0

There is a game called The Hunter, call of the Wild, in which you can spend skill points in skills.

Whenever you spend 1 skill point there is an statistics file in which 2 changes are done: the crc/checksum/whatever at the begining of the file, and a byte with the amount of skill points.

What I would like to know, is how those 4 first bytes are generated. I have tried with some CRCs, but no one fits the numbers. I saw this webpage, and I thought someone would enjoy the puzzle.

BTW, I am an experienced developer, so any piece of code in any language is welcome.

File content when 1 skill point has been spent:

11da a0ea 0000 0000 0200 0000 0000 0000
0000 0000 c659 3c1d 0200 0000 0000 0000
0000 0000 c9dd 36e4 1004 0000 0000 0000
0400 0000 0000 0000 56a0 f406 01b4 b3fc
5501 1bba 9458 0167 fc24 c001 16a0 8e28
3200 0000 0000 0000 8e21 cd06 f800 0000
0000 0000 0000 0000 0000 0000 cec5 140b
1200 0000 0000 0000 0000 0000 0000 0000
9b9d dd24 0000 0000 3979 5543 0000 0000
0000 0000 9619 9429 0000 0000 0000 0000
0000 0000 0000 0000 67ce ba38 0300 0000
0000 0000 0000 0000 0000 0000 73ab 133f
0300 0000 0000 0000 0000 0000 0000 0000
c5cc 9a56 0200 0000 0000 0000 0000 0000
0000 0000 8d58 6967 0100 0000 0000 0000
0000 0000 0000 0000 f8f9 8f6d 0000 0000
0000 0000 0000 0000 0000 0000 7833 0270
2700 0000 0000 0000 0000 0000 0000 0000
2af7 d078 0000 0000 0000 0000 0000 0000
0000 0000 7ba6 447b 1400 0000 0000 0000
0000 0000 0000 0000 f9b9 ac7d 3900 0000
0000 0000 0000 0000 0000 0000 3ce1 ae8b
0000 0000 0000 0000 0000 0000 0000 0000
2414 b28c 0400 0000 0000 0000 0000 0000
0000 0000 90d7 ea90 0b00 0000 0000 0000
0000 0000 0000 0000 73b6 8d96 0200 0000
0000 0000 0000 0000 0000 0000 6845 fa9a
0700 0000 0000 0000 0000 0000 0000 0000
6462 3b9b 0000 0000 0000 0000 0000 0000
0000 0000 72e5 169e 0200 0000 0000 0000
0000 0000 0000 0000 072a 3ca5 0100 0000
0000 0000 0000 0000 0000 0000 e3d7 a9a7
0500 0000 0000 0000 0000 0000 0000 0000
ff3b 0fb4 0000 0000 0000 0000 0000 0000
0000 0000 24d3 0abd 5500 0000 0000 0000
0000 0000 0000 0000 9fc9 3ebd 0f00 0000
0000 0000 0000 0000 0000 0000 eb83 27be
0000 0000 0000 0000 0000 0000 0000 0000
3b29 19bf 0b00 0000 0000 0000 0000 0000
0000 0000 b2ee 32c4 0000 0000 0000 0000
0000 0000 0000 0000 8c86 48cd 0100 0000
0000 0000 0000 0000 0000 0000 4c04 35ce
0000 0000 0000 0000 0e01 0000 0000 5c43
f5a1 3dce 0000 0000 0000 0000 2a00 0000
0000 e041 176c 03d0 0000 0000 0000 0000
0000 0000 0000 0000 b520 dfd5 0000 0000
0000 0000 0000 0000 0000 0000 82aa 10da
4000 0000 0000 0000 0000 0000 0000 0000
0f87 a7da 0000 0000 00f0 653e 0000 0000
0000 0000 560f fcda 0000 0000 0000 0000
0000 0000 0000 0000 9180 d8db 9792 0000
0000 0000 0000 0000 0000 0000 c6af cede
0000 0000 9ab0 3048 0000 0000 0000 0000
af6c b4e2 0500 0000 0000 0000 0000 0000
0000 0000 6b8f 98e8 1300 0000 0000 0000
0000 0000 0000 0000 584c 25e9 0200 0000
0000 0000 0000 0000 0000 0000 e52a 5ee9
0000 0000 6e52 3a48 0000 0000 0000 0000
59cb e7ea 0500 0000 0000 0000 0000 0000
0000 0000 37dd edeb 0700 0000 0000 0000
0000 0000 0000 0000 3936 b7f1 3d01 0000
0000 0000 0000 0000 0000 0000 8187 69f3
0100 0000 0000 0000 0000 0000 0000 0000
d98e c4f7 810d 0000 0000 0000 0000 0000
0000 0000 d2e7 39fa 0000 0000 00f0 653e
0000 0000 0000 0000 8b4c 4dfa 0200 0000
0000 0000 0000 0000 0000 0000 2ce8 62fc
0000 0000 0000 0000 3801 0000 0000 7843

When 2 skill points have been spent:

d624 dc73 0000 0000 0200 0000 0000 0000
0000 0000 c659 3c1d 0200 0000 0000 0000
0000 0000 c9dd 36e4 1004 0000 0000 0000
0400 0000 0000 0000 56a0 f406 01b4 b3fc
5501 1bba 9458 0167 fc24 c001 16a0 8e28
3200 0000 0000 0000 8e21 cd06 f800 0000
0000 0000 0000 0000 0000 0000 cec5 140b
1200 0000 0000 0000 0000 0000 0000 0000
9b9d dd24 0000 0000 3979 5543 0000 0000
0000 0000 9619 9429 0000 0000 0000 0000
0000 0000 0000 0000 67ce ba38 0300 0000
0000 0000 0000 0000 0000 0000 73ab 133f
0300 0000 0000 0000 0000 0000 0000 0000
c5cc 9a56 0200 0000 0000 0000 0000 0000
0000 0000 8d58 6967 0100 0000 0000 0000
0000 0000 0000 0000 f8f9 8f6d 0000 0000
0000 0000 0000 0000 0000 0000 7833 0270
2700 0000 0000 0000 0000 0000 0000 0000
2af7 d078 0000 0000 0000 0000 0000 0000
0000 0000 7ba6 447b 1400 0000 0000 0000
0000 0000 0000 0000 f9b9 ac7d 3900 0000
0000 0000 0000 0000 0000 0000 3ce1 ae8b
0000 0000 0000 0000 0000 0000 0000 0000
2414 b28c 0400 0000 0000 0000 0000 0000
0000 0000 90d7 ea90 0b00 0000 0000 0000
0000 0000 0000 0000 73b6 8d96 0200 0000
0000 0000 0000 0000 0000 0000 6845 fa9a
0700 0000 0000 0000 0000 0000 0000 0000
6462 3b9b 0000 0000 0000 0000 0000 0000
0000 0000 72e5 169e 0200 0000 0000 0000
0000 0000 0000 0000 072a 3ca5 0100 0000
0000 0000 0000 0000 0000 0000 e3d7 a9a7
0500 0000 0000 0000 0000 0000 0000 0000
ff3b 0fb4 0000 0000 0000 0000 0000 0000
0000 0000 24d3 0abd 5500 0000 0000 0000
0000 0000 0000 0000 9fc9 3ebd 0f00 0000
0000 0000 0000 0000 0000 0000 eb83 27be
0000 0000 0000 0000 0000 0000 0000 0000
3b29 19bf 0b00 0000 0000 0000 0000 0000
0000 0000 b2ee 32c4 0000 0000 0000 0000
0000 0000 0000 0000 8c86 48cd 0100 0000
0000 0000 0000 0000 0000 0000 4c04 35ce
0000 0000 0000 0000 0e01 0000 0000 5c43
f5a1 3dce 0000 0000 0000 0000 2a00 0000
0000 e041 176c 03d0 0000 0000 0000 0000
0000 0000 0000 0000 b520 dfd5 0000 0000
0000 0000 0000 0000 0000 0000 82aa 10da
4000 0000 0000 0000 0000 0000 0000 0000
0f87 a7da 0000 0000 00f0 653e 0000 0000
0000 0000 560f fcda 0000 0000 0000 0000
0000 0000 0000 0000 9180 d8db 9792 0000
0000 0000 0000 0000 0000 0000 c6af cede
0000 0000 9ab0 3048 0000 0000 0000 0000
af6c b4e2 0500 0000 0000 0000 0000 0000
0000 0000 6b8f 98e8 1300 0000 0000 0000
0000 0000 0000 0000 584c 25e9 0200 0000
0000 0000 0000 0000 0000 0000 e52a 5ee9
0000 0000 6e52 3a48 0000 0000 0000 0000
59cb e7ea 0500 0000 0000 0000 0000 0000
0000 0000 37dd edeb 0700 0000 0000 0000
0000 0000 0000 0000 3936 b7f1 3d01 0000
0000 0000 0000 0000 0000 0000 8187 69f3
0200 0000 0000 0000 0000 0000 0000 0000
d98e c4f7 810d 0000 0000 0000 0000 0000
0000 0000 d2e7 39fa 0000 0000 00f0 653e
0000 0000 0000 0000 8b4c 4dfa 0200 0000
0000 0000 0000 0000 0000 0000 2ce8 62fc
0000 0000 0000 0000 3801 0000 0000 7843

When 3 skill points have been spent:

2c46 648e 0000 0000 0200 0000 0000 0000
0000 0000 c659 3c1d 0200 0000 0000 0000
0000 0000 c9dd 36e4 1004 0000 0000 0000
0400 0000 0000 0000 56a0 f406 01b4 b3fc
5501 1bba 9458 0167 fc24 c001 16a0 8e28
3200 0000 0000 0000 8e21 cd06 f800 0000
0000 0000 0000 0000 0000 0000 cec5 140b
1200 0000 0000 0000 0000 0000 0000 0000
9b9d dd24 0000 0000 3979 5543 0000 0000
0000 0000 9619 9429 0000 0000 0000 0000
0000 0000 0000 0000 67ce ba38 0300 0000
0000 0000 0000 0000 0000 0000 73ab 133f
0300 0000 0000 0000 0000 0000 0000 0000
c5cc 9a56 0200 0000 0000 0000 0000 0000
0000 0000 8d58 6967 0100 0000 0000 0000
0000 0000 0000 0000 f8f9 8f6d 0000 0000
0000 0000 0000 0000 0000 0000 7833 0270
2700 0000 0000 0000 0000 0000 0000 0000
2af7 d078 0000 0000 0000 0000 0000 0000
0000 0000 7ba6 447b 1400 0000 0000 0000
0000 0000 0000 0000 f9b9 ac7d 3900 0000
0000 0000 0000 0000 0000 0000 3ce1 ae8b
0000 0000 0000 0000 0000 0000 0000 0000
2414 b28c 0400 0000 0000 0000 0000 0000
0000 0000 90d7 ea90 0b00 0000 0000 0000
0000 0000 0000 0000 73b6 8d96 0200 0000
0000 0000 0000 0000 0000 0000 6845 fa9a
0700 0000 0000 0000 0000 0000 0000 0000
6462 3b9b 0000 0000 0000 0000 0000 0000
0000 0000 72e5 169e 0200 0000 0000 0000
0000 0000 0000 0000 072a 3ca5 0100 0000
0000 0000 0000 0000 0000 0000 e3d7 a9a7
0500 0000 0000 0000 0000 0000 0000 0000
ff3b 0fb4 0000 0000 0000 0000 0000 0000
0000 0000 24d3 0abd 5500 0000 0000 0000
0000 0000 0000 0000 9fc9 3ebd 0f00 0000
0000 0000 0000 0000 0000 0000 eb83 27be
0000 0000 0000 0000 0000 0000 0000 0000
3b29 19bf 0b00 0000 0000 0000 0000 0000
0000 0000 b2ee 32c4 0000 0000 0000 0000
0000 0000 0000 0000 8c86 48cd 0100 0000
0000 0000 0000 0000 0000 0000 4c04 35ce
0000 0000 0000 0000 0e01 0000 0000 5c43
f5a1 3dce 0000 0000 0000 0000 2a00 0000
0000 e041 176c 03d0 0000 0000 0000 0000
0000 0000 0000 0000 b520 dfd5 0000 0000
0000 0000 0000 0000 0000 0000 82aa 10da
4000 0000 0000 0000 0000 0000 0000 0000
0f87 a7da 0000 0000 00f0 653e 0000 0000
0000 0000 560f fcda 0000 0000 0000 0000
0000 0000 0000 0000 9180 d8db 9792 0000
0000 0000 0000 0000 0000 0000 c6af cede
0000 0000 9ab0 3048 0000 0000 0000 0000
af6c b4e2 0500 0000 0000 0000 0000 0000
0000 0000 6b8f 98e8 1300 0000 0000 0000
0000 0000 0000 0000 584c 25e9 0200 0000
0000 0000 0000 0000 0000 0000 e52a 5ee9
0000 0000 6e52 3a48 0000 0000 0000 0000
59cb e7ea 0500 0000 0000 0000 0000 0000
0000 0000 37dd edeb 0700 0000 0000 0000
0000 0000 0000 0000 3936 b7f1 3d01 0000
0000 0000 0000 0000 0000 0000 8187 69f3
0300 0000 0000 0000 0000 0000 0000 0000
d98e c4f7 810d 0000 0000 0000 0000 0000
0000 0000 d2e7 39fa 0000 0000 00f0 653e
0000 0000 0000 0000 8b4c 4dfa 0200 0000
0000 0000 0000 0000 0000 0000 2ce8 62fc
0000 0000 0000 0000 3801 0000 0000 7843

Other values:

CRC         skill_points
ecd3 7c2f              0
...
7642 cf4c              4
a310 c21b              5
c99c 268f              6
Improve this question
3
  • Are you sure it is only a matter of how many skill points have been spent? Are you sure other changes to the character sheet don't change the validation code? If they do, they should be taken into consideration when understanding the validation. Additionally, when binary is available it is often recommended to reverse engineer the code in order to produce the algorithm used.
    – NirIzr
    Aug 28, 2017 at 21:59
  • It is the only change, in this file. Other files are affected but they seem to use the same CRC algorithm, so I exposed this one here because it is so simple. No code in there. It is a file that stores values. Or you mean another thing?
    – Rafa
    Aug 29, 2017 at 13:28
  • Well, I think he meant you should try to figure out how the game modifies the file.
    – Michael Pittino
    Aug 29, 2017 at 13:40

1 Answer 1

Reset to default
2

There are many ways to go about solving this, but here's how I might approach it based on a common workflow of mine for hacking games (you could say I'm the resident game-hacker around here). Before delving into it, I'll first suggest you opening the game via your debugger of choice, setting a breakpoint on File Management functions of interest, then seeing if it pops when reading that file.

That aside, I'd say to download, install (beware the additional "offers"), then open the game process with Cheat Engine.

Assuming the game loads that file into memory, you should be able to do an AOB scan to find it. Choose Array of byte from the Value Type select box, make sure the Hex checkbox is checked, then paste a string of bytes from that file into the search box. Using your example above, let's use the following selection from the 3 skill point bytes: 2C 46 64 8E 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 C6 59 3C 1D

Finally, under Memory Scan Options, make sure the Writable checkbox has the black box in it (it's a third state, not checked or unchecked). This will scan both read/write memory. Then click the First Scan button.

You should see results appear in the results list on the left. If you have more than one, then you either need to add more bytes to your search so as to make it more unique, or you'll need to figure out which of those results is the one that's written to once changes occur. There could be multiple positives, too; you'll just have to dig in.

Alright, now you have a couple of options.

First, you can double-click on any of the results from the results list and that address will move down to your address list. Then, right-click on any of those addresses in your address list and choose "Find out what writes to this address". From the resulting window that shows you instructions writing to that address, you can click on an instruction, then click the Show disassembler button. That will take you to that instruction within its respective routine.

You can then right-click on the instruction in the disassembler and set a break-and-trace. Within the results of that break-and-trace, you should you should find the routine(s) related to what's writing those values. It may not be obvious, so this is where it'll be handy for you to know Assembly and debugging.

To note, you could also find what accesses the values by instead choosing Find out what accesses this address. That will show you instructions that both read and write to a memory address.

Your second option is to right-click on any result in your results list or any address you added to your address list, then choose Browse this memory region. That will open that memory location in the Memory Viewer. The top part of the Memory Viewer is the disassembler (which you've seen already if you followed the first step). The bottom half is where you view bytes inside of memory addresses. There, you can right-click on a byte, hover over Data Breakpoint, then choose the type of breakpoint you'd like to set and proceed accordingly!

Improve this answer
2
  • I already used the cheat engine to modify the assambly code and get infinite skill points, but I did not realize that I could use it to get the code that generates the CRC. Thanks!
    – Rafa
    Aug 29, 2017 at 19:39
  • Cheat Engine is incredibly powerful and chock-full of features; however, it suffers from UI issues (not easy ones to solve, mind you, since there are countless features buried in tons of places). There isn't much CE can't do where dynamic analysis is concerned.
    – dsasmblr
    Aug 29, 2017 at 19:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.