for Unity I do want to close all though and now let's get back to the game itself so let me hit F7 and see what we have to do for this final level level nine it says I'm done with you just race to the Finish but don't miss any coins by Okay cool so I just shift to run oh shoot it started a timer I have like 10 seconds to make it to the end of this race I don't know if that's going to happen this is looking pretty lengthy grab all these coins and I'm dead cool all right well let's restart the level and see what other things we might be able to do with our Unity Explorer now that we have F7 as the cool capability what do we we have going on what are the objects that are loaded here let's scroll down and what we might be able to do is actually change our character and make him run faster uh like holding down shift allows us to run but one trick might be able to see look are there any properties about the player I'm assuming po proof of concept character is the player itself yeah that has that tag in that layer oh dude this is where we absolutely need to make ourselves like a giant let me let me see that all right that to like 20 can we go off screen here you know what let me settle on five there we oh no okay but if we were to restart the level will those changes stay in effect no no they will not so good to know okay anything that we tweak will be for that iteration right that running execution of the level anytime that we die or have to restart we'll have to reset after all the all the changes that we would make in the unity Explorer because they're all new objects right but let's see if our little character has any of these components that we might be able to mess with oh do you see character run down there yeah that might be a fine option let me double click into that give it a chance to load and now we could see all these properties and again there are a ton of these you could keep scrolling you could explore you could see what else you might be able to mess with even functions that you could totally call like click evaluate let them run do it if you want I did see way back at the top though just about a run speed which right now now was set to the float of eight but can we set that to like 20 let's H apply F7 to hide that and now if I hold down shift whoa we're zooming oh it started the match okay uh are we going to be able to finish that I don't know uh I don't think I'm going to have the time no two seconds absolutely not I'm dead I would love to learn and seriously this is things that I don't know because I'm still trying to get smart on this I'm I am still trying to learn myself but how could we even script a lot of this tweak and tuning and kind of playing with unity Explorer and objects we might be able to work with uh based off of this info like could I just have something running in the background like external mod or whatever trainer whatever we want to call it to say look I always want my run speed to be like 30 let's hit apply but I'd love to see hey how can we bring that out of the game rather than just that interface let me try to make the race now oh I'm going to miss the coins oh no I'm just will I make it will I make it I don't think I'm going to I made it I made it I the flag spawned but I died anyway what the heck is there some other logic or some other condition that we should mess with well now we can kind of go back and forth and combine all the things that we've learned thus far using either cheat engine or using DN spy or IL spy or dot Peak or whatever other assembly manipulator that we'd like and using Unity Explorer in this little melon loader mod here we might might be able to still get it done so let's get back into DN spy and say look is there anything back in our assembly that we're working with all about our level 9 okay I see L9 finish L9 timer what do these do L9 timer is going to check if it has all the coins game object coins do all the coins make sure they're active and this is just as it starts right yeah oname end Kill player I don't think I want that can I remove that timer end we don't need to particularly mess with the timer but trigger game end doesn't sound cool granted that's just called when it ends anyway we could easily replace this right let's right click and you could replace method body with stop which is another sweet little trick that we had if you wanted to just do nothing that rightclick option will work fine kind of saves us the process of letting it decompile just backspac and stuff out small simple thing right what else can we do with L9 finish is that going to be something we should work with UNT trigger enter if it is the player if it's game over then return check in game requirements Kill player oh if they aren't met it'll kill the player otherwise all that okay no it would end up putting the flag here so that is a condition that we want but it is worried about these check game requirements that's determining if we have all the coins did we miss some does it spawn some things that I'm just not tracking maybe it weren't they weren't invisible to us so we would need to make this change hack it a little bit and kind of beat up this condition we can totally do that though like we've got that capability let's edit iil code just again get those IL instructions and then honestly just remove that condition I don't want it to kill the player though just either so let's knop those out you can see that it's now doing weird stuff because it has some leftover details there so when we move this to the side to try and see what else it kind of comparing it to and how that maps to those all op instructions then we might get a better idea we probably still want to keep the condition of colliding with the player if it's game over return I don't really need that to happen I just need it spawning the flag so can I select all of these and uh we don't need the r either removing the buol kind of processing there and triggering kill player let's just leave one load AR zero for it to be able to keep working on the stack and then all it will do is the completion feedbacks play feedback notice game over and spawn the speed flag fingers crossed let me hit okay and then we'll see how that looks let it kind of re bring it back together oh did some weird stuff on that condition okay well that is why we kind of want to get smart on the conditions of the IL instructions and op codes there right we can control Z or edit undo though if we'd ever like to go back let's start start from a different position and then try to edit the I instructions from there and we know that we're starting okay from four let's also cover everything from triggering Kill player and remove that we hit delete let's try that one click okay okay cool that's looking good if it is the player that collides with the end L9 finish in which case it will succeed play feedback game over true and spawn the flag let's try that save module and that whole rigar roll let's start the game up with melon loader hey getting Unity explore all in the mix just as well level select 9 and we can go see as we spawn let's go change our character speed remember that is the character run component that we were looking at and one of the variables or properties down here was that run speed let's amp that up to 30 click apply and then honestly I don't think we even need to catch the coins anymore right like that win condition doesn't matter anymore so let me just speedrun through some of them and will we win we win excellent the flag does not let me get it anymore though I don't die as the timer runs out so that was some good little thinking there the flag does not disappear what the heck do I have it in my inventory I do I do there's the last flag zoom zoom Money Maker excellent and there is no level 10 here at least not from what we see I will tell you though there is a level 10 and there's also another secret flag so we are not quite done with this game and the little unity game hacking that we've been doing I would like to move into some Unreal Engine Soon again as I'm trying to learn and get a little bit smarter on some of this trying to dig into hey a lot of the other resources that are out and about online I'd like to show that all to you but look we're going to take the baby steps uh crawl walk and then run if the time allows it but I hope this has been a cool showcase as we move from cheat engine to DN spy to melon loader Unity Explorer and stockpiling all these new skill sets if you haven't seen them before and if you have look please let me know give me some of the feedback on what I am doing right or wrong or otherwise or some cool tools or some other techniques some tricks that you might have up your sleeve I saw some folks mentioning something called Harmony and I know a lot of folks were saying hey we should try to dig into some IL to CPP and other works but look this is a whole new wide world for me and I'm just trying to learn and help showcase what I can figure out but hey give me all those resources and let me learn just alongside you thanks so much for watching hope you enjoyed this video please do all those YouTube algorithm things like comment subscribe and I'll see you in the next video oh but hang on before we go I want to make my character like a chuner give him five by five here does that work he's so slow now wait we can zoom zoom with the playback speed oh don't fall don't fall